Race condition in the Linux kernel's RDMA/irdma (Intel Ethernet RDMA) driver arises from a legacy waitqueue-plus-flag synchronization pattern that lacked memory barriers around the request_done flag; maintainers resolved it by switching to a completion primitive. Kernels from 5.14 onward that load the irdma module are affected, but the defect is a local concurrency bug in a specific hardware driver, not the remote unauthenticated code execution its CVSS 9.8 rating implies. No public exploit identified at time of analysis, EPSS is low (0.16%, 6th percentile), and it is not in CISA KEV.
Use-after-free and reference-count imbalance in the Linux kernel's IPsec (xfrm) asynchronous resumption path allows a device UAF and refcnt leak when packets are processed through tunnel interfaces such as VTI. During async crypto resumption, xfrm_rcv_cb can reassign skb->dev to a tunnel device without taking a reference, so the later decrement frees the tunnel netdevice while the original device leaks (observable as 'unregister_netdevice: waiting for vti1 to become free. Usage count = -2'). The upstream fix stashes the original skb->dev and extends RCU protection over xfrm_rcv_cb and transport_finish. There is no public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile).
Out-of-bounds kernel memory read in the Linux netfilter SIP connection-tracking helper (nf_conntrack_sip) lets remote attackers crash or leak memory from any host doing SIP NAT rewriting. When sip_help_tcp() NAT-rewrites a SIP message, the per-message size delta is stored in a signed 16-bit variable; a single message with a long Contact list can grow by more than S16_MAX (while still under the 65535 enlarge_skb limit), wrapping the counter so datalen underflows to a huge unsigned value and ct_sip_get_header() reads past the linearized skb tail (KASAN use-after-free). Tagged Information Disclosure; no public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile).
Heap buffer overflow in the Linux kernel iSCSI TCP initiator (drivers/scsi/libiscsi_tcp.c) lets a malicious or compromised iSCSI target overflow the fixed 8192-byte conn->data buffer by returning a SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) whose DataSegmentLength exceeds ISCSI_DEF_MAX_RECV_SEG_LEN. Unlike LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT, the SCSI response path copied sense/response data into conn->data without bounding it against the buffer size, only against the negotiated MaxRecvDataSegmentLength (open-iscsi default 262144). Any Linux host acting as an iSCSI initiator against an untrusted target is affected; there is no public exploit identified at time of analysis and EPSS is low (0.16%, 5th percentile), and it is not on CISA KEV.
Use-after-free in the Linux kernel's AF_RXRPC (rxrpc) networking subsystem lets a freed struct rxrpc_backlog be reused when kernel accept preallocation races against socket teardown. The flaw affects kernels using the rxrpc transport (notably kAFS/AFS clients) prior to the fixed stable releases; a kernel worker calling rxrpc_kernel_charge_accept() reads rx->backlog with no lock while rxrpc_discard_prealloc() concurrently NULLs and frees it, corrupting backlog head/tail pointers and array slots. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.16% (5th percentile).
Memory corruption and use-after-free in the Linux kernel's AF_RXRPC subsystem (rxrpc) let a local process trigger a double-free and connection refcount underflow by reading an out-of-band challenge message with MSG_PEEK. Because rxrpc_recvmsg_oob() guards only the unlink from recvmsg_oobq under MSG_PEEK but always moves the skb onto pending_oobq, the same singly-referenced skb becomes linked into both a list and an rbtree that share storage, corrupting linkage and freeing the skb and its connection reference twice on socket close. The NVD-assigned CVSS is 9.8, but EPSS is only 0.15% (5th percentile) and there is no public exploit identified at time of analysis; the fix is upstream in the stable trees.
Out-of-bounds kernel memory read in the Linux kernel's ocfs2 filesystem allows disclosure of adjacent kernel data when a maliciously crafted or corrupted ocfs2 volume is mounted and a fast symlink is read. ocfs2_validate_inode_block() failed to validate zero-cluster (fast) symlink dinodes, so ocfs2_fast_symlink_read_folio() would strnlen()/memcpy an inline payload whose i_size exceeds the inline area or lacks a terminating NUL, copying past the inode block buffer (KASAN flagged a 3905-byte over-read via readlink). No public exploit identified at time of analysis; EPSS is low at 0.15% (5th percentile) and the issue is not in CISA KEV.
