Remote code execution in Redis before 8.8.0 is possible when an authenticated attacker can run the RESTORE command with a maliciously crafted serialized stream payload. The payload defines a stream consumer-group PEL in which the same NACK (pending entry) is referenced by two different consumers, so tearing those consumers down (via XGROUP DELCONSUMER or XACK) triggers a CWE-415 double free of the shared NACK object, corrupting the heap. Publicly available exploit code exists, and the flaw stems from an incomplete fix for CVE-2026-25243; it is not listed in CISA KEV, so there is no public exploit identified as actively exploited at time of analysis.
Out-of-bounds read and integer underflow in the Linux kernel staging driver rtl8723bs (Realtek RTL8723BS SDIO Wi-Fi chipset) allows an adjacent network attacker to trigger kernel memory disclosure or crash via crafted 802.11 WEP authentication frames. Two distinct bugs in OnAuth() can be triggered without authentication: a length underflow that causes crc32_le() to read far beyond the frame buffer when the Privacy bit is set on a short frame, and a fixed 128-byte memcmp in the seq=3 path that ignores the actual IE length field. No public exploit code exists and EPSS is 0.26%, reflecting the combination of adjacent-network requirement, deprecated WEP protocol dependency, and niche SDIO chipset driver.
Authorization bypass in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated network client to rewrite any accessible file's security descriptor - including DACL and owner - without holding WRITE_DAC or WRITE_OWNER rights on the file handle. A client opening a handle with only FILE_WRITE_ATTRIBUTES can issue SMB2 SET_INFO with InfoType SMB2_O_INFO_SECURITY to invoke set_info_sec(), which rewrites POSIX ACLs, ownership via notify_change(), and (on KSMBD_SHARE_FLAG_ACL_XATTR shares) the Windows SD xattr, all without any fp->daccess gate. No public exploit has been identified; EPSS is 0.22%, and patches are confirmed in kernel stable series 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1.
Missing VGA arbiter client cleanup on vfio/pci registration failure in the Linux kernel leaves a stale callback registered against a freed vdev cookie. The displaced vfio_pci_vga_init() call in vfio_pci_core_register_device() was never paired with an unwind handler, so any failure after VGA arbiter registration exits without releasing the arbiter client. While currently mostly benign because the existing vfio_pci_set_decode() callback only dereferences pci_dev state, the stale registration becomes a live use-after-free vector once any code path makes the callback follow drvdata to the freed vfio device structure. No public exploit has been identified and EPSS is 0.22%, consistent with a latent defect rather than an actively targeted flaw.
Use-after-free in the Linux kernel's Intel QuickAssist Technology (QAT) SR-IOV driver allows a local low-privileged attacker - including a VM tenant with a VF assigned - to corrupt host kernel memory by racing VF2PF workqueue processing against SR-IOV teardown in adf_disable_sriov(). The VF2PF interrupt handler enqueues work that holds raw pointers to per-VF state (struct adf_accel_vf_info); adf_disable_sriov() freed that state without draining in-flight workers, enabling a concurrent worker to deref freed memory. No public exploit is known at time of analysis, and EPSS is 0.22% (13th percentile), indicating negligible observed exploitation pressure despite the 8.8 CVSS score.
Use-after-free race condition in the Linux kernel's Bluetooth BNEP subsystem allows an adjacent unauthenticated attacker to corrupt kernel memory or crash the system. During netdev registration via bnep_add_connection(), the L2CAP connection is read without holding the channel lock; if controller teardown occurs concurrently, the freed parent device is dereferenced by the network device registration path. The fix takes a reference to the L2CAP connection under the channel lock and retains it until register_netdev() secures its own parent device reference. No public exploit or CISA KEV listing has been identified at time of analysis, and the 0.22% EPSS score reflects low active exploitation probability.
