Authenticated directory traversal in Checkout Field Editor Pro for WooCommerce up to 3.7.7 enables subscriber-level attackers to read arbitrary server files. Exploitation leverages the 'thwcfe_legacy_file' parameter. No active exploitation or public exploit code is currently known, and EPSS indicates low exploitation probability.
Stored Cross-Site Scripting in the Yoast SEO WordPress plugin (all versions through 28.0) allows authenticated attackers holding author-level accounts or higher to inject persistent JavaScript via a crafted post slug (post_name field) that executes in the browsers of any user who later visits the affected page. The vulnerability traces to insufficient sanitization in the bulk-editor list table (class-bulk-editor-list-table.php, lines 898-900) combined with get_permalink() embedding the stored percent-encoded post_name in generated URLs without adequate escaping. No confirmed active exploitation (no CISA KEV listing) and no public exploit code has been identified at time of analysis, though the scope-changed CVSS vector (S:C) reflects cross-user browser impact consistent with a medium-priority persistent XSS.
Out-of-bounds read in the Linux kernel's Samsung Kalmia USB network driver allows a malicious USB device to crash the kernel via a u16 integer underflow in `kalmia_rx_fixup()`. When a crafted bulk-IN frame is 6-11 bytes long, the subtraction `skb->len - 12` underflows to approximately 65,530, bypassing length validation and causing `memcmp()`, `skb_trim()`, and `skb_pull()` to operate past the end of the 14,000-byte RX buffer. No public exploit or active exploitation (CISA KEV) has been identified; EPSS at 0.23% (14th percentile) confirms minimal exploitation interest.
Denial of service via infinite exception loop in the Linux kernel's s390 architecture affects systems running IBM Secure Execution (Ultravisor) workloads on kernel versions 6.7 through the patched releases. When load_unaligned_zeropad() reads across a page boundary where the adjacent page has been donated to the Ultravisor, the do_secure_storage_access() exception handler cannot resolve the fault and enters an unresolvable loop, permanently hanging the affected execution context. Patched in upstream versions 6.12.97, 7.1.4, and 7.2-rc1 via reversion of DCACHE_WORD_ACCESS support on s390; no public exploit or active exploitation is confirmed at time of analysis.
Denial of service in the Linux kernel's AMD CCP/SEV driver allows a local low-privileged process to crash a KVM hypervisor host by submitting SEV firmware ioctls to /dev/sev, which incorrectly triggers SNP initialization and zeroes the MSR_VM_HSAVE_PA register, causing a general protection fault on the next VMRUN and terminating all running virtual machines. Affected kernels span from the introducing commit (ceac7fb89e8da465aec3ac3c20477f912f5c3a6c) through the fixed stable releases 6.12.96, 6.18.39, and 7.1.4. No public exploit has been identified and EPSS is 0.22%, but the blast radius - crashing the host and all its tenant VMs - warrants prompt patching on AMD EPYC KVM deployments.
Crash of a Linux KVM host is achievable by a local low-privileged user via the /dev/sev ioctl interface on systems running AMD SEV-SNP firmware. When SNP_COMMIT is issued after a prior failed SEV initialization, the crypto/ccp driver incorrectly proceeds with SNP initialization, zeroing out MSR_VM_HSAVE_PA - the model-specific register holding the AMD SVM host save-area pointer. Any subsequent VMRUN instruction by KVM for an already-running VM will generate a General Protection Fault, crashing the host and terminating all guest workloads. No public exploit has been identified at time of analysis; patch commits are available across multiple stable branches.
Uncontrolled SNP initialization in the Linux kernel's CCP/SEV driver allows a local low-privileged user with /dev/sev access to crash the host kernel on AMD SEV/SNP-capable systems running KVM. Sending a SNP_VLEK_LOAD ioctl when SNP has not been initialized triggers an unnecessary initialization/shutdown wrapper that zeros MSR_VM_HSAVE_PA globally; the subsequent VMRUN instruction for any active KVM guest then triggers a General Protection Fault, bringing down the host and terminating all co-hosted VMs. No public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects the specialized attack environment required.
