Poisoned-pipeline (pwn request) code execution in the Meshtastic firmware repository's GitHub Actions CI allows any external user to run arbitrary code inside the project's trusted CI context prior to firmware 2.7.21.1370b23. Because main_matrix.yml (and related workflows) triggered on pull_request_target while the check, build, and build-debian-src jobs checked out and executed code from the attacker's fork with no approval gate, a pull request from an author_association of NONE automatically ran attacker-controlled files with access to repository secrets and an elevated GITHUB_TOKEN. This is CWE-94 code injection scoring CVSS 10.0; no public exploit identified at time of analysis, though a linked Google Drive writeup may contain proof-of-concept detail.
Use-after-free and refcount underflow in the Linux kernel's 9p (Plan 9) filesystem client allows a local attacker interacting with a 9p mount to corrupt kernel memory, potentially escalating privileges or crashing the system. The flaw lives in p9_client_walk(): when called with clone=false the new fid aliases oldfid, and a failed multi-component walk incorrectly drops oldfid's reference via the clunk_fid error path, freeing a fid the caller still holds. No public exploit is identified at time of analysis (a reproducer exists only 'on request'), and it is not listed in CISA KEV; the vendor-supplied CVSS of 10.0 appears substantially overstated for a bug requiring an active 9p mount.
Remote denial-of-service and slab corruption in the Linux kernel iSCSI target (LIO) subsystem affects the Text-phase command handler iscsit_handle_text_cmd(), where two latent bugs have existed since the original LIO integration (commit e48354ce078c). A CRC32C overread reads four bytes past a kzalloc'd buffer on every Text PDU when DataDigest=CRC32C is negotiated, and a stale cmd->text_in_ptr causes a double-free on ErrorRecoveryLevel>0 bad-DataDigest drops and at session teardown. On distro kernels built with CONFIG_SLAB_FREELIST_HARDENED=y (the default) the double-free becomes a remote kernel BUG(); on non-hardened builds it corrupts the slab freelist. No public exploit identified at time of analysis, though the flaw is directly reproducible under KASAN; not listed in CISA KEV and EPSS is low (0.22%).
Heap buffer overflow in the Linux kernel iSCSI target (LIO/TCM) subsystem lets a remote attacker who can reach the target's login service corrupt kernel memory during login text-key negotiation. The iscsi_encode_text_output() path performs unbounded sprintf() concatenation of "key=NotUnderstood" response records into a fixed 8 KiB login->rsp_buf, and a single Login PDU packed with ~2048 minimal unknown key/value pairs expands to roughly 32 KiB of output, producing a ~24 KiB overrun in the kmalloc-8k slab. CVSS is rated 9.8, but EPSS is low (0.22%, 13th percentile); no public exploit is identified at time of analysis and it is not on CISA KEV.
Memory-corruption/stale-pointer flaw in the Linux kernel's IPv6 extension-header processing (net/ipv6/exthdrs.c) where the network-header pointer is not refreshed after ipv6_hop_jumbo() invokes pskb_trim_rcsum(), which can reallocate or relocate the socket buffer. Affects the IPv6 hop-by-hop jumbogram code path across a very broad range of kernel versions from 2.6.12 onward, and is reachable by remote attackers sending crafted IPv6 packets; NVD scores it CVSS 9.8 but EPSS is only 0.21% (11th percentile) and there is no public exploit identified at time of analysis. The upstream fix is merged and backported to stable trees (e.g., 6.6.143, 6.1.176, 6.12.93, 5.15.210, 5.10.259).
Out-of-bounds memory access in the Linux kernel IPsec ESP output path (xfrm/esp) occurs when the out-of-place fast path appends the ESP trailer in esp_output_head() but the head-side length gate checks skb->data_len and tailen separately, while esp_output_tail() later allocates a single destination page fragment from the combined post-trailer skb->data_len. When the combined aligned length exceeds one page, skb_page_frag_refill() may return a single page while the destination scatterlist still spans the larger combined length, producing a scatter-gather over-read/over-write. Affected are kernels using ESP transforms for both IPv4 and IPv6; the fix restores the combined-length page gate. No public exploit is identified at time of analysis and EPSS risk is low (0.21%, 11th percentile).
