SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_schoolyr.php endpoint to unauthenticated remote database manipulation via an unsanitized ID parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or complexity barrier, and publicly available exploit code exists, referenced on GitHub. While KEV listing is absent and per-CIA impact is rated Low across all pillars, the combination of zero-barrier remote access and a live POC makes this a credible threat for any internet-exposed instance.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject.php` endpoint to unauthenticated remote exploitation via the unsanitized `id` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network access with no authentication or user interaction required against default installations. A public proof-of-concept exploit has been disclosed on GitHub, substantially lowering the skill threshold for exploitation; however, this vulnerability is not currently listed in CISA KEV, so confirmed active exploitation has not been established.
Unauthenticated remote access to the project upload endpoint in Gerapy up to 0.9.13 is possible because the `@permission_classes([IsAuthenticated])` decorator was commented out in `gerapy/server/core/views.py`, permitting any network-reachable attacker to submit arbitrary zip archives without credentials. Source code review of patch commit bd4891c6 (PR #319) reveals that the same unpatched endpoint also contained a Zip Slip (path traversal) flaw in the archive extraction logic, meaning the combined exposure allows unauthenticated arbitrary file writes to any path the Gerapy process can reach. A public proof-of-concept has been disclosed via GitHub issue #317; this CVE is not currently listed in the CISA KEV catalog.
Missing authentication on the AjaxAdmin AJAX endpoint in newpanjing simpleui 2026.01.13 allows unauthenticated remote attackers to invoke privileged Django admin actions via the `self.get_action` function in `simpleui/admin.py`. A public proof-of-concept exploit exists on GitHub (issue #537), and the vendor has not responded to the disclosure, leaving the vulnerability unpatched. No active exploitation confirmed by CISA KEV, but the combination of PR:N network exposure and available POC makes any internet-facing deployment immediately actionable by low-skill attackers.
Missing authorization in the OAuth Credential Revoke Handler of geex-arts django-jet (versions up to 1.0.8) permits remote unauthenticated actors to revoke OAuth credentials without any access control check. The CVSS 4.0 vector (PR:N/UI:N) confirms no privileges or user interaction are required, and a public exploit exists (E:P). The project maintainer has not responded to the responsible disclosure, meaning no patch is available and no vendor advisory has been issued.
Information disclosure in zevorn's rt-claw (all versions up to 0.2.0) is reachable remotely through manipulation of the claw_net_get and claw_net_post HTTP request functions in claw/services/tools/net.c, exposing sensitive data to unauthenticated network attackers. Publicly available exploit code exists (via GitHub issue #136), raising the practical exploitation threshold significantly. No vendor patch has been released; the project maintainer has not responded to the responsible disclosure report, leaving all deployed instances unmitigated.
Incorrect authorization in zevorn rt-claw up to version 0.2.0 permits remote unauthenticated attackers to invoke privileged RPC functions without valid credentials. The flaw resides in the `claw_tool_invoke` function within the swarm service RPC Handler (`claw/services/swarm/swarm.c`), where authorization checks are insufficiently enforced, enabling authentication bypass. A publicly available proof-of-concept exploit exists via GitHub issue #133; no patch has been released and the project maintainer has not responded to the disclosure.
Sensitive API key credential exposure in django-tastypie up to 0.15.1 stems from the ApiKeyAuthentication class transmitting secrets via GET request query strings, making them visible in server access logs, proxy logs, browser history, and HTTP Referer headers. The flaw is a classic CWE-598 design error rooted in the authentication.py implementation and is remotely triggerable against any deployment using the ApiKeyAuthentication backend. No patch has been released; the project was notified via GitHub issue #1700 but has not yet responded. No public exploit code or CISA KEV listing exists at time of analysis, though the information disclosure risk is real in any environment where logs or network traffic are accessible to adversaries.
