Use-after-free in the Linux kernel AMD IOMMU driver allows a local low-privileged attacker on multi-CPU AMD systems to corrupt kernel memory by exploiting a logical race in `iommu_completion_wait()`. The `need_sync` flag was read locklessly, enabling a CPU to return without waiting for hardware IOMMU command completion while another CPU's page-table pages are freed - leaving the IOMMU walking stale, potentially freed memory. No public exploit exists and EPSS is 0.20% (10th percentile), but successful exploitation on AMD virtualization infrastructure could cross IOMMU isolation boundaries affecting co-tenant VMs.
QRTR (Qualcomm IPC Router) socket namespace isolation is completely absent in the Linux kernel, allowing a local user with low privileges to cross network namespace boundaries by invoking unshare(CLONE_NEWUSER | CLONE_NEWNET) and opening an AF_QIPCRTR socket in the resulting namespace. The attacker can then send QRTR datagrams - including control-plane messages such as QRTR_TYPE_NEW_SERVER - to QRTR services in the host or initial namespace, where those messages are indistinguishable from legitimate traffic because they appear to originate from node id 1. No public exploit has been identified at time of analysis, and EPSS probability is low at 0.20%, but the CVSS 8.8 score with scope change reflects the complete breakdown of the kernel's namespace isolation guarantee for QRTR IPC.
GPU Shared Virtual Memory (SVM) page mapping in the Linux kernel's drm/gpusvm subsystem leaks device mappings when a partial page-acquisition operation fails mid-sequence, leaving IOMMU-level mappings orphaned and unrecoverable through the normal cleanup path. Local users with GPU access on affected kernels - ranging from the introduction of drm/gpusvm through Linux 6.18 and 7.1 stable series - can trigger the condition by causing a later page in a batch to fail with -EOPNOTSUPP when ctx->allow_mixed is false, bypassing device_unmap() in __drm_gpusvm_unmap_pages(). No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, though NVD assigns a CVSS of 8.8 due to potential changed-scope impact on GPU/IOMMU mappings.
Cross-site request forgery in FreePBX Framework 17.0 permits an unauthenticated remote attacker to execute arbitrary administrative operations against the telephony platform by forging requests on behalf of a logged-in administrator. The root cause is the complete absence of CSRF token validation in the BMO Ajax dispatcher (`Ajax.class.php`), whose sole defence - a Referer header check - is trivially bypassed by suppressing the header or exploiting same-site request semantics. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score reflects the full confidentiality, integrity, and availability impact achievable through forged admin-level AJAX operations.
Integer overflow in the Linux kernel's drm/amdgpu VCE (Video Codec Engine) driver enables local low-privileged users on systems with AMD GPU hardware to corrupt GPU memory. Crafted VCE command streams containing extreme image dimensions such as 65536×65536 pixels trigger a 32-bit arithmetic overflow, collapsing the computed buffer size to zero, which bypasses bounds validation and permits the GPU firmware to perform out-of-bounds memory access with scope-change implications rated CVSS 8.8. No public exploit code has been identified and EPSS stands at 0.18% (7th percentile), indicating low real-world exploitation activity; the high score reflects the full-impact scope change to GPU firmware memory rather than immediate internet-facing risk.
Resource mismanagement in the Linux kernel Wacom HID driver leaves hardware running after failed initialization, creating a potential use-after-free condition in kernel memory. Affects a broad range of stable Linux kernel branches from 4.19 through 6.8, requiring a Wacom HID device and a specific probe failure to trigger. Despite a CVSS score of 8.8, EPSS sits at 0.18% (7th percentile) and no public exploit exists; the vulnerability was discovered via static analysis, not active exploitation.
FireWire network driver in the Linux kernel contains a linked-list boundary confusion flaw in `fwnet_frag_new()` that mishandles fragment reassembly at list edges, potentially enabling kernel memory corruption by adjacent-network attackers. Systems with the `firewire-net` module loaded are exposed to unauthenticated attackers sharing the same IEEE 1394 bus who can send crafted fragmented datagrams to trigger the defect. No public exploit exists and EPSS sits at 0.18% (7th percentile), but the CVSS 8.8 vector reflects high potential impact if type confusion against the list head leads to arbitrary kernel memory access.