Out-of-bounds/stale-pointer read in the Linux kernel's IPv6 extension-header parser (net/ipv6/exthdrs.c) affects systems processing IPv6 Destination Options containing the Home Address Option (HAO). After ipv6_dest_hao() invokes pskb_expand_head() on a cloned skb - which can relocate the packet buffer - ip6_parse_tlv() continues using a stale cached network-header pointer, causing trailing padding/TLVs to be parsed from freed or moved memory. This is an information-disclosure/memory-safety defect (Linux CNA tag: Information Disclosure); there is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and it is not in CISA KEV.
Heap out-of-bounds write in the Linux kernel iSCSI target (LIO) driver lets a remote attacker overflow the heap-allocated client_digest buffer by supplying an over-length BASE64-encoded CHAP_R response during login. chap_server_compute_hash() decodes up to 127 base64 characters (95 bytes) into a buffer sized to the digest (32 bytes for SHA-256, 16 for MD5), overflowing it by 63-79 bytes before the too-late length check at line 344. The input assigns CVSS 9.8; however EPSS is low (0.21%, 11th percentile), it is not in CISA KEV, and no public exploit was identified - indicating a serious memory-corruption bug that is not yet being exploited.
Kernel memory corruption and resource leakage in the Linux net/handshake subsystem stems from reversed list_splice_init() arguments in handshake_net_exit(), so pending TLS/handshake requests are never drained when a network namespace is destroyed. Fixing the splice direction then exposes a list-corruption and use-after-free race between the namespace-exit drain path and a concurrent handshake_req_cancel() (e.g. sunrpc TLS timeout), which can free a socket-backed handshake_req while it is still linked on the drain list. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile), and the record is not in CISA KEV.
Use-after-free in the Linux kernel net/handshake subsystem (kernel 6.4 through the fixed 7.x builds) lets a concurrent handshake consumer free a struct socket and its backing file while the netlink accept path (handshake_nl_accept_doit) is dereferencing them, producing a NULL pointer read or freed-memory access. The flaw is a race between handshake_req_next() dropping hn_lock and the accept side reaching FD_PREPARE(), during which tls_handshake_cancel() plus sockfd_put()/__fput_sync() can release the object. No CISA KEV listing and no public exploit identified at time of analysis; EPSS is low at 0.19% (9th percentile) and the tags classify the practical impact as Denial of Service.
Denial-of-service and memory corruption in the Linux kernel's Broadcom GENET (bcmgenet) Ethernet driver occurs when RBUF_EEE_EN and RBUF_PM_EN are set in RBUF_ENERGY_CTRL and MAC Energy-Efficient Ethernet becomes active, silently halting the RX path while the link stays up and, on some boards, triggering a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit. It affects Linux systems using Broadcom GENET NICs (e.g. Raspberry Pi 4B/BCM2711, Broadcom 4908-family SoCs), and is triggered by default now that phy_support_eee() enables EEE automatically, or on older kernels once TX LPI is enabled via ethtool. No public exploit identified at time of analysis; EPSS is low at 0.18% (8th percentile), and the CISA-KEV / attacker-controlled framing implied by the CVSS 9.8 does not match the local hardware-interaction nature of the bug.
Heap buffer overflow in the Linux kernel's batman-adv mesh networking subsystem (translation-table TVLV generation) lets the number of non-empty VLANs grow between a pre-allocation size check and the buffer fill, so a VLAN that gained its first TT entry during that window is written past the allocated buffer. The flaw affects nodes running batman-adv mesh with VLANs and can corrupt kernel heap memory, most realistically causing a crash or information leak (tagged Information Disclosure). It is not in CISA KEV, has no public exploit identified at time of analysis, and carries a low EPSS of 0.18% (8th percentile) despite the automated CVSS 9.8.
Kernel memory disclosure in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking module arises from an integer wraparound in the translation-table (TT) code, where last_changeset_len was a signed s16 that wraps negative once a changeset exceeds 32767 bytes; batadv_send_my_tt_response() then sign-extends that value and batadv_tt_prepare_tvlv_local_data() allocates a full-sized TVLV buffer while filling only a small part, emitting the uninitialized remainder onto the mesh. A remote mesh peer can thereby receive stale kernel heap contents in TT response frames, tagged by the source as Information Disclosure. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the issue is not in CISA KEV; a vendor patch is available.
