Improper channel-identifier handling in the Linux kernel Bluetooth L2CAP stack lets an in-range peer forcibly tear down an established Enhanced Credit (ECRED) connection. Because l2cap_ecred_reconf_rsp() returns on success without clearing chan->ident, a remote peer that completed a reconfiguration can replay a failure response carrying the stale ident, causing the kernel to match and destroy the live channel with l2cap_chan_del(chan, ECONNRESET); the fix also hardens the failure path against a use-after-free. No public exploit is identified at time of analysis and EPSS risk is low (0.31%).
Use-after-free in the Linux kernel IPsec transport-mode input path (xfrm) allows a struct net pointer cached in skb->cb to be dereferenced after the associated network namespace has been torn down, because deferred reinjection via xfrm_trans_reinject() did not hold a netns reference. On affected kernels (5.6 through the fixed stable releases) this can corrupt kernel memory or crash the host when IPsec transport-mode traffic is processed during namespace destruction. No public exploit identified at time of analysis; EPSS is low (0.23%, 13th percentile) and the issue is not listed in CISA KEV.
Cross-tenant network traffic redirection in the Linux kernel's IPv6 Virtual Tunnel Interface (vti6) affects hosts running IPv6 VTI/IPsec tunnels, particularly multi-tenant container platforms. A local attacker with a user namespace can move a vti6 tunnel into their own netns via IFLA_NET_NS_FD and then issue SIOCCHGTUNNEL, exploiting an inconsistency where vti6_siocdevprivate() performs its collision lookup against dev_net(dev) while vti6_update() mutates the original creation netns hash, letting the attacker prepend their controlled device at the head of another tenant's hash bucket so that xfrm-matched packets are delivered through a device they control. It is reachable from an unprivileged user namespace and no public exploit has been identified at time of analysis; EPSS is low at 0.22%.
Denial-of-service (kernel crash) in the Linux kernel Bluetooth L2CAP subsystem lets an in-range attacker trigger memory corruption by sending a crafted Enhanced Credit-Based (ECRED) connection response that reuses an already-assigned destination CID, corrupting the list_for_each_entry_safe cursor during channel teardown. All Linux systems with Bluetooth enabled and processing LE CoC ECRED channels are affected until patched. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile); the issue is not listed in CISA KEV.
Use-after-free memory corruption in the Linux kernel's IPv6 VTI (Virtual Tunnel Interface, vti6) tunnel driver allows a local attacker with access to unprivileged user namespaces to corrupt kernel memory and crash the host or potentially escalate. The flaw arises when a vti6 tunnel device is moved between network namespaces and then reconfigured; the driver tracks the wrong namespace, leaving a stale hash entry that cleanup_net() later dereferences as freed memory. No public exploit identified at time of analysis and EPSS probability is low (0.21%), but the cross-tenant reachability on container hosts makes it a meaningful risk in multi-tenant environments.
Out-of-bounds kernel write in the Linux `wacom` HID driver affects the `wacom_hid_set_device_mode()` routine across long-lived kernel branches (5.10 through 7.x). The driver wrongly assumes the HID_DG_INPUTMODE usage always lives in the report's first field, so a HID device (Wacom-class or a device spoofing one) that places that usage in a later field with a smaller report_count triggers a write past the bounds of `r->field[0]->value`, corrupting kernel memory. No public exploit is identified at time of analysis and EPSS risk is low (0.21%, 11th percentile), consistent with a bug that requires attacker-supplied hardware rather than remote reachability.
Out-of-bounds heap read and remote kernel panic in the Linux kernel NFC HCI/HCP stack (nfc_hci_recv_from_llc() and nci_hci_data_received_cb()) let an adjacent malicious NFC peer send a crafted 0-byte HCP frame that reaches these handlers before any length check, reading packet->header past the buffer and, when the frame is queued as a non-final fragment, underflowing msg_len to UINT_MAX and forcing skb_over_panic(). No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the flaw is not in CISA KEV, so this is a proximity-limited DoS/info-leak affecting any NFC-enabled Linux device, fixed by the maintainers. Exploitation requires NFC radio range and an active NFC/HCI stack, which sharply narrows the real attack surface versus the raw 8.8 score.