Incorrect file-handle hashing in the Linux kernel's lockd (NLM) server causes NLMv4 lock-state lookups to fail intermittently. When a client presents an NFS file handle shorter than LOCKD_FH_HASH_SIZE (32 bytes), file_hash() digests stale bytes left in the argument buffer from a prior request, so the same wire handle hashes into different nlm_files[] buckets across calls and nlm_lookup_file() misses existing lock records. This is a functional-correctness and reliability defect introduced by commit 3de744ee4e45 during the xdrgen NLMv4 TEST conversion; a vendor patch is available, EPSS is low (0.15%), and there is no public exploit identified at time of analysis and no CISA KEV listing.
Memory corruption in the Linux kernel's bnxt (Broadcom NetXtreme) Ethernet driver arises when an XDP program grows the packet head, causing a head-pointer underflow in bnxt_rx_multi_page_skb that drops a page-pool fragment reference on the wrong page or fragment. This corrupts page-pool refcounts, allowing a page to be recycled while still in use and producing a double free on driver teardown, which realistically manifests as a kernel crash or memory corruption on hosts using Broadcom bnxt NICs with native XDP. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS is low at 0.15% (5th percentile).
Memory corruption in the Linux kernel's rxrpc networking subsystem (rxgk/GSS Kerberos security class) affects kernels from 6.16 onward, where rxgk_issue_challenge() frees the page holding challenge content before a tracepoint reads the wire header (whdr) that still points into that freed page, creating a use-after-free. The flaw is patched in stable releases 6.18.40, 7.1.5 and 7.2-rc1, and is triggerable only where the rxrpc RxGK security class is active (primarily kAFS deployments). There is no public exploit identified at time of analysis, and the EPSS score is very low at 0.15% (5th percentile), indicating negligible observed exploitation interest.
Denial of service (and potential memory corruption) in the Linux kernel's AF_RXRPC networking stack stems from a double unlock in rxrpc_recvmsg() triggered while handling out-of-band (OOB) messages, affecting kernels from roughly 6.16 up to the fixed 6.18.40, 7.1.5 and 7.2-rc1 releases. Releasing an already-released lock corrupts kernel lock state and can crash the host or open a race window. No public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile).
Memory corruption in the Linux kernel's NTFS filesystem driver stems from unchecked integer arithmetic when converting runlist element counts into byte sizes inside ntfs_rl_realloc() and ntfs_rl_realloc_nofail(). An attacker who can get a crafted NTFS volume mounted and parsed can overflow the size calculation and corrupt kernel heap memory, potentially escalating to code execution. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile).
Remote code execution in SiYuan before v3.7.4 lets an authenticated attacker who can author Template calculation operators inject HTML and JavaScript that runs in the Electron desktop renderer with Node integration enabled, turning a stored cross-site scripting flaw into full arbitrary code execution when a victim opens the shared notebook/database. The Go template output is stored verbatim without sanitization, so payloads persist and fire on document render. No public exploit or CISA KEV listing has been identified at time of analysis, though VulnCheck published an advisory and the vendor issued a GitHub security advisory (GHSA-rwh7-gm74-67h6).
Stored cross-site scripting in SiYuan's desktop note-taking client (versions before 3.7.4) allows an attacker who can rename an attribute-view (database) field to inject HTML that executes when a victim opens the sort menu, and because the Electron desktop client runs with Node integration enabled, that script achieves arbitrary code execution on the victim's machine. The flaw is authenticated/low-privilege and requires the victim to open the affected menu; no public exploit has been identified at time of analysis, though a vendor security advisory (GHSA-g3jx-227v-x2x4) and VulnCheck advisory document the issue.