Data corruption and cross-port information disclosure affects the Linux kernel's Cortina Gemini (gmac) ethernet driver, where a single static local SKB used to reassemble fragmented RX packets in gmac_rx() is shared across the SoC's two ethernet ports. On devices actively using both ports simultaneously, concurrent RX processing can race on this shared buffer, mixing packet fragments between ports; the fix makes the RX SKB a per-port structure member. EPSS is low (0.18%, 8th percentile) with no public exploit identified at time of analysis and no CISA KEV listing, indicating this is a correctness/hardening fix rather than a practically weaponizable flaw despite its assigned CVSS of 9.8.
Memory corruption in the Linux kernel's exFAT filesystem driver allows a crafted exFAT image to trigger a use-after-free in exfat_find_dir_entry(): the buffer_head backing the directory entry (bh) is released via brelse() before the fall-through TYPE_EXTEND branch still reads through the ep pointer into bh->b_data. Any system that mounts an attacker-supplied exFAT volume (e.g. a USB stick or disk image with a long filename engineered to force same-hash collisions down the TYPE_EXTEND path) is affected; the stale dereference can fault or corrupt kernel memory. No public exploit identified at time of analysis, and the input CVSS 9.8/AV:N score is not credible for a local filesystem-parsing bug that the reporter could only trigger under instrumentation (KASAN + DEBUG_PAGEALLOC with a debug invalidate_bdev()).
Use-after-free in the Linux kernel pNFS (parallel NFS) client, specifically in pnfs_update_layout(), lets a stale layout header (lo) be read by a tracepoint after pnfs_put_layout_hdr() has already freed it when execution takes the NFS_LAYOUT_RETURN branch. The flaw affects Linux NFS clients that mount pNFS-backed exports across a wide range of stable series (5.4.x, 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x and 7.x-rc). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the tags label it Information Disclosure, consistent with a tracepoint reading freed memory. The published CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) appears inflated for what is a client-side, race-dependent memory-safety bug.
Improper error-path cleanup in the Linux kernel NFS server (nfsd) lets a remote NFSv4 client crash or potentially corrupt server memory by sending a truncated SECINFO_NO_NAME operation. Because nfsd4_decode_secinfo_no_name() initializes sin_exp only after decoding sin_style, a bad-XDR failure leaves sin_exp holding stale union data from a prior operation, which the error path then passes to exp_put(). No public exploit has been identified at time of analysis; the NVD-assigned 9.8 score overstates the realistic impact, which is primarily denial of service.
Use-after-free in the Linux kernel's ksmbd (in-kernel SMB3 server) durable-handle scavenger allows a remote client interacting with SMB2 durable handles to corrupt kernel memory and free a file object still referenced by concurrent m_fp_list walkers. The flaw stems from two related races in ksmbd_durable_scavenger() - a list_head reuse that corrupts f_ci->m_fp_list and a refcount/unlink race that leaves a freed handle reachable by rename and share-mode lookups. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not in CISA KEV, so exploitation is unproven despite the NVD 9.8 rating.
Use-after-free in the Linux kernel's ixgbevf driver (Intel 82599 SR-IOV virtual-function NIC driver) occurs when the VEPA multicast source-pruning workaround frees an skb and continues the receive loop without resetting the shared skb pointer to NULL, so the next descriptor iteration calls ixgbevf_add_rx_frag() on freed memory in NAPI softirq context. The flaw is present in ixgbevf's ixgbevf_clean_rx_irq() and affects VFs running in VEPA mode on hosts using the 82599/X520 family. There is no public exploit identified at time of analysis - the bug was located by static analysis (scan_drop_continue_loops.py / semgrep) and the UAF was confirmed under KASAN only via a synthetic test module reproducing the code pattern, not against real hardware; EPSS is low (0.18%, 7th percentile) and it is not on CISA KEV.
Out-of-bounds kernel memory read in the Linux kernel's Soft-iWARP (siw) RDMA driver lets a malicious connected iWARP peer send an MPA FPDU whose 16-bit length field is smaller than the fixed DDP/RDMAP header, triggering a signed-integer underflow that propagates a negative length into skb_copy_bits() as a huge size_t, producing a multi-gigabyte use-after-free read. Affected are kernels from 5.3 up to the fixed stable releases wherever the siw module is loaded; the primary outcome is a kernel crash (denial of service) with potential exposure of adjacent kernel memory. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.18% (7th percentile), consistent with the niche siw attack surface despite the high CVSS.
