Remote denial of service in the Linux kernel NFS server (nfsd) allows an NFSv4 client to leak kernel memory by sending CREATE requests that encode both a native NFSv4 ACL (FATTR4_WORD0_ACL) and POSIX default/access ACLs (FATTR4_WORD2) in the same fattr bitmap. A dead conflict-guard in nfsd4_create() fails to release the original posix_acl objects when nfsd4_acl_to_attr() overwrites them, leaking two posix_acl slab objects per request; repeated requests drive unbounded slab exhaustion. There is no public exploit identified at time of analysis, this is not on CISA KEV, and the impact is availability only (CVSS 7.5, A:H) despite the input tag labelling it 'Information Disclosure'.
Denial of service in the Linux kernel IPsec ESP stack (esp4/esp6) arises from a page fragment reference leak in esp_output_tail() when out-of-place crypto processing is used and the second skb_to_sgvec() call fails. On this error path the code jumps to error_free, freeing only the temporary scatterlist and the newly allocated page while leaking the original skb frag page references, allowing repeated failures to exhaust memory. No public exploit identified at time of analysis; EPSS is 0.14% (4th percentile), consistent with a low-likelihood, availability-only kernel bug fixed upstream in stable commits.
Cross-network-namespace information disclosure in the Linux kernel's XFRM/IPsec subsystem allows XFRM_MSG_MIGRATE (IKEv2 MOBIKE) notifications to leak between namespaces because xfrm_send_migrate() and pfkey_send_migrate() hardcode init_net for their multicast. An IKE daemon (e.g. strongSwan) listening on init_net's XFRMNLGRP_MIGRATE / pfkey BROADCAST_ALL groups receives migration events — including IPsec selectors and old/new endpoint addresses — that originated in other, isolated network namespaces. There is no public exploit identified at time of analysis and EPSS probability is low (0.21%); the fix is upstream in stable trees.
Information disclosure and buffer corruption in the Linux kernel's Qualcomm GENI serial driver (qcom_geni) allows leakage of stale TX buffer contents over the UART line when uart_flush_buffer() races a pending DMA-completion IRQ. On affected builds (6.3 through the fixed stable releases), a kfifo underflow drives kfifo->out past kfifo->in, so a subsequent start_tx_dma() transmits residual/stale buffer data rather than intended output. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the flaw is local-only and timing-dependent.
Out-of-bounds slab read in the Linux kernel Bluetooth management (MGMT) subsystem lets a privileged local user leak adjacent kernel heap memory via the MGMT_OP_ADD_EXT_ADV_DATA command. The handler trusts attacker-supplied adv_data_len and scan_rsp_len fields without confirming those bytes actually fit within the received command payload, so a short command drives an out-of-bounds pointer into tlv_data_is_valid() and can copy past-the-buffer bytes into an advertising instance that the caller then reads back via MGMT_OP_GET_ADV_INSTANCE. Exploitation requires CAP_NET_ADMIN in the initial user namespace; no public exploit identified at time of analysis, and EPSS is low at 0.18%.
Improper handling of write streaming in the Linux kernel's netfs subsystem (network filesystem caching layer) allows a local, low-privileged user to trigger reads of stale, dirty-but-not-uptodate page cache data on network-backed filesystems. Introduced around kernel 6.8, the flaw stems from netfs caching dirty data in folios that are not marked uptodate; concurrent reads (e.g., via mmap or a separate read-only fd) could return incorrect or stale content, an information-disclosure/integrity concern (tagged 'Information Disclosure'). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is very low (0.11%, 2nd percentile), indicating negligible mass-exploitation likelihood.
Information disclosure (slab-out-of-bounds read) in the Linux kernel IPv6 datagram stack lets a local unprivileged attacker leak adjacent kernel slab memory and potentially crash the system. The flaw lives in ip6_datagram_recv_specific_ctl(), which trusts the on-wire extension-header length byte when building IPV6_HOPOPTS/DSTOPTS/RTHDR control messages; because nftables is reachable from an unprivileged user namespace, an attacker can rewrite that length after parse-time validation and force put_cmsg() to copy up to 2040 bytes from an 8-byte header. There is no public exploit and it is not in CISA KEV (EPSS 0.21%), so risk is credible but not yet demonstrated at scale.
Denial-of-service (and minor state corruption) in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced mesh routing) bridge-loop-avoidance (BLA) subsystem allows an adjacent mesh participant to trigger a race condition in the bla.num_requests reference counter. Because the request_sent state check and the atomic increment/decrement of num_requests are not performed under a common lock, concurrent contexts (batadv_bla_send_request(), batadv_handle_announce(), backbone purge, and periodic work) can double-decrement the counter, corrupting BLA state and potentially crashing the kernel. There is no public exploit identified at time of analysis and EPSS risk is low (0.18%, 7th percentile); the fix serializes state and counter updates under a lock and adds a 'stopped' backbone_gw state.
Guest-to-host denial of service in the Linux kernel's x86 KVM ioeventfd datamatch handling allows a malicious VM to crash the hypervisor host via a reachable BUG_ON(). A guest that issues an unaligned store spanning a page boundary and hitting a datamatch-enabled ioeventfd at offset 0 of the second page triggers an alignment assertion in ioeventfd_write(), panicking the host kernel. The defect has existed since 2009 (kernel 2.6.32); EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis, though the commit message includes a working reproducer trace.
