Use-after-free in the Linux kernel Bluetooth ISO subsystem allows a physically adjacent, unauthenticated attacker to corrupt kernel heap memory, potentially enabling privilege escalation or a denial-of-service crash. The defect exists in `iso_sock_disconn()`, where clearing `conn->hcon = NULL` omits the required `conn->hcon->iso_data = NULL` reset, leaving a dangling pointer that `iso_conn_free()` later dereferences. Patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.44, 7.1.8); no confirmed active exploitation is on record despite the high CVSS score, consistent with the very low EPSS of 0.17% and the specialized Bluetooth ISO attack surface.
Use-After-Free in the Linux kernel's Bluetooth L2CAP LE connection response handler exposes systems with Bluetooth enabled to potential kernel-level memory corruption by an adjacent, unauthenticated attacker. The flaw in `l2cap_le_connect_rsp()` stems from missing reference-count protection on a channel object, allowing a concurrent remote-disconnect-triggered `l2cap_chan_del()` to free the object between lookup and lock - a pattern already fixed in the BR/EDR counterpart but overlooked here. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.17%, and no public exploit code has been identified, though the kernel-level UAF impact class is inherently severe if triggered.
Concurrent deadlock and use-after-free (UAF) vulnerabilities in the Linux kernel's Bluetooth ISO socket layer allow adjacent-network attackers to corrupt kernel memory via race conditions in `iso_sock_timeout()`. Affected systems must be within Bluetooth radio range; no authentication is required. No public exploit code and no CISA KEV listing have been identified - EPSS of 0.17% (6th percentile) reflects low current exploitation probability despite the high CVSS score of 8.8.
Use-after-free (UAF) in the Linux kernel Bluetooth HCI connection subsystem exposes adjacent-network attackers to potential kernel memory corruption via a race condition in abort_conn_sync(). The hci_conn object can be freed while the hci_sync task is still executing against it, because no reference count is held across the async operation - a classic lifetime management failure in kernel concurrent code. No public exploit has been identified and EPSS sits at only 0.17% (6th percentile), but the CVSS 8.8 score reflects the theoretical full-system impact if the race is successfully won. The vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at time of analysis.
Use-after-free memory corruption in the Linux kernel's ksmbd SMB server subsystem exposes systems running the in-kernel file-sharing daemon to potential kernel-level compromise by an authenticated remote attacker. Affected are Linux kernel versions beginning at commit 8510a043d334ecdf83d4604782f288db6bf21d60 (ksmbd introduction) through multiple stable branches, with vendor-released patches confirmed in 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. No public exploit code has been identified and EPSS stands at 0.17% (6th percentile), indicating no observed mass exploitation at time of analysis despite the CVSS 8.8 severity rating.
KVM s390 PCI subsystem in the Linux kernel allows a local low-privileged user to corrupt hypervisor resources by repeatedly calling the adapter interrupt forwarding ioctl for the same zPCI device without prior unregistration. The vulnerability affects IBM Z (s390) systems running Linux KVM with PCI passthrough from commit 3c5a1b6f onwards (Linux 6.0+), with patched stable releases available. No public exploit exists and EPSS sits at 0.17% (6th percentile), reflecting the niche architecture and local-access prerequisite, but the CVSS Scope:Changed designation signals the flaw can cross the guest-to-hypervisor boundary, elevating its priority on affected IBM Z KVM deployments.
Use-after-free in the Linux kernel Bluetooth hci_sync subsystem exposes kernel heap memory to corruption via a race condition between advertising instance teardown and HCI command synchronization. Systems running affected kernel versions (from commit cba6b758711cab946c787f7c15be92cc749b8e1f across 5.15.x, 6.12.x, 6.18.x stable branches) with active Bluetooth LE extended advertising are vulnerable to exploitation by attackers within Bluetooth radio range. The kernel-level UAF can yield arbitrary code execution in kernel context with full C/I/A impact; no public exploit has been identified and EPSS sits at the 6th percentile, indicating purely theoretical exploitation risk at this time.
