Kernel panic (use-after-free) in the Linux kernel IPv4 IGMP stack allows a network-adjacent attacker to crash the host by racing an inbound IGMP membership query against network-device teardown. The flaw lives in igmp_gq_start_timer(), where in_dev_hold() re-arms the general-query timer on an in_device whose refcount has already dropped to zero during inetdev_destroy(), so the RCU-freed structure is accessed when the timer later fires. The upstream fix is merged and shipped across stable branches; there is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile).
Use-after-free (refcount_t underflow) in the Linux kernel's SUNRPC TLS connect path lets a failing TLS-secured RPC transport dereference an already-freed upper rpc_clnt, corrupting kernel memory. It affects systems using RPC-with-TLS transports (notably NFS-over-TLS/mTLS mounts) where a fatal handshake failure races the delayed connect_worker. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile); the input's 9.8 CVSS reflects Linux's automated scoring rather than the local, config-dependent trigger described.
Out-of-bounds/use-after-free read in the Linux kernel TIPC subsystem occurs when the enqueue-path debug tracepoints in tipc_sk_enqueue() dump sk_receive_queue while only sk->sk_lock.slock is held. Because that spinlock protects only the backlog queue and does not serialize against the socket owner consuming or purging the receive queue, the tracepoint can dereference skbs already dequeued or freed, as caught by KASAN. There is no public exploit identified at time of analysis, EPSS is very low (0.21%, 11th percentile), and the issue is only reachable when TIPC debug tracepoints are active.
Memory-corruption (double-free / use-after-free) in the Linux kernel's SunRPC server layer allows the rq_procinfo->pc_release hook to fire against stale, reused request state when a worker thread hits an early error path (unsupported protocol, short frame, or bad auth) before a valid procinfo is installed. It affects Linux 6.18 (and the shared SunRPC code reachable via kernel RPC servers such as nfsd), and successful triggering corrupts kernel heap state, risking denial of service or privilege escalation. The issue is patched upstream; there is no public exploit identified at time of analysis and EPSS is low (0.21%), so it is not currently known to be exploited.
Use-after-free in the Linux kernel's IPv4 TCP stack (net/ipv4/tcp_output.c) occurs when tcp_connect() reconciles conflicting TCP-MD5 and TCP-AO authentication keys on a socket that is already in TCP_SYN_SENT and hashed into the inet ehash. In the needs_ao branch, tcp_clear_md5_list() frees each tcp_md5sig_key and the md5sig_info container with bare kfree() before the RCU grace period, while softirq RX-path readers (__tcp_md5_do_lookup / __tcp_md5_do_lookup_exact) are still walking the same list under RCU, producing a per-key slab use-after-free. It affects kernels on the 6.18 line (and the described stable range) and is fixed by deferring frees with kfree_rcu; no public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile).
Type confusion in the Linux kernel's IPv6 In-situ OAM (IOAM) lightweight-tunnel code lets a crafted IOAM route trigger an invalid cast in rt6_get_cookie(), which reads struct rt6_info fields out of a dummy dst_entry that was only ever a bare struct dst_entry embedded in ioam6_lwt. This CWE-843-class flaw affects kernels from 6.16 up to the fixed releases and can produce an invalid pointer access when the aliased sernum/reset_ts field reaches zero. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and the issue is not in CISA KEV, so it reads as a memory-safety/DoS-grade bug rather than a broadly weaponized RCE despite the 9.8 NVD score.
Memory corruption (use-after-free) in the Linux kernel's fbnic Ethernet driver occurs on the transmit path when fbnic_tx_lso() caches a pointer into the skb shared-info region and then calls skb_cow_head(), which may reallocate the skb and free the original buffer. Any host equipped with Meta's fbnic NIC that transmits large-segmentation-offload (LSO/TSO) traffic can trigger a slab-use-after-free, reading freed skbuff memory and potentially crashing the kernel. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%), and the issue is not in CISA KEV.