NULL pointer dereference in the Linux kernel's batman-adv Bridge Loop Avoidance (BLA) subsystem crashes the kernel when a hard interface is concurrently decoupled from its mesh interface during ARP processing. Local users with low privileges on systems running batman-adv mesh networking can trigger a kernel panic, causing a full denial of service. No public exploit exists and EPSS stands at 0.21% (11th percentile), marking this as a low-urgency stability fix rather than an active threat.
Null pointer dereference in the Linux kernel's virtual console screen (vc_screen) subsystem causes a local denial-of-service via kernel panic. The flaw exists in vcs_write(), where a race condition between concurrent writes and virtual console deallocation leaves a stale vc_data pointer that is subsequently dereferenced in the notifier chain. An authenticated local user with write access to /dev/vcs* devices can trigger this to crash the kernel. No public exploit exists and EPSS is very low at 0.19% (9th percentile), though the fix is confirmed available across multiple stable kernel branches.
NULL pointer dereference in the Linux kernel's vidtv virtual DVB test driver crashes the kernel when memory allocation fails silently during PID context initialization. Systems running kernel versions between the introducing commit (f90cf6079bf6) and the patched releases with CONFIG_DVB_VIDTV enabled are vulnerable to local denial of service. No public exploit is identified at time of analysis, and EPSS probability is 0.19% (9th percentile), indicating very low exploitation likelihood; the vulnerability is absent from CISA KEV.
Kernel memory exhaustion via ksmbd's POSIX-to-DACL ACL conversion causes a reliable denial-of-service against Linux SMB servers. Commit 299f962c0b02 introduced `check_add_overflow()` guards in `set_posix_acl_entries_dacl()` to prevent u16 DACL size wrap-around, but the resulting `break` statements bypass the `kfree(sid)` cleanup calls, leaking one or more `struct smb_sid` kernel heap allocations each time the overflow check fires. EPSS is 0.18% (8th percentile), no KEV listing exists, and no public exploit code has been identified, but the leak is deterministic and repeatable on every DACL request against a file with sufficient POSIX ACL entries, making memory exhaustion straightforward for any attacker with SMB access to the server.
Denial-of-service via the batman-adv Translation Table (TT) subsystem in the Linux kernel allows a local low-privileged attacker to trigger empty VLAN responses through the global TT state path, causing availability loss in the mesh networking stack. The flaw traces to an incomplete prior fix: commit 16116dac2339 patched the direct TT response path against inconsistent TT TLVLs, but left the indirect global TT response path unguarded, enabling the same class of inconsistency state. No public exploit has been identified and EPSS stands at 0.18% (8th percentile), reflecting low real-world exploitation probability.
Heap buffer overflow in the Linux kernel's hwmon adm1266 PMBus driver allows a local attacker or a malicious/buggy PMBus device to crash the kernel by inducing a record_count value exceeding 32 in a BLACKBOX_INFO response, overrunning the fixed 2048-byte dev_mem allocation in adm1266_nvmem_read_blackbox(). Systems with the adm1266 driver loaded against ADM1266 hardware are affected across multiple stable kernel branches; patched versions are confirmed across Linux 5.10.258 through 7.0.11. EPSS at 0.18% and absence of KEV listing indicate no active exploitation at time of analysis.
Kernel stack memory leaks to userspace through the adm1266 PMBus GPIO driver in the Linux kernel when the ADM1266 hardware returns a shorter-than-expected I2C block-read response. Both adm1266_gpio_get() and adm1266_gpio_get_multiple() assemble a 16-bit status word from two buffer bytes without first verifying that at least two bytes were returned; uninitialized stack data then propagates through the gpiolib subsystem into sysfs and char-device ioctls accessible to local users. No public exploit exists and EPSS probability is 0.18% (8th percentile), consistent with the hardware-specific, locally-exploitable nature of this flaw; patches have been released across all active stable kernel branches.
Null pointer dereference in the Linux kernel's Bluetooth ISO reassembly path allows any Bluetooth broadcaster within radio range to crash a victim Linux host by transmitting an ISO_END PDU without a preceding ISO_START on a BIS (Broadcast Isochronous Stream) connection. Affected kernels span all stable branches from the ISO introduction commit (ccf74f2390d60a2f9a75ef496d2564abb478f46a) through fixed releases 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code or CISA KEV listing exists at time of analysis; EPSS is 0.18% (8th percentile), reflecting low current exploitation probability despite the unauthenticated wireless trigger available to BIS attackers.