Out-of-bounds bit manipulation in the Linux kernel HID multitouch driver allows an attacker with a crafted USB or Bluetooth multitouch device to corrupt adjacent kernel data structures and panic the kernel. The driver uses mt_io_flags - a single unsigned long - as a variable-length per-slot bitmap indexed by slot number, which is bounded only by the device-reported ContactCountMaximum (up to 255). When that value exceeds BITS_PER_LONG, set_bit()/clear_bit() operations in mt_release_contacts() overwrite adjacent struct mt_device members, zeroing the td->applications list head and causing a null-pointer dereference in softirq context. No local privileges are required; physically connecting a crafted device is sufficient. No public exploit code has been identified at time of analysis.
Incorrect carry overflow in the Linux kernel's ECC vli multiplication allows adjacent network attackers to cause incorrect ECDH shared secret derivation, potentially enabling man-in-the-middle attacks against ECDH-based protocols such as IPsec, TLS, and Wi-Fi WPA3. The vulnerability, introduced in kernel 4.8, can be exploited without authentication or user interaction if ECDH is enabled. No active exploitation or public exploit has been identified, but the bug fundamentally weakens cryptographic guarantees.
Out-of-bounds write in the Linux kernel's HID wacom driver allows an adjacent attacker to corrupt kernel memory, potentially achieving code execution or crashing the system. The flaw, present in kernels from commit 5e013ad2... up to the fixed versions 6.18.39, 7.1.4, and 7.2-rc1, stems from a missing emptiness check that causes the FIFO to read stale data and bypass the buffer size guard. No active exploitation or public exploit code has been identified, and EPSS predicts a low exploitation probability (0.22%).
Out-of-bounds reads in the Linux kernel's rtl8723bs staging WiFi driver allow an adjacent unauthenticated attacker to leak kernel memory or crash the system by sending crafted 802.11 management frames containing malformed WPA, WAPI, or WPS Information Elements. Three IE parsing functions - rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - lack bounds validation before reading multi-byte header fields and OUI comparisons, exposing raw kernel buffer contents to an adversary within WiFi range. No public exploit or active exploitation has been identified; vendor-released patches are available across all supported stable branches.
Use-after-free in the Linux kernel's ksmbd (SMB server) allows authenticated remote attackers to trigger memory corruption, potentially leading to arbitrary code execution or denial of service. The flaw occurs when an SMB2_CLOSE on a locked file is followed by an SMB2_CANCEL, causing a freed file_lock to be re-accessed. A patch is available for affected kernel versions, and while no active exploitation is confirmed, a proof-of-concept exists; EPSS indicates low exploitation likelihood.
Use-after-free in Linux kernel’s ksmbd SMB server occurs during deferred byte-range lock cancellation, allowing an authenticated attacker to potentially execute arbitrary code or crash the system. The vulnerability affects ksmbd versions prior to the released fixes (6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, 7.2-rc1). No active exploitation has been confirmed (no CISA KEV listing), and EPSS indicates a low probability of widespread exploitation.
Memory corruption in the Linux kernel's ksmbd SMB server allows authenticated remote code execution. A race condition in byte-range lock ownership tracking can lead to use-after-free when SMB3 multichannel is enabled, enabling an attacker with low privileges to escalate to full system compromise. No public exploit or active exploitation is known, and EPSS indicates low exploitation probability.
Use-after-free in the Linux kernel's Bluetooth L2CAP subsystem can be triggered by an adjacent attacker, potentially leading to arbitrary code execution or kernel memory corruption. The flaw occurs when a channel timeout callback races with connection teardown, allowing a freed connection object to be accessed. Patched kernels are available; no active exploitation is confirmed, but the vulnerability is remotely exploitable within Bluetooth range without authentication or user interaction.
Double-free in the Linux kernel SMB client's SMB2_open() replay handler allows remote attackers to corrupt memory by inducing a user to mount a malicious SMB share. The flaw affects unpatched kernel versions with the cifs module loaded and can lead to arbitrary code execution, information disclosure, or denial of service. No active exploitation has been reported (not in CISA KEV), and EPSS score is 0.21%, indicating low exploitation probability; official kernel patches are available.
State-counter underflow in the Linux kernel's mlx5e (NVIDIA/Mellanox ConnectX) IPsec offload driver lets the eswitch mode-block reference counter (esw->offloads.num_block_mode) be decremented without a matching increment when a temporary acquire-flow security association is installed. The affected code is the mlx5e_xfrm_add_state() acquire-SA path, which skips hardware offload but still falls through to the common success label that unconditionally calls mlx5_eswitch_unblock_mode(). Fixed upstream in the stable kernel series; no public exploit identified at time of analysis and EPSS probability is low (0.21%).
