Remote code execution in Redis before 8.8.0 is possible when an authenticated attacker can run the RESTORE command with a maliciously crafted serialized stream payload. The payload defines a stream consumer-group PEL in which the same NACK (pending entry) is referenced by two different consumers, so tearing those consumers down (via XGROUP DELCONSUMER or XACK) triggers a CWE-415 double free of the shared NACK object, corrupting the heap. Publicly available exploit code exists, and the flaw stems from an incomplete fix for CVE-2026-25243; it is not listed in CISA KEV, so there is no public exploit identified as actively exploited at time of analysis.
Unauthenticated remote administrator takeover in SiYuan before v3.7.2 via missing authorization on the /mcp kernel endpoint. When the Publish server is in anonymous mode, a remote attacker can invoke 31 MCP tools—including full file-system read, write, and delete—to exfiltrate secrets from conf/conf.json and plant a malicious plugin that runs with elevated desktop privileges. While no active exploitation has been confirmed by CISA KEV, detailed exploit information is publicly available, and the vulnerability carries a maximum CVSS severity.
Remote code execution in Catalyst::View::Wkhtmltopdf before 0.6.1 allows unauthenticated attackers to inject arbitrary shell commands via unsanitized PDF render options such as page_size, orientation, or margins. The incomplete fix in 0.6.0 still permits injection. CVSS 9.8, EPSS 0.67% (moderate probability), CISA SSVC indicates automatable and total impact, but no active exploitation reported.
Use-after-free vulnerability in the Linux kernel's fsl-lpspi SPI driver can lead to memory corruption or arbitrary code execution with kernel privileges. A local attacker with high privileges on systems using the affected driver can trigger this flaw, potentially causing a kernel panic or full system compromise. At time of analysis, no public exploit or active exploitation is identified, and EPSS indicates low exploitation probability (0.22%).
Out-of-bounds write in the Linux kernel's siw RDMA driver allows a remote attacker on an established iWARP connection to cause memory corruption and potential code execution by sending a crafted sequence of Read Response segments that exceed the read request's buffer length. Affects all Linux kernel versions with the siw driver since 5.3. No public exploit is known, and EPSS score is low (0.22%), but the CVSS rating is Critical (9.8).
Improper authorization in the Linux kernel's ksmbd (in-kernel SMB3 server) lets an authenticated SMB client overwrite destination file data it should not be able to write. The FSCTL_DUPLICATE_EXTENTS_TO_FILE branch of smb2_ioctl() performs a server-side block clone via vfs_clone_file_range() but omits the share-level writable check and the per-handle access check that every other write-bearing ioctl arm enforces, so data can be overwritten on a read-only share or through a handle opened with only FILE_WRITE_ATTRIBUTES. This is an integrity/authorization bug (not memory corruption); there is no public exploit identified at time of analysis and EPSS is low (0.21%).
Use-after-free vulnerability in the Linux kernel's ksmbd SMB server allows remote attackers to execute arbitrary code. All kernel versions with ksmbd enabled from early commits up to the patched releases are affected, and the issue can be triggered by concurrent QUERY_DIRECTORY requests on the same file handle. A fix is available via multiple stable kernel branches, no active exploitation is reported in KEV, and EPSS indicates a low probability of widespread exploitation (0.21%).
An out-of-bounds memory access in the Linux kernel's BPF devmap broadcast redirect for XDP frames, introduced in version 5.14, can be triggered by remote unauthenticated attackers sending specially crafted fragmented network packets. This could lead to kernel memory corruption and arbitrary code execution. Though CVSS rates this as critical (9.8), no public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.21%).
Unauthorized read/write of Alternate Data Streams in Linux ksmbd allows remote attackers to access or modify file extended attributes. The vulnerability, present in Linux kernel versions with ksmbd up to before patches 6.18.39, 6.12.96, 7.1.4
Double-free memory corruption in the Linux kernel SMB client when processing SMB2 QUERY_DIRECTORY responses. A remote attacker acting as a malicious SMB server can trigger the issue during directory enumeration, potentially leading to arbitrary code execution or denial of service on any unpatched Linux system that mounts an attacker-controlled share. The vulnerability is not known to be actively exploited, but patches are available across multiple stable kernel branches.
