Linux kernel's ntfs3 filesystem driver crashes and may corrupt memory when processing a crafted NTFS image due to an unbounded memmove in the DeleteIndexEntryAllocation code path. Any local user able to mount a malformed NTFS volume can trigger a kernel oops through a negative ptrdiff_t silently cast to a near-maximal size_t, causing memmove to walk far past the destination buffer. No public exploit and no CISA KEV listing exist at time of analysis; EPSS is low at 0.21%, but the memory corruption primitive and local-to-kernel boundary crossing make this a meaningful privilege escalation and availability risk on systems where unprivileged NTFS mounts are possible.
Use-after-free in the Linux kernel TPM subsystem's tpm_buf_append_salt() function triggers automatic kernel memory corruption on systems equipped with asynchronous KPP cryptographic hardware backends. The defect fires continuously and without any userland action - the hwrng_fillfn kernel thread invokes the vulnerable code path on every entropy poll via tpm2_get_random → tpm2_start_auth_session → tpm_buf_append_salt, causing a deferred completion worker to dereference a freed kpp_request when the async backend returns -EINPROGRESS. No public exploit has been identified at time of analysis and EPSS is 0.20% (10th percentile), but the kernel-space use-after-free carries inherent privilege escalation and denial-of-service risk on affected hardware configurations.
Inconsistent $INDEX_ROOT attribute header validation in the Linux kernel's legacy ntfs filesystem driver exposes systems to potential kernel-level memory corruption when processing maliciously crafted NTFS volumes. Kernel versions from the initial NTFS implementation through 7.1.4 stable are affected across both directory inode and named index inode read paths, with fix releases confirmed at 7.1.5 stable and 7.2-rc1 mainline. No public exploit has been identified at time of analysis, and EPSS exploitation probability is 0.20% (10th percentile), though the CVSS 8.4 High score reflects the theoretical severity of kernel-space memory corruption if the vulnerability is successfully reached.
Stack type confusion in the Linux kernel BPF verifier allows a local attacker to bypass non-scalar pointer spill validation and treat a live kernel pointer slot as an ordinary scalar stack read. Affected are Linux 7.1 stable series prior to commit 0f9278b22cda and mainline prior to 3a354149bcea, with fixes confirmed in Linux 7.1.5 and 7.2-rc1. Successful exploitation permits full kernel memory read and write access, enabling local privilege escalation; no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Linux kernel staging nvec driver's nvec_rx_completed() function exposes Tegra-based systems to potential kernel memory corruption. The flaw arises from a TOCTOU race: nvec_msg_free() releases a message pool slot atomically, but the immediately following read of nvec->rx->data[0] occurs after that release - allowing a concurrent nvec_msg_alloc() to reclaim and overwrite the same slot. No public exploit has been identified at time of analysis, and the very low EPSS score (0.18%, 8th percentile) reflects the niche Tegra hardware prerequisite and staging driver context. Fixed commits are available across multiple stable kernel branches.
Slab-out-of-bounds read in the Linux kernel ntfs3 filesystem driver exposes kernel heap memory and can cause a denial of service when a crafted NTFS volume is mounted. The flaw resides in `run_get_highest_vcn()`, which iterates over NTFS mapping-pairs buffers with no length bound, trusting a 0x00 terminator that a crafted $LogFile UpdateMappingPairs record can omit; the bug fires unconditionally during `ntfs_fill_super` on mount of the malicious image. Affected stable series span Linux 6.1.x through 7.0.x; the EPSS score is 0.18% (8th percentile) and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.
Missing bounds enforcement in the Linux kernel ALSA USB audio driver's implicit-feedback path allows a physically-connected malicious USB device to inject oversized sync packets that propagate un-clamped into the playback endpoint queue. The un-clamped frame count - potentially exceeding ep->maxframesize - can drive packet transfers beyond hardware frame limits, risking kernel memory corruption with high confidentiality, integrity, and availability impact. No public exploit has been identified and EPSS is 0.17% (6th percentile), but patches are confirmed across multiple stable kernel branches including 6.6.151, 6.12.103, 7.1.8, and 6.18.44.
