Use-after-free (CWE-416) in the Linux kernel nvme-pci driver allows a local attacker or triggerable hardware condition to crash the kernel or potentially corrupt memory. The nvme_free_host_mem() function frees dev->hmb_sgt but never clears the pointer, so a double-call during an error path in nvme_probe() dereferences the freed and zeroed DMA structure, causing a NULL pointer dereference in iommu_dma_free_noncontiguous(). Observed reliably on Thunderbolt-attached NVMe devices with PCIe link instability; no public exploit or active exploitation identified at time of analysis.
Local privilege escalation via kernel use-after-free in the Linux kernel's hdlc_ppp WAN driver allows a user able to configure synchronous HDLC/PPP network devices to corrupt kernel memory. The bug stems from per-protocol LCP/IPCP/IPV6CP timers embedded in the hdlc->state (struct ppp) allocation being freed with kfree() during device teardown or protocol re-attach without synchronizing a possibly-running timer callback, so an in-flight ppp_timer dereferences freed memory. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; not listed in CISA KEV.
Local credential disclosure in the Linux kernel CIFS/SMB client (kernel 5.11 and later) stems from the CIFS_GENL generic-netlink family exposing the SWN (witness-notify) command and its CIFS_GENL_MCGRP_SWN multicast group without capability enforcement. Any unprivileged local process can join the multicast group to receive witness Register messages that, for NTLM-authenticated mounts, contain the session username, domain, and cleartext password, and can also inject spoofed RESOURCE_CHANGE or CLIENT_MOVE notifications into the in-kernel witness handler. No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a local-only issue.
Slab use-after-free in the Linux kernel's HSR (High-availability Seamless Redundancy) networking subsystem lets a local attacker read freed heap memory. Generic-netlink node-list/node-status operations walk hsr->node_db under rcu_read_lock(), but RTM_DELLINK teardown (hsr_dellink -> hsr_del_nodes) removed nodes with a plain list_del() and freed each hsr_node immediately, so a concurrent reader could dereference a freed node and copy node->macaddress_A. No public exploit is identified at time of analysis and EPSS is low (0.17%, 7th percentile); the flaw is a race-window read primarily affecting confidentiality and stability rather than a remote RCE.
Use-after-free / dangling dentry reference in the Linux kernel's CIFS (SMB) client allows a local user to leave a filesystem dentry in use after unmount, triggering a 'still in use' warning and potential memory corruption. Introduced by commit 340cea84f691c ('cifs: open files should not hold ref on superblock'), the flaw affects multiple stable series (6.1.x, 6.6.x, 6.12.x, 6.18.x, 6.19.x, 7.0.x) where a deferred CIFS close work item can run after the superblock is torn down. No public exploit has been identified, though a crash reproducer is published in the kernel bugzilla, and EPSS is low (0.17%, 7th percentile) with no CISA KEV listing.
Out-of-bounds read in the AMD display (amdgpu) driver of the Linux kernel occurs when the GPIO pin table parsers get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() trust the VBIOS table_header.structuresize field and iterate over gpio_pin[] entries without confirming the full claimed size is mapped. On a system with a malformed or oversized VBIOS structuresize, the loop reads past the end of the BIOS image, potentially disclosing adjacent kernel memory or crashing the driver. There is no public exploit identified at time of analysis, EPSS is low (0.17%), and the issue is not listed in CISA KEV; a vendor patch is available across multiple stable trees.
Use-after-free in the Linux kernel's bridge multicast (br_multicast) subsystem lets a local user with network-configuration capability crash the host or potentially execute code by toggling global multicast snooping while per-VLAN multicast snooping is enabled on a VLAN-filtering bridge. The flawed logic can leave both per-port and per-{port, VLAN} multicast contexts active simultaneously, so a per-port context (including its query timer) survives after the bridge port is freed, yielding a UAF confirmed by kernel debug tooling (ODEBUG free-active). No public exploit has been identified and EPSS is low (0.17%), but a deterministic reproducer is included in the fix, and the CVSS is 7.8 (High).