Double free in the Linux kernel's SMB client due to improper cleanup of response buffers when a reply error is replayed. An attacker controlling an SMB server can trigger memory corruption, potentially leading to code execution or a system crash, when a vulnerable client connects and processes a crafted response. Patches are available in multiple stable kernel branches, but no active exploitation or public exploit has been reported.
Double-free vulnerability in the Linux kernel's SMB client (cifs) allows remote code execution via crafted SMB2_ioctl replies. An attacker hosting a malicious SMB server can trigger a replay path memory double-free, leading to full system compromise. No active exploitation or public exploit has been identified at this time; EPSS score is low (0.21%).
Denial-of-service (kernel memory corruption) in the Linux kernel's cifs/smb client affects the SMB2 CHANGE_NOTIFY replay path. When a response-bearing notify attempt returns a replayable error and frees its response buffer, stale resp_buftype/rsp_iov bookkeeping is retained across attempts; if SMB2_notify_init() then fails before the next send, cleanup frees the already-freed response a second time (CWE-415 double-free). Exploitation requires a malicious or man-in-the-middle SMB server and winning a replay/retry-failure race, so real-world risk is DoS-leaning; no public exploit is identified and EPSS is low at 0.21%.
Double-free memory corruption in the Linux kernel's SMB client (cifs) affects the SMB2_flush() replay path across many stable branches prior to 6.6.145, 6.12.96, 6.18.39 and 7.1.4. When a mounted client receives a replayable flush response and the subsequent retry fails before cifs_send_recv() installs a replacement response, flush_exit frees the stale response buffer a second time, corrupting kernel slab memory and typically crashing the client. No public exploit is identified at time of analysis (EPSS 0.21%, 11th percentile) and it is not in CISA KEV; exploitation requires a malicious or man-in-the-middle SMB server plus a replay/retry timing race, making it primarily a denial-of-service concern despite the 9.8 rating.
Use-after-free in the Linux kernel net/handshake subsystem allows a struct socket to be torn down while the handshake netlink accept path still holds a pointer to it. The submit path only took a sock_hold(), which keeps struct sock alive via sk_refcnt but does not pin the struct socket (owned by sock->file); once the userspace handshake agent releases the last file reference, sock_release() destroys the socket, leaving handshake_nl_accept_doit() dereferencing freed memory. Fixed versions are available (6.12.93, 7.0.12, 7.1); EPSS is low at 0.21% and no public exploit is identified at time of analysis.
Use-after-free in the Linux kernel TCP Authentication Option (TCP-AO
Use-after-free in the Linux kernel's crypto/krb5 helper library (introduced in 6.15) occurs when Kerberos AEAD encrypt/decrypt operations are backed by an asynchronous AEAD implementation. The synchronous helpers in rfc3961_simplified.c and rfc8009_aes2.c set a NULL completion callback and treat any negative return as terminal, so an async backend returning -EINPROGRESS causes the buffer to be freed with kfree_sensitive() while the backend worker still dereferences it. This is reachable through kernel consumers of krb5 crypto (rxrpc/rxgk, AFS cm_security, and Ceph), but only on systems where an async AEAD provider is bound to the krb5 enctype name; no public exploit identified at time of analysis and EPSS is low at 0.21%.
Insufficient validation in the Linux kernel's netfilter flowtable hardware offload for IPIP tunnels could allow a remote attacker to cause information disclosure or denial of service. The flaw exists because the kernel would attempt to enqueue hardware offload work for IPIP tunnels despite no driver supporting it, leading to an unspecified impact when the unsupported configuration is processed. The issue is fixed by adding an early check to skip unsupported offload setup. No public exploit code is
Unauthorized modification of push notification tokens in OpenRemote before 1.26.2 allows unauthenticated attackers to redirect or block push notifications to legitimate consoles. By supplying a known console asset identifier, an attacker can bypass authentication on the registration API to overwrite notification tokens and metadata, disrupting notification delivery. The issue is tracked as CVE-2026-66013; no public exploit is confirmed at time of analysis.