Availability degradation in the Linux kernel's batman-adv throughput meter (tp_meter) subsystem arises from a reference counting race in the receiver shutdown path, where both `batadv_tp_receiver_shutdown()` and `batadv_tp_stop_all()` can simultaneously skip the `tp_vars` reference release when the shutdown timer expires before `timer_shutdown_sync()` is evaluated. The leaked reference accumulates with repeated triggering, progressively exhausting kernel memory resources and resulting in a local denial-of-service condition on systems running the batman-adv mesh networking module. With no public exploit identified at time of analysis and an EPSS score of 0.18% (8th percentile), this is a correctness-class fix with real impact only on systems explicitly running batman-adv.
Resource leak in the Linux kernel irqchip/imgpdc interrupt controller driver allows a local privileged user to induce a kernel use-after-free and system crash by triggering driver removal without proper cleanup. The imgpdc driver, targeting Imagination Technologies PDC hardware on MIPS-based SoCs, fails to free allocated domain generic interrupt chips or clear chained handlers on unbind, leaving dangling pointers on the global gc_list accessible by PM suspend, resume, and shutdown callbacks. No public exploit exists and EPSS is 0.18% (7th percentile), reflecting very low exploitation probability consistent with the niche hardware target.
NULL pointer dereference in the Linux kernel's fbdev framebuffer subsystem allows a local low-privileged user to trigger a kernel panic (denial of service) by replacing the framebuffer modelist via sysfs while fbcon is unbound. The crash occurs when a subsequent console takeover calls fb_videomode_to_var() with a NULL mode pointer, resulting from the broken invariant that info->var always has a matching entry in info->modelist. No public exploit or CISA KEV listing exists; EPSS of 0.18% (7th percentile) reflects negligible observed exploitation interest.
Stack buffer overflow in the Linux kernel adm1266 PMBus hardware monitor driver allows a local low-privileged user to crash the kernel on systems equipped with an Analog Devices ADM1266 power sequencer chip. The vulnerable function allocates a 5-byte stack buffer but passes it to i2c_smbus_read_block_data(), which performs an unchecked memcpy of up to 32 bytes (I2C_SMBUS_BLOCK_MAX) before any length validation - overflowing the stack and causing a denial of service. No public exploit code exists and EPSS at 0.18% (7th percentile) confirms limited exploitation interest; patched versions are available across all active stable kernel branches.
The pds_core driver in the Linux kernel leaks debugfs dentry references on every firmware reset recovery due to missing dput() calls after debugfs_lookup(), and can crash the kernel when CONFIG_DEBUG_FS is disabled because ERR_PTR(-ENODEV) is not properly distinguished from NULL. A local user with standard privileges on a system hosting AMD/Pensando DPU hardware can trigger repeated firmware reset cycles to exhaust kernel memory, causing denial of service; on kernels with CONFIG_DEBUG_FS=n, a single reset recovery call can immediately crash the system via an invalid dput() on an error pointer. No public exploit exists and EPSS is 0.18% (7th percentile), but patches are available across multiple stable branches.
Memory leak in the Linux kernel's btmtk (MediaTek Bluetooth USB) driver allows a local low-privileged user to exhaust kernel memory, causing denial of service. The vulnerability affects systems running Linux kernel from commit a1c49c434e15050b5dafe3b6f5cc732d4f02d657 onward, with patches confirmed in stable releases 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and no active exploitation has been confirmed; an EPSS of 0.18% at the 7th percentile places this firmly in low-priority territory for most organizations.