Use-after-free race condition in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh-networking throughput meter (tp_meter) can corrupt kernel memory when a sender timer is re-armed after its backing reference has already been freed during cleanup. The flaw affects systems that load the batman-adv module and run tp_meter sessions; an adjacent mesh peer's ACK can race the shutdown path (batadv_tp_sender_shutdown) so that batadv_tp_reset_sender_timer() re-arms a timer whose object is gone. CVSS is rated 8.8 (AV:A), but with EPSS at 0.21% (11th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is low.
Out-of-bounds read in the Linux kernel Bluetooth HIDP (Human Interface Device Protocol) subsystem lets a paired, malicious Bluetooth peripheral send a truncated interrupt frame that hidp_input_report() parses without validating skb->len, causing the handler to read past valid skb data. The stale bytes are interpreted as phantom keystrokes or spurious mouse movement, giving an adjacent attacker a limited local input-injection/info-leak primitive. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), consistent with a niche Bluetooth-range issue rather than mass exploitation; a vendor patch is available across multiple stable branches.
Memory corruption in the Linux kernel Bluetooth ISO (Isochronous Channels) subsystem allows an attacker within Bluetooth range to trigger a use-after-free on a socket structure via a race in iso_recv_frame(), where conn->sk is read under iso_conn_lock but dereferenced after the lock drops while a concurrent iso_sock_kill() frees the socket. Successful exploitation can corrupt kernel memory when accessing sk->sk_state and sock_queue_rcv_skb(), enabling denial of service and potentially privilege escalation or code execution in kernel context. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile).
Denial-of-service and potential memory-corruption exposure in the Linux kernel Bluetooth stack (hci_sync) arises because hci_dev_close_sync() failed to set the HCI_CMD_DRAIN_WORKQUEUE flag during device close, allowing command timeouts to be queued while the hdev workqueue is being drained on the reset path. The fix, present in stable trees (6.12.93, 6.18.35, 7.0.12, 7.1), closes a race that a Bluetooth-adjacent attacker could trigger during controller reset. There is no public exploit identified at time of analysis, EPSS risk is low (0.20%), and it is not listed in CISA KEV.
Use-after-free in the Linux kernel Bluetooth HCI subsystem (hci_sync) lets a concurrent Bluetooth disconnect free an hci_conn object that hci_le_create_cis_sync() then reads via a stale pointer, producing a use-after-free read during Connected Isochronous Stream (CIS) setup. The affected code path handles LE isochronous channel creation, and the flawed cancellation logic (queuing work with data=NULL while dequeuing with data=conn) means the pending work item is never cancelled, leaving the race exploitable. There is no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is not in CISA KEV.
Time-of-check-to-time-of-use race condition in the Linux kernel's KVM AMD SEV code allows a malicious or misbehaving encrypted guest to corrupt the host's processing of Page State Change (PSC) requests by mutating the guest-accessible PSC buffer while KVM reads entries and indices from it. Because KVM read the buffer without READ_ONCE(), the compiler could reload values mid-processing, enabling a TOCTOU exploit path with a CVSS-rated scope-changed impact affecting the host beyond the guest. No public exploit has been identified at time of analysis, and the EPSS score is low (0.20%); the fix hardens the reads with READ_ONCE() to make the guest's writes irrelevant to already-validated values.
Local privilege escalation potential in the Linux kernel's DRM/GEM (Direct Rendering Manager Graphics Execution Manager) subsystem stems from a use-after-free triggered by a race in the drm_gem_change_handle_ioctl path. A local user with access to a DRM device node can race a GEM_CLOSE against a handle-change operation to drop a GEM object's reference count to zero and free it while another handle's IDR entry still points at it, yielding a dangling kernel pointer. No public exploit has been identified at time of analysis and it is not in CISA KEV; EPSS is low (0.20%, 10th percentile), consistent with a local-only race that is non-trivial to weaponize.