Host crash vulnerability in the Linux kernel's AMD SEV/SNP subsystem allows a local low-privileged user to take down a virtualization host by triggering SNP re-initialization via the `/dev/sev` `SNP_CONFIG` ioctl when SNP has previously failed to initialize. When re-initialization executes while KVM guests are running, it zeroes `MSR_VM_HSAVE_PA` globally across all CPUs; the next VMRUN instruction on any active guest then raises a General Protection Fault, crashing the host kernel and terminating all hosted VMs. No public exploit identified at time of analysis; EPSS is 0.22% at the 13th percentile, consistent with low opportunistic exploitation probability.
Memory exhaustion in the Linux kernel XFS quota subsystem can be triggered by a local low-privilege user on systems mounting metadir XFS images with user quota enabled. The vulnerability exists in xfs_dqinode_metadir_create(), where failure of xfs_metadir_create() returns without releasing the allocated update and transaction state, and commit failures leave behind caller-owned inode references. Confirmed present from Linux 6.13-rc1 through v7.1.1; patched in stable releases 6.18.39 and 7.1.4.
Kernel crash (availability loss) in the Linux gpio/eic-sprd Spreadtrum EIC GPIO driver affects systems running PREEMPT_RT kernels with Unisoc/Spreadtrum SoCs. The IRQ startup path - request_threaded_irq() → irq_startup() → sprd_eic_irq_unmask() - calls sprd_eic_update(), which acquires a regular spinlock_t via spin_lock_irqsave(). On PREEMPT_RT kernels, spinlock_t is a sleeping lock; sleeping in a non-sleepable IRQ-disabled context triggers a kernel BUG: 'sleeping function called from invalid context', crashing the system. No public exploit has been identified at time of analysis; patches are available across all maintained stable branches.
Availability impact in the Linux kernel's io_uring work queue (io-wq) subsystem allows a local, low-privileged user to cause an extended hang during io_uring ring closure. The root cause is a race condition in io_worker_handle_work(): the IO_WQ_BIT_EXIT check is snapshotted once before processing a linked-work chain, so if io_wq_exit_start() fires mid-chain, remaining linked items execute with a stale do_kill=false, skip IO_WQ_WORK_CANCEL, and continue running after exit has been initiated. No public exploit is identified at time of analysis; the issue was surfaced by syzbot using slow MSR-device reads with linked work chains and immediate ring close.
Kernel denial-of-service via missing exec_update_lock protection in six Linux procfs functions affects all Linux deployments running kernel 2.6.30 through multiple current stable branches. When a low-privileged local user reads specific /proc entries (stat, map_files, ns symlinks) concurrently with an execve() call in the target process, the missing lock allows ptrace_may_access() to observe transiently invalid credential or memory-map state, triggering a kernel crash. No public exploit identified at time of analysis; EPSS is 0.22% (13th percentile), consistent with low near-term automated exploitation probability.
Resource reference leak in the Linux kernel's POSIX CPU timer subsystem allows a local unprivileged user to exhaust kernel pid references and cause a local denial of service. The flaw exists in `do_cpu_nanosleep()` across all stable kernel branches from 2.6.12 onward: when `posix_cpu_timer_set()` returns an error, the pid reference acquired by the preceding `posix_cpu_timer_create()` call is never released. No public exploit code exists and EPSS sits at 0.22%, consistent with a kernel stability regression fix rather than an actively targeted security flaw.
Uninitialized stack memory use in the Linux kernel HFS and HFS+ filesystem drivers allows a local user to crash the kernel by mounting a crafted filesystem image. Two early-exit paths in `hfs_bnode_read()` - an invalid offset check and a corrected-to-zero length - skip the buffer write, while downstream callers such as `hfs_bnode_read_u16()` and `hfs_bnode_read_u8()` consume the uninitialized stack buffer unconditionally, producing KMSAN uninit-value reports and risking kernel panics. Patches are available across multiple stable kernel branches; no public exploit exists and EPSS is very low at 0.22%.