Use-after-free in the Linux kernel keyring subsystem (security/keys) allows a local low-privileged user to read freed memory because find_key_to_update() calls assoc_array_find() without holding the RCU read lock, racing against assoc_array_gc() which frees nodes after an RCU grace period. The flaw is exercised specifically through the persistent-keyring path, which does not rely on the keyring semaphore that masks the issue for regular keys. No public exploit identified at time of analysis; EPSS probability is low (0.17%, 7th percentile) and it is not listed in CISA KEV.
Out-of-bounds read in the Linux kernel's ethtool module-EEPROM Netlink fallback path allows a local privileged user to read memory beyond the intended EEPROM buffer. The flaw lives in fallback_set_params(), which checks that the requested offset is below eeprom_len but never validates that offset + length also stays within bounds - a check the ioctl path (ethtool_get_any_eeprom()) has always enforced. A compounding issue is the use of plain kmalloc() instead of a zeroed allocation, so uninitialized kernel memory may be returned to the caller. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and it is not in CISA KEV.
Local privilege escalation and denial of service in the Linux kernel's I2C core subsystem arises because an I2C adapter is added to the global IDR lookup table before its embedded struct device is fully initialised. Because i2c_get_adapter() and the i2c-dev chardev (registered via a bus notifier) can look up an adapter by id and take a reference to that device during this window, a concurrent caller can access uninitialised data, leading to NULL-pointer dereference or use-after-free. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; the fix has been merged and backported across stable trees.
Local privilege escalation and kernel memory corruption in the Linux kernel's omap2 framebuffer driver (omapfb) arises from a use-after-free race between omapfb_mmap() and the OMAPFB_SETUP_PLANE/OMAPFB_SETUP_MEM ioctls. Because fb_mmap() holds only mm_lock while the ioctl path holds only fb_info->lock, a local user on a TI OMAP2 device can reassign a framebuffer region mid-mmap so that the map_count of the freed region is never incremented, leaving userspace with a mapping to freed physical memory. This is an information-disclosure/corruption primitive (tagged 'Information Disclosure') with no public exploit identified at time of analysis; the upstream fix is merged and a patched release exists.
Improper inode validation in the Linux kernel's F2FS filesystem allows a crafted or corrupted f2fs image to smuggle a directory entry referencing the synthetic compressed-cache inode number (max_nid), bypassing f2fs_check_nid_range() when the compress_cache mount option is disabled. Because is_meta_ino() unconditionally treats F2FS_COMPRESS_INO() as a meta inode, f2fs_iget() skips do_read_inode() and instantiates a fake internal inode instead of rejecting the out-of-range nid, enabling local memory-safety abuse. No public exploit identified at time of analysis; EPSS probability is low (0.17%, 7th percentile) and it is not on CISA KEV.
Denial of service in the Linux kernel ALSA PCM subsystem allows a local low-privileged user with sound-device access to crash the system on RISC-V hardware. During the transition to iov_iter for PCM data transfer, the silencing path (data = NULL) reused the interleaved iov_iter setup, producing a bogus iterator that triggers a NULL pointer dereference; on most other architectures it was benign, but RISC-V faults. No public exploit is identified at time of analysis, and EPSS risk is low at 0.17% (6th percentile). The kernel tags flag potential information disclosure, though the concretely described symptom is a crash.
Local privilege-holder-triggered use-after-free in the Linux kernel's RADOS block device (rbd) driver allows a kernel crash and potential memory corruption when a Ceph rbd image is unmapped concurrently with in-flight I/O. A TOCTOU race in the exclusive-lock delayed-work (lock_dwork) draining logic lets rbd_acquire_lock() run after the device has been released and its structures freed or reset, violating internal assertions such as rbd_image_format_valid() in rbd_dev_header_info(). No public exploit identified at time of analysis; EPSS is low (0.17%), consistent with a hard-to-win kernel race rather than a broadly weaponizable flaw.