Stored cross-site scripting in SiYuan before v3.7.4 escalates to remote code execution because the desktop client renders database menu metadata (group, view, and field-edit menus) through unsafe HTML interpolation. An attacker who can set a database field name or description injects markup that closes the containing element and fires an event handler; when a victim opens the affected menu, the script runs with Node.js built-ins available due to Electron being configured without sandboxing/context isolation. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-site scripting leading to arbitrary code execution in SiYuan (self-hosted note-taking / knowledge-management app) before v3.7.4 lets an attacker embed hex-encoded markup inside a document icon that the vulnerable unicode2Emoji function renders without sanitization; because the Electron renderer runs with Node integration enabled, the injected script escapes the browser context and executes OS commands on the victim's host. Any user who opens or imports a crafted document is affected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor GitHub security advisory (GHSA-vx5w-qrvp-mmcq) and a VulnCheck advisory document the flaw.
Stored cross-site scripting in SiYuan before v3.7.4 lets a workspace user with edit rights persist JavaScript by injecting event-handler attributes through the unescaped color field of an attribute-view (database) select option. The payload fires whenever any user renders a database containing the malicious select field, across eight distinct render sites that all fail to escape the value. No public exploit or CISA KEV listing has been identified at time of analysis, but the flaw is trivially triggerable and carries a high CVSS 4.0 base score of 9.4.
Stored cross-site scripting escalating to remote code execution affects SiYuan, an Electron-based personal knowledge-management/note-taking application, in all versions before v3.7.4. Because table column-width values passed to the setAttrViewColWidth API are neither validated nor escaped before being written into HTML style attributes, an attacker can break out of the style attribute and attach event handlers to every table cell; when the victim renders the table, the payload executes in the Electron renderer, which runs with Node integration enabled, turning a web-layer injection into arbitrary code execution on the host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting leading to remote code execution in SiYuan (a self-hosted personal knowledge-management notebook) before v3.7.4 lets an attacker with write access poison PDF annotation fields via the setFileAnnotation endpoint; because SiYuan is an Electron application, the injected markup runs as JavaScript in the PDF renderer with full Node.js privileges when a victim opens the annotated PDF, escalating a web injection into host-level code execution. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CWE-79 root cause combined with Node.js integration makes this a full-compromise primitive rather than a benign script injection.
Out-of-bounds kernel memory read in the Linux kernel's CIFS/SMB client (parse_dfs_referrals) affects hosts that mount SMB shares involving DFS referrals. A malicious or man-in-the-middle SMB server can return a referral whose server-supplied string offsets point beyond the received response buffer; the unchecked offset yields a negative max_len that reaches kstrndup()/strnlen() as a size_t, causing an out-of-bounds read that can leak adjacent kernel memory or crash the client. CVSS is 9.4, but there is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.21%, 12th percentile), indicating no observed exploitation.
Authentication brute-force leading to full admin takeover affects SiYuan, a self-hosted personal knowledge-management/note-taking application, in versions before v3.7.4. The HTTP Basic Authentication branch of the CheckAuth() middleware - which protects almost the entire /api/* surface - validates the workspace access code without enforcing the CAPTCHA/lockout controls or the failure counter that guard the normal cookie/session login, letting unauthenticated remote attackers make unlimited automated guesses to recover the admin access code and gain RoleAdministrator control of the kernel. A non-constant-time comparison of the access code adds a secondary timing side channel. No public exploit identified at time of analysis, but the flaw is trivially scriptable.
Memory corruption in the Linux kernel's KVM/arm64 GICv3 virtualization (vgic) subsystem allows a local attacker on an ARM64 KVM host to trigger a double list removal, corrupting the ap_list and enabling a use-after-free style condition. The flaw lives in vgic_prune_ap_list(), where an interrupt can be pruned from a vCPU's active/pending list a second time after vgic_flush_pending_lpis() already removed it, because the affinity re-check does not confirm the interrupt is still owned by the vCPU. No public exploit is identified at time of analysis, and EPSS is low (0.22%), consistent with a race-condition kernel bug that is difficult to weaponize.
