Stack-based buffer overflow in the Linux kernel's SCTP subsystem corrupts adjacent kernel memory when SCTP authentication is configured with four HMAC identifiers, enabling a remote unauthenticated attacker to achieve high-impact memory corruption via a crafted SCTP packet exchange. Affected kernels span from 2.6.24 through current stable branches, with patches backported to 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4. No public exploit code or CISA KEV listing has been identified; the EPSS score of 0.17% reflects the high exploitation complexity imposed by the required SCTP authentication configuration.
Out-of-bounds kernel memory read in the at76c50x-usb WiFi driver affects Linux systems equipped with Atmel AT76C50x USB wireless adapters. When the kernel scans for networks, a truncated beacon or probe response frame between 24 and 35 bytes triggers an integer underflow in at76_guess_freq(): subtracting the fixed management-body offset (el_off = 36) from a shorter frame length wraps the unsigned value to near UINT_MAX, which is then passed to cfg80211_find_elem_match(), causing a walk far beyond the RX socket buffer boundary with consequences ranging from kernel memory disclosure to system crash. With an EPSS of 0.17% (6th percentile) and no CISA KEV listing, no public exploit identified at time of analysis, though the AV:A/PR:N vector means any adjacent attacker can trigger the condition without authentication during routine scanning.
Out-of-bounds heap read in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated network attacker to disclose approximately 1 KB of kernel heap memory at an attacker-controlled offset and potentially crash the ksmbd service or host kernel. The flaw resides in set_ntacl_dacl(), which copies ACEs from a previously stored attacker-controlled security descriptor without validating sid.num_subauth against the fixed SID_MAX_SUB_AUTHORITIES (15) array bound, enabling a crafted num_subauth value of up to 255 to drive a sub_auth[] array overread. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authentication bypass in TrustyAI Service (TAS) within Red Hat OpenShift AI (RHOAI) exposes the backend API to any pod on the cluster network without requiring valid credentials. The CVSS vector (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that an attacker with a pod on the cluster-such as through a compromised workload or a malicious tenant pod in a multi-tenant deployment-can read, modify, delete, or poison AI model monitoring data and configurations with no additional barriers. No public exploit code or CISA KEV listing has been identified at time of analysis, but the root cause (CWE-306: Missing Authentication for Critical Function) means exploitation is trivially simple once cluster network adjacency is established.
Race condition and state management bug in the Linux kernel Bluetooth HCI UART driver (hci_uart) allows an adjacent attacker with low privileges to block all future writes to a Bluetooth UART device after it is closed and reopened, with potential for kernel memory corruption via an unsafely cleared tx_skb pointer. Affected versions span multiple stable branches from 5.10.x through 6.18.x. No public exploit has been identified at time of analysis and EPSS is very low (0.17%), though the CVSS score of 8.0 with high C/I/A impact signals potential for use-after-free conditions beyond pure denial of service.
Source list corruption in the Linux kernel's VXLAN Multicast Database (MDB) subsystem can be triggered by a local low-privileged user during a failed MDB remote entry replace operation, silently corrupting multicast forwarding state across affected kernel branches. The logic flaw in vxlan_mdb_remote_srcs_add() incorrectly tears down pre-existing (S,G) source entries during an error rollback, rather than restricting the rollback to entries added during the current failed call. EXCLUDE-mode multicast filters subsequently forward traffic that should be blocked, and INCLUDE-mode filters drop traffic that should be forwarded; no public exploit is identified at time of analysis.
Heap overflow in GIMP's Seattle Filmworks file loader allows an attacker who tricks a user into opening a specially crafted SFW file to write several kilobytes of attacker-controlled data beyond the intended buffer, resulting in memory corruption that can lead to arbitrary code execution or denial of service. Affected platforms confirmed via CPE data are Red Hat Enterprise Linux 6 through 9 with GIMP installed. No public exploit code has been identified and this CVE is not listed in CISA's KEV catalog, but the high CVSS 7.8 score reflects the full confidentiality, integrity, and availability impact achievable once a victim is socially engineered into opening the malicious file.
