Local denial of service in the Linux kernel UDF filesystem allows an unprivileged local user to panic the system by truncating a file on a crafted UDF media. On desktop systems where polkit permits unprivileged mounting of removable media, an attacker can trigger this reliably. The vulnerability has public patches with exact fixed versions and a low EPSS exploitation probability (0.21%).
Local privilege escalation in the Linux kernel’s cs35l41_hda audio driver allows a low-privileged user to corrupt kernel memory and execute arbitrary code. The flaw arises when firmware autostart is disabled and a firmware load work item is queued, then
Elevation of privilege in the Linux kernel's tcpci_rt1711h USB Type-C port controller driver allows a local attacker with low privileges to potentially achieve full system compromise. The driver fails to unregister the TCPCI port when an interrupt request or alert enable step fails during device probe, leaving a stale resource that can be exploited for code execution. No active exploitation or public exploit code is known; EPSS probability is low (0.21%).
Use-after-free in the Linux kernel Bluetooth MGMT subsystem allows a local attacker with low privileges to trigger kernel memory corruption via a race condition between add_device and remove_device operations. The flaw exists in add_device_complete(), which dereferences a hci_conn_params pointer without holding hci_dev_lock, while a concurrent MGMT_OP_REMOVE_DEVICE path frees the same object under that lock. KASAN confirms exploitation as slab-use-after-free; no public exploit or active exploitation (CISA KEV) has been identified, and patches have been released across multiple stable branches.
Use-after-free memory corruption in the Linux kernel's netpoll subsystem allows a local attacker or concurrent kernel path to access freed memory during the netpoll shutdown sequence. The flaw exists because cancel_delayed_work() - called from softirq context during __netpoll_cleanup() - does not block until the TX worker finishes, permitting queue_process() to dereference a kfree'd npinfo struct via container_of(). KASAN confirms the UAF; patches are available across multiple stable kernel branches, and no public exploit or KEV listing exists at time of analysis.
Use-after-free memory corruption in the Linux kernel's NXP i.MX8 ISI (Image Sensing Interface) media driver is triggered during module removal (rmmod of imx8_isi), confirmed by KASAN slab-use-after-free reports. The root cause is an incorrect teardown order in mxc_isi_remove(): the crossbar cleanup frees media entity pads before the V4L2 cleanup has finished removing media links that reference those same pads, resulting in a dangling pointer dereference in __media_entity_remove_link(). No public exploit has been identified at time of analysis, and with EPSS at 0.21% (11th percentile), real-world weaponization appears unlikely despite the CVSS 7.8 score.
A race condition in the Linux kernel's shrinker subsystem can cause use-after-free or double-free memory errors during memory cgroup creation and teardown. Local attackers with low privileges may exploit this to escalate privileges to kernel level, leading to full system compromise (confidentiality, integrity, and availability impact). Patches are available in multiple stable kernel branches; no active exploitation is reported (CISA KEV not listed), and the EPSS exploitation probability is low (0.21%).
Out-of-bounds write in the Linux kernel's CoreSight ultrasoc-smb driver when used as a perf AUX sink allows a local attacker to elevate privileges. The vulnerability arises from improper page index normalization in smb_sync_perf_buffer(), leading to a heap buffer overflow. Although no active exploitation or public proof-of-concept is known, the weakness has been patched upstream and carries an EPSS score of 0.21%.
Double-free memory corruption in the Linux kernel's Qualcomm CPU frequency hardware driver (qcom-cpufreq-hw) allows a local low-privileged attacker on Qualcomm SoC-based systems to trigger kernel heap corruption, potentially escalating privileges to root. The flaw originates in qcom_cpufreq_hw_cpu_exit(), which incorrectly calls kfree() on memory allocated via devm_kzalloc() - memory already tracked by the kernel's device resource management (devres) system. This results in a double-free when the platform device is subsequently detached and devres performs its own cleanup. No public exploit code exists and EPSS is low (0.21%), consistent with a static-analysis discovery rather than active exploitation.
Arbitrary code execution in the Linux kernel's BPF BTF parser allows local privilege escalation. Malformed BTF data can cause an integer overflow in the repeated field count calculation, bypassing a capacity check and leading to a heap buffer overflow. With low EPSS score (0.21%), widespread exploitation is currently unlikely, but unprivileged local users who can load BPF programs are at risk of complete system compromise.