Reference-count corruption in the Linux kernel's rust_binder IPC driver on 32-bit kernels allows a local, low-privileged user to over-decrement binder object reference counts by submitting transactions with a crafted offsets array. The allocation cleanup path uses usize (32-bit on 32-bit kernels) as the stride and read width for 8-byte binder_size_t entries, causing an N-entry array to be walked 2N times and the object at offset 0 to receive N spurious release operations. This corrupts binder reference accounting, can produce premature BR_RELEASE notifications to object owners, and may lead to use-after-free conditions enabling privilege escalation or kernel instability. No public exploit and no CISA KEV listing identified at time of analysis; EPSS is 0.21%.
An integer truncation vulnerability in the Linux kernel's FPGA DFL-AFU driver allows a local attacker with low privileges to trigger memory corruption by sending a crafted DMA map ioctl. The issue arises from a missing upper bound check on a 64-bit length parameter from userspace, leading to an undersized pin of memory pages and potential out-of-bounds access. This can result in privilege escalation to root, impacting systems with the dfl-afu module loaded. No active exploitation or public exploit code has been identified at time of analysis.
Out-of-bounds access in the Linux kernel amdgpu VCE 1 driver allows a low-privileged local attacker on systems with older AMD GPU hardware to potentially corrupt kernel memory and escalate privileges. The drm/amdgpu/vce1 driver failed to account for the firmware offset when sizing the VCPU Buffer Object, omitted alignment of stack and data offsets to the 32K TLB boundary, and lacked bounds checks ensuring firmware microcode fits reserved space - creating conditions for OOB read/write in kernel space. No public exploit code exists and EPSS stands at 0.20%, placing this in the 10th percentile for exploitation probability despite the high CVSS score.
Path traversal bypass in the Linux kernel's ksmbd SMB server allows authenticated users with write access to a share to create zero-length files or directories outside the exported share boundary. The flaw exists only when the share is configured with case-insensitive (caseless) filename handling. Patches are available; the vulnerability is not known to be actively exploited, has a low EPSS score (0.26%), and no public exploit has been identified.
Out-of-bounds read/write in the Linux kernel's ALSA virtio sound driver allows a malicious hypervisor to corrupt guest memory, potentially leading to code execution or information disclosure. Affected are Linux kernel versions with the CONFIG_SND_VIRTIO option enabled, where the driver trusts device-supplied control metadata without validation. Exploitation requires a compromised or malicious host with local access to the virtualized guest; no public exploit or active exploitation has been identified.
Local privilege escalation in the Linux kernel's ARM FFA firmware interface allows an unprivileged local attacker to achieve arbitrary code execution by triggering an out-of-bounds write when processing PARTITION_INFO_GET descriptors. The kernel fails to validate firmware-supplied indices, enabling a heap buffer overflow that can corrupt memory. Patches are available, no public exploit exists, and EPSS indicates low exploitation probability (0.21%).
Heap-based information disclosure and denial of service in the Linux kernel's mac80211 WiFi subsystem can be triggered by adjacent network attackers. The vulnerability arises from incorrect pointer usage during MLE defragmentation, potentially leading to kernel heap memory over-read and exposure of sensitive data, as well as system crashes. Affected kernels from version 6.9 are vulnerable until patched; no public exploit is known and EPSS indicates a low exploitation probability (0.21%).
Session key corruption in the Linux kernel's ksmbd SMB server allows a network attacker to overwrite an existing session's NTLMv2 session key (`sess->sess_key`) despite a failed authentication attempt. The flaw lies in the SMB3 multichannel binding path: `ksmbd_auth_ntlmv2()` derives the base session key into `sess->sess_key` before verifying the NTLMv2 proof, and the binding session error path does not expire the binding session, so a crafted SESSION_SETUP with a bad NT proof plus KEY_XCH arc4_crypt payload corrupts the live session key before `STATUS_LOGON_FAILURE` is returned. No public exploit has been identified at time of analysis; EPSS is 0.25% (16th percentile), consistent with a race-and-config-gated server-side flaw.