Improper handling of asynchronous fscache cache-object creation in the Linux kernel's netfs subsystem affects kernels from 6.11 up to the fixed 6.18.40, 7.1.5 and 7.2-rc2 releases. In netfs_create_write_req(), caching is skipped when the fscache cookie appears disabled, but a still-in-progress async cache object may not yet have enabled it, causing fscache_begin_write_operation() to be bypassed and write operations to the local cache to be mishandled. The issue is a local netfs/fscache correctness bug (tagged Information Disclosure); it is not remotely reachable, and there is no public exploit identified at time of analysis.
Memory corruption in the Linux kernel's User Mode Linux (UML) vector network driver lets a remote peer trigger a use-after-free in vector_mmsg_rx(). When a received packet fails verify_header(), the code frees the skb but skips the slot-cleanup that normal paths perform, so the next RX iteration re-reads and double-frees the same freed buffer, causing a refcount underflow / use-after-free. It affects UML instances using the GRE or L2TPv3 vector transports; any peer on such a transport can trigger it without authentication. No public exploit identified at time of analysis, and EPSS is low (0.20%).
Kernel memory corruption in the Linux kernel's DRBD (Distributed Replicated Block Device) driver lets a malicious or man-in-the-middle replication peer write attacker-chosen bytes past a bio page in a receiving node. The flaw lives in recv_dless_read(), where a peer-supplied payload length is handled as a signed int (data_size) that can be driven negative, and it affects any node that reads from its peer - a diskless node or one using read-balancing - in the default configuration. Rated CVSS 9.8 by NVD; there is no public exploit identified at time of analysis and EPSS probability is low (0.20%).
Use-after-free in the Linux kernel's sunrpc server-side TLS handshake path (svc_tcp_handshake/svc_sock) allows the asynchronous tlshd handshake-completion callback to write through a freed struct svc_sock, corrupting slab memory on any NFS server configured for RPC-with-TLS. Two close-versus-cancel races let svc_sock_free() kfree() the socket while svc_tcp_handshake_done() is still updating xpt_flags and walking the embedded wait queue, yielding an attacker-influenceable slab-corruption primitive rather than a benign read. No public exploit identified at time of analysis and EPSS is low (0.20%), but the fix is upstream in stable kernels.
Header buffer corruption in the Linux kernel gve (Google Virtual Ethernet) driver's DQO RX datapath lets header bytes from one packet be copied onto another, and lets header buffers be re-posted while the device still owns them, when both header-split and HW-GRO are enabled with many concurrent flows. The gve driver is used by Google Cloud Platform Linux VMs, so exposure is limited to GCP guests running affected kernels with that specific offload configuration. There is no public exploit identified at time of analysis, EPSS is very low (0.20%), and the observed effect is roughly a 30% throughput drop with heavy TCP retransmissions rather than code execution.
Memory-accounting corruption in the Linux kernel's espintcp (ESP-in-TCP / IPsec RFC 8229) send path was resolved by switching to sk_msg_free_partial(), which keeps the socket message (skmsg) consistent on partial sends. On affected kernels the previous code mishandled uncharges and offsets when the full payload was not transmitted, corrupting skmsg accounting on a system where TCP encapsulation of IPsec is in use. This is a stable-tree fix carrying an NVD CVSS of 9.8 and the 'Information Disclosure' tag, but EPSS is only 0.20% (10th percentile) and no public exploit is identified at time of analysis.
Memory-safety defect in the Linux kernel IPVS (IP Virtual Server) subsystem where __ip_vs_get_out_rt() calls skb_ensure_writable(), which can reallocate skb->head, leaving a stale IP-header pointer that is then dereferenced. Affected hosts are Linux systems acting as IPVS load balancers/directors; the flaw can lead to reads of freed/relocated packet memory (information disclosure) or kernel instability. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile); the upstream fix reloads the IP header after reallocation.