Memory corruption in the Linux kernel netfs subsystem allows local authenticated users to corrupt kernel heap state via a crafted sequence of streaming write operations on network-backed filesystems, potentially enabling local privilege escalation to root. The bug resides in netfs_perform_write(): when a subsequent write fully overwrites a partially-dirty streaming-write folio, the netfs_folio struct that tracks the dirty byte region is neither freed nor correctly updated, leaving stale or inconsistent metadata that drives out-of-bounds writes (CWE-787) during later writeback processing. Patched versions are available across all active stable branches (6.12.92, 7.0.11, 7.1, 6.18.34); no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds kernel memory read in the Linux kernel block layer (block integrity subsystem) stems from bio_integrity_copy_user() overwriting bip_vcnt with nr_vecs after bio_integrity_add_page() had already set it to 1 for the bounce segment. On WRITE this breaks the bip_vcnt <= bip_max_vcnt invariant (bip_max_vcnt is 1), causing gap-merge checks in block/blk.h to read past the bip_vec[] flex array; on READ, in-bounds access lands on a saved user bvec instead of the bounce. A local low-privileged user issuing I/O with user-supplied integrity metadata can trigger information disclosure and instability; there is no public exploit identified at time of analysis and EPSS is very low (0.17%, 6th percentile).
Local privilege-escalation via kernel memory corruption in the Linux accel/qaic driver (Qualcomm Cloud AI 100 accelerator) lets a user with access to the qaic device trigger a use-after-free by mapping a GEM buffer object (BO) larger than its VMA. The qaic_gem_object_mmap path called remap_pfn_range without bounding it to the VMA size, so an oversized BO mapped pages past the VMA; a later munmap() unmaps only the VMA and leaves stale mappings to freed pages. EPSS is low (0.17%, 6th percentile) with no public exploit and no KEV listing, but the C:H/I:H/A:H impact makes it a valid local escalation primitive on affected hardware.
Local privilege-escalation-capable memory corruption in the Linux kernel's ALSA sequencer UMP (MIDI 2.0) client code allows a local user with access to the sound sequencer to trigger a use-after-free. seq_ump_process_event() borrows client->out_rfile.output without synchronizing against the ALSA sequencer output open/close transitions, so a last-close can free the rawmidi substream and its runtime while an in-flight event_input callback is still executing snd_rawmidi_kernel_write(). The race is confirmed reproducible under KASAN as a slab-use-after-free, but there is no public exploit identified at time of analysis and EPSS risk is low (0.17%, 6th percentile).
Local information disclosure and memory corruption in the Linux kernel's rxrpc (AF_RXRPC/AFS) subsystem allows a local user of an encrypted rxrpc socket to trigger pagecache corruption because DATA packets were decrypted in-place on shared sk_buffs while splice() referenced the same pages. This is a hardening follow-up to CVE-2026-43500, replacing in-place decryption with a per-call bounce buffer so recvmsg() copies clean data and the sk_buff is never mutated. No public exploit identified at time of analysis, EPSS is low (0.17%, 6th percentile), and it is not listed in CISA KEV, consistent with a niche kernel subsystem rather than a mass-exploitation target.
Out-of-bounds kernel write in the Linux kernel's ethtool CMIS CDB handling (cmis_cdb_process_reply) allows a malicious or buggy SFP/QSFP transceiver module to corrupt kernel memory by returning a CDB reply whose rpl_len exceeds the expected rpl_exp_len. Affected callers (password validation, module feature discovery, and firmware-management feature discovery) cast the reply payload to fixed-layout structs at fixed offsets, so an over-long reply writes past the kmalloc'd page buffer. There is no public exploit identified at time of analysis, EPSS risk is low (0.17%), and it is not on CISA KEV; the fix is a defensive exact-length check merged upstream and backported to stable trees.
Out-of-bounds kernel write in the Linux kernel's ethtool CMIS firmware-update path (cmis_fw_update_start_download) lets a malicious or malfunctioning pluggable transceiver module overflow a 112-byte stack/heap buffer by returning an oversized start_cmd_payload_size in its CDB FW Management Features reply. The value is used unchecked as a memcpy byte count, so any attacker able to present a crafted module-or corrupt its CDB response-can corrupt adjacent kernel memory. EPSS is very low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; the fix simply rejects payload sizes larger than the destination buffer.