Hung-task denial-of-service in the Linux kernel's nilfs2 filesystem allows a local low-privileged user to indefinitely stall concurrent filesystem operations by supplying out-of-range segment numbers to the NILFS_IOCTL_CLEAN_SEGMENTS ioctl. Because input validation was deferred deep inside the call chain to nilfs_sufile_updatev() - which emits one printk warning per invalid entry while holding ns_segctor_sem write-locked - repeated invocations saturate the global printk path and keep the semaphore held long enough to block all readers, including routine operations such as chmod(). No public exploit has been identified and EPSS is very low (0.22%, 13th percentile), consistent with a local kernel DoS requiring filesystem access.
Kernel denial-of-service in the Linux USB gadget composite driver crashes the system by triggering a KASAN memory fault in the USB_DT_OTG request handler when the configuration list is empty. The flaw exists because list_first_entry() never returns NULL - making the subsequent config NULL-check dead code - so when cdev->configs is empty during a gadget unbind race or when a driver sets is_otg before registering any configuration, composite_setup() dereferences a garbage pointer and memcpy() copies arbitrary kernel memory into the USB response buffer. No public exploit code has been identified, and EPSS is 0.22% (13th percentile), consistent with the local, race-condition nature of the flaw.
Incomplete error-path cleanup in the Linux kernel's uss720 USB-to-parallel-port driver leaves a parport device registered after probe failure, creating a dangling stale pointer backed by freed private data. Systems where a Belkin F5U002 or similar USS720-based adapter is attached and causes get_1284_register() to fail during uss720_probe() are left with an orphaned kernel parport entry and a reserved parport slot, which can lead to a kernel crash when the stale pp->private_data pointer is later dereferenced. No active exploitation has been identified; the bug was discovered via static-analysis research, and patches are available across all major Linux stable branches.
DMA mapping leak in the Linux kernel's MTU3 USB device controller driver causes local denial-of-service on MediaTek SoC platforms. When mtu3_gadget_queue() maps a USB transfer request via DMA before checking whether the QMU GPD ring has capacity, then mtu3_prepare_transfer() fails and returns -EAGAIN, the error path bypasses the mtu3_req_complete() cleanup helper, permanently stranding the DMA mapping. Repeated exhaustion of the IOMMU aperture can destabilize or crash the kernel. No public exploit code exists and EPSS at 0.22% (13th percentile) confirms negligible exploitation interest; the impact is a local availability-only issue confined to MediaTek USB gadget hardware.
Availability loss in the Linux kernel's USB serial digi_acceleport driver allows a local user to permanently halt data reception on a Digi AccelePort serial port until the USB device is physically reconnected or the driver is rebound. The bug arises from a missing URB resubmission path: when a port is closed while in a throttled state, the read URB is never re-queued, leaving the port silently deaf to incoming data upon next open. No public exploit has been identified and EPSS sits at 0.22% (13th percentile), reflecting the niche hardware dependency and local-only attack surface.
Hard lockup in the Linux kernel's digi_acceleport USB serial driver causes full system freeze when a Digi AccelePort device is physically disconnected during active I/O. The driver's OOB (out-of-band) command path loops indefinitely with interrupts disabled upon persistent URB submission failure, resulting in a kernel hard lockup that effectively crashes the host. Systems with this specific USB-to-serial adapter are affected across a wide range of stable kernel branches from 2.6.12 onward; patches have been released across all active stable series.
Memory leak in the Linux kernel USB ULPI (Universal Serial Bus Link Interface) subsystem allows a local low-privileged user to trigger repeated ULPI device registration failures that leak kernel memory, potentially leading to system instability or denial of service. Affected kernel versions span from 4.2 through multiple pre-patch stable branches, with fixes backported to 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc3. No public exploit or active exploitation has been identified at time of analysis; the EPSS score of 0.22% (13th percentile) reflects minimal probability of weaponization.