Race condition in the Linux kernel net/packet subsystem allows a local low-privileged attacker to re-register a fanout protocol hook after its associated network device has been unregistered, potentially corrupting kernel state and achieving privilege escalation. Affected systems are those running unpatched kernel versions prior to the stable-branch fixes across the 6.6, 6.12, 6.18, 7.1, and 7.2 release trees. No public exploit code and no CISA KEV listing exist at time of analysis, and the EPSS score of 0.21% (11th percentile) reflects low current exploitation activity.
Out-of-bounds memory access in the Linux kernel's NXP i.MX8 ISI (Image Sensing Interface) media driver enables a local low-privileged attacker to corrupt kernel memory or freeze the system, with CVSS-assessed high impact across confidentiality, integrity, and availability. The flaw stems from missing minimum-value validation on the hardware downscaling factor - the ISI supports up to 16x downscaling, but no floor check is enforced before writing values to hardware registers, resulting in invalid hardware state and a kernel-level process freeze that survives Ctrl+C. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), reflecting the hardware-specific nature of the attack surface.
Buffer leakage in the Linux kernel's pwc (Philips WebCam) driver allows a local low-privileged user to corrupt kernel memory state when start_streaming() fails along two specific error paths: USB device disconnection (-ENODEV) and signal-interrupted mutex acquisition (-ERESTARTSYS). The vb2 videobuf2 framework transfers buffer ownership to the driver before invoking start_streaming(), but the pwc driver's error paths failed to return those buffers via vb2_buffer_done(), triggering WARN_ON(owned_by_drv_count) and leaving kernel buffers in an unreturned, leaked state. No public exploit or CISA KEV entry exists; EPSS is 0.21% (11th percentile), reflecting minimal active exploitation interest, though the CVSS C:H/I:H/A:H scoring reflects the potential severity of kernel-level memory corruption.
Buffer leak in the Linux kernel's rtl2832_sdr media driver allows a local low-privileged user with access to an RTL2832-based SDR device to trigger kernel memory corruption by causing start_streaming() to fail, leaving vb2 framework buffers unreturned and firing WARN_ON(owned_by_drv_count). Affected are Linux kernels from 3.15 through multiple stable branches prior to 6.6.148, 6.12.101, 6.18.42, and 7.1.6. No public exploit has been identified at time of analysis and EPSS is 0.21% (11th percentile), but the kernel-level memory corruption potential under C:H/I:H/A:H CVSS rating indicates a realistic local privilege escalation risk for systems with SDR hardware attached.
Improper error-path cleanup in the Linux kernel STM32 DCMI driver leaves a V4L2 async notifier registered against kernel structures that may be freed or reused after a failed probe, creating a use-after-free condition. Systems running a vulnerable kernel with STM32 DCMI hardware where reset_control_assert() or reset_control_deassert() returns an error during driver initialization are susceptible to kernel memory corruption or crashes. No public exploit has been identified and EPSS sits at the 11th percentile, but CVSS rates the impact as High across confidentiality, integrity, and availability when the specific failure condition is met.
Buffer leak in the Linux kernel's sun4i-csi camera driver (Allwinner SoC Camera Sensor Interface) allows a local attacker with low-privilege access to the V4L2 camera interface to exhaust kernel memory by repeatedly triggering start_streaming() failure with an unsupported CSI format. The vb2 framework hands buffers to the driver before calling start_streaming(); when that call returns -EINVAL on the early format-validation path, those buffers are never returned via vb2_buffer_done(), leaking kernel memory and triggering WARN_ON(owned_by_drv_count). No public exploit exists and EPSS stands at 0.21% (11th percentile), indicating negligible real-world exploitation interest; the NVD-assigned C:H/I:H/A:H impact appears overstated relative to the actual error-path memory leak primitive.
Unvalidated HEVC active reference counts in the Linux kernel's V4L2 common control path allow a local low-privileged user to trigger out-of-bounds kernel memory access on systems equipped with stateless HEVC hardware decoders. Affected kernels from the introduction of stateless HEVC support (approximately 5.14) through to the patch commits fail to check that num_active_dpb_entries values fall within valid bounds before driver-specific code (Cedrus, Hantro, etc.) consumes them. No active exploitation is confirmed - EPSS stands at 0.21% (11th percentile) and the vulnerability is not listed in CISA KEV - but patched stable releases are available across all maintained kernel branches.