Use-after-free in the Linux kernel netfilter ipset subsystem enables local kernel memory corruption with potential for privilege escalation. During an ipset hash resize (`mtype_resize()`), comment pointers are shallow-copied via `memcpy()` rather than deep-copied, causing both old and new table entries to share the same `ip_set_comment_rcu` pointer; an `xt_SET --add-set --exist` packet hitting the old entry during this window calls `ip_set_init_comment()`, freeing the shared pointer and leaving the new table entry with a dangling reference that is later dereferenced in `strlen()` during backlog replay. Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6), no public exploit has been identified, and EPSS sits at 0.17% (6th percentile), indicating very low observed exploitation pressure at time of analysis.
NULL pointer dereference and use-after-free in the Linux kernel i2c-imx driver (NXP i.MX SoC family) allows a local attacker or concurrent kernel path to trigger kernel memory corruption during I2C slave unregistration. The race condition in i2c_imx_unreg_slave() permits a pending hrtimer callback to fire after the slave pointer has been cleared, causing i2c_imx_slave_finish_op() to dereference a NULL pointer with potential for privilege escalation or system crash. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.17% (6th percentile) confirms low exploitation likelihood, though the CVSS base score of 8.4 reflects high potential impact if triggered.
Out-of-bounds array read in the Linux kernel's AMD ACP SoundWire SOF audio driver exposes kernel memory to local attackers on systems equipped with AMD SoundWire hardware. The flaw in create_sdw_dailinks() allows iteration past the end of the allocated sof_dais array when all entries are initialized, lacking any bounds guard on the loop termination condition. No active exploitation is recorded (EPSS 0.17%, 6th percentile; no CISA KEV entry), and patches are available across multiple Linux stable branches.
Out-of-bounds array access in the Linux kernel's nvme-pci driver crashes the kernel and prevents NVMe namespaces from appearing as /dev nodes on systems built without NUMA support (CONFIG_NUMA=n). The root cause is a signed-to-unsigned type mismatch: NUMA_NO_NODE (-1) is cast to UINT_MAX when passed through a parameter declared 'unsigned', causing nvme_setup_descriptor_pools() to index far beyond the bounds of the descriptor pool array (sized to nr_node_ids). No active exploitation has been identified (not in CISA KEV), and EPSS of 0.17% reflects negligible real-world exploitation probability, though the CONFIG_NUMA=n precondition significantly limits the exposed population to non-enterprise kernel builds.
Out-of-bounds slab read in the Linux kernel's ASoC AMD ACP SoundWire legacy machine driver allows a local attacker - or a hardware-triggered probe path - to read beyond an allocated array in create_sdw_dailinks(), potentially causing kernel memory disclosure or denial of service. The vulnerability is introduced when all DAI link entries are initialized, causing the boundary-unchecked loop to walk past the end of the soc_dais allocation. KASAN confirmed the read-of-size-1 in mc_probe(). EPSS is at 0.17% (6th percentile) and the vulnerability is not listed in CISA KEV; no public exploit has been identified at time of analysis. Fixes are available for Linux stable branches 6.18.40 and 7.1.5, as well as the 7.2-rc1 mainline.
Out-of-bounds kernel memory access in the Linux kernel CXL (Compute Express Link) region driver allows a local attacker on systems equipped with CXL memory hardware to corrupt kernel memory by causing cxl_cancel_auto_attach() to use a negative errno value as an array index into p->targets[]. The flaw originates when cxl_region_sort_targets() fails - setting cxled->pos to a negative errno - and that invalid index is later used directly without validation. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.15% at the 5th percentile, reflecting very low real-world exploitation probability consistent with the niche CXL hardware requirement.
Hard-coded TR-069 remote management credentials in LB-LINK X-PRO firmware 1.0.22-20231206 allow network-accessible unauthenticated attackers to authenticate to the device's CWMP interface via static credentials embedded in /etc/config/easycwmp. A public proof-of-concept exploit has been released, effectively eliminating the primary barrier to exploitation. The vendor was unresponsive to coordinated disclosure, and no patch has been issued; no public exploit identified at time of analysis as confirmed active exploitation (CISA KEV listing absent), though publicly available exploit code exists.
IPVS (IP Virtual Server) SCTP state tracking in the Linux kernel misreads chunk headers for IPv6 packets carrying extension headers, causing incorrect connection state transitions that affect load balancer behavior and resource accounting. The IPVS subsystem, widely deployed in Kubernetes and LVS environments via kube-proxy, can misclassify an SCTP INIT packet as an already-ESTABLISHED connection when the IPv6 packet includes extension headers (e.g., an 8-byte Destination Options header), because set_sctp_state() hardcodes sizeof(struct ipv6hdr) as the transport offset rather than using the offset already resolved by ipv6_find_hdr(). No public exploit identified at time of analysis, and EPSS at 0.21% (12th percentile) confirms very low current exploitation interest despite the CVSS 8.2 score.
