Remote code execution in the Templately WordPress plugin (all versions through 3.7.1) is reachable by any authenticated contributor-level user due to a validation/destination mismatch in the fetch_remote_file function. A GIF+PHP polyglot file passes WordPress's wp_check_filetype_and_ext validation by presenting a .gif Content-Disposition filename, while the actual file is written to a .php extension path derived from the attacker-controlled request URL, entirely bypassing the unfiltered_upload capability gate. CVSS 8.8 reflects the low privilege bar and full C/I/A impact; no public exploit has been identified at time of analysis, but the detailed public disclosure of affected endpoints and code paths makes rapid exploit development likely.
Arbitrary file upload leading to remote code execution in the MaxUpload WordPress plugin (all versions through 1.4.0) allows unauthenticated network attackers to upload PHP webshells by exploiting a validation mismatch in the chunked-upload handler. The plugin's handle_upload function applies extension and MIME-type checks only to the temporary chunk filename, but derives the final assembled filename from the attacker-controlled resumableFilename POST parameter - bypassing all validation entirely. No public exploit is confirmed, but the vulnerability is straightforward to exploit against any WordPress site with the plugin active and PHP execution permitted in the upload directory, making it a high-priority remediation target.
Privilege escalation in the bLoyal: Loyalty & Promotions WordPress plugin allows any subscriber-level authenticated user to overwrite the plugin's configured Loyalty Engine API URL via unprotected AJAX actions, then trigger an unauthenticated REST route to force the plugin to authenticate against an attacker-controlled server and invoke wp_set_auth_cookie() with an arbitrary WordPress user ID, yielding full administrator access. All plugin versions through 3.1.611.78 are affected across every WordPress installation running the plugin. No public exploit code identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low barrier to entry - any subscriber account suffices - elevates practical risk significantly on sites with open registration.
Privilege escalation in the Wholesale Market WordPress plugin (versions up to and including 2.2.2) allows any authenticated user with Subscriber-level access or higher to elevate their account to Administrator by supplying an arbitrary role name to a poorly validated AJAX endpoint. The ced_wholesale_request_send_callback() handler accepts a client-controlled role_required POST parameter and passes it directly to WP_User::add_role() without an allowlist, relying solely on a nonce that is freely exposed to all authenticated users via wp_localize_script. No public exploit has been identified at time of analysis, but the low attack complexity combined with Subscriber-level access requirement makes this a realistic and attractive target on sites with the vulnerable configuration option active.
Privilege escalation in the Propovoice WordPress plugin (all versions through 1.7.8) allows authenticated users holding the plugin-granted ndpv_manager role to create new WordPress accounts with full administrator privileges. The REST endpoint backing the team member create() function passes the user-supplied role parameter directly to WP_User::set_role() without validating it against an allowlist of safe roles or checking the WordPress promote_users capability. No public exploit has been identified at time of analysis, but the attack surface is broader than typical authenticated vulnerabilities because the ndpv_manager role is granted by the plugin itself - not the site administrator - expanding who can trigger the escalation.
Use-after-free in the Linux kernel's batman-adv mesh networking driver allows adjacent unauthenticated attackers to achieve kernel memory corruption with potential for code execution, information disclosure, or denial of service. The flaw exists in batadv_interface_rx(), where pskb_may_pull() may reallocate the socket buffer during RX processing - the VLAN header pointer was correctly refreshed post-reallocation, but the ethernet header pointer was not, leaving a dangling reference used subsequently in Translation Table and AP isolation logic. EPSS is low at 0.22% (13th percentile) and no CISA KEV listing exists, limiting real-world risk primarily to environments actively running batman-adv mesh deployments. Vendor-released patches are confirmed across multiple stable kernel branches.
