Improper handling of SPI chip select and bus locking in the Linux kernel's ad_sigma_delta IIO ADC driver allows a local attacker with low privileges to leave the SPI bus in an inconsistent state. This can cause denial of service through bus contention and potential data corruption. Affected kernels include versions before specific stable patches (e.g., 6.14, 7.2-rc1), with no known active exploitation but a low EPSS score indicating minor real-world risk.
Slab out-of-bounds read in the Linux kernel usbio USB driver (drivers/usb/misc/usbio) leaks adjacent kernel heap memory to local unprivileged processes via the i2c subsystem. The flaw lies in usbio_bulk_msg(), which validates the device-supplied payload length against the TX buffer size rather than the smaller RX buffer size, allowing a malicious USB device with mismatched endpoint wMaxPacketSize values to drive memcpy() past the end of the rxbuf slab object. Over-read kernel heap bytes propagate through the i2c layer to userspace via i2c-dev, and under KASAN-enabled kernels the bug is reported as a slab-out-of-bounds crash. No public exploit has been identified at time of analysis; the bug was found by code review and confirmed with a userspace AddressSanitizer model and a USB raw-gadget plus dummy_hcd kernel reproducer.
Use-after-free vulnerability in the Linux kernel's ACPI NFIT driver allows a local attacker with low privileges to trigger a Machine Check Exception, leading to a dangling pointer dereference that can cause memory corruption, privilege escalation, or denial of service. Affected are kernel versions from commit a61fe6f7902ec (4.6-rc1) up
Use-after-free in the Linux kernel's cros_ec driver enables a local low-privileged attacker to potentially escalate privileges or compromise system integrity on devices with ChromeOS Embedded Controller hardware. The flaw stems from dev_set_drvdata() being called too early in ec_device_probe(), allowing sub-drivers like cros_ec_typec to access a stale pointer after probe failure. No public exploit code or active exploitation has been identified, and EPSS is low (0.22%).
Memory corruption in the Linux kernel's netfilter ebtables module can occur from an uninitialized pointer free during chainstack array cleanup. The flaw is triggered only under rare, non-default conditions—a sparse CPU possible mask and a failed memory allocation—making real-world exploitation extremely unlikely. No active exploitation or public exploit is known.
Information disclosure in the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver can expose cryptographic key material via debug logs when CONFIG_DYNAMIC_DEBUG is enabled. A local attacker with low privileges could capture hex dumps of keys from kernel ring buffer, leading to full compromise of confidentiality, integrity, and availability. Patches are available in multiple stable kernel branches; no active exploitation or public exploit code has been identified.
Integer overflow in the Linux kernel's KVM guest_memfd memslot binding logic allows a local attacker with low privileges to bypass a critical bounds check, potentially enabling memory corruption with high confidentiality, integrity, and availability impact. The flaw, introduced because offset and size were stored as signed loff_t rather than unsigned uoff_t values, causes the sum of a large positive offset and a valid size to silently wrap into a negative 64-bit value, which always satisfies the less-than comparison against the positive inode size. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low at 0.22% (13th percentile), but successful exploitation on an affected KVM host or guest would be severe.
Out-of-bounds array access in the Linux kernel PCI SR-IOV subsystem crashes the kernel when a GPU or other PCIe device becomes unresponsive during a power-state restore. Inside `sriov_restore_vf_rebar_state()` (drivers/pci/iov.c:948), if the VF Resizable BAR Control register returns PCI_ERROR_RESPONSE (0xffffffff), the 3-bit `nbars` and `bar_idx` fields both evaluate to 7, which exceeds the `barsz[]` array bound of 6 (PCI_SRIOV_NUM_BARS), triggering a UBSAN array-index-out-of-bounds kernel crash. Observed in production on NVIDIA RTX PRO 1000 (GB207GLM) hardware during a failed GC6 power-state exit; no public exploit code identified at time of analysis.
