Unauthenticated remote access to the project upload endpoint in Gerapy up to 0.9.13 is possible because the `@permission_classes([IsAuthenticated])` decorator was commented out in `gerapy/server/core/views.py`, permitting any network-reachable attacker to submit arbitrary zip archives without credentials. Source code review of patch commit bd4891c6 (PR #319) reveals that the same unpatched endpoint also contained a Zip Slip (path traversal) flaw in the archive extraction logic, meaning the combined exposure allows unauthenticated arbitrary file writes to any path the Gerapy process can reach. A public proof-of-concept has been disclosed via GitHub issue #317; this CVE is not currently listed in the CISA KEV catalog.
Missing authentication on the AjaxAdmin AJAX endpoint in newpanjing simpleui 2026.01.13 allows unauthenticated remote attackers to invoke privileged Django admin actions via the `self.get_action` function in `simpleui/admin.py`. A public proof-of-concept exploit exists on GitHub (issue #537), and the vendor has not responded to the disclosure, leaving the vulnerability unpatched. No active exploitation confirmed by CISA KEV, but the combination of PR:N network exposure and available POC makes any internet-facing deployment immediately actionable by low-skill attackers.
Missing authorization in the OAuth Credential Revoke Handler of geex-arts django-jet (versions up to 1.0.8) permits remote unauthenticated actors to revoke OAuth credentials without any access control check. The CVSS 4.0 vector (PR:N/UI:N) confirms no privileges or user interaction are required, and a public exploit exists (E:P). The project maintainer has not responded to the responsible disclosure, meaning no patch is available and no vendor advisory has been issued.
Information disclosure in zevorn's rt-claw (all versions up to 0.2.0) is reachable remotely through manipulation of the claw_net_get and claw_net_post HTTP request functions in claw/services/tools/net.c, exposing sensitive data to unauthenticated network attackers. Publicly available exploit code exists (via GitHub issue #136), raising the practical exploitation threshold significantly. No vendor patch has been released; the project maintainer has not responded to the responsible disclosure report, leaving all deployed instances unmitigated.
Incorrect authorization in zevorn rt-claw up to version 0.2.0 permits remote unauthenticated attackers to invoke privileged RPC functions without valid credentials. The flaw resides in the `claw_tool_invoke` function within the swarm service RPC Handler (`claw/services/swarm/swarm.c`), where authorization checks are insufficiently enforced, enabling authentication bypass. A publicly available proof-of-concept exploit exists via GitHub issue #133; no patch has been released and the project maintainer has not responded to the disclosure.
Predictable TCP Initial Sequence Number (ISN) generation in the Linux kernel's TCP stack (introduced in 6.10) stems from a stale per-CPU tcp_tw_isn value leaking between packets. A regression moved the TIME_WAIT-derived ISN from the per-skb control block to a per-CPU variable on the assumption it would always be consumed by the same packet; when that packet is instead dropped on any of several intermediate paths, the value persists and the next SYN handled on that CPU inherits a non-zero, potentially predictable ISN, weakening TCP connection integrity. NVD assigns CVSS 9.4, but EPSS is low at 0.17% (6th percentile), there is no public exploit identified at time of analysis, and it is not in CISA KEV.
Improper page-cache modification in the Linux kernel's sk_msg (sockmap/BPF SK_MSG) subsystem allows an attacker who can attach SK_MSG BPF programs to expose externally-backed scatterlist pages as writable BPF ctx->data. Because the sg.copy ownership bitmap was not kept in sync when sk_msg entries are moved, split, shifted, or copied across transforms (BPF pull/push/pop, sk_msg_shift_left/right, sk_msg_xfer, and tls_split_open_record), a splice- or file-page-cache-backed entry could arrive at a new slot with a cleared copy bit and then be modified via BPF stores, corrupting the original page cache. There is no public exploit identified at time of analysis and the EPSS score is very low (0.16%), consistent with a subtle in-kernel logic bug rather than a widely-weaponized flaw.