Use-after-free and list corruption in the Linux kernel's Intel QuickAssist Technology (QAT) crypto driver allows a local low-privileged attacker to trigger kernel memory corruption by racing concurrent service registration and device lifecycle operations. The crypto/qat subsystem's service_table linked list is guarded by service_lock only during insertions and deletions, but seven device-state functions iterate the list unprotected, enabling a concurrent adf_service_register() or adf_service_unregister() call to mutate the list mid-traversal. Exploiting this race can result in kernel crash, arbitrary kernel memory read, or local privilege escalation to root. No public exploit code has been identified and EPSS stands at 0.21% (11th percentile), but the impact class is high for systems running QAT-capable Intel hardware.
Touch event indexing in the Linux kernel mms114 driver misaligns reads for MMS134S and MMS136 controllers, which pack events at 6-byte intervals while the driver iterates at 8-byte struct offsets. On systems physically equipped with these MELFAS touch controllers, a locally privileged attacker can trigger multi-touch input processing that causes the driver to read kernel memory from incorrect offsets, potentially exposing sensitive data or corrupting kernel state. No public exploit or active exploitation has been identified; EPSS stands at 0.21%, reflecting negligible widespread exploitation risk at time of analysis.
Stack out-of-bounds write in the Linux kernel's mms114 touchscreen driver allows a physically-positioned attacker with access to the I2C bus - or the ability to substitute a malicious or counterfeit controller - to overwrite the IRQ-thread stack, corrupting the stack canary, saved registers, and return address for potential kernel-level code execution. Affected systems include Linux kernel builds from version 3.6 onward that load the mms114 driver on hardware incorporating the Melfas MMS114 touchscreen controller. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at just 0.21%, consistent with the narrow hardware-specific attack surface.
Local privilege escalation in the Linux kernel FUSE subsystem allows a low-privileged attacker to corrupt kernel memory
Heap corruption in the Linux kernel's IIO ad_sigma_delta driver allows a local attacker with low privileges to overflow the kernel heap, potentially achieving privilege escalation or causing denial of service. The flaw stems from improper handling of registerless sigma‑delta ADC devices when no ready GPIO is assigned and the reset clock count is zero. EPSS modelling indicates low exploitation likelihood (0.21%), and no active exploitation is reported; patches are available from the vendor.
The user asks for a comprehensive JSON analysis of CVE-2026-64485. I need to synthesize data from the provided sources. Let's examine the input carefully. CVE ID: CVE-2026-64485 Description: In the Linux kernel, ALSA: compress: Fix task creation error unwind. It details a resource leak when snd_compr_task_new() allocates driver task, and if subsequent steps fail, task_free() callback is not called, leaking driver resources. Also, an error in file descriptor allocation may not be reported correctly, leading to incorrect success reporting. CVSS: 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE: N/A EPSS: 0.21% (11th percentile) Patch: Available from vendor Reported by: Linux CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* Tags: Information Disclosure, Linux ENISA EUVD ID: EUVD-2026-48829 Affected versions (EUVD): a list of commit hashes and kernel versions. The patch refs are three git.kernel.org links. Now, I need to generate all fields as plain text strings. I'll go through each field requirement. product_name: "Linux kernel" (or "Linux Kernel"? The requirement: 1-3 words ONLY. The CVE is in the Linux kernel, specifically the ALSA compress subsystem. So "Linux Kernel" is appropriate. summary: Must be an original synthesis, 2-3 sentences. Not copying description. Start with specific impact verb and product. So: "Local privilege escalation in the Linux kernel's ALSA compress driver subsystem allows a local authenticated attacker to trigger a resource leak and potentially escalate privileges due to improper cleanup when creating an audio compress task. The vulnerability affects Linux kernels with the snd-compress module (versions as specified), and can lead to memory leaks and denial of service or arbitrary code execution. Although no public exploit is identified at time of analysis, the issue is addressed in upstream patches." I'll incorporate that the vulnerability leads to resource leak and eventually could lead to other issues. But the description doesn't explicitly men
Use-after-free in the Linux kernel's usbio (USB I/O bridge) driver allows a local, low-privileged attacker to corrupt kernel slab memory during USB device disconnect, potentially achieving privilege escalation or triggering a kernel panic. The bug lies in usbio_disconnect(), which iterates the client list in reverse using list_for_each_entry_reverse() - a macro that reads client->link.prev after the loop body, but auxiliary_device_uninit() can free the current client before that read, dereferencing freed slab memory. Patches are confirmed in Linux stable branches 6.18.39, 7.1.4, and 7.2-rc3; no public exploit or active exploitation is identified at time of analysis.
