Missing capability check in the Linux kernel's IPv4 GRE tunnel driver (ip_gre) lets a local user with CAP_NET_ADMIN in a device's network namespace reconfigure GRE/ERSPAN tunnels that actually live in a different namespace, crossing a namespace isolation boundary. The RTM_NEWLINK changelink path validated CAP_NET_ADMIN only against dev_net(dev) and never against the tunnel's own link netns (t->net), so an operator privileged in one container/netns could rewrite tunnels belonging to another. Patched upstream; EPSS is low (0.16%) and no public exploit is identified at time of analysis.
Memory-safety defect in the Linux kernel's MediaTek mt76/mt7996 Wi-Fi driver leaves a stale WCID (wireless client ID) pointer behind when a station link is torn down in mt7996_mac_sta_deinit_link(), creating a dangling reference that can be dereferenced after the underlying station object is freed. The fix, released in stable kernels, explicitly clears the WCID pointer during link deinitialization. The NVD-assigned CVSS of 8.8 (AV:A) rates this high, though no public exploit has been identified and EPSS exploitation probability is very low (0.15%, 5th percentile).
Memory corruption in the Linux kernel mt76 WiFi driver (mt7925 chipset support) occurs because mt76_sta_add reinitializes the wcid->poll_list even though mt7925_mac_sta_add has already published the wcid, corrupting the dev->sta_poll_list linked list during station association. The flaw manifests as list_add corruption (observed on kernel 7.1-rc4 with mt7925 hardware) reachable from the RX NAPI poll path when TX status frames are processed, typically leading to a kernel panic. This is a vendor-fixed Linux stable-tree issue with no public exploit identified at time of analysis and a low EPSS score (0.15%).
Local denial of service in the Linux kernel's DRM GPU SVM helper (drm_gpusvm_helper) arises from an unbalanced notifier-lock release in drm_gpusvm_scan_mm(): an early jump to the err_free label reaches drm_gpusvm_notifier_unlock() before the matching lock is taken, tripping the kernel's 'bad unlock balance' detector. Affected recent kernels (7.0 series, fixed in 7.0.10 and 7.1) can hit this path during GPU shared-virtual-memory scanning, leading to lock-state corruption and likely a crash or hang. There is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile); the fix is upstream in the stable tree.
Information disclosure in the Linux kernel's SEV-SNP guest driver (virt/sev-guest) allows memory pages left in an indeterminate encryption state to be reclaimed by the buddy allocator, potentially exposing plaintext guest data to later allocations. When set_memory_encrypted()/set_memory_decrypted() fail partway, the caller cannot tell where they failed, so pages that may still be unencrypted were being freed for general reuse; the fix instead calls snp_leak_pages() to permanently retain them. Rated CVSS 8.7 (local, low-privilege); EPSS is low at 0.17% (7th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
Memory corruption in the Linux kernel's BPF sockmap subsystem allows a local actor to produce an inconsistent scatterlist layout via bpf_msg_push_data(). When a BPF sk_msg program inserts data into a non-first scatterlist entry, the right-fragment offset is over-advanced by the message-global insertion point instead of the fragment-local delta (start - offset), corrupting the split-buffer layout and enabling information disclosure or further memory corruption. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%, 11th percentile), and it is not listed in CISA KEV.
Memory corruption in the Linux kernel's USB MUSB OMAP2430 glue driver (drivers/usb/musb/omap2430.c) stems from a use-after-free in omap2430_probe(), where of_node_put() releases the device-tree node reference before the node is last accessed. On affected TI OMAP2430-class platforms an attacker able to influence driver probe (device bind/unbind, hotplug, or device-tree handling) could trigger access to freed kernel memory, potentially corrupting kernel state. EPSS is low (0.21%, 11th percentile) and there is no public exploit identified at time of analysis; the fix is merged upstream across multiple stable branches.
