Memory leak in the Linux kernel's wilc1000 WiFi driver exposes systems with Microchip WILC1000 adapters to kernel heap exhaustion. The function wilc_wlan_firmware_download() allocates a DMA buffer via kmalloc() but an early-return path after the first acquire_bus() call bypasses the established cleanup label, leaking the buffer unconditionally on bus acquire failures. No public exploit has been identified and EPSS probability is extremely low (0.17%, 6th percentile), but repeated triggering on affected embedded hardware could degrade system stability. Upstream stable fixes are available as confirmed kernel commits targeting 6.18.x, 7.0.x, and 7.1.
Memory corruption in the Linux kernel netfilter x_tables subsystem lets a local user with network-admin capability trigger a use-after-free during table module removal (rmmod) while userspace performs concurrent set/getsockopt operations on the same table. The fix introduces a two-stage teardown (xtables_unregister_table_exit) that unlinks the table from the dying list, frees hook ops, and emits the audit notification, replacing the racy single-stage xt_unregister_table(). Rated CVSS 7.8 (local, high CIA impact); EPSS is low (0.17%), it is not in CISA KEV, and no public exploit has been identified at time of analysis.
Local privilege escalation and memory disclosure in the Linux kernel's netfilter ebtables subsystem stems from a table-removal race that could expose a partially-initialized ebt_table structure before its ops pointer is assigned. On affected kernels (5.15 through the fixes in 6.18.34, 7.0.11 and 7.1), a local user with network-administration capability manipulating ebtables can trigger the window between allocation and full initialization, corrupting or reading kernel memory. No public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile), consistent with a race-condition bug requiring local access rather than mass exploitation.
Local privilege escalation and memory-safety exposure in the Linux kernel netfilter bridge ebtables subsystem stems from a module-initialization race where nf_register_sockopt() runs before ebtables data structures are fully initialized, exposing the setsockopt/getsockopt interface globally too early. On affected kernels (5.13 through builds before the 6.18.34 / 7.0.11 / 7.1 stable fixes), a local low-privileged actor with the ability to reach ebtables sockopts during the init window can trigger operations on uninitialized state, risking high confidentiality, integrity, and availability impact (CVSS 7.8). There is no public exploit identified at time of analysis and EPSS is low (0.17%), so this is a code-correctness fix rather than an actively exploited threat.
Use-after-free in the Linux kernel's fprobe subsystem exposes kernel memory to corruption when a fprobe is released immediately after unregistration without waiting for an RCU grace period. The flaw was introduced by commit 4346ba1604093, which rewrote fprobe on the function-graph tracer and placed struct fprobe on an RCU-protected hlist but omitted the required synchronize_rcu() call in unregister_fprobe(), leaving a window where in-flight RCU readers may dereference freed memory. BPF users of fprobe are explicitly unaffected because BPF defers deallocation through the bpf_link_defer_dealloc_rcu_gp() RCU callback; affected paths are fprobe events and sample module code.
Local privilege-adjacent memory corruption in the Linux kernel's fs/statmount subsystem allows an authenticated local user to trigger a 1-byte NULL out-of-bounds write on a dynamically allocated seq buffer. The flaw lives in statmount_mnt_idmap(), which manually advances seq->count after seq_printf(); on overflow this desynchronizes the buffer accounting so seq_has_overflowed() misses the overflow and a later 'seq->buf[seq->count++] = 0' writes past the slab allocation. Rated CVSS 7.8 (High); EPSS is low (0.17%, 6th percentile), no public exploit or CISA KEV listing exists at time of analysis, and a vendor fix is available.
Local information disclosure and memory corruption in the Linux kernel's netfs subsystem arises because netfs_read_folio() does not wait for in-flight writeback to complete before trusting the folio dirty flag and the folio->private data, which the writeback collector may free before it clears the writeback flag. Hosts using network/cache-backed filesystems (9p, AFS, Ceph, CIFS/SMB, and fscache-backed mounts) can hit a race where a read consumes stale or freed metadata. There is no public exploit identified at time of analysis and the EPSS probability is low (0.17%, 6th percentile); the fix is merged in stable releases 6.18.34, 7.0.11, and 7.1.
