Local privilege-adjacent memory corruption in the Linux kernel's AMD GPU JPEG engine (amdgpu driver, JPEG v5.0.1 ring) allows a local low-privileged user to submit command-stream (CS) submissions containing 64-bit user fences that the JPEG ring cannot service. Because the ring lacks support for user fence writes, accepting such submissions leads to high-impact confidentiality, integrity, and availability consequences (CVSS 7.8). No public exploit identified at time of analysis, and EPSS is very low (0.17%), consistent with a hardware-specific, locally-scoped GPU driver flaw rather than a mass-exploitation target.
A local privilege-context memory corruption in the Linux kernel's IBM PowerPC 'nx' hardware crypto driver (drivers/crypto/nx) causes a kernel oops when userspace uses the AF_ALG socket interface for shash hashing. nx_crypto_ctx_shash_exit passed a wrong pointer type (an nx_crypto_ctx* treated as a crypto_tfm*) into nx_crypto_ctx_exit, producing a bad-address kernel access (observed at 0xc0403effffffffc8) during teardown, reachable by any local user - e.g. hardlink(1) opportunistically selecting AF_ALG. No public exploit is identified at time of analysis; EPSS is low (0.17%) and this is not on CISA KEV, so real-world risk is a local denial-of-service (kernel crash) on affected NX-capable POWER systems rather than confirmed code execution.
Local privilege-relevant memory corruption in the Linux kernel's KEYS subsystem allows an authenticated local user to overflow an internal output buffer via the keyctl() public-key operation path. The flaw stems from keyctl_pkey_params_get_2() sizing its internal output buffer using the caller-supplied length instead of the cryptographic primitive's maximum length, so a too-small buffer triggers a heap overflow. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not on CISA KEV, so risk is theoretical rather than actively exploited.
Local privilege escalation via a use-after-free in the Linux kernel's key management (keys) subsystem allows an unprivileged local user to corrupt kernel memory by racing a request_key() helper against KEYCTL_INSTANTIATE_IOV. The request_key_auth payload (rka) could be detached and freed by the key-request helper's completion path while a concurrent instantiate/reject operation was still dereferencing rka->target_key, yielding a UAF (CWE-416). It is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is low at 0.17% (6th percentile), and a vendor patch is available across multiple stable branches.
Out-of-bounds heap read in the Linux kernel's F2FS filesystem lets a local low-privileged user disclose adjacent kernel memory or crash the system by reading POSIX ACLs from a maliciously crafted f2fs image. The flaw lives in f2fs_acl_from_disk() (fs/f2fs/acl.c), which dereferences an ACL entry's e_id before confirming a full f2fs_acl_entry fits in the xattr buffer. It is fixed upstream, carries CVSS 7.8, and shows a very low EPSS (0.17%, 6th percentile); there is a KASAN crash reproducer in the report but no public weaponized exploit and no CISA KEV listing - no public exploit identified at time of analysis.
Memory-management corruption in the Linux kernel (introduced in 6.18) affects x86 32-bit systems with Transparent Huge Pages (THP) enabled, where __vm_normal_page() fails to recognize the huge zero PMD because pmd_special()/pud_special() are gated behind CONFIG_ARCH_SUPPORTS_PMD_PFNMAP, which is never set on any 32-bit architecture. A local user allocating THP mappings can trigger VM_WARN warnings, bad rss-counter and bad page state conditions, and mis-accounting of the huge zero folio as file-backed THP. No public exploit has been identified and EPSS is low (0.16%), consistent with a niche, non-default trigger condition.
Local privilege-escalation-class memory corruption in the Linux kernel's AppArmor LSM affects the policy-replacement path (aa_replace_profiles) across a wide span of stable branches (5.10 through 7.1). During the rawdata deduplication loop, aa_get_profile_loaddata() performs an unconditional kref_get() on struct aa_loaddata entries whose pcount has already dropped to zero but which remain briefly on ns->rawdata_list before the deferred do_ploaddata_rmfs() workqueue frees them, producing a refcount 'addition on 0' use-after-free. Exploitation requires local access with the ability to load AppArmor policy and winning a narrow race; there is no public exploit identified at time of analysis and EPSS risk is low (0.16%, 6th percentile).
