Out-of-bounds memory write in the Linux kernel's legacy NTFS driver allows a local attacker with filesystem mount privileges to corrupt kernel heap memory via a crafted NTFS image. The flaw lives in `ntfs_icx_ib_sync_write()`, which unconditionally calls `post_write_mst_fixup()` even when `pre_write_mst_fixup()` has already rejected the index block as invalid - the caller does not distinguish between I/O errors and validation failures. By manipulating `usa_ofs` or `usa_count` fields in the NTFS index block, an attacker can drive both slab-out-of-bounds reads and writes into the kernel, as confirmed by KASAN traces in the bug report. No public exploit or CISA KEV listing exists; EPSS is 0.20%.
Silent ownership update failure in the Linux kernel's SMB/CIFS client allows local users mounting SMB3 shares with POSIX Extensions to have chown/chgrp operations silently dropped by the kernel unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID flags are also explicitly set. The root cause is a missing posix_extensions check in cifs_setattr_nounix() that prevented id_mode_to_cifs_acl() from being invoked to relay ownership changes to the server. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% (10th percentile) reflects low exploitation likelihood for what is primarily a logic/correctness defect.
Memory-safety out-of-bounds read in the virtio-rng driver of the Linux kernel allows a malicious or buggy hypervisor to leak adjacent slab memory into the guest’s hardware random number stream, potentially exposing kernel heap data. The flaw triggers automatically at device probe without guest user interaction, and while no active exploitation has been observed, the fix is a hardening priority for confidential computing environments. The EPSS score (0.22%) suggests low near-term exploitation likelihood.
Out-of-bounds array read and missing initialization flaw in the Linux kernel's drm/hyperv virtual display driver affect Linux VMs running under Microsoft Hyper-V. A SYNTHVID_RESOLUTION_RESPONSE message carrying resolution_count exceeding 64 causes the guest kernel driver to walk past the end of the 64-entry supported_resolution[] array, potentially disclosing adjacent guest kernel heap memory to the Hyper-V host. A separate missing-initialization defect in the WIN10-to-WIN8 protocol fallback path leaves screen dimension fields at zero, causing drm_internal_framebuffer_create() to reject every userspace framebuffer with -EINVAL and effectively disabling virtual display. No public exploit exists and EPSS is 0.21%; exploitation of the OOB read requires host-level control over Hyper-V VMBus messaging.
Linux kernel real-time scheduling on non-PREEMPT_RT builds (kernel 4.1 through multiple stable branches) can be livelocked on large multi-CPU systems via the RT_PUSH_IPI mechanism. When a CPU is saturated with softirqs in hardirq context and simultaneously targeted by repeated IPIs from other CPUs attempting to pull overloaded RT tasks, the IPI flood degrades softirq performance until the CPU can never return to task context, permanently removing it from the scheduler. No public exploit exists; EPSS is 0.22% (13th percentile), and no KEV listing is present, reflecting the workload-specific nature of the condition.
Denial of service in the Linux kernel's pcrypt crypto template allows remote unauthenticated attackers to crash the system by triggering a faulty fallback path. When the parallel execution via padata fails (e.g., due to resource pressure), the pcrypt module does not restore the original callback, leading to unsafe execution of the parallel-only completion routine and kernel memory corruption. The vulnerability has a low EPSS score (0.22%, 13th percentile), no public exploit or active exploitation, and patches are available in multiple stable kernel series.
A denial-of-service flaw in the Linux kernel's NTB EPF driver can cause a kernel panic or system crash when the interrupt handler calls pci_irq_vector() in hardirq context. An attacker with local access to a system using this specialized hardware driver could trigger the issue. At the time of analysis, no public exploit or active exploitation has been reported, and EPSS indicates low exploitation probability (0.21%).
Unauthorized information disclosure in Linux kernel's ksmbd module allows remote unauthenticated attackers to copy arbitrary file contents on SMB shares by exploiting a missing access check on the FSCTL_DUPLICATE_EXTENTS_TO_FILE operation. Attackers with only attribute access to a source file can read its contents without requiring the FILE_READ_DATA permission. No public exploit or active exploitation has been identified, though the vulnerability is patchable via kernel updates.