Local privilege/security-policy bypass in the Linux kernel's LSM (Linux Security Module) infrastructure arises because lsm_set_self_attr() failed to hold cred_guard_mutex before invoking the LSM hook, unlike the equivalent proc_pid_attr_write() path. On SELinux- or AppArmor-enforced systems, this allows a local low-privileged process to race the ptrace-based checks that gate a security-context transition, potentially performing a domain/type transition that policy would otherwise deny. EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis; the fix is already merged into stable kernels.
Slab out-of-bounds read in the Linux kernel IFB (Intermediate Functional Block) network driver exposes adjacent kernel memory and risks system instability when a local user with low privileges queries ethtool statistics on an asymmetrically configured IFB device. The root cause is a queue-count mismatch: ethtool stat callbacks size and walk per-queue data using real_num_rx_queues and real_num_tx_queues, while the underlying tx_private allocation is sized only to num_tx_queues - creating an over-read when RX queue count exceeds TX queue count. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), though patch availability across multiple stable branches confirms vendor acknowledgment and active remediation.
Kernel memory disclosure in the Linux kernel fbcon (framebuffer console) subsystem allows a local low-privileged attacker to trigger an out-of-bounds read by exploiting incomplete error-path rollback in fbcon_do_set_font(). When a font-set operation fails partway (e.g., vc_resize() allocation failure under memory pressure), the hi_font_mask and screen buffer are left desynchronized from the reverted 256-character font array, causing the VT subsystem to render character indices above 255 against undersized data. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available across multiple stable branches.
Out-of-bounds array read in the Linux kernel's IIO veml6075 UV light sensor driver allows a local low-privileged user reading the sensor's integration-time data to trigger access past the 5-element veml6075_it_ms lookup table. The VEML6075_CONF_IT register field can decode to index values 0-7, but only indices 0-4 are valid; a reserved value (5-7) drives the driver to read beyond the array. This is a hardening fix against faulty hardware, device misprogramming, or bus corruption rather than a directly attacker-controllable memory-corruption primitive; no public exploit identified at time of analysis and EPSS risk is low (0.17%, 6th percentile).
Denial of service in the Linux kernel's KVM/SVM AVIC (Advanced Virtual Interrupt Controller) IPI virtualization affects Hygon Family 18h hosts, where a hardware erratum (#1235, shared with AMD Zen1 Family 17h) lets the CPU read a stale IsRunning bit during ICR write emulation and skip the expected AVIC_IPI_FAILURE_TARGET_NOT_RUNNING VM-Exit. As a result KVM misses the wakeup of a blocking target vCPU, causing hung vCPUs and unbounded stalls in guest execution. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; the fix disables AVIC IPI virtualization on these CPUs so every non-self IPI is correctly emulated via VM-Exit.
Filesystem metadata corruption in the Linux kernel's F2FS (Flash-Friendly File System) driver arises from a race between f2fs_need_dentry_mark() reading nat_entry flags and the concurrent checkpoint path, so a node folio can be written with the DENT_BIT_SHIFT dentry-mark set even though the inode was already checkpointed. After a sudden power-off, fsck detects this inconsistent inode state. This is a local, low-privilege integrity/availability issue with no public exploit identified at time of analysis; EPSS is low at 0.17% and it is not listed in CISA KEV.
Local privilege escalation in the Linux kernel NTFS3 filesystem driver allows an unprivileged user with a file on a writable ntfs3 mount to set the reserved $LXUID, $LXGID, $LXMOD and $LXDEV WSL-permission xattrs directly via setxattr(), planting root ownership and the S_ISUID bit on their own file so it executes with euid 0. The empty-prefix xattr handler failed to block userspace writes to these internal metadata names, which ntfs_get_wsl_perm() reloads into i_uid/i_gid/i_mode on inode reload. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and the issue is not on CISA KEV, but the outcome is full local root.
Out-of-bounds read in the Linux kernel's AMD IOMMU debugfs subsystem exposes local users with standard privileges to potential kernel memory disclosure or denial of service via a sign-extension defect. The functions iommu_mmio_write() and iommu_capability_write() declare offset variables as signed int but populate them with kstrtou32_from_user(), allowing values in the range 0x80000000-0xFFFFFFFF to wrap negative and theoretically index before the intended MMIO region. The vulnerability description explicitly characterizes it as latent, acknowledging that three pre-existing defensive layers already prevent exploitation in practice; the fix replaces the unsigned parser with kstrtos32_from_user() and adds explicit negativity checks. No public exploit exists, no KEV listing is present, and EPSS sits at 0.15% (5th percentile).
Denial of service and an ACL enforcement flaw in the Linux kernel's NFSv4 server (nfsd) allow an authenticated NFS client to leak kernel memory and bypass RFC-mandated attribute validation. The nfsd4_create_file() path silently discards the return value of nfsd4_acl_to_attr(), so a CREATE supplying an unsupported/unconvertible ACL succeeds with NFS4_OK and no ACL applied, and a failing start_creating() (e.g. an over-length filename) leaks posix_acl allocations on every attempt. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; the fix has been merged upstream.