Improper resource validation in the Linux kernel's vfio/pci DMABUF export path (vfio/pci) allows a local user holding a VFIO device file descriptor to export and access PCI BAR (MMIO) resources that were never successfully reserved, enabling disclosure of adjacent device memory. The flaw stems from the DMABUF-creation path exporting BAR access without first confirming the resources were reserved at startup. There is no public exploit identified at time of analysis, EPSS is low (0.19%), and it is not listed in CISA KEV; the fix has been merged upstream.
Improper vector-length capping in the Linux kernel's KVM arm64 SVE handling lets a nested (L2) guest under a VHE guest hypervisor access Scalable Vector Extension vector lengths beyond its configured limit. When a guest hypervisor updates ZCR_EL2 indirectly via the untrapped ZCR_EL1 accessor, KVM restores the raw value into the physical ZCR_EL2 without capping, breaking the vector-length confinement policy. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.19%, 9th percentile); a vendor fix is available via the stable git tree.
Kernel-level out-of-bounds write in the Linux octeontx2-af driver (Marvell OcteonTX2 admin function) lets a low-privileged VF whose parent PF is in switchdev representor mode corrupt kernel memory. The rvu_mbox_handler_rep_event_notify() handler queues a sender-controlled REP_EVENT_NOTIFY body whose nested event->pcifunc is never bounds-checked, so an out-of-range index reaches rvu_get_pfvf()/rvu_get_pf() and, on RVU_EVENT_MAC_ADDR_CHANGE, becomes a six-byte attacker-chosen OOB ether_addr_copy() write in the AF worker (KASAN slab-out-of-bounds in rvu_rep_wq_handler). No public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with niche Marvell SmartNIC hardware rather than mass exposure.
Local privilege-escalation-class use-after-free in the Linux kernel's VMware VMCI vsock transport (vsock/vmci) allows a local attacker to corrupt freed socket memory by resetting a connection during the vsock handshake. When a peer sends a VMCI RST packet, vmci_transport_recv_connecting_server() incorrectly returned success (err=0), so vsock_transport_recv_listen() skipped removing the pending socket; a deferred vsock_pending_work() then double-dropped the socket reference, freeing it and writing into the freed object (KASAN slab-use-after-free). CVSS is 8.8 with a scope change, but EPSS is low (0.18%, 8th percentile) and there is no public exploit identified at time of analysis and it is not in CISA KEV.
Uninitialized kernel-memory disclosure in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh-routing module allows an adjacent mesh peer to receive leaked kernel heap contents inside translation-table (TT) response frames. The batadv_orig_node::tt_buff_len field was typed as s16 and wraps negative when a changeset exceeds 32767 bytes, so batadv_tt_prepare_tvlv_global_data() allocates a full-size buffer but populates only a small portion, transmitting the uninitialized remainder over the mesh. No public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), consistent with a niche, non-default kernel feature rather than a broadly weaponized flaw.
Incorrect error-handling in the Qualcomm MSM DRM/GPU driver (drm/msm) of the Linux kernel mishandles the return value of iommu_map_sgtable(), which was changed upstream to return a signed ssize_t with negative error codes instead of a size_t/zero. On the failure path the driver triggered a WARN rather than propagating the error, so a local user able to reach the GPU IOMMU mapping code can provoke a kernel warning and a poorly-handled error condition. This is a robustness/error-path correctness fix reported through the kernel stable process; no public exploit and no active exploitation are known (EPSS 0.18%, 8th percentile).
Use-after-free (KASAN slab-use-after-free read) in the Linux kernel's TIPC cryptographic subsystem allows freed per-netns tipc_crypto state to be dereferenced by an asynchronous decrypt completion callback. When TIPC encryption is enabled and crypto_aead_decrypt() is offloaded asynchronously (e.g. via the SIMD/cryptd wrapper), tipc_aead_decrypt() never takes a netns reference, so if the bearer's network namespace is torn down mid-flight the cryptd worker's tipc_aead_decrypt_done() reads freed memory (aead->crypto->stats, ->net, ->aead[] and the node table). There is no public exploit identified at time of analysis and it is not in CISA KEV; it was surfaced by 0sec automated security-research tooling with a KASAN reproducer, and CVSS is rated 8.8.