Local privilege escalation and memory corruption in the Linux kernel's amdgpu VCN (Video Core Next) driver arises because VCN v2.0 encoder and decoder rings accept command-stream (CS) submissions carrying 64-bit user fence writes that the hardware does not actually support. A local user able to submit GPU work (via /dev/dri render nodes) can trigger the driver to perform unsupported fence writes, leading to high-impact confidentiality, integrity, and availability effects consistent with kernel memory corruption or information disclosure. There is no public exploit identified at time of analysis, EPSS is low (0.16%), and the issue is not on the CISA KEV list, so this is a locally-scoped hardening/correctness fix rather than a remotely exploitable emergency.
Local privilege escalation and memory corruption in the Linux kernel amdgpu driver stems from VCN (Video Core Next) v2.5 encoder/decoder rings accepting command-stream submissions that request 64-bit user fence writes, an operation the hardware does not support. A local user with render-node access to an AMD GPU can submit a crafted CS with a user fence, causing the kernel to write to an unsupported/attacker-influenced fence address. No public exploit is identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the flaw is not in CISA KEV.
Local privilege escalation and memory-corruption risk in the amdgpu driver's VCN (Video Core Next) v3.0 encoder/decoder rings allows an authenticated local user with GPU render-node access to submit command streams containing 64-bit user-fence writes that the hardware does not support, corrupting kernel memory. The fix marks these rings with no_user_fence so the kernel rejects any command submission carrying a user fence. This affects Linux kernels from 5.9 onward that ship the AMD VCN 3.0 support; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.16% (5th percentile).
Local privilege-adjacent memory corruption in the Linux kernel's AMD GPU (amdgpu) VCN v4.0.3 driver arises because the video encode/decode rings accept command-stream submissions carrying 64-bit user fences that the hardware cannot honor. A local user with GPU/DRM access could submit crafted VCN jobs with user fences, leading to out-of-bounds fence writes and kernel memory corruption. No public exploit has been identified at the time of analysis, EPSS is low (0.16%, 5th percentile), and the flaw is not on the CISA KEV list; a vendor patch is available.
Local privilege escalation / memory corruption in the Linux kernel's AMD GPU driver (amdgpu VCN v4.0.5) allows an authenticated local user to submit command-stream (CS) requests carrying 64-bit user fences to VCN encoder/decoder rings that do not support them, corrupting kernel memory. The fix marks the affected rings with no_user_fence so the kernel rejects such submissions. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not on CISA KEV, but CVSS scores high impact (7.8) due to full C/I/A compromise from a local unprivileged-to-low-privileged vector.
Local privilege-adjacent memory corruption in the Linux kernel's AMD GPU (amdgpu) JPEG v5.3.0 driver arises because the ring did not set the no_user_fence flag, allowing command-stream (CS) submissions carrying 64-bit user fence writes that the JPEG ring cannot support. A local user with GPU/DRM device access can submit crafted CS with user fences, leading to undefined ring behavior and high impact on confidentiality, integrity, and availability. No public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%), but a vendor (upstream stable) patch is available.
Local privilege-adjacent memory corruption in the Linux kernel's F2FS filesystem allows a low-privileged user with access to an F2FS-mounted volume to trigger a use-after-free on the atomic_inode structure. During garbage collection of an atomic (copy-on-write) file via ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE), a race with concurrent inode eviction lets the kernel dereference and populate the page mapping of an already-freed atomic_inode, corrupting kernel memory and typically causing a BUG_ON/crash. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and this is not on CISA KEV. A vendor fix that takes a reference on fi->atomic_inode before use has been merged upstream.
Filesystem cache-consistency flaw in the Linux kernel's F2FS (Flash-Friendly File System) driver leaves a stale 'largest extent' entry cached when __destroy_extent_node() sets the FI_NO_EXTENT inode flag without resetting the extent length or updating the inode folio, causing the extent tree to diverge from on-disk metadata. Affected are local users of F2FS-formatted volumes across many stable kernel lines (6.6.x through 6.18.x and 7.x pre-releases); the bug surfaces as a sanity_check_extent_cache error (reproduced by xfstests generic/388) and, per source tagging, carries an information-disclosure angle because stale block mappings can point reads at the wrong physical blocks. No public exploit identified at time of analysis; EPSS is 0.16% (5th percentile), and it is not on CISA KEV.