Use-after-free in the Linux kernel's ath6kl WiFi driver exposes systems with Atheros WiFi hardware to potential kernel memory corruption via a timer-callback race condition. The vulnerable `aggr_reset_state()` function calls non-synchronous `timer_delete()`, leaving a window in which the `aggr_timeout` callback continues accessing `aggr_conn->rx_tid[]` and `aggr_conn->stat[]` after those structures are freed by `aggr_module_destroy()`. Vendor-released patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.42, 7.1.6, 7.2-rc5), no public exploit has been identified, and EPSS stands at 0.18%, reflecting low observed exploitation activity.
Cross-namespace privilege escalation in the Linux kernel GENEVE tunnel driver allows a locally authenticated attacker holding CAP_NET_ADMIN in a device network namespace to reconfigure the tunnel's underlay sockets in a separate, more privileged network namespace where they hold no such capability. Affected are kernels from version 4.14 through current stable branches prior to 7.1.6, 6.18.42, 6.12.101, and 6.6.148. With the Changed scope confirmed by NVD's CVSS vector (S:C, C:H/I:H/A:H), an attacker can redirect or disrupt overlay tunnel traffic crossing namespace boundaries; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Use-after-free in the Linux kernel's IUCV (Inter-User Communication Vehicle) networking subsystem exposes IBM z/VM mainframe guests to kernel memory corruption via a malicious peer. When a remote peer severs an IUCV connection, the kernel frees the iucv_path object but leaves raw, non-reference-counted pointers to it in the pending message notification queue; a subsequent recvmsg() call dereferences the freed memory, enabling heap corruption with full confidentiality, integrity, and availability impact. The vulnerability has existed since kernel 2.6.24, carries no public exploit code, and has not been added to CISA KEV, with EPSS at 0.18% reflecting its narrow IBM mainframe deployment scope.
Out-of-bounds bitmap write in the Linux kernel's Intel ICE SR-IOV driver allows a malicious Virtual Function guest to crash the host kernel or potentially escalate privileges to the host. The vulnerable function ice_parser_profile_init unconditionally passes caller-controlled ptype values from VIRTCHNL_OP_ADD_RSS_CFG into set_bit() against a statically sized 1024-bit bitmap, permitting a value such as 0xffff to write beyond the bitmap boundary and trigger a kernel NULL pointer dereference. No public exploit code has been identified and EPSS exploitation probability is low at 0.18%, but the CVSS 8.8 score and confirmed crash reproducibility signal real urgency for SR-IOV multi-tenant environments where stable-branch patches are already available.
Use-after-free race condition in the Linux kernel AF_IUCV HiperSockets receive path allows a network-adjacent unauthenticated attacker to dereference freed kernel memory, potentially achieving kernel code execution and full system compromise. The flaw exclusively affects IBM z/Architecture (mainframe) systems running Linux under z/VM with the AF_IUCV subsystem active, making the exploitable population extremely narrow. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), consistent with the niche deployment context; patched stable kernel releases are available across multiple branches.
Use-after-free in the Linux kernel Bluetooth hci_qca driver allows an attacker within Bluetooth radio range to corrupt kernel heap memory by inducing a Qualcomm Atheros QCA controller to report a zero-length memory dump. Systems running unpatched kernels prior to 6.6.148, 6.12.101, 6.18.42, or 7.1.6 with QCA Bluetooth hardware are exposed, with potential impact spanning kernel information disclosure, memory corruption, and denial of service. No public exploit code has been identified at time of analysis, and EPSS probability is very low at 0.17% (6th percentile), indicating no evidence of active or widespread exploitation.
Slab-out-of-bounds read and integer underflow in the Linux kernel mwifiex wifi driver's uAP event handler allow a malicious or malfunctioning Marvell WiFi device (USB/SDIO/PCIe) to leak kernel slab memory or trigger a kernel panic on a host running in AP mode. The firmware-supplied event->len field in EVENT_UAP_STA_ASSOC is never validated before being used to compute assoc_req_ies_len, enabling an attacker who controls device firmware to walk cfg80211_find_ie() past the fixed event_body buffer into adjacent slab objects, or to produce a massive size_t that copies stale kernel bytes into NL80211_CMD_NEW_STATION notifications. No active exploitation has been confirmed (not in CISA KEV) and EPSS places exploitation probability at the 6th percentile, though the CVSS 8.8 base score reflects potential for complete confidentiality and availability compromise against affected configurations.