Arbitrary file deletion in the Link Library WordPress plugin (all versions through 7.9.4) lets unauthenticated attackers submit a malicious link whose crafted path traversal payload causes an arbitrary file on the server to be deleted when an administrator later removes the link; deleting wp-config.php can escalate to remote code execution by dropping WordPress into its setup routine. Reported by Wordfence and fixed in 7.9.5, this issue carries a 9.1 CVSS but has no public exploit identified at time of analysis and is not on CISA KEV, and real exploitation hinges on a non-default plugin option being enabled. Impact is integrity and availability loss with a plausible path to full site takeover.
Improper resource handling in the Linux kernel's RDMA bnxt_re driver (Broadcom NetXtreme RoCE) allows a local user with access to the uverbs interface to trigger a race and an error-path resource leak by repeatedly requesting write-combining (WC) mmap pages for the same ucontext. The driver historically supported only one WC page per ucontext without a serializing lock, so concurrent or repeated requests could race and, on mmap-insert failure, leak the mapped Doorbell page index. The published CVSS is 9.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), but this reflects the Linux CNA's conservative scoring convention; EPSS is 0.21% (11th percentile), it is not on CISA KEV, and no public exploit identified at time of analysis.
Local privilege escalation / host memory corruption in the Linux kernel's arm64 KVM vGIC subsystem allows a malicious or compromised guest VM to trigger a use-after-free by racing an LPI (Locality-specific Peripheral Interrupt) disable against an interrupt affinity migration across vCPUs. When vgic_prune_ap_list() drops and reacquires the irq and ap_list locks, a concurrent affinity change can free the interrupt out from under it, leading to a kernel UAF that can crash the host or potentially enable host-kernel code execution. This is not in CISA KEV and no public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile), consistent with a hard-to-win race rather than a turnkey exploit.
Guest-to-host memory corruption in the Linux kernel's arm64 KVM nested-virtualization (NV) path arises from mishandling of the VNCR page translation: when a nested guest reads the VNCR page before writing, the host maps the PFN read-only and fails to re-fetch a writable translation on the subsequent write abort. The fix invalidates the VNCR TLB and re-translates before injecting the abort, restoring correct write-fault handling and satisfying FEAT_ETS2/3 ordering. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and it is not on CISA KEV.
Denial-of-service in the Linux kernel's arm64 KVM nested-virtualization (NV) support allows an L1 guest to trigger a host System Error (SError) by pointing its VNCR mapping at a non-memory PFN. Because kvm_translate_vncr() unconditionally applies cacheable memory attributes without checking whether the backing PFN is real memory, a writeback to a device/non-cacheable endpoint can raise an uncontained SError on the host. The upstream fix makes KVM reject non-memory backing and inject a Synchronous External Abort (SEA) into the guest instead. There is no public exploit identified at time of analysis and EPSS is low (0.21%).
Denial of service in the Linux kernel's Xen paravirtualized SCSI backend (xen-scsiback) lets a malicious pvSCSI guest exhaust every command tag of a target LUN's session by driving the pre-submission error paths, which call transport_generic_free_cmd() on an se_cmd whose cmd_kref is still 0. The resulting refcount underflow is a use-after-free that leaks the tag and stops the LUN; on hosts booted with panic_on_warn it crashes the host outright. There is no public exploit identified at time of analysis and EPSS is low (0.21%), but the fix is shipped across multiple stable kernel trees.
Weakened AMD SEV-SNP memory-integrity enforcement in the Linux kernel results from a race between WBINVD IPIs and dirty-cacheline migration that can leave Reverse Map Table (RMP) memory with un-flushed dirty cache lines when SNP_INIT_EX is invoked with INIT_RMP=1, violating SNP firmware requirement (spec section 8.8). Affected are Linux 7.1 hosts that had adopted commit 99cf1fb58e68 (which dropped the pre-SNPEn WBINVD); the fix reverts that change so wbinvd_on_all_cpus() again runs before setting MSR_AMD64_SYSCFG_SNP_EN, while the RMP is not yet in use. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not CISA KEV-listed.
