Out-of-bounds kernel memory read in the Linux kernel's ath6kl WiFi driver exposes systems with Atheros AR600x chipsets to kernel memory disclosure and availability impact via a malicious adjacent-network access point. The ath6kl_wmi_connect_event_rx() function fails to validate firmware-supplied beacon_ie_len, assoc_req_len, and assoc_resp_len fields against the actual WMI event buffer size before parsing 802.11 Information Elements, allowing combined lengths of up to 765 bytes to exceed the buffer boundary and corrupt the wmi->is_wmm_enabled state flag. No public exploit has been identified and the vulnerability is not listed in CISA KEV; EPSS at 0.21% (11th percentile) reflects minimal opportunistic exploitation activity consistent with the niche hardware footprint.
Out-of-bounds read in the Linux kernel wilc1000 WiFi driver exposes devices with Microchip ATWILC1000 chipsets to memory disclosure and potential denial of service when a rogue access point sends a malformed association response shorter than 6 bytes. The driver's wilc_parse_assoc_resp_info() function performs an integer underflow when computing IE length without first validating the frame meets the minimum fixed-header size, causing kmemdup() to attempt copying up to 65534 bytes of out-of-bounds kernel memory. No public exploit code is identified at time of analysis, and EPSS probability sits at 0.21%, though the adjacent-network vector and no-authentication requirement make this exploitable by any attacker within WiFi range acting as a rogue AP.
SQL injection in the Library Management System WordPress plugin (all versions before 3.6.7) allows any user holding a Subscriber role or higher to inject arbitrary SQL into the underlying WordPress database, extracting sensitive records including user password hashes. A publicly available proof-of-concept exploit is confirmed via WPScan. No CISA KEV listing exists and EPSS sits at 0.17% (6th percentile), indicating limited observed automated exploitation, but the low privilege bar and public POC make this a meaningful and urgent patching priority for any affected site.
Insecure Direct Object Reference (IDOR) in the FoodBoxBooker WordPress plugin before 1.0.8 allows any authenticated user - including those with only Subscriber-level access - to overwrite the profile details of any other account on the site, including administrator accounts. The plugin fails to verify that the account being modified belongs to the requesting user, enabling horizontal and vertical privilege abuse without any special configuration. A publicly available proof-of-concept exists; exploitation is not confirmed in CISA KEV but the low barrier to entry makes this a practical account-takeover risk on any affected WordPress site.
Insecure Direct Object Reference (IDOR) in the Salon Booking System WordPress plugin through version 10.30.33 allows any authenticated user - including self-registered subscriber and customer accounts - to enumerate booking identifiers via a REST API endpoint and retrieve personal data belonging to any other customer, including name, email, phone number, physical address, and private appointment notes. The plugin fails to verify that the requested booking belongs to the calling user, requiring only a basic read-level WordPress capability. A publicly available proof-of-concept exists per WPScan disclosure; no active exploitation has been confirmed in CISA KEV at time of analysis.
Insufficiently protected credentials in the Zyxel WAH7601 4G LTE mobile Wi-Fi router expose sensitive embedded data to unauthenticated remote attackers. All firmware versions through 20072026 are affected, and the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial remote exploitation requiring no privileges or user interaction. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the unauthenticated network-accessible nature of the flaw warrants prompt patching.
Cross-namespace authorization bypass in HashiCorp Vault Enterprise's identity entity batch-delete endpoint allows an authenticated low-privileged caller in one namespace to permanently delete the storage backing of identity entities belonging to a completely separate namespace. Affected are all Vault Enterprise versions prior to the patched releases 2.0.4, 1.21.9, 1.20.14, and 1.19.20. No public exploit or CISA KEV listing has been identified at time of analysis, but the destructive, cross-tenant impact makes this a high-priority patch for any multi-namespace Vault Enterprise deployment.
TCP connection disruption in the Linux kernel exposes systems handling SYN-RECEIVED state connections to blind RST injection attacks that bypass RFC 5961 and RFC 9293 challenge ACK protections. The tcp_check_req() function accepts in-window RST segments with non-exact sequence numbers, allowing a remote unauthenticated attacker to abort half-open connections without meeting the exact SEQ match requirement mandated by RFC 9293 section 3.10.7.4. Exploitation probability remains low (EPSS 0.17%, 6th percentile) and no public exploit or KEV listing has been identified, though the CVSS 8.2 score reflects the ease of network access (AV:N/AC:L/PR:N) combined with a high availability impact from connection disruption.