Kernel stack address disclosure in the Linux kernel's Bluetooth L2CAP subsystem leaks 8 bytes of kernel virtual address space to a paired Bluetooth peer whenever a local user triggers an L2CAP Enhanced Credit-Based Reconfigure (ECRED) request. The flaw was introduced by commit 1c08108f3014 when DEFINE_RAW_FLEX() converted the on-stack PDU struct but left l2cap_send_cmd() receiving the local pointer's stack storage address and sizeof(pointer) instead of the struct address and struct size. As a result, the ECRED reconfigure feature has been functionally broken for local initiators since that commit, and every reconfigure attempt passively leaks a KASLR-randomized kernel stack address to the Bluetooth peer, potentially aiding ASLR/KASLR bypass. No public exploit is identified at time of analysis, and the EPSS score of 0.18% (7th percentile) reflects low automated exploitation probability.
Memory leak in the Linux kernel's ath11k WiFi driver (Qualcomm Atheros 802.11ax) allows a local low-privileged user to exhaust kernel memory by triggering error paths in two WMI Wake-on-WLAN (WOW) command functions that fail to free associated socket buffers (skb) on failure. Patched across all active stable kernel branches (5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and mainline 7.1). No active exploitation has been identified, with EPSS at 0.17% (7th percentile), consistent with a routine driver memory management fix rather than a weaponizable vulnerability.
DMA mapping failures in the Linux kernel's dma-mapping subsystem crash device driver probes on ARM64 systems with SPARSEMEM due to an incorrect pfn_valid() precondition check in dma_map_resource(). On Raspberry Pi 4 and similar ARM64/SPARSEMEM platforms, MMIO registers whose physical addresses share a 128MB sparsemem section with RAM are misidentified as RAM, causing WARN_ON_ONCE to fire and dma_map_resource() to return DMA_MAPPING_ERROR, breaking peripheral initialization (e.g., spi_bcm2835 SPI controller). No public exploit identified at time of analysis; this is a functional kernel regression with local availability impact rather than a remotely exploitable security flaw.
Out-of-bounds heap read in the Linux kernel's fwctl pds driver allows a local low-privileged user to crash the kernel by submitting an undersized RPC buffer, resulting in a denial of service. Affected kernel versions include Linux 6.15 and all stable trees prior to 6.18.34, 7.0.11, and 7.1, with exploitation requiring the pds_fwctl module loaded and a compatible PDS network adapter present. No public exploit exists and EPSS is 0.17% (7th percentile), placing this as a low-priority stability fix unless deployments expose the fwctl device node to untrusted local users.
Deadlock in the Linux kernel's drm/msm (Qualcomm Snapdragon GPU) shrinker causes full kernel hang under memory reclaim pressure. The circular lock dependency arises when the kswapd0 thread holds fs_reclaim and the MSM gem shrinker calls dma_resv_lock(), which internally attempts to re-acquire fs_reclaim - producing a ABBA deadlock that renders the system unresponsive. Kernels in the affected range on Snapdragon-based hardware (Linux 6.17 through pre-patch 7.0.x and 6.18.x) are vulnerable; no public exploit code exists and no active exploitation has been confirmed.
Bio memory leak in the Linux kernel NVMe driver causes kernel memory exhaustion under integrity-mapping failure conditions, affecting local low-privileged users on systems with NVMe integrity features enabled. The defect lies in the NVMe block-I/O path: a local `bio` pointer is always NULL, so when integrity mapping fails the associated bio object is never freed - the fix retrieves the bio directly from the request structure. With EPSS at 0.17% (7th percentile) and no CISA KEV listing, no public exploit has been identified at time of analysis, and real-world risk is confined to gradual memory exhaustion rather than immediate system compromise.
CPU exhaustion in the Linux kernel's cfg80211 WiFi subsystem allows an attacker within radio range to trigger a runaway loop in cfg80211_merge_profile() by broadcasting a specially crafted Multi-BSSID beacon frame, consuming up to 2 milliseconds of kernel CPU time per beacon received. Devices running Linux 5.2 and later with cfg80211-based WiFi drivers are affected across eight stable kernel branches, from 5.10.x through 7.0.x, until patched. No public exploit has been identified at time of analysis, and EPSS probability is 0.17% at the 7th percentile, indicating no observed active exploitation.