Host-side buffer overflow in the Linux kernel's KVM AMD SEV/SEV-ES support (arch/x86/kvm/svm/sev.c GHCB handling) lets a malicious or compromised confidential guest corrupt host memory by abusing Page State Change (PSC) requests. KVM miscomputes the maximum length of the in-GHCB scratch area, treating the guest-supplied @len as the buffer's full size when for PSC it is only a minimum, allowing a guest to drive writes past the shared GHCB buffer. Rated CVSS 9.3 for a scope-changed guest-to-host escape; no public exploit is identified at time of analysis and EPSS is low (0.22%), but a vendor patch is available across multiple stable branches.
Improper handling of zero-length Port I/O (PIO) requests in the Linux kernel's KVM AMD SEV/SEV-ES support allows a malicious confidential-computing guest to reach a length-underflow path when the hypervisor sets up the GHCB software scratch area. No public exploit has been identified at time of analysis and it is not on CISA KEV, though a vendor (upstream) patch is available. Despite a headline CVSS of 9.3, EPSS is only 0.20% (10th percentile), and the fix itself is a defensive hardening that ignores len/count '0' PIO to prevent length underflow.
Out-of-bounds memory access in the Linux kernel's KVM AMD SEV-SNP subsystem allows a malicious or compromised confidential-computing guest to read or corrupt host hypervisor memory by supplying a Page State Change (PSC) request whose buffer pointer is not aligned to the start of the GHCB shared buffer. The flaw affects KVM hosts running SEV-SNP guests on kernels from 6.11 onward and carries a high CVSS of 9.3 (AV:L/S:C) reflecting a guest-to-host boundary crossing. EPSS is low (0.20%, 10th percentile), it is not on CISA KEV, and no public exploit has been identified at time of analysis; a vendor fix is available in the stable trees.
Kernel memory corruption in the Linux MANA (Microsoft Azure Network Adapter) driver lets a malicious or compromised hypervisor bypass a bounds check via a time-of-check/time-of-use double-fetch of hwc_msg_id from a shared DMA buffer. In a Confidential VM (SEV-SNP/TDX), DMA-coherent memory is unencrypted and host-visible, so the host can alter the message ID after mana_hwc_rx_event_handler() validates it but before mana_hwc_handle_resp() re-reads it for test_bit() and pointer arithmetic, driving an out-of-bounds access in guest kernel memory. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and it is not in CISA KEV.
Kernel memory corruption in the Linux arm_ffa (Arm Firmware Framework for A-profile) driver allows a local attacker to trigger a use-after-free by racing notifier unregistration against active notification delivery, affecting Arm systems running kernels from 6.15 up to the fixed 6.18.34/7.0.11 releases. Both the framework and non-framework notification handlers looked up a callback under notify_lock, dropped the lock, then dereferenced a notifier entry that a concurrent unregister could have already freed. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and it is not listed in CISA KEV.
Out-of-bounds array access in the Linux kernel's Microsoft Azure Network Adapter (mana) driver lets a malicious hypervisor corrupt guest kernel memory within Confidential VMs. In mana_hwc_rx_event_handler(), the rx_req_idx index is read from host-shared DMA-coherent memory (a WQE's sge->address) without a bounds check, so in SEV-SNP/TDX guests the untrusted host can steer the index to read/write past the reqs[] array. There is no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a defense-in-depth hardening fix for the confidential-computing threat model rather than an actively exploited flaw.
Out-of-bounds memory access in the Linux kernel's IP tunnel path-MTU discovery code (iptunnel_pmtud_check_icmp) affects IPv4 tunnel interfaces where the function may run on packets whose skb transport header is unset, causing an ~65535-byte offset read past the linear buffer. Remote attackers can trigger this by sending crafted ICMP traffic to a tunnel endpoint, potentially leaking adjacent kernel memory or crashing the host (denial of service). This is a supplier-reported (Linux stable) fix with no public exploit identified at time of analysis and a low EPSS score of 0.18%.
Out-of-bounds host memory access in the Linux kernel's arm64 KVM virtual ITS (vgic-its) subsystem allows a local user driving the VM migration/restore path to disclose kernel memory and crash the host. The flaw lets userspace restore an ITS Device Table Entry (DTE) whose Size field encodes more EventID bits than the virtual ITS supports; vgic_its_restore_dte() stores this out-of-range num_eventid_bits, which later produces an oversized scan_its_table() range. It carries a high CVSS (9.0) but a very low EPSS (0.18%), with no public exploit identified at time of analysis and no CISA KEV listing.