Use-after-free in the Linux kernel's batman-adv Bridge Loop Avoidance (BLA) subsystem allows an unauthenticated attacker on the same Layer 2 network segment to corrupt kernel memory, potentially achieving arbitrary code execution or system crash. The flaw originates from pskb_may_pull() silently reallocating the socket buffer during backbone gateway processing in batadv_bla_is_backbone_gw(), leaving cached gateway address pointers dangling against the freed old buffer. Affected kernels span from commit 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 (approximately Linux 4.12) through multiple stable branches; patches are available across all active stable series. No public exploit or CISA KEV listing exists at time of analysis, and the very low EPSS of 0.22% (13th percentile) reflects the niche deployment footprint of batman-adv BLA.
OCFS2 cluster filesystem dinode validation in the Linux kernel fails to reject inodes with non-canonical i_mode type bits, allowing forged on-disk metadata to propagate into in-core kernel inode structures. Affected kernels accept any non-zero i_mode value and pass it verbatim into ocfs2_populate_inode(), where an unrecognized S_IFMT type falls through to ocfs2_special_file_iops and init_special_inode() - a code path not designed for arbitrary mode inputs. No public exploit has been identified at time of analysis and EPSS sits at only 0.22%, but the kernel-level impact (C:H/I:H/A:H) and the shared-storage attack surface of OCFS2 clusters warrant priority patching on affected systems.
Insufficient capability verification in the Linux kernel's xfrm interface changelink path allows a process holding CAP_NET_ADMIN in a device's network namespace to rewrite xfrm (IPsec transform) interface parameters belonging to a separate, distinct link namespace where it lacks authorization. Affected kernel versions span all stable branches from the introduction of xfrm_interface (commit f203b76d) through the fix commits, with patched releases confirmed at 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. No public exploit code or active exploitation has been identified; EPSS is 0.22% at the 13th percentile, reflecting low current attacker interest despite a High CVSS score driven by the cross-namespace scope change.
Out-of-bounds memory access in the Linux kernel dm-era (device mapper era) subsystem allows a local privileged attacker to trigger a vmalloc out-of-bounds read by configuring a dm-era table with a non-zero start sector. The era_map() function fails to apply the target offset before calculating the writeset block, passing an absolute block number to writeset_marked() that may exceed the allocated bitset size. No public exploit exists and EPSS probability is 0.22%, but patches are backported across all major stable kernel branches. The provided CVSS score of 8.8 (AV:N/PR:L) materially overstates real-world risk for a flaw requiring CAP_SYS_ADMIN and a specifically misconfigured dm-era table.
Cross-namespace privilege escalation in the Linux kernel SIT (IPv6-in-IPv4) tunnel driver allows a local attacker with CAP_NET_ADMIN in one network namespace to rewrite SIT tunnel configuration belonging to a distinct, more privileged network namespace, bypassing the intended authorization boundary. This is particularly impactful in containerized environments where network namespace isolation is a primary security boundary, as tenant containers are commonly granted CAP_NET_ADMIN within their own namespace. Patches are confirmed available across all active stable kernel branches (5.10 through 7.x); no public exploit or CISA KEV entry exists at time of analysis, and EPSS is 0.22%, reflecting very low observed exploitation activity.
BPF verifier register bounds mismatch in the Linux kernel allows local users with BPF loading capability to bypass BPF memory safety checks via crafted programs targeting LSM hook context loads. The flaw in check_mem_access() causes stale register bounds from prior instructions to corrupt the verifier's abstract interpretation, producing a divergence between the verifier's belief and runtime state that can be exploited to escape the BPF sandbox. Patches are confirmed available in stable branches (6.12.103, 6.18.40, 7.1.5, 7.2-rc1); no public exploit or CISA KEV listing exists, and EPSS is low at 0.22% (13th percentile), indicating limited observed real-world exploitation.