Userspace ACL isolation is defeated in Zephyr RTOS v2.0.0 through v4.4.0 on SMP builds due to a missing spinlock in thread_idx_alloc(), allowing two concurrently executing user-mode threads to receive the same permission-index (tidx) and subsequently alias each other's ACL bit across every kernel object. Any kernel object access grant intended exclusively for one thread is silently extended to the aliasing thread, nullifying the CONFIG_USERSPACE isolation model. No public exploit or active exploitation (CISA KEV) is known at time of analysis, and SSVC marks automatable: no, but the technical impact is assessed as total, warranting prioritized patching for affected SMP deployments.
Authenticated directory traversal in Checkout Field Editor Pro for WooCommerce up to 3.7.7 enables subscriber-level attackers to read arbitrary server files. Exploitation leverages the 'thwcfe_legacy_file' parameter. No active exploitation or public exploit code is currently known, and EPSS indicates low exploitation probability.
Stored Cross-Site Scripting in the Yoast SEO WordPress plugin (all versions through 28.0) allows authenticated attackers holding author-level accounts or higher to inject persistent JavaScript via a crafted post slug (post_name field) that executes in the browsers of any user who later visits the affected page. The vulnerability traces to insufficient sanitization in the bulk-editor list table (class-bulk-editor-list-table.php, lines 898-900) combined with get_permalink() embedding the stored percent-encoded post_name in generated URLs without adequate escaping. No confirmed active exploitation (no CISA KEV listing) and no public exploit code has been identified at time of analysis, though the scope-changed CVSS vector (S:C) reflects cross-user browser impact consistent with a medium-priority persistent XSS.
Out-of-bounds read in the Linux kernel's Samsung Kalmia USB network driver allows a malicious USB device to crash the kernel via a u16 integer underflow in `kalmia_rx_fixup()`. When a crafted bulk-IN frame is 6-11 bytes long, the subtraction `skb->len - 12` underflows to approximately 65,530, bypassing length validation and causing `memcmp()`, `skb_trim()`, and `skb_pull()` to operate past the end of the 14,000-byte RX buffer. No public exploit or active exploitation (CISA KEV) has been identified; EPSS at 0.23% (14th percentile) confirms minimal exploitation interest.
Denial of service via infinite exception loop in the Linux kernel's s390 architecture affects systems running IBM Secure Execution (Ultravisor) workloads on kernel versions 6.7 through the patched releases. When load_unaligned_zeropad() reads across a page boundary where the adjacent page has been donated to the Ultravisor, the do_secure_storage_access() exception handler cannot resolve the fault and enters an unresolvable loop, permanently hanging the affected execution context. Patched in upstream versions 6.12.97, 7.1.4, and 7.2-rc1 via reversion of DCACHE_WORD_ACCESS support on s390; no public exploit or active exploitation is confirmed at time of analysis.
Denial of service in the Linux kernel's AMD CCP/SEV driver allows a local low-privileged process to crash a KVM hypervisor host by submitting SEV firmware ioctls to /dev/sev, which incorrectly triggers SNP initialization and zeroes the MSR_VM_HSAVE_PA register, causing a general protection fault on the next VMRUN and terminating all running virtual machines. Affected kernels span from the introducing commit (ceac7fb89e8da465aec3ac3c20477f912f5c3a6c) through the fixed stable releases 6.12.96, 6.18.39, and 7.1.4. No public exploit has been identified and EPSS is 0.22%, but the blast radius - crashing the host and all its tenant VMs - warrants prompt patching on AMD EPYC KVM deployments.
Crash of a Linux KVM host is achievable by a local low-privileged user via the /dev/sev ioctl interface on systems running AMD SEV-SNP firmware. When SNP_COMMIT is issued after a prior failed SEV initialization, the crypto/ccp driver incorrectly proceeds with SNP initialization, zeroing out MSR_VM_HSAVE_PA - the model-specific register holding the AMD SVM host save-area pointer. Any subsequent VMRUN instruction by KVM for an already-running VM will generate a General Protection Fault, crashing the host and terminating all guest workloads. No public exploit has been identified at time of analysis; patch commits are available across multiple stable branches.