Metadata corruption in the Linux kernel traffic control connection-tracking action (act_ct) allows remote attackers to crash systems or corrupt qdisc packet-segment state by sending fragmented IP or IPv6 traffic. The flaw exists because tcf_ct_handle_fragments() invokes nf_ct_handle_fragments() without preserving skb->cb, so the netfilter defragmentation helper silently overwrites tc_skb_cb/qdisc_skb_cb in-place - the same memory region. On hosts with panic_on_warn enabled, this triggers a WARN_ON_ONCE in qdisc_pkt_segs() that escalates to a kernel panic. EPSS is low (0.21%, 11th percentile) and the vulnerability is not in CISA KEV, indicating opportunistic exploitation is unlikely but targeted denial-of-service against network appliances or container hosts using tc act_ct is realistic.
Kernel panic via NULL pointer dereference in Linux's taprio traffic scheduler (net/sched/sch_taprio) delivers system-level denial of service when a non-work-conserving child qdisc such as qfq is attached to a taprio parent. The defect in taprio_dequeue_from_txq() calls the child's ->dequeue() function pointer directly rather than via qdisc_dequeue_peeked(), bypassing the child's gso_skb stash, orphaning the peeked skb, desyncing qlen/backlog counters, and re-entering the child on an emptied list - triggering a NULL dereference from softirq context during ordinary egress traffic. No public exploit has been identified at time of analysis, and EPSS stands at 0.20% (10th percentile), indicating very low opportunistic exploitation probability; the vulnerability is not listed in CISA KEV.
KVM on AMD SVM-enabled hosts fails to update x2APIC MSR intercepts when AVIC is inhibited while a nested guest (L2) is running, allowing an L1 guest with root-level privileges to directly access the host's APIC state, send arbitrary interrupts, and crash the host kernel. Affected Linux kernels from 6.0 through multiple stable branches expose the host to interrupt manipulation, task priority changes, and denial-of-service. A functional proof-of-concept demonstrating both spurious interrupt injection and wakeup handler corruption is embedded in the CVE description itself; this vulnerability is not currently listed in the CISA KEV catalog and carries a 0.17% EPSS score consistent with its narrow but severe exploitation conditions.
RB-tree corruption in the Linux kernel iommu/vt-d driver allows a privileged local attacker to corrupt kernel memory structures during device probe error handling, leading to potential kernel panic, privilege escalation, or information disclosure. Affected systems must have Intel VT-d IOMMU enabled and encounter a device that does not support Address Translation Services (ATS) followed by a probe step failure. No public exploit code has been identified and no CISA KEV listing exists, but the Changed Scope (S:C) CVSS flag signals that kernel-level corruption can cascade across process and subsystem boundaries. Upstream fixes are available in stable branches targeting kernel 6.18.40, 7.1.5, and 7.2-rc1.
Integer overflow in the Linux kernel SMB client's smb2_ioctl_query_info() function enables a malicious SMB server to bypass bounds checking during PASSTHRU_FSCTL response processing, leading to an out-of-bounds kernel memory read disclosed to userspace. Affected systems are Linux kernels across multiple stable branches where OutputOffset and qi.input_buffer_length are summed without overflow protection, allowing a server-controlled 32-bit wrap to defeat the bounds check and cause copy_to_user() to read beyond the response buffer. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% reflects low current exploitation probability, but the network-reachable attack surface and high confidentiality impact (CVSS 8.1) make patching a near-term priority for any Linux host using SMB client connectivity.
Out-of-bounds read in the Linux kernel's batman-adv multicast tracker exposes adjacent-network unauthenticated attackers to kernel memory disclosure or denial-of-service via a crafted TVLV mcast tracker packet. The root cause is a C macro misuse - offsetof() on the first struct member always evaluates to 0, making the bounds check a no-op that permits access to num_dests even when only 0 or 1 byte is in the received packet instead of the required 2. EPSS is 0.21% (11th percentile), no CISA KEV entry exists, and no public exploit is identified; vendor-released patches are available in Linux 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3.