Protection-mechanism bypass in the Linux kernel's memfd file-sealing subsystem lets a local low-privileged process hold writable mappings on a memfd while still applying SEAL_WRITE via the SEAL_EXEC path, defeating the immutability guarantee that consumers rely on. Because the implied SEAL_WRITE was set after the mapping_deny_writable() check rather than before, an attacker can hand a victim (e.g. a sandbox or loader) a memfd that reports as write-sealed yet remains arbitrarily modifiable. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and this is not on CISA KEV.
Integrity-check bypass in the Linux kernel's UDF filesystem driver allows a crafted disk image to defeat descriptor CRC validation, leaving only a trivially-forgeable 8-bit tag checksum guarding descriptor parsing. Affecting the udf_read_tagged() path across kernels from 2.6.12 through 7.1 pre-patch, an attacker who can get a malicious UDF image mounted can smuggle corrupted on-disk descriptors past validation, enabling downstream memory corruption with high confidentiality, integrity, and availability impact (CVSS 8.4). No public exploit is identified at time of analysis, and EPSS is low (0.19%), consistent with a local-only, media-dependent attack surface.
Memory-corruption (double free) in the Linux kernel's qed driver (QLogic FastLinQ 40/100G Ethernet) occurs when a PF/VF CID bitmap allocation fails during qed_cxt_tables_alloc(): the error path in qed_cid_map_alloc() frees already-allocated bitmaps, and the subsequent qed_cxt_mngr_free() cleanup frees them a second time. The bug is present from the driver's introduction through v7.1-rc3 and was surfaced by an experimental kernel memory-analysis tool; no public exploit identified at time of analysis and it is not in CISA KEV. Exploitation requires the specific hardware and a triggered allocation failure, so despite the CVSS 8.4 the practical risk is limited to local denial of service on affected NIC hosts.
Use-after-free in the Linux kernel's in-kernel OpenVPN data channel offload (ovpn) TCP transport allows a local attacker to corrupt kernel memory by racing a TCP socket close against peer removal. The flaw lives in ovpn_tcp_close(), which caches a peer pointer under an RCU read lock but then escapes and dereferences sock->peer after the lock is dropped and without holding lock_sock(), so ovpn_socket_release() can free the socket concurrently. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but the CVSS 8.4 rating reflects full high impact to confidentiality, integrity, and availability if the race is won. A vendor patch is available.
AppArmor connect mediation bypass in the Linux kernel lets a confined task open outbound TCP or MPTCP connections using TCP Fast Open (MSG_FASTOPEN on sendmsg()/sendto()) even when its profile grants send but denies connect. Because apparmor_socket_sendmsg() only checked AA_MAY_SEND, the implicit connect embedded in the SYN packet escaped policy enforcement, effectively an authentication/authorization bypass of the profile. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and this is not in CISA KEV, so risk is a targeted policy-enforcement gap rather than mass exploitation.
Use-after-free in the Linux kernel's rpmsg character device driver (rpmsg_char) allows local attackers on rpmsg-enabled platforms to trigger access to freed endpoint memory during a probe-failure race. The flaw exists because rpmsg_chrdev_probe() publishes the newly allocated eptdev in the default endpoint's priv pointer before rpmsg_chrdev_eptdev_add() completes, so a failed add frees eptdev while the default endpoint can still dispatch callbacks against the stale pointer. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list; it is a defensive stable-tree fix rather than an observed in-the-wild vulnerability.
Out-of-bounds read and oversized memory allocation in the Linux kernel's Arm Firmware Framework for A-profile (FF-A) driver (drivers/firmware/arm_ffa) arises from unvalidated offset and size fields in framework notification messages placed in the shared RX buffer. Malformed firmware-supplied data can drive an OOB read during UUID parsing or an oversized kmemdup() allocation, affecting kernels from 6.15 onward on Arm systems using FF-A. Rated CVSS 8.4 (local vector); no public exploit is identified and EPSS is low (0.17%), consistent with a firmware-trust-boundary issue rather than a broadly exploitable remote flaw.