Malformed packet assembly in the Linux kernel's Cortina Gemini 'gmac' Ethernet driver (drivers/net/ethernet/cortina) occurs because the RX fragment counter (frag_nr) is reset to zero between NAPI poll invocations when the RX ring buffer empties mid-assembly, leaving a partially built SKB. The realistic impact is corrupted or partially-assembled receive buffers on affected ARM SoC platforms, tagged as Information Disclosure, potentially leaking stale buffer contents or destabilizing the receive path. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the issue is not in CISA KEV, and the NVD-supplied CVSS 9.8 is almost certainly an automated over-score inconsistent with a driver-internal RX race.
Memory-safety off-by-one in the Linux kernel's TLS (kTLS) data path miscounts scatterlist entries when an sk_msg scatterlist ring wraps (sg.end < sg.start), causing tls_push_record() to place the sg_chain() continuation pointer at data[MAX_SKB_FRAGS] instead of the true last entry. On affected 5.5-through-7.x stable kernels this can corrupt or misdirect the scatterlist handed to the crypto API during TLS record transmission, with the potential for information disclosure (as tagged) or a crash. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the issue is not in CISA KEV.
Malformed scatterlist chaining in the Linux kernel TLS (kTLS) plaintext send path can hand illegal 'chain-after-chain' input to the crypto subsystem when the ring's end index is 0 while start is non-zero, because the sg_next iterator does not recursively resolve consecutive chain links. This affects the kernel's in-kernel TLS offload used by processes with TLS sockets, and is tagged as an information-disclosure issue. It is not in CISA KEV and no public exploit has been identified; EPSS is low at 0.18% (7th percentile), and a fix is available across multiple stable kernel branches.
Kernel memory corruption in the Linux netfilter SYNPROXY module (synproxy_tstamp_adjust) lets remote hosts trigger a use-after-free write against systems that deploy the SYNPROXY target for TCP SYN-flood mitigation. When processing a cloned or non-linear packet, skb_ensure_writable() reallocates and frees the old skb->head, but the code then writes the recomputed TCP checksum through a stale header pointer - landing in freed slab memory or leaving a wrong on-wire checksum. Rated CVSS 9.8 by the automated feed, but EPSS is only 0.18% (7th percentile), it is not in CISA KEV, and no public exploit identified at time of analysis.
Use-after-free in the Linux kernel IP tunnel path-MTU discovery code (iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6()) arises because ip_hdr()/ipv6_hdr() pointers were cached before an skb_cow() that can reallocate skb->head, leaving the code operating on freed memory when generating ICMP/ICMPv6 fragmentation-needed messages for tunnel traffic. On systems with IP tunnels configured, an attacker able to drive oversized traffic through the tunnel can trigger the freed-memory access, risking a kernel information leak (the issue is tagged Information Disclosure) or memory corruption/crash. No public exploit identified at time of analysis, EPSS probability is low (0.18%), and the fix is already merged across the stable trees.
Use-after-free in the Linux kernel's VXLAN tunnel driver (drivers/net/vxlan) arises because the transmit path caches the result of ip_hdr() into old_iph and reuses it after skb_tunnel_check_pmtu(), which may reallocate skb->head and invalidate that pointer. Affected are kernels from 5.9 through the fix commits (patched in 6.1.176, 6.6.143, 6.12.93, 5.15.210, 5.10.259, 6.18.35, 7.0.12 and 7.1) on hosts using VXLAN overlays; an attacker able to drive traffic through the tunnel can trigger memory corruption leading to information disclosure or a kernel crash. There is no public exploit identified at time of analysis and EPSS is low (0.18%, 7th percentile), so this is not currently associated with active exploitation despite the CVSS 9.8 rating.
Out-of-bounds heap corruption in the Linux kernel's IPv6 RPL Source Routing Header handling (net/ipv6/exthdrs.c) allows remote attackers to corrupt the routing header of forwarded packets by sending a crafted compressed SRH. The bug stems from a __u8 truncation of the computed hdrlen in ipv6_rpl_srh_decompress(): with n=127 segments the value (128*16)>>3 = 256 wraps to 0, causing the compressed header to overlap the decompressed region so ipv6_rpl_srh_compress() writes into kernel memory it should not. Rated CVSS 9.8 but EPSS is only 0.18% (7th percentile); no public exploit and no CISA KEV listing exist at time of analysis, and exploitation requires an unrealistic 127-segment header on a node with RPL source routing enabled.