Uninitialized memory read and session hijack in the Linux kernel Bluetooth HIDP subsystem exposes systems with active Bluetooth HID sessions to kernel memory disclosure and forced session termination from an unauthenticated adjacent attacker. The functions hidp_recv_ctrl_frame() and hidp_recv_intr_frame() dereference skb->data[0] before validating that the received L2CAP SDU is at least one byte long, allowing a connected peer to feed an empty frame and cause the kernel to consume a stale tailroom byte - or, via a crafted HCI ACL packet, a fully attacker-controlled byte interpreted as a synthetic HIDP transaction code. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Use-after-free race condition in the Linux Kernel TIPC subsystem allows a low-privileged attacker to trigger stale-pointer dereference during socket poll trace operations, potentially leading to kernel memory corruption and privilege escalation. The flaw arises because tipc_poll() invokes trace_tipc_sk_poll() without holding the socket lock, enabling tipc_list_dump() to walk live queue members while a concurrent thread dequeues and frees socket buffers (skbs). Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8); no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free and out-of-bounds read in the Linux kernel mwifiex WiFi driver (CVSS 8.8, AV:A) allow an unauthenticated attacker on an adjacent WiFi segment to trigger kernel memory corruption by sending crafted A-MSDU frames containing TDLS payloads. Affected kernel versions span from the commit introducing A-MSDU TDLS handling (circa Linux 4.5, commit 776f742040ca) through all stable branches prior to the fixes in 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the flaw is remotely selectable by the sender through control over A-MSDU subframe layout, making TDLS-capable mwifiex deployments meaningfully exposed from the local wireless segment.
Integer overflow in the Linux kernel SCTP subsystem allows a remote low-privileged attacker to trigger an approximately 8 MiB out-of-bounds write past a socket buffer (skb) tail in kernel heap memory by adding 65,536 unique peer transport addresses to an SCTP association, wrapping the 16-bit transport_count to zero. Affected systems running Linux kernels from the 4.7 era through stable branches prior to 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6 are vulnerable. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates minimal current exploitation activity despite the CVSS 8.8 rating.
Pointer underflow in the VMware graphics driver (drm/vmwgfx) of the Linux kernel enables local low-privileged users to perform a TOCTOU attack on the DMA command stream inside a bounce buffer, allowing one crafted command to overwrite authenticated fields (GMR id, surface id) of a previously verified command. This bypasses kernel command authentication and can lead to unauthorized access to graphics memory regions or escalated privileges within a VMware guest. EPSS is 0.17% (6th percentile) and the vulnerability is not listed in CISA KEV, suggesting no confirmed widespread exploitation at the time of analysis.
Kernel soft lockup and system panic in the Linux rtw89 Wi-Fi driver affects systems with Realtek RTW89 802.11ax chipsets during 6GHz band scanning. The root cause is an integer truncation bug where the loop counter variable `i` is silently narrowed to 8 bits via a `movzbl %bl, %eax` instruction; when `req->n_6ghz_params` exceeds 255, the counter wraps to zero and the loop never terminates, trapping the CPU for 26+ seconds until the watchdog fires and triggers a kernel panic. No public exploit identified at time of analysis, and EPSS of 0.17% at the 6th percentile reflects low exploitation probability despite the provided CVSS score of 8.8.
Race condition in the Linux kernel Bluetooth ISO subsystem allows an adjacent, unauthenticated attacker to trigger a NULL pointer dereference or memory corruption by sending crafted Bluetooth LE ISO connection events targeting a socket concurrently transitioning out of LISTEN or CONNECT state. Affected kernels span the 6.8.9 through pre-6.9 range, with backported fixes confirmed for stable releases 6.18.44 and 7.1.8. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), though the kernel-level impact and Bluetooth-adjacent unauthenticated access vector justify the vendor's 8.8 CVSS rating.
Use-after-free race condition in the Linux kernel's Bluetooth ISO subsystem allows an unauthenticated attacker within Bluetooth adjacency range to corrupt kernel memory by exploiting concurrent socket teardown in iso_conn_ready(), potentially leading to privilege escalation or system crash on affected hosts. The flaw - present since the introduction of Bluetooth 5.2 ISO channel support in Linux 5.15 - arises because conn->sk is dereferenced without holding a lock or refcount, enabling a concurrent iso_sock_release() call to free the socket before iso_conn_ready() completes its dereference. No public exploit or CISA KEV entry exists at time of analysis, and the EPSS score of 0.17% (6th percentile) reflects very low near-term exploitation probability despite the High CVSS score.