Out-of-bounds string handling in the Linux kernel RDMA subsystem (drivers/infiniband/core) allows a local actor with RDMA netlink access to trigger reads past the end of a supplied netlink attribute. The affected code declared configuration attributes as NLA_STRING and then passed them directly to strcmp()/%s formatting without guaranteeing a NUL terminator, so a crafted, unterminated attribute can cause the kernel to read adjacent memory, potentially leaking information or crashing the host. No public exploit identified at time of analysis; the fix simply switches the attributes to NLA_NUL_STRING to enforce termination.
Local denial-of-service and out-of-bounds read in the Linux kernel F2FS filesystem allows an attacker who can mount a crafted image to panic the kernel via f2fs_recover_orphan_inodes(), which trusts an attacker-controlled orphan block entry_count. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK drives the recovery loop past the ino[] array, reading footer/adjacent data as inode numbers and tripping f2fs_bug_on(). No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not on CISA KEV.
Out-of-bounds kernel memory read in the Linux kernel's f2fs filesystem driver allows an attacker who can get a crafted f2fs image mounted to leak kernel memory and crash the system. When the flexible_inline_xattr feature is enabled, do_read_inode() trusts the on-disk i_inline_xattr_size for inodes that carry inline dentries or inline data but lack the FI_INLINE_XATTR flag, so an unvalidated, attacker-controlled size drives inode geometry negative and produces an out-of-bounds read in f2fs_fill_dentries() when the inline directory is read. EPSS is low (0.16%, 5th percentile) and there is no public exploit identified at time of analysis nor CISA KEV listing; a vendor patch is available.
Local privilege-boundary weakness in the Linux kernel's iommupt (IOMMU generic page-table) code allows a driver-constructed iommu_domain that omits PAGE_SIZE from its pgsize_bitmap to take an unintended fast path in page-table handling. The upstream fix lifts a PT_WARN_ON into a branch check and skips the fast path when PAGE_SIZE is absent. No public exploit identified at time of analysis; EPSS probability is very low (0.15%, 5th percentile) and this is a design-hardening fix rather than a demonstrated attack primitive.
Memory-safety corruption in the Linux kernel eBPF verifier (fixed in 6.19 / stable 7.0.10 / 7.1) arises because visit_tailcall_insn(), added by commit e40f5a6bf88a to correct stack liveness for tail calls, discards its return value so verifier errors are never propagated. An attacker able to load a crafted BPF program can cause the verifier to accept an invalid program, leading to high-impact confidentiality, integrity, and availability compromise (CVSS 8.4). This is tagged as Information Disclosure with no public exploit identified at time of analysis and a low EPSS of 0.14%.
Improper TCP connection teardown in the Linux kernel netfilter conntrack subsystem lets remote attackers prematurely terminate active NAT/connection-tracked sessions by injecting an RST packet with an invalid sequence number after a SYN, without the state machine verifying packet direction. The flaw affects the nf_conntrack TCP state machine across numerous stable kernel branches and primarily threatens availability of tracked connections. EPSS is low (0.23%, 13th percentile) and there is no public exploit identified at time of analysis; a vendor patch is available across multiple stable trees.
Availability degradation in the Linux kernel's MPTCP (Multipath TCP) subsystem allows remote peers to trigger connection-level inconsistencies through a time-of-check-to-time-of-use (TOCTOU) race in the transmit path. The MPTCP output code reads the connection-level ack_seq locklessly and multiple times per packet, so the data_ack value placed in the DSS option can diverge from the value used to compute the announced receive window, confusing the remote peer and destabilizing the multipath connection. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and the flaw is not in CISA KEV.
Heap out-of-bounds read in the Linux kernel's ksmbd in-kernel SMB3 server allows an authenticated remote user to read 2 bytes past the pntsd allocation during SMB2_CREATE handling, potentially leaking adjacent heap memory or crashing the kernel. The flaw is a regression: commit d07b26f39246 introduced a transposed bounds check in smb_check_perm_dacl() that always evaluates false, turning the ACE-size guard into dead code and re-opening a previously fixed OOB. No public exploit identified at time of analysis, and EPSS risk is low (0.21%, 12th percentile); it is not on CISA KEV.