Guest memory corruption in the Linux kernel's s390 (IBM Z) memory-management code, where mishandling of the _PAGE_UNUSED software PTE bit causes in-use KVM guest pages to be discarded as if unused. On s390 KVM hosts running kernels before 7.1.5 (and 7.2-rc series before the fix), the bit set by KVM on unmapped guest pages was not cleared by all PTE-setting paths, so a page returned to use could later be silently dropped - corrupting guest state. There is no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and it is not in CISA KEV.
Kernel-memory corruption in the Linux kernel's net/liquidio (Marvell/Cavium LiquidIO SmartNIC) SR-IOV driver stems from caching virtual-function pci_dev pointers that hold no reference; the stale pointer is later dereferenced when servicing an OCTEON_VF_FLR_REQUEST, yielding a use-after-free reachable from a virtual function. Affected systems are hosts running the liquidio PF driver with SR-IOV enabled and VFs assigned to guests. Successful triggering can crash the host or corrupt kernel memory (potential privilege/scope escalation from a VF into the host); this is no public exploit identified at time of analysis, EPSS is low (0.20%), and a vendor fix is available.
Local privilege/information-disclosure risk in the Linux kernel's s390 KVM subsystem stems from an unlikely race in try_get_locked_pte(), where puds or pmds can be unmapped between the p?dp_get() and p?d_offset() calls, leaving code operating on a stale or freed page-table entry. The flaw affects s390 (IBM Z mainframe) systems running KVM virtualization and has now been patched upstream; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.20%, 10th percentile).
Local memory corruption in the Linux kernel's vhost-net driver arises from mishandling of zerocopy TX completion: vhost_zerocopy_complete() treats every ubuf_info callback as a finished vhost descriptor, so when the networking stack clones a zerocopy skb (e.g. batman-adv fragmentation via skb_split/skb_zerocopy_clone, or veth forwarding via skb_copy_ubufs) and a backend reset frees the vhost_net_ubuf_ref, a later delayed completion dereferences the freed ubufs pointer - a slab use-after-free confirmed by KASAN. It affects virtualization hosts running vhost-net with zerocopy TX, and a successful trigger yields kernel memory corruption (crash and potential privilege escalation). There is no public exploit identified at time of analysis, EPSS is low (0.17%), and a vendor patch is available across multiple stable branches.
Use-after-free / torn-entry race in the Linux kernel's Intel VT-d IOMMU driver (iommu/vt-d) lets the hardware walk a stale scalable-mode context entry pointing at freed PASID directory memory during device_pasid_table_teardown(), producing spurious DMA faults, unpredictable IOMMU behavior, and potential memory corruption. It affects Linux 6.8.2 through the 6.x/7.x stable series on systems using Intel scalable-mode (PASID) IOMMU translation. There is no public exploit identified at time of analysis and EPSS is low (0.16%), but the vendor-released fix is available in the stable trees.
Out-of-bounds kernel memory read and incomplete invalidation affect the Linux kernel's ARM SMMUv3 iommufd nested-virtualization path (arm_vsmmu_vsid_to_sid), where a guest virtual Stream ID is mapped to a single physical Stream ID from master->streams[0]. On ARM64 hosts using nested SMMUv3 with iommufd vDEVICE, assigning a device that has zero streams turns master->streams into a ZERO_SIZE_PTR that is read out of bounds, while a device with multiple streams leaves the other streams' ATC/IOTLB entries unreachable by guest invalidations. There is no public exploit identified at time of analysis, and EPSS is very low (0.15%, 5th percentile), consistent with a niche subsystem rather than broad exploitability despite the 9.3 CVSS.
Local privilege-escalation/denial-of-service via a use-after-free in the Linux kernel's KVM x86 I/O APIC emulation (CVE-2026-74517): during VM teardown the delayed I/O APIC EOI work (kvm_ioapic_eoi_inject_work) can execute after the target vCPUs are freed, causing __kvm_irq_delivery_to_apic_fast to read freed slab memory. Any local principal able to create and run a KVM guest can race VM destruction against a pending delayed EOI to corrupt host kernel memory. EPSS is low (0.15%, 5th percentile) and the issue is not on CISA KEV; no public exploit is identified, and the reporter/tags frame the practical impact as denial of service.