Heap out-of-bounds write in Perl's DBI module before 1.652 lets an attacker who can feed an oversized untrusted statement to the preparse() function corrupt heap memory on 32-bit perl builds, writing hundreds of megabytes of attacker-controlled data past a tiny allocation. The flaw stems from an integer wraparound (CWE-190) in the output-buffer sizing arithmetic and could lead to code execution or crashes. No public exploit has been identified and EPSS is low (0.20%), but a vendor patch (DBI 1.652) is available.
Incorrect route selection in the Linux kernel's netfilter flowtable IPIP-encapsulation offload path causes the headroom and IP fragment-offset (iph->frag_off) to be computed from the reverse-direction dst instead of the current direction when pushing the IPIP header. Affecting kernel 6.19 and development branches through the 7.x line, the flaw can lead to malformed encapsulated packets and potential memory/headroom mishandling in the fast-path offload; it is tagged as information disclosure. The input CVSS of 9.8 (RCE-grade) is a CNA auto-score that overstates a config-dependent packet-handling bug, and EPSS is low at 0.20% (10th percentile) with no public exploit or KEV listing.
Denial of service in the Linux kernel netfilter flowtable subsystem allows a crash in the tunnel transmit path when IPIP tunnel offload is combined with a direct-xmit device such as a bridge. Because no dst_entry is supplied, the code performs invalid dst usage while checking skb headroom and setting iph->frag_off, leading to a kernel crash. Rated CVSS 9.8 by automated scoring, but vendor tags classify it as Denial Of Service; EPSS is 0.20% (10th percentile), it is not in CISA KEV, and no public exploit was identified at time of analysis.
Filesystem consistency flaw in the Linux kernel NTFS driver's ntfs_ir_reparent() index-root reparenting path allows a transient on-disk/in-memory layout that $INDEX_ROOT validation rejects as corrupt, surfacing as generic/013 xfstests failures and ntfsck 'Corrupt index root' errors. The bug is a metadata-ordering error triggered during NTFS write operations that grow an index root and hit -ENOSPC, not a remotely exploitable memory-safety issue; no public exploit identified at time of analysis and it is not in CISA KEV. Fixed in stable 7.1.5 and mainline 7.2-rc1.
Out-of-bounds read in the Linux kernel's NTFS driver (ntfs_mapping_pairs_decompress) lets a crafted NTFS attribute record trigger a one-byte read past the attribute boundary. It stems from off-by-one bounds checks that use strict greater-than instead of >=, so mapping-pair data extending exactly to attr_end passes validation and buf[b] reads one byte too far. No public exploit is identified at time of analysis, EPSS is low (0.20%), and it is not on CISA KEV; exploitation requires the kernel to parse an attacker-controlled NTFS volume.
Out-of-bounds kernel memory read in the legacy NTFS filesystem driver of the Linux kernel (affecting builds derived from commit 6ceb4cc8 up to the 7.1.x and 7.2-rc series) occurs when the driver parses a crafted NTFS image whose $FILE_NAME attribute declares a small resident value_length but an oversized file_name_length. Callers trust file_name_length and read past the resident attribute value during name conversion/comparison, producing a slab-out-of-bounds read confirmed under KASAN from the kmalloc-1k MFT record copy. There is no public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and despite the source-assigned 9.8 CVSS this is a local filesystem-parsing bug rather than a remote-unauthenticated flaw.
Out-of-bounds read in the Linux kernel's NTFS driver allows a local attacker to leak adjacent kernel memory or crash the system by parsing extended attribute (EA) entries on a crafted NTFS volume. The ntfs_ea_lookup and ntfs_listxattr routines dereferenced the next_entry_offset field of an EA entry without first verifying that enough space remained in the buffer. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is tagged as Information Disclosure rather than code execution.
On-disk NTFS metadata corruption in the Linux kernel's NTFS3 driver arises because ntfs_resident_attr_resize() may select zero-length resident $DATA attributes when converting attributes to non-resident to free MFT record space, producing 0-byte non-resident $DATA that fsck flags as filesystem corruption. The flaw affects Linux systems writing to NTFS volumes and is a data-integrity/consistency defect rather than a memory-safety or remote-code issue; it is fixed in stable 7.1.5 and 7.2-rc1. There is no public exploit identified at time of analysis, EPSS probability is low (0.20%, 10th percentile), and it is not listed in CISA KEV. The published CVSS of 9.8 (network vector) is not consistent with a local filesystem write path and appears to be an automated over-assessment.