Out-of-bounds heap write in the Linux kernel ethtool netlink coalesce interface allows a local privileged user (CAP_NET_ADMIN) to corrupt kernel memory beyond a 5-element IRQ moderation profile buffer, enabling privilege escalation, denial of service, or information disclosure. The flaw lives in ethnl_update_profile(), which trusts a fully user-controlled Netlink nest count while writing into a kmemdup()'d array sized at NET_DIM_PARAMS_NUM_PROFILES (5). This has been resolved upstream and is not known to be exploited; EPSS probability is low (0.17%, 6th percentile) and no public exploit has been identified at time of analysis.
Use of uninitialized kernel memory in the Linux kernel's IEEE 802.15.4 6LoWPAN transmit path (lowpan_xmit) allows a local attacker to leak or corrupt kernel memory when a non-IPv6 packet (e.g., an ETH_P_AOE frame from the aoe driver) is queued on a 6LoWPAN interface. Because the 6LoWPAN header_create path skips initialization for non-IPv6 traffic, lowpan_xmit unconditionally reads a stale lowpan_addr_info structure from the skb headroom, yielding information disclosure and potential instability (tagged Information Disclosure). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel's AMD GPU (amdgpu) VCN v5.0.0 driver arises because the video encode/decode rings do not support 64-bit user fence writes, yet command-stream (CS) submissions carrying user fences were accepted. A local user with render/DRI device access could submit crafted GPU jobs whose user-fence writes land outside the intended target, corrupting kernel-managed memory. The fix rejects such submissions by setting no_user_fence for the affected ring. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 6th percentile).
Local privilege-context memory corruption/information disclosure in the Linux kernel's AMD GPU (amdgpu) JPEG v2.0 driver arises because JPEG rings do not support 64-bit user fence writes, yet command-submission (CS) requests carrying user fences were accepted. A local authenticated user with GPU/DRM access could submit crafted jobs that trigger unsupported user-fence writes, leading to high confidentiality, integrity, and availability impact (CVSS 7.8). This is a resolved kernel bug with an upstream stable fix; no public exploit has been identified and EPSS exploitation probability is low (0.17%, 7th percentile).
Local privilege escalation potential in the Linux kernel's AMD GPU JPEG v2.5 driver (drm/amdgpu/jpeg) arises because JPEG rings do not support 64-bit user fence writes, yet command-submission (CS) requests carrying user fences were accepted rather than rejected. A local user with GPU access could submit crafted CS requests that trigger memory corruption impacting confidentiality, integrity, and availability. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.17%, 6th percentile), consistent with a hardware-gated local kernel driver bug rather than a mass-exploited flaw.
Local privilege escalation / memory-corruption risk in the Linux kernel's AMD GPU (amdgpu) JPEG v3.0 ring driver, where the ring was allowed to accept command-stream submissions containing 64-bit user fences that the JPEG hardware cannot actually write. The fix flags the JPEG v3.0 ring as no_user_fence and rejects such CS submissions, closing an unvalidated-write condition reachable by any local user with GPU device access. No public exploit identified at time of analysis; EPSS is low (0.17%) and this is not on CISA KEV.
Local memory-corruption/denial-of-service risk in the Linux kernel amdgpu JPEG v4.0 ring (drm/amdgpu/jpeg) arises because JPEG rings cannot perform 64-bit user-fence writes, yet command-stream (CS) submissions carrying user fences were accepted; the fix sets no_user_fence to reject them. A local user with access to the AMD GPU device can submit crafted CS jobs specifying a user fence, causing the ring to attempt a fence write it does not support. No public exploit has been identified and EPSS is low (0.17%, 7th percentile), but the CVSS 3.1 score is 7.8 with high confidentiality, integrity, and availability impact.