Heap-based out-of-bounds read in the Linux kernel's nvmet discovery log page handler allows unauthenticated remote attackers to leak kernel memory or crash the host. Any system acting as an NVMe over Fabrics target with a discovery service exposed via TCP, RDMA, or FC is vulnerable. No active exploitation or public exploit code is reported at this time, and EPSS probability is low (0.25%), but the impact and ease of exploitation make remediation urgent for affected storage targets.
Out-of-bounds heap read in the Linux kernel's nvmet-auth module allows pre-authentication remote attackers to read up to 526 bytes of heap memory beyond a crafted DHCHAP_REPLY message. By sending an NVMe-oF authentication reply with a small transfer length but inflated hash and DH value length fields, an unauthenticated attacker can extract sensitive data or cause a denial-of-service. Patches are available in upstream stable kernels.
Out-of-bounds slab read in the Linux kernel TIPC (Transparent Inter-Process Communication) protocol lets a malicious TIPC neighbour trigger a heap over-read by sending a single crafted broadcast PROTOCOL/STATE_MSG carrying a Gap ACK blocks record. Affecting kernels 5.8 through the fixed stable releases, the broadcast path (tipc_bcast_sync_rcv → tipc_link_advance_transmq) fails to bound the Gap ACK record against the actual message data size, so kmemdup() copies up to 1024 bytes past a ~704-byte skb, corrupting/leaking adjacent slab memory and crashing the host (KASAN slab-out-of-bounds). No public exploit is identified at time of analysis and EPSS is low (0.22%), consistent with a niche, non-default kernel subsystem.
Filesystem permission bypass in the Linux kernel's in-kernel SMB server (ksmbd) allows an authenticated SMB client to delete base files and Alternate Data Stream (ADS) xattrs it should not be permitted to remove. When a delete-on-close is finalized during deferred or durable handle teardown - a code path with no associated request work - the unlink and ADS removal executed with the ksmbd worker's credentials rather than the opening user's, skipping the fsuid/fsgid/supplementary-group/capability checks. No public exploit is identified at time of analysis; EPSS is low (0.22%, 13th percentile) and it is not in CISA KEV.
Unauthorized file modification in the Linux kernel's ksmbd SMB server allows remote attackers to modify file data and attributes by exploiting a credential confusion in SMB2 SET_INFO handlers. The vulnerability arises because the VFS operations used after permission checks run with the ksmbd worker credentials rather than the opener's credentials, effectively bypassing ownership and permission restrictions. No public exploit is known and EPSS is low (0.21%), but the network-accessible, low-complexity nature makes critical
Host memory disclosure to a remote RDMA peer in the Linux kernel's RDMA/rtrs-srv (RTRS server) transport allows a connected peer to read beyond a mapped chunk buffer. When answering an RTRS READ, rdma_write_sg() set the outbound RDMA-Write source-SGE length directly from the attacker-controlled wire descriptor field desc[0].len, which was only rejected when zero, and used the PD-wide local_dma_lkey rather than the chunk's own MR, so the verbs layer never constrained the transfer to max_chunk_size. A peer advertising a length larger than the chunk can force the posted RDMA write to read past the chunk into adjacent host memory (disclosed back to the peer under passthrough/no-IOMMU configs) or trigger a translation fault that aborts the connection. No public exploit identified at time of analysis and EPSS is low (0.21%).
Memory exposure and denial of service in the Linux kernel SMB client allows remote attackers to read kernel memory or crash the system via crafted SMB2 responses. The vulnerability exists in versions prior to the patched releases, affecting all systems mounting SMB shares from untrusted servers. No authentication or user interaction is required, and while no active exploitation is reported, the high CVSS score reflects the serious confidentiality and availability impact.