Out-of-bounds access in the Linux kernel's legacy NTFS filesystem driver arises from insufficient validation of INDEX_HEADER geometry within INDX directory-index blocks; a crafted NTFS volume can drive ntfs_lookup_inode_by_name() to read past block boundaries. The fix hardens ntfs_index_block_inconsisent() to strictly validate index-block header fields before use, affecting systems that mount attacker-controlled NTFS media. There is no public exploit identified at time of analysis, KEV does not list it, and EPSS is low (0.20%, 10th percentile), consistent with a filesystem-parsing bug that requires a malicious volume rather than remote reach.
Improper validation of NTFS index entries in the Linux kernel's NTFS filesystem driver allows a crafted or corrupted NTFS volume to be processed without adequate bounds checking during index root and index block reads. When an attacker-controlled NTFS image is mounted and traversed (lookup/readdir), missing per-read validation can lead to out-of-bounds memory access, enabling information disclosure or a kernel crash. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is not on the CISA KEV list.
Signed-integer overflow in the Linux kernel NTFS driver's mapping-pairs runlist parser lets a crafted or corrupted NTFS volume redirect logical-to-physical cluster mappings to unintended disk locations. The flaw affects the kernel's NTFS attribute parsing when it accumulates relative LCN deltas; a malicious runlist can set the accumulator to S64_MAX and add 1, triggering undefined behavior that resolves runs to a different set of physical clusters. Fixed upstream in Linux 7.1.5 and 7.2-rc1; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.20%).
Out-of-bounds memory access in the Linux kernel NTFS driver arises because resident $INDEX_ROOT attribute headers are consumed after lookup without fully validating their layout invariants. Affected are Linux kernels prior to the 7.1.5 and 7.2-rc1 stable fixes when mounting or accessing an attacker-crafted NTFS volume; unchecked entries_offset, index_length, and allocated_size fields let a malformed filesystem drive reads beyond the resident value, tagged upstream as Information Disclosure. This is not actively exploited (no CISA KEV entry) and EPSS is low at 0.20%, with no public exploit identified at time of analysis, though upstream stable commits are available.
Missing DMA sync-for-CPU in the Linux kernel's MANA (Microsoft Azure Network Adapter) RX path can hand stale or uninitialized buffer memory to the networking stack on systems that require explicit DMA syncing, such as those booted with swiotlb=force. The flaw affects the mana Ethernet driver when RX buffers come from page-pool fragments (frag_count > 1), where the DMA unmap that normally performs the implicit CPU sync is skipped. There is no public exploit identified at time of analysis, EPSS is low (0.20%), and it is not listed in CISA KEV.
Local denial-of-service / kernel-warning condition in the Linux kernel TCP stack allows a race during failed connection setup to trip a socket-lock assertion when eBPF sock_ops callbacks are in use. When a listener has a BPF sock_ops program with BPF_SOCK_OPS_STATE_CB_FLAG attached, a child socket that fails setup in tcp_v4/v6_syn_recv_sock() is force-closed without its socket lock held, causing tcp_done() -> tcp_set_state() -> tcp_call_bpf() to fire sock_owned_by_me() and emit a WARNING. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and the issue is not in CISA KEV; the headline CVSS 9.8 is inconsistent with the actual local, privilege- and race-dependent nature of the bug.
Improper error handling in the Linux kernel's ntfs3 filesystem driver leaves an inode in an inconsistent state after a failed rename, where a WARN_ON was previously hit instead of properly marking the inode bad. The fix replaces that WARN_ON with a _ntfs_bad_inode() call so the kernel stops operating on the corrupted inode. The recorded CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) is inconsistent with the actual change, which is a local filesystem-driver robustness fix; EPSS is 0.20% (10th percentile) and there is no public exploit identified at time of analysis and no CISA KEV listing.