Integer underflow in the ksmbd in-kernel SMB3 server's DACL parsing logic allows authenticated remote SMB clients to bypass ACE count validation, driving large kernel heap allocations. The flaw exists in parse_dacl(), where subtracting sizeof(struct smb_acl) from an attacker-controlled 16-bit DACL size using unsigned arithmetic wraps to a large size_t when the DACL size is smaller than the header, permitting an ACE count of up to 0xffff to pass the guard unchecked. No public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) indicates minimal current exploitation activity, though upstream kernel patches confirm vendor acknowledgment and the attack path is fully documented in the fix commit.
Use-after-free in the Linux kernel's KVM x86 irqfd subsystem exposes hypervisor hosts to potential privilege escalation and VM escape when VFIO PCI device passthrough is in use. The flaw arises because a failed IRTE bypass update leaves irqfd->producer as a dangling pointer; if the VFIO PCI vector is subsequently disabled-an event independent of KVM routing-the now-freed vfio_pci_irq_ctx struct can be dereferenced through KVM's routing table, corrupting kernel memory. No public exploit has been identified at time of analysis and EPSS is low (0.22%, 13th percentile), but the S:C scope change in the CVSS vector reflects the potential for a low-privilege local attacker to escape VM boundaries into the host kernel.
Race condition in the Linux kernel's DesignWare eDMA (dw-edma) driver exposes DONE_INT_MASK and ABORT_INT_MASK interrupt registers to concurrent corruption when multiple DMA channels are started simultaneously. Systems running Linux kernel versions since commit 7e4b8a4fbe2c and equipped with DesignWare eDMA hardware - common in PCIe-attached peripherals and certain SoC platforms - are affected across stable branches from 6.1 through 7.1. No public exploit has been identified and EPSS sits at 0.21% (12th percentile), consistent with a hardware-specific driver flaw; however, the kernel maintainers have shipped patches across all active stable series, and remediation should be prioritized where this DMA controller is in use.
Out-of-bounds memory read and infinite-loop denial of service in the Linux kernel's iosm WWAN driver (net/wwan/iosm) allow a rogue or compromised modem to corrupt kernel memory and exhaust system resources by supplying crafted MUX downlink packets with malicious offsets and circular table references. Affected systems are those running Linux 5.18 and later with Intel WWAN hardware using the iosm driver, where the mux_dl_adb_decode() function failed to validate any of the device-supplied offsets and lengths (first_table_index, next_table_index, table_length, datagram_index, datagram_length) against the received socket buffer boundary. No public exploit exists and EPSS probability is very low at 0.21% (12th percentile); however, the CVSS 8.8 rating with Full C/I/A impact and reproduction confirmed under KASAN make this a credible risk for cellular-enabled Linux deployments awaiting patch application.
Heap overflow in the Linux kernel brcmfmac/cyw WiFi driver allows a network-adjacent attacker controlling a rogue or compromised access point to corrupt kernel heap memory during WPA3 SAE authentication. The flaw in `brcmf_notify_auth_frame_rx()` causes an unsigned integer underflow when a short auth frame (under 24 bytes) is received, producing a wrap-around copy length that drives `memcpy` far beyond the allocated buffer. With CVSS 8.8 and full C/H/I/H/A/H impact on the vulnerable system, exploitation yields arbitrary kernel memory write capability; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (12th percentile), indicating low observed exploitation pressure despite the critical technical severity.
Privilege boundary bypass in the Linux kernel's ip6_vti (IPv6 Virtual Tunnel Interface) subsystem allows a local user with CAP_NET_ADMIN in one network namespace to reconfigure VTI6 tunnels residing in a separate, unprivileged network namespace. The rtnl changelink path validates CAP_NET_ADMIN only against dev_net(dev), leaving t->net unchecked when the device spans namespaces - enabling unauthorized rewrites of cross-namespace tunnel configurations with full confidentiality, integrity, and availability impact on the affected namespace. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (12th percentile) reflects low current exploitation probability, though the capability misuse pattern is well-understood in container-escape research.
Privilege escalation in the Linux kernel's IP VTI (Virtual Tunnel Interface) subsystem allows a local attacker holding CAP_NET_ADMIN in one network namespace to reconfigure VTI tunnel endpoints anchored in a separate, more privileged network namespace they do not control. Affected kernel versions span from approximately 3.15 through all stable branches prior to 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code has been identified and no CISA KEV listing exists, but the scope-changed CVSS rating (8.8) reflects real cross-namespace boundary violation risk relevant to container and VNF deployments.
IPv6 GRE tunnel management in the Linux kernel allows a local attacker holding CAP_NET_ADMIN in one network namespace to modify tunnel configurations residing in a separate, unauthorized namespace - effectively escalating privilege across namespace security boundaries. Affected kernels span multiple long-term support trees from at least 4.19.100 onward, with patches released across stable series including 6.12.97, 6.6.145, 6.1.178, 6.18.40, 5.10.261, 5.15.212, and 7.1.5. No public exploit code has been identified at time of analysis; EPSS exploitation probability stands at 0.21% (12th percentile), indicating limited current attacker interest despite the high CVSS score.
Memory corruption in the Linux kernel's ThunderboltIP receive path allows an adjacent unauthenticated attacker to overflow the skb frags[] array by sending a crafted multi-frame packet with 19 or more small frames. The insufficient frame_count bound in tbnet_check_frame() (capped at TBNET_RING_SIZE/4 = 64) far exceeds MAX_SKB_FRAGS (17), causing skb_add_rx_frag() to write past the frags[] array and corrupt kernel memory. EPSS is low (0.21%, 11th percentile), no public exploit exists, and CISA KEV confirmation is absent, but CVSS 8.8 reflects the severity of kernel memory corruption once Thunderbolt physical access is achieved.
Race condition in the Linux kernel's CAN ISO-TP (isotp) socket subsystem allows adjacent-network attackers to corrupt TX state machine transitions, enabling kernel memory corruption with high confidentiality, integrity, and availability impact. Multiple stable branches from 5.10 onward are affected, with fixes released in kernel versions 6.6.148, 6.12.101, 6.18.40, 7.1.5, and 7.2-rc4. No public exploit code or CISA KEV entry has been identified at time of analysis, and the EPSS probability of exploitation within 30 days is 0.21% (11th percentile), consistent with the narrow, specialized conditions required.
Race conditions in the Linux kernel CAN Broadcast Manager (BCM) subsystem allow adjacent attackers on the CAN bus to corrupt kernel timer and filter state in bcm_rx_setup() by racing concurrent frame-reception handlers, with theoretical impact spanning kernel memory disclosure, corruption, and denial of service. KCSAN-detected simultaneous accesses affect all Linux kernel stable branches from 5.4 through 6.15, spanning automotive, industrial, and embedded deployments that rely on CAN BCM sockets. No public exploit has been identified and EPSS sits at 0.21% (11th percentile), indicating very low near-term exploitation probability despite the 8.8 CVSS score; vendor-released patches are available across multiple stable branches.
Deadlock in the Linux kernel's dm-integrity device mapper module allows a local attacker or process with block-device access to permanently freeze I/O on an integrity-protected block device. When dm_integrity_check_limits detects an out-of-bounds bio and returns failure, it exits with DM_MAPIO_KILL while leaving an internal range lock held, so all subsequent I/O operations block indefinitely waiting for a lock that will never be released. No public exploit identified at time of analysis; EPSS is 0.21% at the 11th percentile, consistent with a locally-triggered kernel availability flaw requiring a non-default configuration.
Reference-count (kref) underflow in the Linux kernel xprtrdma subsystem permits use-after-free when RDMA_CM_EVENT_ADDR_CHANGE is delivered before RDMA_CM_EVENT_ESTABLISHED during NFS-over-RDMA connection setup. An attacker on the same RDMA fabric who can induce an address-change event during the narrow pre-ESTABLISHED window may corrupt freed kernel memory, potentially leading to privilege escalation, arbitrary kernel code execution, or system crash. No public exploit exists and EPSS of 0.21% (11th percentile) reflects low automated exploitation probability; active exploitation has not been confirmed and no CISA KEV listing is present.