Local memory corruption in the Linux kernel scheduler's per-mm concurrency-ID (mm_cid) subsystem lets an unprivileged task trigger a deterministic out-of-bounds single-bit clear in kernel memory. The flaw lives in mm_cid_fixup_cpus_to_tasks(), where a task whose CID is still the MM_CID_UNSET sentinel (BIT(31)) is wrongly marked in-transit and later fed to clear_bit(), clearing a bit 256 MiB past the mm_struct CID bitmap. It was surfaced by syzkaller as a KASAN use-after-free in __schedule; no public weaponized exploit and no CISA KEV listing exist at time of analysis.
Local information disclosure and use-after-free in the Linux kernel NTFS filesystem driver lets a low-privileged local user read freed kernel memory by racing the FS_IOC_GETFSLABEL and FS_IOC_SETFSLABEL ioctls against a mounted NTFS volume. Because vol->volume_label is copied to userspace via copy_to_user without serialization, a concurrent SETFSLABEL that replaces the label can free the buffer mid-read, leaking kernel data or crashing the system. No public exploit is identified at time of analysis and it is not in CISA KEV; a vendor patch is available in Linux 7.1.3 and 7.2-rc1.
Improper error-path handling in the Linux kernel IOMMU subsystem allows unbalanced debug-tracking operations when CONFIG_IOMMU_DEBUG is enabled and an IOMMU map operation fails partway. When iommu_map_nosync() hits an error, the cleanup path invoked iommu_unmap()/iommu_debug_unmap_begin()/end() against a mapping the debug layer never recorded via iommu_debug_map(), corrupting internal tracking state and producing spurious unmatched trace records. The fix lifts unmap error handling into iommu_map_nosync() and reorders it so trace_map()/iommu_debug_map() records the partial mapping before immediately unmapping it. This is a locally-scoped, debug-configuration-dependent issue with no public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and it is not in CISA KEV.
Kernel stack information disclosure and register-state corruption affects the Linux kernel's RISC-V 32-bit compat layer, where compat_riscv_gpr_set() (the PTRACE_SETREGSET handler) and compat_restore_sigcontext() (the compat sigreturn path) call cregs_to_regs() even after the user copy fails, writing an uninitialized stack buffer into the target task's pt_regs. A local low-privileged attacker running a 32-bit process on a riscv64 kernel can force the copy to fail and leak uninitialized kernel stack contents into user-visible registers while corrupting the task's register state. There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), consistent with the narrow RISC-V compat attack surface.
Improper locking in the Linux kernel AFS (Andrew File System) client's symbolic link handling (afs_get_link()) allows a local attacker on a host mounting an AFS volume to trigger race conditions that leak kernel memory and can expose stale or freed symlink buffers. The flaw affects kernels from roughly 6.14 up to the fixed 7.0.11/7.1 stable series and stems from a missing validate_lock, absent RCU barriering during lockless pathwalk, and unsynchronized access when a symlink is concurrently updated on the server. No public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and it is not on CISA KEV.
Local privilege-escalation-class memory corruption in the Linux kernel's blk-mq multi-queue block layer allows a local low-privileged user to trigger a use-after-free when submitting a bio: if the task sleeps after peeking a cached request but before popping it, the plug flush frees the cached_rqs, leaving a dangling pointer. The flaw affects mainline and multiple stable trees (6.1.x, 6.5.x, 6.6.x, 6.7) and carries CVSS 7.8 (high CIA impact). There is no public exploit identified at time of analysis, and the very low EPSS (0.15%, 5th percentile) reflects the difficulty of winning the required timing race rather than low structural severity.