Local memory corruption in the Linux kernel's AMD GPU (amdgpu) JPEG v4.0.3 driver allows a user with GPU render-node access to escalate privileges or crash the system by submitting command-stream (CS) work with a 64-bit user fence, which the JPEG ring hardware cannot write correctly. The fix flags the ring with no_user_fence so the kernel rejects such submissions. EPSS is very low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis, so this is a hardening/robustness fix rather than an urgent externally-exploited threat.
Improper user-fence handling in the Linux kernel's AMDGPU JPEG v4.0.5 driver allows a local, low-privileged user to submit GPU command-stream (CS) jobs with 64-bit user fences to a JPEG ring that only supports narrower fence writes, potentially corrupting or disclosing kernel/GPU memory. The fix sets the no_user_fence flag so the driver rejects such CS submissions outright. Rated CVSS 7.8 (local), with no public exploit identified at time of analysis, a low EPSS of 0.17% (6th percentile), and no CISA KEV listing - this is a hardware-specific hardening fix rather than a broadly exploited flaw.
Local privilege escalation and memory corruption in the Linux kernel's amdgpu JPEG v5.0.0 driver allows a low-privileged local user with access to the GPU render node to submit command-stream (CS) requests carrying a 64-bit user fence that the JPEG ring cannot service, corrupting kernel/GPU-writable memory. The fix makes the driver set no_user_fence and reject such submissions. This is a CVSS 7.8 (AV:L) issue with a very low EPSS (0.17%, 6th percentile) and no public exploit identified at time of analysis; it is patched upstream.
Local privilege escalation or denial of service in the Linux kernel's GFS2 filesystem is possible via a use-after-free in gfs2_qd_dealloc(), where an RCU callback dereferences the superblock (sdp) through qd->qd_sbd after gfs2_put_super() may have already freed it via free_sbd() during unmount. The race is exploitable when GFS2 quota cleanup RCU callbacks outlive the 60-second sd_kill_wait timeout or are re-scheduled by gfs2_gl_hash_clear(). No public exploit has been identified at time of analysis, and EPSS is low (0.17%, 6th percentile), consistent with a hard-to-win kernel race rather than a mass-exploited flaw.
Local privilege-escalation-capable memory corruption in the Linux kernel's blk-cgroup (block I/O controller) subsystem allows a local user to trigger a use-after-free in __blkcg_rstat_flush() by concurrently releasing multiple block cgroups (blkgs) within the same blkcg. Affected kernels span 6.4 through the fixed 6.6.144 / 6.12.95 / 6.18.38 / 7.1.3 / 7.2-rc1 line; the flaw carries CVSS 7.8 (local, low-privilege) and is fixed upstream. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Use-after-free in the Linux kernel's TCP Authentication Option (TCP-AO) subsystem lets a local low-privileged user leak freed slab memory by adding a signing key with set_current/set_rnext=1 while a socket is in CLOSE state, transitioning it to LISTEN, then deleting the key asynchronously and reading TCP_AO_INFO. The del_async cleanup path fails to clear the dangling current_key/rnext_key pointers, so a later getsockopt(TCP_AO_INFO) dereferences freed key memory (CVSS 7.8, tagged Information Disclosure). No public exploit identified at time of analysis and EPSS probability is low (0.17%), making this a patchable memory-safety defect rather than an actively exploited threat.
Out-of-bounds array read in the Linux kernel's TI ADS1298 IIO ADC driver (ti-ads1298) lets a local, low-privileged actor read past the 7-element ads1298_pga_settings table when a channel's PGA field decodes to the reserved value 7 (0b111). Affected are systems running the ti-ads1298 driver against a TI ADS1298 biopotential/ECG analog front end; the upstream fix adds a bounds check that returns -EINVAL. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile), consistent with a niche, hardware-dependent code path rather than a broadly weaponizable flaw.