Local privilege escalation and host memory corruption in the Linux kernel's KVM arm64 virtual GIC (vgic) LPI handling allows a malicious guest to trigger a use-after-free by racing LPI release against re-registration. Affecting arm64 KVM hosts (introduced by the LPI refcounting rework, present through Linux 6.17), a guest that issues an ITS DISCARD while an LPI is still referenced and then re-maps the same INTID via MAPTI can cause the kernel to erase a newly registered LPI from the xarray or leak an orphaned structure. There is no public exploit identified at time of analysis and EPSS is low (0.14%), but the scope-changing guest-to-host impact makes this a meaningful host-integrity issue.
Arbitrary file deletion in the RapiSafe - Secure Multi File Upload for Contact Form 7 WordPress plugin (versions through 1.0.4) lets unauthenticated attackers delete any file the web server can write to, and deleting wp-config.php can pivot to remote code execution by forcing WordPress into its installer flow. The flaw stems from missing path validation in the handleAjaxRemoveUpload AJAX handler, and the CSRF nonce that gates the handler is leaked to any anonymous visitor as RSMFCF7Vars.nonce in the page's public JavaScript, neutralizing the only access control. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS base score is 9.1 (Critical).
Improper error handling in the Linux kernel's RDMA/bnxt_re driver (Broadcom NetXtreme RoCE) causes bnxt_qplib_alloc_dpi() to report success even when the underlying ioremap() call fails, leaving callers to operate on an unmapped/invalid Doorbell Page Index resource. Affected kernels are 6.5 and later on systems using the bnxt_re driver with Broadcom RDMA-capable NICs. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is very low (0.15%), so the practical risk is confined to local DoS/robustness rather than remote compromise, despite the high assigned CVSS of 9.2.
Netfilter ip6tables rule evasion in the Linux kernel allows remote attackers to slip malformed IPv6 packets past firewall policy. The ah, hbh, and rt matches for IPv6 extension headers derived the header length without fully validating it against available skb data, so a packet whose advertised extension-header length exceeded the real data was treated as a rule mismatch (returning false) rather than being dropped - letting it bypass ip6tables rules specifically written to drop such traffic. The fix sets hotdrop=true so malformed packets are discarded. No public exploit identified at time of analysis; EPSS is low (0.23%, 14th percentile) and this is not in CISA KEV.
Denial-of-service in the Linux kernel's IFE (Inter-Forwarding-Element) traffic-control action allows a crafted, malformed IFE frame to crash the host, because ife_decode() only guaranteed the outer IFE header was pullable before handing the decapsulated packet to eth_type_trans(), which then reads an inner Ethernet header that may be shorter than ETH_HLEN in the linear skb area. Only systems that have the tc act_ife action configured are exposed. There is no public exploit identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not in CISA KEV; the fix adds ETH_HLEN to the pull check.
Firewall policy bypass in the Linux kernel's netfilter nftables subsystem allows remote attackers to evade packet-filtering rules that use inverted set lookups. The flaw lives in nft_lookup_eval(), where the match result for negated lookups ('!= @set') is computed before the catchall element used by interval sets is folded in, so rules resolve to the wrong verdict. It affects the nf_tables classifier across a wide range of kernel branches; there is no public exploit identified at time of analysis and EPSS probability is low (0.21%).
Heap out-of-bounds write in the Perl DBI module before version 1.652 lets an attacker who reaches the preparse() routine with attacker-controlled SQL corrupt heap memory when the ':pN' / ':N' (named-to-numbered) placeholder return style is used. A numeric placeholder such as ':2147483648' is parsed with atoi() and stored in the binder counter with no range check; on glibc it wraps negative, and each following '?' then expands to a 14-byte ':p-2147483648' string into a buffer that budgeted only 7 bytes per input byte. Exploitation status: no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile), and it is not in CISA KEV.