Out-of-bounds read in the Linux kernel's CIFS client during SMB2 message validation allows an unauthenticated remote attacker acting as a malicious server to leak kernel memory and crash the client before session authentication. The vulnerability, which affects the smb2_check_message() function, can be triggered during NEGOTIATE or SESSION_SETUP exchanges. No active exploitation has been reported, and the EPSS probability is low (0.22%).
A data race condition in the Linux kernel's audit subsystem allows local attackers to cause denial of service and minimal integrity impact by exploiting unsynchronized reads of the audit queue length. The flaw affects kernel versions from 4.10 through the unpatched stable series, triggered when concurrent readers and writers access the queue without proper locking,
Out-of-bounds read in the Linux kernel's SMB/CIFS client POSIX SID parser allows a malicious or MITM SMB server to cause kernel memory disclosure and denial of service on connecting clients. The `posix_info_sid_size()` helper reads `sid[1]` (the SubAuthorityCount byte) after validating only one remaining byte, permitting a truncated server-supplied POSIX SID to trigger a one-byte OOB read - leaking a byte of kernel heap context (C:L) and risking a crash (A:H). No public exploit code exists and EPSS is 0.22%, but the vulnerability is client-facing and triggered entirely from the server side without client-side privilege. Patches are available across all maintained stable branches.
Privilege escalation in the Linux kernel's KVM on ARM64 with pKVM allows a host with root privileges to corrupt hypervisor memory via an out-of-bounds list register index, potentially leading to full hypervisor compromise. The vulnerability arises from missing bounds clamping of the used_lrs field when copying vGIC state from host to hyp, enabling a malicious host to read or write beyond the implemented list registers. A patch is available across several stable kernel branches; the EPSS score is low (0.21%) and no public exploit or active exploitation is known at time of analysis.
Privilege escalation in the Linux kernel's
Arbitrary file upload leading to remote code execution affects the WPForms Pro plugin for WordPress in all versions up to and including 1.10.1.1, exploitable by unauthenticated attackers through the ajax_chunk_upload_finalize function. Because file-type validation runs only after chunk metadata and file contents are written to disk, and the assembled file is not removed when validation fails, an attacker can leave an executable payload (e.g. a PHP file) on the server. Reported by Wordfence and tracked as ENISA EUVD-2026-48766, this carries a CVSS 8.1; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Knot Resolver versions prior to 6.4.1 stems from a heap-based buffer overflow triggered along the DNS-over-QUIC (DoQ) receive path, allowing a remote unauthenticated attacker to corrupt heap memory by sending malformed QUIC-transported DNS traffic to an exposed resolver. Because the flaw lives in the query-receiving code, any Knot Resolver instance that has DoQ listening is reachable over the network without credentials. Publicly available exploit code exists (a dedicated 'knot-doq' proof-of-concept was published), and the issue was disclosed via oss-security; it is not listed in CISA KEV, so there is no confirmation of active exploitation yet.
Out-of-bounds write in the Linux kernel's rtl8723bs staging Wi-Fi driver when processing a maliciously crafted 802.11 Association Response frame. An attacker within Wi-Fi range can send an oversized HT Capabilities IE, leading to up to 229 bytes of kernel memory corruption, resulting in high integrity and availability impact with no user interaction or authentication required. No public exploit or active exploitation is known; EPSS indicates very low exploitation probability (0.22%).
Data zeroing attack in the Linux kernel's ksmbd SMB server allows an authenticated client to destroy file contents without requiring FILE_WRITE_DATA permission. A handle opened with only FILE_WRITE_ATTRIBUTES is sufficient to send FSCTL_SET_ZERO_DATA, bypassing the missing per-handle access check. Publicly available exploit code exists, and vendor patches have been released.