MACsec replay-protection bypass in the Linux kernel allows an adjacent attacker to indefinitely replay a captured frame on Extended Packet Numbering (XPN) associations. Because macsec_post_decrypt() computes pn + 1 on a u32, the value 0xFFFFFFFF wraps to 0 and fails to advance next_pn_halves, so lowest_pn never rises and the same IV keeps validating. EPSS is low (0.21%, 11th percentile) and there is no public exploit identified at time of analysis, but the CVSS of 8.1 reflects high integrity and availability impact against encrypted L2 links.
Out-of-bounds kernel memory read in the Linux kernel Thunderbolt (thunderbolt) driver's XDomain property parser lets a malicious directly-connected Thunderbolt/USB4 peer leak kernel memory contents. The flaw stems from a u32 integer wrap in tb_property_entry_valid(), where a crafted property entry (value=0xffffff00, length=0x100) wraps the bounds check and causes tb_property_parse() to read attacker-directed memory far past the property block allocation; leaked bytes for TEXT-typed 'deviceid'/'vendorid' keys become readable via the per-XDomain device_name/vendor_name sysfs attributes. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, and EPSS is low (0.21%), consistent with a physical-access adjacent-only information-disclosure bug.
Denial-of-service in the Linux kernel's generic Fibre Channel transport (scsi_transport_fc) lets an adjacent fabric actor hang a host driving an lpfc (Emulex) or qla2xxx (QLogic) FC HBA. By sending a crafted FPIN ELS frame whose 32-bit pname_count exceeds 255, an attacker wraps a u8 loop counter in the Link-Integrity and Peer-Congestion descriptor walkers, producing a non-terminating loop (non-return) in kernel context. No public exploit is identified at time of analysis and EPSS is low (0.20%), but the flaw is remotely triggerable without authentication from within the SAN fabric.
Heap out-of-bounds read in the Linux kernel's in-kernel SMB server (ksmbd) lets an authenticated SMB client leak kernel heap memory or crash the server on shares that use ACL xattrs. The flaw lives in smb_check_perm_dacl(), which validates an ACE header and caps sub-authority count but never confirms the ACE is large enough to hold those sub-authorities before compare_sids() dereferences them. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a memory-disclosure/DoS bug rather than a mass-exploited RCE.
Denial-of-service in the Linux kernel iwlwifi mvm WiFi driver affects older Intel wireless adapters such as the 7265D, where a regression in TX-rate encoding sets TX_CMD rates incorrectly. When the device reports these malformed rates back, the driver can emit warnings and, for beacon rates, trigger a firmware assert/crash that disrupts wireless connectivity. This is a fixed regression with no public exploit identified at time of analysis and a low EPSS score (0.15%), indicating negligible real-world exploitation interest.
Local memory corruption in the Linux kernel's AMD Kernel Fusion Driver (amdkfd) stems from an integer overflow in the KFD debugger's get_queue_ids() routine, where num_queues * sizeof(uint32_t) can wrap on 32-bit size_t builds and produce an undersized allocation. A local user with access to the KFD debug interface can trigger kernel heap corruption impacting confidentiality, integrity, and availability. No public exploit is identified at time of analysis; EPSS is low (0.22%, 12th percentile) and it is not on CISA KEV, but a vendor patch has been released across multiple stable trees.
Local privilege escalation and memory corruption in the Linux kernel's ASoC fs210x audio codec driver arises from a misused strscpy() call in fs210x_effect_scene_info(), where the copy length was derived from the source string (strlen(SRC)+1) rather than the destination buffer size, allowing an overwrite when the source is at least as long as the destination. The flaw affects Linux 6.18 through the fixed stable releases and carries a CVSS of 7.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile), consistent with a local-only kernel driver bug rather than a mass-exploited network flaw.