Improper validation of on-disk metadata in the Linux kernel's legacy NTFS driver allows a crafted NTFS filesystem image to smuggle an error-marked MFT (Master File Table) reference back through ntfs_lookup_inode_by_name(), causing directory-lookup callers to misinterpret corrupted disk data as a legitimate pseudo-errno. This affects systems that mount attacker-supplied NTFS volumes; there is no public exploit identified at time of analysis and the EPSS probability is low (0.20%). The upstream fix normalizes any error-marked reference to ERR_MREF(-EIO) so callers can no longer be tricked into consuming a bogus value.
Local volume corruption and a writeback deadlock affect the Linux kernel NTFS driver (fixed in 7.1.5 and 7.2-rc3) when a filesystem is mounted with the non-default show_sys_files option and userspace writes to an exposed base metadata file such as $Bitmap; because the cluster allocator scans $Bitmap through the same inode page cache, the write both corrupts the volume and deadlocks writeback against an already-locked folio. Only affected when the opt-in show_sys_files mount option is set, so this is a local integrity/availability issue rather than a remote one. There is no public exploit identified at time of analysis, EPSS is 0.20% (10th percentile), and it is not in CISA KEV.
Out-of-bounds read in the Linux kernel's SCTP protocol implementation allows a malicious SCTP peer to trigger memory over-reads during INIT or ASCONF chunk processing. The flaw stems from insufficient validation of an embedded address parameter's declared length inside ADD_IP, DEL_IP, and SET_PRIMARY ASCONF parameters, letting a crafted peer advertise a length exceeding the enclosing parameter's bounds. No public exploit has been identified at time of analysis, EPSS is low (0.18%), and it is not on CISA KEV, but the CVSS 9.1 score reflects remote unauthenticated reachability against SCTP-enabled hosts.
Improper credential context in the Linux kernel's in-kernel SMB3 server (ksmbd) allows an attacker with an open SMB handle to have SET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION FSCTL operations executed under the ksmbd worker's credentials instead of the credentials captured when the file was opened. Because the underlying VFS xattr, fallocate and fileattr helpers revalidate inode permissions, ownership and LSM policy against those worker credentials rather than the SMB handle's access mask, an attacker can corrupt or zero file data and alter file attributes beyond what their handle should permit (CVSS 9.1, I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not in CISA KEV; the upstream fix is merged into stable kernels.
Denial-of-service (kernel crash) in the Linux kernel's veth driver affects hosts running an XDP program with AF_XDP sockets in copy mode bound to a virtual ethernet interface. When a frag_list skb (data_len set, nr_frags zero) reaches veth_convert_skb_to_xdp_buff(), the driver advertises XDP fragment metadata for a non-existent frags[] array, causing __xsk_rcv() to walk an empty fragment and crash inside memcpy(). NVD rates it CVSS 9.1, though the underlying tags and code path point to availability impact (crash) rather than the confidentiality loss the vector claims; EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis.
Session-binding authentication weakness in the Linux kernel's ksmbd in-kernel SMB3 server allows different SMB clients to be treated as identical because ClientGUID values were compared with strncmp(), which halts at the first embedded NUL byte. An attacker able to reach an exposed ksmbd share could exploit this to bind to another client's authenticated SMB3 multichannel session or bypass FSCTL_VALIDATE_NEGOTIATE_INFO integrity checks, exposing high confidentiality and integrity impact per the CVSS 9.1 rating. There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), indicating no observed exploitation activity.
Improper permission handling in the KVM ARM64 nested-virtualization (NV) subsystem of the Linux kernel (6.16 through fixes in 6.18.40/7.1.5) lets a malicious L1 guest hypervisor write to a read-only backing page and trigger a page reference leak on the host. When mapping the L1 VNCR page into the host stage-1, KVM trusted only the guest stage-1 permissions and ignored that the backing PFN may be read-only (e.g. a read-only memslot), permitting writes to memory that should be immutable and leaking pages on the read-only early-return path. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the issue is not in CISA KEV.