Memory leak in the Linux kernel's wilc1000 WiFi driver exposes systems with Microchip WILC1000 adapters to kernel heap exhaustion. The function wilc_wlan_firmware_download() allocates a DMA buffer via kmalloc() but an early-return path after the first acquire_bus() call bypasses the established cleanup label, leaking the buffer unconditionally on bus acquire failures. No public exploit has been identified and EPSS probability is extremely low (0.17%, 6th percentile), but repeated triggering on affected embedded hardware could degrade system stability. Upstream stable fixes are available as confirmed kernel commits targeting 6.18.x, 7.0.x, and 7.1.
Memory corruption in the Linux kernel netfilter x_tables subsystem lets a local user with network-admin capability trigger a use-after-free during table module removal (rmmod) while userspace performs concurrent set/getsockopt operations on the same table. The fix introduces a two-stage teardown (xtables_unregister_table_exit) that unlinks the table from the dying list, frees hook ops, and emits the audit notification, replacing the racy single-stage xt_unregister_table(). Rated CVSS 7.8 (local, high CIA impact); EPSS is low (0.17%), it is not in CISA KEV, and no public exploit has been identified at time of analysis.
Local privilege escalation and memory disclosure in the Linux kernel's netfilter ebtables subsystem stems from a table-removal race that could expose a partially-initialized ebt_table structure before its ops pointer is assigned. On affected kernels (5.15 through the fixes in 6.18.34, 7.0.11 and 7.1), a local user with network-administration capability manipulating ebtables can trigger the window between allocation and full initialization, corrupting or reading kernel memory. No public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile), consistent with a race-condition bug requiring local access rather than mass exploitation.
Local privilege escalation and memory-safety exposure in the Linux kernel netfilter bridge ebtables subsystem stems from a module-initialization race where nf_register_sockopt() runs before ebtables data structures are fully initialized, exposing the setsockopt/getsockopt interface globally too early. On affected kernels (5.13 through builds before the 6.18.34 / 7.0.11 / 7.1 stable fixes), a local low-privileged actor with the ability to reach ebtables sockopts during the init window can trigger operations on uninitialized state, risking high confidentiality, integrity, and availability impact (CVSS 7.8). There is no public exploit identified at time of analysis and EPSS is low (0.17%), so this is a code-correctness fix rather than an actively exploited threat.
Use-after-free in the Linux kernel's fprobe subsystem exposes kernel memory to corruption when a fprobe is released immediately after unregistration without waiting for an RCU grace period. The flaw was introduced by commit 4346ba1604093, which rewrote fprobe on the function-graph tracer and placed struct fprobe on an RCU-protected hlist but omitted the required synchronize_rcu() call in unregister_fprobe(), leaving a window where in-flight RCU readers may dereference freed memory. BPF users of fprobe are explicitly unaffected because BPF defers deallocation through the bpf_link_defer_dealloc_rcu_gp() RCU callback; affected paths are fprobe events and sample module code.
Local privilege-adjacent memory corruption in the Linux kernel's fs/statmount subsystem allows an authenticated local user to trigger a 1-byte NULL out-of-bounds write on a dynamically allocated seq buffer. The flaw lives in statmount_mnt_idmap(), which manually advances seq->count after seq_printf(); on overflow this desynchronizes the buffer accounting so seq_has_overflowed() misses the overflow and a later 'seq->buf[seq->count++] = 0' writes past the slab allocation. Rated CVSS 7.8 (High); EPSS is low (0.17%, 6th percentile), no public exploit or CISA KEV listing exists at time of analysis, and a vendor fix is available.
Local information disclosure and memory corruption in the Linux kernel's netfs subsystem arises because netfs_read_folio() does not wait for in-flight writeback to complete before trusting the folio dirty flag and the folio->private data, which the writeback collector may free before it clears the writeback flag. Hosts using network/cache-backed filesystems (9p, AFS, Ceph, CIFS/SMB, and fscache-backed mounts) can hit a race where a read consumes stale or freed metadata. There is no public exploit identified at time of analysis and the EPSS probability is low (0.17%, 6th percentile); the fix is merged in stable releases 6.18.34, 7.0.11, and 7.1.