Local privilege-scoped memory corruption in the Linux kernel's IPsec/xfrm subsystem allows a low-privileged user with network-configuration capability to trigger a massive out-of-bounds kernel write. The xfrm_state_mtu() helper computes an ESP MTU in unsigned modulo-2^32 arithmetic; by installing an IPv4 ESP tunnel SA with an oversized truncated auth key, a tiny interface MTU, and a large XFRMA_TFCPAD value, an attacker forces the result to underflow, and esp_output() later treats it as a negative signed length passed to memset() — producing a near-16 EB write of zeroes at the skb tail. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and the flaw is not in CISA KEV, but the ubiquity of the Linux kernel makes patching important.
Use-after-free in the Linux kernel's in-kernel OpenVPN data-channel module (ovpn) lets a local operator who can create VPN peers over TCP trigger memory corruption when the CMD_NEW_PEER netlink command hits its error path. The flaw affects kernels from 6.16 onward and stems from the error path calling the peer destructor directly instead of dropping the kref, so a concurrent TCP syscall caller (e.g. a recvmsg blocked on the peer's queue) can operate on freed memory. No public exploit identified at time of analysis; EPSS is low (0.21%) and it is not in CISA KEV, but the CVSS 7.8 reflects high confidentiality/integrity/availability impact from local memory corruption.
Local privilege escalation and memory corruption in the Linux kernel SCTP subsystem stems from a race condition where sctp_wait_for_connect() fails to detect that an association was migrated to a new socket via SCTP_SOCKOPT_PEELOFF while the socket lock was released. An attacker with a local account and the ability to open SCTP sockets can race a connecting association against a peeloff getsockopt() call, causing the connect path to operate on asoc->base.sk under the wrong socket lock in sctp_datamsg_from_user(). This is a fixed upstream kernel bug (EUVD-2026-45744) with a vendor patch available; no public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.21% (11th percentile).
Local denial-of-service in the Linux kernel's HPFS (High Performance File System) driver allows a crash when hpfs_map_dnode_bitmap fails and the code subsequently calls hpfs_brelse4 on an uninitialized quad buffer head. Affected are Linux kernels prior to the fixed stable releases (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1) when an HPFS filesystem is mounted. There is no public exploit identified at time of analysis, KEV does not list it, and EPSS is very low (0.21%), consistent with a niche legacy-filesystem bug rather than a broadly weaponizable flaw.
Privilege-independent local crash in the Linux kernel's parport (parallel port) subsystem allows a race between port registration and client-driver attachment, where drivers such as lp bind to ports that are not yet fully initialised or are being torn down, causing a NULL/use-after-free style kernel crash. Affects systems where parport_pc and lp are built as modules and loaded concurrently during boot with PC-style parallel-port hardware present. No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and it is not listed in CISA KEV, consistent with the vendor 'Denial Of Service' tag rather than code execution.
Local privilege escalation and memory corruption in the Linux kernel's Industrial I/O (IIO) buffer hardware-consumer subsystem stems from a use-after-free in the error-handling path of iio_hw_consumer_alloc(). When buffer allocation fails, the cleanup routine iterated the buffer list with the unsafe list_for_each_entry() macro while iio_buffer_put() could free the current buffer, causing the loop to dereference freed memory. CVSS is 7.8 (High) with local vector and low privileges; EPSS is low at 0.21% (11th percentile), and there is no public exploit identified at time of analysis, consistent with this being a defect reachable only in a rare allocation-failure path.
Local denial-of-service (and potential information disclosure) in the Linux kernel's dwc2 USB host controller driver, where debug code dereferences the 'urb' structure after it has already been handed back via usb_hcd_giveback_urb(), causing a use-after-free read of freed memory. The flaw affects systems using the DesignWare HS OTG USB 2.0 controller driver (common on ARM SoCs such as Raspberry Pi). It is patched upstream, has no public exploit identified at time of analysis, and carries a low EPSS score (0.21%).
Stale TLB walk-cache entries in the Linux kernel on arm64 arise because huge_pmd_unshare() marks tlb->unshared_tables=true, but the aarch64 tlb_flush() logic only inspected tlb->freed_tables when deciding between a full invalidation (vae1is) and a leaf-only one (vale1is). As a result, unsharing a hugetlb PMD table leaves the obsolete PMD entry in the walk cache, allowing the MMU to perform incorrect page-table walks against freed/reassigned page-table memory - a potential path to information disclosure or memory corruption on affected 64-bit ARM systems. This is a config/architecture-specific kernel bug with no public exploit identified at time of analysis and a low EPSS (0.21%), and it is not listed in CISA KEV.