Double-free memory corruption in the Linux kernel's net/shaper subsystem allows a local attacker with CAP_NET_ADMIN capability to corrupt the kernel heap by submitting a crafted GROUP netlink request containing duplicate leaf handles. Affected kernels span from the introduction of the net shaper subsystem (~6.13) through multiple stable branches, with fixes backported to 6.18.34, 7.0.11, and 7.1. No public exploit or active exploitation has been identified; vendor-released patches are available via kernel.org and distribution advisories such as Ubuntu USN-8593-1.
Use-after-free in the Linux kernel's Qualcomm MSM Display Processing Unit (DPU) DRM driver arises because dpu_writeback_init() mixes device-managed (devm_) and DRM-managed (drmm_) allocation lifetimes. On driver teardown, the writeback connector's data is freed via devm while userspace still holds a reference to the drm device and can interact with the drmm-backed connector, creating a dangling pointer a local user can exploit. Rated CVSS 7.8 (local, low-privilege); EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis.
Local privilege-context memory corruption in the Linux kernel's cgroup/rstat subsystem allows a process holding CAP_BPF and CAP_PERFMON to trigger an out-of-bounds array access by passing an unvalidated CPU index to the css_rstat_updated() BPF kfunc. Because the caller-supplied cpu argument is used for per-cpu rstat lookups without a possible-CPU bounds check, a value such as 0x7fffffff drives an array-index-out-of-bounds condition (confirmed on UBSAN kernels) inside kernel/cgroup/rstat.c. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; exploitation requires elevated BPF-related capabilities, which sharply narrows the realistic attacker set.
Local privilege escalation / memory-corruption potential in the Linux kernel's EROFS filesystem arises from a managed-cache race condition affecting unaligned compressed extents. When two threads process the same Z_EROFS_PREALLOCATED_FOLIO for different pclusters, one thread can call filemap_add_folio() a second time on a folio whose private state was not yet cleared, corrupting the managed page cache. Rated CVSS 7.8 (AV:L), it affects EROFS images built with unaligned data compression (e.g. -E48bit with zstd); EPSS is low (0.17%, 6th percentile), it is not in CISA KEV, and no public exploit identified at time of analysis.
Use-after-free in the Linux kernel's net shaper subsystem allows a local, low-privileged attacker to trigger memory corruption via a race condition in the network shaper API's XArray-based entry tracking. Because XArray 'VALID' marks are not stored atomically with their entries, a reader can observe a VALID slot, be preempted while a writer replaces the entry, and then dereference a stale pointer that net_shaper_rollback() has already freed, enabling potential privilege escalation or information disclosure. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 6th percentile).
Local privilege escalation and memory corruption in the Linux kernel GPIO aggregator driver (gpio-aggregator) arises from a use-after-free on the error-handling path, where `aggr->lookups->dev_id` is freed before the lookup entry is removed from the table. A concurrent thread calling `gpiod_find()` can then dereference the freed `dev_id` via `strcmp()` in `gpiod_match_lookup_table()`, yielding a UAF that a low-privileged local attacker could leverage for code execution or DoS. There is no public exploit identified at time of analysis, and EPSS is low (0.17%), consistent with a race-condition kernel bug requiring local access rather than a mass-exploitation candidate.
Local privilege escalation via use-after-free in the Linux kernel accel/rocket driver (Rockchip NPU accelerator) allows an authenticated local user with access to the accel device node to dereference freed slab memory. The flaw stems from rocket_ioctl_create_bo() registering a GEM handle in the file IDR before fallible operations (sgt allocation, drm_mm insert, iommu_map); on failure the object is freed while the handle stays live, and any later PREP_BO/FINI_BO/SUBMIT ioctl triggers the UAF. No public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile).
Local privilege/memory-safety flaw in the Linux kernel's amdgpu VCN (Video Core Next) v5.0.1 driver allows a local user with GPU render-node access to submit command-stream (CS) requests containing 64-bit user fences that the VCN encoder/decoder rings cannot handle, leading to high-impact corruption (CVSS 7.8, tagged Information Disclosure). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile). A vendor patch is available upstream in the kernel stable tree.
