Use-after-free in the Linux kernel's irq_work subsystem allows a local attacker on a PREEMPT_RT (real-time) kernel to corrupt memory by racing irq_work_sync() against irq_work_single(). After the BUSY flag is cleared via atomic_cmpxchg(), the work object is still dereferenced for irq_work_is_hard() and rcuwait_wake_up(), while a concurrent irq_work_sync() caller on another CPU can observe BUSY==0, return, and free the object before those accesses complete. Rated CVSS 7.8 (High); no public exploit identified at time of analysis and EPSS probability is low (0.19%, 8th percentile).
Local denial-of-service in the Linux kernel's IPv4 raw socket path allows a caller holding CAP_NET_RAW to crash the host by sending an IP_HDRINCL packet whose self-reported header length (ihl) is below the RFC 791 minimum of 5. raw_send_hdrinc() checks that the header fits within the message but never rejects ihl < 5, so the malformed header is injected into the output path where downstream consumers such as ah_output() compute a negative header size, cast it to size_t, and perform an OOB memcpy of nearly SIZE_MAX bytes, panicking the kernel. It affects all maintained kernel branches and is reachable from an unprivileged process inside a user+net namespace (CONFIG_USER_NS=y) or a rootless Docker container with NET_ADMIN; no public exploit identified at time of analysis and EPSS risk is low (0.18%).
Denial of service and potential dma_resv fence-list corruption in the Linux kernel's virtio-gpu DRM driver (drm/virtio) affects Linux guests using virtio graphics, where virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() ignore the return value of virtio_gpu_array_lock_resv(). When the lock acquisition fails with -EINTR (signal during wait) or -ENOMEM (fence-slot allocation), the code proceeds to call dma_resv_add_fence() on an unheld lock, tripping a lockdep WARNING and racing concurrent readers/writers of the fence list. There is no public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and the issue was found by syzbot via fault injection rather than in-the-wild abuse.
Out-of-bounds memory access in the Linux kernel's hwmon pmbus/adm1266 driver lets a malicious or malfunctioning ADM1266 PMBus device on the I2C bus trigger a one-byte write past the end of the driver's fixed read_buf array, plus a corresponding out-of-bounds read during the PEC comparison. The read_buf field is sized ADM1266_PMBUS_BLOCK_MAX+1 (256 bytes) while the i2c transaction is programmed for ADM1266_PMBUS_BLOCK_MAX+2 (257 bytes), so a maximum-length block response (255 payload bytes plus a PEC byte) overruns the buffer. No public exploit identified at time of analysis and EPSS risk is low (0.18%, 8th percentile); the flaw is fixed across multiple stable trees.
Out-of-bounds heap write in the Linux kernel's ADM1266 PMBus power-sequencer hwmon driver allows a locally-privileged attacker - aided by a malicious or non-compliant ADM1266 device - to overflow kernel heap memory by up to 191 bytes, potentially achieving privilege escalation or kernel code execution. The root cause is a size-contract violation between adm1266_pmbus_block_xfer() (which trusts device-supplied lengths up to 255 bytes) and adm1266_nvmem_read_blackbox() (which allocates only 64-byte strides). No public exploit code has been identified at time of analysis; EPSS is 0.18%, consistent with low in-the-wild interest.
Out-of-bounds read and write in the Linux kernel's hwmon PMBus ADM1266 driver (adm1266_gpio_get_multiple) lets a local low-privileged user with access to the driver's GPIO interface corrupt adjacent kernel/caller stack memory, potentially leading to privilege escalation or a crash. The flaw stems from an incorrect loop bound (the PMBus command code 0xE9/233 was used instead of the 25-pin ADM1266_PDIO_NR limit), so the scan walks up to 242 bits and reads/writes past the caller-supplied mask and bits arrays. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile) and the CVE is not on CISA KEV.