Improper packet-header validation in the Linux kernel's netfilter flowtable IP6IP6 tunnel fast path was corrected by switching nf_flow_ip6_tunnel_proto() from skb_header_pointer() to pskb_may_pull(), guaranteeing the outer IPv6 header is actually present in the skb before the offload path dereferences it. The flaw affects hosts using netfilter flowtable hardware/software offload with IP6IP6 tunnel encapsulation, where a malformed encapsulated packet could be processed against a header not fully pulled into the linear buffer. No public exploit identified at time of analysis; not listed in CISA KEV, and EPSS is low (0.20%, 10th percentile).
Out-of-bounds memory access in the Linux kernel netfilter flowtable subsystem allows malformed IPv4 packets to overrun header-size calculations in nf_flow_ip4_tunnel_proto(), affecting systems that use nftables flowtable offload with IP tunnel processing. The bug stems from consuming the untrusted iph->ihl field without validation before computing header size. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not on CISA KEV; despite the CNA's 9.8 rating, real-world impact is most consistent with a denial-of-service kernel crash on a non-default configuration.
Memory-ordering (barriering) defect in the Linux kernel's netfs subsystem allows a subrequest that was just added by an application thread to be observed inconsistently while the retry path walks the subrequest list, risking use of partially-initialized data. The flaw affects netfs-backed network filesystems (e.g. AFS, Ceph, CIFS, 9p) in kernels from 6.10 onward and has been resolved upstream. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.20%, 10th percentile), indicating negligible observed exploitation interest despite the NVD's 9.8 rating.
Kernel-level memory corruption in the Linux RDMA SCSI RDMA Protocol target driver (ib_srpt) lets a malicious SRP initiator on the RDMA fabric overflow an integer length calculation and drive a ~4GB out-of-bounds scatter-gather mapping. The flaw stems from adding an attacker-controlled 32-bit immediate-data length to an offset without overflow checking, wrapping req_size below its bounds check. It carries a CVSS 9.8 rating, but there is no public exploit identified at time of analysis and EPSS is low (0.19%, 8th percentile); a vendor patch is available across current stable kernel trees.
Denial of service (and potential memory corruption) in the Linux kernel IPv6 stack arises from a race condition in addrconf_dad_failure() where ifp->lock is transiently dropped, letting a concurrent ipv6_del_addr() poison a list entry that Duplicate Address Detection (DAD) work then dereferences, producing a general protection fault in ipv6_del_addr(). The flaw affects the addrconf DAD-failure path across a broad range of kernel versions and is fixed by folding the state transition into a single locked critical section. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%), and it is not listed in CISA KEV.
Out-of-bounds slab write in the Linux kernel's NVMe-multipath driver (nvme_mpath_revalidate_paths) affects hosts whose NUMA node IDs are sparse rather than densely packed from zero, notably some powerpc/POWER9 systems. The nvme_ns_head.current_path[] flexible array is sized with num_possible_nodes() but indexed with the raw numa_node_id(), so on non-contiguous topologies the driver writes a pointer past the end of the allocation during namespace scanning, producing the KASAN slab-out-of-bounds splat shown in the report. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and it is not on CISA KEV, despite an inflated NVD score of 9.8.
Denial of service (and potential memory corruption) in the Linux kernel's TIPC networking subsystem arises from a use-after-free in tipc_l2_send_msg(); when a TIPC L2 bearer is disabled, tipc_disable_l2_media() runs synchronize_net() while b->media_ptr still references the underlying net_device, letting concurrent RCU readers keep sending on a device that is subsequently freed. Syzbot reproduced the slab-use-after-free via ipvlan_hard_header(). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.18%, 7th percentile), consistent with a race-condition kernel bug rather than a mass-exploited flaw.