Refcount race in the Linux kernel SMB/CIFS client (smb2_find_smb_sess_tcon_unlocked) leaves a tc_count increment unprotected by tc_lock, so concurrent tree-connect lookups can corrupt the tcon reference count and lead to premature free / use-after-free of the tcon object. It affects hosts that mount SMB2/SMB3 shares via the in-kernel cifs client and is a regression introduced by commit 96c4af418586 which converted tc_count locking from cifs_tcp_ses_lock to tc_lock but missed this one increment site. No public exploit is identified at time of analysis and EPSS is low (0.18%); the vendor-carried CVSS of 9.8 is auto-generated boilerplate that is not well supported by the actual local, race-conditioned nature of the bug.
Use-after-free in the Linux kernel's IPv6 In-situ OAM (IOAM) hop-by-hop option handler (ipv6_hop_ioam) lets a crafted IPv6 packet trigger access to a freed skb data buffer on hosts configured as IOAM nodes. After skb_ensure_writable() reallocates the socket buffer via pskb_expand_head(), the code refreshes the trace pointer but leaves the stale hdr pointer, so hdr->opt_len is later read from freed memory when calling ioam6_event(), enabling potential information disclosure or kernel crash. This is a resolved upstream fix with no public exploit identified at time of analysis and a low EPSS score (0.18%, 7th percentile).
Kernel-memory use-after-free in the Linux mlx5e Ethernet driver (NVIDIA/Mellanox ConnectX mlx5_core) occurs when mlx5e_tx_reporter_timeout_recover() dereferences sq->netdev after mlx5e_safe_reopen_channels() has already freed the channel and its embedded send queues during TX-timeout health recovery. Systems using mlx5 NICs are affected; the freed-pointer read can corrupt kernel state, leak kernel memory, or crash the host. No public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not in CISA KEV, so this is a reliability/hardening fix rather than an actively exploited threat despite the NVD 9.8 score.
Use-after-free in the Linux kernel's 8250_dw (Synopsys DesignWare) serial driver arises when dw8250_probe() fails during clk_notifier_register(): the already-registered 8250 port is left occupying its slot while its devm-allocated driver data is freed, leaving stale private_data and serial_in/serial_out callbacks that reference freed memory. The flaw affects kernels from 5.9 through the fixed stable releases and is tagged as an information-disclosure risk; there is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile). Despite an NVD CVSS of 9.8, exploitation is gated by a probe-failure error path in a specific UART driver, so real-world reachability is far narrower than the score implies.
Use-after-free in the Linux kernel's RDMA/rtrs (RDMA Transport) server module allows corruption of freed memory during the error-cleanup path of rtrs_srv_create_path_files(). When sysfs path-file creation partially fails, cleanup calls kobject_put() (which can free srv_path via the rtrs_srv_release callback) before rtrs_srv_destroy_once_sysfs_root_folders() dereferences that now-freed structure. Reported upstream by Linux/kernel maintainers with a vendor patch available; there is no public exploit identified and EPSS exploitation probability is low (0.17%, 7th percentile), consistent with a hard-to-reach error path in a niche subsystem rather than a broadly weaponizable flaw.
Out-of-bounds memory access in the Linux kernel's HSR (High-availability Seamless Redundancy) networking subsystem allows a crafted, truncated supervision frame to trigger an OOB read when the code accesses a TLV header that was not fully linearized into the socket buffer. The flaw affects systems running the net/hsr driver across numerous stable kernel branches (fixed in 6.1.176, 6.6.143, 6.12.93, 6.18.35 and others). No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a niche, protocol-specific attack surface rather than broad exploitation.
Use-after-free memory corruption in the Linux kernel's netfs subsystem (netfs_read_gaps()) allows local activity on network filesystem mounts (notably the cifs/SMB client) to write into a prematurely-freed sink folio. The bug arises because the sink page backing an ITER_BVEC iterator is released before the outstanding read op completes, letting the cifsd receive thread copy incoming socket data into freed memory - reproduced by KASAN on the generic/075 xfstest. There is no public exploit identified at time of analysis and EPSS risk is low (0.17%); the vendor-supplied CVSS of 9.8 (AV:N) appears inflated for what is fundamentally a local, race-dependent kernel flaw.
Use-after-free in the Linux kernel's BPF sockmap (skmsg) receive path arises when a socket is added to a BPF_SK_SKB_VERDICT sockmap before kernel TLS (kTLS) RX is configured, letting sk_psock_verdict_data_ready() drain the TCP receive queue that the TLS strparser believes it owns. The mismatch leaves the strparser's frag_list pointing at freed, psock-owned skbs, which tls_decrypt_sg() then walks, corrupting kernel memory. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis, but a kernel-space UAF with high confidentiality, integrity, and availability impact makes this a meaningful local privilege-escalation and denial-of-service risk on affected builds.