Memory corruption in the Linux kernel's vivid virtual video driver arises from missing vb2_is_busy() guards when toggling CROP, COMPOSE, and SCALE capability controls, exploitable by local low-privileged users in the window between VIDIOC_REQBUFS and VIDIOC_STREAMON ioctls. The affected vivid_update_format_cap/out() functions can overwrite video queue format parameters on an already-allocated buffer queue, yielding kernel-level corruption with high confidentiality, integrity, and availability impact as reflected in the CVSS 7.8 score. No public exploit identified at time of analysis; EPSS is 0.21% (11th percentile), though the issue was surfaced by the syzbot automated kernel fuzzer and confirmed by upstream maintainers.
Use-after-free in the Linux kernel ALSA MIDI sequencer subsystem enables local privilege escalation by any unprivileged user with access to /dev/snd/seq, requiring no capabilities or queue ownership. The flaw stems from a race window during queue deletion where a concurrent thread can re-open a queue timer after it has been closed but before the queue is freed, leaving a stale callback pointer that the global timer subsequently dereferences on the next tick. No public exploit has been identified and EPSS is 0.21% (11th percentile), but the attack surface is broad given how widely ALSA seq is deployed across Linux desktop and development systems.
Use-after-free in the Linux kernel ALSA timer subsystem allows a local low-privileged attacker to corrupt kernel memory by exploiting a race condition during master-slave timer instance teardown. When a master timer closes, slave callback draining is skipped, causing the slave struct to be freed while its callback executes in parallel - a classic UAF primitive with potential for local privilege escalation. EPSS is low at 0.21% (11th percentile), no KEV listing exists, and no public exploit code has been identified at time of analysis, but patched stable kernel releases are available.
Use-after-free in the Linux kernel ALSA timer subsystem allows a local unprivileged user to corrupt kernel memory and potentially escalate privileges. The flaw resides in the userspace-driven timer (utimer) path: the in-flight callback state is tracked by a single bit that cannot represent two concurrent callbacks, so racing two TRIGGER ioctls against the same utimer frees the instance while a second callback is still executing against that memory. The vulnerability is reachable by any user who can open /dev/snd/timer, including via sequencer queue timers bound to a utimer; no public exploit code has been identified and EPSS probability is low at 0.21%.
Race condition in the Linux kernel's CAN raw socket subsystem allows a local low-privileged user to trigger concurrent read-modify-write operations on the raw flags bitfield, potentially leading to kernel memory corruption and local privilege escalation. Introduced by commit 890e5198a6e5, which consolidated separate integer flags into a single bitfield in struct raw_sock without adequate locking in raw_setsockopt(), any concurrent call path can race to produce inconsistent flag state. No public exploit code has been identified and EPSS sits at the 11th percentile, indicating low current exploitation probability despite the high CVSS base score.
Use-after-free in the Linux kernel SCTP subsystem exposes a race condition during network namespace teardown, enabling a local low-privileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw stems from a lifecycle misalignment between per-net SCTP sysctl registration and the SCTP control socket: an open sysctl file descriptor targeting a network namespace can survive into teardown, causing proc_sctp_do_auth() to dereference an already-freed control socket. No public exploit has been identified at time of analysis; EPSS is 0.21% (11th percentile), consistent with the timing complexity required for successful exploitation.
NULL pointer dereference in the Linux kernel's drm/imagination PowerVR GPU driver allows a local attacker with low privileges to crash the kernel or potentially exploit kernel memory corruption. The vulnerability stems from pvr_vm_map() failing to acquire vm_ctx->lock before performing GPU virtual memory mapping operations, enabling a concurrent drm_gpuva_find() call to dereference a NULL pointer at kernel address offset 0x10 when map and find operations race. No public exploit code or confirmed active exploitation exists; vendor-released patches are available across multiple stable kernel branches as of Linux 6.12.101, 7.1.6, and 6.18.42.
Use-after-unlock memory corruption in the Linux kernel's DRM/AMDGPU driver allows local low-privileged users on systems with AMD GPUs to read or corrupt kernel memory via the `amdgpu_vm_get_task_info_pasid()` function. The defect stems from a lock lifetime design flaw: a `vm` pointer obtained under XArray lock is dereferenced after `xa_unlock_irqrestore` releases that lock, leaving the pointer unprotected against concurrent modification. No public exploit code has been identified and EPSS is very low (0.20%, 10th percentile), but the CVSS-rated impact is High across Confidentiality, Integrity, and Availability, and vendor patches are available across multiple stable branches.
Race condition in the chips-media Wave5 video encoder driver of the Linux kernel corrupts the V4L2 M2M ready queue linked list, enabling local privilege escalation. The IRQ handler returns a source buffer to userspace via v4l2_m2m_buf_done before removing it from the ready queue; if userspace re-queues that buffer before start_encode cleans up the index, __list_add creates a self-referential loop that __list_del cannot resolve, poisoning kernel list pointers. A low-privileged local user on a system with Wave5 hardware can trigger kernel memory corruption, leading to a crash or potential escalation to root. No public exploit has been identified at time of analysis, and EPSS at 0.20% reflects very low near-term weaponization probability.
Use-after-free in the Linux kernel Bluetooth HCI sync subsystem allows a local low-privileged attacker to corrupt kernel memory, with potential for privilege escalation and full system compromise. The flaw is a race condition between the hci_sync async command work (holding hdev->req_lock) and Bluetooth management socket operations (add_uuid/remove_uuid, which operate under hdev->lock), enabling concurrent unsafe UUID list access confirmed by KASAN. No public exploit code exists and EPSS is 0.20% (10th percentile), but the high C/I/A CVSS impact reflects the severity of kernel-level memory corruption if the race is won.
Use-after-unload code execution in the Linux kernel's NSM (Nitro Security Module) misc device allows a local attacker with low privileges to call into freed kernel module text, potentially achieving full kernel compromise. The NSM driver fails to set nsm_dev_fops.owner to THIS_MODULE, meaning misc_open() never increments the module reference count when /dev/nsm is opened. When the nsm module is subsequently unloaded while a file descriptor remains open, a later ioctl through that descriptor jumps into unmapped or reallocated memory. No public exploit code or CISA KEV listing exists, and EPSS sits at 0.20% (10th percentile), reflecting limited real-world exploitation risk at this time.
Silent data corruption in the Linux kernel's airoha NPU mailbox driver affects EN7581-based systems (Cortex-A53 without hardware DMA cache coherency) when NPU response data is read back through a CPU cache that was never invalidated. The driver's airoha_npu_send_msg() function maps buffers exclusively as DMA_TO_DEVICE, causing dma_unmap_single() to skip cache invalidation on non-coherent architectures - so CPU reads of NPU-written responses observe stale cached values rather than actual NPU output. The CVSS 7.8 score reflects high confidentiality, integrity, and availability impact for local low-privilege users; however, hardware specificity and timing sensitivity keep real-world exploitation likelihood low (EPSS 0.20%, 10th percentile), and no public exploit or CISA KEV listing exists.
Memory corruption in the Linux kernel's mm/page_vma_mapped subsystem allows a local low-privileged attacker to trigger kernel memory corruption, potentially leading to privilege escalation or system crash. The flaw stems from incomplete handling of device-private PMD entries in the rmap walk code: when PVMW_MIGRATION is set, the caller incorrectly interprets a device-private PMD entry as a migration entry, producing undefined behavior. No public exploit has been identified at time of analysis, and EPSS at 0.20% (10th percentile) indicates low current exploitation interest, but the high CVSS 7.8 with full C/I/A impact reflects the severity of kernel memory corruption.
Heap buffer overflow in the Linux kernel's Intel Xe GPU DRM driver (drm/xe/guc) corrupts kernel slab memory during device unbind, creating a local privilege escalation path on systems hosting Intel Xe/Arc discrete GPUs with compute-only DSS hardware units. The root cause is a mismatch between the steered register extarray allocation size - derived solely from the geometry DSS mask - and the fill loop, which iterates over the union of geometry and compute DSS masks, writing past the allocated region on affected hardware configurations. Vendor-released patches are available in kernel versions 6.18.44, 7.1.6, and 7.2-rc1; no public exploit code or CISA KEV listing exists at time of analysis.
A race condition in the Linux kernel's cfg80211 wifi subsystem exposes systems to kernel memory corruption by a local, low-privilege user. The flaw exists between the NETLINK_URELEASE notification path and the NETDEV_GOING_DOWN cancellation path for the wireless device autodisconnect work item: because the work is a plain work_struct, it can be re-queued after cancellation and outlive the wdev structure it references, since synchronize_net() does not drain work queued by in-flight RCU readers. Upstream fix commits are available on kernel.org stable trees, and no public exploit or CISA KEV listing has been identified at time of analysis.
