Local denial-of-service and out-of-bounds read in the Linux kernel F2FS filesystem allows an attacker who can mount a crafted image to panic the kernel via f2fs_recover_orphan_inodes(), which trusts an attacker-controlled orphan block entry_count. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK drives the recovery loop past the ino[] array, reading footer/adjacent data as inode numbers and tripping f2fs_bug_on(). No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not on CISA KEV.
Out-of-bounds kernel memory read in the Linux kernel's f2fs filesystem driver allows an attacker who can get a crafted f2fs image mounted to leak kernel memory and crash the system. When the flexible_inline_xattr feature is enabled, do_read_inode() trusts the on-disk i_inline_xattr_size for inodes that carry inline dentries or inline data but lack the FI_INLINE_XATTR flag, so an unvalidated, attacker-controlled size drives inode geometry negative and produces an out-of-bounds read in f2fs_fill_dentries() when the inline directory is read. EPSS is low (0.16%, 5th percentile) and there is no public exploit identified at time of analysis nor CISA KEV listing; a vendor patch is available.
Local privilege-boundary weakness in the Linux kernel's iommupt (IOMMU generic page-table) code allows a driver-constructed iommu_domain that omits PAGE_SIZE from its pgsize_bitmap to take an unintended fast path in page-table handling. The upstream fix lifts a PT_WARN_ON into a branch check and skips the fast path when PAGE_SIZE is absent. No public exploit identified at time of analysis; EPSS probability is very low (0.15%, 5th percentile) and this is a design-hardening fix rather than a demonstrated attack primitive.
Memory-safety corruption in the Linux kernel eBPF verifier (fixed in 6.19 / stable 7.0.10 / 7.1) arises because visit_tailcall_insn(), added by commit e40f5a6bf88a to correct stack liveness for tail calls, discards its return value so verifier errors are never propagated. An attacker able to load a crafted BPF program can cause the verifier to accept an invalid program, leading to high-impact confidentiality, integrity, and availability compromise (CVSS 8.4). This is tagged as Information Disclosure with no public exploit identified at time of analysis and a low EPSS of 0.14%.
Improper TCP connection teardown in the Linux kernel netfilter conntrack subsystem lets remote attackers prematurely terminate active NAT/connection-tracked sessions by injecting an RST packet with an invalid sequence number after a SYN, without the state machine verifying packet direction. The flaw affects the nf_conntrack TCP state machine across numerous stable kernel branches and primarily threatens availability of tracked connections. EPSS is low (0.23%, 13th percentile) and there is no public exploit identified at time of analysis; a vendor patch is available across multiple stable trees.
Availability degradation in the Linux kernel's MPTCP (Multipath TCP) subsystem allows remote peers to trigger connection-level inconsistencies through a time-of-check-to-time-of-use (TOCTOU) race in the transmit path. The MPTCP output code reads the connection-level ack_seq locklessly and multiple times per packet, so the data_ack value placed in the DSS option can diverge from the value used to compute the announced receive window, confusing the remote peer and destabilizing the multipath connection. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and the flaw is not in CISA KEV.
Heap out-of-bounds read in the Linux kernel's ksmbd in-kernel SMB3 server allows an authenticated remote user to read 2 bytes past the pntsd allocation during SMB2_CREATE handling, potentially leaking adjacent heap memory or crashing the kernel. The flaw is a regression: commit d07b26f39246 introduced a transposed bounds check in smb_check_perm_dacl() that always evaluates false, turning the ACE-size guard into dead code and re-opening a previously fixed OOB. No public exploit identified at time of analysis, and EPSS risk is low (0.21%, 12th percentile); it is not on CISA KEV.
MACsec replay-protection bypass in the Linux kernel allows an adjacent attacker to indefinitely replay a captured frame on Extended Packet Numbering (XPN) associations. Because macsec_post_decrypt() computes pn + 1 on a u32, the value 0xFFFFFFFF wraps to 0 and fails to advance next_pn_halves, so lowest_pn never rises and the same IV keeps validating. EPSS is low (0.21%, 11th percentile) and there is no public exploit identified at time of analysis, but the CVSS of 8.1 reflects high integrity and availability impact against encrypted L2 links.