Use-after-free / NULL-pointer dereference in the Linux kernel zl3073x DPLL (digital phase-locked loop) driver allows a local attacker to crash the system or potentially corrupt kernel memory during DPLL device teardown. Introduced in kernel 6.18 and fixed in stable 7.0.12/7.1, the flaw stems from the change_work item being re-scheduled after cancel_work_sync(), causing the handler to dereference a freed or NULL dpll_dev pointer. No public exploit identified at time of analysis; EPSS probability is low (0.15%, 5th percentile) and it is not listed in CISA KEV.
Denial of service and possible memory disclosure in the Linux kernel's MCTP-over-USB transport driver (net/mctp/usb) stems from a race between USB request block (urb) completion and cancellation of the rx_retry work during interface teardown. When the interface is brought down concurrently with an in-flight retry, a urb can remain queued and re-schedule already-cancelled work, leading to use-after-free-style memory corruption. This affects Linux 6.15 through the fixed stable releases; there is no public exploit identified at time of analysis, EPSS is low (0.15%, 5th percentile), and the flaw is not in CISA KEV.
Local privilege/impact flaw in the Linux kernel's amdgpu AMD GPU driver (VCN v4.0 video encode/decode rings) allowed userspace command submissions (CS) to include 64-bit user fences that the encoder/decoder ring hardware cannot correctly service. Before the fix, the driver accepted these submissions instead of rejecting them, so a local user with GPU render-node access could trigger unsupported fence writes with High confidentiality, integrity, and availability impact (CVSS 7.8). This is a fixed upstream stable-kernel issue tagged Information Disclosure; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.15%).
Local denial-of-service in the Linux kernel's f2fs filesystem lets an attacker who can mount a crafted f2fs image trigger a kernel panic (BUG_ON at fs/f2fs/file.c:845) during inode truncation. A corrupted inode containing a direct node whose footer reuses the inode's own ino/nid causes ADDRS_PER_PAGE to return an inode-sized address count (923), driving ofs_in_node into the out-of-bounds addr[923..1017] range and crashing the host. Discovered via syzkaller fuzzing; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile).
Memory corruption in the Linux kernel's F2FS filesystem lets a local low-privileged user trigger LRU list corruption and a kernel panic (denial of service) by driving garbage collection on a nearly-full F2FS partition via fallocate. The bug is a use-after-free-class race introduced by commit 9609dd704725 in move_data_block(), where a folio is dropped from the page cache and later split, leaving a tail page freed back to the allocator while still linked in the LRU; the fix is a revert of that commit. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low (0.15%, 5th percentile).
Local privilege escalation and kernel-memory disclosure in the Linux kernel netfilter nf_tables subsystem arises from unsafe handling of basechain/flowtable hook deletions, where moving hooks off an RCU-protected hook_list during the transaction preparation phase races with concurrent netlink dump readers. A low-privileged local user with netfilter administration capability (typically CAP_NET_ADMIN, obtainable inside an unprivileged user namespace on many distros) can trigger the race to read or corrupt freed kernel memory. There is no public exploit identified at time of analysis, EPSS exploitation probability is low (0.14%, 4th percentile), and the issue is not in CISA KEV; the fix is available as upstream stable commits.
Local privilege escalation and kernel memory disclosure in the Linux kernel's Renesas RZ/V2H IVC media driver (rzv2h-ivc) stems from a race condition where rzv2h_ivc_transfer_buffer() calls list_del() on the shared buffer queue from a workqueue context without holding the protecting spinlock. On affected embedded systems using the RZ/V2H SoC, a local low-privileged user can concurrently modify the buffer list to corrupt kernel memory, potentially leaking data or achieving code execution. EPSS is low (0.14%, 4th percentile) and there is no public exploit identified at time of analysis; the flaw is fixed upstream in the stable kernel tree.
Improper error handling in the Linux kernel's memory management VMA subsystem (mm/vma) allows a local low-privileged user to trigger a kernel warning and potential instability when an mmap() error path attempts to unmap an already-detached VMA. The flaw affects the mmap_prepare hook compatibility layer used by 'stacked' drivers such as overlayfs and shm in Linux 6.19 (and related stable branches), where a not-fully-established VMA pointer is passed to the caller. No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile), and it is not on CISA KEV, indicating a robustness/correctness fix rather than an actively exploited weakness despite the high NVD CVSS score.