NULL pointer dereference in the Linux kernel's usbip virtual UDC (vudc) subsystem crashes the kernel when FunctionFS AIO cancellations are processed. The `vep_alloc_request()` function never initialized `vrequest->udc`, so any AIO cancellation arriving at `vep_dequeue()` - such as one triggered by a host-side `usbip attach` - dereferences a null pointer and produces a kernel oops, denying service to the guest system. A local attacker with low privileges on a system configured for USB/IP with FunctionFS AIO endpoints can reliably reproduce this crash. No public exploit code exists, and EPSS at 0.22% (13th percentile) confirms the path has not seen meaningful exploitation despite the bug reportedly existing for approximately ten years since Linux 4.7.
Sensitive cryptographic key material handled by the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver was unconditionally emitted to the kernel ring buffer via unguarded hex-dump calls in *_setkey() and gen_split_key(), exposing raw key bytes to any local user with dmesg access on kernels built with CONFIG_DYNAMIC_DEBUG. The exposure affects NXP CAAM-equipped platforms (i.MX, QorIQ SoC families) running kernel versions from approximately 5.3 through the fix commits across all active stable branches. No public exploit code exists and EPSS probability is 0.22%, but key material disclosure on a crypto-accelerator driver carries genuine confidentiality risk that the vendor-assigned CVSS (C:N/I:N/A:H) incorrectly characterizes - the real primary impact is confidentiality loss, not availability.
Silent error propagation in the Linux kernel's CTR_DRBG implementation (`drbg_ctr_generate()`) causes the function to return a success code while leaving its output buffer uninitialized when an internal operation fails. Code that relies on the generated random material receives garbage data, which can trigger kernel crashes or hangs depending on how the uninitialized buffer is consumed downstream. No public exploit has been identified; patched stable kernel releases are available across all active longterm-support branches.
Division-by-zero and arithmetic underflow flaws in the Linux kernel's elan_i2c touchpad driver cause kernel panic during device probe on systems equipped with Elan I2C touchpad hardware. When device firmware or device tree supplies zero values for x_traces or y_traces, the driver performs an unguarded integer division by zero, crashing the kernel. A secondary arithmetic underflow causes the input subsystem to report a massively incorrect touch width value to userspace when physical device dimensions fall below a hardcoded threshold. No public exploit exists and EPSS is 0.22% (13th percentile), reflecting the hardware-specific, limited-scope nature of this flaw.
Kernel panic risk in the Linux gpio-sch driver exposes PREEMPT_RT systems with legacy Intel SCH GPIO hardware to a local denial of service. The SCH IRQ unmask callback acquires a regular spinlock inside a non-sleepable IRQ-setup context; under PREEMPT_RT, that spinlock is reimplemented as a sleeping lock, triggering a lockdep BUG and potential kernel panic. Patches are available across all active stable branches (5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.39, 7.1.4); no public exploit exists and EPSS is 0.21% (percentile 12%).
Kernel availability loss in the Linux mm/shrinker subsystem allows a local user with debugfs access to trigger a kernel BUG by reading the debugfs 'count' file of a memcg-aware shrinker such as zswap. The shrinker_debugfs_count_show() function incorrectly holds rcu_read_lock() while invoking ->count_objects() callbacks; when zswap's callback attempts to flush memcg stats via css_rstat_flush(), it sleeps inside an RCU read-side critical section - a fatal kernel invariant violation. No public exploit has been identified at time of analysis, and EPSS is very low at 0.21% (12th percentile).
Kernel panic via NULL pointer dereference in the Linux kernel's memory shrinker debugfs interface allows a local attacker to crash the system. The shrinker_debugfs_add() function unconditionally creates 'count' and 'scan' debugfs files for all registered shrinkers, but some shrinkers - notably the xen-backend shrinker - only implement one of the two required callbacks (count_objects or scan_objects). Writing to the exposed 'scan' debugfs file on such a shrinker dispatches through a NULL function pointer, triggering a kernel panic. No public exploit has been identified at time of analysis, and EPSS score of 0.21% reflects low exploitation probability. Patches are available across multiple stable kernel branches.
Denial of service in the Linux kernel btmtksdio (MediaTek Bluetooth SDIO) driver allows a local attacker with low privileges to permanently hang the Bluetooth stack by triggering an infinite loop in btmtksdio_txrx_work(). The root cause is an inverted timeout logic: a misused time_is_before_jiffies() call, combined via OR, causes the worker loop's exit condition to become unconditionally true after the 5-second timeout fires, so the loop never terminates and never releases the SDIO host. No public exploit has been identified at time of analysis; however, the bug can also trigger organically under hardware stress conditions.