LoongArch BPF JIT in the Linux kernel incorrectly sign-extends results of signed ALU32 division and modulo operations (off=1), leaving bits 63:32 set in JIT-compiled code while the verifier and interpreter model those bits as zero. This JIT-verifier semantic divergence affects low-privileged local users on LoongArch systems who can load BPF programs, and may be leveraged via crafted eBPF programs to violate verifier-enforced memory safety invariants, potentially enabling privilege escalation. EPSS is low at 0.19% (9th percentile), no public exploit is confirmed at time of analysis, and patches are available in Linux 7.1.6 and upstream commit dacd348b8a99.
Use-after-free in the Linux kernel tracing subsystem's enable_event trigger mechanism allows a local attacker to dereference freed module memory by racing module unloading against an active tracepoint trigger. Affected kernel versions span from commit 61d445af0a7c70018111919e47beaaee15653f2f up to the fix commits on stable branches; patched releases 7.1.6 and 7.2-rc5 are available. No public exploit is identified and EPSS is 0.19% (9th percentile), but the CVSS-rated impact is full compromise of confidentiality, integrity, and availability at the kernel level.
Buffer overflow in the Intel i915 HDCP subsystem of the Linux kernel allows a local, low-privileged user to corrupt kernel memory with potential privilege escalation to full system compromise. The bounds check on the `data->streams[]` array write executes after the overrun has already occurred, meaning any caller who can trigger this code path can write past the array boundary before the kernel detects the violation. Discovered via AI-assisted static analysis and confirmed by Intel Product Security; no public exploit exists and EPSS probability is 0.18%, indicating no observed exploitation at time of analysis.
Race conditions in the Linux kernel's drm/xe Virtual Function CCS state management expose Intel Xe GPU SR-IOV environments to local privilege escalation, information disclosure, and memory corruption. The driver's buffer object move operations improperly sequence CCS batch buffer attach and detach relative to in-flight copy jobs, creating two distinct timing windows where a VF migration event can observe partially-copied or already-torn-down CCS metadata. No CISA KEV listing or public proof-of-concept exists at time of analysis, and EPSS of 0.18% (8th percentile) reflects negligible observed exploitation activity; the primary exposure surface is cloud and VDI infrastructure using Intel Xe GPUs with SR-IOV enabled.
Race condition in the Linux kernel's dummy_hcd USB gadget driver corrupts a shared kernel request object's function pointer mid-callback, enabling a local low-privilege attacker on a multi-CPU system to redirect kernel execution and achieve privilege escalation. The vulnerable component is the FIFO fast-path in dummy_queue(), which reuses a single shared fifo_req before its completion callback has returned, allowing a concurrent CPU to overwrite the req->complete pointer while dummy_timer is actively invoking it - causing a general protection fault or page fault in kernel context. A syzkaller reproducer is documented (extid faf3a6cf579fc65591ca), but no public exploit or CISA KEV listing exists; EPSS sits at 0.18%, indicating very low observed exploitation activity.
Use-after-free in the Linux kernel RDS (Reliable Datagram Sockets) subsystem allows a local user with the ability to create unprivileged network namespaces to trigger memory corruption leading to privilege escalation. The flaw stems from rds_find_bound() performing socket lookups in a global hash table without accounting for network namespace boundaries, enabling a cross-namespace message delivery race condition where a freed rds_connection object is subsequently dereferenced. Two dangerous dereference sites have been KASAN-confirmed, including a function pointer call-through that constitutes a potential code execution primitive. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Use-after-free in the Linux kernel's BPF sockmap subsystem allows a local low-privileged attacker to corrupt kernel slab memory via a race condition in tcp_bpf_sendmsg(), potentially escalating privileges to root. The vulnerability arises because the error path in tcp_bpf_sendmsg() uses a stale msg_tx pointer to decide whether to free a shared cork object - a decision that becomes unsafe once a second thread has already freed it during the window when the socket lock is released by sk_stream_wait_memory(). No public exploit has been identified at time of analysis and EPSS is 0.18%, though KASAN telemetry in the disclosure confirms the bug was reproduced by the reporter.