Uncontrolled SNP initialization in the Linux kernel's CCP/SEV driver allows a local low-privileged user with /dev/sev access to crash the host kernel on AMD SEV/SNP-capable systems running KVM. Sending a SNP_VLEK_LOAD ioctl when SNP has not been initialized triggers an unnecessary initialization/shutdown wrapper that zeros MSR_VM_HSAVE_PA globally; the subsequent VMRUN instruction for any active KVM guest then triggers a General Protection Fault, bringing down the host and terminating all co-hosted VMs. No public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects the specialized attack environment required.
Host crash vulnerability in the Linux kernel's AMD SEV/SNP subsystem allows a local low-privileged user to take down a virtualization host by triggering SNP re-initialization via the `/dev/sev` `SNP_CONFIG` ioctl when SNP has previously failed to initialize. When re-initialization executes while KVM guests are running, it zeroes `MSR_VM_HSAVE_PA` globally across all CPUs; the next VMRUN instruction on any active guest then raises a General Protection Fault, crashing the host kernel and terminating all hosted VMs. No public exploit identified at time of analysis; EPSS is 0.22% at the 13th percentile, consistent with low opportunistic exploitation probability.
Memory exhaustion in the Linux kernel XFS quota subsystem can be triggered by a local low-privilege user on systems mounting metadir XFS images with user quota enabled. The vulnerability exists in xfs_dqinode_metadir_create(), where failure of xfs_metadir_create() returns without releasing the allocated update and transaction state, and commit failures leave behind caller-owned inode references. Confirmed present from Linux 6.13-rc1 through v7.1.1; patched in stable releases 6.18.39 and 7.1.4.
Kernel crash (availability loss) in the Linux gpio/eic-sprd Spreadtrum EIC GPIO driver affects systems running PREEMPT_RT kernels with Unisoc/Spreadtrum SoCs. The IRQ startup path - request_threaded_irq() → irq_startup() → sprd_eic_irq_unmask() - calls sprd_eic_update(), which acquires a regular spinlock_t via spin_lock_irqsave(). On PREEMPT_RT kernels, spinlock_t is a sleeping lock; sleeping in a non-sleepable IRQ-disabled context triggers a kernel BUG: 'sleeping function called from invalid context', crashing the system. No public exploit has been identified at time of analysis; patches are available across all maintained stable branches.
Availability impact in the Linux kernel's io_uring work queue (io-wq) subsystem allows a local, low-privileged user to cause an extended hang during io_uring ring closure. The root cause is a race condition in io_worker_handle_work(): the IO_WQ_BIT_EXIT check is snapshotted once before processing a linked-work chain, so if io_wq_exit_start() fires mid-chain, remaining linked items execute with a stale do_kill=false, skip IO_WQ_WORK_CANCEL, and continue running after exit has been initiated. No public exploit is identified at time of analysis; the issue was surfaced by syzbot using slow MSR-device reads with linked work chains and immediate ring close.
Kernel denial-of-service via missing exec_update_lock protection in six Linux procfs functions affects all Linux deployments running kernel 2.6.30 through multiple current stable branches. When a low-privileged local user reads specific /proc entries (stat, map_files, ns symlinks) concurrently with an execve() call in the target process, the missing lock allows ptrace_may_access() to observe transiently invalid credential or memory-map state, triggering a kernel crash. No public exploit identified at time of analysis; EPSS is 0.22% (13th percentile), consistent with low near-term automated exploitation probability.
Resource reference leak in the Linux kernel's POSIX CPU timer subsystem allows a local unprivileged user to exhaust kernel pid references and cause a local denial of service. The flaw exists in `do_cpu_nanosleep()` across all stable kernel branches from 2.6.12 onward: when `posix_cpu_timer_set()` returns an error, the pid reference acquired by the preceding `posix_cpu_timer_create()` call is never released. No public exploit code exists and EPSS sits at 0.22%, consistent with a kernel stability regression fix rather than an actively targeted security flaw.