Time-of-check to time-of-use (TOCTOU) race condition in the Linux kernel's AMDGPU VCN4 video encoder driver allows a local low-privileged user with GPU device access to corrupt the IB (Indirect Buffer) parameter length between driver reads, potentially achieving out-of-bounds kernel memory access. Affected systems must run AMD RDNA3-class GPU hardware; the official CVSS 3.1 score of 8.8 with scope change (S:C) and High C/I/A ratings implies a local privilege escalation path to kernel level. No public exploit code has been identified and EPSS is 0.17% (6th percentile), indicating low real-world exploitation activity despite the high theoretical severity.
Kernel memory corruption via out-of-bounds ACE dedup walk in the Linux kernel's ksmbd SMB server subsystem exposes any network-reachable Linux host running ksmbd to high-impact compromise with only low-privilege SMB authentication. When set_ntacl_dacl() terminates ACE copying early due to a size-accounting overflow, set_posix_acl_entries_dacl() continues iterating using the original inflated nt_num_aces count rather than the count of ACEs actually copied, causing the dedup walk to scan into uninitialized buffer tail memory. No public exploit or CISA KEV entry exists at time of analysis, and EPSS remains low at 0.17%, but the patch is available across multiple stable kernel branches and should be applied promptly on any ksmbd-enabled deployment.
Out-of-bounds memory read in the Linux kernel's ksmbd (in-kernel SMB server) allows authenticated network attackers to trigger kernel memory disclosure via a crafted NT ACL. The flaw resides in set_ntacl_dacl(), which validates sid.num_subauth before copying an ACE but fails to verify the declared ACE size can contain all declared SID sub-authorities, permitting undersized ACEs through. The subsequent POSIX ACL deduplication walk then reads beyond the copied ACE's legitimate boundary. No active exploitation is confirmed (not in CISA KEV), and the EPSS probability is 0.17% (6th percentile), indicating low real-world exploitation activity at time of analysis.
Use-after-free race condition in the Linux kernel mac80211 MLO (Multi-Link Operation) link removal path allows an adjacent-network attacker to trigger kernel memory corruption on WiFi 7-capable systems. The flaw exists because sta_remove_link() immediately frees the percpu RX stats buffer while deferring only the link container to RCU, leaving the kernel's fast RX path able to dereference the freed percpu block via a stale link_sta pointer. No public exploit code exists and EPSS is 0.17% (6th percentile), consistent with the kernel commit description's own characterization of the race window as 'hard to win in practice,' though a successful exploit would carry full kernel-level impact.
Use-after-free in the Linux kernel Bluetooth HCI synchronization layer (hci_sync) allows adjacent, unauthenticated attackers to corrupt kernel memory, potentially achieving full system compromise. The root cause is that RCU-protected conn_hash lookup results were dereferenced outside RCU critical sections without holding a reference count, permitting concurrent deletion to free the connection object while it is still in use. With a CVSS score of 8.8 (AV:A), exploitation requires only Bluetooth adjacency and no privileges; however, the EPSS score of 0.17% (6th percentile) and absence from CISA KEV indicate no confirmed active exploitation or public weaponized exploit at time of analysis.
Stored XSS in the Advanced Excerpt WordPress plugin before 4.5 permits administrators - critically including those without the `unfiltered_html` capability, such as site-level admins in WordPress multisite deployments - to inject persistent JavaScript payloads via unsanitized plugin settings, which then execute silently in every visitor's browser on affected pages. A publicly available proof-of-concept exists per WPScan's disclosure (EUVD-2026-55021), though EPSS remains very low at 0.16% (6th percentile) and the vulnerability is not confirmed in CISA KEV. The primary risk surface is WordPress multisite environments, where this plugin's settings bypass the platform-level capability restriction that normally prevents restricted admins from injecting raw HTML.
Use-after-free in the Linux kernel tracing subsystem exposes kernel memory to corruption when event trigger data is freed asynchronously by a kthread while a concurrent tracepoint handler still holds a reference. Affected are Linux 6.19 and kernel versions containing commit 61d445af0a7c but lacking the fixes at b9c8a1400a3b or 79097812153b. A local attacker with sufficient privilege to configure kernel tracing triggers could exploit this race condition to achieve kernel memory corruption, potentially enabling privilege escalation. No public exploit has been identified at time of analysis, and EPSS of 0.16% (6th percentile) reflects minimal exploitation activity despite the high CVSS score.
Missing mutex protection in the Linux kernel's Bluetooth HCI synchronization layer creates a race condition when hci_conn_params_lookup is called without holding hdev->lock, enabling unsafe concurrent list iteration and parameter access at kernel level. All Linux kernel builds spanning commit c530569adc19b5f0c62955de41f067bad34e3fe0 up to the respective fix commits are affected when the Bluetooth subsystem is active. An adjacent, unauthenticated attacker within Bluetooth radio range could exploit this race window to achieve kernel-level memory corruption, information disclosure, or potentially arbitrary code execution. No public exploit or active exploitation (CISA KEV) has been identified; EPSS at 0.15% (5th percentile) reflects low current weaponization despite the elevated CVSS base score.
OAuth token hijacking in the Salon Booking System WordPress plugin (through 10.30.33) allows unauthenticated remote attackers to overwrite the site's stored Google Calendar connection credentials with attacker-controlled OAuth tokens, fully hijacking the calendar integration. Exploitation requires the target site to have independently configured a Google OAuth client for the calendar sync feature, limiting the exposed population. No public exploit has reached CISA KEV status, but a publicly available proof-of-concept was published by WPScan, and EPSS remains low at 0.14% (3rd percentile), consistent with a niche plugin requiring a non-default configuration. The primary consequence is persistent integrity and availability disruption of the booking-calendar workflow, with a secondary confidentiality risk if future appointment data is synced to the attacker's Google account.
Enabled telnet services on the Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums expose a network-accessible shell interface that authenticated low-privilege users can leverage to log into the device. Rooted in CWE-489 (Active Debug Code), the telnet daemon was never disabled before shipping production firmware, leaving a legacy unencrypted remote access protocol open on the device. Reported by JPCERT/CC with a CVSS 4.0 score of 8.7, no public exploit code or CISA KEV listing has been identified, though the network-accessible nature and low attack complexity represent meaningful risk in home and SMB environments.
Unauthenticated remote access to a production-enabled debug web server on Ecovacs DEEBOT PRO M1 and K1VAC robot vacuums exposes sensitive floor map data and operational logs to any network-reachable attacker. The flaw (CWE-489: Active Debug Code) means the devices ship with a debugging HTTP interface left enabled, serving home layout and usage data without any authentication gate. No active exploitation has been confirmed and no public exploit exists, but the CVSS 4.0 score of 8.7 reflects the high real-world privacy impact of floor plan exposure - a detailed map of a victim's home interior.
Shell command injection in Dokploy exposes the underlying host OS to arbitrary command execution by any authenticated user with Compose service edit permissions. The flaw is in the sanitizeCommand function within packages/server/src/utils/builders/compose.ts, which stripped only whitespace and surrounding quotes before interpolating user-supplied compose.command values into live shell invocations such as docker ${command} - leaving semicolons, pipe operators, backticks, and subshell substitutions entirely intact. Working exploit payloads (semicolons, $(subshell), pipes, backtick substitution) are publicly available in the fix PR test suite at https://github.com/Dokploy/dokploy/pull/4863; no CISA KEV listing exists at time of analysis, and the vendor-confirmed patch is available in v0.29.13.
Overprivileged ClusterRole assignments in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) create a cluster-wide privilege escalation path if the operator pod is compromised. The DSPO ClusterRole grants capabilities well beyond operational necessity - including pod exec and cluster-wide RBAC management - directly violating the principle of least privilege (CWE-250). Successful exploitation of a compromised DSPO pod would allow an attacker to assume full administrative control over the entire Kubernetes cluster; no public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS scope-change flag (S:C) confirms the blast radius extends far beyond the initial compromise boundary.