Remote denial-of-service in Linux kernel netfilter allows unauthenticated attackers to crash the system by sending crafted network packets containing unreadable socket buffer fragments (e.g., from devmem TCP). Affected components include xt_u32, nfnetlink_queue, and nfnetlink_log, which mishandle the error return from sk
Persistent denial-of-service condition in the Linux kernel's svcrdma transport occurs when a remote disconnect causes server worker threads to hang indefinitely during transport shutdown, pinning resources and preventing normal teardown. Attackers can trigger this without authentication, leading to resource exhaustion and complete service unavailability for NFS-over-RDMA. No active exploitation is known, and the EPSS exploitation probability is low (0.20%).
Integer overflow in the Linux kernel's TCP networking subsystem (net/ipv4) allows a local user with network-namespace privileges to trigger an out-of-bounds read, potentially disclosing kernel memory or crashing the system. Writing a negative integer to the `net.ipv4.tcp_reordering` sysctl causes a silent type-coercion wrap when the value is copied into the `u32 tp->reordering` field, producing an enormous effective value. When `tcp_mtu_probing=2` is also active, this wrapped value overflows the `size_needed` computation in `tcp_mtu_probe()`, bypassing send-queue and window bounds checks entirely, leading to a CWE-190 integer overflow driving a subsequent out-of-bounds read. No public exploit and no KEV listing have been identified at time of analysis; EPSS is 0.23%.
Kernel memory leak in the Linux kernel's IIO event subsystem allows local attackers to read kernel memory via a race condition. A local unauthenticated attacker with low privileges can exploit a race between file descriptor installation and FIFO reset to trigger an out-of-bounds read, potentially leaking sensitive kernel data. No active exploitation or public exploit code is currently known, and the EPSS likelihood is low (0.22%).
Use-after-free in the Linux kernel's 6LoWPAN NHC handler may allow network-adjacent attackers to execute arbitrary code or trigger denial of service by sending a malformed packet. Affects kernels with 6LoWPAN support from commit 92aa7c65d295 up to the patched versions. No active exploitation or public exploit code is known; EPSS probability is low at 0.22%.
Information disclosure and denial of service in the Linux kernel's netfilter ebtables subsystem allows a local attacker with low privileges to leak kernel memory or cause a system crash. The vulnerability arises from a missing null-termination check on module names before passing them to request_module(), potentially exposing uninitialized kernel memory. No public exploit or active exploitation has been identified, and the EPSS score indicates a low probability of widespread exploitation.
Stack buffer over-read in the Linux kernel's netfilter ebtables module allows a local attacker with low privileges to read kernel stack data and potentially crash the system. When updating ebtables counters, a 32-byte user-supplied table name is passed without NUL-termination to a kernel function that uses it in a module autoload request, causing vsnprintf to read beyond the stack buffer. No active exploitation or public exploit code is known, and EPSS indicates a low exploitation probability (0.22%).
Out-of-bounds read in the Linux kernel's Bluetooth L2CAP configuration option parser allows an adjacent attacker to crash the system or leak up to 4 bytes of kernel memory. The vulnerability arises from a validate-after-use bug where an attacker-controlled option length is dereferenced before checking bounds, affecting all Bluetooth-enabled kernels prior to the fix
Improper mode masking in the Linux kernel SMB client when the modefromsid mount option is used allows a remote attacker to cause denial of service and limited integrity impact via a crafted SMB response. The vulnerability arises because parse_dacl() fails to mask server-provided mode bits to 07777, potentially setting unexpected permission bits on files. No public exploit is identified at time of analysis.
Out-of-bounds read in the Linux kernel's UDF filesystem driver allows a local low-privileged attacker to leak kernel memory or cause a denial of service by mounting a crafted UDF image with a malicious Virtual Allocation Table (VAT) header. The vulnerability resides in the udf_load_vat() function, which fails to validate the attacker-controlled VAT header length against the inode size, leading to a large out-of-bounds read index. No active exploitation or public proof-of-concept has been identified; EPSS predicts a very low exploitation probability (0.22%).