Out-of-bounds reads in the Linux kernel's rtl8723bs staging WiFi driver allow an attacker-controlled access point to leak kernel memory or crash affected systems by sending beacon or probe-response frames with a truncated final information element. Two IE-parsing loops in issue_assocreq() and join_cmd_hdl() dereference pIE->length without first verifying that at least sizeof(*pIE) bytes remain in the buffer, so a one-byte stub IE at the end of AP-supplied data reads one byte past the buffer end. No public exploit has been identified at time of analysis, and EPSS sits at 0.22%, consistent with the adjacent-network attack vector and niche driver footprint.
Out-of-bounds read in the Linux kernel's rtl8723bs staging driver allows adjacent network attackers to read sensitive kernel memory and cause denial of service via a malicious association response. Exploitation requires a rogue access point sending crafted IE data. Patches are available, and no active exploitation or public exploit has been reported.
Out-of-bounds read in the Linux kernel's staging rtl8723bs Wi-Fi driver can be triggered by a malicious Access Point sending a crafted Beacon frame, allowing an adjacent attacker to read sensitive kernel memory and potentially crash the system. Affected kernels from version 4.12 onwards that include the rtl8723bs driver; vendor patches are available.
Memory disclosure in the Linux kernel's SLUB allocator allows local attackers to read uninitialized kernel memory when specific slab debugging options are enabled. The issue occurs when red zoning is active without store_user tracking, causing krealloc() to violate the __GFP_ZERO contract and return partially zeroed allocations. This can leak sensitive data, with an EPSS probability of 0.21% and no known active exploitation, though a vendor patch is available.
Use-after-free in the Linux kernel Bluetooth subsystem's bt_accept_dequeue() function allows an attacker with local or adjacent Bluetooth access to corrupt kernel heap memory or crash the system during L2CAP listening socket teardown. The bug stems from a reference-count sequencing error: the temporary queue-walk reference is dropped before bt_accept_unlink() removes the socket from the accept queue and drops its own reference, so if that was the final reference, the subsequent sock_hold() call dereferences freed slab memory. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS is 0.22% (13th percentile), consistent with low opportunistic exploitation risk.
Local privilege escalation in the Linux kernel's QAT driver allows a low-privileged local attacker to achieve full system compromise by exploiting a legacy character device interface with IOCTLs. The unused /dev/qat_adf_ctl device node increases attack surface and has been the subject of multiple bug reports. With an EPSS score of 0.24%, active exploitation is unlikely, and no public exploit code is known; the vulnerability is addressed by removing the entire character device and IOCTL infrastructure.
Heap buffer overflow in the Linux kernel's rtl8723bs staging WiFi driver (rtw_cfg80211_set_wpa_ie()) allows a local low-privileged user to corrupt kernel memory by one byte via a crafted nl80211 connect request, enabling potential privilege escalation to kernel context. The 256-byte supplicant_ie array in struct security_priv overflows when a WPA IE with length 255 is supplied, writing 257 bytes and clobbering the adjacent last_mic_err_time field; a flawed length check in rtw_parse_wpa_ie() using u8 narrowing silently permits the overflow. Patches are available across all active stable kernels; EPSS is 0.23% and no public exploit or CISA KEV listing exists at time of analysis.
Local privilege escalation via stack buffer overflow in the Linux kernel's hid-goodix-spi driver allows a user with access to a Goodix SPI HID device node to corrupt kernel stack memory and achieve full system compromise. The goodix_hid_set_raw_report() function copies caller-supplied report data into a fixed 128-byte stack buffer without bounds checking, so a hidraw SET_REPORT ioctl carrying more than ~116 bytes overflows it. There is no public exploit identified at time of analysis, and the low EPSS score (0.23%) plus the local-only, hardware-specific attack surface indicate limited real-world exposure despite the high 7.8 CVSS.
Local privilege escalation to root via a use-after-free race condition in the Linux kernel's binder driver allows a low-privileged attacker to exploit a flaw in binder_thread_release() when a thread exit races with a parallel process death. The vulnerability affects Linux kernel versions since commit 7a4408c6bd3e and can lead to full system compromise. EPSS exploitation probability is low (0.22%), and no public exploit or active exploitation is known at time of analysis.
Local privilege escalation in the Linux kernel's binder driver allows a low-privileged attacker to execute arbitrary code with kernel rights. The vulnerability arises from a race condition in binder_free_transaction() where a freed target process can still be accessed, leading to a use-after-free. No active exploitation or public exploit code is currently known, and vendor patches are available across multiple stable kernel branches.