Local privilege escalation or denial of service in the Linux kernel's zram block device (writeback path) stems from a use-after-free in zram_writeback_endio, where the bio completion handler calls wake_up() on wb_ctl->done_wait after the writeback task may have already observed num_inflight reach zero and freed wb_ctl via release_wb_ctl(). Affecting kernels around 6.19/7.0 with zram writeback in use, a local attacker who can drive zram writeback activity may trigger the race to corrupt kernel memory, crashing the system or potentially escalating privileges. There is no public exploit identified at time of analysis and EPSS is low (0.21%), consistent with a hard-to-win kernel race rather than a trivially weaponizable bug.
Local privilege escalation or denial of service in the Linux kernel Bluetooth ISO (Isochronous Channels) subsystem arises from a race condition where iso_sock_close() calls iso_sock_clear_timer() before taking the socket lock, letting a concurrent iso_conn_del() free the connection object and trigger a NULL pointer dereference or use-after-free. Any local user able to open and close AF_BLUETOOTH ISO sockets can race the two code paths; UAF of a kernel connection structure can escalate from a crash to memory corruption. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and the issue is not in CISA KEV.
Local privilege escalation or denial of service in the Linux kernel's Intel i915 GPU driver stems from a use-after-free in the TTM object purge path (i915_ttm_purge), where the bo->ttm page-vector container can be replaced by ttm_bo_validate() during eviction, leaving a stale i915_tt pointer that is later dereferenced. A user on DG2 (Intel Arc/discrete) hardware reproduced this as a general protection fault under heavy GPU load during buffer-object eviction. There is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS (0.21%), but the CVSS 7.8 local vector reflects high confidentiality, integrity, and availability impact if the freed memory is groomed and reclaimed.
Arbitrary code execution in keras-team/keras 3.15.0 arises because the public keras.layers.TorchModuleWrapper.from_config method calls torch.load(..., weights_only=False) without any explicit unsafe opt-in, so a maliciously crafted Keras layer configuration deserialized outside a SafeModeScope(True) context triggers execution of attacker-controlled PyTorch pickle payloads (CWE-502). Any application or pipeline that loads untrusted or third-party Keras model/layer configs is affected; CVSS is 7.8 (High) with a local vector requiring user interaction. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the vulnerability class is well understood and reliably weaponizable via standard pickle reduce gadgets.
Local privilege-boundary memory corruption in the Linux kernel L2TP subsystem (net/l2tp) arises because l2tp_session_get_by_ifname() took its reference with a bare refcount_inc() instead of refcount_inc_not_zero(), letting an RCU reader acquire a session whose refcount already hit zero and dereference freed slab memory. Affected kernels include the 6.12.x and 6.18.x stable series (fixed in 6.12.93, 6.18.35, 7.0.12 and 7.1), and the flaw is a race between the IDR/RCU lookup and l2tp_session_free()->kfree_rcu() that is genuinely reachable on PREEMPT_RT builds. There is no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a hard-to-win local race rather than a widely weaponized bug.
Local privilege-boundary memory corruption in the Linux kernel USB gadget FunctionFS (f_fs) driver lets a process with access to the FunctionFS control node trigger a use-after-free by racing a DMABUF request completion against a FUNCTIONFS_DMABUF_DETACH ioctl or the file-close path. The completion frees the usb_request but leaves the priv->req back-pointer dangling, so the cancel path passes freed memory to usb_ep_dequeue(), corrupting kernel memory on SG-capable UDCs (chipidea, cdnsp) that dereference the request immediately. EPSS is low (0.20%, 10th percentile) and there is no public exploit identified at time of analysis; a vendor patch is available across stable trees.