Use-after-free via reference counting race in the Linux kernel's Bluetooth ISO (LE Audio) subsystem allows an adjacent, unauthenticated attacker to potentially achieve kernel-level code execution or information disclosure. The race arises between concurrent execution of iso_conn_del() and iso_chan_del() in separate kernel tasks, resulting in a double-put of the iso_conn object and subsequent memory corruption. Affected stable branches span Linux 6.11.11 through pre-6.13 series; upstream patches are available in Linux 6.18.44, 7.1.8, and 7.2-rc6. No public exploit code exists and no active exploitation has been confirmed, consistent with a very low EPSS score of 0.17%.
Use-after-free in the Linux kernel's IOMMUFD subsystem (iommu/iommufd) exposes systems running VFIO device passthrough to kernel memory corruption by a local low-privileged attacker, with a scope change that may cross security boundaries into the hypervisor layer. The flaw, present since Linux 6.11, stems from a race between IOPF group acceptance by the fault handler and concurrent device detach operations, leaving IOMMUFD's deliver list holding references to memory already freed by the generic pending list cleanup path. No public exploit or active exploitation has been identified at time of analysis - EPSS stands at 0.17% (6th percentile) and the vulnerability is absent from CISA KEV - though the CVSS 3.1 score of 8.8 reflects the severity of potential impact in affected virtualization environments.
Type confusion in the rtw89 PCI Advanced Error Reporting (AER) handlers corrupts kernel memory on Linux systems equipped with Realtek RTL8852CE and related WiFi adapters. The driver stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() incorrectly retrieve it as a net_device pointer, causing netif_device_detach/attach to read and write at wrong memory offsets within a misidentified kernel struct. An adjacent-network attacker within WiFi range could potentially trigger the faulty AER handler path by inducing hardware-level PCI errors via crafted 802.11 frames, resulting in kernel memory corruption. No public exploit exists and EPSS is 0.17% (6th percentile), indicating low observed exploitation activity despite a high CVSS score of 8.8.
Type confusion in the rtw88 Realtek PCIe Wi-Fi driver's PCI Advanced Error Reporting (AER) handlers allows an adjacent-network attacker to corrupt kernel memory, potentially enabling privilege escalation or arbitrary kernel code execution on Linux systems using Realtek PCIe Wi-Fi hardware. The driver stores an ieee80211_hw pointer via pci_set_drvdata() at probe time but retrieves it as a net_device pointer in io_error_detected() and io_resume(), causing netif operations to read and write kernel memory at incorrect struct offsets. No public exploit code has been identified, EPSS places exploitation probability at 0.17% (6th percentile), and the vulnerability is not listed in CISA KEV.
Out-of-bounds array indexing in the Linux kernel's rtw89 WiFi driver exposes systems using Realtek 802.11ax hardware to kernel memory corruption or disclosure from adjacent network attackers. The driver accepts an 8-bit mac_id (range 0-255) from firmware-processed RX descriptors and uses it without validation to index into assoc_link_on_macid[], which contains only 128 entries - creating a 128-entry gap where attacker-controlled values trigger reads or writes beyond the array boundary. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at 0.17% (6th percentile), but the CVSS 8.8 score reflects the full kernel memory impact achievable by an unauthenticated adjacent attacker.
Token resource leak in the Linux kernel mt7996 WiFi driver (mt76 subsystem) allows an adjacent unauthenticated attacker to exhaust TX tokens by repeatedly triggering failed link_conf or link_sta lookups in mt7996_tx_prepare_skb(), potentially degrading or crashing WiFi functionality on affected devices. The provided CVSS 8.8 score with C:H/I:H/A:H is notably high for what the description characterizes as a resource management bug; the actual impact most closely aligns with denial-of-service through token exhaustion, not direct confidentiality or integrity compromise. No public exploit code exists and EPSS sits at 0.17% (6th percentile), indicating minimal current exploitation interest. Patches are available in Linux 6.18.40, 7.1.5, and 7.2-rc1.
Use-after-free in the Linux kernel Thunderbolt XDomain subsystem enables a physically adjacent attacker with a malicious Thunderbolt device to corrupt kernel memory, potentially achieving code execution at kernel privilege level. The flaw stems from a race condition introduced when commit 559c1e1e0134 moved tb_xdp_handle_request() to the system workqueue, breaking the serialization with the disconnect path and creating a window where queue_delayed_work() can fire on a freed xdomain object. No public exploit has been identified and EPSS (0.16%, 5th percentile) confirms very low near-term exploitation probability, though the kernel-level impact makes this relevant for organizations operating Thunderbolt-enabled endpoints in adversarial physical environments.