Use-after-free in the Linux kernel NFS server (nfsd) pNFS layout code allows an NFSv4.1+ client to leave a freed layout state ID published in the client's IDR when nfsd4_layout_setlease() fails, so any later IDR walk (states_show, client teardown) dereferences a dangling slab pointer. The affected component is the pNFS block/SCSI/flexfiles layout server path on kernels between commit c5c707f96fc9 and the fixed stable releases. No public exploit has been identified and it is not in CISA KEV; the practical impact is kernel memory corruption leading to crash (DoS) and possible information disclosure per the vendor tag, though the auto-assigned CVSS of 9.8 significantly overstates real-world exploitability.
Out-of-bounds memory writes in the Linux kernel's gcov code-coverage instrumentation can corrupt memory and crash the system when inflate_fast() (zlib decompression) runs concurrently on multiple CPUs, most notably during IPComp/IPsec (xfrm_input) packet decompression. GCC merges the global GCOV branch counter with loop induction variables, so simultaneous execution reloads the shared counter mid-loop and computes an index that wrote ~3.4 MB past a 65 KB buffer. This only affects kernels built with GCOV profiling enabled; there is no public exploit identified at time of analysis and EPSS is very low (0.17%).
Improper lock/softirq release ordering in the Linux kernel's netfilter nft_inner component allows a local privileged user to trigger lock imbalance and softirq state corruption via the error path, where local_bh_enable() runs before local_unlock_nested_bh(). Affected are Linux stable branches around 6.16 through pre-patch 6.18.x/7.0.x, fixed by three stable commits; no public exploit identified at time of analysis and EPSS is very low (0.17%, 6th percentile) despite the auto-assigned 9.8 CVSS. This is a defensive locking-correctness fix rather than an evidenced remote code execution primitive.
Improper error-path cleanup in the Linux kernel's netfs read subsystem (the netfslib helper used by network filesystem clients such as CIFS/SMB, AFS, Ceph and 9p) mishandles reference counting when preparation of a direct-I/O (DIO) or single-read subrequest fails after being added to the stream's subrequest list. Because the failed subrequest can still be observed by the collector while holding two outstanding references, this leads to reference mismanagement and potential use-after-free/memory disorder on the read failure path, tagged as an information-disclosure risk. The fix has been merged upstream and backported; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.17%).
A missing back-pressure flaw in the Linux kernel's netfs read path (netfs_read_to_pagecache()) fails to pause generation of new read subrequests after an already-issued subrequest fails, affecting network/cached filesystems (e.g. AFS, Ceph, CIFS/SMB, 9p, and fscache-backed mounts) built on the netfs helper library. The upstream fix has been merged and backported to stable trees; EPSS is very low (0.17%, 6th percentile) and no public exploit or CISA KEV listing exists, so this is no public exploit identified at time of analysis. Despite an NVD/CNA CVSS of 9.8, the change is a reliability/correctness fix and the supplied tag characterizes real impact as Information Disclosure rather than remote code execution.
Kernel memory corruption in the Linux iwlwifi 'mld' Wi-Fi driver occurs when AMSDU is disabled for a traffic ID and the TSO segmentation path (iwl_mld_tx_tso_segment) fails to detect the sentinel value max_tid_amsdu_len == 1, producing gso_size = 0 and exploding a single GSO skb into ~32,000 tiny segments that flood the TX ring and trigger a use-after-free (refcount underflow) in TCP's retransmit queue. Only the newer 'mld' driver is affected; the legacy 'mvm' driver is immune because it checks amsdu_enabled first. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 6th percentile), and a vendor patch is available.
TX-completion memory mishandling in the Linux kernel's Intel igc (I225/I226 2.5GbE) driver stems from igc_fpe_init_smd_frame() failing to set the tx-buffer type on SMD (Frame Preemption) frames, so a reused igc_tx_buffer can retain a stale XDP or XSK type and be freed through the wrong cleanup path. This affects local systems running an igc NIC with Frame Preemption active, and the realistic impact is memory corruption or a driver crash rather than remote compromise. No public exploit identified at time of analysis; EPSS is very low (0.17%, 6th percentile) and it is not in CISA KEV, despite the NVD-assigned 9.8 CVSS.