Missing interrupt request (IRQ) validity checking in the LoongArch KVM subsystem of the Linux kernel allows a local low-privileged user with access to KVM device nodes to pass malformed IRQ values via the kvm_vcpu_ioctl_interrupt() ioctl, potentially causing memory corruption or privilege escalation that crosses the guest-to-host boundary. The CVSS scope change (S:C) signals that successful exploitation could compromise the hypervisor host, making this significant for LoongArch-based virtualization environments. No public exploit code has been identified and EPSS probability sits at 0.21%, suggesting exploitation remains theoretical at this time.
Incomplete SEV-SNP state handling in the Linux kernel's KVM subsystem breaks AMD Secure Encrypted Virtualization isolation when intra-host VM migration or mirroring is attempted on SNP guests, potentially exposing encrypted guest memory to confidentiality and integrity breaches. The vulnerability affects multiple stable kernel branches from commit 1dfe571c12cf99244b933208fb77f29471ded677 onward, with fixes backported to 6.12.97, 6.18.40, 7.1.5, and 7.2-rc4. No public exploit code exists at time of analysis, and the EPSS score of 0.21% at the 11th percentile places real-world exploitation probability as very low despite the high official CVSS score of 8.8.
Unsigned integer underflow in the Linux kernel iomap writeback subsystem allows a low-privileged user to corrupt filesystem EOF metadata and on-disk size tracking. The flaw occurs in the io_size EOF trim path when a concurrent truncate shrinks the file after end_pos is sampled, causing end_pos to fall below ioend->io_offset; the resulting negative subtraction wraps to a huge value in the size_t io_size field. This corrupted io_size is then consumed by end_io paths for decisions including on-disk EOF updates, unwritten extent completion, and COW range handling. No public exploit has been identified at time of analysis, and EPSS is very low at 0.21% (11th percentile), though the official CVSS scores this 8.8 High with full C/I/A impact.
Out-of-bounds array indexing in the Linux kernel's KVM irqfd routing for LoongArch allows a local user with KVM access to index past the routing table's chip array boundary, potentially exposing host kernel memory or enabling a hypervisor boundary breach with full triad impact. Patches are available in stable releases 6.18.40, 7.1.5, and 7.2-rc1 across three upstream commits. No public exploit code exists and EPSS sits at 0.21% (11th percentile), indicating negligible active exploitation probability despite the elevated CVSS 8.8 score.
Cross-namespace capability bypass in the Linux kernel's IPIP (IP-in-IP) tunnel driver allows a local process holding CAP_NET_ADMIN within one network namespace to modify IPIP tunnel parameters governed by a separate, more privileged network namespace. By exploiting the missing rtnl_dev_link_net_capable() check in ipip_changelink(), an attacker can redirect or disrupt encapsulated tunnel traffic across namespace boundaries - a meaningful concern in containerized environments where namespace separation is a security boundary. No public exploit code or CISA KEV listing has been identified; EPSS stands at 0.21% (11th percentile), indicating low current exploitation probability despite the high CVSS score of 8.8.
Insufficient capability gating in the Linux kernel's IPv6 tunnel subsystem allows a local attacker with CAP_NET_ADMIN in one network namespace to reconfigure tunnel devices residing in a separate, more privileged namespace. Affected versions span from Linux 3.12 through all stable branches prior to 6.6.148, 6.12.101, 6.18.40, and 7.1.5, with the CVSS Scope:Changed metric confirming cross-namespace impact. This vulnerability is not listed in CISA KEV and carries an EPSS score of 0.20% (10th percentile), indicating limited observed exploitation at time of analysis; however, it is a meaningful privilege escalation primitive in containerized deployments where CAP_NET_ADMIN is routinely granted.