TBEA TLogger V2.1.0.0B0.0.0.0 (Communication Box 3rd Generation) exposes an unauthenticated HTTP PUT endpoint at /tmp/ that allows any remote attacker to permanently write attacker-controlled files to the device's filesystem under /opt/myapp/webserver/. Because the web server attempts to move these files into a non-existent directory, cleanup never occurs, and repeated requests exhaust available storage and cause a denial-of-service condition. No public exploit has been identified at time of analysis, but the attack requires only network reachability and no credentials, making exploitation trivially automatable.
OS command injection in Dokploy before 0.29.13 allows any authenticated user with application access to execute arbitrary commands on the Dokploy host by supplying malicious values for customGitUrl or customGitBranch and triggering a deployment. The cloneGitRepository function in packages/server/src/utils/providers/git.ts interpolates these user-controlled parameters directly into shell commands passed to execAsync or execAsyncRemote without any quoting or escaping. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the attack class is trivially weaponizable and a confirmed patch is available in v0.29.13.
OS command injection in Dokploy prior to version 0.29.13 allows any authenticated user with project write access to execute arbitrary commands as the Dokploy server process. The buildRemoteDocker() function in packages/server/src/utils/providers/docker.ts interpolates the user-controlled dockerImage field directly into a shell command passed to execAsync() without sanitization. The same unsanitized interpolation pattern was present across three separate build pipeline files, indicating a systemic rather than isolated flaw. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Privilege escalation in Roskus Prospero Flow CRM before version 5.2.1 permits any authenticated user - regardless of assigned role - to grant any application role the complete set of system permissions by sending a crafted POST request to the permission save endpoint. The vulnerable `PermissionSaveController` accepted a user-supplied `roles` array and invoked Spatie Permission's `syncPermissions()` with no prior authorization check, making low-trust authenticated accounts a direct path to full administrative control. No public exploit or CISA KEV listing has been identified at time of analysis, but the publicly accessible commit diff documents the exact endpoint and flaw mechanism, substantially lowering the exploitation barrier for any attacker holding CRM credentials.
Stored cross-site scripting in Discourse's Chat plugin allows an authenticated user to inject arbitrary HTML and JavaScript into any viewer's browser session by embedding a malicious payload in the username field of a chat-transcript quote block. The Rich Text Editor rendered the username attribute via `innerHTML` without sanitization, meaning any authenticated Discourse member with chat access could craft a quote block that executes attacker-controlled script when a victim - potentially a moderator or administrator - views the transcript. Patch versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 are confirmed released; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Authentication bypass in TP-Link Aginet home mesh networking devices allows an adjacent-network attacker without credentials to invoke privileged management operations and gain full administrative control of the device. The flaw (CWE-862, Missing Authorization) stems from inconsistent enforcement of access control checks on specific web management interface endpoints - certain privileged API handlers accept and act on requests without verifying caller identity. The vulnerability affects over 60 distinct model/region/hardware-revision combinations across the HB, HX, EX, HC, VX, and XX Aginet product lines; no public exploit code or CISA KEV listing is identified at time of analysis, but the vendor has released firmware patches.
Cryptographic signature validation failure in Pega Platform (Pega Infinity) versions 8.5.0 through 25.1.2 enables low-privileged network attackers to forge or manipulate JWT tokens, bypassing authentication and authorization controls. The vulnerability maps to CWE-347 and is tagged as a JWT attack vector capable of authentication bypass, with high confidentiality and integrity impact confirmed in the vendor's own CVSS 4.0 assessment. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this a meaningful risk for any organization running affected Pega Infinity deployments.
OS command injection in TP-Link Aginet home networking devices (HB, EB, EX, XX, VX series) allows an authenticated attacker on the same network segment to execute arbitrary operating system commands with elevated privileges through unsanitized web interface inputs. The attack vector is adjacent-network only (AV:A per CVSS 4.0), limiting internet-scale exploitation, but a compromised or malicious LAN/Wi-Fi client could fully compromise the affected device. No public exploit code or CISA KEV listing has been identified at time of analysis; TP-Link has released patched firmware across all affected product lines.