Information disclosure and denial-of-service in the Linux kernel's drm/msm display snapshot subsystem allows a local low-privileged user to read out-of-bounds register data and trigger a 16x memory overallocation during device state dumps. The flaw stems from the snapshot code force-aligning data segments to 16 bytes, which mishandles unaligned regions such as the 4-byte-shifted DSI data, causing inaccurate register reads. No public exploit identified at time of analysis; EPSS probability is low (0.21%), and it is not listed in CISA KEV.
A shift-out-of-bounds (undefined behavior) exists in the Linux kernel's mac80211 wireless stack, in ieee80211_parse_tx_radiotap(), where an 8-bit IEEE80211_RADIOTAP_ANTENNA value from a userspace-injected frame is used directly as a BIT() shift count, allowing shifts of up to 255 on a 64-bit unsigned long. A local user able to inject frames on a monitor-mode interface can trigger the UB, flagged by UBSAN, with no public exploit identified at time of analysis and a low EPSS score (0.16%, 5th percentile). The realistic impact is undefined behavior / potential instability rather than the memory-corruption RCE implied by the assigned 7.6 CVSS.
Denial of service in Meshtastic firmware prior to 2.7.23.b246bcd allows a single node whose User.long_name contains malformed UTF-8 to render other radios unmanageable over Bluetooth Low Energy when paired with the iOS app. Because the strict-parsing iOS client refuses to load a node database containing a poisoned entry, BLE sync enters a fail/retry loop and the operator loses control of the device; the malformed name propagates across the mesh, so one bad node can degrade iOS management for many users over a wide area. There is no public exploit identified at time of analysis, but the condition has been observed occurring naturally in the wild from ordinary buffer truncation rather than deliberate attack.
Denial of service in the Linux kernel in-kernel SMB3 server (ksmbd) lets remote, unauthenticated clients crash the ksmbd worker via a crafted COMPOUND request. Because smb2_check_user_session() skips the SMB2_SESSION_VALID state check for non-first compound operations and treats a SessionId of 0xFFFFFFFFFFFFFFFF as automatically valid, a TREE_CONNECT chained onto a half-open session (created by an NTLM Type-1 negotiate blob, sess->user still NULL) reaches ksmbd_ipc_tree_connect_request() and dereferences a NULL pointer, wedging the worker for all clients. EPSS is low (0.23%, 13th percentile) and there is no public exploit identified at time of analysis.
Host-based policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 4.1.0, spanning the 2.x line up to 2.4.2 and the 3.x line up to 3.1.3) allows remote attackers to smuggle a different host past allowlist, denylist, SSRF, loopback, and redirect-validation checks by using a literal backslash. Because fast-uri does not treat U+005C as an authority delimiter while Node's native WHATWG URL parser (used by fetch, undici, and the http/https clients) normalizes backslash to forward slash for special schemes, the two parsers disagree on the host, enabling requests to be steered to cloud metadata, loopback, or internal endpoints. There is no public exploit identified at time of analysis, but the flaw is trivially triggerable in affected deployments and openjsf has published a fix.
Denial of service in the Linux kernel's IPv6 routing stack allows remote attackers to trigger an infinite loop in fib6_select_path(), hanging a CPU in softirq context and causing a system-wide hang or hard lockup. The flaw exists because writers holding tb6_lock can list_del_rcu() a route's fib6_siblings entry without waiting for RCU readers, leaving the softirq-side path-selection walker traversing a stale sibling ring that never reaches its list terminator. A vendor patch is available; EPSS is low (0.21%) and there is no public exploit identified at time of analysis, but the network-triggerable, no-privilege CVSS 7.5 vector makes it a meaningful availability risk on multipath IPv6 deployments.
Denial of service in the Linux kernel MANA (Microsoft Azure Network Adapter) Ethernet driver allows the port reset recovery path to trigger a NULL pointer dereference and kernel crash. The flaw occurs when mana_per_port_queue_reset_work_handler() runs after a prior detach succeeded but a subsequent attach failed, leaving apc->tx_qp and apc->rxqs freed; a second unconditional mana_detach() then dereferences NULL during queue teardown. No public exploit has been identified, EPSS is low (0.20%, 10th percentile), and the CVSS 3.1 score is 7.5 driven purely by availability impact.