Local privilege-adjacent memory corruption in the Linux kernel's AMD GPU JPEG engine (amdgpu driver, JPEG v5.0.1 ring) allows a local low-privileged user to submit command-stream (CS) submissions containing 64-bit user fences that the JPEG ring cannot service. Because the ring lacks support for user fence writes, accepting such submissions leads to high-impact confidentiality, integrity, and availability consequences (CVSS 7.8). No public exploit identified at time of analysis, and EPSS is very low (0.17%), consistent with a hardware-specific, locally-scoped GPU driver flaw rather than a mass-exploitation target.
A local privilege-context memory corruption in the Linux kernel's IBM PowerPC 'nx' hardware crypto driver (drivers/crypto/nx) causes a kernel oops when userspace uses the AF_ALG socket interface for shash hashing. nx_crypto_ctx_shash_exit passed a wrong pointer type (an nx_crypto_ctx* treated as a crypto_tfm*) into nx_crypto_ctx_exit, producing a bad-address kernel access (observed at 0xc0403effffffffc8) during teardown, reachable by any local user - e.g. hardlink(1) opportunistically selecting AF_ALG. No public exploit is identified at time of analysis; EPSS is low (0.17%) and this is not on CISA KEV, so real-world risk is a local denial-of-service (kernel crash) on affected NX-capable POWER systems rather than confirmed code execution.
Local privilege-relevant memory corruption in the Linux kernel's KEYS subsystem allows an authenticated local user to overflow an internal output buffer via the keyctl() public-key operation path. The flaw stems from keyctl_pkey_params_get_2() sizing its internal output buffer using the caller-supplied length instead of the cryptographic primitive's maximum length, so a too-small buffer triggers a heap overflow. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not on CISA KEV, so risk is theoretical rather than actively exploited.
Local privilege escalation via a use-after-free in the Linux kernel's key management (keys) subsystem allows an unprivileged local user to corrupt kernel memory by racing a request_key() helper against KEYCTL_INSTANTIATE_IOV. The request_key_auth payload (rka) could be detached and freed by the key-request helper's completion path while a concurrent instantiate/reject operation was still dereferencing rka->target_key, yielding a UAF (CWE-416). It is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is low at 0.17% (6th percentile), and a vendor patch is available across multiple stable branches.
Out-of-bounds heap read in the Linux kernel's F2FS filesystem lets a local low-privileged user disclose adjacent kernel memory or crash the system by reading POSIX ACLs from a maliciously crafted f2fs image. The flaw lives in f2fs_acl_from_disk() (fs/f2fs/acl.c), which dereferences an ACL entry's e_id before confirming a full f2fs_acl_entry fits in the xattr buffer. It is fixed upstream, carries CVSS 7.8, and shows a very low EPSS (0.17%, 6th percentile); there is a KASAN crash reproducer in the report but no public weaponized exploit and no CISA KEV listing - no public exploit identified at time of analysis.
Memory-management corruption in the Linux kernel (introduced in 6.18) affects x86 32-bit systems with Transparent Huge Pages (THP) enabled, where __vm_normal_page() fails to recognize the huge zero PMD because pmd_special()/pud_special() are gated behind CONFIG_ARCH_SUPPORTS_PMD_PFNMAP, which is never set on any 32-bit architecture. A local user allocating THP mappings can trigger VM_WARN warnings, bad rss-counter and bad page state conditions, and mis-accounting of the huge zero folio as file-backed THP. No public exploit has been identified and EPSS is low (0.16%), consistent with a niche, non-default trigger condition.
Local privilege-escalation-class memory corruption in the Linux kernel's AppArmor LSM affects the policy-replacement path (aa_replace_profiles) across a wide span of stable branches (5.10 through 7.1). During the rawdata deduplication loop, aa_get_profile_loaddata() performs an unconditional kref_get() on struct aa_loaddata entries whose pcount has already dropped to zero but which remain briefly on ns->rawdata_list before the deferred do_ploaddata_rmfs() workqueue frees them, producing a refcount 'addition on 0' use-after-free. Exploitation requires local access with the ability to load AppArmor policy and winning a narrow race; there is no public exploit identified at time of analysis and EPSS risk is low (0.16%, 6th percentile).