NULL pointer dereference in the Linux kernel Bluetooth HCI connection handler crashes the kernel when aborting a pending connection while `hdev->sent_cmd` is NULL but `req_status` remains `HCI_REQ_PEND`. Local users with Bluetooth access can trigger a general protection fault from the `hci_rx_work()` receive path, producing a kernel panic and denying service to all users on the affected system. No public exploit has been identified and EPSS probability stands at 0.21% (12th percentile), indicating very limited real-world exploitation likelihood.
Device reference count leak in the Linux kernel's firmware_loader subsystem exposes systems to local denial-of-service conditions. Specifically, firmware_upload_register() fails to call put_device() on the fw_dev pointer when alloc_lookup_fw_priv() fails after fw_create_instance() has already called device_initialize(), leaving the embedded struct device reference count unbalanced and potentially preventing proper memory cleanup. Discovered via static analysis and confirmed by manual code review, the issue is patched across multiple stable kernel branches including 6.1.178, 6.6.145, 6.12.96, 6.18.39, and 7.1.4. No public exploit exists and no active exploitation has been observed.
Memory exhaustion in the Linux kernel's USB CDNSP host controller driver allows local users to trigger a kernel-level memory leak by forcing partial allocation failures in `cdnsp_alloc_stream_info()`. Systems running Linux 5.12 through unpatched stable branches accumulate unreleased `stream_ctx_array` allocations that are never freed, eventually causing availability impact on hosts with CDNSP USB hardware. No public exploit exists, EPSS stands at 0.21%, and the vulnerability carries no confidentiality or integrity impact per the CVSS vector.
Reference count leak in the Linux kernel USB gadget printer driver (f_printer) allows a local user to trigger a permanent kref increment on every rejected concurrent open attempt. Each call to printer_open() that returns -EBUSY still increments dev->kref, but because VFS never invokes ->release() for a failed open, the reference is never balanced. Repeated exploitation exhausts the reference counter, preventing proper driver teardown and causing availability degradation. No public exploit has been identified at time of analysis.
The keyspan_pda USB-serial driver in the Linux kernel transmits kernel memory beyond the tty write buffer to an attached USB device due to an incorrect write() return value introduced with write FIFO support. After commit 034e38e8f687, the driver returns the byte count submitted to the USB device rather than the count accepted from the caller; the TTY line discipline interprets this inflated count as authorization to advance its read pointer past the buffer boundary, exposing adjacent kernel memory. Affected stable trees span Linux 5.15 through 7.1 and the 7.2-rc3 development branch, with patches released across all maintained stable series; no public exploit or active exploitation is confirmed, and EPSS is 0.21% (12th percentile).
Reference count leak in the Linux kernel's SCMI regulator driver can exhaust kernel memory resources, leading to a denial-of-service condition on affected systems. The flaw resides in scmi_regulator_probe(), where of_find_node_by_name() acquires a reference on a device-tree node but the corresponding of_node_put() release call is omitted on the error path when process_scmi_regulator_of_node() fails, permanently leaking the reference. Exploitation requires local access; no public exploit code has been identified and EPSS probability stands at 0.21%, indicating very low likelihood of opportunistic exploitation.
Null pointer dereference in the Linux kernel module decompression path crashes the kernel when a local user loads a compressed module under memory pressure. The flaw exists across multiple stable kernel branches and was introduced at commit b1ae6dc41eaa; patches are now available for all affected stable trees. No active exploitation confirmed (not in CISA KEV), and EPSS at 0.21% (12th percentile) reflects very low exploitation probability, consistent with the local-only, condition-dependent attack surface.
