Silent dirty page loss in the Linux kernel's Intel VT-d IOMMU subsystem (iommu/vt-d) allows a low-privileged local actor to trigger an availability impact by attaching a PASID to a nested IOMMU domain whose nesting parent domain already has dirty tracking configured. The kernel fails to block this invalid combination, causing dirty page tracking to silently fail - a condition critical to live VM migration correctness in virtualization environments. No public exploit has been identified; EPSS at 0.17% (6th percentile) reflects extremely low exploitation interest, and the vulnerability is absent from CISA KEV.
Out-of-bounds read in the Linux kernel RDMA/ionic driver's hca_type_show() sysfs handler allows a local user to trigger a kernel crash or leak adjacent kernel memory. The ionic driver's use of an unbounded "%s" format specifier on the 64-byte node_desc field - which is not guaranteed to be NUL-terminated - causes the kernel to read past the end of that field into adjacent members of struct ib_device when exactly 64 bytes have been written. Since ionic supports IB_DEVICE_MODIFY_NODE_DESC, this condition is reachable from unprivileged userspace. No public exploit or CISA KEV listing exists; EPSS is 0.17% (6th percentile), indicating low exploitation probability in the wild.
Multiple ACR mask validation and configuration flaws in the Linux kernel's perf/x86/intel subsystem allow a local low-privileged user to trigger incorrect Intel PMU hardware counter configuration, resulting in high availability impact. Three distinct weaknesses exist: incomplete user-space ACR mask validation permitting cross-group index bits, an early-return logic error that silently skips all subsequent ACR group configuration, and failure to clear stale hardware ACR masks (hw.config1) before writing new values. No public exploit code is identified and EPSS sits at 0.17% (6th percentile), indicating negligible active exploitation probability; this is a maintenance-patch priority rather than an emergency.
SELinux avdcache auditing in the Linux kernel incorrectly reuses a previously computed audited vector from avc_audit_required() rather than recomputing it against the current access request and its allow/deny outcome, causing certain permission checks to go silently unlogged. Affected are local, low-privileged users on kernels containing the per-task avdcache introduced at commit dde3a5d0f4dce1d1a6095e6b8eeb59b75d28fb3b, through versions prior to 6.18.30, 7.0.7, and 7.1. An attacker exploiting this gap can perform SELinux-policy-violating operations - such as directory writes following a cached directory search - that generate no audit record, directly undermining intrusion detection and compliance monitoring that depends on SELinux audit logs. No public exploit exists and EPSS is at the 6th percentile; however, organizations with strict SELinux audit compliance requirements face elevated effective risk.
Error pointer dereference in the Linux kernel's spi-sprd driver causes local denial of service on systems equipped with Spreadtrum (SPRD) SoC hardware. When DMA setup fails during driver probe and the driver falls back to PIO mode, a subsequent late probe error triggers a cleanup path that does not check the dma.enabled flag before attempting to release DMA channels - resulting in an error pointer dereference or double-channel-release and consequent kernel panic. No public exploit exists and EPSS sits at 0.17% (6th percentile), reflecting the highly hardware-specific nature of this flaw. Vendor-released patches are confirmed across multiple Linux stable branches.
Reference leak in the Linux kernel's Qualcomm Adreno a6xx GPU driver (drm/msm/adreno) can cause kernel memory reference exhaustion on affected hardware, leading to system instability or a kernel panic. The flaw in a6xx_gpu_init() allows of_parse_phandle() node references to escape release on multiple early error return paths, bypassing the required of_node_put() cleanup. No active exploitation has been identified; EPSS is 0.17% (6th percentile), no KEV listing exists, and impact is limited to availability on hardware-specific Linux deployments.
NULL pointer dereference in the Linux kernel's EFI runtime subsystem crashes affected systems when ACPI Platform Runtime Mechanism (PRM) handlers are invoked during early boot before the EFI runtime workqueue has been allocated. Systems with EFI PRM-capable firmware running unpatched kernels between the introduction of commit 5894cf571e14 and the respective stable-branch fixes are affected. No public exploit or CISA KEV listing exists; the vulnerability manifests as a kernel panic during initialization on susceptible hardware, resulting in a denial of service.
Kernel self-deadlock in the Linux phonet/pep subsystem allows a local low-privilege attacker to crash affected systems by triggering an inconsistent bottom-half (BH) lock state on a child PEP socket. The flaw exists from kernel 2.6.28 through unpatched stable branches up to 7.x, and is reachable only when the Phonet protocol module is active. No public exploit or active exploitation is confirmed; EPSS is 0.16% (6th percentile), consistent with the niche deployment context.