Use-after-free race condition in the Linux kernel Bluetooth ISO subsystem allows an adjacent, unauthenticated attacker to trigger kernel memory corruption with full confidentiality, integrity, and availability impact. The flaw resides in the hci_conn::iso_data field, which is read and modified across concurrent kernel tasks without lock or RCU protection - allowing a kfree() in one task to race against a kref_get_unless_zero() in another, yielding a dangling pointer dereference. No public exploit code has been identified and EPSS exploitation probability is 0.15% (5th percentile), but kernel UAF primitives are well-understood by skilled attackers and the Bluetooth adjacency requirement is the primary limiting factor for mass exploitation.
Use-after-free in the Linux kernel Bluetooth HCI synchronization subsystem (hci_sync) creates a theoretical kernel memory corruption risk via a race condition in the hci_connect_big_sync() callback. The conn (connection) struct can be freed while the hci_sync asynchronous task is still executing, potentially allowing an adjacent, unauthenticated attacker within Bluetooth range to trigger a dangling pointer dereference in kernel context. No public exploit identified at time of analysis and EPSS stands at 0.15% (5th percentile), but patches are available across multiple Linux stable branches and should be applied as routine maintenance.
Local privilege escalation in the Linux kernel's octeontx2-af driver (Marvell OcteonTX2 hardware) allows a low-privileged Virtual Function (VF) tenant to overwrite the Physical Function's (PF) shared CGX hardware PKIND configuration, corrupting HiGig2 or EDSA packet parsing state and achieving high confidentiality, integrity, and availability impact across the PF boundary. The vulnerability arises because VF NIX LF allocation did not check whether the LMAC was already configured with a privileged PKIND before resetting it. No public exploit code has been identified and EPSS is 0.15% (5th percentile), indicating very low exploitation probability, though the changed-scope CVSS vector reflects genuine cross-tenant hardware corruption potential in SR-IOV deployments.
Use-after-free in the Linux kernel wifi/mac80211 subsystem allows an adjacent network attacker to trigger kernel memory corruption during Block Acknowledgment session teardown. ieee80211_stop_tx_ba_cb() hands tid_tx to kfree_rcu() and then reads tid_tx->ndp after dropping sta->lock without RCU read-side protection, creating a window where the RCU softirq callback can free the object before the read completes. The vulnerability carries a CVSS 8.8 score (AV:A) but EPSS sits at the 5th percentile with no KEV listing, reflecting the race-condition exploitation complexity; no public exploit has been identified at time of analysis.
Kernel panic via NULL pointer dereference in the Linux kernel's ath11k PCI WiFi driver affects systems running kernel versions from 5.19 through pre-7.1.5/7.2-rc1 with Qualcomm PCI-attached WiFi chipsets such as WCN6855. The race condition occurs when a system reboot overlaps with WLAN firmware crash recovery (Subsystem Reset, SSR), causing the MHI teardown path and SSR recovery path to simultaneously attempt to deinitialize MHI and free DMA-backed contexts, resulting in a double-free scenario and kernel crash. No public exploit code exists and EPSS exploitation probability is very low at 0.15%, consistent with an accidental-trigger vulnerability rather than a targeted attack vector.
Use-after-free in the Linux kernel iommufd subsystem allows a local low-privileged attacker on IOMMU-enabled systems to corrupt kernel memory by triggering dmabuf invalidation callbacks against already-destroyed page structures during detach. Affected configurations include virtualization hosts using VFIO or vDPA device passthrough where the iommufd framework is active. The CVSS S:C (Changed Scope) rating reflects the potential for cross-workload impact in multi-tenant environments; no public exploit identified at time of analysis, and EPSS at 0.15% (5th percentile) indicates negligible observed exploitation activity.
Incorrect teardown ordering in the Linux kernel's netkit queue lease subsystem allows a local attacker with low privileges to trigger a race window where live NAPI polling consumes net_iov entries whose DMA addresses have already been cleared, causing the physical NIC to DMA to a stale or zero address. Affected kernel versions span from the introducing commit 5602ad61ebee through the 7.1 stable series, with fixes landing in 7.1.5 and 7.2-rc1. No public exploit code exists and EPSS probability stands at 0.15%, but the S:C scope change in the CVSS vector signals that successful exploitation can corrupt memory beyond the vulnerable process boundary, potentially enabling privilege escalation.