Local privilege escalation and memory corruption in the Linux kernel's amdgpu VCN (Video Core Next) driver arises because VCN v2.0 encoder and decoder rings accept command-stream (CS) submissions carrying 64-bit user fence writes that the hardware does not actually support. A local user able to submit GPU work (via /dev/dri render nodes) can trigger the driver to perform unsupported fence writes, leading to high-impact confidentiality, integrity, and availability effects consistent with kernel memory corruption or information disclosure. There is no public exploit identified at time of analysis, EPSS is low (0.16%), and the issue is not on the CISA KEV list, so this is a locally-scoped hardening/correctness fix rather than a remotely exploitable emergency.
Local privilege escalation and memory corruption in the Linux kernel amdgpu driver stems from VCN (Video Core Next) v2.5 encoder/decoder rings accepting command-stream submissions that request 64-bit user fence writes, an operation the hardware does not support. A local user with render-node access to an AMD GPU can submit a crafted CS with a user fence, causing the kernel to write to an unsupported/attacker-influenced fence address. No public exploit is identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the flaw is not in CISA KEV.
Local privilege escalation and memory-corruption risk in the amdgpu driver's VCN (Video Core Next) v3.0 encoder/decoder rings allows an authenticated local user with GPU render-node access to submit command streams containing 64-bit user-fence writes that the hardware does not support, corrupting kernel memory. The fix marks these rings with no_user_fence so the kernel rejects any command submission carrying a user fence. This affects Linux kernels from 5.9 onward that ship the AMD VCN 3.0 support; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.16% (5th percentile).
Local privilege-adjacent memory corruption in the Linux kernel's AMD GPU (amdgpu) VCN v4.0.3 driver arises because the video encode/decode rings accept command-stream submissions carrying 64-bit user fences that the hardware cannot honor. A local user with GPU/DRM access could submit crafted VCN jobs with user fences, leading to out-of-bounds fence writes and kernel memory corruption. No public exploit has been identified at the time of analysis, EPSS is low (0.16%, 5th percentile), and the flaw is not on the CISA KEV list; a vendor patch is available.
Local privilege escalation / memory corruption in the Linux kernel's AMD GPU driver (amdgpu VCN v4.0.5) allows an authenticated local user to submit command-stream (CS) requests carrying 64-bit user fences to VCN encoder/decoder rings that do not support them, corrupting kernel memory. The fix marks the affected rings with no_user_fence so the kernel rejects such submissions. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not on CISA KEV, but CVSS scores high impact (7.8) due to full C/I/A compromise from a local unprivileged-to-low-privileged vector.
Local privilege-adjacent memory corruption in the Linux kernel's AMD GPU (amdgpu) JPEG v5.3.0 driver arises because the ring did not set the no_user_fence flag, allowing command-stream (CS) submissions carrying 64-bit user fence writes that the JPEG ring cannot support. A local user with GPU/DRM device access can submit crafted CS with user fences, leading to undefined ring behavior and high impact on confidentiality, integrity, and availability. No public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%), but a vendor (upstream stable) patch is available.
Local privilege-adjacent memory corruption in the Linux kernel's F2FS filesystem allows a low-privileged user with access to an F2FS-mounted volume to trigger a use-after-free on the atomic_inode structure. During garbage collection of an atomic (copy-on-write) file via ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE), a race with concurrent inode eviction lets the kernel dereference and populate the page mapping of an already-freed atomic_inode, corrupting kernel memory and typically causing a BUG_ON/crash. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and this is not on CISA KEV. A vendor fix that takes a reference on fi->atomic_inode before use has been merged upstream.