Invalid cleanup in the Linux kernel's tracing_map subsystem causes a kernel panic when memory allocation fails during element initialization. Specifically, the error path in tracing_map_elt_alloc() incorrectly invokes map->ops->elt_free() on uninitialized data when elt_alloc() was never successfully called, producing an invalid memory operation that crashes the kernel. This affects all kernel branches from 4.17 through the respective fixed stable releases. No public exploit exists and EPSS is 0.16% (6th percentile), but any local low-privileged user with access to the tracing subsystem who can induce allocation failures can trigger a denial of service.
NULL pointer dereference in the Linux kernel's SPI QUP (Qualcomm Universal Peripheral) driver causes a local denial-of-service condition affecting Qualcomm SoC-based Linux systems. When DMA setup fails during driver probe, the fallback to PIO mode leaves DMA channel pointers in a stale error state rather than clearing them to NULL; a subsequent probe failure or driver unbind then dereferences those error pointers, triggering a kernel panic. Patches are available across all active stable branches (5.10.259, 5.15.210, 6.1.176, 6.6.142, 6.12.92, 6.18.34, 7.0.11, 7.1); no public exploit has been identified and EPSS is at the 6th percentile, indicating negligible exploitation probability at this time.
Sleep-in-atomic-context denial of service in the Linux kernel btrfs filesystem driver allows a local low-privileged user to crash the system by triggering file sync operations while kernel tracing is active. The btrfs_sync_file trace event erroneously calls dput() - a function that may sleep - within an atomic context where sleeping is forbidden, producing a kernel BUG splat and potential panic. No active exploitation has been identified, EPSS is 0.16% (6th percentile), and the vulnerability requires a non-default kernel tracing configuration to be exploitable, substantially limiting real-world exposure.
Kernel panic in the Linux kernel's kprobes self-test module (test_kprobes) allows a local attacker or privileged user with debugfs write access to crash the kernel by triggering the KUnit kprobes test suite twice in succession. The root cause is that static kprobe and kretprobe variables retain stale address and flag data after unregister_kprobe, causing re-registration to fail with -EINVAL and subsequently triggering a kernel paging fault on the second test run. No public exploit is identified at time of analysis; EPSS at the 6th percentile and absence from CISA KEV confirm this as low-priority in production contexts.
Resource exhaustion in the Linux kernel erofs filesystem driver allows a local low-privileged attacker to leak folio references via error paths in erofs_init_inode_xattrs(), potentially causing kernel memory resource exhaustion or denial of service. Affected systems are those running Linux kernel versions from 5.17 through the fix commits, where erofs filesystems with extended attributes (xattrs) are mounted. No public exploit code exists and the vulnerability is absent from CISA KEV; vendor-released patches are available in stable branches targeting 7.0.11 and 7.1.
Permanent battery hardware damage on Uniwell-based laptops can be triggered via the platform/x86/uniwill-laptop kernel driver by enabling the battery charging limit through the 'force' module parameter. Affected hardware is limited to older Uniwell OEM models manufactured around 2020 where the charging limit circuitry is incompatible with the feature and causes irreversible battery degradation. No public exploit exists and EPSS stands at 0.16% (6th percentile), reflecting the narrow hardware and configuration prerequisites; however, the impact is severe and permanent - affected batteries cannot be recovered once damaged.
NULL pointer dereference in the Linux kernel's PCM512x ASoC audio codec driver crashes the kernel when a local low-privileged user writes to the overclocking mixer kcontrol. The driver's pcm512x_overclock_xxx_put() handler incorrectly invokes snd_soc_dapm_kcontrol_to_dapm() on a standard mixer kcontrol - an accessor only valid for DAPM kcontrols - returning NULL and triggering a kernel panic. No public exploit has been identified and EPSS stands at 0.16% (6th percentile), reflecting low exploitation likelihood; impact is confined to denial of service on systems with PCM512x audio hardware.
Memory exhaustion in the Linux kernel WWAN IOSM driver allows a local low-privileged attacker to deplete kernel memory by repeatedly triggering error paths in `ipc_imem_init()` where memory allocated by `ipc_protocol_init()` is never released. Affected systems running kernel versions from 5.14 through the unpatched branches of 5.15, 6.1, 6.6, 6.12, 6.18, 7.0, and pre-7.1 with Intel WWAN IOSM modem hardware loaded are vulnerable to availability-impact memory exhaustion. No public exploit exists and EPSS probability sits at 0.16% (6th percentile), indicating negligible real-world exploitation likelihood; however, patched stable releases are available across all major kernel branches.
Crash kernel panic in Linux kernel's KHO (Kexec Handover) subsystem causes kdump capture to fail due to a missing crash-kernel guard in kho_fill_kimage(). Systems configured with both KHO and a crash kernel (kdump) are affected: when a kernel crash transfers control to the crash kernel, KHO metadata pointing outside the reserved crash region triggers an invalid phys_to_virt() translation in kho_memory_init(), crashing the crash kernel itself and defeating the crash dump mechanism. No public exploit exists and EPSS at 0.16% (6th percentile) reflects appropriately low exploitation probability given the local-only, configuration-dependent nature of the flaw.
Resource leak in the Linux kernel's ov8856 OmniVision I2C camera driver exposes systems with that hardware to local denial-of-service via kernel memory exhaustion. The driver's ov8856_init_controls() function fails to call v4l2_ctrl_handler_free() on error exit paths, leaving the control handler's allocated memory unreleased each time control registration fails. No public exploit exists and EPSS probability sits at 0.16% (6th percentile), reflecting that this hardware-specific driver code is rarely reachable in practice.
Reference leak in the Linux kernel DAMON sysfs-schemes subsystem allows a local low-privilege attacker to cause a denial of service through accumulated cgroup object reference exhaustion. Affected are kernel builds from Linux 6.3 (commit 29cbb9a13f05b20f0777c60db9603730b487a4e0) through stable branches prior to 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1, on systems where DAMON is active and cgroup-path-based memory schemes are configured via sysfs. No public exploit has been identified and EPSS is 0.16% (5th percentile), consistent with a kernel resource-management flaw requiring specific local conditions.
Reference count leaking in the Linux kernel's hardware memory poison accounting subsystem (drivers/base/memory) causes memory block device objects to remain unreleased across repeated hardware memory error events, gradually degrading system stability. Affected kernels span multiple stable branches from introducing commit 5033091de814 through their respective fix commits, with patched releases available at 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and no active exploitation is recorded (EPSS 0.16%, 5th percentile); this is a slow-accumulating resource leak rather than an immediately weaponizable flaw.
Memory hotplug removal in the Linux kernel leaks device references because `find_memory_block()` acquires a kobject reference inside `remove_memory_blocks_and_altmaps()` that is never released, allowing the reference count to accumulate unchecked across repeated memory block removal cycles. Systems with memory hotplug support - including virtual machines using ACPI memory balloon drivers and bare-metal servers with hot-pluggable DIMM slots - are affected across multiple stable kernel branches, with patches confirmed for 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and exploitation probability is extremely low (EPSS 0.16%), though the availability impact is rated high: leaked references accumulated over repeated hotplug cycles can eventually precipitate a kernel panic.
Error pointer dereference in the Linux kernel ep93xx SPI driver causes kernel panic (denial of service) under specific driver lifecycle conditions on Cirrus Logic EP93xx ARM SoC hardware. When DMA channel setup fails during driver probe and falls back to PIO mode, the driver fails to clear the DMA channel pointers; any subsequent probe error or driver unbind then dereferences those stale error pointers, triggering a kernel oops or panic. No public exploit exists and EPSS of 0.16% (5th percentile) reflects negligible real-world exploitation probability - this is a targeted stability fix for a niche embedded platform.
Missing upper bound validation on `num_of_nodes` in the AMD KFD ioctl handler `kfd_ioctl_get_process_apertures_new` allows a local low-privileged user with access to AMD GPU compute devices to crash the kernel, causing a denial of service. Affected are Linux kernel branches prior to 6.6.140, 6.12.90, 6.18.32, 7.0.9, and 7.1, restricted to systems with AMD GPU hardware and the amdkfd module loaded. EPSS is 0.16% (5th percentile), no public exploit or CISA KEV listing exists, and patched stable releases are available across all active stable branches.
Incorrect zero_point calculation in the Linux kernel netfs layer's netfs_release_folio() function causes short reads and application-level I/O failures on network filesystem mounts when local pagecache size (i_size) exceeds the server-reported file size (remote_i_size). The bug affects local users on systems mounting CIFS or other netfs-backed shares with caching enabled, and was reproducible via a specific sequence of truncate, write, mapread, and copy_range operations on CIFS with the default cache option. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.15% at the 5th percentile, and patches are confirmed available for kernel stable branches 7.0.11 and 7.1.
NULL pointer dereference in the Linux kernel netfilter x_tables subsystem allows a local attacker to crash the kernel via a race condition during network namespace teardown. The flaw exists because arp/ip(6)t_register_table() adds a table to the per-netns linked list before allocating its per-namespace hook ops structure, leaving a window where ops=NULL is visible to concurrent readers. If a network namespace exit runs concurrently during this window, nf_unregister_net_hooks() receives a NULL ops pointer and triggers a general protection fault. No public exploit has been identified at time of analysis, and EPSS is very low at 0.15%.