Out-of-bounds read and integer underflow in the Linux kernel staging driver rtl8723bs (Realtek RTL8723BS SDIO Wi-Fi chipset) allows an adjacent network attacker to trigger kernel memory disclosure or crash via crafted 802.11 WEP authentication frames. Two distinct bugs in OnAuth() can be triggered without authentication: a length underflow that causes crc32_le() to read far beyond the frame buffer when the Privacy bit is set on a short frame, and a fixed 128-byte memcmp in the seq=3 path that ignores the actual IE length field. No public exploit code exists and EPSS is 0.26%, reflecting the combination of adjacent-network requirement, deprecated WEP protocol dependency, and niche SDIO chipset driver.
Authorization bypass in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated network client to rewrite any accessible file's security descriptor - including DACL and owner - without holding WRITE_DAC or WRITE_OWNER rights on the file handle. A client opening a handle with only FILE_WRITE_ATTRIBUTES can issue SMB2 SET_INFO with InfoType SMB2_O_INFO_SECURITY to invoke set_info_sec(), which rewrites POSIX ACLs, ownership via notify_change(), and (on KSMBD_SHARE_FLAG_ACL_XATTR shares) the Windows SD xattr, all without any fp->daccess gate. No public exploit has been identified; EPSS is 0.22%, and patches are confirmed in kernel stable series 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1.
Missing VGA arbiter client cleanup on vfio/pci registration failure in the Linux kernel leaves a stale callback registered against a freed vdev cookie. The displaced vfio_pci_vga_init() call in vfio_pci_core_register_device() was never paired with an unwind handler, so any failure after VGA arbiter registration exits without releasing the arbiter client. While currently mostly benign because the existing vfio_pci_set_decode() callback only dereferences pci_dev state, the stale registration becomes a live use-after-free vector once any code path makes the callback follow drvdata to the freed vfio device structure. No public exploit has been identified and EPSS is 0.22%, consistent with a latent defect rather than an actively targeted flaw.
Use-after-free in the Linux kernel's Intel QuickAssist Technology (QAT) SR-IOV driver allows a local low-privileged attacker - including a VM tenant with a VF assigned - to corrupt host kernel memory by racing VF2PF workqueue processing against SR-IOV teardown in adf_disable_sriov(). The VF2PF interrupt handler enqueues work that holds raw pointers to per-VF state (struct adf_accel_vf_info); adf_disable_sriov() freed that state without draining in-flight workers, enabling a concurrent worker to deref freed memory. No public exploit is known at time of analysis, and EPSS is 0.22% (13th percentile), indicating negligible observed exploitation pressure despite the 8.8 CVSS score.
Use-after-free race condition in the Linux kernel's Bluetooth BNEP subsystem allows an adjacent unauthenticated attacker to corrupt kernel memory or crash the system. During netdev registration via bnep_add_connection(), the L2CAP connection is read without holding the channel lock; if controller teardown occurs concurrently, the freed parent device is dereferenced by the network device registration path. The fix takes a reference to the L2CAP connection under the channel lock and retains it until register_netdev() secures its own parent device reference. No public exploit or CISA KEV listing has been identified at time of analysis, and the 0.22% EPSS score reflects low active exploitation probability.
Out-of-bounds bit manipulation in the Linux kernel HID multitouch driver allows an attacker with a crafted USB or Bluetooth multitouch device to corrupt adjacent kernel data structures and panic the kernel. The driver uses mt_io_flags - a single unsigned long - as a variable-length per-slot bitmap indexed by slot number, which is bounded only by the device-reported ContactCountMaximum (up to 255). When that value exceeds BITS_PER_LONG, set_bit()/clear_bit() operations in mt_release_contacts() overwrite adjacent struct mt_device members, zeroing the td->applications list head and causing a null-pointer dereference in softirq context. No local privileges are required; physically connecting a crafted device is sufficient. No public exploit code has been identified at time of analysis.
Incorrect carry overflow in the Linux kernel's ECC vli multiplication allows adjacent network attackers to cause incorrect ECDH shared secret derivation, potentially enabling man-in-the-middle attacks against ECDH-based protocols such as IPsec, TLS, and Wi-Fi WPA3. The vulnerability, introduced in kernel 4.8, can be exploited without authentication or user interaction if ECDH is enabled. No active exploitation or public exploit has been identified, but the bug fundamentally weakens cryptographic guarantees.