Double-free memory corruption in the Linux kernel's net/shaper subsystem allows a local attacker with CAP_NET_ADMIN capability to corrupt the kernel heap by submitting a crafted GROUP netlink request containing duplicate leaf handles. Affected kernels span from the introduction of the net shaper subsystem (~6.13) through multiple stable branches, with fixes backported to 6.18.34, 7.0.11, and 7.1. No public exploit or active exploitation has been identified; vendor-released patches are available via kernel.org and distribution advisories such as Ubuntu USN-8593-1.
Use-after-free in the Linux kernel's Qualcomm MSM Display Processing Unit (DPU) DRM driver arises because dpu_writeback_init() mixes device-managed (devm_) and DRM-managed (drmm_) allocation lifetimes. On driver teardown, the writeback connector's data is freed via devm while userspace still holds a reference to the drm device and can interact with the drmm-backed connector, creating a dangling pointer a local user can exploit. Rated CVSS 7.8 (local, low-privilege); EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis.
Local privilege-context memory corruption in the Linux kernel's cgroup/rstat subsystem allows a process holding CAP_BPF and CAP_PERFMON to trigger an out-of-bounds array access by passing an unvalidated CPU index to the css_rstat_updated() BPF kfunc. Because the caller-supplied cpu argument is used for per-cpu rstat lookups without a possible-CPU bounds check, a value such as 0x7fffffff drives an array-index-out-of-bounds condition (confirmed on UBSAN kernels) inside kernel/cgroup/rstat.c. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; exploitation requires elevated BPF-related capabilities, which sharply narrows the realistic attacker set.
Local privilege escalation / memory-corruption potential in the Linux kernel's EROFS filesystem arises from a managed-cache race condition affecting unaligned compressed extents. When two threads process the same Z_EROFS_PREALLOCATED_FOLIO for different pclusters, one thread can call filemap_add_folio() a second time on a folio whose private state was not yet cleared, corrupting the managed page cache. Rated CVSS 7.8 (AV:L), it affects EROFS images built with unaligned data compression (e.g. -E48bit with zstd); EPSS is low (0.17%, 6th percentile), it is not in CISA KEV, and no public exploit identified at time of analysis.
Use-after-free in the Linux kernel's net shaper subsystem allows a local, low-privileged attacker to trigger memory corruption via a race condition in the network shaper API's XArray-based entry tracking. Because XArray 'VALID' marks are not stored atomically with their entries, a reader can observe a VALID slot, be preempted while a writer replaces the entry, and then dereference a stale pointer that net_shaper_rollback() has already freed, enabling potential privilege escalation or information disclosure. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 6th percentile).
Local privilege escalation and memory corruption in the Linux kernel GPIO aggregator driver (gpio-aggregator) arises from a use-after-free on the error-handling path, where `aggr->lookups->dev_id` is freed before the lookup entry is removed from the table. A concurrent thread calling `gpiod_find()` can then dereference the freed `dev_id` via `strcmp()` in `gpiod_match_lookup_table()`, yielding a UAF that a low-privileged local attacker could leverage for code execution or DoS. There is no public exploit identified at time of analysis, and EPSS is low (0.17%), consistent with a race-condition kernel bug requiring local access rather than a mass-exploitation candidate.
Local privilege escalation via use-after-free in the Linux kernel accel/rocket driver (Rockchip NPU accelerator) allows an authenticated local user with access to the accel device node to dereference freed slab memory. The flaw stems from rocket_ioctl_create_bo() registering a GEM handle in the file IDR before fallible operations (sgt allocation, drm_mm insert, iommu_map); on failure the object is freed while the handle stays live, and any later PREP_BO/FINI_BO/SUBMIT ioctl triggers the UAF. No public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile).
Local privilege/memory-safety flaw in the Linux kernel's amdgpu VCN (Video Core Next) v5.0.1 driver allows a local user with GPU render-node access to submit command-stream (CS) requests containing 64-bit user fences that the VCN encoder/decoder rings cannot handle, leading to high-impact corruption (CVSS 7.8, tagged Information Disclosure). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile). A vendor patch is available upstream in the kernel stable tree.