Use-after-free race condition in the Linux kernel's RDMA bnxt_re driver allows a local low-privileged user to corrupt kernel memory by triggering a Notification Queue (NQ) interrupt that writes to a freed CQ toggle page during Completion Queue teardown. Systems running Linux kernel versions prior to 7.1.5 or 7.2-rc1 with Broadcom NetXtreme-E/C RDMA-capable adapters are affected. No public exploit or active exploitation has been identified; EPSS remains at 0.15% (5th percentile), reflecting low real-world exploitation probability at time of analysis.
Kernel memory corruption in the Linux RDMA bnxt_re (Broadcom NetXtreme) driver allows a local low-privileged user to trigger undefined hardware behavior by submitting WQE (Work Queue Entry) mode values that exceed the 64K hardware maximum or are zero, with no bounds validation applied. The CVSS vector (AV:L/AC:L/PR:L/S:C/C:H/I:H/A:H, score 8.8) reflects that a local unprivileged process interacting with RDMA verbs can cause a scoped kernel-level impact, including potential memory corruption or system crash. No public exploit has been identified at time of analysis, and EPSS at 0.15% (5th percentile) indicates very low observed exploitation probability, but the scope change to kernel space makes this a meaningful risk in environments deploying Broadcom RDMA adapters.
Use-after-free in the Linux kernel's IPv6 nexthop routing subsystem allows a local low-privileged attacker to corrupt kernel memory by racing nexthop replace operations against concurrent IPv6 route deletion. The functions fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list under RTNL serialization without holding nh->lock, while IPv6 route add/delete operations mutate that same list under nh->lock without RTNL, creating a window where a freed fib6_info struct is read. No public exploit is confirmed in CISA KEV and EPSS is a low 0.14%, but KASAN stack traces embedded in the advisory (tasks 'exploit/142' and 'exploit/143') confirm the race was reproducibly triggered, and the vendor has released fix commits to the stable kernel trees.
Use-after-free race condition in the Linux kernel nexthop subsystem (net/ipv4/nexthop.c) allows a local attacker with low-privilege access to trigger slab-use-after-free in kernel memory, potentially achieving full kernel code execution with scope change across the system. The race occurs between nh_rt_cache_flush() walking nh->f6i_list without holding nh->lock and concurrent IPv6 route add/delete operations freeing fib6_info entries under nh->lock - confirmed by an in-kernel KASAN trace naming the task 'exploit/146'. This CVE carries a CVSS 3.1 score of 8.8 (S:C, C:H/I:H/A:H) but EPSS of 0.14% (4th percentile) and no CISA KEV listing indicate no confirmed active exploitation at time of analysis.
Out-of-bounds memory corruption in the Linux kernel's ath12k WiFi 7 driver corrupts kernel memory adjacent to the ML peer ID bitmap during MLO peer cleanup. The `ath12k_mac_dp_peer_cleanup()` function incorrectly indexes a 256-bit bitmap with `dp_peer->peer_id`, which always carries the ATH12K_PEER_ML_ID_VALID flag (BIT(13), value 8192+), causing `clear_bit()` to write far outside the valid bitmap range. No public exploit has been identified at time of analysis, and EPSS probability stands at 0.14%, though the CVSS 8.8 rating reflects the adjacent-network, unauthenticated vector and full kernel-level C/I/A impact of the memory corruption primitive.
Authentication bypass in SiYuan's WebSocket endpoint allows unauthenticated remote attackers to access the live kernel event stream - including document identifiers, titles, and operation logs - in all versions before v3.7.4. The flaw stems from a query-parameter parsing differential between two distinct security checks: the auth-exemption path and the session quarantine path resolve duplicate query parameters differently, allowing a crafted URI to satisfy the exemption check while evading token validation entirely. No active exploitation has been confirmed (not in CISA KEV), but the unauthenticated network-accessible attack vector and CVSS 4.0 score of 8.7 make this a high-priority patch for any internet-exposed SiYuan deployment.
Unauthenticated brute-force of per-notebook publish passwords is possible in SiYuan before 3.7.4 due to the complete absence of rate limiting or CAPTCHA on the authFilePublishAccess endpoint. Any network-reachable SiYuan instance with the notebook publishing feature enabled and at least one password-protected published notebook is exposed to automated credential guessing, potentially disclosing the notebook's full contents to an unauthorized party. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS 4.0 score of 8.7 reflects the trivially low exploitation barrier once a suitable target is identified.