Out-of-bounds memory access in the Linux kernel's OCFS2 cluster filesystem allows a crafted on-disk group descriptor to trigger a use-after-free/OOB read during suballocator bitmap operations. The bug lives in ocfs2_validate_gd_parent(), which only checked bg_bits against the parent allocator's chain geometry and not against the bytes that physically fit in the group descriptor block, so a malicious bg_size/bg_bits pair drives later bitmap scans (ocfs2_find_max_contig_free_bits / ocfs2_block_group_set_bits) past bg_bitmap. It was found via KASAN and fixed upstream; no public exploit has been identified at time of analysis.
Use-after-free in the Linux kernel's batman-adv (B.A.T.M.A.N. mesh routing) multicast code lets an adjacent attacker on the mesh trigger access to freed orig_node memory, potentially disclosing kernel memory or crashing the node. The flaw stems from batadv_mcast_purge_orig() removing entries from RCU-protected hlists without waiting for a grace period, so concurrent RCU readers dereference already-freed multicast node references. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV.
Use-after-free in the Linux kernel NFC LLCP subsystem allows an adjacent attacker to corrupt kernel memory by racing a connection-complete (CC) packet against socket release in nfc_llcp_recv_cc(). Affected are kernels using the NFC Logical Link Control Protocol stack; successful exploitation of the race can yield kernel memory corruption leading to potential privilege escalation or denial of service. No public exploit identified at time of analysis, and EPSS probability is low (0.18%), consistent with a memory-safety race that is hard to trigger and requires NFC proximity.
Out-of-bounds read in the Linux kernel's KVM x86 shadow MMU allows a malicious or misbehaving guest to trigger a host kernel page fault (crash) during hugepage recovery. The flaw occurs when the KVM host recovers hugepages and queries the max mapping level for a direct shadow page whose base gfn falls outside the target memslot, causing an out-of-bounds access into the vmalloc'd lpage_info array. Rated CVSS 8.8 (local, scope-changed) but with low real-world exploitation probability (EPSS 0.17%); no public exploit and no CISA KEV listing - no public exploit identified at time of analysis.
Memory corruption in the Linux kernel's mac802154 IEEE 802.15.4 link-layer security (llsec) subsystem allows an adjacent attacker to trigger a slab use-after-free and data corruption by sending 802.15.4 frames to a host with link-layer security enabled. The llsec encrypt/decrypt routines perform in-place crypto on socket buffer data that may be shared across skb clones, so modifying it corrupts memory still referenced by other clones. No public exploit has been identified at time of analysis; EPSS is low at 0.17% (7th percentile) and the issue is not in CISA KEV, but a vendor patch is available.
Out-of-bounds memory access in the Linux kernel's ksmbd (in-kernel SMB3 server) occurs during ACL inheritance, where Owner and Group SIDs read from a parent directory's NT Security Descriptor were used without bounds validation. An authenticated SMB user able to write to a share can craft or place a malformed security descriptor so that a subsequent create operation reads past buffer boundaries, enabling kernel information disclosure and potential denial of service. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 6th percentile).
Use-after-free read in the Linux kernel's AF_UNIX stream socket handler (unix_stream_data_wait()) lets a local user leak or corrupt kernel memory state and potentially crash the system by racing a peeking recv() against a normal recv() on the same socket. The flaw affects kernels from ~6.5 onward, where unix_stream_data_wait() dereferences tail->len from an SKB read via skb_peek_tail() without a lock preventing that SKB from being concurrently dequeued and freed. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis, though the fix commit includes a race reproducer; the issue is fixed in stable releases.
Out-of-bounds kernel memory access in the Linux kernel's devmem TCP subsystem (net/devmem) allows a local, low-privileged user who can bind a dma-buf to a socket to read one slot past the tx_vec array and to desynchronize net_iov accounting from the underlying gen_pool region. The root cause is that net_devmem_bind_dmabuf() trusts dmabuf->size and sg_dma_len() to be PAGE_SIZE multiples without validating them, so a dma-buf sized N*PAGE_SIZE+r lets a sendmsg() at offset N*PAGE_SIZE pass the bounds check yet index tx_vec[N]. No public exploit is identified at time of analysis and the EPSS score is very low (0.17%, 6th percentile); the fix (reject non-page-aligned size or SG length with -EINVAL) is shipped in vendor-released patches.