Filesystem cache-consistency flaw in the Linux kernel's F2FS (Flash-Friendly File System) driver leaves a stale 'largest extent' entry cached when __destroy_extent_node() sets the FI_NO_EXTENT inode flag without resetting the extent length or updating the inode folio, causing the extent tree to diverge from on-disk metadata. Affected are local users of F2FS-formatted volumes across many stable kernel lines (6.6.x through 6.18.x and 7.x pre-releases); the bug surfaces as a sanity_check_extent_cache error (reproduced by xfstests generic/388) and, per source tagging, carries an information-disclosure angle because stale block mappings can point reads at the wrong physical blocks. No public exploit identified at time of analysis; EPSS is 0.16% (5th percentile), and it is not on CISA KEV.
Local memory corruption in the Linux kernel scheduler's per-mm concurrency-ID (mm_cid) subsystem lets an unprivileged task trigger a deterministic out-of-bounds single-bit clear in kernel memory. The flaw lives in mm_cid_fixup_cpus_to_tasks(), where a task whose CID is still the MM_CID_UNSET sentinel (BIT(31)) is wrongly marked in-transit and later fed to clear_bit(), clearing a bit 256 MiB past the mm_struct CID bitmap. It was surfaced by syzkaller as a KASAN use-after-free in __schedule; no public weaponized exploit and no CISA KEV listing exist at time of analysis.
Local information disclosure and use-after-free in the Linux kernel NTFS filesystem driver lets a low-privileged local user read freed kernel memory by racing the FS_IOC_GETFSLABEL and FS_IOC_SETFSLABEL ioctls against a mounted NTFS volume. Because vol->volume_label is copied to userspace via copy_to_user without serialization, a concurrent SETFSLABEL that replaces the label can free the buffer mid-read, leaking kernel data or crashing the system. No public exploit is identified at time of analysis and it is not in CISA KEV; a vendor patch is available in Linux 7.1.3 and 7.2-rc1.
Improper error-path handling in the Linux kernel IOMMU subsystem allows unbalanced debug-tracking operations when CONFIG_IOMMU_DEBUG is enabled and an IOMMU map operation fails partway. When iommu_map_nosync() hits an error, the cleanup path invoked iommu_unmap()/iommu_debug_unmap_begin()/end() against a mapping the debug layer never recorded via iommu_debug_map(), corrupting internal tracking state and producing spurious unmatched trace records. The fix lifts unmap error handling into iommu_map_nosync() and reorders it so trace_map()/iommu_debug_map() records the partial mapping before immediately unmapping it. This is a locally-scoped, debug-configuration-dependent issue with no public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and it is not in CISA KEV.
Kernel stack information disclosure and register-state corruption affects the Linux kernel's RISC-V 32-bit compat layer, where compat_riscv_gpr_set() (the PTRACE_SETREGSET handler) and compat_restore_sigcontext() (the compat sigreturn path) call cregs_to_regs() even after the user copy fails, writing an uninitialized stack buffer into the target task's pt_regs. A local low-privileged attacker running a 32-bit process on a riscv64 kernel can force the copy to fail and leak uninitialized kernel stack contents into user-visible registers while corrupting the task's register state. There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), consistent with the narrow RISC-V compat attack surface.
Improper locking in the Linux kernel AFS (Andrew File System) client's symbolic link handling (afs_get_link()) allows a local attacker on a host mounting an AFS volume to trigger race conditions that leak kernel memory and can expose stale or freed symlink buffers. The flaw affects kernels from roughly 6.14 up to the fixed 7.0.11/7.1 stable series and stems from a missing validate_lock, absent RCU barriering during lockless pathwalk, and unsynchronized access when a symlink is concurrently updated on the server. No public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and it is not on CISA KEV.
Local privilege-escalation-class memory corruption in the Linux kernel's blk-mq multi-queue block layer allows a local low-privileged user to trigger a use-after-free when submitting a bio: if the task sleeps after peeking a cached request but before popping it, the plug flush frees the cached_rqs, leaving a dangling pointer. The flaw affects mainline and multiple stable trees (6.1.x, 6.5.x, 6.6.x, 6.7) and carries CVSS 7.8 (high CIA impact). There is no public exploit identified at time of analysis, and the very low EPSS (0.15%, 5th percentile) reflects the difficulty of winning the required timing race rather than low structural severity.