Unbounded zlib decompression in Pandora's DAA file extractor enables unauthenticated remote attackers to trigger memory and CPU exhaustion by submitting a crafted zip-bomb DAA archive. Because Pandora is a file analysis platform whose core function is accepting untrusted files, the attack surface is directly aligned with the product's intended use - no special access or configuration is required beyond file submission. The CVSS 4.0 score of 8.7 reflects high availability impact on the extraction worker with limited subsequent service degradation; no public exploit code has been identified, and the vulnerability is not listed in CISA KEV, though exploitation is trivially simple for anyone familiar with zip bomb construction.
Server-side template injection in siyuan's attribute-view Template calculation feature (versions 3.7.0-beta.1 through 3.7.3) allows any local OS user to read the siyuan process's environment variables and conduct DNS lookups from the server's network position. The vulnerability exists because the Sprig template function map is used unmodified, reintroducing env, expandenv, and getHostByName functions that were specifically removed in a prior remediation (CVE-2024-55660). Because the siyuan kernel binds to 127.0.0.1 with no per-UID access control, a separate unprivileged OS account sharing the same host can exploit this without any application-level credentials. No public exploit has been identified at time of analysis; vendor-released patch v3.7.4 is available.
Undefined behavior in the Linux kernel's spi-uniphier SPI controller driver arises from a driver probe initialization ordering defect: devm_request_irq() is called before init_completion(), leaving a race window in which an early interrupt can invoke complete() on an uninitialized kernel completion object. Systems running Socionext UniPhier SoC hardware on affected kernel versions are exposed during driver probe. No public exploit has been identified and EPSS sits at 0.22% (13th percentile), consistent with the hardware-specific nature of the flaw - practical exploitation is constrained to platforms physically equipped with UniPhier SoCs.
Integer overflow in the Linux kernel's QRTR (Qualcomm IPC Router) subsystem on 32-bit platforms allows an out-of-bounds kernel heap write via a crafted incoming packet. On 32-bit builds where size_t is four bytes, passing size >= 0xfffffffd to ALIGN(size, 4) wraps the result to zero, bypassing the packet validation check in qrtr_endpoint_post() and allowing skb_put_data() to write attacker-controlled data far beyond the allocated socket buffer. This is the 32-bit residual of commit ad9d24c9429e2, which fixed only the 64-bit case; 64-bit kernels are structurally unaffected. No public exploit is identified at time of analysis, and EPSS at 0.22% reflects low exploitation probability.
Landlock SCOPE_SIGNAL enforcement in the Linux kernel can be bypassed by a sandboxed process via the asynchronous SIGIO delivery path, allowing it to send arbitrary signals - including SIGKILL - to processes outside its Landlock domain such as supervisors or security monitors. The flaw exists because hook_file_send_sigiotask() evaluates the Landlock domain recorded at F_SETOWN time rather than the live sender domain, and control_current_fowner() incorrectly skips domain recording when a single member of the target process group (PIDTYPE_PGID) shares the caller's thread group, leaving the remaining group members unchecked at delivery. No public exploit code exists and EPSS is 0.22% (13th percentile), but the impact is significant for environments relying on Landlock as a containment boundary.
SELinux mandatory access control bypass in the Linux kernel allows local low-privilege users to circumvent connect-related network policy enforcement by initiating TCP connections via TCP Fast Open (MSG_FASTOPEN). The kernel's SELinux LSM hook for socket_sendmsg() was never updated to invoke selinux_socket_connect() when the MSG_FASTOPEN flag is passed, meaning connections using this path skip SELinux policy checks entirely. With a CVSS 8.4, Scope Changed, and confirmed patches across six stable branches, this is a meaningful MAC bypass in SELinux-enforcing environments - no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile).
Slab-out-of-bounds write in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3) is triggered during the log_replay() analysis pass when mounting a malformed NTFS3 volume. The copy_lcns loop lacks bounds enforcement against dp->lcns_follow, so a crafted LRH entry with target_vcn set to dp->vcn + dp->lcns_follow - 1 and lcns_follow greater than 1 overflows the heap-allocated page_lcns[] array, corrupting kernel memory. Confirmed by KASAN on mainline kernel 8d90b09e6741 with a slab-out-of-bounds write of size 8 at log_replay+0x68d4; no public exploit exists and EPSS stands at 0.21%, though the CVSS score of 8.4 reflects the full confidentiality, integrity, and availability impact of kernel heap corruption.