Remote kernel crash in the Linux kernel's mac80211 WiFi stack affects WiFi 7 (802.11be) clients: the ieee80211_ml_epcs() handler fails to bounds-check the 4-bit link_id (0-15) extracted from an EPCS PER_STA_PROFILE subelement, but sdata->link[] holds only 15 entries (indices 0-14), so link_id=15 reads out of bounds. A connected access point can send an EPCS Enable Response action frame with link_id=15 to read a garbage pointer that bypasses the NULL check and is dereferenced in ieee80211_sta_wmm_params(), crashing the kernel. There is no public exploit identified at time of analysis, EPSS is low (0.17%), and this is a denial-of-service (kernel panic) rather than the code-execution/data-disclosure implied by the vendor CVSS.
Use-after-free read in the Linux kernel Bluetooth BNEP subsystem allows a local privileged user (CAP_NET_ADMIN) to read freed net_device memory by winning a race against concurrent teardown. Affected kernels span from 2.6.12 through the 6.x/7.x stable series until the fixed releases (e.g. 6.12.92, 6.6.142, 6.1.175, 5.15.209, 5.10.258, 6.18.34, 7.0.11, 7.1). The upstream maintainers explicitly characterize this as low practical security interest; there is no public exploit identified at time of analysis and EPSS is very low (0.17%, 6th percentile).
Memory corruption (slab use-after-free) in the Linux kernel's mac80211 wireless stack allows an adjacent attacker on an 802.11s mesh network to trigger a KASAN-detected use-after-free in the fast-RX receive path. When a unicast frame is forwarded by mesh_data and hits the no-route path, the shared skb->cb storage is freed (or zeroed) before the RX_QUEUED handler reads rate statistics from it via sta_stats_encode_rate, corrupting kernel memory. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 6th percentile); the issue is a fixed upstream bug rather than an actively exploited one.
Denial-of-service / kernel-stability defect in the Linux kernel BPF LSM subsystem allows a privileged BPF program author to attach sleepable LSM programs to the bpf_lsm_task_to_inode() and bpf_lsm_inet_conn_established() hooks, which execute in atomic contexts (under rcu_read_lock() and in softirq respectively) where sleeping is illegal. The upstream fix removes these two hooks from the sleepable-eligible set; there is no public exploit identified at time of analysis, EPSS is very low (0.16%, 6th percentile), and it is not in CISA KEV. Despite an NVD CVSS of 8.8 the real-world risk is modest because triggering requires local privilege to load BPF LSM programs.
Local privilege escalation / memory corruption in the Linux kernel's amdgpu VCE (Video Compression Engine) driver allows an unprivileged local user with access to the AMD DRM render node to trigger a bad address being written into VCE firmware. The flaw stems from the command-buffer address-patching routine accepting a partially-valid relocation where only the low or high half of an address is present, producing a malformed pointer handed to firmware. No public exploit is identified at time of analysis (EPSS 0.16%, not in CISA KEV), and vendor stable-tree patches are available across all maintained branches.
Improper memory initialization in the Linux kernel's AMD GPU driver (drm/amdgpu) allows a stale, uninitialized GART page-table entry to be speculatively loaded into the GPU TLB, causing the GPU to reference the wrong physical memory. Affected are systems running AMD GPUs on kernels before 6.1.175, 6.6.140, 6.12.90, 6.18.32 and 7.0.9; a low-privileged local user with GPU access could potentially trigger disclosure of adjacent memory or corrupt GPU address translation. No public exploit identified at time of analysis, and EPSS is low (0.16%), consistent with a hardware-specific correctness flaw rather than a mass-exploitable bug.