NULL pointer dereference in the Linux kernel's swap cgroup subsystem (`mm/swap_cgroup.c`) causes a kernel panic and full system crash on swapless hosts running kernel versions after commit `bea67dcc5eea`. The batched PTE zap path introduced by that commit calls `lookup_swap_cgroup_id()` without validating the swap entry against `swap_info[]`, so any process exit involving a PTE corrupted into a type-0 swap entry dereferences the uninitialized `ctrl->map` pointer and takes the host down. The crash pattern was confirmed in production on kernel 6.12.58 and independently reproduced by syzbot; no public exploit exists, but the kernel teardown path is deterministically vulnerable once the prerequisite conditions are present.
Softlockup in the Linux kernel's swap memory reclaim path allows a local user to trigger a kernel panic by generating heavy swap pressure on systems with large swap devices. The swap_reclaim_full_clusters() function, called from a kworker context, iterates through potentially thousands of full swap clusters without yielding the CPU via cond_resched(), starving the scheduler and eventually causing the kernel watchdog timer to fire. The vulnerability was confirmed in a real-world stress test on a 320-CPU arm64 machine with ~1TB RAM and an 8.6GB swap device, resulting in a kernel panic. No public exploit code exists and EPSS is very low (0.21%, 11th percentile).
NULL pointer dereference in the Linux kernel's Bluetooth ISO subsystem can crash the kernel when a race condition is triggered during PA-sync broadcast sink socket operations. The flaw exists in iso_conn_big_sync(), which drops the socket lock to call hci_get_route() and then re-acquires it without re-validating that the connection structure is still intact - allowing concurrent teardown events (iso_disconn_cfm → iso_conn_del → iso_chan_del) to null out iso_pi(sk)->conn before it is dereferenced. A local low-privileged user with access to Bluetooth ISO sockets can reliably crash the kernel, resulting in a denial of service. No public exploit code has been identified and no active exploitation is confirmed.
Unconditional invocation of cancel_work_sync() in the mtk-jpeg media driver's release path triggers spurious WARN_ON kernel warnings on non-multicore MediaTek JPEG codec platforms where the workqueue callback pointer is NULL. Systems running affected Linux kernel versions (6.6.140-6.18.38, 7.0.4) on MediaTek SoC hardware may experience kernel log pollution or, on kernels compiled with CONFIG_PANIC_ON_WARN=y, a full system denial of service when the JPEG device is released. No public exploit has been identified and no active exploitation is recorded; this is a stability and correctness fix with strictly local trigger conditions.
Integer overflow in the Linux kernel's XFS filesystem exchmaps reservation logic allows a local low-privileged user to crash the system. The bug in xfs_exchmaps_estimate_overhead() adds bmbt and rmapbt overhead to a local resblks variable but then performs the UINT_MAX guard check against the original req->resblks value - the pre-overhead figure - before writing the inflated value back into req->resblks for use in xfs_trans_alloc(). This means the guard intended to prevent integer truncation when the reservation is cast to unsigned int is rendered ineffective, enabling a kernel panic on XFS systems where exchmaps overhead pushes the reservation past UINT_MAX. No public exploit exists and EPSS is 0.21%, placing this firmly in the kernel stability/bug-fix category rather than active threat landscape.
Kernel memory leak in the Linux USB gadget FunctionFS (f_fs) subsystem allows a local low-privileged user to slowly exhaust kernel memory by repeatedly triggering DMA buffer transfers via the ffs_dmabuf_transfer() code path. Affected kernels span from the commit introducing DMA buffer sharing (7b07a2a7ca02) through versions prior to 6.12.96, 7.1.4, and 7.2-rc3. The root cause is a missing dma_fence_put() call after dma_resv_add_fence(), leaving the initial kref permanently outstanding and causing ffs_dma_fence objects to accumulate without ever being freed. No public exploit has been identified at time of analysis.
The USB gadget FunctionFS (f_fs) subsystem in the Linux kernel fails to initialize the endpoint direction field (epfile->in) until USB host connection, leaving it zero when userspace performs early DMA ioctl calls such as FUNCTIONFS_DMABUF_ATTACH before a host connects. This incorrect DMA direction causes kernel-mode availability loss - crashes or hangs - on systems actively using FunctionFS-based USB gadgets with DMABUF. No public exploit has been identified, and EPSS probability stands at 0.21% (11th percentile), reflecting very low opportunistic exploitation risk.