Arbitrary code execution in Red Hat OpenShift AI's trustyai-service-operator enables authenticated cluster users to bypass pod security policies via crafted sidecar container configurations in LMEvalJob resources. The CVSS 8.1 (High) score reflects network-accessible exploitation requiring only low-privilege cluster authentication, with high confidentiality and integrity impact against the affected workload context. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the low barrier of entry (any authenticated cluster user) elevates insider-threat and compromised-account risk for RHOAI deployments.
Path traversal in Tabby terminal emulator (prior to 1.0.235) on Windows allows a malicious SFTP server to write or overwrite arbitrary files outside the user-selected download or temporary edit directory. When a Windows user downloads a folder or opens a remote file for editing, server-supplied filenames containing backslash sequences bypass POSIX path handling in the SSH layer and are later resolved by Windows-native path.join(), enabling directory traversal. No public exploit code has been identified at time of analysis, but the attack requires only a user connecting to an attacker-controlled SFTP server and initiating a download or file-edit operation.
Out-of-bounds kernel memory read in the Linux kernel ath6kl WiFi driver affects systems using Qualcomm Atheros AR6xxx chipsets from kernel 3.2 onward. The firmware-supplied `num_msg` field (a u8 value, range 0-255) governs a loop in `ath6kl_wmi_tx_complete_event_rx()` without any validation against the actual WMI event buffer length, enabling reads of up to 1020 bytes past the buffer boundary. An adjacent-network attacker with no privileges can potentially exploit this to leak sensitive kernel memory contents or trigger a kernel panic - neither CISA KEV listing nor public exploit code has been identified at time of analysis, and EPSS at 0.18% (7th percentile) corroborates low current exploitation activity.
Stack-based buffer overflow in the Linux kernel's SCTP subsystem corrupts adjacent kernel memory when SCTP authentication is configured with four HMAC identifiers, enabling a remote unauthenticated attacker to achieve high-impact memory corruption via a crafted SCTP packet exchange. Affected kernels span from 2.6.24 through current stable branches, with patches backported to 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4. No public exploit code or CISA KEV listing has been identified; the EPSS score of 0.17% reflects the high exploitation complexity imposed by the required SCTP authentication configuration.
Out-of-bounds kernel memory read in the at76c50x-usb WiFi driver affects Linux systems equipped with Atmel AT76C50x USB wireless adapters. When the kernel scans for networks, a truncated beacon or probe response frame between 24 and 35 bytes triggers an integer underflow in at76_guess_freq(): subtracting the fixed management-body offset (el_off = 36) from a shorter frame length wraps the unsigned value to near UINT_MAX, which is then passed to cfg80211_find_elem_match(), causing a walk far beyond the RX socket buffer boundary with consequences ranging from kernel memory disclosure to system crash. With an EPSS of 0.17% (6th percentile) and no CISA KEV listing, no public exploit identified at time of analysis, though the AV:A/PR:N vector means any adjacent attacker can trigger the condition without authentication during routine scanning.
Out-of-bounds heap read in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated network attacker to disclose approximately 1 KB of kernel heap memory at an attacker-controlled offset and potentially crash the ksmbd service or host kernel. The flaw resides in set_ntacl_dacl(), which copies ACEs from a previously stored attacker-controlled security descriptor without validating sid.num_subauth against the fixed SID_MAX_SUB_AUTHORITIES (15) array bound, enabling a crafted num_subauth value of up to 255 to drive a sub_auth[] array overread. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
SQL injection in the vitepos WordPress plugin before version 3.6.0 enables authenticated administrators to exfiltrate database contents via a crafted REST API report request. The vulnerability stems from an unsanitized identifier taken directly from the request body and concatenated into a SQL query, a textbook CWE-89 flaw. A publicly available exploit proof-of-concept exists per WPScan, though no active exploitation is confirmed in CISA KEV and the EPSS score of 0.16% reflects the high authentication bar.