Use-after-free and NULL pointer dereference vulnerabilities in the Linux kernel's amdgpu DRM driver allow a local authenticated user to corrupt kernel memory during GPU context initialization. The flaws stem from `amdgpu_ctx_init()` failing to acquire `adev->pm.stable_pstate_ctx_lock`, enabling a race between context initialization and concurrent sysfs pstate modifications, alongside a logic error where context finalization incorrectly restores pstate even when ownership has transferred to sysfs. CVSS rates this 7.8 (High), though EPSS at 0.18% (7th percentile) and absence from CISA KEV indicate no confirmed active exploitation at time of analysis.
Use-after-free in the Linux kernel's drm/xe Intel Xe GPU driver allows a local low-privileged user to trigger kernel memory corruption with potential for full system compromise (C:H/I:H/A:H). The bug arises because an imported dma-buf buffer object (BO) is created with its reservation object (resv) pointing to the exporter's dma_buf->resv before the importer acquires a reference on that dma-buf - leaving a window in which the exporter can be freed while the TTM workqueue asynchronously accesses the now-dangling pointer. Vendor-released patches are available for Linux 6.12.103, 6.18.42, and 7.1.6; no public exploit has been identified at time of analysis.
Out-of-bounds write and use-after-free in the Intel Xe GPU DRM driver (drm/xe/pt) allows a local low-privileged attacker to corrupt kernel heap memory and crash or potentially escalate privileges on systems running affected Linux kernel versions. The flaw exists in xe_pt_update_ops_init(), which fails to reset current_op, needs_svm_lock, and needs_invalidation before each pass, causing unbounded counter growth across drm_exec retry loops triggered by lock contention or OOM eviction. No public exploit code exists and EPSS is extremely low (0.18%), though the memory corruption primitive is structurally serious.
Integer overflow in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user on systems with multi-die AMD GPUs to trigger an undersized CWSR save-area allocation that AMD firmware subsequently overruns, enabling kernel heap corruption with full confidentiality, integrity, and availability impact. Affected stable branches include all kernel versions before 6.12.101, 6.18.42, and 7.1.6, with patches released across all trees. No public exploit code or active exploitation has been identified; EPSS at 0.18% (7th percentile) reflects very low near-term exploitation probability.
Buffer management failures in the Linux kernel msi2500 USB SDR driver allow a local low-privileged user to cause kernel memory corruption through improperly handled start_streaming() error paths. Five distinct failure paths in msi2500_start_streaming() - including USB disconnection, mutex interruption, USB ADC setup failure, isoc initialization failure, and CMD_START_STREAMING failure - neglect to return queued vb2 buffers to the framework before returning errors, and the worst path leaves submitted isochronous URBs with no consumer. Patched stable releases are available (6.6.148, 6.12.101, 6.18.42, 7.1.6), no public exploit exists, and EPSS is 0.18% (7th percentile), indicating low current exploitation probability.
Use-after-free in the Linux kernel's AMT (Automatic Multicast Tunneling) driver allows a local attacker to trigger kernel memory corruption or a system crash through a race condition introduced during AMT device removal. The flaw arises because amt_dev_stop() uses cancel_delayed_work_sync() to cancel req_wq and discovery_wq, but event_wq can re-schedule req_wq after that cancellation completes yet before the netdev is freed - leaving delayed work items that dereference the already-released amt_dev structure. Upstream patches are confirmed available in stable kernel releases 6.12.101, 6.18.42, and 7.1.6; no public exploit has been identified at time of analysis.
Use-after-free in the Linux kernel fscrypt subsystem allows a local low-privileged user to potentially escalate privileges or corrupt kernel memory on systems running f2fs with inline encryption. The flaw surfaces in fscrypt_destroy_inline_crypt_key() during inode eviction under direct memory reclaim: when the dynamic heap allocation inside fscrypt_get_devices() fails under memory pressure, the function skips the mandatory blk_crypto_evict_key() call and immediately frees the blk_crypto_key structure while block device drivers still hold references to it. No public exploit code exists and EPSS is 0.18% (7th percentile), but the underlying kernel use-after-free primitive carries serious privilege-escalation potential on affected configurations; patches are available across multiple stable branches.