Denial of service in the Linux kernel's VXLAN driver stems from a race condition in vxlan_gro_prepare_receive(): udp_tunnel_sock_release() can set sk->sk_user_data to NULL while GRO processing is mid-flight, producing a NULL-pointer dereference and kernel panic. It affects hosts using VXLAN overlay tunnels across numerous stable branches, is fixed upstream, and has no public exploit identified at time of analysis (EPSS 0.17%). The published NVD CVSS of 9.8 (C:H/I:H/A:H) overstates impact - the actual effect is a crash, not code execution or data disclosure.
Kernel memory (bio structure) leak in the Linux md/raid10 driver occurs when a discard operation reuses an r10bio object previously used for a read. Because put_all_bios() only releases the replacement bio (repl_bio) when read_slot is negative, a reused r10bio with a stale non-negative read_slot skips the bio_put() on repl_bio, leaking kernel memory on RAID10 arrays that have replacement/spare devices and receive discard (TRIM) traffic. There is no public exploit identified at time of analysis, and EPSS risk is very low (0.17%, 7th percentile).
A double-free memory-corruption defect in the Linux kernel's rtase Realtek automotive Ethernet driver allows the same multi-fragment socket buffer to be freed twice when the transmit path hits a DMA mapping failure. It affects hosts running the rtase driver (Realtek multi-gigabit/automotive NICs) on kernel 6.12 and related stable trees, and can lead to kernel memory corruption and denial of service. No public exploit has been identified at time of analysis; EPSS is low (0.17%, 7th percentile) and the CVE is not on CISA KEV.
A DMA mapping resource leak in the Linux kernel's igbvf driver (Intel 82576 SR-IOV virtual function NIC) occurs on the TX buffer-mapping error path: an off-by-one in the dma_error cleanup loop leaks exactly one DMA mapping (the packet head) whenever a fragment mapping fails after the head was successfully mapped. The bug traces to a 2010 fix for an endless loop and affects a wide range of stable kernels until patched (fixes landed in 6.6.151, 6.12.103, 6.18.44, 7.1.8 and 7.2-rc6). There is no public exploit identified at time of analysis, EPSS is very low (0.17%), and the practical impact is memory/DMA resource exhaustion rather than the remote code execution suggested by the assigned 9.8 score.
Kernel-level use-after-free in the Linux SMC (Shared Memory Communications) subsystem allows a race between socket close and link group termination to write to freed memory. The flaw lives in the net/smc driver where __smc_lgr_terminate() releases conns_lock after locating a connection in lgr->conns_all but before calling sock_hold(), so a concurrent close can free the embedded socket first. Fixed across multiple stable trees; EPSS is low (0.17%), there is no public exploit identified at time of analysis, and it is not on CISA KEV.
Use-after-free in the Linux kernel bridge (net/bridge) multicast fast-leave path lets the group-leave handler dereference a freed port-group entry after br_multicast_del_pg() removes it, because the loop keeps walking through the stale next pointer. It affects bridges that had multicast-to-unicast enabled and later disabled while multiple per-source-MAC port groups existed, and can corrupt kernel memory. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not in CISA KEV, so the headline CVSS 9.8 overstates practical risk for most deployments.
Out-of-bounds read in the Linux kernel's VXLAN driver stems from route_shortcircuit() validating only 20 bytes from skb->data instead of accounting for the 14-byte MAC header offset, so ip_hdr()->daddr dereferences can read past the pulled linear buffer when packets have non-linear fragments. The flaw affects hosts running VXLAN tunneling with proxy mode, is tagged as an information-disclosure issue, and has no public exploit identified at time of analysis (EPSS 0.17%, 6th percentile). A vendor fix replaces pskb_may_pull() with pskb_network_may_pull() to check the full network header including skb_network_offset().
Use-after-free in the Linux kernel's DLM (Distributed Lock Manager) subsystem stems from incorrect sequence-number ordering of message handles in a node's send_queue, which breaks the before(mh->seq, seq) tail-walk in dlm_receive_ack and leads to refcounting corruption and freeing of an in-use send buffer. It affects Linux kernels using DLM (clustered filesystems such as GFS2/OCFS2) from 5.14 onward, and is fixed in stable releases 6.6.145, 6.12.97, 6.18.40 and 7.1.5. Despite a headline CVSS of 9.8, EPSS is only 0.17% (6th percentile), there is no public exploit, and it is not on CISA KEV - the reporter only reproduced it on an experimental branch with an io_uring userspace benchmark.