Improper channel-identifier handling in the Linux kernel Bluetooth L2CAP stack lets an in-range peer forcibly tear down an established Enhanced Credit (ECRED) connection. Because l2cap_ecred_reconf_rsp() returns on success without clearing chan->ident, a remote peer that completed a reconfiguration can replay a failure response carrying the stale ident, causing the kernel to match and destroy the live channel with l2cap_chan_del(chan, ECONNRESET); the fix also hardens the failure path against a use-after-free. No public exploit is identified at time of analysis and EPSS risk is low (0.31%).
Use-after-free in the Linux kernel IPsec transport-mode input path (xfrm) allows a struct net pointer cached in skb->cb to be dereferenced after the associated network namespace has been torn down, because deferred reinjection via xfrm_trans_reinject() did not hold a netns reference. On affected kernels (5.6 through the fixed stable releases) this can corrupt kernel memory or crash the host when IPsec transport-mode traffic is processed during namespace destruction. No public exploit identified at time of analysis; EPSS is low (0.23%, 13th percentile) and the issue is not listed in CISA KEV.
Cross-tenant network traffic redirection in the Linux kernel's IPv6 Virtual Tunnel Interface (vti6) affects hosts running IPv6 VTI/IPsec tunnels, particularly multi-tenant container platforms. A local attacker with a user namespace can move a vti6 tunnel into their own netns via IFLA_NET_NS_FD and then issue SIOCCHGTUNNEL, exploiting an inconsistency where vti6_siocdevprivate() performs its collision lookup against dev_net(dev) while vti6_update() mutates the original creation netns hash, letting the attacker prepend their controlled device at the head of another tenant's hash bucket so that xfrm-matched packets are delivered through a device they control. It is reachable from an unprivileged user namespace and no public exploit has been identified at time of analysis; EPSS is low at 0.22%.
Denial-of-service (kernel crash) in the Linux kernel Bluetooth L2CAP subsystem lets an in-range attacker trigger memory corruption by sending a crafted Enhanced Credit-Based (ECRED) connection response that reuses an already-assigned destination CID, corrupting the list_for_each_entry_safe cursor during channel teardown. All Linux systems with Bluetooth enabled and processing LE CoC ECRED channels are affected until patched. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile); the issue is not listed in CISA KEV.
Use-after-free memory corruption in the Linux kernel's IPv6 VTI (Virtual Tunnel Interface, vti6) tunnel driver allows a local attacker with access to unprivileged user namespaces to corrupt kernel memory and crash the host or potentially escalate. The flaw arises when a vti6 tunnel device is moved between network namespaces and then reconfigured; the driver tracks the wrong namespace, leaving a stale hash entry that cleanup_net() later dereferences as freed memory. No public exploit identified at time of analysis and EPSS probability is low (0.21%), but the cross-tenant reachability on container hosts makes it a meaningful risk in multi-tenant environments.
Out-of-bounds kernel write in the Linux `wacom` HID driver affects the `wacom_hid_set_device_mode()` routine across long-lived kernel branches (5.10 through 7.x). The driver wrongly assumes the HID_DG_INPUTMODE usage always lives in the report's first field, so a HID device (Wacom-class or a device spoofing one) that places that usage in a later field with a smaller report_count triggers a write past the bounds of `r->field[0]->value`, corrupting kernel memory. No public exploit is identified at time of analysis and EPSS risk is low (0.21%, 11th percentile), consistent with a bug that requires attacker-supplied hardware rather than remote reachability.
Out-of-bounds heap read and remote kernel panic in the Linux kernel NFC HCI/HCP stack (nfc_hci_recv_from_llc() and nci_hci_data_received_cb()) let an adjacent malicious NFC peer send a crafted 0-byte HCP frame that reaches these handlers before any length check, reading packet->header past the buffer and, when the frame is queued as a non-final fragment, underflowing msg_len to UINT_MAX and forcing skb_over_panic(). No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the flaw is not in CISA KEV, so this is a proximity-limited DoS/info-leak affecting any NFC-enabled Linux device, fixed by the maintainers. Exploitation requires NFC radio range and an active NFC/HCI stack, which sharply narrows the real attack surface versus the raw 8.8 score.
Use-after-free race condition in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh-networking throughput meter (tp_meter) can corrupt kernel memory when a sender timer is re-armed after its backing reference has already been freed during cleanup. The flaw affects systems that load the batman-adv module and run tp_meter sessions; an adjacent mesh peer's ACK can race the shutdown path (batadv_tp_sender_shutdown) so that batadv_tp_reset_sender_timer() re-arms a timer whose object is gone. CVSS is rated 8.8 (AV:A), but with EPSS at 0.21% (11th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is low.
Out-of-bounds read in the Linux kernel Bluetooth HIDP (Human Interface Device Protocol) subsystem lets a paired, malicious Bluetooth peripheral send a truncated interrupt frame that hidp_input_report() parses without validating skb->len, causing the handler to read past valid skb data. The stale bytes are interpreted as phantom keystrokes or spurious mouse movement, giving an adjacent attacker a limited local input-injection/info-leak primitive. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), consistent with a niche Bluetooth-range issue rather than mass exploitation; a vendor patch is available across multiple stable branches.
Memory corruption in the Linux kernel Bluetooth ISO (Isochronous Channels) subsystem allows an attacker within Bluetooth range to trigger a use-after-free on a socket structure via a race in iso_recv_frame(), where conn->sk is read under iso_conn_lock but dereferenced after the lock drops while a concurrent iso_sock_kill() frees the socket. Successful exploitation can corrupt kernel memory when accessing sk->sk_state and sock_queue_rcv_skb(), enabling denial of service and potentially privilege escalation or code execution in kernel context. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile).
Denial-of-service and potential memory-corruption exposure in the Linux kernel Bluetooth stack (hci_sync) arises because hci_dev_close_sync() failed to set the HCI_CMD_DRAIN_WORKQUEUE flag during device close, allowing command timeouts to be queued while the hdev workqueue is being drained on the reset path. The fix, present in stable trees (6.12.93, 6.18.35, 7.0.12, 7.1), closes a race that a Bluetooth-adjacent attacker could trigger during controller reset. There is no public exploit identified at time of analysis, EPSS risk is low (0.20%), and it is not listed in CISA KEV.
Use-after-free in the Linux kernel Bluetooth HCI subsystem (hci_sync) lets a concurrent Bluetooth disconnect free an hci_conn object that hci_le_create_cis_sync() then reads via a stale pointer, producing a use-after-free read during Connected Isochronous Stream (CIS) setup. The affected code path handles LE isochronous channel creation, and the flawed cancellation logic (queuing work with data=NULL while dequeuing with data=conn) means the pending work item is never cancelled, leaving the race exploitable. There is no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is not in CISA KEV.
Time-of-check-to-time-of-use race condition in the Linux kernel's KVM AMD SEV code allows a malicious or misbehaving encrypted guest to corrupt the host's processing of Page State Change (PSC) requests by mutating the guest-accessible PSC buffer while KVM reads entries and indices from it. Because KVM read the buffer without READ_ONCE(), the compiler could reload values mid-processing, enabling a TOCTOU exploit path with a CVSS-rated scope-changed impact affecting the host beyond the guest. No public exploit has been identified at time of analysis, and the EPSS score is low (0.20%); the fix hardens the reads with READ_ONCE() to make the guest's writes irrelevant to already-validated values.
Local privilege escalation potential in the Linux kernel's DRM/GEM (Direct Rendering Manager Graphics Execution Manager) subsystem stems from a use-after-free triggered by a race in the drm_gem_change_handle_ioctl path. A local user with access to a DRM device node can race a GEM_CLOSE against a handle-change operation to drop a GEM object's reference count to zero and free it while another handle's IDR entry still points at it, yielding a dangling kernel pointer. No public exploit has been identified at time of analysis and it is not in CISA KEV; EPSS is low (0.20%, 10th percentile), consistent with a local-only race that is non-trivial to weaponize.