Double-free and use-after-free memory corruption flaws in the Linux kernel's staging Intel IPU7 media driver allow a local low-privileged user to corrupt kernel heap memory during driver initialization error paths. Two functions - ipu7_isys_init() and ipu7_psys_init() - incorrectly call kfree(pdata) after device teardown has already freed the same allocation via the ipu7_bus_release() reference-count path, producing a CWE-415 double-free. A concurrent use-after-free also occurs when ERR_CAST() dereferences the already-freed adev pointer before the function returns. No public exploit code exists and exploitation probability is low (EPSS 0.21%), but the C:H/I:H/A:H impact reflects the theoretical kernel code execution or crash potential.
Use-after-free in the Linux kernel USB iowarrior driver allows a local unprivileged user to corrupt kernel memory when a USB device disconnect races with a file release operation. The root cause is that mutex_unlock() is documented as non-atomic and may access the mutex structure after releasing the lock, meaning the driver data object can be freed while mutex_unlock() is still executing. An attacker who can trigger the race - by opening the iowarrior device and simultaneously provoking a USB disconnect - may achieve kernel memory corruption leading to privilege escalation. No public exploit code exists and EPSS is low (0.21%), but the impact class is standard kernel UAF.
Use-after-free and missing forward security in the loongson-rng crypto driver of the Linux kernel allow a local, low-privilege attacker to corrupt memory and potentially execute arbitrary code, compromise system integrity, or read sensitive information. Affected systems are primarily Loongson-based machines running kernels between v6.18 and the respective fix versions; the driver itself is unused by any in‑kernel consumer and is being removed entirely rather than patched. No active exploitation or public exploit code is known, and the EPSS exploitation probability is low (0.21%).
Page use-after-free in the Linux kernel perf/aux subsystem allows a local authenticated attacker to read or write freed kernel memory, potentially achieving privilege escalation. The flaw arises because map_range() accesses rb->aux_pages[], rb->aux_nr_pages, and rb->aux_pgoff while holding only the per-event mmap_mutex, whereas those fields are serialised by the ring-buffer-level rb->aux_mutex; two events sharing one ring buffer via PERF_EVENT_IOC_SET_OUTPUT can therefore race rb_alloc_aux() against map_range(), leaving a VM_PFNMAP mapping pointing to a freed physical frame. No public exploit has been identified at time of analysis, and EPSS exploitation probability is very low at 0.21% (11th percentile).
We are tasked to synthesize a comprehensive analysis for CVE-2026-64293. Need to output JSON. Given data: - CVE ID: CVE-2026-64293 - Description: long description about iommufd veventq read bug with sizeof(hdr) vs sizeof(*hdr). On 32-bit, under-counts header size, leading to buffer overflow past user-supplied buffer. - CVSS: 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CWE: N/A (but we can infer CWE-131: Incorrect Calculation of Buffer Size? Or maybe CWE-682: Incorrect Calculation? Not given.) - EPSS: 0.21% (percentile 11%) — low exploitation probability. - Patch: Available from vendor. - Reported by: Linux (likely Linux kernel) - CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (all versions) - Tags: Linux, Information Disclosure (though the vulnerability is actually a buffer overflow, but tags say Information Disclosure; perhaps they are generic tags, not precise) - ENISA EUVD ID: EUVD-2026-49005 - Affected versions (EUVD): weird entries: "Linux patch: 7.1.4", "Linux 6.15", "Linux patch: 0", "Linux patch: 7.2-rc1", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <be93d186ae88a92e7aa77e122d4e661fa57b1e39", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <0cdbb97a4dbd69abdd2ab998b4fbc7803d4b0b72", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <04a177f91160ee18da98f5689482cf0f589ec869", "Linux patch: 6.18.39" - Looks like commit ranges and patch references. Need to interpret. - References: three kernel git commits, NVD link, vuldb link. Analysis: Product name: Linux kernel (specifically iommufd subsystem). So product_name: "Linux Kernel". Summary: Must not copy description, write original synthesis. Buffer overflow in Linux kernel's iommufd subsystem, specifically in veventq read path due to sizeof(hdr) using pointer size instead of structure size, leading to potential memory corruption on 32-bit systems. Allowing local attackers with low privileges to gain elevated privileges or cause system compromise. CVSS 7.8 indicates local vector, low complexity, high im
Local privilege escalation in the Linux kernel's fuse-uring subsystem allows a local attacker to trigger a use-after-free condition by racing with the async stop queues function, potentially resulting in arbitrary code execution and complete system compromise. The vulnerability affects Linux kernel versions 6.14 through 6.18.x (patched in 6.18.39, 7.1.4,
A race condition in the Linux kernel's fuse-uring subsystem allows a local user to achieve privilege escalation and full system compromise. The vulnerability, triggered by concurrent operations on the queue->stopped flag outside of locking, leads to a use-after
Use-after-free in the Linux kernel’s fuse-uring subsystem allows a local authenticated attacker to escalate privileges. The race condition occurs when a malicious userspace sends a commit SQE before the kernel completes the memcpy of request data, triggering a freed fuse_req to be reused. CVSS base score is 7.8 but EPSS probability is low (0.21%), and no public exploit or active exploitation has been reported.
Out-of-bounds memory write in the Linux kernel's legacy NTFS driver allows a local attacker with filesystem mount privileges to corrupt kernel heap memory via a crafted NTFS image. The flaw lives in `ntfs_icx_ib_sync_write()`, which unconditionally calls `post_write_mst_fixup()` even when `pre_write_mst_fixup()` has already rejected the index block as invalid - the caller does not distinguish between I/O errors and validation failures. By manipulating `usa_ofs` or `usa_count` fields in the NTFS index block, an attacker can drive both slab-out-of-bounds reads and writes into the kernel, as confirmed by KASAN traces in the bug report. No public exploit or CISA KEV listing exists; EPSS is 0.20%.
Silent ownership update failure in the Linux kernel's SMB/CIFS client allows local users mounting SMB3 shares with POSIX Extensions to have chown/chgrp operations silently dropped by the kernel unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID flags are also explicitly set. The root cause is a missing posix_extensions check in cifs_setattr_nounix() that prevented id_mode_to_cifs_acl() from being invoked to relay ownership changes to the server. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% (10th percentile) reflects low exploitation likelihood for what is primarily a logic/correctness defect.
Memory-safety out-of-bounds read in the virtio-rng driver of the Linux kernel allows a malicious or buggy hypervisor to leak adjacent slab memory into the guest’s hardware random number stream, potentially exposing kernel heap data. The flaw triggers automatically at device probe without guest user interaction, and while no active exploitation has been observed, the fix is a hardening priority for confidential computing environments. The EPSS score (0.22%) suggests low near-term exploitation likelihood.
Out-of-bounds array read and missing initialization flaw in the Linux kernel's drm/hyperv virtual display driver affect Linux VMs running under Microsoft Hyper-V. A SYNTHVID_RESOLUTION_RESPONSE message carrying resolution_count exceeding 64 causes the guest kernel driver to walk past the end of the 64-entry supported_resolution[] array, potentially disclosing adjacent guest kernel heap memory to the Hyper-V host. A separate missing-initialization defect in the WIN10-to-WIN8 protocol fallback path leaves screen dimension fields at zero, causing drm_internal_framebuffer_create() to reject every userspace framebuffer with -EINVAL and effectively disabling virtual display. No public exploit exists and EPSS is 0.21%; exploitation of the OOB read requires host-level control over Hyper-V VMBus messaging.
Linux kernel real-time scheduling on non-PREEMPT_RT builds (kernel 4.1 through multiple stable branches) can be livelocked on large multi-CPU systems via the RT_PUSH_IPI mechanism. When a CPU is saturated with softirqs in hardirq context and simultaneously targeted by repeated IPIs from other CPUs attempting to pull overloaded RT tasks, the IPI flood degrades softirq performance until the CPU can never return to task context, permanently removing it from the scheduler. No public exploit exists; EPSS is 0.22% (13th percentile), and no KEV listing is present, reflecting the workload-specific nature of the condition.
Denial of service in the Linux kernel's pcrypt crypto template allows remote unauthenticated attackers to crash the system by triggering a faulty fallback path. When the parallel execution via padata fails (e.g., due to resource pressure), the pcrypt module does not restore the original callback, leading to unsafe execution of the parallel-only completion routine and kernel memory corruption. The vulnerability has a low EPSS score (0.22%, 13th percentile), no public exploit or active exploitation, and patches are available in multiple stable kernel series.
A denial-of-service flaw in the Linux kernel's NTB EPF driver can cause a kernel panic or system crash when the interrupt handler calls pci_irq_vector() in hardirq context. An attacker with local access to a system using this specialized hardware driver could trigger the issue. At the time of analysis, no public exploit or active exploitation has been reported, and EPSS indicates low exploitation probability (0.21%).
Unauthorized information disclosure in Linux kernel's ksmbd module allows remote unauthenticated attackers to copy arbitrary file contents on SMB shares by exploiting a missing access check on the FSCTL_DUPLICATE_EXTENTS_TO_FILE operation. Attackers with only attribute access to a source file can read its contents without requiring the FILE_READ_DATA permission. No public exploit or active exploitation has been identified, though the vulnerability is patchable via kernel updates.
Remote denial-of-service in Linux kernel netfilter allows unauthenticated attackers to crash the system by sending crafted network packets containing unreadable socket buffer fragments (e.g., from devmem TCP). Affected components include xt_u32, nfnetlink_queue, and nfnetlink_log, which mishandle the error return from sk
Persistent denial-of-service condition in the Linux kernel's svcrdma transport occurs when a remote disconnect causes server worker threads to hang indefinitely during transport shutdown, pinning resources and preventing normal teardown. Attackers can trigger this without authentication, leading to resource exhaustion and complete service unavailability for NFS-over-RDMA. No active exploitation is known, and the EPSS exploitation probability is low (0.20%).
Integer overflow in the Linux kernel's TCP networking subsystem (net/ipv4) allows a local user with network-namespace privileges to trigger an out-of-bounds read, potentially disclosing kernel memory or crashing the system. Writing a negative integer to the `net.ipv4.tcp_reordering` sysctl causes a silent type-coercion wrap when the value is copied into the `u32 tp->reordering` field, producing an enormous effective value. When `tcp_mtu_probing=2` is also active, this wrapped value overflows the `size_needed` computation in `tcp_mtu_probe()`, bypassing send-queue and window bounds checks entirely, leading to a CWE-190 integer overflow driving a subsequent out-of-bounds read. No public exploit and no KEV listing have been identified at time of analysis; EPSS is 0.23%.
Kernel memory leak in the Linux kernel's IIO event subsystem allows local attackers to read kernel memory via a race condition. A local unauthenticated attacker with low privileges can exploit a race between file descriptor installation and FIFO reset to trigger an out-of-bounds read, potentially leaking sensitive kernel data. No active exploitation or public exploit code is currently known, and the EPSS likelihood is low (0.22%).
Use-after-free in the Linux kernel's 6LoWPAN NHC handler may allow network-adjacent attackers to execute arbitrary code or trigger denial of service by sending a malformed packet. Affects kernels with 6LoWPAN support from commit 92aa7c65d295 up to the patched versions. No active exploitation or public exploit code is known; EPSS probability is low at 0.22%.
Information disclosure and denial of service in the Linux kernel's netfilter ebtables subsystem allows a local attacker with low privileges to leak kernel memory or cause a system crash. The vulnerability arises from a missing null-termination check on module names before passing them to request_module(), potentially exposing uninitialized kernel memory. No public exploit or active exploitation has been identified, and the EPSS score indicates a low probability of widespread exploitation.
Stack buffer over-read in the Linux kernel's netfilter ebtables module allows a local attacker with low privileges to read kernel stack data and potentially crash the system. When updating ebtables counters, a 32-byte user-supplied table name is passed without NUL-termination to a kernel function that uses it in a module autoload request, causing vsnprintf to read beyond the stack buffer. No active exploitation or public exploit code is known, and EPSS indicates a low exploitation probability (0.22%).
Out-of-bounds read in the Linux kernel's Bluetooth L2CAP configuration option parser allows an adjacent attacker to crash the system or leak up to 4 bytes of kernel memory. The vulnerability arises from a validate-after-use bug where an attacker-controlled option length is dereferenced before checking bounds, affecting all Bluetooth-enabled kernels prior to the fix
Improper mode masking in the Linux kernel SMB client when the modefromsid mount option is used allows a remote attacker to cause denial of service and limited integrity impact via a crafted SMB response. The vulnerability arises because parse_dacl() fails to mask server-provided mode bits to 07777, potentially setting unexpected permission bits on files. No public exploit is identified at time of analysis.
Out-of-bounds read in the Linux kernel's UDF filesystem driver allows a local low-privileged attacker to leak kernel memory or cause a denial of service by mounting a crafted UDF image with a malicious Virtual Allocation Table (VAT) header. The vulnerability resides in the udf_load_vat() function, which fails to validate the attacker-controlled VAT header length against the inode size, leading to a large out-of-bounds read index. No active exploitation or public proof-of-concept has been identified; EPSS predicts a very low exploitation probability (0.22%).
We are tasked with synthesizing data from multiple sources about CVE-2026-64318 into a comprehensive analysis, returning a JSON object with specified fields. Let's carefully parse the provided information. CVE-2026-64318: In the Linux kernel, a vulnerability in the AIX partition handling. The description: "aix_partition() reads the physical volume descriptor... pp_count is unvalidated, so a crafted AIX image with pp_count > 1016 drives an out-of-bounds read... bound the scan to array size." From description: - Product: Linux kernel, specifically the partition handling for AIX disks (block/partitions/aix.c). So product_name: "Linux Kernel". - CVSS Score: 7.1, Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - CWE: N/A - EPSS: 0.22% (percentile 13%) - Patch: Available from vendor - Tags: Linux, IBM, Information Disclosure - KEV status: not mentioned (likely not KEV). POC? Not mentioned. So no active exploitation or public exploit identified from data. - CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (but note: Linux kernel is typically "o:linux:linux_kernel", but given as "a" application? The data says "cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*". We'll use it as is, but product_name Linux kernel is correct.) - Affected versions: We have a list of git commit ranges and patches. We can extract the fix versions: mention specific stable versions patched: 7.1.4, 6.18.39, 5.15.212, 5.10.261, 7.2-rc1, 6.6.145, 6.12.96, 6.1.178, and the initial commit from 3.11. So the vulnerability was introduced long ago (Linux 3.11) and fixed in multiple stable branches. The description mentions "Linux 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 < ..." which is the commit that fixed it? Possibly the fix commit. The EUVD entries give commit ranges where the vulnerability exists. We'll synthesize: Affected: Linux kernel versions from 3.11 up to before the fix in the 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1, 7.2 series. So we can say "Linux kernel versions prior to the patched releases: 5.10.261, 5.1
Information disclosure in the Linux kernel's isofs filesystem driver allows a local attacker to leak up to 255 bytes of kernel heap memory to userspace by mounting a crafted ISO 9660 image. Because
Out-of-bounds slab read in the Linux kernel tracing subsystem allows a local attacker with access to the trace event filter interface to leak kernel slab memory or crash the kernel. The flaw exists because `regex_match_glob()` ignores the bounded length passed by filter predicate functions and calls the NUL-terminated-string-only `glob_match()`, which scans past the end of non-NUL-terminated dynamic string fields - exemplified by XFS namespace tracepoints whose dynamic char arrays are copied without a trailing NUL. EPSS is 0.22% (13th percentile); no public exploit code exists and the vulnerability is not listed in CISA KEV.
Unauthorized file truncation in the Linux kernel's NFSv4 client allows local attackers to bypass write permission checks when opening a file with O_RDONLY|O_TRUNC. By exploiting a missing MAY_WRITE permission mask during cached delegated opens, an attacker without write access can truncate files, causing data loss. No public exploit or active exploitation has been identified, and EPSS indicates a 0.22% exploitation probability.
Uninitialized memory read in the Linux kernel's PF_KEY IPComp implementation allows local unprivileged users to disclose kernel memory or cause a denial of service. The vulnerability arises from a missing initialization of the alg_key_len field in the xfrm_algo structure when adding IPComp security associations, leading to an out-of-bounds slab read during XFRM state migration. Affected are all Linux kernels since version 2.6.21, with patches backported to multiple stable series.
Out-of-bounds memory read in the Linux kernel's btnxpuart Bluetooth driver exposes kernel memory to a malicious or compromised NXP Bluetooth UART controller. The vulnerability exists in nxp_recv_fw_req_v3(), which handles firmware download requests during v3 controller initialization: when the controller supplies a crafted 32-bit offset or 16-bit length value that pushes past the end of the firmware image, the driver reads arbitrary kernel memory and transmits it back to the controller over UART. The parallel v1 path (nxp_recv_fw_req_v1()) already contained the equivalent bounds check; the v3 path lacked it. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.21% (11th percentile), consistent with the narrow local/hardware attack surface.
Incomplete dirty-page tracking in KVM's VMX fastpath userspace exit handling can lead to data corruption or availability loss in virtual machines. A local attacker with low privileges and the ability to run a KVM guest can trigger missed guest memory dirty markings, causing integrity and availability impacts on the host. No active exploitation is known, but vendor patches are available.