Cross-VF/PF LMTLINE physical address disclosure in the Linux kernel's octeontx2-af CN10K driver allows a low-privileged VF caller to read another PF's LMTLINE physical base address and map it into its own LMT table entry. Affected are Linux kernel trees from commit 893ae97214c3 across stable branches 6.6.x before 6.6.148, 6.12.x before 6.12.101, 6.18.x before 6.18.42, and mainline before 7.1.5/7.2-rc1. No public exploit code or CISA KEV listing exists at time of analysis; the EPSS score of 0.20% (10th percentile) indicates low exploitation probability, consistent with the hardware-specific attack surface.
Insufficient Multi-Link Element (MLE) common info length validation in the Linux kernel's IEEE 802.11 WiFi stack exposes adjacent-network attackers to high-impact memory corruption. Kernels from commit 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 onward failed to validate the advertised common-info length field for Reconfiguration and Priority Access MLE types - and also omitted the length octet when computing the minimum common size for Reconfiguration MLEs - meaning a malformed MLE frame crafted by a nearby attacker can trigger out-of-bounds access. The CVSS score of 8.8 (AV:A) and EPSS of 0.20% (10th percentile) together indicate high potential impact but no public exploit activity at time of analysis; no public exploit and no CISA KEV listing have been identified.
Use-after-free race condition in the Linux kernel RDMA/bnxt_re driver allows a local attacker with low privileges to write data to a freed kernel memory page, potentially enabling privilege escalation or kernel crash. The vulnerability affects systems running the Broadcom NetXtreme-E RDMA driver across multiple stable kernel branches, with confirmed fixes in kernel versions 7.1.5, 6.18.40, and 7.2-rc1. No public exploit code has been identified and EPSS probability sits at 0.20% (10th percentile), reflecting the narrow hardware prerequisite that sharply limits the exposed population.
Out-of-bounds kernel memory write in the Linux kernel BPF conntrack kfuncs allows a local attacker with BPF access to corrupt memory outside the verifier-enforced boundary. The BPF verifier constrains accessible memory using the caller-supplied opts__sz argument, but the conntrack wrapper functions unconditionally write to opts->error on failure regardless of whether that field falls within the verified range - enabling a write beyond the checked region when opts__sz is deliberately undersized. No public exploit has been identified and EPSS probability is very low (0.20%, 10th percentile), but the CVSS 8.8 score with scope change reflects kernel memory corruption potential and privilege escalation risk for deployments where unprivileged BPF is enabled.
Out-of-bounds kernel heap write in the Linux kernel Xen PV Calls (pvcalls) frontend allows a malicious or compromised Xen backend domain to corrupt guest kernel memory by supplying a ring response with req_id set beyond PVCALLS_NR_RSP_PER_RING, potentially enabling privilege escalation or denial of service within the affected guest. A compounding int vs. u32 type confusion means req_id=0xffffffff is cast to -1, bypasses a signed comparison, and indexes bedata->rsp[-1] - making the missing bounds check exploitable via two independent paths. Fixes are confirmed in Linux 7.1.5 and 7.2-rc2; no public exploit exists at time of analysis and EPSS is 0.20% at the 10th percentile.
Use-after-free in the Linux kernel's legacy NTFS filesystem driver (ntfs_mft_writepages) allows a local low-privileged attacker to corrupt kernel slab memory by winning a timing race between MFT writeback and concurrent MFT allocation extension. Affected kernels span the Linux 7.1 stable series up through 7.1.4; fix commits are confirmed in the upstream stable tree targeting 7.1.5 and 7.2-rc3. No public exploit is identified at time of analysis and EPSS is low (0.20%), but the confirmed slab-use-after-free in ring-0 writeback code represents a high-severity memory safety defect warranting scheduled patching.