Improper resource validation in the Linux kernel's vfio/pci DMABUF export path (vfio/pci) allows a local user holding a VFIO device file descriptor to export and access PCI BAR (MMIO) resources that were never successfully reserved, enabling disclosure of adjacent device memory. The flaw stems from the DMABUF-creation path exporting BAR access without first confirming the resources were reserved at startup. There is no public exploit identified at time of analysis, EPSS is low (0.19%), and it is not listed in CISA KEV; the fix has been merged upstream.
Improper vector-length capping in the Linux kernel's KVM arm64 SVE handling lets a nested (L2) guest under a VHE guest hypervisor access Scalable Vector Extension vector lengths beyond its configured limit. When a guest hypervisor updates ZCR_EL2 indirectly via the untrapped ZCR_EL1 accessor, KVM restores the raw value into the physical ZCR_EL2 without capping, breaking the vector-length confinement policy. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.19%, 9th percentile); a vendor fix is available via the stable git tree.
Kernel-level out-of-bounds write in the Linux octeontx2-af driver (Marvell OcteonTX2 admin function) lets a low-privileged VF whose parent PF is in switchdev representor mode corrupt kernel memory. The rvu_mbox_handler_rep_event_notify() handler queues a sender-controlled REP_EVENT_NOTIFY body whose nested event->pcifunc is never bounds-checked, so an out-of-range index reaches rvu_get_pfvf()/rvu_get_pf() and, on RVU_EVENT_MAC_ADDR_CHANGE, becomes a six-byte attacker-chosen OOB ether_addr_copy() write in the AF worker (KASAN slab-out-of-bounds in rvu_rep_wq_handler). No public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with niche Marvell SmartNIC hardware rather than mass exposure.
Local privilege-escalation-class use-after-free in the Linux kernel's VMware VMCI vsock transport (vsock/vmci) allows a local attacker to corrupt freed socket memory by resetting a connection during the vsock handshake. When a peer sends a VMCI RST packet, vmci_transport_recv_connecting_server() incorrectly returned success (err=0), so vsock_transport_recv_listen() skipped removing the pending socket; a deferred vsock_pending_work() then double-dropped the socket reference, freeing it and writing into the freed object (KASAN slab-use-after-free). CVSS is 8.8 with a scope change, but EPSS is low (0.18%, 8th percentile) and there is no public exploit identified at time of analysis and it is not in CISA KEV.
Uninitialized kernel-memory disclosure in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh-routing module allows an adjacent mesh peer to receive leaked kernel heap contents inside translation-table (TT) response frames. The batadv_orig_node::tt_buff_len field was typed as s16 and wraps negative when a changeset exceeds 32767 bytes, so batadv_tt_prepare_tvlv_global_data() allocates a full-size buffer but populates only a small portion, transmitting the uninitialized remainder over the mesh. No public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), consistent with a niche, non-default kernel feature rather than a broadly weaponized flaw.
Incorrect error-handling in the Qualcomm MSM DRM/GPU driver (drm/msm) of the Linux kernel mishandles the return value of iommu_map_sgtable(), which was changed upstream to return a signed ssize_t with negative error codes instead of a size_t/zero. On the failure path the driver triggered a WARN rather than propagating the error, so a local user able to reach the GPU IOMMU mapping code can provoke a kernel warning and a poorly-handled error condition. This is a robustness/error-path correctness fix reported through the kernel stable process; no public exploit and no active exploitation are known (EPSS 0.18%, 8th percentile).
Use-after-free (KASAN slab-use-after-free read) in the Linux kernel's TIPC cryptographic subsystem allows freed per-netns tipc_crypto state to be dereferenced by an asynchronous decrypt completion callback. When TIPC encryption is enabled and crypto_aead_decrypt() is offloaded asynchronously (e.g. via the SIMD/cryptd wrapper), tipc_aead_decrypt() never takes a netns reference, so if the bearer's network namespace is torn down mid-flight the cryptd worker's tipc_aead_decrypt_done() reads freed memory (aead->crypto->stats, ->net, ->aead[] and the node table). There is no public exploit identified at time of analysis and it is not in CISA KEV; it was surfaced by 0sec automated security-research tooling with a KASAN reproducer, and CVSS is rated 8.8.