Uninitialized stack memory use in the Linux kernel HFS and HFS+ filesystem drivers allows a local user to crash the kernel by mounting a crafted filesystem image. Two early-exit paths in `hfs_bnode_read()` - an invalid offset check and a corrected-to-zero length - skip the buffer write, while downstream callers such as `hfs_bnode_read_u16()` and `hfs_bnode_read_u8()` consume the uninitialized stack buffer unconditionally, producing KMSAN uninit-value reports and risking kernel panics. Patches are available across multiple stable kernel branches; no public exploit exists and EPSS is very low at 0.22%.
Hung-task denial-of-service in the Linux kernel's nilfs2 filesystem allows a local low-privileged user to indefinitely stall concurrent filesystem operations by supplying out-of-range segment numbers to the NILFS_IOCTL_CLEAN_SEGMENTS ioctl. Because input validation was deferred deep inside the call chain to nilfs_sufile_updatev() - which emits one printk warning per invalid entry while holding ns_segctor_sem write-locked - repeated invocations saturate the global printk path and keep the semaphore held long enough to block all readers, including routine operations such as chmod(). No public exploit has been identified and EPSS is very low (0.22%, 13th percentile), consistent with a local kernel DoS requiring filesystem access.
Kernel denial-of-service in the Linux USB gadget composite driver crashes the system by triggering a KASAN memory fault in the USB_DT_OTG request handler when the configuration list is empty. The flaw exists because list_first_entry() never returns NULL - making the subsequent config NULL-check dead code - so when cdev->configs is empty during a gadget unbind race or when a driver sets is_otg before registering any configuration, composite_setup() dereferences a garbage pointer and memcpy() copies arbitrary kernel memory into the USB response buffer. No public exploit code has been identified, and EPSS is 0.22% (13th percentile), consistent with the local, race-condition nature of the flaw.
Incomplete error-path cleanup in the Linux kernel's uss720 USB-to-parallel-port driver leaves a parport device registered after probe failure, creating a dangling stale pointer backed by freed private data. Systems where a Belkin F5U002 or similar USS720-based adapter is attached and causes get_1284_register() to fail during uss720_probe() are left with an orphaned kernel parport entry and a reserved parport slot, which can lead to a kernel crash when the stale pp->private_data pointer is later dereferenced. No active exploitation has been identified; the bug was discovered via static-analysis research, and patches are available across all major Linux stable branches.
DMA mapping leak in the Linux kernel's MTU3 USB device controller driver causes local denial-of-service on MediaTek SoC platforms. When mtu3_gadget_queue() maps a USB transfer request via DMA before checking whether the QMU GPD ring has capacity, then mtu3_prepare_transfer() fails and returns -EAGAIN, the error path bypasses the mtu3_req_complete() cleanup helper, permanently stranding the DMA mapping. Repeated exhaustion of the IOMMU aperture can destabilize or crash the kernel. No public exploit code exists and EPSS at 0.22% (13th percentile) confirms negligible exploitation interest; the impact is a local availability-only issue confined to MediaTek USB gadget hardware.
Availability loss in the Linux kernel's USB serial digi_acceleport driver allows a local user to permanently halt data reception on a Digi AccelePort serial port until the USB device is physically reconnected or the driver is rebound. The bug arises from a missing URB resubmission path: when a port is closed while in a throttled state, the read URB is never re-queued, leaving the port silently deaf to incoming data upon next open. No public exploit has been identified and EPSS sits at 0.22% (13th percentile), reflecting the niche hardware dependency and local-only attack surface.
Hard lockup in the Linux kernel's digi_acceleport USB serial driver causes full system freeze when a Digi AccelePort device is physically disconnected during active I/O. The driver's OOB (out-of-band) command path loops indefinitely with interrupts disabled upon persistent URB submission failure, resulting in a kernel hard lockup that effectively crashes the host. Systems with this specific USB-to-serial adapter are affected across a wide range of stable kernel branches from 2.6.12 onward; patches have been released across all active stable series.