Use-after-free in the Linux kernel IPv4 IGMP subsystem allows a local low-privileged attacker to trigger kernel memory corruption or a system crash by racing network device destruction against concurrent multicast group lookups in softirq context. During ip_mc_destroy_dev(), multicast membership entries are scheduled for RCU reclamation via ip_ma_put() but are not unlinked from the per-device mc_hash table; concurrent softirq-path readers such as ip_check_mc_rcu() can then dereference a freed slab object, as confirmed by the embedded KASAN trace showing a read of freed memory during UDP packet processing. No public exploit code or CISA KEV listing exists at time of analysis; Ubuntu USN-8726/8727-1 and a Siemens ICS advisory confirm active patching across distributions.
Memory leak in the Linux kernel's SMB client encrypted receive path (receive_encrypted_standard()) allows a local low-privileged user or a cooperative malicious SMB server to exhaust kernel heap memory, with potential for heap grooming-based privilege escalation. The bug was introduced with commit b24df3e30cbf and affects multiple stable kernel series from 4.19 onward. No public exploit code exists and EPSS is 0.22%, but the kernel team's classification of CWE-787 and a C:H/I:H/A:H CVSS score reflect the Linux security team's assessment that the leaked kernel buffer is exploitable beyond simple resource exhaustion.
Privilege escalation in the Linux kernel /proc filesystem allows a local attacker to bypass ptrace access restrictions when reading symbolic links in /proc/[pid]/fd/. By racing the task lookup and access check, an unauthenticated local user can gain unauthorized read and write access to sensitive file descriptors of other processes, potentially leading to full system compromise. The vulnerability affects a wide range of kernel versions and has a patch released by the Linux kernel project.
Local privilege escalation in the Linux kernel's pcc-cpufreq driver allows a low-privileged user to gain full root privileges. The vulnerability is a use-after-free and double-free flaw when evaluating ACPI _OSC negotiation, affecting all kernel versions from 2.6.34 until the fixed stable releases (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1). No active exploitation or public exploit has been identified, and EPSS indicates a low probability of widespread exploitation.
Use-after-free in the Linux kernel HID appleir driver allows a local attacker to corrupt kernel memory during device removal, potentially achieving privilege escalation. The race condition exists between the key_up_timer callback (armed by appleir_raw_event() on each keydown/key-repeat) and hid_hw_stop(), which frees the underlying input_dev before the timer is drained. A second race window, where a USB URB completion during hid_hw_stop() can re-arm the timer via mod_timer(), means a simple teardown reorder is insufficient — the fix introduces a spinlock-gated 'removing' flag combined with timer_shutdown_sync() to permanently disable further callbacks. No public exploit has been identified at time of analysis, and EPSS is 0.22% (13th percentile).
Use-after-free in the Linux kernel HID lg-g15 driver allows a local attacker to trigger kernel memory corruption by racing device input events against USB keyboard removal. The driver allocates lg_g15_data via devm and schedules work items from HID report handlers (backlight cycle key on G15, G15 v2, G510), but lacked a remove callback to cancel pending work before devres freed the allocation. On kernel versions from approximately 5.5 through the unfixed stable branches, unplugging the keyboard while a work item is pending causes the worker to dereference freed memory via container_of, potentially enabling local privilege escalation. No public exploit has been identified and EPSS is 0.22% (13th percentile), indicating no observed widespread exploitation.
Integer wrap-around in the Linux kernel's HFS/HFS+ filesystem driver allows a local low-privileged user to bypass a critical bounds check, triggering a memmove that reads approximately 4GB past a node buffer in kernel memory. The flaw originates in check_and_correct_requested_length(), where u32 arithmetic on off+len wraps silently when len arrives as a large underflowed value from hfs_brec_remove(); the wrapped result passes the node_size guard and proceeds to an out-of-bounds memory operation. No public exploit has been identified at time of analysis, and EPSS stands at 0.22%, reflecting low real-world exploitation expectation despite full C:H/I:H/A:H impact ratings.