Out-of-bounds heap write in the AMD SEV debug-encrypt path (sev_dbg_crypt/__sev_dbg_encrypt_user) of the Linux kernel's KVM/SVM code (kvm_amd) lets a local, privileged VMM process corrupt kernel slab memory by up to 15 bytes past a single-page buffer. The per-iteration transfer length is bounded by the source page offset but not the destination page offset, so when d_off > s_off the PSP command and a following memcpy()/copy_from_user() spill beyond the 4096-byte dst_tpage allocation. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but a KASAN slab-use-after-free splat is included in the report, confirming reliable reproducibility.
Use-after-free in the Linux kernel's FUSE (Filesystem in Userspace) subsystem allows a local low-privileged attacker to access or corrupt freed kernel memory by racing a request abort against the page-cache folio replacement path in fuse_try_move_folio(). Because the function unlocks the request on entry but fails to re-lock it on the success path, fuse_chan_abort() can end the request and free the fuse_io_args (e.g., via fuse_readpages_end()) while the subsequent copy-chain logic still dereferences that structure. Rated CVSS 7.8 (local, high C/I/A impact); no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile).
Out-of-bounds array read in the Linux kernel's ALSA ASIHPI (AudioScience HPI) sound driver allows a local, low-privileged user to trigger memory disclosure or a kernel crash by requesting a cached control info entry with an unchecked index. The find_control() helper indexed its cache array with a caller-supplied index without bounds validation; the fix adds a sanity check. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%), and it is not listed in CISA KEV, so this is a routine defense-in-depth hardening fix rather than an urgent threat.
Use-after-free in the Linux kernel ISCI (Intel SAS) driver's device removal path allows a local attacker with low privileges to corrupt kernel memory by racing the completion tasklet against driver teardown, potentially enabling privilege escalation. Systems running affected kernel versions with Intel ISCI SAS hardware are vulnerable across multiple stable branches, with vendor-released fixes available in 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit has been identified and EPSS of 0.18% (7th percentile) confirms no observed widespread exploitation, though the KASAN-verified reproduction documented in the fix commit confirms the failure class is reliably triggerable under controlled conditions.
Local privilege escalation risk arises from a use-after-free in the Linux kernel's NFC LLCP subsystem, where llcp_sock_release() unconditionally unlinks a socket from the local sockets list even when the socket is still in the connecting state and actually resides on the connecting list. A local user able to open NFC LLCP sockets can trigger memory corruption during socket release, with high confidentiality, integrity and availability impact per the CVSS 7.8 rating. No public exploit identified at time of analysis, and EPSS is low (0.18%), consistent with a local-only, hardware-gated attack surface.
Memory corruption in the Linux kernel's SMC (Shared Memory Communications) networking subsystem arises because smc_init() re-runs INIT_HLIST_HEAD() on the smc_v1/smc_v2 hashtables after they may already hold live hash entries, resetting the list heads and corrupting an in-use linked list. A local user able to trigger SMC socket activity during the vulnerable window can cause list corruption leading to high confidentiality, integrity, and availability impact per the CVSS 7.8 (AV:L) rating. This is not actively exploited - no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.18%.
Local denial of service in the Linux kernel's AF_IUCV networking stack allows any unprivileged user on an s390/IBM Z host to crash the machine by racing recvmsg() against getsockopt(SO_MSGSIZE) on a HiperSockets (HIPER) socket. The .getsockopt handler dereferenced iucv->hs_dev->mtu without holding lock_sock(), so a concurrent iucv_sock_close() (triggered from recvmsg) could set hs_dev to NULL between the check and the dereference, producing a NULL pointer dereference oops. EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis; the upstream fix wraps the entire getsockopt switch in lock_sock()/release_sock() to mirror the existing setsockopt locking.
Use-after-free in the Linux kernel's IPv4 sysctl teardown path (ipv4_sysctl_exit_net) can corrupt kernel memory because net->ipv4.sysctl_local_reserved_ports is freed before unregister_net_sysctl_table(), leaving a window where threads accessing /proc/sys/net/ipv4/ip_local_reserved_ports reference freed memory. A local low-privileged attacker able to trigger network namespace teardown could leverage the dangling pointer for memory corruption, information disclosure, or potential privilege escalation. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the issue is not on CISA KEV, consistent with a fix delivered quietly through the kernel stable process.
Local privilege escalation and memory corruption in the Linux kernel's drm/v3d GPU driver (Broadcom VideoCore, used in Raspberry Pi and similar SoCs) stems from a use-after-free on the CPU-job ioctl error path, where kvfree() reads the cpu_job structure after v3d_job_cleanup() has already dropped its last reference and freed it. The same faulty path also causes a NULL-pointer dereference on early init failure and leaks a drm_syncobj reference per query. No public exploit is identified at time of analysis, EPSS is low (0.18%), and it is not in CISA KEV, but a kernel UAF reachable by a local unprivileged user with GPU access carries high impact (CVSS 7.8).
Use-after-free (CWE-416) in the Linux kernel nvme-pci driver allows a local attacker or triggerable hardware condition to crash the kernel or potentially corrupt memory. The nvme_free_host_mem() function frees dev->hmb_sgt but never clears the pointer, so a double-call during an error path in nvme_probe() dereferences the freed and zeroed DMA structure, causing a NULL pointer dereference in iommu_dma_free_noncontiguous(). Observed reliably on Thunderbolt-attached NVMe devices with PCIe link instability; no public exploit or active exploitation identified at time of analysis.
Local privilege escalation via kernel use-after-free in the Linux kernel's hdlc_ppp WAN driver allows a user able to configure synchronous HDLC/PPP network devices to corrupt kernel memory. The bug stems from per-protocol LCP/IPCP/IPV6CP timers embedded in the hdlc->state (struct ppp) allocation being freed with kfree() during device teardown or protocol re-attach without synchronizing a possibly-running timer callback, so an in-flight ppp_timer dereferences freed memory. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; not listed in CISA KEV.
Local credential disclosure in the Linux kernel CIFS/SMB client (kernel 5.11 and later) stems from the CIFS_GENL generic-netlink family exposing the SWN (witness-notify) command and its CIFS_GENL_MCGRP_SWN multicast group without capability enforcement. Any unprivileged local process can join the multicast group to receive witness Register messages that, for NTLM-authenticated mounts, contain the session username, domain, and cleartext password, and can also inject spoofed RESOURCE_CHANGE or CLIENT_MOVE notifications into the in-kernel witness handler. No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a local-only issue.
Slab use-after-free in the Linux kernel's HSR (High-availability Seamless Redundancy) networking subsystem lets a local attacker read freed heap memory. Generic-netlink node-list/node-status operations walk hsr->node_db under rcu_read_lock(), but RTM_DELLINK teardown (hsr_dellink -> hsr_del_nodes) removed nodes with a plain list_del() and freed each hsr_node immediately, so a concurrent reader could dereference a freed node and copy node->macaddress_A. No public exploit is identified at time of analysis and EPSS is low (0.17%, 7th percentile); the flaw is a race-window read primarily affecting confidentiality and stability rather than a remote RCE.
Use-after-free / dangling dentry reference in the Linux kernel's CIFS (SMB) client allows a local user to leave a filesystem dentry in use after unmount, triggering a 'still in use' warning and potential memory corruption. Introduced by commit 340cea84f691c ('cifs: open files should not hold ref on superblock'), the flaw affects multiple stable series (6.1.x, 6.6.x, 6.12.x, 6.18.x, 6.19.x, 7.0.x) where a deferred CIFS close work item can run after the superblock is torn down. No public exploit has been identified, though a crash reproducer is published in the kernel bugzilla, and EPSS is low (0.17%, 7th percentile) with no CISA KEV listing.
Out-of-bounds read in the AMD display (amdgpu) driver of the Linux kernel occurs when the GPIO pin table parsers get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() trust the VBIOS table_header.structuresize field and iterate over gpio_pin[] entries without confirming the full claimed size is mapped. On a system with a malformed or oversized VBIOS structuresize, the loop reads past the end of the BIOS image, potentially disclosing adjacent kernel memory or crashing the driver. There is no public exploit identified at time of analysis, EPSS is low (0.17%), and the issue is not listed in CISA KEV; a vendor patch is available across multiple stable trees.
Use-after-free in the Linux kernel's bridge multicast (br_multicast) subsystem lets a local user with network-configuration capability crash the host or potentially execute code by toggling global multicast snooping while per-VLAN multicast snooping is enabled on a VLAN-filtering bridge. The flawed logic can leave both per-port and per-{port, VLAN} multicast contexts active simultaneously, so a per-port context (including its query timer) survives after the bridge port is freed, yielding a UAF confirmed by kernel debug tooling (ODEBUG free-active). No public exploit has been identified and EPSS is low (0.17%), but a deterministic reproducer is included in the fix, and the CVSS is 7.8 (High).
Use-after-free in the Linux kernel keyring subsystem (security/keys) allows a local low-privileged user to read freed memory because find_key_to_update() calls assoc_array_find() without holding the RCU read lock, racing against assoc_array_gc() which frees nodes after an RCU grace period. The flaw is exercised specifically through the persistent-keyring path, which does not rely on the keyring semaphore that masks the issue for regular keys. No public exploit identified at time of analysis; EPSS probability is low (0.17%, 7th percentile) and it is not listed in CISA KEV.
Out-of-bounds read in the Linux kernel's ethtool module-EEPROM Netlink fallback path allows a local privileged user to read memory beyond the intended EEPROM buffer. The flaw lives in fallback_set_params(), which checks that the requested offset is below eeprom_len but never validates that offset + length also stays within bounds - a check the ioctl path (ethtool_get_any_eeprom()) has always enforced. A compounding issue is the use of plain kmalloc() instead of a zeroed allocation, so uninitialized kernel memory may be returned to the caller. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and it is not in CISA KEV.
Local privilege escalation and denial of service in the Linux kernel's I2C core subsystem arises because an I2C adapter is added to the global IDR lookup table before its embedded struct device is fully initialised. Because i2c_get_adapter() and the i2c-dev chardev (registered via a bus notifier) can look up an adapter by id and take a reference to that device during this window, a concurrent caller can access uninitialised data, leading to NULL-pointer dereference or use-after-free. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; the fix has been merged and backported across stable trees.
Local privilege escalation and kernel memory corruption in the Linux kernel's omap2 framebuffer driver (omapfb) arises from a use-after-free race between omapfb_mmap() and the OMAPFB_SETUP_PLANE/OMAPFB_SETUP_MEM ioctls. Because fb_mmap() holds only mm_lock while the ioctl path holds only fb_info->lock, a local user on a TI OMAP2 device can reassign a framebuffer region mid-mmap so that the map_count of the freed region is never incremented, leaving userspace with a mapping to freed physical memory. This is an information-disclosure/corruption primitive (tagged 'Information Disclosure') with no public exploit identified at time of analysis; the upstream fix is merged and a patched release exists.
Improper inode validation in the Linux kernel's F2FS filesystem allows a crafted or corrupted f2fs image to smuggle a directory entry referencing the synthetic compressed-cache inode number (max_nid), bypassing f2fs_check_nid_range() when the compress_cache mount option is disabled. Because is_meta_ino() unconditionally treats F2FS_COMPRESS_INO() as a meta inode, f2fs_iget() skips do_read_inode() and instantiates a fake internal inode instead of rejecting the out-of-range nid, enabling local memory-safety abuse. No public exploit identified at time of analysis; EPSS probability is low (0.17%, 7th percentile) and it is not on CISA KEV.
Denial of service in the Linux kernel ALSA PCM subsystem allows a local low-privileged user with sound-device access to crash the system on RISC-V hardware. During the transition to iov_iter for PCM data transfer, the silencing path (data = NULL) reused the interleaved iov_iter setup, producing a bogus iterator that triggers a NULL pointer dereference; on most other architectures it was benign, but RISC-V faults. No public exploit is identified at time of analysis, and EPSS risk is low at 0.17% (6th percentile). The kernel tags flag potential information disclosure, though the concretely described symptom is a crash.
