Improper locking scope in the Linux kernel KVM subsystem exposes a use-after-free race condition through `kvm_io_bus_get_dev()`, where the function drops the SRCU lock before returning a device pointer, leaving a window in which the referenced object may be freed before the caller can safely inspect it. All Linux kernel versions from the introducing commit (approximately 4.8) through the 7.1 and 6.x stable series are affected until patched releases across eight stable branches are applied. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% reflects a low current probability of exploitation despite the High CVSS severity rating.
Heap buffer overflow in the Linux kernel ASoC SOF IPC3 audio subsystem allows a local low-privilege attacker to write past an allocated buffer via a missing bounds check in `snd_sof_update_control()`, potentially enabling kernel memory corruption, privilege escalation, or system crash. Affected systems span Linux 5.18 through multiple stable branches (6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x) on hosts with Intel SOF-capable audio DSP hardware. No public exploit is known and EPSS is low at 0.21%, but the CVSS 7.8 score reflects the severity of the potential kernel-level impact once local access is obtained.
Use-after-free in the Linux kernel netfilter nf_queue subsystem allows a local attacker with bridge networking and NFQUEUE configured to corrupt kernel memory, potentially escalating privileges to root. The flaw arises because NFQUEUE upgrades a no-reference bridge fake dst to a real dst reference via skb_dst_force(), but the bridge device can complete teardown before the queued packet receives its verdict, leaving dst_release() operating on freed memory belonging to netdev_priv(br->dev). No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, CVSS rates it 7.8 HIGH with full confidentiality, integrity, and availability impact, consistent with kernel-level use-after-free primitives.
Integer underflow in the ntfs3 filesystem driver's journal replay logic (`fs/ntfs3/fslog.c`) allows a local attacker with low privileges to corrupt the resident attribute data size to approximately 4 GiB, enabling out-of-bounds kernel memory reads up to 4 GiB beyond a 1024-byte MFT record allocation. Exploitation requires mounting or processing a crafted NTFS image with specially crafted Log Record Header values - on distributions with unprivileged user namespaces enabled (Ubuntu, Fedora, and others), this is achievable without elevated privileges. No public exploit code has been identified and the vulnerability is not in CISA KEV; EPSS stands at 0.21% (12th percentile), and patches are confirmed available across multiple stable kernel branches.
Memory corruption in the Linux kernel's MIPS scheduler corrupts kernel pointer state when CONFIG_CPUMASK_OFFSTACK is enabled, enabling local privilege escalation to root. Two compounding flaws exist: sizeof(new_mask) resolves to the pointer width (4-8 bytes on MIPS) rather than the actual cpumask buffer size, causing copy_from_user() to overwrite the mask pointer with user-controlled bytes; and the original code invoked copy_from_user() prior to allocating the mask buffer, creating a write-before-allocation primitive. CVSS 7.8 with AV:L/AC:L/PR:L/UI:N reflects straightforward local exploitation on affected MIPS systems, though EPSS at 0.21% (12th percentile), no CISA KEV listing, and no public exploit code indicate limited real-world exploitation activity at time of analysis.
Use-after-free in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges. The flaw arises from a race between concurrent RCU readers re-arming a throttle timer and RCU-deferred deallocation of the BCM operation structure, introduced by commit f1b4e32aca08's replacement of synchronize_rcu() with call_rcu(). No active exploitation has been confirmed (not in CISA KEV) and EPSS is 0.21% (12th percentile), reflecting limited real-world risk outside CAN-enabled environments.
Incomplete cleanup in the Linux kernel's sparx5 Ethernet switch driver leaves a switchdev blocking notifier registered when workqueue allocation fails during initialization, creating a dangling callback that subsequent kernel network events can invoke against uninitialized driver state - enabling potential kernel memory corruption or privilege escalation on affected hardware. Systems running kernels from 5.14 through the unpatched stable branches on Microchip Sparx5 switch ASICs are affected; patches have been backported to five stable kernel series. No public exploit code exists and EPSS probability is 0.21% (12th percentile), though kernel-level C:H/I:H/A:H impact warrants prompt patching on any affected networking appliance.
Use-after-free and initialization-order race conditions in the Linux kernel's mlx5e MACsec hardware offload driver allow a local low-privileged user to corrupt kernel memory during RX Security Channel deletion. The delete path in macsec_del_rxsc_ctx() called metadata_dst_free() unconditionally, bypassing reference counting, while concurrent RX datapath readers operating under rcu_read_lock() could still hold and dereference the freed dst object. A secondary race in the add path published the SC's xarray entry before md_dst was fully initialized, allowing readers to observe NULL or partially-constructed pointers. Patches are available across multiple stable branches (6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2-rc2); no public exploit has been identified at time of analysis.
Unbounded sprintf() calls in the Linux kernel's CPU hotplug sysfs interface (states_show()) can overflow the PAGE_SIZE kernel buffer when a sufficient number of hotplug states are registered, enabling a local low-privileged user to corrupt adjacent kernel memory with potential high impact on confidentiality, integrity, and availability. Affected kernel versions span from the 4.6 era through multiple current stable branches (5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x), each with vendor-released patch versions confirmed by ENISA EUVD-2026-59024. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), indicating limited real-world exploitation probability despite the 7.8 CVSS score.
Use-after-free and double-free memory corruption in the Linux kernel's amdkfd DRM subsystem exposes systems with AMD GPUs to local privilege escalation. The flaw resides in kfd_criu_resume_svm(), where cleanup logic frees struct criu_svm_metadata objects without unlinking them from the list, leaving dangling pointers; a second AMDKFD_IOC_CRIU_OP ioctl from the same process then walks and double-frees those freed objects. Exploitation is reachable by any unprivileged user with render group membership via /dev/kfd - no additional capabilities required. No public exploit identified at time of analysis, and EPSS sits at 0.21% (12th percentile), consistent with a local-access kernel bug without weaponized tooling.
Invalid pointer dereference in the Linux kernel netfilter NAT subsystem exposes local attackers with CAP_NET_ADMIN to kernel slab-out-of-bounds memory access via nf_nat_register_fn(). When nf_nat_init() fails during module initialization, the nat_net pointer is left in an invalid state; subsequent calls to nf_nat_register_fn() dereference it without validation, producing a KASAN-confirmed out-of-bounds read that can escalate to full kernel memory corruption. No public exploit code exists and EPSS at 0.21% (12th percentile) reflects negligible observed exploitation activity, though the local-privilege attack surface in containerized environments warrants timely patching.
Slab-use-after-free in the Linux kernel's True Equalizer (TEQL) traffic scheduler (`net/sched/sch_teql`) enables a local low-privileged attacker to achieve full kernel-level compromise by exploiting an unprotected race on the `master->slaves` linked list. The `teql_master_xmit()` function can retain a stale pointer to a freed qdisc object while concurrent mutations in `teql_destroy()` and `teql_qdisc_init()` proceed without holding any list lock or RCU protection, producing a confirmed KASAN-detected slab-use-after-free. Reported by Trend Micro's ZDI team with a working proof-of-concept trigger, no public exploit code has been confirmed and the vulnerability is not yet listed in the CISA KEV catalog, with an EPSS score of 0.21% indicating low current opportunistic exploitation pressure.
Use-after-free in the Linux kernel bridge STP subsystem allows a local low-privileged attacker to achieve kernel code execution by engineering a specific state involving the topology change timer. The flaw exists in br_topology_change_detection(), which lacks the IFF_UP guard present at all other STP timer-arming call sites, enabling the timer to be armed while the bridge is administratively down; deleting the bridge subsequently frees kernel structures while the timer remains scheduled, triggering a dereference of freed memory when the timer fires. No public exploit is identified and EPSS sits at 0.21% (12th percentile), though the CVSS 7.8 High score with full C/I/A impact correctly reflects the severity of kernel-level UAF if successfully triggered.
The AFS subsystem in the Linux kernel misassigns the AFS_VOLUME_RM_TREE flag during volume insertion, marking the newly inserted volume for tree removal instead of the replaced one. This logic inversion causes the old volume to be processed for removal twice - creating a double-free or use-after-free condition - while the new volume is never properly cleaned up from the cell's volume tree. Locally authenticated users on systems with AFS filesystems mounted could exploit this to corrupt kernel heap memory, with CVSS assessing potential full confidentiality, integrity, and availability impact; however, with EPSS at 0.21% (12th percentile), no CISA KEV listing, and no public exploit identified, the near-term exploitation probability is low.
Use-after-free in the Linux kernel Bluetooth MGMT advertising monitor subsystem allows a local attacker with low privileges to corrupt kernel heap memory, potentially achieving privilege escalation. The flaw arises from a ownership race: hci_add_adv_monitor() publishes a new adv_monitor into the hdev->adv_monitors_idr before the MSFT HCI offload setup step completes, allowing the MSFT callback to free the monitor on failure while the MGMT completion path still holds a dangling pointer. KASAN confirmed the slab-use-after-free in mgmt_add_adv_patterns_monitor_complete; no public exploit or active exploitation (CISA KEV) has been identified, and EPSS is 0.21% (12th percentile).
Memory corruption and information disclosure in the Linux kernel's ASoC Sound Open Firmware (SOF) IPC3 control subsystem allows local users with low privileges to corrupt kernel memory or leak sensitive data. The flaw affects sof_ipc3_bytes_put() and sof_ipc3_bytes_get() functions, where wrong-size memcpy operations and an off-by-sizeof bounds check create exploitable memory safety violations. No public exploit or CISA KEV listing exists at time of analysis; the EPSS score of 0.21% (12th percentile) reflects a low but non-negligible near-term exploitation probability.
Out-of-bounds buffer read in the Linux kernel's batman-adv (batadv) mesh networking driver allows a local user with eBPF TC hook access to trigger reads beyond allocated packet buffer boundaries inside batadv_interface_tx(). The vulnerability spans many stable kernel series from 2.6.38 through pre-patch releases of 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, and 7.1 branches. No public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), though the high CVSS impact metrics (C:H/I:H/A:H) reflect potential for kernel heap memory disclosure or corruption if the out-of-bounds read extends into sensitive kernel state.
Metadata snapshot operations in the Linux kernel's device-mapper thin provisioning (dm-thin) subsystem write a partially-updated superblock field to disk when a metadata commit subsequently fails, corrupting the on-disk space map reference counts. Systems using dm-thin storage pools are affected across a wide range of stable kernel branches from 3.2 onward through patched versions. A local attacker with access to dm-thin pool management can deliberately trigger the failure path - for example by constraining the metadata device - causing persistent metadata inconsistency that survives reboots and results in data loss or pool unavailability. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis.
Kernel panic via NULL pointer dereference in the Linux kernel's multiq traffic scheduler (net/sched/sch_multiq) affects all kernels from 2.6.29 through unpatched stable trees. When multiq pairs with a non-work-conserving child qdisc (such as qfq) routed through a peeking intermediary (such as tbf), multiq_dequeue() invokes the child's raw ->dequeue() method directly instead of qdisc_dequeue_peeked(), orphaning the stash, corrupting qlen/backlog accounting, and triggering a NULL dereference in softirq context during ordinary egress. Exploitation requires local access with CAP_NET_ADMIN and a deliberately constructed qdisc hierarchy; no public exploit code exists and EPSS probability is 0.21% (12th percentile), consistent with the niche configuration requirement.
Race condition in the Linux kernel mac802154 subsystem allows a local low-privileged attacker to trigger kernel memory corruption by racing hardware teardown against an in-flight asynchronous transmit completion. Affected systems are those running IEEE 802.15.4 wireless networking hardware with the mac802154 module loaded; versions from Linux 3.19 through the respective stable-branch fix commits are vulnerable. No public exploit identified at time of analysis, and EPSS of 0.21% (12th percentile) reflects negligible observed exploitation activity; vendor patches have been released across all active stable kernel branches.
Local privilege escalation in the Linux kernel's rt2x00 WiFi driver stems from improper error handling during device probe, where early allocation failures invoke a full teardown path that assumes work items (intf_work, autowakeup_work, sleep_work) are already initialized. On systems with Ralink/MediaTek rt2x00-compatible WiFi hardware, a local low-privileged attacker who can trigger workqueue allocation failure during driver probe can corrupt uninitialized kernel work_struct objects, as confirmed by DEBUG_OBJECTS reporting invalid work drains. EPSS is low (0.21%, 12th percentile) and this is not listed in CISA KEV, though a QEMU-based proof-of-concept demonstrating the failure path was confirmed by the reporters.
Integer underflow and overflow flaws in the Linux kernel's Realtek Bluetooth driver (btrtl) corrupt kernel memory during firmware loading, enabling a local attacker with low privileges to achieve full kernel-level compromise. The vulnerability exists in rtlbt_parse_firmware(), where a malformed firmware patch with a length field smaller than 4 causes a subtraction underflow that transforms a subsequent memcpy into an oversized kernel memory write; a separate addition overflow on 32-bit architectures compounds the exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), consistent with the local-only attack vector.
Out-of-bounds memory access in the Linux kernel's spufs (SPU filesystem) subsystem on PowerPC Cell Broadband Engine architectures allows a local low-privileged user to read or write beyond the SPU local store buffer via a flawed bounds check in `spufs_mem_mmap_access()`. The function computes the mmap offset correctly but validates it against `vma->vm_end` rather than `LS_SIZE`, causing the guard to never fire on 64-bit systems and leaving the length parameter unconstrained relative to the actual local store buffer. Vendor-released patches are confirmed across multiple stable kernel branches; no public exploit has been identified and EPSS is 0.21% at the 12th percentile.
Privilege escalation in the Linux kernel's TIPCv2 generic netlink interface exposes mutating operations - including TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and bearer enable/disable - to any local unprivileged process. The legacy TIPCv1 netlink API already enforces CAP_NET_ADMIN via netlink_net_capable(), but TIPCv2's generic netlink handlers omit the GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM flags, creating an enforcement gap. A QEMU/KASAN reproducer running as uid/gid 65534 with zero effective capabilities confirmed the flaw: an attacker can alter network identity, inject or flush cryptographic key material, and disrupt bearer connectivity. No public exploit has been identified and EPSS is very low (0.21%), but the primitives are straightforward for any local user.
Out-of-bounds write in the Linux kernel's netfilter nft_set_pipapo component allows a local low-privileged attacker to corrupt kernel memory and potentially escalate to root. When memory allocation fails during cloning of an nft_pipapo_match structure inside a netfilter batch transaction, the clone can enter an inconsistent state - with mismatched lookup table sizes, toggled bits, or an undersized scratch map - and that corrupted clone can persist into the next transaction where a subsequent set insertion triggers an out-of-bounds write. No public exploit has been identified at time of analysis, and EPSS at 0.21% (11th percentile) indicates low predicted exploitation probability despite the high CVSS score of 7.8.
Local privilege escalation in the Linux kernel's GPU buddy memory allocator (gpu/buddy) allows a low-privileged authenticated local user to exploit a misalignment logic error in the try_harder contiguous fallback path, achieving high confidentiality, integrity, and availability impact (CVSS 7.8). The defect, introduced at commit 0a1844bf0b532d84324453374ad6845f64066c28, caused the allocator to return candidate blocks whose start offsets were not aligned to the caller's min_block_size, violating allocation invariants on both the RHS and LHS paths. No public exploit identified at time of analysis; EPSS exploitation probability is 0.21% (11th percentile), consistent with low near-term exploitation likelihood.
Uninitialized struct page corruption in the Linux kernel's ZONE_DEVICE memory subsystem exposes systems with DAX/persistent memory hotplug to kernel memory corruption. When DAX memory is hotplugged into an unoccupied subsection of an early section, section_activate() reuses the unoptimized boot memmap while compound_nr_pages() incorrectly assumes vmemmap optimization is active, initializing fewer struct pages than the memory region actually contains. The resulting uninitialized tail struct pages can cause crashes or, under adverse conditions, kernel memory corruption with high confidentiality, integrity, and availability impact per the CVSS 7.8 rating. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.21% (11th percentile).
The 9p filesystem client (v9fs) in the Linux kernel incorrectly invokes drop_nlink() on inodes whose nlink counter is already zero in cacheless mode, producing a kernel WARN_ON under concurrent unlink workloads. The race arises because cacheless mode delegates authority to the server: after the server processes an unlink and sets nlink to 0, the client refetches that metadata before its own v9fs_dec_count() executes, resulting in a decrement of an already-zero counter. No public exploit exists and EPSS is 0.21%, placing this firmly in patch-cycle rather than emergency response territory.
Use-after-free race condition in the Linux kernel CAN ISO-TP (isotp) subsystem enables a local user to corrupt kernel memory by racing isotp_release() against concurrent network device unregistration, with CVSS 7.8 reflecting full confidentiality, integrity, and availability impact on the vulnerable system. Affected kernels span the stable 5.10 tree through at least 6.18.x and 7.1.x; patched versions 6.6.148, 6.12.101, 6.18.40, 7.1.5, and 7.2-rc4 are available. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS exploitation probability is low at 0.21% (11th percentile), consistent with the narrow race window and specialized hardware prerequisites.
Race condition and missing lock coverage in the Linux kernel CAN Broadcast Manager (BCM) subsystem expose kernel frame data and 64-bit timer values to concurrent unsynchronized access. Low-privileged local users with access to AF_CAN BCM sockets can trigger reads of partially written frame content or torn 64-bit ktime_t values - the latter specifically affecting 32-bit kernel builds - with C:H/I:H/A:H impact per the CVSS vector. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) confirms low current exploitation activity, and the vulnerability is not listed in CISA KEV.
Missing frame length validation in the Linux kernel CAN Broadcast Manager (BCM) subsystem allows a local low-privileged user to trigger kernel memory corruption by supplying a malformed RTR-reply frame via RX_SETUP with the RX_RTR_FRAME flag. While bcm_tx_setup() correctly enforces DLC bounds on TX_SETUP frames, the equivalent check was absent in bcm_rx_setup(), creating an asymmetric validation gap reachable through the CAN socket interface. The CVSS 3.1 score is 7.8 HIGH with full C/I/A impact; no public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog, but patched stable releases are available across multiple kernel branches.
Use-after-free race condition in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows a local low-privileged attacker to trigger a stale filter pointer against freed memory, with potential full CIA impact on affected systems. The flaw exists from kernel 2.6.25 onward in net/can/bcm.c, where concurrent NETDEV_UNREGISTER events could silently bypass can_rx_unregister(), leaving dangling references to freed bcm_op and socket structures. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.21% (11th percentile), indicating very low real-world exploitation probability at this time.
Use-after-free in the Linux kernel's BPF task storage subsystem allows a local low-privileged user to trigger a kernel hang or UAF condition during fork() failure. When copy_process() duplicates a task_struct via dup_task_struct, it copies the parent's bpf_storage pointer verbatim into the nascent child; if a subsequent RLIMIT_NPROC check causes the fork to abort, the cleanup path (bpf_task_storage_free → bpf_local_storage_destroy) operates on this uninitialized copied pointer rather than a valid child-owned one. No public exploit or CISA KEV listing exists at time of analysis, and EPSS is low at 0.21%, but kernel UAF conditions of this class are historically weaponizable into local privilege escalation.
Use-after-free race condition in the Linux kernel's tracing/user_events subsystem allows a low-privileged local user to corrupt kernel heap memory during fork(), potentially enabling privilege escalation to root. The race is triggered when a multithreaded process concurrently unregisters a user event enabler while calling fork(), causing user_event_mm_dup() to dereference enabler and user_event structures freed without observing the required RCU grace period. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, the low privilege bar and full C/I/A impact make it a meaningful escalation primitive on any multi-user or shared Linux system running an unpatched kernel with CONFIG_USER_EVENTS enabled.
Memory corruption in the Linux kernel's compaction subsystem allows a local low-privileged attacker to trigger data corruption or potential privilege escalation by exploiting improper error handling in compaction_free(). The function ignores failure returns from free_pages_prepare(), causing hardware-poisoned pages (PageHWPoison) or bad pages (free_page_is_bad()) to be re-added to the compaction freepages list and subsequently reallocated to kernel or user structures. Exploitation requires low-privilege local access and is not confirmed actively exploited (absent from CISA KEV), with EPSS at a low 0.21% (11th percentile); vendor-released patches are available across multiple stable branches.
Double-free kernel memory corruption in the Linux DRM/i915 Intel graphics driver allows a local low-privileged user to potentially escalate privileges or crash the system. The flaw resides in the CRTC color blob pointer cleanup path: after dropping blob references, the pointers are not nulled, so a subsequent failure in the atomic commit path (e.g., -EDEADLK from DP tunnel state lookup) can trigger a second call to intel_crtc_free_hw_state() on the same already-freed state. No public exploit code exists and EPSS is 0.21%, but the CVSS 7.8 local score reflects the full C/I/A impact if kernel heap corruption is reliably weaponized. Vendor patches are available for stable branches.
Privilege escalation in the Linux kernel's netfilter ipset subsystem stems from a race condition between the garbage collector (GC) and set destruction logic, where `queue_delayed_work()` is called unconditionally inside the GC callback while `cancel_delayed_work_sync()` is called during set teardown, allowing the GC to run against freed memory. Affected kernel versions span from 5.4.24 through mainline prior to the fix commits, with patches backported to stable series 6.12.97 and 6.18.40. No public exploit code exists and the CVE is not listed in CISA KEV, but the CVSS 7.8 local-privilege-escalation impact reflects the potential for kernel heap corruption reachable by low-privileged local users.
Incorrect bounds validation in the Linux kernel's octeontx2-af driver allows a local attacker with low privileges to trigger a kernel-level flaw by issuing a crafted devlink command that sets NIX maximum LFs before any PF/VF assignment, bypassing the faulty assignment-check condition. Systems running Marvell OcteonTX2 SoC hardware with the octeontx2-af driver loaded are affected across multiple stable kernel branches originating from commit dd7842878633453e38d6a4927593dd28b9d8ab91. EPSS exploitation probability is very low at 0.21% (11th percentile), no public exploit code has been identified, and this vulnerability is not listed in the CISA KEV catalog.
Race condition in the Linux kernel's AFS (Andrew File System) subsystem allows local low-privileged users to corrupt kernel memory by exploiting unsynchronized writes to net->cells_dyn_ino, with potential for privilege escalation to root. The flaw exists because cell lifecycle operations modified shared kernel state without holding net->cells_lock exclusively, and RCU cleanup context constraints in afs_cell_destroy() prevented a straightforward fix - requiring cell removal to be relocated to afs_destroy_cell_work() in a workqueue context. No public exploit exists and EPSS sits at 0.21% (11th percentile), though the 7.8 CVSS score is technically justified by the potential kernel-level impact on affected configurations.
Integer overflow in the Linux kernel minix filesystem driver allows a local low-privileged user to crash the kernel by mounting a crafted Minix v3 image. The minix_blocks_needed() helper uses DIV_ROUND_UP() in unsigned int arithmetic; an image with s_ninodes or s_zones set near UINT_MAX causes the addition to wrap to zero, tricking minix_check_superblock() into accepting an invalid zero bitmap-block count, after which minix_fill_super() dereferences the unallocated s_imap[0] or s_zmap[0] pointer and panics the kernel. No public exploit identified at time of analysis; EPSS is 0.21% (11th percentile), reflecting very low exploitation probability consistent with a legacy, rarely-used filesystem driver.
Integer wraparound in the Linux kernel HID-BPF subsystem's hid_bpf_get_data() helper allows a local low-privileged user to bypass a buffer range check and obtain an out-of-bounds pointer into kernel memory, potentially enabling privilege escalation or memory corruption. Affected kernels span from Linux 6.3 (commit 658ee5a64fcfbbf) through versions prior to 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3, where upstream fix commits have landed. No public exploit has been identified at time of analysis and EPSS remains at 0.21%, but the CVSS 7.8 local-privilege score reflects a high-impact, low-complexity code path once local access is established.
Race condition in the Linux kernel's Microchip VCAP network driver corrupts hardware forwarding table entries on systems using sparx5 or lan969x switching ASICs. A local authenticated user can simultaneously trigger a debugfs VCAP rule dump and a tc-flower rule write to different Super VCAP instances, causing shared cache registers to be overwritten mid-transaction and committing corrupt data directly into hardware forwarding entries. No public exploit code or CISA KEV listing exists; EPSS is 0.21%, reflecting low exploitation likelihood in practice.
Heap out-of-bounds write in the Linux kernel's act_pedit TC offload path allows a local attacker holding CAP_NET_ADMIN to corrupt kernel slab memory with attacker-controlled content, potentially leading to privilege escalation or denial of service. The flaw affects Linux kernel versions from approximately 4.11 through the stable branches patched in 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3. Trend Micro ZDI researchers confirmed exploitability via KASAN trace using a targeted POC; no public exploit has been released and this CVE is not listed in the CISA KEV catalog.
Kernel memory corruption in the Linux ASoC Sound Open Firmware (SOF) IPC4 control subsystem allows a low-privileged local user to trigger incorrect buffer copy lengths in sof_ipc4_bytes_put(), potentially achieving high confidentiality, integrity, and availability impact. The root cause is a logic error - not a race - where the copy size is sourced from the stale in-kernel buffer's size field rather than from the incoming user-supplied sof_abi_hdr.size in ucontrol, enabling data truncation or stale-byte copying into kernel structures. No public exploit code or active exploitation has been identified at time of analysis; patch commits are available across multiple stable kernel series.
Unbounded array indexing in the ocfs2 filesystem's ocfs2_sum_rightmost_rec() function causes UBSAN-detected kernel panic or memory corruption when a file write targets an inode whose embedded extent list has been corrupted on-disk. Linux kernels prior to 6.18.40 (stable 6.x branch) and 7.1.5 (7.x branch) are affected on any system mounting an ocfs2 volume. No public exploit has been identified at time of analysis and EPSS probability sits at 0.21% (11th percentile), reflecting realistically constrained exploitability due to the required on-disk corruption precondition.
Cache coherency corruption in the Linux kernel's OpenRISC architecture jump_label implementation leaves instruction cache lines on remote SMP cores stale after static key updates, meaning security-relevant kernel branches may execute the wrong code path indefinitely on affected multi-core OpenRISC systems. The flaw originates in commit 8c30b0018f9d, which ported jump_label support from arm64 without adapting icache invalidation to OpenRISC's SMP model - `kick_all_cpus_sync()` does not guarantee a full remote icache flush on this architecture. No public exploit has been identified at time of analysis, and the 0.21% EPSS score (11th percentile) reflects the severe rarity of OpenRISC SMP hardware in production.
Uninitialized memory dereference in the Linux kernel's dma-fence subsystem allows a local low-privileged user on AMD GPU-equipped systems to trigger memory corruption via the amdgpu userqueue wait path. The root cause is an off-by-one logic error in `dma_fence_dedup_array()` that returns 1 instead of 0 for empty input, which the primary caller guards against but `amdgpu_userq_wait_*()` does not, exposing an uninitialized fence slot to dereference. Patch commits are available for stable branches 6.18.40 and 7.1.5; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), indicating low real-world exploitation activity.
Use-after-free in the Linux kernel's amdxdna DMA buffer memory mapping function exposes systems with AMD XDna AI accelerator hardware to local privilege escalation. When vm_insert_pages() fails inside amdxdna_gem_dmabuf_mmap(), the error path triggers drm_gem_object_put() twice on the same GEM object - once through the VMA close handler and again through the fall-through put_obj label - freeing the object and then accessing freed memory. EPSS sits at 0.21% (11th percentile) and the vulnerability is not listed in CISA KEV, indicating no known active exploitation; however, the CVSS 7.8 high score reflects the full C/H/I:H/A:H kernel memory corruption potential if successfully triggered locally.
Use-after-free in the Linux kernel's resctrl filesystem subsystem allows a local low-privileged user to dereference freed kernel memory during a race between a concurrent monitoring file reader and resctrl unmount or fatal teardown. The vulnerable code path affects multiple stable kernel series, with fixes confirmed in 6.18.42, 7.1.5, and 7.2-rc3. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% reflects low current exploitation probability, though kernel use-after-free primitives are commonly developed into local privilege escalation exploits.
Out-of-bounds memory access in the Linux kernel's SoundWire audio subsystem exposes local low-privilege users on affected kernel versions to potential privilege escalation to root. The off-by-one loop error in sdw_add_element_group_count, discovered via Google's syzkaller fuzzer, allows iteration to read beyond valid array bounds when the iterator equals the element count, potentially corrupting adjacent kernel memory. No active exploitation is confirmed (no CISA KEV entry), and an EPSS of 0.21% at the 11th percentile reflects minimal real-world exploitation activity at time of analysis, though the local vector and low privilege requirement mean any authenticated user on a SoundWire-equipped system is theoretically within scope.