The block device layer in Linux Kernel hangs indefinitely during NVMe surprise removal when `bdev_mark_dead()` is called with `surprise=true`, because a missing guard causes `sync_blockdev()` to be invoked on an already-dead device, permanently blocking `folio_wait_writeback()`. Triggered via `nvme_reset_work()` I/O-queues-lost path, the bug wedges the NVMe reset worker and every task waiting on it, requiring a system reboot to recover. Discovered by FuzzNvme (syzkaller + FEMU fuzzing framework); no public exploit identified at time of analysis.
Reference count leak in the Linux kernel NVMe-oF target RDMA subsystem causes local denial of service on affected storage servers. When nvmet_rdma_queue_connect() calls nvmet_rdma_find_get_device() and the host queue backlog is exceeded (NVME_SC_CONNECT_CTRL_BUSY), the kref acquired by kref_get() is never released via the put_device cleanup path. Repeated triggering of this code path by a local low-privileged process causes progressive resource exhaustion, ultimately rendering the affected device unreclaimable and degrading availability. No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile).
Incorrect idmap handling in the Linux kernel memory management subsystem causes `owner_or_capable()` checks inside `mincore()` and `madvise(MADV_PAGEOUT)` to use the identity no-op mount idmap (`nop_mnt_idmap`) rather than the actual mount's idmap, producing incorrect ownership evaluations on idmapped mounts. Local users with low privileges on Linux 5.12+ systems configured with idmapped mounts may trigger incorrect authorization decisions that deny legitimate memory management operations, with the most impactful edge case occurring on 0444 files where neither the idmap check nor the fallback `file_permission(MAY_WRITE)` path succeeds. No public exploit is known and EPSS is 0.21% (11th percentile), reflecting minimal real-world exploitation risk despite the Linux kernel's ubiquitous deployment footprint.
Unbounded cache invalidation parameters in the Linux kernel iommufd subsystem allow a local low-privileged user to pin a CPU indefinitely or trigger a soft-lockup watchdog fault, resulting in a kernel denial of service. The iommufd_hwpt_invalidate() ioctl accepts user-supplied entry_len and entry_num values bounded only by U32_MAX, enabling an uninterruptible gigabyte-scale memory scan or a no-reschedule VT-d flush loop. No public exploit has been identified and EPSS stands at 0.21% (11th percentile); the vulnerability is not listed in CISA KEV, indicating low active exploitation pressure.
XFS filesystem quota iteration in the Linux kernel wraps a 32-bit quota ID back to zero when a disk quota entry (dquot) exists at XFS_DQ_ID_MAX, producing an infinite loop and local denial of service. Systems running Linux 6.8 and later with XFS quotas enabled are vulnerable if a dquot is present at the maximum 32-bit ID boundary (0xFFFFFFFF). No active exploitation has been identified; patched releases 6.12.96, 6.18.39, 7.1.4, and 7.2-rc4 are available from the kernel stable tree.
Resource exhaustion via file reference leak in the Linux kernel's io_uring NOP opcode handler allows a local, low-privileged user to gradually exhaust kernel memory. The flaw occurs when a NOP submission carries the generic IOSQE_FIXED_FILE sqe flag (setting REQ_F_FIXED_FILE) but omits the NOP-specific IORING_NOP_FIXED_FILE flag in nop_flags: io_nop() acquires a real file reference via io_file_get_normal(), yet io_put_file() skips releasing it because REQ_F_FIXED_FILE is set, producing one leaked 176-byte kernel file object per operation. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
The Linux kernel BPF verifier incorrectly elides null-check requirements for inner array map lookups when the BPF_F_INNER_MAP flag is set, allowing a local attacker with BPF program loading privileges to trigger a null pointer dereference and crash the kernel. The flaw arises because the verifier uses the inner map template's max_entries for bounds reasoning at verification time, while the runtime helper operates against a concrete inner map that may have a larger max_entries value. A crafted BPF program exploiting the faulty nullness elision can cause a kernel denial of service. No public exploit code has been identified at time of analysis, and EPSS is low at 0.21%.