Race condition in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows adjacent network attackers to corrupt CAN frame state and trigger spurious RX_TIMEOUT notifications. The flaw exists in ANYDEV rx operations (ifindex == 0) where concurrent frame delivery from multiple CAN interfaces races hrtimer_cancel(), bcm_rx_starttimer(), and bcm_rx_timeout_handler() on different CPUs, leading to last_frames corruption and clobbering of shared rx_ifindex/rx_stamp fields. No public exploit has been identified at time of analysis; EPSS is 0.21% (11th percentile), indicating very low current exploitation probability.
Out-of-bounds read in the Linux kernel cfg80211 WiFi subsystem allows an adjacent-network unauthenticated attacker to disclose kernel memory or crash the system by sending a crafted EHT Multi-Link Element inside an MBSSID beacon frame. Affected kernels fail to call ieee80211_mle_type_ok() before passing the element to ieee80211_mle_get_mld_id(), violating the helper's documented contract and allowing reads past the IE boundary. No public exploit exists and EPSS is 0.20% (10th percentile), but the attack requires only radio proximity to a device with Wi-Fi scanning active - no authentication and no user interaction needed.
Out-of-bounds read in the Linux kernel's rtw88 PCIe WiFi driver allows an adjacent-network attacker to trigger kernel memory disclosure or a system crash via crafted WiFi RX descriptor values. Systems running unpatched kernels with Realtek RTW88-series WiFi chipsets attached over PCIe are affected; the USB transport path was already protected by an equivalent check. The vulnerability arises because the PCIe receive path in rtw_pci_rx_napi() does not validate that the firmware-derived new_len value stays within the pre-allocated DMA buffer before calling skb_put_data. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog.
Out-of-bounds heap read in the Linux kernel's wcn36xx WiFi driver exposes kernel memory and risks system crashes on any adjacent-network attacker within radio range of a device using a Qualcomm WCN36xx series chipset. The flaw, introduced at commit 43efa3c0f241e04862be8e6a68ff765d36cde1ba (Linux 4.11 era), allows the PRINT_REG_INFO firmware indication handler to iterate over rsp->regs[] using a firmware-controlled rsp->count value that is never validated against the actual received message length, enabling reads beyond the heap-allocated buffer. No public exploit has been identified and EPSS is very low at 0.18% (7th percentile), but the CVSS 8.1 score and the availability of patches across seven stable branches make this a concrete patch priority for platforms running Qualcomm WCN36xx hardware.
Key-based authorization bypass in @fastify/jwt before 10.2.2 permits any low-privileged authenticated user holding a token signed by the application's global secret to access routes explicitly restricted to a separate per-request key, silently crossing a cryptographic trust boundary. Applications implementing multi-domain JWT authorization - for example, separating user and admin token verification keys - are specifically at risk, as the plugin's option merge incorrectly applies the global key last, overriding the developer-supplied per-request key. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the fix is available in version 10.2.2 and the attack path is mechanically straightforward for any authenticated user.
Missing socket lock in the Linux kernel Bluetooth ISO subsystem exposes a race condition in iso_sock_getname that allows a low-privileged adjacent attacker to trigger a use-after-free or null-pointer dereference via concurrent connection teardown. Systems running affected kernel versions with Bluetooth ISO (Isochronous) sockets enabled are vulnerable to kernel crashes or memory disclosure. No public exploit code exists and EPSS probability is 0.17%, but the CVSS 8.0 score reflects the potential for high-impact memory corruption if the race is won.
Use-after-free in the Linux kernel's Bluetooth HCI synchronization subsystem allows an adjacent-network attacker with low privileges to pass freed hci_conn pointers to hci_conn_valid(), where kmalloc may have reallocated that memory to unrelated objects. Affected Linux kernel versions across multiple stable branches expose systems with active Bluetooth to potential kernel memory corruption, yielding full confidentiality, integrity, and availability impact at the kernel level. No public exploit code has been identified and CISA KEV does not list this CVE; however, the HIGH CVSS score and kernel-level CIA:H/H/H impact justify prompt patching on any Bluetooth-enabled Linux host.
The octeontx2-af driver in the Linux kernel mishandles SR-IOV mailbox requests for nix_set_rx_mode, allowing a low-privileged user controlling a Virtual Function on Marvell OcteonTX2 hardware to silently delete the Physical Function's MCAM promiscuous and allmulti filtering rules through ordinary interface bringup or teardown operations. Affected Linux kernel versions span 5.14 through multiple stable branches, patched in 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), consistent with negligible observed exploitation activity and the hardware-specific attack surface.