Missing capability check in the Linux kernel's IPv4 GRE tunnel driver (ip_gre) lets a local user with CAP_NET_ADMIN in a device's network namespace reconfigure GRE/ERSPAN tunnels that actually live in a different namespace, crossing a namespace isolation boundary. The RTM_NEWLINK changelink path validated CAP_NET_ADMIN only against dev_net(dev) and never against the tunnel's own link netns (t->net), so an operator privileged in one container/netns could rewrite tunnels belonging to another. Patched upstream; EPSS is low (0.16%) and no public exploit is identified at time of analysis.
Memory-safety defect in the Linux kernel's MediaTek mt76/mt7996 Wi-Fi driver leaves a stale WCID (wireless client ID) pointer behind when a station link is torn down in mt7996_mac_sta_deinit_link(), creating a dangling reference that can be dereferenced after the underlying station object is freed. The fix, released in stable kernels, explicitly clears the WCID pointer during link deinitialization. The NVD-assigned CVSS of 8.8 (AV:A) rates this high, though no public exploit has been identified and EPSS exploitation probability is very low (0.15%, 5th percentile).
Memory corruption in the Linux kernel mt76 WiFi driver (mt7925 chipset support) occurs because mt76_sta_add reinitializes the wcid->poll_list even though mt7925_mac_sta_add has already published the wcid, corrupting the dev->sta_poll_list linked list during station association. The flaw manifests as list_add corruption (observed on kernel 7.1-rc4 with mt7925 hardware) reachable from the RX NAPI poll path when TX status frames are processed, typically leading to a kernel panic. This is a vendor-fixed Linux stable-tree issue with no public exploit identified at time of analysis and a low EPSS score (0.15%).
Local denial of service in the Linux kernel's DRM GPU SVM helper (drm_gpusvm_helper) arises from an unbalanced notifier-lock release in drm_gpusvm_scan_mm(): an early jump to the err_free label reaches drm_gpusvm_notifier_unlock() before the matching lock is taken, tripping the kernel's 'bad unlock balance' detector. Affected recent kernels (7.0 series, fixed in 7.0.10 and 7.1) can hit this path during GPU shared-virtual-memory scanning, leading to lock-state corruption and likely a crash or hang. There is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile); the fix is upstream in the stable tree.
Information disclosure in the Linux kernel's SEV-SNP guest driver (virt/sev-guest) allows memory pages left in an indeterminate encryption state to be reclaimed by the buddy allocator, potentially exposing plaintext guest data to later allocations. When set_memory_encrypted()/set_memory_decrypted() fail partway, the caller cannot tell where they failed, so pages that may still be unencrypted were being freed for general reuse; the fix instead calls snp_leak_pages() to permanently retain them. Rated CVSS 8.7 (local, low-privilege); EPSS is low at 0.17% (7th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
Memory corruption in the Linux kernel's BPF sockmap subsystem allows a local actor to produce an inconsistent scatterlist layout via bpf_msg_push_data(). When a BPF sk_msg program inserts data into a non-first scatterlist entry, the right-fragment offset is over-advanced by the message-global insertion point instead of the fragment-local delta (start - offset), corrupting the split-buffer layout and enabling information disclosure or further memory corruption. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%, 11th percentile), and it is not listed in CISA KEV.
Memory corruption in the Linux kernel's USB MUSB OMAP2430 glue driver (drivers/usb/musb/omap2430.c) stems from a use-after-free in omap2430_probe(), where of_node_put() releases the device-tree node reference before the node is last accessed. On affected TI OMAP2430-class platforms an attacker able to influence driver probe (device bind/unbind, hotplug, or device-tree handling) could trigger access to freed kernel memory, potentially corrupting kernel state. EPSS is low (0.21%, 11th percentile) and there is no public exploit identified at time of analysis; the fix is merged upstream across multiple stable branches.
Protection-mechanism bypass in the Linux kernel's memfd file-sealing subsystem lets a local low-privileged process hold writable mappings on a memfd while still applying SEAL_WRITE via the SEAL_EXEC path, defeating the immutability guarantee that consumers rely on. Because the implied SEAL_WRITE was set after the mapping_deny_writable() check rather than before, an attacker can hand a victim (e.g. a sandbox or loader) a memfd that reports as write-sealed yet remains arbitrarily modifiable. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and this is not on CISA KEV.
Integrity-check bypass in the Linux kernel's UDF filesystem driver allows a crafted disk image to defeat descriptor CRC validation, leaving only a trivially-forgeable 8-bit tag checksum guarding descriptor parsing. Affecting the udf_read_tagged() path across kernels from 2.6.12 through 7.1 pre-patch, an attacker who can get a malicious UDF image mounted can smuggle corrupted on-disk descriptors past validation, enabling downstream memory corruption with high confidentiality, integrity, and availability impact (CVSS 8.4). No public exploit is identified at time of analysis, and EPSS is low (0.19%), consistent with a local-only, media-dependent attack surface.
Memory-corruption (double free) in the Linux kernel's qed driver (QLogic FastLinQ 40/100G Ethernet) occurs when a PF/VF CID bitmap allocation fails during qed_cxt_tables_alloc(): the error path in qed_cid_map_alloc() frees already-allocated bitmaps, and the subsequent qed_cxt_mngr_free() cleanup frees them a second time. The bug is present from the driver's introduction through v7.1-rc3 and was surfaced by an experimental kernel memory-analysis tool; no public exploit identified at time of analysis and it is not in CISA KEV. Exploitation requires the specific hardware and a triggered allocation failure, so despite the CVSS 8.4 the practical risk is limited to local denial of service on affected NIC hosts.
Use-after-free in the Linux kernel's in-kernel OpenVPN data channel offload (ovpn) TCP transport allows a local attacker to corrupt kernel memory by racing a TCP socket close against peer removal. The flaw lives in ovpn_tcp_close(), which caches a peer pointer under an RCU read lock but then escapes and dereferences sock->peer after the lock is dropped and without holding lock_sock(), so ovpn_socket_release() can free the socket concurrently. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but the CVSS 8.4 rating reflects full high impact to confidentiality, integrity, and availability if the race is won. A vendor patch is available.
AppArmor connect mediation bypass in the Linux kernel lets a confined task open outbound TCP or MPTCP connections using TCP Fast Open (MSG_FASTOPEN on sendmsg()/sendto()) even when its profile grants send but denies connect. Because apparmor_socket_sendmsg() only checked AA_MAY_SEND, the implicit connect embedded in the SYN packet escaped policy enforcement, effectively an authentication/authorization bypass of the profile. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and this is not in CISA KEV, so risk is a targeted policy-enforcement gap rather than mass exploitation.
Use-after-free in the Linux kernel's rpmsg character device driver (rpmsg_char) allows local attackers on rpmsg-enabled platforms to trigger access to freed endpoint memory during a probe-failure race. The flaw exists because rpmsg_chrdev_probe() publishes the newly allocated eptdev in the default endpoint's priv pointer before rpmsg_chrdev_eptdev_add() completes, so a failed add frees eptdev while the default endpoint can still dispatch callbacks against the stale pointer. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list; it is a defensive stable-tree fix rather than an observed in-the-wild vulnerability.
Out-of-bounds read and oversized memory allocation in the Linux kernel's Arm Firmware Framework for A-profile (FF-A) driver (drivers/firmware/arm_ffa) arises from unvalidated offset and size fields in framework notification messages placed in the shared RX buffer. Malformed firmware-supplied data can drive an OOB read during UUID parsing or an oversized kmemdup() allocation, affecting kernels from 6.15 onward on Arm systems using FF-A. Rated CVSS 8.4 (local vector); no public exploit is identified and EPSS is low (0.17%), consistent with a firmware-trust-boundary issue rather than a broadly exploitable remote flaw.
Out-of-bounds string handling in the Linux kernel RDMA subsystem (drivers/infiniband/core) allows a local actor with RDMA netlink access to trigger reads past the end of a supplied netlink attribute. The affected code declared configuration attributes as NLA_STRING and then passed them directly to strcmp()/%s formatting without guaranteeing a NUL terminator, so a crafted, unterminated attribute can cause the kernel to read adjacent memory, potentially leaking information or crashing the host. No public exploit identified at time of analysis; the fix simply switches the attributes to NLA_NUL_STRING to enforce termination.