Out-of-bounds kernel memory read in the Linux kernel Thunderbolt (thunderbolt) driver's XDomain property parser lets a malicious directly-connected Thunderbolt/USB4 peer leak kernel memory contents. The flaw stems from a u32 integer wrap in tb_property_entry_valid(), where a crafted property entry (value=0xffffff00, length=0x100) wraps the bounds check and causes tb_property_parse() to read attacker-directed memory far past the property block allocation; leaked bytes for TEXT-typed 'deviceid'/'vendorid' keys become readable via the per-XDomain device_name/vendor_name sysfs attributes. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, and EPSS is low (0.21%), consistent with a physical-access adjacent-only information-disclosure bug.
Denial-of-service in the Linux kernel's generic Fibre Channel transport (scsi_transport_fc) lets an adjacent fabric actor hang a host driving an lpfc (Emulex) or qla2xxx (QLogic) FC HBA. By sending a crafted FPIN ELS frame whose 32-bit pname_count exceeds 255, an attacker wraps a u8 loop counter in the Link-Integrity and Peer-Congestion descriptor walkers, producing a non-terminating loop (non-return) in kernel context. No public exploit is identified at time of analysis and EPSS is low (0.20%), but the flaw is remotely triggerable without authentication from within the SAN fabric.
Heap out-of-bounds read in the Linux kernel's in-kernel SMB server (ksmbd) lets an authenticated SMB client leak kernel heap memory or crash the server on shares that use ACL xattrs. The flaw lives in smb_check_perm_dacl(), which validates an ACE header and caps sub-authority count but never confirms the ACE is large enough to hold those sub-authorities before compare_sids() dereferences them. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a memory-disclosure/DoS bug rather than a mass-exploited RCE.
Denial-of-service in the Linux kernel iwlwifi mvm WiFi driver affects older Intel wireless adapters such as the 7265D, where a regression in TX-rate encoding sets TX_CMD rates incorrectly. When the device reports these malformed rates back, the driver can emit warnings and, for beacon rates, trigger a firmware assert/crash that disrupts wireless connectivity. This is a fixed regression with no public exploit identified at time of analysis and a low EPSS score (0.15%), indicating negligible real-world exploitation interest.
Local memory corruption in the Linux kernel's AMD Kernel Fusion Driver (amdkfd) stems from an integer overflow in the KFD debugger's get_queue_ids() routine, where num_queues * sizeof(uint32_t) can wrap on 32-bit size_t builds and produce an undersized allocation. A local user with access to the KFD debug interface can trigger kernel heap corruption impacting confidentiality, integrity, and availability. No public exploit is identified at time of analysis; EPSS is low (0.22%, 12th percentile) and it is not on CISA KEV, but a vendor patch has been released across multiple stable trees.
Local privilege escalation and memory corruption in the Linux kernel's ASoC fs210x audio codec driver arises from a misused strscpy() call in fs210x_effect_scene_info(), where the copy length was derived from the source string (strlen(SRC)+1) rather than the destination buffer size, allowing an overwrite when the source is at least as long as the destination. The flaw affects Linux 6.18 through the fixed stable releases and carries a CVSS of 7.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile), consistent with a local-only kernel driver bug rather than a mass-exploited network flaw.
Local privilege-scoped memory corruption in the Linux kernel's IPsec/xfrm subsystem allows a low-privileged user with network-configuration capability to trigger a massive out-of-bounds kernel write. The xfrm_state_mtu() helper computes an ESP MTU in unsigned modulo-2^32 arithmetic; by installing an IPv4 ESP tunnel SA with an oversized truncated auth key, a tiny interface MTU, and a large XFRMA_TFCPAD value, an attacker forces the result to underflow, and esp_output() later treats it as a negative signed length passed to memset() — producing a near-16 EB write of zeroes at the skb tail. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and the flaw is not in CISA KEV, but the ubiquity of the Linux kernel makes patching important.