Kernel memory corruption in the Linux RDMA/siw (soft-iWARP) driver lets a remote peer trigger a slab use-after-free during connection setup: siw_socket_disassoc() can drop the last reference on an endpoint and free it, after which siw_cm_work_handler() still dereferences the stale endpoint pointer. The demonstrated impact is a KASAN-confirmed use-after-free crash after a malformed MPA request, exploitable only where the siw module is loaded and an iWARP listener is active. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile) with no CISA KEV listing, so the 9.8 NVD score overstates practical risk for typical deployments.
Improper transmit-path header validation in the Linux kernel VXLAN driver (functions vxlan_xmit, arp_reduce, and vxlan_mdb_entry_skb_get) can cause the driver to read network-layer header bytes (ARP, IPv6/ND, IP/IPv6 MDB keys) that reside in non-linear skb fragments. The root cause is the use of pskb_may_pull(), which measures length from skb->data - which on transmit points at the MAC header - instead of pskb_network_may_pull(), which accounts for the ETH_HLEN (14-byte) network offset; the result is that part of the network header may remain unpulled in paged fragments and be parsed from stale linear-buffer memory, an information-disclosure/misparse condition. Only systems with VXLAN overlay interfaces configured are affected. There is no public exploit identified at time of analysis, EPSS is 0.17% (6th percentile), and it is not in CISA KEV; the upstream 9.8 CVSS score appears substantially overstated for this robustness fix.
Out-of-bounds access in the Linux kernel NVMe Flexible Data Placement (FDP) code allows an attacker who can submit NVMe commands to read beyond the fdpcidx configuration array. An off-by-one in the fdpcidx bounds check (using '>' instead of '>=' against n = NUMFDPC + 1) accepts an index one element past the valid range, tagged by intelligence sources as an information-disclosure issue. Affects Linux 6.16 through the fix; no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile), and the published CVSS 9.8 network vector appears inflated relative to the local/fabric-scoped nature of NVMe command handling.
Use-after-free / stale work-item race in the Linux kernel's kAFS (Andrew File System client) network-namespace teardown path allows a use-after-free when an afs netns is destroyed. Fixed upstream (this issue was found by AI review), the flaw stems from afs_charge_preallocation() and afs_rx_new_call() failing to stop the rxrpc preallocation 'charger' work item before incoming calls are disabled during net-namespace deletion, so the charger can run against freed/torn-down state. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and it is not in CISA KEV, so this is a correctness/stability defect far below the raw CVSS 9.8 rating.
Race condition in the Linux kernel's RDMA/irdma (Intel Ethernet RDMA) driver arises from a legacy waitqueue-plus-flag synchronization pattern that lacked memory barriers around the request_done flag; maintainers resolved it by switching to a completion primitive. Kernels from 5.14 onward that load the irdma module are affected, but the defect is a local concurrency bug in a specific hardware driver, not the remote unauthenticated code execution its CVSS 9.8 rating implies. No public exploit identified at time of analysis, EPSS is low (0.16%, 6th percentile), and it is not in CISA KEV.
Use-after-free and reference-count imbalance in the Linux kernel's IPsec (xfrm) asynchronous resumption path allows a device UAF and refcnt leak when packets are processed through tunnel interfaces such as VTI. During async crypto resumption, xfrm_rcv_cb can reassign skb->dev to a tunnel device without taking a reference, so the later decrement frees the tunnel netdevice while the original device leaks (observable as 'unregister_netdevice: waiting for vti1 to become free. Usage count = -2'). The upstream fix stashes the original skb->dev and extends RCU protection over xfrm_rcv_cb and transport_finish. There is no public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile).