Use-after-free in the Linux kernel's RDS/TCP subsystem allows a local authenticated attacker to read freed kernel memory via a race condition in `rds_tcp_laddr_check()`, potentially enabling privilege escalation. The flaw is triggered through the `bind()` syscall when the RCU read lock is incorrectly released between a `dev_get_by_index_rcu()` lookup and a subsequent `ipv6_chk_addr()` call, creating a window for concurrent interface deletion to free the `net_device` struct. No public exploit is identified at time of analysis, and EPSS of 0.16% (5th percentile) indicates low near-term exploitation probability despite the CVSS 7.8 High rating.
Use-after-free in the Linux kernel's nf_tables netfilter subsystem exposes local attackers with low-privilege accounts to potential kernel-level privilege escalation by exploiting a race condition in nft_object lifecycle management across network namespaces. The nft_object rhltable was implemented as a global structure, meaning that as one network namespace tears down its objects via nft_rcv_nl_event(), another namespace can still resolve pointers to those objects through the shared lookup table - and since nft_obj_destroy() frees memory immediately, a concurrent lookup dereferences freed memory. No active exploitation has been identified (not in CISA KEV) and EPSS sits at 0.16% (5th percentile), though the vulnerability's kernel-level impact warrants patching on multi-tenant and containerized Linux hosts.
Shift-out-of-bounds undefined behavior in the Linux kernel's TC u32 classifier allows local privilege escalation on systems where unprivileged namespace creation is permitted. The root cause is that u32_change() copies a user-supplied offshift value (0-255) into the kernel without validating it is less than 16, so when packet classification later evaluates the variable offset expression with TC_U32_VAROFFSET set, an offshift >= 32 violates C11 §6.5.7p3 and produces undefined behavior exploitable for kernel-level impact. No public exploit has been identified at time of analysis, and patched stable releases 7.1.8 and 7.2-rc6 are available.
Integer overflow in the Linux kernel's legacy DRM radeon driver exposes systems with older ATI/AMD Radeon GPUs to kernel memory corruption via crafted dumb-buffer allocation requests from a low-privileged local user. The flaw resides in radeon_align_pitch(), where both the alignment round-up addition and the final width-times-bytes-per-pixel multiplication can overflow signed 32-bit integers, causing radeon_mode_dumb_create() to return an invalid pitch or allocate a zero-sized kernel buffer - a condition that can be leveraged for heap corruption. EPSS sits at 0.16% (5th percentile) with no CISA KEV listing and no public proof-of-concept, indicating active exploitation has not been confirmed; however, the low-privilege local vector and straightforward arithmetic overflow make this notable for shared Linux systems with this legacy hardware.
Incorrect NULL-check ordering in the Linux kernel's crypto/ccp driver exposes AMD SEV-SNP systems to kernel memory corruption during Trusted I/O firmware initialization. On architectures without HASHED_PAGE_VIRTUAL, passing the return value of __snp_alloc_firmware_pages() directly to page_address() before checking for NULL causes page_address(NULL) to return a deterministic but invalid non-zero address, silently bypassing the allocation-failure guard and allowing sev_tsm_init_locked() to dereference garbage memory. Affected kernel versions span from commit 4be423572da1f4c1 through the patched releases (7.1.5, 7.2-rc1, 6.19); no public exploit identified at time of analysis, and EPSS is 0.16% (5th percentile), consistent with zero confirmed in-the-wild exploitation.
Use-after-free in the Linux kernel Bluetooth hci_sync subsystem exposes local users with low privileges to potential kernel heap corruption via a race condition in `hci_connect_pa_sync()`. The `conn` connection object can be freed by one code path while the asynchronous hci_sync callback is still executing, allowing a local attacker on affected 6.12.x, 6.14.x, and 6.15.x kernel branches to corrupt kernel memory and potentially achieve full privilege escalation. No public exploit code has been identified, and EPSS of 0.15% (5th percentile) confirms very low exploitation probability at this time - no confirmed active exploitation (not in CISA KEV).
Use-after-free in the Linux kernel's FOU (Foo-over-UDP) tunnel subsystem allows a local attacker with low privileges to corrupt kernel memory by exploiting a race condition in fou_create(). The struct fou object is published via sk_user_data before being committed to the per-network-namespace port list; when fou_add_to_port_list() subsequently fails on port-0 requests, the error path frees the object while concurrent RCU readers can still dereference it through fou_from_sock(). Two stable-branch upstream commits (a28d8903, b14361ac) provide the fix; no public exploit has been identified at time of analysis, and EPSS sits at the 5th percentile.