Use-after-free in the Linux kernel's in-kernel OpenVPN data-channel module (ovpn) lets a local operator who can create VPN peers over TCP trigger memory corruption when the CMD_NEW_PEER netlink command hits its error path. The flaw affects kernels from 6.16 onward and stems from the error path calling the peer destructor directly instead of dropping the kref, so a concurrent TCP syscall caller (e.g. a recvmsg blocked on the peer's queue) can operate on freed memory. No public exploit identified at time of analysis; EPSS is low (0.21%) and it is not in CISA KEV, but the CVSS 7.8 reflects high confidentiality/integrity/availability impact from local memory corruption.
Local privilege escalation and memory corruption in the Linux kernel SCTP subsystem stems from a race condition where sctp_wait_for_connect() fails to detect that an association was migrated to a new socket via SCTP_SOCKOPT_PEELOFF while the socket lock was released. An attacker with a local account and the ability to open SCTP sockets can race a connecting association against a peeloff getsockopt() call, causing the connect path to operate on asoc->base.sk under the wrong socket lock in sctp_datamsg_from_user(). This is a fixed upstream kernel bug (EUVD-2026-45744) with a vendor patch available; no public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.21% (11th percentile).
Local denial-of-service in the Linux kernel's HPFS (High Performance File System) driver allows a crash when hpfs_map_dnode_bitmap fails and the code subsequently calls hpfs_brelse4 on an uninitialized quad buffer head. Affected are Linux kernels prior to the fixed stable releases (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1) when an HPFS filesystem is mounted. There is no public exploit identified at time of analysis, KEV does not list it, and EPSS is very low (0.21%), consistent with a niche legacy-filesystem bug rather than a broadly weaponizable flaw.
Privilege-independent local crash in the Linux kernel's parport (parallel port) subsystem allows a race between port registration and client-driver attachment, where drivers such as lp bind to ports that are not yet fully initialised or are being torn down, causing a NULL/use-after-free style kernel crash. Affects systems where parport_pc and lp are built as modules and loaded concurrently during boot with PC-style parallel-port hardware present. No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and it is not listed in CISA KEV, consistent with the vendor 'Denial Of Service' tag rather than code execution.
Local privilege escalation and memory corruption in the Linux kernel's Industrial I/O (IIO) buffer hardware-consumer subsystem stems from a use-after-free in the error-handling path of iio_hw_consumer_alloc(). When buffer allocation fails, the cleanup routine iterated the buffer list with the unsafe list_for_each_entry() macro while iio_buffer_put() could free the current buffer, causing the loop to dereference freed memory. CVSS is 7.8 (High) with local vector and low privileges; EPSS is low at 0.21% (11th percentile), and there is no public exploit identified at time of analysis, consistent with this being a defect reachable only in a rare allocation-failure path.
Local denial-of-service (and potential information disclosure) in the Linux kernel's dwc2 USB host controller driver, where debug code dereferences the 'urb' structure after it has already been handed back via usb_hcd_giveback_urb(), causing a use-after-free read of freed memory. The flaw affects systems using the DesignWare HS OTG USB 2.0 controller driver (common on ARM SoCs such as Raspberry Pi). It is patched upstream, has no public exploit identified at time of analysis, and carries a low EPSS score (0.21%).
Stale TLB walk-cache entries in the Linux kernel on arm64 arise because huge_pmd_unshare() marks tlb->unshared_tables=true, but the aarch64 tlb_flush() logic only inspected tlb->freed_tables when deciding between a full invalidation (vae1is) and a leaf-only one (vale1is). As a result, unsharing a hugetlb PMD table leaves the obsolete PMD entry in the walk cache, allowing the MMU to perform incorrect page-table walks against freed/reassigned page-table memory - a potential path to information disclosure or memory corruption on affected 64-bit ARM systems. This is a config/architecture-specific kernel bug with no public exploit identified at time of analysis and a low EPSS (0.21%), and it is not listed in CISA KEV.