Authentication bypass in TrustyAI Service (TAS) within Red Hat OpenShift AI (RHOAI) exposes the backend API to any pod on the cluster network without requiring valid credentials. The CVSS vector (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that an attacker with a pod on the cluster-such as through a compromised workload or a malicious tenant pod in a multi-tenant deployment-can read, modify, delete, or poison AI model monitoring data and configurations with no additional barriers. No public exploit code or CISA KEV listing has been identified at time of analysis, but the root cause (CWE-306: Missing Authentication for Critical Function) means exploitation is trivially simple once cluster network adjacency is established.
Race condition and state management bug in the Linux kernel Bluetooth HCI UART driver (hci_uart) allows an adjacent attacker with low privileges to block all future writes to a Bluetooth UART device after it is closed and reopened, with potential for kernel memory corruption via an unsafely cleared tx_skb pointer. Affected versions span multiple stable branches from 5.10.x through 6.18.x. No public exploit has been identified at time of analysis and EPSS is very low (0.17%), though the CVSS score of 8.0 with high C/I/A impact signals potential for use-after-free conditions beyond pure denial of service.
Source list corruption in the Linux kernel's VXLAN Multicast Database (MDB) subsystem can be triggered by a local low-privileged user during a failed MDB remote entry replace operation, silently corrupting multicast forwarding state across affected kernel branches. The logic flaw in vxlan_mdb_remote_srcs_add() incorrectly tears down pre-existing (S,G) source entries during an error rollback, rather than restricting the rollback to entries added during the current failed call. EXCLUDE-mode multicast filters subsequently forward traffic that should be blocked, and INCLUDE-mode filters drop traffic that should be forwarded; no public exploit is identified at time of analysis.
Heap overflow in GIMP's Seattle Filmworks file loader allows an attacker who tricks a user into opening a specially crafted SFW file to write several kilobytes of attacker-controlled data beyond the intended buffer, resulting in memory corruption that can lead to arbitrary code execution or denial of service. Affected platforms confirmed via CPE data are Red Hat Enterprise Linux 6 through 9 with GIMP installed. No public exploit code has been identified and this CVE is not listed in CISA's KEV catalog, but the high CVSS 7.8 score reflects the full confidentiality, integrity, and availability impact achievable once a victim is socially engineered into opening the malicious file.
Race condition in the Linux kernel net/packet subsystem allows a local low-privileged attacker to re-register a fanout protocol hook after its associated network device has been unregistered, potentially corrupting kernel state and achieving privilege escalation. Affected systems are those running unpatched kernel versions prior to the stable-branch fixes across the 6.6, 6.12, 6.18, 7.1, and 7.2 release trees. No public exploit code and no CISA KEV listing exist at time of analysis, and the EPSS score of 0.21% (11th percentile) reflects low current exploitation activity.
Out-of-bounds memory access in the Linux kernel's NXP i.MX8 ISI (Image Sensing Interface) media driver enables a local low-privileged attacker to corrupt kernel memory or freeze the system, with CVSS-assessed high impact across confidentiality, integrity, and availability. The flaw stems from missing minimum-value validation on the hardware downscaling factor - the ISI supports up to 16x downscaling, but no floor check is enforced before writing values to hardware registers, resulting in invalid hardware state and a kernel-level process freeze that survives Ctrl+C. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), reflecting the hardware-specific nature of the attack surface.
Buffer leakage in the Linux kernel's pwc (Philips WebCam) driver allows a local low-privileged user to corrupt kernel memory state when start_streaming() fails along two specific error paths: USB device disconnection (-ENODEV) and signal-interrupted mutex acquisition (-ERESTARTSYS). The vb2 videobuf2 framework transfers buffer ownership to the driver before invoking start_streaming(), but the pwc driver's error paths failed to return those buffers via vb2_buffer_done(), triggering WARN_ON(owned_by_drv_count) and leaving kernel buffers in an unreturned, leaked state. No public exploit or CISA KEV entry exists; EPSS is 0.21% (11th percentile), reflecting minimal active exploitation interest, though the CVSS C:H/I:H/A:H scoring reflects the potential severity of kernel-level memory corruption.
