Incorrect argument passing in dwc3_ulpi_setup() causes the Linux kernel's DWC3 USB controller driver to pass a raw MMIO register pointer (dwc3->regs, typed as void __iomem *) to dwc3_readl() and dwc3_writel(), which instead expect the containing struct dwc3 * pointer. Because the register accessor functions internally dereference the struct to locate ->regs, supplying ->regs directly results in incorrect memory access during ULPI (USB Low Pin Interface) initialization - flagged by the kernel sparse checker as a type-safety violation across address spaces. The practical impact is a potential kernel panic or silent misread/miswrite of a USB control register, manifesting as an availability failure in systems using DWC3 ULPI USB controllers. No public exploit exists and the issue requires local access to trigger.
Null pointer dereference in the Linux kernel's chacha20poly1305 crypto template allows a local unprivileged user to crash the system. The flaw exists in chachapoly_create(), which passes the unvalidated return value of crypto_attr_alg_name() directly to strcmp() when the poly1305 sub-argument is absent in a malformed template string; since that function returns an ERR_PTR on failure, the subsequent strcmp() call dereferences an invalid pointer, triggering a kernel panic. Patches are available across multiple stable branches; no public exploit or active exploitation has been identified at time of analysis.
PMD-sized vmemmap pages are silently leaked in the Linux kernel's x86 memory management subsystem following a regression introduced in commit bf9e4e30f353, which replaced __free_pages() with pagetable_free() for vmemmap page freeing. Because vmemmap pages are not compound pages (outside of HVO, which does not apply here), pagetable_free() resolves compound_order() to zero and frees only the first page of a PMD-sized block, leaking the remaining pages on every memory section removal. Systems running affected kernel versions (6.18.7-6.18.38, 6.19 series through 7.1.3) that perform x86 memory hotplug operations will experience progressive physical memory loss; no public exploit has been identified and this vulnerability is not in CISA KEV.
NULL pointer dereference in the Linux kernel's `page_ext` memory iteration API crashes systems during dynamic memory hotplug operations. The `page_ext_iter_next()` function fails to enforce the PFN boundary, advancing the iterator index past `__pgcount` and calling `page_ext_lookup()` on an uninitialized memory section, triggering a kernel panic. With EPSS at 0.21% (11th percentile) and no CISA KEV listing, real-world exploitation is low-probability and operationally constrained to environments actively performing memory hotplug, such as cloud hypervisors or NUMA-heavy servers with memory ballooning.
Atomic memory reserve exhaustion in the Linux kernel's iommufd subsystem allows a local low-privileged user to trigger kernel-side memory pressure by allocating virtual event queues whose depth is fully user-controlled, potentially destabilizing the system through GFP_ATOMIC reserve depletion. The root cause is memory allocation for veventq entries occurring inside a spinlock, drawing from atomic reserves never intended for user-directed exhaustion. No active exploitation is confirmed and EPSS sits at 0.21% (11th percentile); upstream fix commits are available across the 6.18.x, 7.1.x, and 7.2-rc1 stable series.
Memory exhaustion in the Linux kernel iommufd subsystem allows a local low-privileged user to crash the system by passing an uncapped veventq_depth value to iommufd_veventq_alloc(), which previously accepted any non-zero integer up to U32_MAX without validation. Exploitation requires local access with low privileges on a system where the iommufd device is accessible, making this primarily a concern for multi-tenant or virtualization hosts. No public exploit has been identified and EPSS at 0.21% (11th percentile) reflects minimal real-world exploitation interest at time of analysis.
Infinite loop in the Linux kernel iommufd subsystem's fault read path allows a low-privileged local user to pin a CPU core at 100% utilization while holding a kernel mutex, causing a local denial of service. The flaw exists in iommufd_fault_fops_read(), where a copy_to_user() failure in the inner list traversal loop fails to propagate its error code to the outer while loop, which then re-fetches the same fault group and retries the failing operation indefinitely with fault->mutex held. No public exploit is identified at time of analysis; EPSS indicates a very low 0.21% exploitation probability, and this CVE is not listed in the CISA KEV catalog.
Null pointer dereference in the Linux kernel's KVM arm64 nested virtualization subsystem allows a local low-privileged attacker to crash the host kernel via a race condition in VNCR pseudo-TLB invalidation. The function kvm_invalidate_vncr_va() dereferences the VNCR pseudo-TLB pointer without first verifying allocation or validity, unlike its companion kvm_invalidate_vncr_ipa(). Exploitation results in a kernel panic that disrupts all virtual machines on the affected host; no public exploit has been identified at time of analysis, and EPSS of 0.21% (11th percentile) reflects minimal observed exploitation activity.
System hang vulnerability in the Linux kernel's NXP i.MX LPI2C driver arises from a race condition during suspend/resume power transitions. Specifically, periodic workqueues in I2C client drivers can fire I2C transfers between the suspend_noirq and resume_noirq phases, when clock and pinctrl resources have already been disabled or are not yet restored. Accessing I2C controller registers in this state causes the system to hang. The fix marks the adapter as suspended during noirq suspend, blocking transfers until hardware resources are fully restored. No public exploit or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Integer wrap in the FUSE subsystem's prune notification handler crashes 32-bit Linux kernels when a malicious or compromised FUSE daemon sends a crafted FUSE_NOTIFY_PRUNE message. On 32-bit platforms where size_t is 32 bits, multiplying a daemon-controlled count value of 0x20000000 by sizeof(u64) wraps to zero, causing the payload length check to pass with no actual nodeid data present; the subsequent copy loop then triggers a BUG_ON assertion, inducing a kernel panic. No public exploit has been identified at time of analysis and EPSS stands at 0.21% (11th percentile), consistent with the narrow exploitation window of 32-bit-only kernels and requiring FUSE daemon control.
Error-code mishandling in the Linux kernel fuse-uring subsystem causes a failed copy_from_user() in fuse_uring_commit to be silently treated as success, leaving callers processing uninitialized or partial output arguments. Local users with low-privilege access on kernels from 6.14 through pre-patch versions can trigger a kernel panic or crash, yielding a local denial of service. No public exploit has been identified and the EPSS score of 0.21% (11th percentile) indicates no meaningful active exploitation activity at time of analysis.
Kernel panic in the Linux kernel's fuse-uring subsystem allows a local low-privileged attacker to crash the system by triggering a NULL pointer dereference through crafted io_uring cancellation sequences against a FUSE filesystem. The root cause is that fuse_uring_cancel() moves cancelled entries with no attached requests to the ent_in_userspace list, where ent_list_request_expired() unconditionally dereferences ent->fuse_req, crashing the kernel. No public exploit code exists and EPSS sits at 0.21% (11th percentile), indicating negligible opportunistic exploitation pressure; however, the low privilege requirement and local DoS impact make it relevant for multi-tenant or shared-access Linux environments.
Resource exhaustion and denial of service in the Linux kernel's fuse-uring subsystem allows a local authenticated user to permanently hang FUSE requests and stall all background filesystem operations for the affected connection. The flaw was introduced with the fuse-uring interface in Linux 6.14 and affects stable series through 6.18.38 and 7.1.3; patched releases 6.18.39, 7.1.4, and mainline 7.2-rc1 are available. No public exploit has been identified at time of analysis (EPSS 0.21%, 11th percentile) and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation.
NULL pointer dereference in the Linux kernel's fuse-uring subsystem enables a local low-privilege attacker to crash the kernel, causing a denial of service. The flaw arises from a state management race in the fuse-uring request lifecycle: when a copy into a userspace io_uring ring buffer fails, the entry's request pointer is nullified but the entry remains on the active queue, allowing the expiration scanner to dereference the NULL pointer in a narrow race window. No public exploit has been identified and EPSS stands at 0.21% (11th percentile), indicating low likelihood of opportunistic exploitation.
NULL pointer dereference in the Linux kernel tracing subsystem (`func_set_flag()`) allows a local attacker with tracefs write access to trigger a kernel panic and crash the system. The flaw arises when a process holds an open file descriptor to a function tracer option (e.g., `func_stack_trace`) while a concurrent tracer switch sets `tr->current_trace_flags` to NULL; a subsequent write to that option file then dereferences the NULL pointer before the function tracer guard executes. No active exploitation (KEV) or public exploit code has been identified; EPSS is 0.20% at the 10th percentile, consistent with a localized, technically specific DoS condition.
NULL pointer dereference in the Linux kernel's hid_logitech_dj driver causes a kernel crash (DoS) when a crafted HID descriptor is processed during device probe. The flaw exists in logi_dj_probe(): when a Logitech Unifying receiver emulation presents report ID 0x20 with only padding output items, hid-core registers the report with rep->maxfield == 0. The error-path validation then dereferences rep->field[0]->report_count while printing a diagnostic message, triggering a KASAN-visible null-ptr-deref and kernel panic. No public exploit is identified at time of analysis, but the kernel commit descriptions include a full uhid-based reproduction method, lowering the barrier for local attackers.
NULL pointer dereference in the Linux kernel's mt76 driver for MediaTek mt7921/mt7925 WiFi chipsets causes a kernel panic (denial of service) via a race condition in Channel Switch Announcement (CSA) beacon processing. When a CSA beacon is received, cfg80211 queues a wiphy work item; if the station disconnects or the channel context is torn down before the work item executes, the driver's dev->new_ctx pointer is already NULL but dereferenced unconditionally in mt7921_channel_switch_rx_beacon() and mt7925_channel_switch_rx_beacon(). EPSS is 0.20% (10th percentile) and no public exploit or CISA KEV listing is identified at time of analysis.
KVM's SEV-SNP guest initialization path in the Linux kernel can trigger a host kernel panic when processing CPUID data backed by a read-only memory mapping. The flaw affects hypervisors running Linux 7.0.x before 7.1.4 where a local, low-privileged VMM process can cause KVM to write corrected CPUID values into a read-only source page after AMD's trusted firmware rejects the userspace-supplied data. No public exploit has been identified and EPSS sits at 0.20% (10th percentile), consistent with a niche, difficult-to-trigger local denial-of-service condition with no confirmed active exploitation.
Memory exhaustion in ImageMagick's magick CLI tool allows a local attacker to cause denial of service by repeatedly supplying malformed command-line arguments. Affects versions before 7.1.2-27. Vendor patch is available; no public exploit or active exploitation reported.
Null pointer dereference in the Linux kernel's cpufreq subsystem during system reboot allows a local attacker with low privileges to crash the kernel. The reboot path (kernel_restart() → device_shutdown() → cpufreq_suspend()) does not invoke freeze_processes() - unlike the normal suspend path - leaving CPU hotplug operations free to run concurrently and free governor_data while cpufreq_suspend() is still reading it, producing a use-after-free null pointer dereference. No public exploit exists and EPSS probability is 0.22% (13th percentile), placing this in low-urgency territory despite the ubiquitous kernel footprint.
KVM arm64 in the Linux kernel leaks a Page Frame Number reference when kvm_translate_vncr() races an MMU notifier, allowing a local low-privileged attacker to gradually exhaust kernel memory and cause a denial of service on affected arm64 hypervisor hosts. The vulnerability is specific to arm64 systems running KVM with VNCR (Virtualization Non-Cached Region) active, and requires precise race-condition timing (AC:H). No public exploit has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) confirms this remains a low-probability exploitation target.