Early boot initialization on ARM Integrator/CP hardware in the Linux kernel triggers a NULL pointer dereference by invoking memory allocation routines before the memory management subsystem is operational, causing a kernel panic that renders affected systems unbootable. The regression was introduced by commit bdb249fce9ad4 and affects all Linux stable branches from that point through patched releases (5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, 7.1). No public exploit exists, CISA KEV does not list this vulnerability, and EPSS sits at 0.17% (7th percentile), reflecting the narrowly scoped, hardware-specific nature of the defect.
Spurious kernel WARN() triggers in Linux kernel mm/memory.c during process teardown when NVIDIA UVM or HMM-capable GPU drivers are present alongside private file-backed mappings containing migrated anonymous folios. The unmap path incorrectly uses vma_is_anonymous() rather than folio_test_anon() to gate device-private/exclusive page handling, producing false-positive kernel warnings (not panics) during munmap or process exit in affected configurations. No public exploit has been identified at time of analysis; EPSS at 0.17% (7th percentile) reflects the narrow triggering conditions required and the non-weaponizable nature of a spurious WARN().
Spinlock leak in the Linux kernel's huge page device migration subsystem causes a local denial of service via deadlock. A low-privileged local user who can trigger the `migrate_vma_insert_huge_pmd_page` code path while inducing `check_stable_address_space()` to fail will leave the PMD spinlock permanently held, deadlocking any subsequent thread that attempts to acquire it. No public exploit has been identified and EPSS at 0.17% (7th percentile) reflects negligible real-world exploitation probability; the vulnerability is not in CISA KEV.
Sysfs group corruption in the Linux kernel's kernfs/sysfs subsystem can cause local denial of service when a pre-existing attribute group directory is silently deleted during a failed update operation. When `sysfs_update_group()` encounters an allocation failure (-ENOMEM) in `create_files()`, the cleanup code in `internal_create_group()` calls `kernfs_remove(kn)` on a kernfs node obtained via `kernfs_find_and_get()` - a directory that existed before the call - rather than restricting removal to directories it created. This logic error, affecting multiple stable kernel branches prior to the respective fix commits, is not in CISA KEV, carries an EPSS of 0.17% (6th percentile), and no public exploit has been identified.
NULL pointer dereference in the Linux kernel's ARM Firmware Framework for Armv8-A (arm_ffa) bus driver allows a local actor with kernel module loading rights to crash the host system. The bus match callback unconditionally dereferences the id_table pointer of any registering FF-A client driver; a driver that omits id_table triggers an immediate kernel panic, producing a denial-of-service condition. EPSS at 0.17% (6th percentile) and absence from the CISA KEV catalog indicate no public exploit and negligible observed exploitation activity.
Incorrect dirty-region bookkeeping in the Linux kernel netfs subsystem (netfs_invalidate_folio) causes a local denial-of-service condition when streaming-write folios are partially invalidated. The bug is present in kernels from commit cce6bfa6ca0e through multiple stable branches and is fixed in 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit or active exploitation has been identified; EPSS sits at 0.17% (6th percentile), reflecting very low real-world exploitation probability despite the kernel's ubiquitous deployment.
KVM arm64 vGIC in the Linux kernel leaks kernel memory when vCPU initialization fails, enabling a local attacker with VM-creation privileges to exhaust host memory and cause denial of service. The defect is a missing cleanup call in the kvm_vgic_vcpu_init() error path: private IRQs allocated prior to a redistributor iodev registration failure are never freed before the failed vCPU structure is released. No public exploit has been identified at time of analysis; an EPSS score of 0.17% (6th percentile) reflects low opportunistic exploitation probability, and the flaw is not listed in CISA KEV.