Shift-out-of-bounds undefined behavior in the Linux kernel's MAX3421E USB host controller driver (`max3421-hcd`) allows a local low-privileged user with access to the raw USB device node to corrupt kernel hub state. The `max3421_hub_control()` function blindly shifts the integer constant 1 left by an attacker-controlled `wValue` field without bounds-checking, so any value ≥ 32 invokes undefined behavior that arbitrarily corrupts `max3421_hcd->port_status`, including immutable change bits that gate internal state transitions. No public exploit exists and this CVE is not in the CISA KEV catalog; EPSS at 0.25% (16th percentile) reflects low exploitation likelihood, but the CVSS 7.8 is grounded in a genuine local privilege-escalation primitive within the kernel USB subsystem.
Integer overflow in the Linux kernel's ASoC Sound Open Firmware (SOF) IPC3 control handler allows a local, low-privileged attacker on 32-bit platforms to bypass buffer size validation and trigger out-of-bounds memory access in `snd_sof_update_control`. The flaw exists because `sof_ipc3_control_update()` performs unguarded arithmetic on firmware-supplied `cdata->num_elems`, which wraps on 32-bit integer arithmetic and causes the subsequent header size check to pass with mismatched values. No public exploit code exists and no CISA KEV listing is present; EPSS probability is 0.23% at the 14th percentile, with vendor patches available across multiple stable kernel branches.
Heap overflow in the Linux kernel ASoC SOF IPC3 control subsystem allows a local low-privileged user to write past the end of a kernel heap allocation and over-read adjacent heap memory via the ALSA TLV kcontrol interface. The root cause is an off-by-offset bounds check in `bytes_ext_put` and `bytes_ext_get` that compared user-supplied lengths against the full allocation size rather than the actual payload capacity at `cdata->data`, enabling up to `sizeof(struct sof_ipc_ctrl_data)` bytes of out-of-bounds write and disclosure. Patched versions are confirmed across multiple stable branches (6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2-rc1); no public exploit or active exploitation has been identified at time of analysis.
Integer underflow in the Linux kernel's jbd2 journaling subsystem corrupts critical journal metadata, aborting the filesystem journal and rendering affected ext4 volumes unavailable. Local, low-privileged attackers on unpatched systems running ext4 with the fast-commit feature can trigger the arithmetic wraparound in jbd2_journal_initialize_fast_commit() to corrupt j_last, j_fc_first, and j_free, with CVSS scoring this at 7.8 (AV:L/AC:L/PR:L). No public exploit code has been identified and CISA KEV listing is absent, with EPSS at 0.22% (14th percentile), but the breadth of the patch set across six stable kernel branches signals meaningful engineering priority across the fleet.
Netfilter IPv6 fragment reassembly in the Linux kernel incorrectly advances the sk_buff MAC header offset on the NF_INET_LOCAL_OUT path, where no link-layer header exists, causing a u16 integer wrap that leaves the MAC header pointer aimed at kernel headroom. All Linux kernels from version 2.6.15 through the stable-branch patch releases (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5) are affected when the nf_conntrack_ipv6 module is loaded. A local low-privilege attacker can send crafted IPv6 fragmented packets to trigger the vulnerable reassembly code path, potentially achieving information disclosure of kernel memory or a kernel panic; no public exploit or active exploitation has been identified at time of analysis.
Kernel memory corruption in the Linux kernel's MTD slram driver stems from a link-before-initialize race in `register_device()`, where new `slram_mtdlist` entries are inserted into the global device list before all required state (memory allocation, `memremap()`, and `mtd_device_register()`) is fully committed. When any of these subsequent operations fail, the partially initialized entry persists on the list, and later cleanup code dereferences or frees invalid kernel memory - enabling potential local privilege escalation from low-privileged access to full kernel compromise. EPSS is 0.22% (13th percentile), no CISA KEV listing exists, and no public exploit has been identified at time of analysis, collectively indicating low near-term exploitation likelihood despite the high CVSS score of 7.8.
Out-of-bounds memory access in the Linux kernel MTD raw NAND subsystem allows a local low-privilege user to corrupt or read kernel memory via an improper bounds check in `nand_select_target()`, where the chip-select index `cs` is not validated against `nanddev_ntargets()`. Affected systems span Linux 5.2 through current stable branches across multiple LTS lines; patched releases are available. No public exploit code exists and the vulnerability is not listed in CISA KEV, with EPSS at 0.22% (13th percentile), indicating low real-world exploitation probability despite the high CVSS score of 7.8.