Use-after-free race condition in the Linux kernel's legacy NTFS driver (ntfs.ko) exposes systems with NTFS-mounted volumes to kernel heap memory corruption, enabling local privilege escalation, information disclosure, or kernel panic. The flaw in ntfs_attr_fallocate() releases a read lock before consuming a borrowed runlist pointer, while a concurrent mmap page_mkwrite path can simultaneously reallocate and free the underlying array - confirmed by a KASAN slab-use-after-free trace in the CVE description. No public exploit or CISA KEV entry exists; EPSS of 0.20% (10th percentile) reflects the difficulty of reliably winning this race, though successful exploitation carries severe kernel-level impact.
Bluetooth ISO packet reassembly in the Linux kernel mishandles malformed ISO_CONT and ISO_END packets, exposing adjacent attackers to three distinct kernel-level impacts: a conn->rx_skb memory leak via abnormal ISO_START sequences, a kernel panic triggered by an unchecked skb_put call on oversized ISO_END frames, and silent acceptance of undersized ISO_END packets. All Linux kernel versions from 6.0 through the fix commits on affected stable branches are impacted, with fixes confirmed in 7.1.5 and 7.2-rc3. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS 8.8 AV:A/PR:N vector and the availability of upstream fix commits make this an actionable patching priority for any Bluetooth-enabled Linux deployment.
Heap buffer overflow in the Linux kernel wcn36xx WiFi driver allows an adjacent-network attacker without authentication to corrupt kernel heap memory with firmware-controlled content. The vulnerability exists in the synchronous HAL response dispatcher for Qualcomm WCN36xx chipsets, which copies all firmware responses into a fixed 4096-byte buffer without first validating response length. Successful exploitation from an adjacent network position yields high confidentiality, integrity, and availability impact - consistent with potential kernel code execution. EPSS is low at 0.19% and no active exploitation is confirmed, but the lack of authentication requirement and network-adjacent reachability elevate real-world concern for affected embedded and mobile platforms. Patches are available across multiple stable kernel branches.
Remote kernel memory corruption in the Linux mac80211 WiFi subsystem allows an unauthenticated attacker within WiFi range to trigger out-of-bounds memory accesses by sending crafted 802.11 extension frames that bypass subtype validation and reach generic RX path code expecting regular 802.11 header layouts. Affected systems include any Linux host with an active mac80211-based WiFi driver across a broad range of kernel versions spanning 5.10 through pre-patch 7.x releases. The CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact at the kernel level; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Corrupted DMA length assignments in the Linux kernel's iommu/dma-iommu subsystem allow a local attacker with low privileges to trigger memory corruption through the PCI Peer-to-Peer DMA (P2PDMA) code path, potentially achieving confidentiality, integrity, and availability impact across scope boundaries. The flaw stems from a variable typo in iommu_dma_map_sg() where multi-segment P2PDMA scatterlists receive the head segment's length for all entries, corrupting DMA mappings and leading to out-of-bounds memory operations. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.19% (9th percentile) reflects low observed exploitation probability.
Use-after-free in the Linux kernel's ksmbd in-kernel SMB server allows a low-privileged authenticated SMB client to dereference freed kernel memory, potentially achieving arbitrary kernel-level code execution or sensitive information disclosure. The race condition exists between `same_client_has_lease()` releasing `ci->m_lock` without holding a reference on the returned `opinfo` pointer and a concurrent SMB CLOSE operation freeing that same object. Affected kernels span the 5.15 through 7.1 stable series; patches are confirmed available across all branches. No public exploit code or CISA KEV listing has been identified at time of analysis, and an EPSS of 0.18% (8th percentile) indicates no currently observed widespread exploitation.
Kernel memory corruption in the Linux MTD raw NAND driver for NXP LPC32xx SLC hardware arises because lpc32xx_xmit_dma() silently discards the return value of wait_for_completion_timeout(), treating an expired DMA transfer as successful. The timed-out DMA engine can continue accessing a scatterlist buffer after it has been unmapped and potentially reused by the NAND read/write path, creating a use-after-free condition in kernel space. Exploitation requires local access to an embedded Linux system built on LPC32xx silicon with NAND flash; no public exploit has been identified and EPSS probability sits at 0.18% (7th percentile), indicating limited real-world exploitation interest.