Memory leak in the Linux kernel USB ULPI (Universal Serial Bus Link Interface) subsystem allows a local low-privileged user to trigger repeated ULPI device registration failures that leak kernel memory, potentially leading to system instability or denial of service. Affected kernel versions span from 4.2 through multiple pre-patch stable branches, with fixes backported to 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc3. No public exploit or active exploitation has been identified at time of analysis; the EPSS score of 0.22% (13th percentile) reflects minimal probability of weaponization.
NULL pointer dereference in the Linux kernel's usbip virtual UDC (vudc) subsystem crashes the kernel when FunctionFS AIO cancellations are processed. The `vep_alloc_request()` function never initialized `vrequest->udc`, so any AIO cancellation arriving at `vep_dequeue()` - such as one triggered by a host-side `usbip attach` - dereferences a null pointer and produces a kernel oops, denying service to the guest system. A local attacker with low privileges on a system configured for USB/IP with FunctionFS AIO endpoints can reliably reproduce this crash. No public exploit code exists, and EPSS at 0.22% (13th percentile) confirms the path has not seen meaningful exploitation despite the bug reportedly existing for approximately ten years since Linux 4.7.
Sensitive cryptographic key material handled by the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver was unconditionally emitted to the kernel ring buffer via unguarded hex-dump calls in *_setkey() and gen_split_key(), exposing raw key bytes to any local user with dmesg access on kernels built with CONFIG_DYNAMIC_DEBUG. The exposure affects NXP CAAM-equipped platforms (i.MX, QorIQ SoC families) running kernel versions from approximately 5.3 through the fix commits across all active stable branches. No public exploit code exists and EPSS probability is 0.22%, but key material disclosure on a crypto-accelerator driver carries genuine confidentiality risk that the vendor-assigned CVSS (C:N/I:N/A:H) incorrectly characterizes - the real primary impact is confidentiality loss, not availability.
Silent error propagation in the Linux kernel's CTR_DRBG implementation (`drbg_ctr_generate()`) causes the function to return a success code while leaving its output buffer uninitialized when an internal operation fails. Code that relies on the generated random material receives garbage data, which can trigger kernel crashes or hangs depending on how the uninitialized buffer is consumed downstream. No public exploit has been identified; patched stable kernel releases are available across all active longterm-support branches.
Division-by-zero and arithmetic underflow flaws in the Linux kernel's elan_i2c touchpad driver cause kernel panic during device probe on systems equipped with Elan I2C touchpad hardware. When device firmware or device tree supplies zero values for x_traces or y_traces, the driver performs an unguarded integer division by zero, crashing the kernel. A secondary arithmetic underflow causes the input subsystem to report a massively incorrect touch width value to userspace when physical device dimensions fall below a hardcoded threshold. No public exploit exists and EPSS is 0.22% (13th percentile), reflecting the hardware-specific, limited-scope nature of this flaw.
Kernel panic risk in the Linux gpio-sch driver exposes PREEMPT_RT systems with legacy Intel SCH GPIO hardware to a local denial of service. The SCH IRQ unmask callback acquires a regular spinlock inside a non-sleepable IRQ-setup context; under PREEMPT_RT, that spinlock is reimplemented as a sleeping lock, triggering a lockdep BUG and potential kernel panic. Patches are available across all active stable branches (5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.39, 7.1.4); no public exploit exists and EPSS is 0.21% (percentile 12%).
Kernel availability loss in the Linux mm/shrinker subsystem allows a local user with debugfs access to trigger a kernel BUG by reading the debugfs 'count' file of a memcg-aware shrinker such as zswap. The shrinker_debugfs_count_show() function incorrectly holds rcu_read_lock() while invoking ->count_objects() callbacks; when zswap's callback attempts to flush memcg stats via css_rstat_flush(), it sleeps inside an RCU read-side critical section - a fatal kernel invariant violation. No public exploit has been identified at time of analysis, and EPSS is very low at 0.21% (12th percentile).