Local privilege escalation or denial of service in the Linux kernel's zram block device (writeback path) stems from a use-after-free in zram_writeback_endio, where the bio completion handler calls wake_up() on wb_ctl->done_wait after the writeback task may have already observed num_inflight reach zero and freed wb_ctl via release_wb_ctl(). Affecting kernels around 6.19/7.0 with zram writeback in use, a local attacker who can drive zram writeback activity may trigger the race to corrupt kernel memory, crashing the system or potentially escalating privileges. There is no public exploit identified at time of analysis and EPSS is low (0.21%), consistent with a hard-to-win kernel race rather than a trivially weaponizable bug.
Local privilege escalation or denial of service in the Linux kernel Bluetooth ISO (Isochronous Channels) subsystem arises from a race condition where iso_sock_close() calls iso_sock_clear_timer() before taking the socket lock, letting a concurrent iso_conn_del() free the connection object and trigger a NULL pointer dereference or use-after-free. Any local user able to open and close AF_BLUETOOTH ISO sockets can race the two code paths; UAF of a kernel connection structure can escalate from a crash to memory corruption. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and the issue is not in CISA KEV.
Local privilege escalation or denial of service in the Linux kernel's Intel i915 GPU driver stems from a use-after-free in the TTM object purge path (i915_ttm_purge), where the bo->ttm page-vector container can be replaced by ttm_bo_validate() during eviction, leaving a stale i915_tt pointer that is later dereferenced. A user on DG2 (Intel Arc/discrete) hardware reproduced this as a general protection fault under heavy GPU load during buffer-object eviction. There is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS (0.21%), but the CVSS 7.8 local vector reflects high confidentiality, integrity, and availability impact if the freed memory is groomed and reclaimed.
Arbitrary code execution in keras-team/keras 3.15.0 arises because the public keras.layers.TorchModuleWrapper.from_config method calls torch.load(..., weights_only=False) without any explicit unsafe opt-in, so a maliciously crafted Keras layer configuration deserialized outside a SafeModeScope(True) context triggers execution of attacker-controlled PyTorch pickle payloads (CWE-502). Any application or pipeline that loads untrusted or third-party Keras model/layer configs is affected; CVSS is 7.8 (High) with a local vector requiring user interaction. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the vulnerability class is well understood and reliably weaponizable via standard pickle reduce gadgets.
Local privilege-boundary memory corruption in the Linux kernel L2TP subsystem (net/l2tp) arises because l2tp_session_get_by_ifname() took its reference with a bare refcount_inc() instead of refcount_inc_not_zero(), letting an RCU reader acquire a session whose refcount already hit zero and dereference freed slab memory. Affected kernels include the 6.12.x and 6.18.x stable series (fixed in 6.12.93, 6.18.35, 7.0.12 and 7.1), and the flaw is a race between the IDR/RCU lookup and l2tp_session_free()->kfree_rcu() that is genuinely reachable on PREEMPT_RT builds. There is no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a hard-to-win local race rather than a widely weaponized bug.
Local privilege-boundary memory corruption in the Linux kernel USB gadget FunctionFS (f_fs) driver lets a process with access to the FunctionFS control node trigger a use-after-free by racing a DMABUF request completion against a FUNCTIONFS_DMABUF_DETACH ioctl or the file-close path. The completion frees the usb_request but leaves the priv->req back-pointer dangling, so the cancel path passes freed memory to usb_ep_dequeue(), corrupting kernel memory on SG-capable UDCs (chipidea, cdnsp) that dereference the request immediately. EPSS is low (0.20%, 10th percentile) and there is no public exploit identified at time of analysis; a vendor patch is available across stable trees.
Local memory corruption in the Linux kernel's vsock/virtio transport (AF_VSOCK) arises from a reference-counting lifetime mismatch in the MSG_ZEROCOPY send path, affecting kernels from 6.7 onward. Because virtio_transport_send_pkt_info() reuses or allocates the zerocopy uarg before virtio_transport_alloc_skb() fills the skb, a rollback after a partial fixed-buffer vectored zerocopy attach frees an skb that is flagged SKBFL_MANAGED_FRAG_REFS but has no uarg, causing skb_release_data() to take the wrong unref path. The CVSS 7.8 rating reflects high confidentiality, integrity, and availability impact from local access; there is no public exploit identified at time of analysis and EPSS is low at 0.20%.