We are tasked with synthesizing data from multiple sources about CVE-2026-64318 into a comprehensive analysis, returning a JSON object with specified fields. Let's carefully parse the provided information. CVE-2026-64318: In the Linux kernel, a vulnerability in the AIX partition handling. The description: "aix_partition() reads the physical volume descriptor... pp_count is unvalidated, so a crafted AIX image with pp_count > 1016 drives an out-of-bounds read... bound the scan to array size." From description: - Product: Linux kernel, specifically the partition handling for AIX disks (block/partitions/aix.c). So product_name: "Linux Kernel". - CVSS Score: 7.1, Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - CWE: N/A - EPSS: 0.22% (percentile 13%) - Patch: Available from vendor - Tags: Linux, IBM, Information Disclosure - KEV status: not mentioned (likely not KEV). POC? Not mentioned. So no active exploitation or public exploit identified from data. - CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (but note: Linux kernel is typically "o:linux:linux_kernel", but given as "a" application? The data says "cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*". We'll use it as is, but product_name Linux kernel is correct.) - Affected versions: We have a list of git commit ranges and patches. We can extract the fix versions: mention specific stable versions patched: 7.1.4, 6.18.39, 5.15.212, 5.10.261, 7.2-rc1, 6.6.145, 6.12.96, 6.1.178, and the initial commit from 3.11. So the vulnerability was introduced long ago (Linux 3.11) and fixed in multiple stable branches. The description mentions "Linux 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 < ..." which is the commit that fixed it? Possibly the fix commit. The EUVD entries give commit ranges where the vulnerability exists. We'll synthesize: Affected: Linux kernel versions from 3.11 up to before the fix in the 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1, 7.2 series. So we can say "Linux kernel versions prior to the patched releases: 5.10.261, 5.1
Information disclosure in the Linux kernel's isofs filesystem driver allows a local attacker to leak up to 255 bytes of kernel heap memory to userspace by mounting a crafted ISO 9660 image. Because
Out-of-bounds slab read in the Linux kernel tracing subsystem allows a local attacker with access to the trace event filter interface to leak kernel slab memory or crash the kernel. The flaw exists because `regex_match_glob()` ignores the bounded length passed by filter predicate functions and calls the NUL-terminated-string-only `glob_match()`, which scans past the end of non-NUL-terminated dynamic string fields - exemplified by XFS namespace tracepoints whose dynamic char arrays are copied without a trailing NUL. EPSS is 0.22% (13th percentile); no public exploit code exists and the vulnerability is not listed in CISA KEV.
Unauthorized file truncation in the Linux kernel's NFSv4 client allows local attackers to bypass write permission checks when opening a file with O_RDONLY|O_TRUNC. By exploiting a missing MAY_WRITE permission mask during cached delegated opens, an attacker without write access can truncate files, causing data loss. No public exploit or active exploitation has been identified, and EPSS indicates a 0.22% exploitation probability.
Uninitialized memory read in the Linux kernel's PF_KEY IPComp implementation allows local unprivileged users to disclose kernel memory or cause a denial of service. The vulnerability arises from a missing initialization of the alg_key_len field in the xfrm_algo structure when adding IPComp security associations, leading to an out-of-bounds slab read during XFRM state migration. Affected are all Linux kernels since version 2.6.21, with patches backported to multiple stable series.
Out-of-bounds memory read in the Linux kernel's btnxpuart Bluetooth driver exposes kernel memory to a malicious or compromised NXP Bluetooth UART controller. The vulnerability exists in nxp_recv_fw_req_v3(), which handles firmware download requests during v3 controller initialization: when the controller supplies a crafted 32-bit offset or 16-bit length value that pushes past the end of the firmware image, the driver reads arbitrary kernel memory and transmits it back to the controller over UART. The parallel v1 path (nxp_recv_fw_req_v1()) already contained the equivalent bounds check; the v3 path lacked it. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.21% (11th percentile), consistent with the narrow local/hardware attack surface.
Incomplete dirty-page tracking in KVM's VMX fastpath userspace exit handling can lead to data corruption or availability loss in virtual machines. A local attacker with low privileges and the ability to run a KVM guest can trigger missed guest memory dirty markings, causing integrity and availability impacts on the host. No active exploitation is known, but vendor patches are available.
Improper handling of SPI chip select and bus locking in the Linux kernel's ad_sigma_delta IIO ADC driver allows a local attacker with low privileges to leave the SPI bus in an inconsistent state. This can cause denial of service through bus contention and potential data corruption. Affected kernels include versions before specific stable patches (e.g., 6.14, 7.2-rc1), with no known active exploitation but a low EPSS score indicating minor real-world risk.