Local privilege-holder-triggered use-after-free in the Linux kernel's RADOS block device (rbd) driver allows a kernel crash and potential memory corruption when a Ceph rbd image is unmapped concurrently with in-flight I/O. A TOCTOU race in the exclusive-lock delayed-work (lock_dwork) draining logic lets rbd_acquire_lock() run after the device has been released and its structures freed or reset, violating internal assertions such as rbd_image_format_valid() in rbd_dev_header_info(). No public exploit identified at time of analysis; EPSS is low (0.17%), consistent with a hard-to-win kernel race rather than a broadly weaponizable flaw.
Memory corruption in the Linux kernel netfs subsystem allows local authenticated users to corrupt kernel heap state via a crafted sequence of streaming write operations on network-backed filesystems, potentially enabling local privilege escalation to root. The bug resides in netfs_perform_write(): when a subsequent write fully overwrites a partially-dirty streaming-write folio, the netfs_folio struct that tracks the dirty byte region is neither freed nor correctly updated, leaving stale or inconsistent metadata that drives out-of-bounds writes (CWE-787) during later writeback processing. Patched versions are available across all active stable branches (6.12.92, 7.0.11, 7.1, 6.18.34); no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds kernel memory read in the Linux kernel block layer (block integrity subsystem) stems from bio_integrity_copy_user() overwriting bip_vcnt with nr_vecs after bio_integrity_add_page() had already set it to 1 for the bounce segment. On WRITE this breaks the bip_vcnt <= bip_max_vcnt invariant (bip_max_vcnt is 1), causing gap-merge checks in block/blk.h to read past the bip_vec[] flex array; on READ, in-bounds access lands on a saved user bvec instead of the bounce. A local low-privileged user issuing I/O with user-supplied integrity metadata can trigger information disclosure and instability; there is no public exploit identified at time of analysis and EPSS is very low (0.17%, 6th percentile).
Local privilege-escalation via kernel memory corruption in the Linux accel/qaic driver (Qualcomm Cloud AI 100 accelerator) lets a user with access to the qaic device trigger a use-after-free by mapping a GEM buffer object (BO) larger than its VMA. The qaic_gem_object_mmap path called remap_pfn_range without bounding it to the VMA size, so an oversized BO mapped pages past the VMA; a later munmap() unmaps only the VMA and leaves stale mappings to freed pages. EPSS is low (0.17%, 6th percentile) with no public exploit and no KEV listing, but the C:H/I:H/A:H impact makes it a valid local escalation primitive on affected hardware.
Local privilege-escalation-capable memory corruption in the Linux kernel's ALSA sequencer UMP (MIDI 2.0) client code allows a local user with access to the sound sequencer to trigger a use-after-free. seq_ump_process_event() borrows client->out_rfile.output without synchronizing against the ALSA sequencer output open/close transitions, so a last-close can free the rawmidi substream and its runtime while an in-flight event_input callback is still executing snd_rawmidi_kernel_write(). The race is confirmed reproducible under KASAN as a slab-use-after-free, but there is no public exploit identified at time of analysis and EPSS risk is low (0.17%, 6th percentile).
Local information disclosure and memory corruption in the Linux kernel's rxrpc (AF_RXRPC/AFS) subsystem allows a local user of an encrypted rxrpc socket to trigger pagecache corruption because DATA packets were decrypted in-place on shared sk_buffs while splice() referenced the same pages. This is a hardening follow-up to CVE-2026-43500, replacing in-place decryption with a per-call bounce buffer so recvmsg() copies clean data and the sk_buff is never mutated. No public exploit identified at time of analysis, EPSS is low (0.17%, 6th percentile), and it is not listed in CISA KEV, consistent with a niche kernel subsystem rather than a mass-exploitation target.
Out-of-bounds kernel write in the Linux kernel's ethtool CMIS CDB handling (cmis_cdb_process_reply) allows a malicious or buggy SFP/QSFP transceiver module to corrupt kernel memory by returning a CDB reply whose rpl_len exceeds the expected rpl_exp_len. Affected callers (password validation, module feature discovery, and firmware-management feature discovery) cast the reply payload to fixed-layout structs at fixed offsets, so an over-long reply writes past the kmalloc'd page buffer. There is no public exploit identified at time of analysis, EPSS risk is low (0.17%), and it is not on CISA KEV; the fix is a defensive exact-length check merged upstream and backported to stable trees.
Out-of-bounds kernel write in the Linux kernel's ethtool CMIS firmware-update path (cmis_fw_update_start_download) lets a malicious or malfunctioning pluggable transceiver module overflow a 112-byte stack/heap buffer by returning an oversized start_cmd_payload_size in its CDB FW Management Features reply. The value is used unchecked as a memcpy byte count, so any attacker able to present a crafted module-or corrupt its CDB response-can corrupt adjacent kernel memory. EPSS is very low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; the fix simply rejects payload sizes larger than the destination buffer.
Out-of-bounds heap write in the Linux kernel ethtool netlink coalesce interface allows a local privileged user (CAP_NET_ADMIN) to corrupt kernel memory beyond a 5-element IRQ moderation profile buffer, enabling privilege escalation, denial of service, or information disclosure. The flaw lives in ethnl_update_profile(), which trusts a fully user-controlled Netlink nest count while writing into a kmemdup()'d array sized at NET_DIM_PARAMS_NUM_PROFILES (5). This has been resolved upstream and is not known to be exploited; EPSS probability is low (0.17%, 6th percentile) and no public exploit has been identified at time of analysis.
Use of uninitialized kernel memory in the Linux kernel's IEEE 802.15.4 6LoWPAN transmit path (lowpan_xmit) allows a local attacker to leak or corrupt kernel memory when a non-IPv6 packet (e.g., an ETH_P_AOE frame from the aoe driver) is queued on a 6LoWPAN interface. Because the 6LoWPAN header_create path skips initialization for non-IPv6 traffic, lowpan_xmit unconditionally reads a stale lowpan_addr_info structure from the skb headroom, yielding information disclosure and potential instability (tagged Information Disclosure). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel's AMD GPU (amdgpu) VCN v5.0.0 driver arises because the video encode/decode rings do not support 64-bit user fence writes, yet command-stream (CS) submissions carrying user fences were accepted. A local user with render/DRI device access could submit crafted GPU jobs whose user-fence writes land outside the intended target, corrupting kernel-managed memory. The fix rejects such submissions by setting no_user_fence for the affected ring. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 6th percentile).
Local privilege-context memory corruption/information disclosure in the Linux kernel's AMD GPU (amdgpu) JPEG v2.0 driver arises because JPEG rings do not support 64-bit user fence writes, yet command-submission (CS) requests carrying user fences were accepted. A local authenticated user with GPU/DRM access could submit crafted jobs that trigger unsupported user-fence writes, leading to high confidentiality, integrity, and availability impact (CVSS 7.8). This is a resolved kernel bug with an upstream stable fix; no public exploit has been identified and EPSS exploitation probability is low (0.17%, 7th percentile).
Local privilege escalation potential in the Linux kernel's AMD GPU JPEG v2.5 driver (drm/amdgpu/jpeg) arises because JPEG rings do not support 64-bit user fence writes, yet command-submission (CS) requests carrying user fences were accepted rather than rejected. A local user with GPU access could submit crafted CS requests that trigger memory corruption impacting confidentiality, integrity, and availability. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.17%, 6th percentile), consistent with a hardware-gated local kernel driver bug rather than a mass-exploited flaw.
Local privilege escalation / memory-corruption risk in the Linux kernel's AMD GPU (amdgpu) JPEG v3.0 ring driver, where the ring was allowed to accept command-stream submissions containing 64-bit user fences that the JPEG hardware cannot actually write. The fix flags the JPEG v3.0 ring as no_user_fence and rejects such CS submissions, closing an unvalidated-write condition reachable by any local user with GPU device access. No public exploit identified at time of analysis; EPSS is low (0.17%) and this is not on CISA KEV.
Local memory-corruption/denial-of-service risk in the Linux kernel amdgpu JPEG v4.0 ring (drm/amdgpu/jpeg) arises because JPEG rings cannot perform 64-bit user-fence writes, yet command-stream (CS) submissions carrying user fences were accepted; the fix sets no_user_fence to reject them. A local user with access to the AMD GPU device can submit crafted CS jobs specifying a user fence, causing the ring to attempt a fence write it does not support. No public exploit has been identified and EPSS is low (0.17%, 7th percentile), but the CVSS 3.1 score is 7.8 with high confidentiality, integrity, and availability impact.