Memory-management memory corruption in the Linux kernel's reverse-mapping (rmap) code lets a local, low-privileged user crash the system by corrupting folio refcount/mapcount state. The flaw lives in try_to_unmap_one() (mm/rmap.c), where the nr_pages counter is not reset to 1 at the start of each page-table-walk iteration, so a stale batch count from a prior lazyfree folio unmap is reused against a device-exclusive PTE. No public exploit identified at time of analysis and EPSS is low (0.20%, 10th percentile); the demonstrated userspace-visible effect is a kernel crash (denial of service).
Local privilege escalation and memory corruption in the Linux kernel's XFRM IP-TFS (IPTFS) tunnel subsystem (introduced in 6.14) arises because iptfs_clone_state() shallow-copies runtime state via kmemdup() during IPsec SA cloning. If xfrm_state_migrate() fails after the clone but before re-initialization, the garbage collector can free skbs still owned by the original SA queue, yielding use-after-free and double-free. A local low-privileged actor able to drive IPsec SA migration on an IPTFS-configured tunnel can trigger the flaw; there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Local privilege escalation and memory corruption in the Linux kernel's AMD GPU (amdgpu) DRM driver arises from a race condition in amdgpu_hmm_range_get_pages, where the MMU notifier sequence was read more than once, allowing the driver to operate on stale or invalid page mappings. A local low-privileged user with GPU device access can exploit the timing window to disclose kernel memory or corrupt memory, matching the CVSS 7.8 high/high/high impact profile. There is no public exploit identified at time of analysis, and the EPSS score is low (0.20%, 10th percentile), consistent with a hard-to-time local race rather than a broadly weaponized flaw.
Local privilege escalation and memory corruption in the Linux kernel's virtiofs (virtio-fs) driver arises from a use-after-free triggered when an auto-submount is unmounted, where iput() called from fuse_release_end() can dereference an already-destroyed superblock. Because the FUSE num_waiting counter is per-connection rather than per-superblock, the shutdown wait only protects the last submount instance, leaving earlier submounts exposed. The fix reverts virtiofs auto_submounts to synchronous release requests; no public exploit is identified at time of analysis and EPSS risk is low (0.19%).
Memory corruption in the Linux kernel's cgroup BPF sysctl filtering path allows a local privileged user to corrupt kernel memory and potentially escalate privileges. The bug is a mismatched allocator/deallocator: proc_sys_call_handler() allocates the temporary sysctl buffer with kvzalloc() (which falls back to vmalloc() for large writes) but the replacement path in __cgroup_bpf_run_filter_sysctl() frees it with kfree(), which is invalid for vmalloc-backed memory. It carries a CVSS of 7.8 (High) with a local vector; EPSS is very low (0.19%, 9th percentile) and there is no public exploit identified at time of analysis, consistent with a memory-safety fix flagged by an experimental static-analysis tool rather than in-the-wild abuse.
Local privilege-boundary memory corruption in the Linux kernel dma-buf subsystem allows a local user to trigger a slab-use-after-free via a race in the dma_buf_fd() tracepoint (DMA_BUF_TRACE). After the FD_ADD() conversion, a thread sharing the file descriptor table can close() the freshly installed dma-buf fd before the tracepoint dereferences dmabuf->name_lock, freeing the object under the trace. Fixed in stable 7.0.12 and 7.1; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.19%.
Use-after-free in the Linux kernel's irq_work subsystem allows a local attacker on a PREEMPT_RT (real-time) kernel to corrupt memory by racing irq_work_sync() against irq_work_single(). After the BUSY flag is cleared via atomic_cmpxchg(), the work object is still dereferenced for irq_work_is_hard() and rcuwait_wake_up(), while a concurrent irq_work_sync() caller on another CPU can observe BUSY==0, return, and free the object before those accesses complete. Rated CVSS 7.8 (High); no public exploit identified at time of analysis and EPSS probability is low (0.19%, 8th percentile).