Kernel panic (BUG) in the Linux netfs subsystem's netfs_write_begin() function causes local denial of service when a folio is unlocked without holding the lock, triggering the VM_BUG_ON_FOLIO(!folio_test_locked(folio)) assertion at mm/filemap.c:1504. The defect surfaces under concurrent write workloads on Ceph-backed filesystems using the netfs layer - the generic/013 xfstests case reproduces it with approximately 30% probability per run. A local, low-privileged user who can write to a Ceph mount can crash the kernel; no confidentiality or integrity impact is observed. No public exploit code exists and EPSS stands at 0.17% (6th percentile), consistent with a race-condition DoS confined to specific filesystem configurations.
Kernel crash via NULL pointer dereference in the Linux netfs layer is triggered by a local low-privileged user combining a streaming write, file truncation, and mmap read on the same netfs-backed file. Affected kernel versions span from 6.8 (commit 9ebff83e) through stable branches prior to 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and EPSS is 0.17%, indicating very low observed exploitation probability; however, a precise reproduction recipe is embedded in the upstream fix commit, substantially lowering the knowledge barrier for any attacker already holding local access.
Write-through mode deadlock in the Linux kernel netfs subsystem allows a local low-privileged user to hang the kernel, causing a denial of service. The defect in netfs_advance_writethrough() fails to unconditionally unlock a supplied folio, and prematurely marks it for writeback before the folio is fully written, creating a lock-ordering conflict against concurrent mmapped reads and writes. Patches are available across multiple stable kernel branches; no public exploit code or active exploitation has been identified.
Reference leaks and memory corruption in the Linux kernel netfs subsystem allow a local unprivileged user to crash the system via crafted write operations on network-backed filesystems. The flaw in netfs_perform_write() incorrectly transitions folio->private between NULL, the NETFS_FOLIO_COPY_TO_CACHE sentinel, netfs_group pointers, and netfs_folio structs, enabling multiple private-data attachments, folio reference leaks, and netfs_group struct leaks that can exhaust kernel resources or trigger a kernel panic. No public exploit exists and EPSS sits at 0.17% (6th percentile), indicating no observed exploitation activity.
Null pointer dereference in the Linux kernel's block bio-integrity subsystem (`bio_integrity_map_user()`) allows a local low-privileged attacker to crash the kernel, causing a denial of service. The flaw stems from `pin_user_pages_fast()` being permitted to return a partial page-pin result that is never validated before `bvec_from_pages()` dereferences the uninitialized zero-address entry. Patches are available across multiple stable kernel branches and Ubuntu has issued USN-8593-1; no active exploitation has been identified (EPSS 0.17%, no CISA KEV listing).
Silent NFS data loss in the Linux kernel's nfsd subsystem allows UNSTABLE write data to be discarded without client notification when deferred writeback errors occur. Affected kernels prior to 6.12.95, 6.18.38, and 7.1.3 fail to rotate the server write verifier (nn->writeverf) in nfsd_vfs_write() and nfsd_commit() after filemap_check_wb_err() detects an error, so NFS clients receive an unchanged verifier on COMMIT and incorrectly conclude their data is durable - violating the UNSTABLE+COMMIT contract in RFC 1813 §3.3.7 and RFC 8881 §18.32. No public exploit exists and EPSS sits at 0.17% (6th percentile), placing this firmly in the operational-reliability rather than active-threat category.
CPU pinning denial-of-service in the Linux kernel L2TP subsystem allows an unprivileged local user to wedge a host CPU indefinitely by exploiting an RCU list management mismatch in l2tp_session_unhash(). By creating a user network namespace (unshare -Urn) to obtain CAP_NET_ADMIN and then racing L2TP_CMD_SESSION_CREATE, L2TP_CMD_SESSION_DELETE, and L2TP_CMD_SESSION_GET against the same tunnel, an attacker causes a session list walker to enter an infinite loop with BH and preemption disabled - stalling RCU grace periods system-wide and rendering the thread unkillable via SIGKILL. No public exploit has been identified at time of analysis; EPSS at 0.17% (6th percentile) indicates low automated exploitation probability and no CISA KEV listing.