Slab out-of-bounds read in the Linux kernel usbio USB driver (drivers/usb/misc/usbio) leaks adjacent kernel heap memory to local unprivileged processes via the i2c subsystem. The flaw lies in usbio_bulk_msg(), which validates the device-supplied payload length against the TX buffer size rather than the smaller RX buffer size, allowing a malicious USB device with mismatched endpoint wMaxPacketSize values to drive memcpy() past the end of the rxbuf slab object. Over-read kernel heap bytes propagate through the i2c layer to userspace via i2c-dev, and under KASAN-enabled kernels the bug is reported as a slab-out-of-bounds crash. No public exploit has been identified at time of analysis; the bug was found by code review and confirmed with a userspace AddressSanitizer model and a USB raw-gadget plus dummy_hcd kernel reproducer.
Use-after-free vulnerability in the Linux kernel's ACPI NFIT driver allows a local attacker with low privileges to trigger a Machine Check Exception, leading to a dangling pointer dereference that can cause memory corruption, privilege escalation, or denial of service. Affected are kernel versions from commit a61fe6f7902ec (4.6-rc1) up
Use-after-free in the Linux kernel's cros_ec driver enables a local low-privileged attacker to potentially escalate privileges or compromise system integrity on devices with ChromeOS Embedded Controller hardware. The flaw stems from dev_set_drvdata() being called too early in ec_device_probe(), allowing sub-drivers like cros_ec_typec to access a stale pointer after probe failure. No public exploit code or active exploitation has been identified, and EPSS is low (0.22%).
Memory corruption in the Linux kernel's netfilter ebtables module can occur from an uninitialized pointer free during chainstack array cleanup. The flaw is triggered only under rare, non-default conditions—a sparse CPU possible mask and a failed memory allocation—making real-world exploitation extremely unlikely. No active exploitation or public exploit is known.
Information disclosure in the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver can expose cryptographic key material via debug logs when CONFIG_DYNAMIC_DEBUG is enabled. A local attacker with low privileges could capture hex dumps of keys from kernel ring buffer, leading to full compromise of confidentiality, integrity, and availability. Patches are available in multiple stable kernel branches; no active exploitation or public exploit code has been identified.
Integer overflow in the Linux kernel's KVM guest_memfd memslot binding logic allows a local attacker with low privileges to bypass a critical bounds check, potentially enabling memory corruption with high confidentiality, integrity, and availability impact. The flaw, introduced because offset and size were stored as signed loff_t rather than unsigned uoff_t values, causes the sum of a large positive offset and a valid size to silently wrap into a negative 64-bit value, which always satisfies the less-than comparison against the positive inode size. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low at 0.22% (13th percentile), but successful exploitation on an affected KVM host or guest would be severe.
Out-of-bounds array access in the Linux kernel PCI SR-IOV subsystem crashes the kernel when a GPU or other PCIe device becomes unresponsive during a power-state restore. Inside `sriov_restore_vf_rebar_state()` (drivers/pci/iov.c:948), if the VF Resizable BAR Control register returns PCI_ERROR_RESPONSE (0xffffffff), the 3-bit `nbars` and `bar_idx` fields both evaluate to 7, which exceeds the `barsz[]` array bound of 6 (PCI_SRIOV_NUM_BARS), triggering a UBSAN array-index-out-of-bounds kernel crash. Observed in production on NVIDIA RTX PRO 1000 (GB207GLM) hardware during a failed GC6 power-state exit; no public exploit code identified at time of analysis.
Userspace ACL isolation is defeated in Zephyr RTOS v2.0.0 through v4.4.0 on SMP builds due to a missing spinlock in thread_idx_alloc(), allowing two concurrently executing user-mode threads to receive the same permission-index (tidx) and subsequently alias each other's ACL bit across every kernel object. Any kernel object access grant intended exclusively for one thread is silently extended to the aliasing thread, nullifying the CONFIG_USERSPACE isolation model. No public exploit or active exploitation (CISA KEV) is known at time of analysis, and SSVC marks automatable: no, but the technical impact is assessed as total, warranting prioritized patching for affected SMP deployments.