The OCFS2 extent-move ioctl (OCFS2_IOC_MOVE_EXT) in the Linux kernel permits a local user with write access to an OCFS2-mounted filesystem to trigger cross-inode data corruption and information disclosure by supplying a crafted physical goal cluster that an uninitialized probe output allows to survive a failed scan. Affected kernel versions span from approximately Linux 3.0 (commit e6b5859cccfa0fec) through all stable branches prior to the fix releases in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit has been identified at time of analysis, and EPSS probability is 0.22% (13th percentile), consistent with a subsystem-specific kernel bug requiring deliberate targeting.
Out-of-bounds heap read and write in the Linux kernel TPM character device driver exposes kernel heap memory to local low-privileged users with access to /dev/tpm0 or /dev/tpmrm0. The TPM char device open handlers fail to call nonseekable_open(), leaving FMODE_PREAD and FMODE_PWRITE enabled on a device that only supports sequential command/response I/O; a pread() call with a large offset (e.g., 0x1400) passes that offset unchecked into tpm_common_read(), causing an out-of-bounds heap read via copy_to_user() and a subsequent out-of-bounds zero-write via memset(). No public exploit is identified at time of analysis, EPSS sits at 0.22% (13th percentile), and patches are available across all active Linux stable branches.
Use-after-free in the Linux kernel CAN isotp (ISO 15765-2 Transport Protocol) socket subsystem enables a local low-privileged attacker to corrupt freed kernel memory, potentially escalating privileges to root. The race arises because isotp_notify() clears so->bound via can_rx_unregister() without a subsequent RCU grace period, causing isotp_release() to skip synchronize_rcu() and cancel so->rxtimer while an in-flight isotp_rcv() callback is still executing and about to re-arm it via isotp_send_fc(). Multiple Linux stable branches from 5.10 through pre-7.2-rc4 are affected; vendor-released patches are confirmed across eight stable-tree commits. No public exploit identified at time of analysis; EPSS is 0.22% at the 13th percentile.
Missing RCU (Read-Copy-Update) list synchronization primitives in the Linux kernel's CAN BCM (Broadcast Manager) subsystem expose local low-privilege users to a race-condition memory hazard affecting all kernel stable branches from 5.4 through 6.15. Two distinct defects compound the risk: bcm_[rx|tx]_setup() uses plain list_add() instead of list_add_rcu(), allowing bcm_proc_show() to observe partially initialized bcm_op structures under rcu_read_lock(); and bcm_release() invokes bcm_remove_op() - which schedules memory reclamation via call_rcu() - without first calling list_del_rcu(), creating a use-after-free window while the op remains traversable. No public exploit code has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) indicates low current exploitation probability despite the CVSS 7.8 High rating.
Integer wraparound in the Linux kernel's dm-log subsystem on 32-bit architectures allows a local attacker to trigger a bitset_size overflow, potentially causing kernel memory corruption. Specifically, when region_size is close to UINT_MAX and bitset_size is rounded up to a multiple of BITS_PER_LONG, a 32-bit size_t wraps around to zero, leading to an incorrect zero-byte bitmap allocation and subsequent out-of-bounds write conditions. No public exploit is identified at time of analysis, and EPSS probability is low (0.22%, percentile 13%), but the CVSS 7.8 local score reflects the potential for full system compromise once the specific conditions are met.
Double-free memory corruption in the Linux kernel's device mapper subsystem allows a local attacker to trigger kernel memory corruption by causing dm_resume failure during early device creation, potentially leading to privilege escalation or system crash. Affected systems run kernel versions from approximately Linux 5.1 through multiple stable branches prior to the respective patch commits; fixes are available across all major stable series from 5.10 through 7.2-rc3. No public exploit code exists and EPSS exploitation probability is extremely low at 0.22% (13th percentile), though the high CVSS impact metrics (C:H/I:H/A:H) reflect the potential severity if the error path is successfully triggered and weaponized.