Out-of-bounds write in the Linux kernel's HID wacom driver allows an adjacent attacker to corrupt kernel memory, potentially achieving code execution or crashing the system. The flaw, present in kernels from commit 5e013ad2... up to the fixed versions 6.18.39, 7.1.4, and 7.2-rc1, stems from a missing emptiness check that causes the FIFO to read stale data and bypass the buffer size guard. No active exploitation or public exploit code has been identified, and EPSS predicts a low exploitation probability (0.22%).
Out-of-bounds reads in the Linux kernel's rtl8723bs staging WiFi driver allow an adjacent unauthenticated attacker to leak kernel memory or crash the system by sending crafted 802.11 management frames containing malformed WPA, WAPI, or WPS Information Elements. Three IE parsing functions - rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - lack bounds validation before reading multi-byte header fields and OUI comparisons, exposing raw kernel buffer contents to an adversary within WiFi range. No public exploit or active exploitation has been identified; vendor-released patches are available across all supported stable branches.
Use-after-free in the Linux kernel's ksmbd (SMB server) allows authenticated remote attackers to trigger memory corruption, potentially leading to arbitrary code execution or denial of service. The flaw occurs when an SMB2_CLOSE on a locked file is followed by an SMB2_CANCEL, causing a freed file_lock to be re-accessed. A patch is available for affected kernel versions, and while no active exploitation is confirmed, a proof-of-concept exists; EPSS indicates low exploitation likelihood.
Use-after-free in Linux kernel’s ksmbd SMB server occurs during deferred byte-range lock cancellation, allowing an authenticated attacker to potentially execute arbitrary code or crash the system. The vulnerability affects ksmbd versions prior to the released fixes (6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, 7.2-rc1). No active exploitation has been confirmed (no CISA KEV listing), and EPSS indicates a low probability of widespread exploitation.
Memory corruption in the Linux kernel's ksmbd SMB server allows authenticated remote code execution. A race condition in byte-range lock ownership tracking can lead to use-after-free when SMB3 multichannel is enabled, enabling an attacker with low privileges to escalate to full system compromise. No public exploit or active exploitation is known, and EPSS indicates low exploitation probability.
Use-after-free in the Linux kernel's Bluetooth L2CAP subsystem can be triggered by an adjacent attacker, potentially leading to arbitrary code execution or kernel memory corruption. The flaw occurs when a channel timeout callback races with connection teardown, allowing a freed connection object to be accessed. Patched kernels are available; no active exploitation is confirmed, but the vulnerability is remotely exploitable within Bluetooth range without authentication or user interaction.
Double-free in the Linux kernel SMB client's SMB2_open() replay handler allows remote attackers to corrupt memory by inducing a user to mount a malicious SMB share. The flaw affects unpatched kernel versions with the cifs module loaded and can lead to arbitrary code execution, information disclosure, or denial of service. No active exploitation has been reported (not in CISA KEV), and EPSS score is 0.21%, indicating low exploitation probability; official kernel patches are available.
State-counter underflow in the Linux kernel's mlx5e (NVIDIA/Mellanox ConnectX) IPsec offload driver lets the eswitch mode-block reference counter (esw->offloads.num_block_mode) be decremented without a matching increment when a temporary acquire-flow security association is installed. The affected code is the mlx5e_xfrm_add_state() acquire-SA path, which skips hardware offload but still falls through to the common success label that unconditionally calls mlx5_eswitch_unblock_mode(). Fixed upstream in the stable kernel series; no public exploit identified at time of analysis and EPSS probability is low (0.21%).
Reference-count corruption in the Linux kernel's rust_binder IPC driver on 32-bit kernels allows a local, low-privileged user to over-decrement binder object reference counts by submitting transactions with a crafted offsets array. The allocation cleanup path uses usize (32-bit on 32-bit kernels) as the stride and read width for 8-byte binder_size_t entries, causing an N-entry array to be walked 2N times and the object at offset 0 to receive N spurious release operations. This corrupts binder reference accounting, can produce premature BR_RELEASE notifications to object owners, and may lead to use-after-free conditions enabling privilege escalation or kernel instability. No public exploit and no CISA KEV listing identified at time of analysis; EPSS is 0.21%.