Buffer leak in the Linux kernel's rtl2832_sdr media driver allows a local low-privileged user with access to an RTL2832-based SDR device to trigger kernel memory corruption by causing start_streaming() to fail, leaving vb2 framework buffers unreturned and firing WARN_ON(owned_by_drv_count). Affected are Linux kernels from 3.15 through multiple stable branches prior to 6.6.148, 6.12.101, 6.18.42, and 7.1.6. No public exploit has been identified at time of analysis and EPSS is 0.21% (11th percentile), but the kernel-level memory corruption potential under C:H/I:H/A:H CVSS rating indicates a realistic local privilege escalation risk for systems with SDR hardware attached.
Improper error-path cleanup in the Linux kernel STM32 DCMI driver leaves a V4L2 async notifier registered against kernel structures that may be freed or reused after a failed probe, creating a use-after-free condition. Systems running a vulnerable kernel with STM32 DCMI hardware where reset_control_assert() or reset_control_deassert() returns an error during driver initialization are susceptible to kernel memory corruption or crashes. No public exploit has been identified and EPSS sits at the 11th percentile, but CVSS rates the impact as High across confidentiality, integrity, and availability when the specific failure condition is met.
Buffer leak in the Linux kernel's sun4i-csi camera driver (Allwinner SoC Camera Sensor Interface) allows a local attacker with low-privilege access to the V4L2 camera interface to exhaust kernel memory by repeatedly triggering start_streaming() failure with an unsupported CSI format. The vb2 framework hands buffers to the driver before calling start_streaming(); when that call returns -EINVAL on the early format-validation path, those buffers are never returned via vb2_buffer_done(), leaking kernel memory and triggering WARN_ON(owned_by_drv_count). No public exploit exists and EPSS stands at 0.21% (11th percentile), indicating negligible real-world exploitation interest; the NVD-assigned C:H/I:H/A:H impact appears overstated relative to the actual error-path memory leak primitive.
Unvalidated HEVC active reference counts in the Linux kernel's V4L2 common control path allow a local low-privileged user to trigger out-of-bounds kernel memory access on systems equipped with stateless HEVC hardware decoders. Affected kernels from the introduction of stateless HEVC support (approximately 5.14) through to the patch commits fail to check that num_active_dpb_entries values fall within valid bounds before driver-specific code (Cedrus, Hantro, etc.) consumes them. No active exploitation is confirmed - EPSS stands at 0.21% (11th percentile) and the vulnerability is not listed in CISA KEV - but patched stable releases are available across all maintained kernel branches.
Memory corruption in the Linux kernel's vivid virtual video driver arises from missing vb2_is_busy() guards when toggling CROP, COMPOSE, and SCALE capability controls, exploitable by local low-privileged users in the window between VIDIOC_REQBUFS and VIDIOC_STREAMON ioctls. The affected vivid_update_format_cap/out() functions can overwrite video queue format parameters on an already-allocated buffer queue, yielding kernel-level corruption with high confidentiality, integrity, and availability impact as reflected in the CVSS 7.8 score. No public exploit identified at time of analysis; EPSS is 0.21% (11th percentile), though the issue was surfaced by the syzbot automated kernel fuzzer and confirmed by upstream maintainers.
Use-after-free in the Linux kernel ALSA MIDI sequencer subsystem enables local privilege escalation by any unprivileged user with access to /dev/snd/seq, requiring no capabilities or queue ownership. The flaw stems from a race window during queue deletion where a concurrent thread can re-open a queue timer after it has been closed but before the queue is freed, leaving a stale callback pointer that the global timer subsequently dereferences on the next tick. No public exploit has been identified and EPSS is 0.21% (11th percentile), but the attack surface is broad given how widely ALSA seq is deployed across Linux desktop and development systems.
Use-after-free in the Linux kernel ALSA timer subsystem allows a local low-privileged attacker to corrupt kernel memory by exploiting a race condition during master-slave timer instance teardown. When a master timer closes, slave callback draining is skipped, causing the slave struct to be freed while its callback executes in parallel - a classic UAF primitive with potential for local privilege escalation. EPSS is low at 0.21% (11th percentile), no KEV listing exists, and no public exploit code has been identified at time of analysis, but patched stable kernel releases are available.