Local memory corruption in the Linux kernel's vsock/virtio transport (AF_VSOCK) arises from a reference-counting lifetime mismatch in the MSG_ZEROCOPY send path, affecting kernels from 6.7 onward. Because virtio_transport_send_pkt_info() reuses or allocates the zerocopy uarg before virtio_transport_alloc_skb() fills the skb, a rollback after a partial fixed-buffer vectored zerocopy attach frees an skb that is flagged SKBFL_MANAGED_FRAG_REFS but has no uarg, causing skb_release_data() to take the wrong unref path. The CVSS 7.8 rating reflects high confidentiality, integrity, and availability impact from local access; there is no public exploit identified at time of analysis and EPSS is low at 0.20%.
Memory-management memory corruption in the Linux kernel's reverse-mapping (rmap) code lets a local, low-privileged user crash the system by corrupting folio refcount/mapcount state. The flaw lives in try_to_unmap_one() (mm/rmap.c), where the nr_pages counter is not reset to 1 at the start of each page-table-walk iteration, so a stale batch count from a prior lazyfree folio unmap is reused against a device-exclusive PTE. No public exploit identified at time of analysis and EPSS is low (0.20%, 10th percentile); the demonstrated userspace-visible effect is a kernel crash (denial of service).
Local privilege escalation and memory corruption in the Linux kernel's XFRM IP-TFS (IPTFS) tunnel subsystem (introduced in 6.14) arises because iptfs_clone_state() shallow-copies runtime state via kmemdup() during IPsec SA cloning. If xfrm_state_migrate() fails after the clone but before re-initialization, the garbage collector can free skbs still owned by the original SA queue, yielding use-after-free and double-free. A local low-privileged actor able to drive IPsec SA migration on an IPTFS-configured tunnel can trigger the flaw; there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Local privilege escalation and memory corruption in the Linux kernel's AMD GPU (amdgpu) DRM driver arises from a race condition in amdgpu_hmm_range_get_pages, where the MMU notifier sequence was read more than once, allowing the driver to operate on stale or invalid page mappings. A local low-privileged user with GPU device access can exploit the timing window to disclose kernel memory or corrupt memory, matching the CVSS 7.8 high/high/high impact profile. There is no public exploit identified at time of analysis, and the EPSS score is low (0.20%, 10th percentile), consistent with a hard-to-time local race rather than a broadly weaponized flaw.
Local privilege escalation and memory corruption in the Linux kernel's virtiofs (virtio-fs) driver arises from a use-after-free triggered when an auto-submount is unmounted, where iput() called from fuse_release_end() can dereference an already-destroyed superblock. Because the FUSE num_waiting counter is per-connection rather than per-superblock, the shutdown wait only protects the last submount instance, leaving earlier submounts exposed. The fix reverts virtiofs auto_submounts to synchronous release requests; no public exploit is identified at time of analysis and EPSS risk is low (0.19%).
Memory corruption in the Linux kernel's cgroup BPF sysctl filtering path allows a local privileged user to corrupt kernel memory and potentially escalate privileges. The bug is a mismatched allocator/deallocator: proc_sys_call_handler() allocates the temporary sysctl buffer with kvzalloc() (which falls back to vmalloc() for large writes) but the replacement path in __cgroup_bpf_run_filter_sysctl() frees it with kfree(), which is invalid for vmalloc-backed memory. It carries a CVSS of 7.8 (High) with a local vector; EPSS is very low (0.19%, 9th percentile) and there is no public exploit identified at time of analysis, consistent with a memory-safety fix flagged by an experimental static-analysis tool rather than in-the-wild abuse.
Local privilege-boundary memory corruption in the Linux kernel dma-buf subsystem allows a local user to trigger a slab-use-after-free via a race in the dma_buf_fd() tracepoint (DMA_BUF_TRACE). After the FD_ADD() conversion, a thread sharing the file descriptor table can close() the freshly installed dma-buf fd before the tracepoint dereferences dmabuf->name_lock, freeing the object under the trace. Fixed in stable 7.0.12 and 7.1; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.19%.