Use-after-free / NULL-pointer dereference in the Linux kernel zl3073x DPLL (digital phase-locked loop) driver allows a local attacker to crash the system or potentially corrupt kernel memory during DPLL device teardown. Introduced in kernel 6.18 and fixed in stable 7.0.12/7.1, the flaw stems from the change_work item being re-scheduled after cancel_work_sync(), causing the handler to dereference a freed or NULL dpll_dev pointer. No public exploit identified at time of analysis; EPSS probability is low (0.15%, 5th percentile) and it is not listed in CISA KEV.
Denial of service and possible memory disclosure in the Linux kernel's MCTP-over-USB transport driver (net/mctp/usb) stems from a race between USB request block (urb) completion and cancellation of the rx_retry work during interface teardown. When the interface is brought down concurrently with an in-flight retry, a urb can remain queued and re-schedule already-cancelled work, leading to use-after-free-style memory corruption. This affects Linux 6.15 through the fixed stable releases; there is no public exploit identified at time of analysis, EPSS is low (0.15%, 5th percentile), and the flaw is not in CISA KEV.
Local privilege/impact flaw in the Linux kernel's amdgpu AMD GPU driver (VCN v4.0 video encode/decode rings) allowed userspace command submissions (CS) to include 64-bit user fences that the encoder/decoder ring hardware cannot correctly service. Before the fix, the driver accepted these submissions instead of rejecting them, so a local user with GPU render-node access could trigger unsupported fence writes with High confidentiality, integrity, and availability impact (CVSS 7.8). This is a fixed upstream stable-kernel issue tagged Information Disclosure; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.15%).
Local denial-of-service in the Linux kernel's f2fs filesystem lets an attacker who can mount a crafted f2fs image trigger a kernel panic (BUG_ON at fs/f2fs/file.c:845) during inode truncation. A corrupted inode containing a direct node whose footer reuses the inode's own ino/nid causes ADDRS_PER_PAGE to return an inode-sized address count (923), driving ofs_in_node into the out-of-bounds addr[923..1017] range and crashing the host. Discovered via syzkaller fuzzing; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile).
Memory corruption in the Linux kernel's F2FS filesystem lets a local low-privileged user trigger LRU list corruption and a kernel panic (denial of service) by driving garbage collection on a nearly-full F2FS partition via fallocate. The bug is a use-after-free-class race introduced by commit 9609dd704725 in move_data_block(), where a folio is dropped from the page cache and later split, leaving a tail page freed back to the allocator while still linked in the LRU; the fix is a revert of that commit. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low (0.15%, 5th percentile).
Local privilege escalation and kernel-memory disclosure in the Linux kernel netfilter nf_tables subsystem arises from unsafe handling of basechain/flowtable hook deletions, where moving hooks off an RCU-protected hook_list during the transaction preparation phase races with concurrent netlink dump readers. A low-privileged local user with netfilter administration capability (typically CAP_NET_ADMIN, obtainable inside an unprivileged user namespace on many distros) can trigger the race to read or corrupt freed kernel memory. There is no public exploit identified at time of analysis, EPSS exploitation probability is low (0.14%, 4th percentile), and the issue is not in CISA KEV; the fix is available as upstream stable commits.
Local privilege escalation and kernel memory disclosure in the Linux kernel's Renesas RZ/V2H IVC media driver (rzv2h-ivc) stems from a race condition where rzv2h_ivc_transfer_buffer() calls list_del() on the shared buffer queue from a workqueue context without holding the protecting spinlock. On affected embedded systems using the RZ/V2H SoC, a local low-privileged user can concurrently modify the buffer list to corrupt kernel memory, potentially leaking data or achieving code execution. EPSS is low (0.14%, 4th percentile) and there is no public exploit identified at time of analysis; the flaw is fixed upstream in the stable kernel tree.