Kernel panic via NULL pointer dereference in the Linux kernel's memory shrinker debugfs interface allows a local attacker to crash the system. The shrinker_debugfs_add() function unconditionally creates 'count' and 'scan' debugfs files for all registered shrinkers, but some shrinkers - notably the xen-backend shrinker - only implement one of the two required callbacks (count_objects or scan_objects). Writing to the exposed 'scan' debugfs file on such a shrinker dispatches through a NULL function pointer, triggering a kernel panic. No public exploit has been identified at time of analysis, and EPSS score of 0.21% reflects low exploitation probability. Patches are available across multiple stable kernel branches.
Denial of service in the Linux kernel btmtksdio (MediaTek Bluetooth SDIO) driver allows a local attacker with low privileges to permanently hang the Bluetooth stack by triggering an infinite loop in btmtksdio_txrx_work(). The root cause is an inverted timeout logic: a misused time_is_before_jiffies() call, combined via OR, causes the worker loop's exit condition to become unconditionally true after the 5-second timeout fires, so the loop never terminates and never releases the SDIO host. No public exploit has been identified at time of analysis; however, the bug can also trigger organically under hardware stress conditions.
NULL pointer dereference in the Linux kernel Bluetooth HCI connection handler crashes the kernel when aborting a pending connection while `hdev->sent_cmd` is NULL but `req_status` remains `HCI_REQ_PEND`. Local users with Bluetooth access can trigger a general protection fault from the `hci_rx_work()` receive path, producing a kernel panic and denying service to all users on the affected system. No public exploit has been identified and EPSS probability stands at 0.21% (12th percentile), indicating very limited real-world exploitation likelihood.
Device reference count leak in the Linux kernel's firmware_loader subsystem exposes systems to local denial-of-service conditions. Specifically, firmware_upload_register() fails to call put_device() on the fw_dev pointer when alloc_lookup_fw_priv() fails after fw_create_instance() has already called device_initialize(), leaving the embedded struct device reference count unbalanced and potentially preventing proper memory cleanup. Discovered via static analysis and confirmed by manual code review, the issue is patched across multiple stable kernel branches including 6.1.178, 6.6.145, 6.12.96, 6.18.39, and 7.1.4. No public exploit exists and no active exploitation has been observed.
Memory exhaustion in the Linux kernel's USB CDNSP host controller driver allows local users to trigger a kernel-level memory leak by forcing partial allocation failures in `cdnsp_alloc_stream_info()`. Systems running Linux 5.12 through unpatched stable branches accumulate unreleased `stream_ctx_array` allocations that are never freed, eventually causing availability impact on hosts with CDNSP USB hardware. No public exploit exists, EPSS stands at 0.21%, and the vulnerability carries no confidentiality or integrity impact per the CVSS vector.
Reference count leak in the Linux kernel USB gadget printer driver (f_printer) allows a local user to trigger a permanent kref increment on every rejected concurrent open attempt. Each call to printer_open() that returns -EBUSY still increments dev->kref, but because VFS never invokes ->release() for a failed open, the reference is never balanced. Repeated exploitation exhausts the reference counter, preventing proper driver teardown and causing availability degradation. No public exploit has been identified at time of analysis.
The keyspan_pda USB-serial driver in the Linux kernel transmits kernel memory beyond the tty write buffer to an attached USB device due to an incorrect write() return value introduced with write FIFO support. After commit 034e38e8f687, the driver returns the byte count submitted to the USB device rather than the count accepted from the caller; the TTY line discipline interprets this inflated count as authorization to advance its read pointer past the buffer boundary, exposing adjacent kernel memory. Affected stable trees span Linux 5.15 through 7.1 and the 7.2-rc3 development branch, with patches released across all maintained stable series; no public exploit or active exploitation is confirmed, and EPSS is 0.21% (12th percentile).