Out-of-bounds kernel heap write in the Linux kernel iomap subsystem allows a local unprivileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw resides in ifs_set_range_dirty() and ifs_set_range_uptodate(), where an unsigned integer underflow on a zero-length range argument produces a near-SIZE_MAX block count, causing bitmap_set() to write arbitrarily far beyond the ifs->state allocation. The reachable code path through __iomap_write_end() requires no special configuration and affects all iomap-backed filesystems (ext4, XFS, etc.). EPSS is low at 0.18% (7th percentile), no KEV listing, and no public exploit has been identified; however, the C:H/I:H/A:H CVSS impact profile reflects the severity of uncontrolled kernel heap corruption.
Race condition in the Linux kernel's SLIP (Serial Line Internet Protocol) driver allows a local attacker with low privileges to trigger an out-of-bounds write or use-after-free in kernel memory, potentially enabling privilege escalation. The `slip_receive_buf()` callback reads and writes the receive buffer `rbuff` without holding `sl->lock`, while `sl_realloc_bufs()` replaces that buffer under the lock during MTU changes - creating a classic TOCTOU window where an MTU shrink can cause writes beyond the new smaller buffer or into a freed allocation. No confirmed active exploitation exists (not in CISA KEV) and the EPSS score of 0.18% places this in the 7th percentile, though kernel memory corruption of this class carries inherent privilege escalation potential.
Memory corruption in the Linux kernel PPPoE driver allows a local low-privilege attacker to write six bytes through a stale pointer into freed kernel memory, with potential for privilege escalation to root. The flaw exists in pppoe_sendmsg(), which saves a direct pointer to the PPPoE header before calling dev_hard_header() - a callback that may reallocate the socket buffer head, invalidating the saved pointer. This vulnerability is not confirmed actively exploited (not in CISA KEV), no public exploit is known, and EPSS stands at 0.18% (7th percentile); however, patches are available across multiple stable kernel series.
Out-of-bounds memory writes in the Linux kernel's ARM Firmware Framework for Armv8-A (FF-A) driver expose local low-privilege users to kernel memory corruption on affected ARM platforms. Two distinct write-past-end defects exist in ffa_setup_and_transmit(): one triggered when the FFA protocol version is below 1.2 due to a struct size mismatch causing writes beyond allocated memory, and another from missing size validation before writing constituents. Upstream kernel patches are available across multiple stable branches (6.18.42, 7.1.6, 7.2-rc4); no public exploit or active exploitation has been identified at time of analysis, and EPSS probability is very low at 0.17%.
Use-after-free in the Linux kernel's AMD XDNA accelerator driver (amdxdna) exposes systems with AMD NPU hardware to local privilege escalation, kernel memory corruption, or system crash. The flaw exists in the job scheduler path: amdxdna_cmd_submit() stores a raw pointer to the submitting process's mm_struct in job->mm without calling mmgrab() to hold a structural reference, while aie2_sched_job_run() later dereferences that pointer from the DRM worker thread - after the originating process may have exited and freed the mm_struct. No public exploit code has been identified at time of analysis, and the EPSS score of 0.17% (7th percentile) is consistent with specialized hardware prerequisites and no active exploitation campaign.
Use-after-free in the Linux kernel's PPP-over-L2TP subsystem exposes a race condition between softirq RX processing and socket teardown, reachable by an unprivileged local user and capable of yielding full kernel memory corruption and privilege escalation. The pppol2tp_recv() function runs under rcu_read_lock() but dereferences an internal struct channel that close() can free with a plain kfree() when the channel was bound via PPPIOCGCHAN without a subsequent PPPIOCCONNECT, bypassing all RCU grace-period fences. Patches are available across multiple stable kernel branches; no public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV.
Use-after-free in the Linux kernel's Bluetooth MGMT subsystem allows a local attacker with low-privilege Bluetooth Management socket access to corrupt kernel heap memory and potentially escalate privileges to root. The flaw exists in MGMT_OP_LOAD_CONN_PARAM handling, where a borrowed hci_conn_params pointer stored in a queued work item can be freed by a subsequent LOAD_CONN_PARAM call before hci_cmd_sync_work executes the callback - a race-driven use-after-free confirmed by KASAN. No public exploit or active exploitation has been identified at time of analysis; patches are available across stable kernel series 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4.