Local denial-of-service in the Linux kernel's IPv4 raw socket path allows a caller holding CAP_NET_RAW to crash the host by sending an IP_HDRINCL packet whose self-reported header length (ihl) is below the RFC 791 minimum of 5. raw_send_hdrinc() checks that the header fits within the message but never rejects ihl < 5, so the malformed header is injected into the output path where downstream consumers such as ah_output() compute a negative header size, cast it to size_t, and perform an OOB memcpy of nearly SIZE_MAX bytes, panicking the kernel. It affects all maintained kernel branches and is reachable from an unprivileged process inside a user+net namespace (CONFIG_USER_NS=y) or a rootless Docker container with NET_ADMIN; no public exploit identified at time of analysis and EPSS risk is low (0.18%).
Denial of service and potential dma_resv fence-list corruption in the Linux kernel's virtio-gpu DRM driver (drm/virtio) affects Linux guests using virtio graphics, where virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() ignore the return value of virtio_gpu_array_lock_resv(). When the lock acquisition fails with -EINTR (signal during wait) or -ENOMEM (fence-slot allocation), the code proceeds to call dma_resv_add_fence() on an unheld lock, tripping a lockdep WARNING and racing concurrent readers/writers of the fence list. There is no public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and the issue was found by syzbot via fault injection rather than in-the-wild abuse.
Out-of-bounds memory access in the Linux kernel's hwmon pmbus/adm1266 driver lets a malicious or malfunctioning ADM1266 PMBus device on the I2C bus trigger a one-byte write past the end of the driver's fixed read_buf array, plus a corresponding out-of-bounds read during the PEC comparison. The read_buf field is sized ADM1266_PMBUS_BLOCK_MAX+1 (256 bytes) while the i2c transaction is programmed for ADM1266_PMBUS_BLOCK_MAX+2 (257 bytes), so a maximum-length block response (255 payload bytes plus a PEC byte) overruns the buffer. No public exploit identified at time of analysis and EPSS risk is low (0.18%, 8th percentile); the flaw is fixed across multiple stable trees.
Out-of-bounds heap write in the Linux kernel's ADM1266 PMBus power-sequencer hwmon driver allows a locally-privileged attacker - aided by a malicious or non-compliant ADM1266 device - to overflow kernel heap memory by up to 191 bytes, potentially achieving privilege escalation or kernel code execution. The root cause is a size-contract violation between adm1266_pmbus_block_xfer() (which trusts device-supplied lengths up to 255 bytes) and adm1266_nvmem_read_blackbox() (which allocates only 64-byte strides). No public exploit code has been identified at time of analysis; EPSS is 0.18%, consistent with low in-the-wild interest.
Out-of-bounds read and write in the Linux kernel's hwmon PMBus ADM1266 driver (adm1266_gpio_get_multiple) lets a local low-privileged user with access to the driver's GPIO interface corrupt adjacent kernel/caller stack memory, potentially leading to privilege escalation or a crash. The flaw stems from an incorrect loop bound (the PMBus command code 0xE9/233 was used instead of the 25-pin ADM1266_PDIO_NR limit), so the scan walks up to 242 bits and reads/writes past the caller-supplied mask and bits arrays. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile) and the CVE is not on CISA KEV.
Out-of-bounds heap write in the AMD SEV debug-encrypt path (sev_dbg_crypt/__sev_dbg_encrypt_user) of the Linux kernel's KVM/SVM code (kvm_amd) lets a local, privileged VMM process corrupt kernel slab memory by up to 15 bytes past a single-page buffer. The per-iteration transfer length is bounded by the source page offset but not the destination page offset, so when d_off > s_off the PSP command and a following memcpy()/copy_from_user() spill beyond the 4096-byte dst_tpage allocation. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but a KASAN slab-use-after-free splat is included in the report, confirming reliable reproducibility.
Use-after-free in the Linux kernel's FUSE (Filesystem in Userspace) subsystem allows a local low-privileged attacker to access or corrupt freed kernel memory by racing a request abort against the page-cache folio replacement path in fuse_try_move_folio(). Because the function unlocks the request on entry but fails to re-lock it on the success path, fuse_chan_abort() can end the request and free the fuse_io_args (e.g., via fuse_readpages_end()) while the subsequent copy-chain logic still dereferences that structure. Rated CVSS 7.8 (local, high C/I/A impact); no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile).