Out-of-bounds array access in the Linux kernel's ath9k WiFi driver allows an adjacent network attacker to trigger kernel memory corruption via a maliciously crafted firmware transmit status queue ID. The ath_tx_edma_tasklet() function blindly indexes sc->tx.txq[] using a 4-bit hardware field (range 0-15) against an array of only 10 entries (ATH9K_NUM_TX_QUEUES), meaning any qid value of 10 or greater causes an OOB memory access with potential for high confidentiality, integrity, and availability impact. No active exploitation is confirmed (not in CISA KEV), and EPSS stands at 0.18% (7th percentile), but the adjacent-network, no-authentication attack vector keeps this relevant for environments running Atheros 802.11n hardware.
Indefinite kernel task hang in the Linux kernel's md/raid5 subsystem exposes any system running software RAID5 to a local availability attack via a data race between break_stripe_batch_list() and raid5_make_request(). The race corrupts the R5_Overlap flag on stripe device state without issuing the corresponding wake_up_bit() call, permanently blocking a kernel task on wait_on_bit() with no recovery path short of reboot. EPSS probability is very low at 0.18% and no public exploit has been identified, but the structural impact on active RAID5 arrays under sustained concurrent I/O workloads is a genuine availability concern.
Race condition in the Linux kernel AppArmor unix socket mediation subsystem exposes systems with peer path-based AppArmor rules to a use-after-free scenario, enabling a local low-privileged user to potentially escalate privileges and achieve full compromise of confidentiality, integrity, and availability. The flaw involves accessing a peer unix socket's path (`peer_path`) outside the kernel socket state lock, creating a window for concurrent execution of `unix_release_sock()` to free the referenced path while AppArmor reads it. No public exploit code exists and the EPSS score sits at a low 0.17% (7th percentile), but the NVD-assigned CVSS scope change (S:C) reflects that successful exploitation could reach kernel-level components beyond the attacking process.
The host1x GPU driver in the Linux kernel mishandles the return value of iommu_map_sgtable() after an upstream API change switched its return type from size_t (unsigned, zero on error) to ssize_t (signed, negative on error), leaving pin_job() blind to failures. Compounded by pin_job() assigning the result to a plain int - risking overflow on large sizes - an IOMMU mapping failure can be silently treated as success, potentially allowing a low-privileged local user on Tegra hardware to trigger kernel memory corruption and escalate privileges. No public exploit identified at time of analysis; the CVSS 8.8 score with Scope:Changed reflects the theoretical kernel-level blast radius, while the 0.17% EPSS and absence of CISA KEV listing indicate low current exploitation activity.
Use-after-free in the Linux kernel VDUSE (vDPA Device in Userspace) subsystem allows a local low-privileged user to corrupt kernel memory and escalate privileges to full kernel control. The flaw exists in vduse_dev_open(), which releases vduse_lock after an IDR lookup but before acquiring dev->lock, creating a race window where a concurrent VDUSE_DESTROY_DEV ioctl can remove and free the same struct vduse_dev object - causing the open path to later dereference freed memory. No public exploit code and no CISA KEV listing are identified at time of analysis, and EPSS sits at 0.17% (7th percentile), indicating low current exploitation probability despite a high CVSS score of 8.8.
Out-of-bounds memory read in the Linux kernel Bluetooth HCI subsystem enables a malformed or malicious Bluetooth controller response to the Read Local Codec Capabilities command to cause the kernel to copy one byte beyond the HCI response payload into the codec list. All kernel versions from 5.16 onward that include Bluetooth codec capability support are affected, and fixed stable releases are available across the 6.1, 6.6, 6.12, 6.18, and 7.1 branches. No public exploit has been identified, and the 7th-percentile EPSS score of 0.17% indicates negligible opportunistic exploitation risk at this time.