Unauthenticated SSRF in duhow/xiaoai-patch (all versions through commit fb07049) allows any remote attacker to force the Xiaomi XiaoAI smart speaker's API server to issue HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py blindly accepts a user-supplied url POST parameter to redirect toward a Home Assistant instance without destination validation, enabling internal network scanning and access to internal services from the speaker's network vantage point. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Cross-tenant IDOR in Prospero Flow CRM before 5.4.8 allows any authenticated user to blindly overwrite contact records belonging to other companies and exfiltrate their personal data as vCard files, simply by supplying an arbitrary numeric contact ID. The contact save and vCard export endpoints performed no company-scoping on their database queries, so a user authenticated to Company A could tamper with or harvest contacts owned by Company B without any special knowledge beyond a valid integer identifier. No public exploit or CISA KEV listing has been identified at time of analysis, but the vulnerability is trivially exploitable in any multi-tenant deployment and the full fix has been released as v5.4.8 (and later v5.5.3).
Privilege escalation across more than 60 TP-Link Aginet mesh networking device models allows authenticated low-privileged users to invoke administrative operations - including creating privileged accounts and modifying critical configuration settings - by exploiting insufficient authorization validation (CWE-863). The flaw spans the HB, HX, EX, HC, EB, XX, VX, and XC device families in US, EU, BR, AU, CA, KR, DE, and RU regional variants, with specific vulnerable firmware builds documented per device in ENISA EUVD-2025-210674. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available at the TP-Link advisory.
Authorization bypass in Feast's materialization API endpoints within Red Hat OpenShift AI (RHOAI) permits full re-materialization of all feature views by sending a crafted request that omits the feature_views field, circumventing permission checks. The consequence is a multi-tenant Denial of Service through data corruption and significant resource exhaustion, impacting all tenants sharing the deployment. No public exploit code has been identified at time of analysis, but the bypass mechanism is straightforward - a structural omission in the request body - making independent rediscovery likely for any attacker with API access.
Hardcoded cryptographic keys embedded in TP-Link Aginet firmware expose sensitive configuration data to any attacker who gains access to device storage. Affecting over 70 distinct hardware SKUs across the HB, HX, HC, EB, EC, EX, XX, XC, and VX product families, the static keys are identical across all devices sharing a firmware image, meaning key material extracted from one device - or from a publicly downloadable firmware image - decrypts configuration stores on any other device of the same model. Successful exploitation yields plaintext credentials and service configuration, and no public exploit has been identified at time of analysis. TP-Link has released patched firmware for all affected models.
Insufficient source identity validation in Red Hat Multicluster Global Hub's manager component allows a network-adjacent attacker who has compromised a managed hub to impersonate any other hub on the shared Kafka status bus. By presenting a legitimately obtained Kafka client certificate from the compromised hub while falsifying the CloudEvent source field, the attacker can overwrite or delete compliance records, inventory data, and cluster health telemetry belonging to sibling hubs in the shared database. No public exploit has been identified at time of analysis, but the scope-changed CVSS vector (S:C) reflects that the integrity impact extends beyond the initially compromised hub to the entire multi-hub management plane.
Cross-organization server deletion and SSH key disclosure in Dokploy affects all instances running versions 0.28.7 through 0.29.12. The server.remove tRPC mutation accepts a caller-supplied serverId without verifying organizational ownership, allowing an authenticated owner or administrator in one organization to delete server registrations and all associated deployment records belonging to a completely separate organization - and to receive that organization's plaintext SSH private key as a side effect. No public exploit code has been identified at time of analysis, but the fix is available in version 0.29.13 and the GitHub advisory (GHSA-3rpx-c3j9-q99x) and patch PR are public.
Reference count underflow in the Linux kernel's USB MUSB OMAP2430 driver exposes systems built on Texas Instruments OMAP2430 SoCs to potential use-after-free conditions in kernel memory, with theoretical impact spanning privilege escalation and system crash. The flaw in omap2430_probe() calls of_node_put() on a borrowed platform device OF node that was never reference-counted by the probe function, leaving pdev->dev.of_node with an unbalanced count that can trigger premature freeing. No public exploit exists and EPSS exploitation probability stands at 0.20% (10th percentile), consistent with the extremely narrow hardware attack surface; this vulnerability is not listed in CISA KEV.