Improper error handling in the Linux kernel's memory management VMA subsystem (mm/vma) allows a local low-privileged user to trigger a kernel warning and potential instability when an mmap() error path attempts to unmap an already-detached VMA. The flaw affects the mmap_prepare hook compatibility layer used by 'stacked' drivers such as overlayfs and shm in Linux 6.19 (and related stable branches), where a not-fully-established VMA pointer is passed to the caller. No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile), and it is not on CISA KEV, indicating a robustness/correctness fix rather than an actively exploited weakness despite the high NVD CVSS score.
Information disclosure and denial-of-service in the Linux kernel's drm/msm display snapshot subsystem allows a local low-privileged user to read out-of-bounds register data and trigger a 16x memory overallocation during device state dumps. The flaw stems from the snapshot code force-aligning data segments to 16 bytes, which mishandles unaligned regions such as the 4-byte-shifted DSI data, causing inaccurate register reads. No public exploit identified at time of analysis; EPSS probability is low (0.21%), and it is not listed in CISA KEV.
A shift-out-of-bounds (undefined behavior) exists in the Linux kernel's mac80211 wireless stack, in ieee80211_parse_tx_radiotap(), where an 8-bit IEEE80211_RADIOTAP_ANTENNA value from a userspace-injected frame is used directly as a BIT() shift count, allowing shifts of up to 255 on a 64-bit unsigned long. A local user able to inject frames on a monitor-mode interface can trigger the UB, flagged by UBSAN, with no public exploit identified at time of analysis and a low EPSS score (0.16%, 5th percentile). The realistic impact is undefined behavior / potential instability rather than the memory-corruption RCE implied by the assigned 7.6 CVSS.
Denial of service in Meshtastic firmware prior to 2.7.23.b246bcd allows a single node whose User.long_name contains malformed UTF-8 to render other radios unmanageable over Bluetooth Low Energy when paired with the iOS app. Because the strict-parsing iOS client refuses to load a node database containing a poisoned entry, BLE sync enters a fail/retry loop and the operator loses control of the device; the malformed name propagates across the mesh, so one bad node can degrade iOS management for many users over a wide area. There is no public exploit identified at time of analysis, but the condition has been observed occurring naturally in the wild from ordinary buffer truncation rather than deliberate attack.
Denial of service in the Linux kernel in-kernel SMB3 server (ksmbd) lets remote, unauthenticated clients crash the ksmbd worker via a crafted COMPOUND request. Because smb2_check_user_session() skips the SMB2_SESSION_VALID state check for non-first compound operations and treats a SessionId of 0xFFFFFFFFFFFFFFFF as automatically valid, a TREE_CONNECT chained onto a half-open session (created by an NTLM Type-1 negotiate blob, sess->user still NULL) reaches ksmbd_ipc_tree_connect_request() and dereferences a NULL pointer, wedging the worker for all clients. EPSS is low (0.23%, 13th percentile) and there is no public exploit identified at time of analysis.
Host-based policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 4.1.0, spanning the 2.x line up to 2.4.2 and the 3.x line up to 3.1.3) allows remote attackers to smuggle a different host past allowlist, denylist, SSRF, loopback, and redirect-validation checks by using a literal backslash. Because fast-uri does not treat U+005C as an authority delimiter while Node's native WHATWG URL parser (used by fetch, undici, and the http/https clients) normalizes backslash to forward slash for special schemes, the two parsers disagree on the host, enabling requests to be steered to cloud metadata, loopback, or internal endpoints. There is no public exploit identified at time of analysis, but the flaw is trivially triggerable in affected deployments and openjsf has published a fix.
Denial of service in the Linux kernel's IPv6 routing stack allows remote attackers to trigger an infinite loop in fib6_select_path(), hanging a CPU in softirq context and causing a system-wide hang or hard lockup. The flaw exists because writers holding tb6_lock can list_del_rcu() a route's fib6_siblings entry without waiting for RCU readers, leaving the softirq-side path-selection walker traversing a stale sibling ring that never reaches its list terminator. A vendor patch is available; EPSS is low (0.21%) and there is no public exploit identified at time of analysis, but the network-triggerable, no-privilege CVSS 7.5 vector makes it a meaningful availability risk on multipath IPv6 deployments.