Local memory corruption in the Linux kernel's AMD GPU (amdgpu) JPEG v4.0.3 driver allows a user with GPU render-node access to escalate privileges or crash the system by submitting command-stream (CS) work with a 64-bit user fence, which the JPEG ring hardware cannot write correctly. The fix flags the ring with no_user_fence so the kernel rejects such submissions. EPSS is very low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis, so this is a hardening/robustness fix rather than an urgent externally-exploited threat.
Improper user-fence handling in the Linux kernel's AMDGPU JPEG v4.0.5 driver allows a local, low-privileged user to submit GPU command-stream (CS) jobs with 64-bit user fences to a JPEG ring that only supports narrower fence writes, potentially corrupting or disclosing kernel/GPU memory. The fix sets the no_user_fence flag so the driver rejects such CS submissions outright. Rated CVSS 7.8 (local), with no public exploit identified at time of analysis, a low EPSS of 0.17% (6th percentile), and no CISA KEV listing - this is a hardware-specific hardening fix rather than a broadly exploited flaw.
Local privilege escalation and memory corruption in the Linux kernel's amdgpu JPEG v5.0.0 driver allows a low-privileged local user with access to the GPU render node to submit command-stream (CS) requests carrying a 64-bit user fence that the JPEG ring cannot service, corrupting kernel/GPU-writable memory. The fix makes the driver set no_user_fence and reject such submissions. This is a CVSS 7.8 (AV:L) issue with a very low EPSS (0.17%, 6th percentile) and no public exploit identified at time of analysis; it is patched upstream.
Local privilege escalation or denial of service in the Linux kernel's GFS2 filesystem is possible via a use-after-free in gfs2_qd_dealloc(), where an RCU callback dereferences the superblock (sdp) through qd->qd_sbd after gfs2_put_super() may have already freed it via free_sbd() during unmount. The race is exploitable when GFS2 quota cleanup RCU callbacks outlive the 60-second sd_kill_wait timeout or are re-scheduled by gfs2_gl_hash_clear(). No public exploit has been identified at time of analysis, and EPSS is low (0.17%, 6th percentile), consistent with a hard-to-win kernel race rather than a mass-exploited flaw.
Local privilege-escalation-capable memory corruption in the Linux kernel's blk-cgroup (block I/O controller) subsystem allows a local user to trigger a use-after-free in __blkcg_rstat_flush() by concurrently releasing multiple block cgroups (blkgs) within the same blkcg. Affected kernels span 6.4 through the fixed 6.6.144 / 6.12.95 / 6.18.38 / 7.1.3 / 7.2-rc1 line; the flaw carries CVSS 7.8 (local, low-privilege) and is fixed upstream. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Use-after-free in the Linux kernel's TCP Authentication Option (TCP-AO) subsystem lets a local low-privileged user leak freed slab memory by adding a signing key with set_current/set_rnext=1 while a socket is in CLOSE state, transitioning it to LISTEN, then deleting the key asynchronously and reading TCP_AO_INFO. The del_async cleanup path fails to clear the dangling current_key/rnext_key pointers, so a later getsockopt(TCP_AO_INFO) dereferences freed key memory (CVSS 7.8, tagged Information Disclosure). No public exploit identified at time of analysis and EPSS probability is low (0.17%), making this a patchable memory-safety defect rather than an actively exploited threat.
Out-of-bounds array read in the Linux kernel's TI ADS1298 IIO ADC driver (ti-ads1298) lets a local, low-privileged actor read past the 7-element ads1298_pga_settings table when a channel's PGA field decodes to the reserved value 7 (0b111). Affected are systems running the ti-ads1298 driver against a TI ADS1298 biopotential/ECG analog front end; the upstream fix adds a bounds check that returns -EINVAL. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile), consistent with a niche, hardware-dependent code path rather than a broadly weaponizable flaw.