Memory corruption in the Linux kernel mlx5e driver's Hyper-V VHCA statistics subsystem causes a kernel fault when running as a Hyper-V guest with a Mellanox/NVIDIA ConnectX NIC. The driver initializes the stats buffer with a zero-size allocation that returns ZERO_SIZE_PTR (0x10) instead of NULL, bypasses the NULL guard, and stores the sentinel pointer; once channels open and the hypervisor enables stats reporting, a subsequent memset on address 0x10 faults the kernel. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), reflecting minimal real-world exploitation likelihood despite the high official CVSS score.
The mlx5e HV VHCA stats agent registration in the Linux kernel contains an initialization race condition that can produce NULL pointer dereferences or kernel timer list corruption, crashing a Hyper-V guest VM. Affected systems are those running Linux on Microsoft Hyper-V with a Mellanox mlx5e NIC across stable kernel trees spanning 6.1 through 7.1, with the root cause being that mlx5_hv_vhca_agent_create() publishes the agent and triggers an asynchronous workqueue callback before the caller has initialized the associated delayed_work structure and agent pointer. No public exploit code has been identified and EPSS exploitation probability is 0.21% (12th percentile); vendor patches have been released across all active stable branches and upstream commit references are available via kernel.org.
Integer overflow in the Linux kernel's BPF sockmap helper `bpf_msg_pop_data()` enables a local privileged attacker to bypass scatterlist bounds checks, causing an out-of-bounds traversal that dereferences a null or non-canonical page pointer and crashes the kernel. Affected are all kernel stable series from 5.10 through pre-7.2, with patches confirmed across eight stable branches. No public exploit has been identified at time of analysis and the EPSS score of 0.21% (12th percentile) indicates negligible current exploitation activity, though the confirmed kernel crash impact and High CVSS score warrant prompt patching on systems using BPF sockmap.
Initialization ordering flaw in the Linux kernel's Renesas RZ DMAC driver (rz-dmac) creates a race window during driver probe where a DMA interrupt fires before channel->ch_base is assigned and before the ld_free, ld_queue, and ld_active linked-list structures are initialized, leading to invalid kernel memory access, potential kernel crashes, or memory corruption on Renesas RZ SoC-based platforms. Affected systems run Linux 5.15 through the pre-patch stable releases; fixes are available across multiple upstream stable branches (6.6.148, 6.12.101, 7.1.5, 7.2-rc1). No public exploit exists, EPSS is 0.21% (11th percentile), and this CVE is not listed in the CISA KEV catalog.
Integrity and availability compromise in the Linux kernel's Intel Xe GPU Physical Function (PF) driver allows a low-privileged local user operating within a guest Virtual Function (VF) environment to trigger PF-side assertion failures and ABI protocol breakage by sending FAST_REQUEST or EVENT relay messages - message types the PF handler is not designed to process. The vulnerability crosses a privilege boundary from guest to host, reflected in the CVSS scope-changed rating of 8.4. No public exploit code exists and no active exploitation has been confirmed; EPSS stands at 0.21% (11th percentile). Vendor-released patches are available across multiple stable kernel branches.
Linux kernel's ntfs3 filesystem driver crashes and may corrupt memory when processing a crafted NTFS image due to an unbounded memmove in the DeleteIndexEntryAllocation code path. Any local user able to mount a malformed NTFS volume can trigger a kernel oops through a negative ptrdiff_t silently cast to a near-maximal size_t, causing memmove to walk far past the destination buffer. No public exploit and no CISA KEV listing exist at time of analysis; EPSS is low at 0.21%, but the memory corruption primitive and local-to-kernel boundary crossing make this a meaningful privilege escalation and availability risk on systems where unprivileged NTFS mounts are possible.
The Linux kernel CIFS client driver crashes with a NULL pointer dereference when a filesystem is unmounted while CIFS file objects remain queued in the fileinfo_put_wq work queue. Multiple stable branches from 6.1 through 6.19 are affected, with patched versions released across all active stable trees. No active exploitation has been confirmed - EPSS stands at 0.21% (11th percentile) and the CVE carries no CISA KEV listing - though the CVE description itself includes a complete, step-by-step reproduction script.