Reference count leak in the Linux kernel's SCMI regulator driver can exhaust kernel memory resources, leading to a denial-of-service condition on affected systems. The flaw resides in scmi_regulator_probe(), where of_find_node_by_name() acquires a reference on a device-tree node but the corresponding of_node_put() release call is omitted on the error path when process_scmi_regulator_of_node() fails, permanently leaking the reference. Exploitation requires local access; no public exploit code has been identified and EPSS probability stands at 0.21%, indicating very low likelihood of opportunistic exploitation.
Null pointer dereference in the Linux kernel module decompression path crashes the kernel when a local user loads a compressed module under memory pressure. The flaw exists across multiple stable kernel branches and was introduced at commit b1ae6dc41eaa; patches are now available for all affected stable trees. No active exploitation confirmed (not in CISA KEV), and EPSS at 0.21% (12th percentile) reflects very low exploitation probability, consistent with the local-only, condition-dependent attack surface.
NULL pointer dereference in the Linux kernel's swap cgroup subsystem (`mm/swap_cgroup.c`) causes a kernel panic and full system crash on swapless hosts running kernel versions after commit `bea67dcc5eea`. The batched PTE zap path introduced by that commit calls `lookup_swap_cgroup_id()` without validating the swap entry against `swap_info[]`, so any process exit involving a PTE corrupted into a type-0 swap entry dereferences the uninitialized `ctrl->map` pointer and takes the host down. The crash pattern was confirmed in production on kernel 6.12.58 and independently reproduced by syzbot; no public exploit exists, but the kernel teardown path is deterministically vulnerable once the prerequisite conditions are present.
Softlockup in the Linux kernel's swap memory reclaim path allows a local user to trigger a kernel panic by generating heavy swap pressure on systems with large swap devices. The swap_reclaim_full_clusters() function, called from a kworker context, iterates through potentially thousands of full swap clusters without yielding the CPU via cond_resched(), starving the scheduler and eventually causing the kernel watchdog timer to fire. The vulnerability was confirmed in a real-world stress test on a 320-CPU arm64 machine with ~1TB RAM and an 8.6GB swap device, resulting in a kernel panic. No public exploit code exists and EPSS is very low (0.21%, 11th percentile).
NULL pointer dereference in the Linux kernel's Bluetooth ISO subsystem can crash the kernel when a race condition is triggered during PA-sync broadcast sink socket operations. The flaw exists in iso_conn_big_sync(), which drops the socket lock to call hci_get_route() and then re-acquires it without re-validating that the connection structure is still intact - allowing concurrent teardown events (iso_disconn_cfm → iso_conn_del → iso_chan_del) to null out iso_pi(sk)->conn before it is dereferenced. A local low-privileged user with access to Bluetooth ISO sockets can reliably crash the kernel, resulting in a denial of service. No public exploit code has been identified and no active exploitation is confirmed.
Unconditional invocation of cancel_work_sync() in the mtk-jpeg media driver's release path triggers spurious WARN_ON kernel warnings on non-multicore MediaTek JPEG codec platforms where the workqueue callback pointer is NULL. Systems running affected Linux kernel versions (6.6.140-6.18.38, 7.0.4) on MediaTek SoC hardware may experience kernel log pollution or, on kernels compiled with CONFIG_PANIC_ON_WARN=y, a full system denial of service when the JPEG device is released. No public exploit has been identified and no active exploitation is recorded; this is a stability and correctness fix with strictly local trigger conditions.
Integer overflow in the Linux kernel's XFS filesystem exchmaps reservation logic allows a local low-privileged user to crash the system. The bug in xfs_exchmaps_estimate_overhead() adds bmbt and rmapbt overhead to a local resblks variable but then performs the UINT_MAX guard check against the original req->resblks value - the pre-overhead figure - before writing the inflated value back into req->resblks for use in xfs_trans_alloc(). This means the guard intended to prevent integer truncation when the reservation is cast to unsigned int is rendered ineffective, enabling a kernel panic on XFS systems where exchmaps overhead pushes the reservation past UINT_MAX. No public exploit exists and EPSS is 0.21%, placing this firmly in the kernel stability/bug-fix category rather than active threat landscape.