Resource leak in the Texas Instruments ICSSG PRUETH Ethernet driver causes a device-tree node reference count to go unreleased on a specific probe error path, degrading kernel resource availability. Affected kernels from commit 511f6c1ae093c7045742299d29eba71925709a71 onward, prior to stable backports landing in 6.18.34, 7.0.11, and 7.1, are at risk only on hardware platforms carrying TI ICSSG silicon. EPSS sits at 0.17% (6th percentile) and no public exploit or CISA KEV entry exists, positioning this as a maintenance-tier stability fix rather than an active threat.
Incorrect writeback state management in the Linux kernel's netfs and AFS subsystems allows a local low-privileged user on an AFS-mounted system to cause filesystem availability degradation. When netfs_write_single() or afs_single_writepages() skips a write due to lock contention under asynchronous writeback (WB_SYNC_NONE), the affected inode loses its dirty mark without the write being rescheduled, meaning data may never be flushed to the AFS server. No public exploit has been identified and the EPSS score of 0.17% at the 6th percentile reflects very low exploitation probability; patched versions are confirmed available across multiple stable kernel branches.
Stale ARM64 Memory Tagging Extension (MTE) tag exposure in the Linux kernel's huge zero folio allocation path undermines the init_on_free security guarantee on AArch64 systems. When the kernel is booted with init_on_free=1 and a 2MB anonymous mapping triggers the huge zero folio path (mapped as a PMD-special entry), the __GFP_ZEROTAGS flag causes post_alloc_hook() to skip tag memory clearing while content zeroing was already handled at free time - leaving whatever allocation tags were previously set accessible to user space. No public exploit has been identified at time of analysis, and EPSS stands at 0.17% (6th percentile), consistent with the narrow architectural and configuration prerequisites required to trigger the flaw.
NULL pointer dereference in the Linux kernel's ethtool PHY subsystem allows a local low-privileged user to crash the kernel and cause a denial of service. The flaw in `phy_prepare_data()` fails to check return values from `kstrdup()` for the strings `name`, `drvname`, `upstream_sfp_name`, and `downstream_sfp_name`; when allocation fails and returns NULL, `phy_reply_size()` subsequently calls `strlen()` unconditionally on the NULL pointer, triggering a kernel oops and system panic. No public exploit code has been identified and EPSS stands at 0.17% (6th percentile), but the availability impact is total - a kernel panic - making this a standard patching priority for any multi-user or shared Linux environment.
Memory leak in the Linux kernel igc driver's Frame Preemption (FPE) implementation affects systems with Intel I225/I226 Ethernet controllers running kernel versions from commit 5422570c0010bb968738f9256eb2bf83e79b4d63 onward. The function igc_fpe_xmit_smd_frame() allocates a socket buffer for SMD frame transmission but fails to release it when igc_fpe_init_tx_descriptor() returns an error, confirmed by kernel SLAB unreferenced-object traces showing 224-byte skb allocations going unfreed. No public exploit has been identified and EPSS stands at 0.17%, indicating negligible broad exploitation interest; the practical exposure is limited to TSN-capable deployments with FPE explicitly enabled.
Reference leak in the Linux kernel netfs subsystem exposes systems with network filesystem mounts to a local denial-of-service condition. The `netfs_write_begin()` function fails to drop its held reference on the netfs request object when `netfs_wait_for_read()` returns an error, violating reference-counting invariants in the kernel's network filesystem abstraction layer. A low-privileged local user who can trigger repeated write errors on a netfs-backed mount (NFS, Ceph, AFS, or similar) can slowly exhaust kernel memory resources. No public exploit code exists and EPSS is 0.17% (6th percentile), consistent with a low-priority kernel maintenance fix.
NULL pointer dereference in the Linux kernel's drm/msm/adreno driver allows local low-privilege users to crash systems equipped with older Qualcomm Adreno GPU generations (a2xx through a4xx). Querying UBWC (Universal Bandwidth Compression) parameters from userspace on these GPU families - which have no UBWC support and therefore no initialized UBWC config structure - triggers a NULL dereference in adreno_get_param(), resulting in a kernel panic. No public exploit has been identified at time of analysis; EPSS is 0.17% (6th percentile), consistent with the hardware-specific, local-only scope.