Use-after-free in the Linux kernel ALSA timer subsystem allows a local unprivileged user to corrupt kernel memory and potentially escalate privileges. The flaw resides in the userspace-driven timer (utimer) path: the in-flight callback state is tracked by a single bit that cannot represent two concurrent callbacks, so racing two TRIGGER ioctls against the same utimer frees the instance while a second callback is still executing against that memory. The vulnerability is reachable by any user who can open /dev/snd/timer, including via sequencer queue timers bound to a utimer; no public exploit code has been identified and EPSS probability is low at 0.21%.
Race condition in the Linux kernel's CAN raw socket subsystem allows a local low-privileged user to trigger concurrent read-modify-write operations on the raw flags bitfield, potentially leading to kernel memory corruption and local privilege escalation. Introduced by commit 890e5198a6e5, which consolidated separate integer flags into a single bitfield in struct raw_sock without adequate locking in raw_setsockopt(), any concurrent call path can race to produce inconsistent flag state. No public exploit code has been identified and EPSS sits at the 11th percentile, indicating low current exploitation probability despite the high CVSS base score.
Use-after-free in the Linux kernel SCTP subsystem exposes a race condition during network namespace teardown, enabling a local low-privileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw stems from a lifecycle misalignment between per-net SCTP sysctl registration and the SCTP control socket: an open sysctl file descriptor targeting a network namespace can survive into teardown, causing proc_sctp_do_auth() to dereference an already-freed control socket. No public exploit has been identified at time of analysis; EPSS is 0.21% (11th percentile), consistent with the timing complexity required for successful exploitation.
NULL pointer dereference in the Linux kernel's drm/imagination PowerVR GPU driver allows a local attacker with low privileges to crash the kernel or potentially exploit kernel memory corruption. The vulnerability stems from pvr_vm_map() failing to acquire vm_ctx->lock before performing GPU virtual memory mapping operations, enabling a concurrent drm_gpuva_find() call to dereference a NULL pointer at kernel address offset 0x10 when map and find operations race. No public exploit code or confirmed active exploitation exists; vendor-released patches are available across multiple stable kernel branches as of Linux 6.12.101, 7.1.6, and 6.18.42.
Use-after-unlock memory corruption in the Linux kernel's DRM/AMDGPU driver allows local low-privileged users on systems with AMD GPUs to read or corrupt kernel memory via the `amdgpu_vm_get_task_info_pasid()` function. The defect stems from a lock lifetime design flaw: a `vm` pointer obtained under XArray lock is dereferenced after `xa_unlock_irqrestore` releases that lock, leaving the pointer unprotected against concurrent modification. No public exploit code has been identified and EPSS is very low (0.20%, 10th percentile), but the CVSS-rated impact is High across Confidentiality, Integrity, and Availability, and vendor patches are available across multiple stable branches.
Race condition in the chips-media Wave5 video encoder driver of the Linux kernel corrupts the V4L2 M2M ready queue linked list, enabling local privilege escalation. The IRQ handler returns a source buffer to userspace via v4l2_m2m_buf_done before removing it from the ready queue; if userspace re-queues that buffer before start_encode cleans up the index, __list_add creates a self-referential loop that __list_del cannot resolve, poisoning kernel list pointers. A low-privileged local user on a system with Wave5 hardware can trigger kernel memory corruption, leading to a crash or potential escalation to root. No public exploit has been identified at time of analysis, and EPSS at 0.20% reflects very low near-term weaponization probability.
Use-after-free in the Linux kernel Bluetooth HCI sync subsystem allows a local low-privileged attacker to corrupt kernel memory, with potential for privilege escalation and full system compromise. The flaw is a race condition between the hci_sync async command work (holding hdev->req_lock) and Bluetooth management socket operations (add_uuid/remove_uuid, which operate under hdev->lock), enabling concurrent unsafe UUID list access confirmed by KASAN. No public exploit code exists and EPSS is 0.20% (10th percentile), but the high C/I/A CVSS impact reflects the severity of kernel-level memory corruption if the race is won.
Use-after-unload code execution in the Linux kernel's NSM (Nitro Security Module) misc device allows a local attacker with low privileges to call into freed kernel module text, potentially achieving full kernel compromise. The NSM driver fails to set nsm_dev_fops.owner to THIS_MODULE, meaning misc_open() never increments the module reference count when /dev/nsm is opened. When the nsm module is subsequently unloaded while a file descriptor remains open, a later ioctl through that descriptor jumps into unmapped or reallocated memory. No public exploit code or CISA KEV listing exists, and EPSS sits at 0.20% (10th percentile), reflecting limited real-world exploitation risk at this time.
Silent data corruption in the Linux kernel's airoha NPU mailbox driver affects EN7581-based systems (Cortex-A53 without hardware DMA cache coherency) when NPU response data is read back through a CPU cache that was never invalidated. The driver's airoha_npu_send_msg() function maps buffers exclusively as DMA_TO_DEVICE, causing dma_unmap_single() to skip cache invalidation on non-coherent architectures - so CPU reads of NPU-written responses observe stale cached values rather than actual NPU output. The CVSS 7.8 score reflects high confidentiality, integrity, and availability impact for local low-privilege users; however, hardware specificity and timing sensitivity keep real-world exploitation likelihood low (EPSS 0.20%, 10th percentile), and no public exploit or CISA KEV listing exists.
Memory corruption in the Linux kernel's mm/page_vma_mapped subsystem allows a local low-privileged attacker to trigger kernel memory corruption, potentially leading to privilege escalation or system crash. The flaw stems from incomplete handling of device-private PMD entries in the rmap walk code: when PVMW_MIGRATION is set, the caller incorrectly interprets a device-private PMD entry as a migration entry, producing undefined behavior. No public exploit has been identified at time of analysis, and EPSS at 0.20% (10th percentile) indicates low current exploitation interest, but the high CVSS 7.8 with full C/I/A impact reflects the severity of kernel memory corruption.
Heap buffer overflow in the Linux kernel's Intel Xe GPU DRM driver (drm/xe/guc) corrupts kernel slab memory during device unbind, creating a local privilege escalation path on systems hosting Intel Xe/Arc discrete GPUs with compute-only DSS hardware units. The root cause is a mismatch between the steered register extarray allocation size - derived solely from the geometry DSS mask - and the fill loop, which iterates over the union of geometry and compute DSS masks, writing past the allocated region on affected hardware configurations. Vendor-released patches are available in kernel versions 6.18.44, 7.1.6, and 7.2-rc1; no public exploit code or CISA KEV listing exists at time of analysis.
A race condition in the Linux kernel's cfg80211 wifi subsystem exposes systems to kernel memory corruption by a local, low-privilege user. The flaw exists between the NETLINK_URELEASE notification path and the NETDEV_GOING_DOWN cancellation path for the wireless device autodisconnect work item: because the work is a plain work_struct, it can be re-queued after cancellation and outlive the wdev structure it references, since synchronize_net() does not drain work queued by in-flight RCU readers. Upstream fix commits are available on kernel.org stable trees, and no public exploit or CISA KEV listing has been identified at time of analysis.
LoongArch BPF JIT in the Linux kernel incorrectly sign-extends results of signed ALU32 division and modulo operations (off=1), leaving bits 63:32 set in JIT-compiled code while the verifier and interpreter model those bits as zero. This JIT-verifier semantic divergence affects low-privileged local users on LoongArch systems who can load BPF programs, and may be leveraged via crafted eBPF programs to violate verifier-enforced memory safety invariants, potentially enabling privilege escalation. EPSS is low at 0.19% (9th percentile), no public exploit is confirmed at time of analysis, and patches are available in Linux 7.1.6 and upstream commit dacd348b8a99.
Use-after-free in the Linux kernel tracing subsystem's enable_event trigger mechanism allows a local attacker to dereference freed module memory by racing module unloading against an active tracepoint trigger. Affected kernel versions span from commit 61d445af0a7c70018111919e47beaaee15653f2f up to the fix commits on stable branches; patched releases 7.1.6 and 7.2-rc5 are available. No public exploit is identified and EPSS is 0.19% (9th percentile), but the CVSS-rated impact is full compromise of confidentiality, integrity, and availability at the kernel level.