Out-of-bounds memory access in the Linux kernel's OCFS2 cluster filesystem allows a crafted on-disk group descriptor to trigger a use-after-free/OOB read during suballocator bitmap operations. The bug lives in ocfs2_validate_gd_parent(), which only checked bg_bits against the parent allocator's chain geometry and not against the bytes that physically fit in the group descriptor block, so a malicious bg_size/bg_bits pair drives later bitmap scans (ocfs2_find_max_contig_free_bits / ocfs2_block_group_set_bits) past bg_bitmap. It was found via KASAN and fixed upstream; no public exploit has been identified at time of analysis.
Use-after-free in the Linux kernel's batman-adv (B.A.T.M.A.N. mesh routing) multicast code lets an adjacent attacker on the mesh trigger access to freed orig_node memory, potentially disclosing kernel memory or crashing the node. The flaw stems from batadv_mcast_purge_orig() removing entries from RCU-protected hlists without waiting for a grace period, so concurrent RCU readers dereference already-freed multicast node references. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV.
Use-after-free in the Linux kernel NFC LLCP subsystem allows an adjacent attacker to corrupt kernel memory by racing a connection-complete (CC) packet against socket release in nfc_llcp_recv_cc(). Affected are kernels using the NFC Logical Link Control Protocol stack; successful exploitation of the race can yield kernel memory corruption leading to potential privilege escalation or denial of service. No public exploit identified at time of analysis, and EPSS probability is low (0.18%), consistent with a memory-safety race that is hard to trigger and requires NFC proximity.
Out-of-bounds read in the Linux kernel's KVM x86 shadow MMU allows a malicious or misbehaving guest to trigger a host kernel page fault (crash) during hugepage recovery. The flaw occurs when the KVM host recovers hugepages and queries the max mapping level for a direct shadow page whose base gfn falls outside the target memslot, causing an out-of-bounds access into the vmalloc'd lpage_info array. Rated CVSS 8.8 (local, scope-changed) but with low real-world exploitation probability (EPSS 0.17%); no public exploit and no CISA KEV listing - no public exploit identified at time of analysis.
Memory corruption in the Linux kernel's mac802154 IEEE 802.15.4 link-layer security (llsec) subsystem allows an adjacent attacker to trigger a slab use-after-free and data corruption by sending 802.15.4 frames to a host with link-layer security enabled. The llsec encrypt/decrypt routines perform in-place crypto on socket buffer data that may be shared across skb clones, so modifying it corrupts memory still referenced by other clones. No public exploit has been identified at time of analysis; EPSS is low at 0.17% (7th percentile) and the issue is not in CISA KEV, but a vendor patch is available.
Out-of-bounds memory access in the Linux kernel's ksmbd (in-kernel SMB3 server) occurs during ACL inheritance, where Owner and Group SIDs read from a parent directory's NT Security Descriptor were used without bounds validation. An authenticated SMB user able to write to a share can craft or place a malformed security descriptor so that a subsequent create operation reads past buffer boundaries, enabling kernel information disclosure and potential denial of service. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 6th percentile).
Use-after-free read in the Linux kernel's AF_UNIX stream socket handler (unix_stream_data_wait()) lets a local user leak or corrupt kernel memory state and potentially crash the system by racing a peeking recv() against a normal recv() on the same socket. The flaw affects kernels from ~6.5 onward, where unix_stream_data_wait() dereferences tail->len from an SKB read via skb_peek_tail() without a lock preventing that SKB from being concurrently dequeued and freed. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis, though the fix commit includes a race reproducer; the issue is fixed in stable releases.