Kernel use-after-free in ksmbd, the Linux in-kernel SMB3 server, occurs when a durable handle reconnect succeeds but smb2_open() then hits a later error path. The cleanup logic double-frees the same ksmbd_file (once via ksmbd_fd_put and again via the non-session-aware ksmbd_put_durable_fd), freeing the file object while its volatile-id entry remains published in the session table. This dangling entry can be reused, giving a remote SMB client a path to kernel memory corruption; it is not in CISA KEV and no public exploit identified at time of analysis, with EPSS at a low 0.17%.
Data-race tearing in the Linux kernel's netfs library allows the ->remote_i_size and ->zero_point fields to be read or written non-atomically, potentially yielding torn/inconsistent file-size values for network filesystems built on netfslib (e.g., AFS, Ceph, 9p, cifs/SMB). The fix mirrors the existing i_size_read()/i_size_write() pattern, reusing the i_size seqcount under i_lock to serialize updates. Despite an input CVSS of 9.8, this is a local race-condition hardening fix with no public exploit identified at time of analysis and a low EPSS (0.16%, 6th percentile); the tag set even reclassifies impact as Information Disclosure rather than RCE.
Incorrect spinlock initialization ordering in the Linux kernel's idpf network driver (Intel Infrastructure Data Path Function) causes the PTP auxiliary worker to acquire the read_dev_clk_lock before spin_lock_init() has run, producing a lockdep 'non-static key' warning and a race on an uninitialized lock during device init/reset. This is a local kernel-driver initialization bug affecting systems using the idpf driver with PTP enabled, not a remotely reachable code-execution flaw; no public exploit identified at time of analysis and the EPSS score is negligible (0.15%). Despite an automated CVSS of 9.8, the real-world security impact is minimal and confined to hosts running specific Intel networking hardware.
Memory corruption in the Linux kernel's netfs library (introduced around v6.10) arises because netfs_retry_read_subrequests() and netfs_retry_write_stream() add new subrequests to stream->subrequests without holding the stream lock, creating a race on the shared list during I/O retry. The flaw affects systems using netfs-backed network filesystems (e.g. AFS, Ceph, CIFS/SMB, 9p) and can lead to list corruption, information disclosure, or a crash when concurrent retries mutate the list. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.15%), consistent with a hard-to-trigger local kernel race rather than a remotely weaponizable bug.
Memory-ordering defect in the Linux kernel's netfs (network filesystem helper) subsystem allows the lockless readers netfs_collect_read_results() and netfs_collect_write_results() to observe a subrequest pointer before the NETFS_SREQ_IN_PROGRESS flag and other subreq state are guaranteed visible, causing races on stream->subrequests. The flaw affects kernels from 6.10 onward that use netfs-backed filesystems (CIFS/SMB, AFS, Ceph, 9p) and can lead to stale-state reads, information disclosure, or instability during concurrent I/O collection. There is no public exploit identified at time of analysis, EPSS is very low (0.15%, 5th percentile), and it is not on CISA KEV; the upstream fix is available in stable git.
An uninitialized-memory read in the Airoha ethernet driver (airoha_dev_xmit) of the Linux kernel affects systems using MediaTek/Airoha EN7581-class networking SoCs, where the transmit loop reads a fragment address and length on its final iteration before that descriptor data is initialized. Although the read values are never consumed, the access itself is unsafe and can trigger a page fault, potentially crashing the kernel during packet transmission. EPSS is low (0.15%, 5th percentile), there is no public exploit identified at time of analysis, and it is not listed in CISA KEV. Note: the auto-assigned CVSS of 9.8 (AV:N/C:H/I:H/A:H) appears substantially inflated for what is a local transmit-path bug with availability-only impact.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_schoolyr.php endpoint to unauthenticated remote database manipulation via an unsanitized ID parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or complexity barrier, and publicly available exploit code exists, referenced on GitHub. While KEV listing is absent and per-CIA impact is rated Low across all pillars, the combination of zero-barrier remote access and a live POC makes this a credible threat for any internet-exposed instance.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject.php` endpoint to unauthenticated remote exploitation via the unsanitized `id` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network access with no authentication or user interaction required against default installations. A public proof-of-concept exploit has been disclosed on GitHub, substantially lowering the skill threshold for exploitation; however, this vulnerability is not currently listed in CISA KEV, so confirmed active exploitation has not been established.