Out-of-bounds array read in the Linux kernel's ALSA ASIHPI (AudioScience HPI) sound driver allows a local, low-privileged user to trigger memory disclosure or a kernel crash by requesting a cached control info entry with an unchecked index. The find_control() helper indexed its cache array with a caller-supplied index without bounds validation; the fix adds a sanity check. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%), and it is not listed in CISA KEV, so this is a routine defense-in-depth hardening fix rather than an urgent threat.
Use-after-free in the Linux kernel ISCI (Intel SAS) driver's device removal path allows a local attacker with low privileges to corrupt kernel memory by racing the completion tasklet against driver teardown, potentially enabling privilege escalation. Systems running affected kernel versions with Intel ISCI SAS hardware are vulnerable across multiple stable branches, with vendor-released fixes available in 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit has been identified and EPSS of 0.18% (7th percentile) confirms no observed widespread exploitation, though the KASAN-verified reproduction documented in the fix commit confirms the failure class is reliably triggerable under controlled conditions.
Local privilege escalation risk arises from a use-after-free in the Linux kernel's NFC LLCP subsystem, where llcp_sock_release() unconditionally unlinks a socket from the local sockets list even when the socket is still in the connecting state and actually resides on the connecting list. A local user able to open NFC LLCP sockets can trigger memory corruption during socket release, with high confidentiality, integrity and availability impact per the CVSS 7.8 rating. No public exploit identified at time of analysis, and EPSS is low (0.18%), consistent with a local-only, hardware-gated attack surface.
Memory corruption in the Linux kernel's SMC (Shared Memory Communications) networking subsystem arises because smc_init() re-runs INIT_HLIST_HEAD() on the smc_v1/smc_v2 hashtables after they may already hold live hash entries, resetting the list heads and corrupting an in-use linked list. A local user able to trigger SMC socket activity during the vulnerable window can cause list corruption leading to high confidentiality, integrity, and availability impact per the CVSS 7.8 (AV:L) rating. This is not actively exploited - no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.18%.
Local denial of service in the Linux kernel's AF_IUCV networking stack allows any unprivileged user on an s390/IBM Z host to crash the machine by racing recvmsg() against getsockopt(SO_MSGSIZE) on a HiperSockets (HIPER) socket. The .getsockopt handler dereferenced iucv->hs_dev->mtu without holding lock_sock(), so a concurrent iucv_sock_close() (triggered from recvmsg) could set hs_dev to NULL between the check and the dereference, producing a NULL pointer dereference oops. EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis; the upstream fix wraps the entire getsockopt switch in lock_sock()/release_sock() to mirror the existing setsockopt locking.
Use-after-free in the Linux kernel's IPv4 sysctl teardown path (ipv4_sysctl_exit_net) can corrupt kernel memory because net->ipv4.sysctl_local_reserved_ports is freed before unregister_net_sysctl_table(), leaving a window where threads accessing /proc/sys/net/ipv4/ip_local_reserved_ports reference freed memory. A local low-privileged attacker able to trigger network namespace teardown could leverage the dangling pointer for memory corruption, information disclosure, or potential privilege escalation. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the issue is not on CISA KEV, consistent with a fix delivered quietly through the kernel stable process.
Local privilege escalation and memory corruption in the Linux kernel's drm/v3d GPU driver (Broadcom VideoCore, used in Raspberry Pi and similar SoCs) stems from a use-after-free on the CPU-job ioctl error path, where kvfree() reads the cpu_job structure after v3d_job_cleanup() has already dropped its last reference and freed it. The same faulty path also causes a NULL-pointer dereference on early init failure and leaks a drm_syncobj reference per query. No public exploit is identified at time of analysis, EPSS is low (0.18%), and it is not in CISA KEV, but a kernel UAF reachable by a local unprivileged user with GPU access carries high impact (CVSS 7.8).