Preempt count leak in four hv-gpci sysfs show() callbacks in the Linux kernel powerpc subsystem causes progressive kernel stability degradation on IBM Power systems compiled with CONFIG_PREEMPT=y. Each successful read of the affected sysfs nodes leaves one preempt_disable() unmatched, incrementally raising preempt_count; once the count becomes non-zero on return to userspace, the next page fault is misidentified as occurring in an atomic context, generating SIGSEGV and triggering 'BUG: scheduling while atomic' during the resulting coredump. Patches are available across the 6.6, 7.0, and 7.1 stable kernel trees, with no public exploit identified at time of analysis.
Persistent GPU denial-of-service in the Linux kernel's drm/msm Qualcomm GPU driver allows a local low-privileged user to render the GPU permanently hung by submitting a single ring workload that triggers an unrecovered fault. The recover_worker function advances the hung ring's fence and early-exits when it detects no further queued work, bypassing the actual GPU reset sequence - leaving the hardware stuck until a reboot. No public exploit has been identified and EPSS is 0.15% (5th percentile), consistent with the narrow hardware and local-access prerequisites.
Runtime PM reference count leak in the Linux kernel's Tegra I2C driver permanently prevents the affected I2C controller from entering runtime suspend when tegra_i2c_mutex_lock() returns an error. The asymmetric acquire-without-release of pm_runtime_get_sync() causes device power management to malfunction on NVIDIA Tegra SoC hardware, covering Linux 7.0 through pre-7.0.11 and pre-7.1. No public exploit exists and EPSS at 0.14% (4th percentile) reflects minimal exploitation interest; this is a stability and power management correctness defect rather than a security attack vector in the conventional sense.
Memory leaks in the Linux kernel's DRM colorop subsystem allow a local low-privileged attacker to gradually exhaust kernel memory by triggering repeated DRM atomic state lifecycle operations, ultimately causing denial of service via out-of-memory conditions. Affected systems are those running Linux kernel versions between the introduction of the colorop subsystem (commit cfc27680ee208cdf7a61cda817b4158c4142595f) and the upstream fix commits, with patched versions available at 7.0.9 and 7.1. No active exploitation is confirmed (not in CISA KEV) and EPSS is extremely low at 0.14% (4th percentile), making this a low-urgency but legitimate kernel hygiene issue requiring patching during normal maintenance cycles.
Insufficient session expiration in django-oauth-toolkit 3.3.0 allows authenticated network attackers to exploit the `_load_id_token` function in `oauth2_provider/oauth2_validators.py`, bypassing token expiration enforcement and maintaining access beyond their authorized session lifetime. The CVSS 4.0 score of 5.3 with PR:L confirms exploitation requires low-privilege access (a valid or expired token), and impacts confidentiality, integrity, and availability at a low level. No public exploit or active exploitation has been confirmed; the issue was submitted via a GitHub issue report and the project has not yet issued a response or patch.
Improper authorization across multiple dashboard API endpoints in MoviePilot through version 2.13.5 allows any authenticated low-privilege user to access administrative telemetry that should be restricted to superusers. The root cause, confirmed by patch commit dc2b6910a423b3bfadeffaa303e1ba75cfb33900, is that route handlers in `app/api/endpoints/dashboard.py` used `verify_token` (any valid session) rather than `get_current_active_superuser` for endpoints exposing system stats, storage, CPU/memory usage, downloader metrics, and scheduler information. No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.
Unrestricted file upload in SourceCodester Pizzafy Ecommerce System 1.0 exposes the admin panel's `save_settings` function to arbitrary file upload via the `img` parameter in `/admin/admin_class_novo.php`. The CVSS 4.0 vector (PR:H) confirms exploitation requires authenticated administrator-level access, but once achieved, a PHP webshell can be uploaded to the server and potentially executed, escalating effective impact well beyond the base score's conservative VC:L/VI:L ratings. No public exploit code and no CISA KEV listing exist at time of analysis.
Cleartext storage of blog entry protection passwords in django-blog-zinnia (all versions through 0.20) exposes those passwords to any local actor with read access to the application's storage layer. The flaw resides in the Protected Entry Password Handler at `zinnia/views/mixins/entry_protection.py`, where passwords used to gate access to individual blog entries are persisted without hashing or encryption. No public exploit code exists and no actively exploited status has been confirmed; the project maintainer has not responded to the coordinated disclosure, making a vendor-issued patch unlikely.