Kernel panic (denial of service) in the Linux kernel's mm/vmalloc subsystem occurs because __get_vm_area_node() calls BUG_ON(in_interrupt()), and in_interrupt() also returns true when bottom halves (softirqs) are merely disabled rather than in a genuine interrupt context. A legitimate network-bridge path (br_fdb_add_local under spin_lock_bh) reaches vmalloc while BH is disabled, tripping the BUG() and crashing the kernel. NVD scores this A:H (availability only) with no public exploit identified at time of analysis; EPSS is low at 0.19% (9th percentile) and it is not in CISA KEV.
Denial of service in the Linux kernel's IPv6 In-situ OAM (IOAM) processing path allows remote attackers to crash the system via a NULL pointer dereference in ipv6_hop_ioam(). The function dereferences the result of __in6_dev_get(skb->dev) to read cnf.ioam6_enabled without checking for NULL, so a packet carrying an IOAM Hop-by-Hop option that arrives while addrconf_ifdown() concurrently clears dev->ip6_ptr via RCU can trigger a kernel panic. EPSS is low (0.18%), no public exploit or CISA KEV entry exists, and the fix ships in multiple stable kernel releases; the availability-only impact (CVSS 7.5, A:H) reflects a crash rather than code execution or data exposure.
Denial of service in the Linux kernel's NFS server (nfsd) ACL handling allows remote clients to leak kernel memory by sending SETACL requests that fail decoding partway through. When nfsaclsvc_decode_setaclargs() (NFSv2 ACL) or nfs3svc_decode_setaclargs() (NFSv3 ACL) successfully decodes the NFS_ACL entry but then fails on the NFS_DFACL entry, the already-allocated posix_acl is orphaned for the server's lifetime because the wired pc_release handlers only performed fh_put() and svc_process() skips the proc function (where cleanup lived) on decode failure. There is no public exploit identified at time of analysis and this is not in CISA KEV; the impact is gradual memory exhaustion rather than code execution or data disclosure.
Improper error handling in the Linux kernel's pds_core driver (AMD Pensando Distributed Services Card core driver) causes pdsc_devcmd_wait() to return stale success from the completion register when firmware crashes or a device command times out, instead of propagating -ENXIO or -ETIMEDOUT. Because the error path is bypassed, the driver fails to queue health_work recovery, leaving the device in an inconsistent state and producing an availability (denial-of-service) condition. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and the issue is not on the CISA KEV list.
Remote denial of service in the Linux kernel's NFSv4/pNFS flexfiles client allows a malicious or compromised NFS metadata server to crash any mounted client by returning a GETDEVICEINFO response containing a zero-length r_addr or r_netid opaque. The decoder nfs4_decode_mp_ds_addr() only checks for negative lengths, so a zero-length value leaves the buffer pointer NULL and the subsequent strrchr(NULL, '.') triggers a kernel NULL-pointer dereference and panic. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a targeted server-side trust attack rather than mass exploitation.
Remote denial of service in the Linux kernel's SMC-D (Shared Memory Communications over ISM) client allows a malicious peer to crash the system via a null-pointer dereference during SMC-Dv2 connection setup. When a client sends an SMC-Dv2-only proposal and no SMC-Dv1 device is selected, a peer that replies with an ACCEPT containing CHID value 0 matches the reserved empty slot 0 of the ism_dev[] array, causing a null-ptr-deref on ism_dev[0]->lgr_lock in smc_conn_create(). No public exploit identified at time of analysis; EPSS is low (0.17%) and it is not listed in CISA KEV, but the fix is upstream in the kernel stable tree.