Out-of-bounds kernel memory access in the Linux kernel's devmem TCP subsystem (net/devmem) allows a local, low-privileged user who can bind a dma-buf to a socket to read one slot past the tx_vec array and to desynchronize net_iov accounting from the underlying gen_pool region. The root cause is that net_devmem_bind_dmabuf() trusts dmabuf->size and sg_dma_len() to be PAGE_SIZE multiples without validating them, so a dma-buf sized N*PAGE_SIZE+r lets a sendmsg() at offset N*PAGE_SIZE pass the bounds check yet index tx_vec[N]. No public exploit is identified at time of analysis and the EPSS score is very low (0.17%, 6th percentile); the fix (reject non-page-aligned size or SG length with -EINVAL) is shipped in vendor-released patches.
Remote kernel crash in the Linux kernel's mac80211 WiFi stack affects WiFi 7 (802.11be) clients: the ieee80211_ml_epcs() handler fails to bounds-check the 4-bit link_id (0-15) extracted from an EPCS PER_STA_PROFILE subelement, but sdata->link[] holds only 15 entries (indices 0-14), so link_id=15 reads out of bounds. A connected access point can send an EPCS Enable Response action frame with link_id=15 to read a garbage pointer that bypasses the NULL check and is dereferenced in ieee80211_sta_wmm_params(), crashing the kernel. There is no public exploit identified at time of analysis, EPSS is low (0.17%), and this is a denial-of-service (kernel panic) rather than the code-execution/data-disclosure implied by the vendor CVSS.
Use-after-free read in the Linux kernel Bluetooth BNEP subsystem allows a local privileged user (CAP_NET_ADMIN) to read freed net_device memory by winning a race against concurrent teardown. Affected kernels span from 2.6.12 through the 6.x/7.x stable series until the fixed releases (e.g. 6.12.92, 6.6.142, 6.1.175, 5.15.209, 5.10.258, 6.18.34, 7.0.11, 7.1). The upstream maintainers explicitly characterize this as low practical security interest; there is no public exploit identified at time of analysis and EPSS is very low (0.17%, 6th percentile).
Memory corruption (slab use-after-free) in the Linux kernel's mac80211 wireless stack allows an adjacent attacker on an 802.11s mesh network to trigger a KASAN-detected use-after-free in the fast-RX receive path. When a unicast frame is forwarded by mesh_data and hits the no-route path, the shared skb->cb storage is freed (or zeroed) before the RX_QUEUED handler reads rate statistics from it via sta_stats_encode_rate, corrupting kernel memory. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 6th percentile); the issue is a fixed upstream bug rather than an actively exploited one.
Denial-of-service / kernel-stability defect in the Linux kernel BPF LSM subsystem allows a privileged BPF program author to attach sleepable LSM programs to the bpf_lsm_task_to_inode() and bpf_lsm_inet_conn_established() hooks, which execute in atomic contexts (under rcu_read_lock() and in softirq respectively) where sleeping is illegal. The upstream fix removes these two hooks from the sleepable-eligible set; there is no public exploit identified at time of analysis, EPSS is very low (0.16%, 6th percentile), and it is not in CISA KEV. Despite an NVD CVSS of 8.8 the real-world risk is modest because triggering requires local privilege to load BPF LSM programs.
Local privilege escalation / memory corruption in the Linux kernel's amdgpu VCE (Video Compression Engine) driver allows an unprivileged local user with access to the AMD DRM render node to trigger a bad address being written into VCE firmware. The flaw stems from the command-buffer address-patching routine accepting a partially-valid relocation where only the low or high half of an address is present, producing a malformed pointer handed to firmware. No public exploit is identified at time of analysis (EPSS 0.16%, not in CISA KEV), and vendor stable-tree patches are available across all maintained branches.
Improper memory initialization in the Linux kernel's AMD GPU driver (drm/amdgpu) allows a stale, uninitialized GART page-table entry to be speculatively loaded into the GPU TLB, causing the GPU to reference the wrong physical memory. Affected are systems running AMD GPUs on kernels before 6.1.175, 6.6.140, 6.12.90, 6.18.32 and 7.0.9; a low-privileged local user with GPU access could potentially trigger disclosure of adjacent memory or corrupt GPU address translation. No public exploit identified at time of analysis, and EPSS is low (0.16%), consistent with a hardware-specific correctness flaw rather than a mass-exploitable bug.