Error-masking in the Linux kernel CPU hotplug subsystem allows a failed CPU state transition to silently appear successful to callers, spanning stable branches from 4.14 through 7.1.x. The root cause is that cpuhp_invoke_callback() reuses the ret variable in its rollback path: when one instance callback fails and the subsequent rollback succeeds, the rollback's zero return overwrites the original non-zero error, hiding the failure from higher-level consumers. No active exploitation is confirmed - EPSS sits at 0.22% (13th percentile) and there is no CISA KEV listing - but patches are available across all affected stable branches.
Use-after-free in the Linux kernel dmaengine subsystem allows a local low-privileged attacker to corrupt kernel memory or crash the system by racing DMA channel release against DMA provider device teardown. The flaw exists in `dma_release_channel()` across kernels from 2.6.30 through multiple active stable branches, with patches confirmed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. No public exploit has been identified at time of analysis, and the EPSS probability of 0.22% (13th percentile) indicates very low near-term exploitation likelihood despite the High CVSS score.
Shift-out-of-bounds in the Linux kernel's XFRM subsystem allows a local low-privileged attacker to corrupt kernel memory by crafting an AF_UNSPEC selector with an oversized prefixlen (e.g., 128) and triggering a match against an IPv4 flow when XFRM_STATE_AF_UNSPEC is set. Affected systems span multiple long-term stable kernel branches from 4.19 through 6.12.x, with patched versions available across all impacted series. No public exploit has been identified and the vulnerability is not in CISA KEV; EPSS at 0.22% confirms minimal observed exploitation activity.
Incorrect RCU (Read-Copy-Update) operation ordering in the Linux kernel's netfilter ipset subsystem allows a local attacker with low privileges to trigger a use-after-free condition in kernel memory, potentially leading to privilege escalation or system crash. The flaw exists because kfree_rcu() was called before rcu_assign_pointer() in the comment extension handling path - scheduling memory for freeing before the pointer update is visible to all CPUs, creating a race window. With a CVSS score of 7.8 and an EPSS of 0.22% (13th percentile), this is assessed as a serious local privilege escalation with low likelihood of opportunistic exploitation. No public exploit has been identified and CISA KEV status is not confirmed.
Double-free memory corruption in the Linux kernel's sungem (Sun GEM) Ethernet driver probe error path allows local attackers to trigger kernel heap corruption on systems equipped with Sun GEM hardware. gem_init_one() incorrectly delegates cleanup to gem_remove_one() on register_netdev() failure - which frees DMA blocks, MMIO mappings, PCI regions, and the net_device struct - then falls through to its own cleanup labels that attempt to release the same already-freed resources. No public exploit or active exploitation is identified at time of analysis; EPSS is 0.22% (13th percentile), consistent with the extreme obsolescence of the affected hardware.
Out-of-bounds read in the Linux kernel's SRv6 (Segment Routing for IPv6) subsystem allows a local attacker with BPF program execution capability to read kernel memory past a caller-supplied buffer boundary. The flaw in seg6_validate_srh() - reachable via BPF helpers bpf_lwt_push_encap() and the SEG6 local actions END_B6 and END_B6_ENCAP - permits a crafted 2-byte SEG6 encap header to trigger a kernel out-of-bounds read before any minimum-size validation occurs. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; the EPSS score of 0.22% (13th percentile) reflects low current exploitation probability.
Undefined-behavior shift in the Linux kernel's netfilter xt_u32 match module allows a local attacker with CAP_NET_ADMIN to supply malformed packet-filter rules containing shift counts of 32 or more, triggering out-of-bounds shift operations on 32-bit values in u32_match_it() during live packet evaluation. The vulnerability affects all kernel versions from 2.6.23 (when xt_u32 was introduced) through the stable-branch fix commits, with patched versions confirmed across six stable trees. No active exploitation (KEV) or public proof-of-concept has been identified; EPSS sits at the 13th percentile, reflecting currently limited exploitation probability.
The regulator subsystem in the Linux kernel contains a deadlock-handling defect where `regulator_lock_two()` compares the return value of `ww_mutex_lock()` against `-EDEADLOCK` instead of the correct `-EDEADLK` constant. On MIPS architecture - the only platform where the regulator core is active and these two error constants carry different numeric values - the mismatch causes the kernel to skip the mandatory unlock-and-retry backoff sequence, fire `WARN_ON`, and return to the caller with only one of the two regulators locked, producing corrupted locking state. No public exploit has been identified and EPSS is very low (0.22%, 13th percentile), but the high CVSS impact ratings (C:H/I:H/A:H) reflect the potential for kernel panic or local privilege escalation on affected MIPS systems.