An integer truncation vulnerability in the Linux kernel's FPGA DFL-AFU driver allows a local attacker with low privileges to trigger memory corruption by sending a crafted DMA map ioctl. The issue arises from a missing upper bound check on a 64-bit length parameter from userspace, leading to an undersized pin of memory pages and potential out-of-bounds access. This can result in privilege escalation to root, impacting systems with the dfl-afu module loaded. No active exploitation or public exploit code has been identified at time of analysis.
Out-of-bounds access in the Linux kernel amdgpu VCE 1 driver allows a low-privileged local attacker on systems with older AMD GPU hardware to potentially corrupt kernel memory and escalate privileges. The drm/amdgpu/vce1 driver failed to account for the firmware offset when sizing the VCPU Buffer Object, omitted alignment of stack and data offsets to the 32K TLB boundary, and lacked bounds checks ensuring firmware microcode fits reserved space - creating conditions for OOB read/write in kernel space. No public exploit code exists and EPSS stands at 0.20%, placing this in the 10th percentile for exploitation probability despite the high CVSS score.
Path traversal bypass in the Linux kernel's ksmbd SMB server allows authenticated users with write access to a share to create zero-length files or directories outside the exported share boundary. The flaw exists only when the share is configured with case-insensitive (caseless) filename handling. Patches are available; the vulnerability is not known to be actively exploited, has a low EPSS score (0.26%), and no public exploit has been identified.
Out-of-bounds read/write in the Linux kernel's ALSA virtio sound driver allows a malicious hypervisor to corrupt guest memory, potentially leading to code execution or information disclosure. Affected are Linux kernel versions with the CONFIG_SND_VIRTIO option enabled, where the driver trusts device-supplied control metadata without validation. Exploitation requires a compromised or malicious host with local access to the virtualized guest; no public exploit or active exploitation has been identified.
Local privilege escalation in the Linux kernel's ARM FFA firmware interface allows an unprivileged local attacker to achieve arbitrary code execution by triggering an out-of-bounds write when processing PARTITION_INFO_GET descriptors. The kernel fails to validate firmware-supplied indices, enabling a heap buffer overflow that can corrupt memory. Patches are available, no public exploit exists, and EPSS indicates low exploitation probability (0.21%).
Heap-based information disclosure and denial of service in the Linux kernel's mac80211 WiFi subsystem can be triggered by adjacent network attackers. The vulnerability arises from incorrect pointer usage during MLE defragmentation, potentially leading to kernel heap memory over-read and exposure of sensitive data, as well as system crashes. Affected kernels from version 6.9 are vulnerable until patched; no public exploit is known and EPSS indicates a low exploitation probability (0.21%).
Session key corruption in the Linux kernel's ksmbd SMB server allows a network attacker to overwrite an existing session's NTLMv2 session key (`sess->sess_key`) despite a failed authentication attempt. The flaw lies in the SMB3 multichannel binding path: `ksmbd_auth_ntlmv2()` derives the base session key into `sess->sess_key` before verifying the NTLMv2 proof, and the binding session error path does not expire the binding session, so a crafted SESSION_SETUP with a bad NT proof plus KEY_XCH arc4_crypt payload corrupts the live session key before `STATUS_LOGON_FAILURE` is returned. No public exploit has been identified at time of analysis; EPSS is 0.25% (16th percentile), consistent with a race-and-config-gated server-side flaw.
Out-of-bounds read in the Linux kernel's CIFS client during SMB2 message validation allows an unauthenticated remote attacker acting as a malicious server to leak kernel memory and crash the client before session authentication. The vulnerability, which affects the smb2_check_message() function, can be triggered during NEGOTIATE or SESSION_SETUP exchanges. No active exploitation has been reported, and the EPSS probability is low (0.22%).