Mutex unlock imbalance in the Linux kernel's Nitro Security Module (NSM) ioctl handler allows a local process to corrupt kernel locking state by supplying an invalid user pointer to NSM_IOCTL_RAW. The `nsm_dev_ioctl()` function's pre-lock `copy_from_user()` failure path incorrectly reaches the shared `out` label, which unconditionally calls `mutex_unlock()` on a mutex that was never acquired - triggering a bad-unlock-balance condition confirmed by Lockdep. Systems running AWS Nitro Enclaves on affected kernel versions are exposed; no public weaponized exploit exists but a functional PoC triggering the Lockdep warning is documented in the upstream commit itself, and EPSS sits at 0.20% (10th percentile), indicating no widespread exploitation observed to date.
ACL cache state corruption in the Linux kernel's FUSE filesystem driver allows a local low-privileged attacker to receive stale POSIX ACL values from get_acl(), potentially bypassing access controls on files. The flaw resides in forget_cached_acl(), which can silently overwrite the ACL_DONT_CACHE sentinel for FUSE mounts where the userspace server has not negotiated FUSE_POSIX_ACL, re-enabling caching that the filesystem explicitly opted out of. No public exploit exists and EPSS sits at 0.18% (7th percentile), but the CVSS 8.4 score reflects high confidentiality and integrity impact from ACL policy bypass under specific FUSE configurations.
Secure-world heap corruption in OP-TEE OS through 4.10.0 allows a malicious Trusted Application to write attacker-controlled data before a destination buffer in S-EL1 memory via RSA NOPAD encrypt and decrypt operations. The flaw exists in both the mbedTLS software cryptographic backend and the NXP SE050 hardware driver: when the caller supplies an input length exceeding the RSA modulus size, an unsigned integer underflow in the size subtraction produces a huge value, causing a subsequent memcpy to write well before the intended destination buffer in the secure-world heap. No public exploit has been identified at time of analysis; the upstream fix is available at commit 7b8b494 in the OP-TEE GitHub repository.
Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local attackers to execute arbitrary code on affected Samsung Mobile Devices prior to SMR Aug-2026 Release 1. The CVSS 4.0 vector (AV:L/PR:H) confirms exploitation requires established local access with high privileges, limiting the realistic attacker pool to already-compromised or insider-threat scenarios. No public exploit code or CISA KEV listing has been identified at time of analysis.
Kernel-heap buffer overflow in Zephyr RTOS's DTLS socket layer allows a low-privileged user thread to write up to 31 bytes past an attacker-controlled heap allocation in the kernel. The root cause is that tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c forwarded a caller-supplied optval buffer to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (32) bytes, while the syscall verifier in CONFIG_USERSPACE builds allocated exactly optlen bytes for the bounce buffer. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
DLL hijacking in the LINE for Windows installer (LineInst.exe) enables arbitrary code execution when a victim runs the installer after an attacker has pre-positioned a malicious Msftedit.dll in the same directory. All LINE for Windows versions prior to 26.4.0 load this Microsoft Rich Edit control library via a relative path, bypassing Windows secure DLL loading practices and allowing the installer's current directory - commonly a user-writable location such as Downloads - to shadow the legitimate System32 copy. No public exploit code has been identified and no active exploitation has been confirmed; the vulnerability is transient, existing only during the installation phase and not in the running application.
Use-after-free in the OP-TEE OS Trusted Application loader (all versions through 4.10.0) allows an attacker who controls a signed Trusted Application to corrupt S-EL1 secure-world kernel memory. By setting TA_FLAG_CONCURRENT in the TA's signed header - a flag reserved exclusively for pseudo-TAs - an adversary can force two concurrent sessions to share a context without locking, triggering a race on uctx->vm_info.regions that frees vm_region nodes still referenced by live mappings. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the high CVSS 4.0 score of 8.4 and confirmed patch availability underscore its seriousness in TEE-dependent deployments.