Buffer overflow in the Intel i915 HDCP subsystem of the Linux kernel allows a local, low-privileged user to corrupt kernel memory with potential privilege escalation to full system compromise. The bounds check on the `data->streams[]` array write executes after the overrun has already occurred, meaning any caller who can trigger this code path can write past the array boundary before the kernel detects the violation. Discovered via AI-assisted static analysis and confirmed by Intel Product Security; no public exploit exists and EPSS probability is 0.18%, indicating no observed exploitation at time of analysis.
Race conditions in the Linux kernel's drm/xe Virtual Function CCS state management expose Intel Xe GPU SR-IOV environments to local privilege escalation, information disclosure, and memory corruption. The driver's buffer object move operations improperly sequence CCS batch buffer attach and detach relative to in-flight copy jobs, creating two distinct timing windows where a VF migration event can observe partially-copied or already-torn-down CCS metadata. No CISA KEV listing or public proof-of-concept exists at time of analysis, and EPSS of 0.18% (8th percentile) reflects negligible observed exploitation activity; the primary exposure surface is cloud and VDI infrastructure using Intel Xe GPUs with SR-IOV enabled.
Race condition in the Linux kernel's dummy_hcd USB gadget driver corrupts a shared kernel request object's function pointer mid-callback, enabling a local low-privilege attacker on a multi-CPU system to redirect kernel execution and achieve privilege escalation. The vulnerable component is the FIFO fast-path in dummy_queue(), which reuses a single shared fifo_req before its completion callback has returned, allowing a concurrent CPU to overwrite the req->complete pointer while dummy_timer is actively invoking it - causing a general protection fault or page fault in kernel context. A syzkaller reproducer is documented (extid faf3a6cf579fc65591ca), but no public exploit or CISA KEV listing exists; EPSS sits at 0.18%, indicating very low observed exploitation activity.
Use-after-free in the Linux kernel RDS (Reliable Datagram Sockets) subsystem allows a local user with the ability to create unprivileged network namespaces to trigger memory corruption leading to privilege escalation. The flaw stems from rds_find_bound() performing socket lookups in a global hash table without accounting for network namespace boundaries, enabling a cross-namespace message delivery race condition where a freed rds_connection object is subsequently dereferenced. Two dangerous dereference sites have been KASAN-confirmed, including a function pointer call-through that constitutes a potential code execution primitive. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Use-after-free in the Linux kernel's BPF sockmap subsystem allows a local low-privileged attacker to corrupt kernel slab memory via a race condition in tcp_bpf_sendmsg(), potentially escalating privileges to root. The vulnerability arises because the error path in tcp_bpf_sendmsg() uses a stale msg_tx pointer to decide whether to free a shared cork object - a decision that becomes unsafe once a second thread has already freed it during the window when the socket lock is released by sk_stream_wait_memory(). No public exploit has been identified at time of analysis and EPSS is 0.18%, though KASAN telemetry in the disclosure confirms the bug was reproduced by the reporter.
Use-after-free and NULL pointer dereference vulnerabilities in the Linux kernel's amdgpu DRM driver allow a local authenticated user to corrupt kernel memory during GPU context initialization. The flaws stem from `amdgpu_ctx_init()` failing to acquire `adev->pm.stable_pstate_ctx_lock`, enabling a race between context initialization and concurrent sysfs pstate modifications, alongside a logic error where context finalization incorrectly restores pstate even when ownership has transferred to sysfs. CVSS rates this 7.8 (High), though EPSS at 0.18% (7th percentile) and absence from CISA KEV indicate no confirmed active exploitation at time of analysis.
Use-after-free in the Linux kernel's drm/xe Intel Xe GPU driver allows a local low-privileged user to trigger kernel memory corruption with potential for full system compromise (C:H/I:H/A:H). The bug arises because an imported dma-buf buffer object (BO) is created with its reservation object (resv) pointing to the exporter's dma_buf->resv before the importer acquires a reference on that dma-buf - leaving a window in which the exporter can be freed while the TTM workqueue asynchronously accesses the now-dangling pointer. Vendor-released patches are available for Linux 6.12.103, 6.18.42, and 7.1.6; no public exploit has been identified at time of analysis.