Remote denial of service in the Linux kernel's ksmbd in-kernel SMB3 server allows an attacker to trigger a NULL-pointer dereference and kernel panic during SMB2 CREATE lease processing. After a SESSION_LOGOFF, a stale opinfo remains linked in the per-ClientGuid lease list with its conn pointer cleared; a subsequent session reusing the same ClientGuid and taking a lease on a different inode causes compare_guid_key() to dereference the NULL conn->ClientGUID. Exploitation requires only a successful SMB2 SESSION_SETUP against a share with 'durable handles = yes'; no public exploit is identified at time of analysis and EPSS risk is low (0.17%).
Denial of service in the Linux kernel SCSI core allows a device removal process to hang when SCSI devices in a partially-removed state (SDEV_CANCEL) retain requeued requests that are never kicked. Because scsi_run_host_queues() relied on shost_for_each_device()/scsi_device_get(), which skips devices not in a runnable state, requests queued during host error recovery stayed stuck after recovery cleared. The fix broadens scsi_run_host_queues() to run queues for every device except those in SDEV_DEL or where a reference cannot be acquired. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile).
Denial of service in the Linux kernel's net/handshake (TLS handshake) subsystem allows a CPU-local deadlock on hosts acting as NVMe-over-TCP (nvmet_tcp) targets with in-kernel TLS. The nvmet_tcp_state_change() socket callback runs in softirq/BH context and reaches handshake_req_cancel(), which took hn->hn_lock with a plain spin_lock(); if a process-context thread on the same CPU already holds hn_lock when the softirq fires, the lock attempt deadlocks and hangs the CPU. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not on CISA KEV, so this is a stability/availability hardening fix rather than an actively exploited threat.
Memory exhaustion in the Linux kernel NFS server (nfsd) arises from a leak of a pre-allocated openowner structure in find_or_alloc_open_stateowner() when handling NFSv4.0 OPEN retries. When an unconfirmed owner is encountered, release_openowner() runs and control falls through the `if (oo)` cleanup guard, so a previously allocated `new` state-owner (slab object plus owner-name buffer) is silently overwritten and leaked. Remote clients that can reach the NFS service can, under a specific race, repeatedly trigger this leak to degrade or exhaust server memory. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; impact is availability-only (no data disclosure despite the mislabeled tag).
Remote denial-of-service in the Linux kernel NFSv4 flexfiles (pNFS) client allows a malicious or compromised NFS server to crash a mounting client via a malformed flexfiles layout that declares a zero filehandle-version count. The flaw stems from ff_layout_alloc_lseg() accepting fh_count == 0, which produces a ZERO_SIZE_PTR that is later dereferenced during layoutreturn encoding, triggering a null-pointer-deref and kernel panic. No public exploit identified at time of analysis, though the commit includes a QEMU/KASAN reproducer; CVSS 7.5 reflects availability-only impact (A:H) with no confidentiality or integrity effect.
Denial of service in the Linux kernel's Intel iwlwifi 'mld' Wi-Fi driver allows a firmware crash on Intel BE201/Wi-Fi 7 adapters to spiral into sustained resource exhaustion. Because iwl_mld_tx_from_txq() failed to check the in_hw_restart flag, TX frames kept being dequeued and pushed to dead firmware, each returning -EIO and being freed in a tight loop that burns CPU and churns skb allocations, causing slab fragmentation and memory pressure. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 6th percentile), and the issue is not on CISA KEV; it is a reliability/availability bug that manifests under real load, not an attacker-driven remote exploit.
Kernel-panic denial of service in the Linux kernel's in-kernel SMB server (ksmbd) allows the file-pointer table to retain a durable-handle file object with a NULL tcon after a client issues SMB2 SESSION_LOGOFF; any subsequent read of /proc/fs/ksmbd/files then dereferences the NULL fp->tcon in proc_show_files() and crashes the host. Affected are kernels running ksmbd on shares configured with 'durable handles = yes'. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile), consistent with a stability/robustness bug rather than a weaponizable RCE.
Memory (kmalloc) leak in the Linux kernel's nvme-pci driver allows exhaustion of kernel memory over time on hosts using NVMe peer-to-peer (P2P) DMA. Because P2P memory is never unmapped, the driver has no need to track it, yet the dma_vec allocation used for tracking was never freed on I/O completion, leaking on every affected request. The flaw affects kernel 6.17 and is fixed in stable; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%).