Use-after-free in the Linux kernel's AMD GPU power management subsystem (drm/amd/pm) allows a low-privileged local attacker to corrupt kernel memory via a race condition in the sysfs power table interface. The flaw exists because amdgpu_dpm_get_pp_table() returns a raw pointer to a driver-owned buffer after releasing adev->pm.mutex, enabling a concurrent pp_table write to free the allocation while a sysfs copy is still in progress. No public exploit has been identified and EPSS probability is very low (0.15%), but the CVSS 7.8 C:H/I:H/A:H impact reflects credible potential for local privilege escalation or kernel crash on AMD GPU-equipped Linux systems.
Divide-by-zero panic in the Linux kernel's AMD display driver (drm/amd/display) allows a low-privileged local user to crash the kernel by triggering a zero-area viewport condition in the calculate_mcache_setting function. The vulnerable code path exits early with num_mcaches == 0 and mvmpg_width/height == 0, then proceeds to divide by those zero values, causing both a divide-by-zero panic and potential integer underflow on num_mcaches. EPSS is very low at 0.15% (5th percentile) and no active exploitation or public exploit code has been identified at time of analysis; however, the local trigger mechanism via display mode setting is accessible to low-privileged users on systems with AMD GPU hardware.
The BPF verifier in the Linux kernel incorrectly accepts constant negative offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF pointer accesses, enabling a local attacker with BPF program loading privileges to perform out-of-bounds kernel memory reads and writes by bypassing the boundary enforcement in __check_buffer_access(). The regression was introduced when commit 022ac0750883 moved constant pointer offsets from reg->off to reg->var_off without updating the corresponding validation logic, leaving a signedness blind spot that allows programs with negative var_off values to load and attach to raw tracepoints undetected. No public exploit code has been identified at time of analysis and the vulnerability is absent from the CISA KEV catalog, but the well-documented commit trail makes independent derivation feasible for a skilled kernel researcher.
Inconsistent arvif state management in the Linux kernel's ath12k Qualcomm WiFi 7 driver exposes local low-privileged users to kernel memory corruption, information disclosure, and system crash via stale pointer dereference. Three distinct error paths in ath12k_mac_vdev_create() fail to clear or properly unwind arvif->ar and associated vdev/peer state, leaving the driver operating against ghost structures never confirmed in firmware. No public exploit identified at time of analysis, and EPSS probability sits at 0.15% (5th percentile), reflecting low near-term exploitation likelihood despite the 7.8 CVSS score.
Heap out-of-bounds write in the Linux kernel amdgpu DRM driver's `amdgpu_coredump()` function allows a local attacker with GPU access to corrupt kernel heap memory during a GPU reset event. The vulnerability affects Linux kernel versions containing commit eea85914d15b up to the fix commits, specifically Linux 7.1 stable and prior, on systems with AMD GPU hardware. A local user who can trigger or time a GPU ring timeout during an active GPU reset could exploit this heap corruption for potential privilege escalation; however, no public exploit exists and EPSS probability is 0.15% (5th percentile), indicating limited real-world exploitation activity at time of analysis.
Local privilege escalation in the Linux kernel's BPF arena subsystem arises from zap_pages() invoking zap_vma_range() without first acquiring the owning mm's mmap_lock, creating a lock-ordering race condition against arena_vm_close() and arena_map_mmap(), both of which acquire mmap_write_lock before arena->lock in reverse order. A low-privileged local user capable of loading BPF programs on affected Linux 6.9+ systems can exploit this AB-BA deadlock opportunity or operate on stale VMA pointers after concurrent unmapping, potentially corrupting kernel memory and escalating privileges. No public exploit code has been identified at time of analysis, and EPSS scores place current exploitation probability at a low 0.15%.
Use-after-free in the Linux kernel's netfilter conntrack timeout subsystem (nf_ct_timeout) allows a local low-privileged attacker to corrupt kernel memory by exploiting improper reference counting between the data plane and control plane lifecycle of timeout policy objects. Affected versions span from Linux 3.4 through pre-7.1.5/7.2-rc1, covering a very wide range of deployments wherever custom conntrack timeout policies are active. No public exploit code has been identified and EPSS sits at 0.15% (5th percentile), but the local high-impact profile (C:H/I:H/A:H) and the ubiquity of the Linux kernel make patching a clear priority for affected configurations.
Race condition in the kernfs xattr subsystem of Linux kernel 7.1 and earlier allows local low-privileged users to corrupt shared xattr structures across multiple superblocks, resulting in high-impact confidentiality, integrity, and availability compromise. The flaw arises specifically in namespace-multiplexed environments where kernfs_test_super() allows distinct superblocks to share a single kernfs_node while VFS locking remains per-inode and therefore insufficient. No public exploit has been identified at time of analysis; EPSS probability is 0.15% (5th percentile), indicating that despite the high CVSS score, widespread exploitation is currently assessed as unlikely.
Race condition exploitation in the Linux kernel's RDMA/nldev subsystem allows a local low-privileged attacker to trigger a use-after-free or stale pointer dereference via racy access to the mr->pd pointer during concurrent rereg_mr and nldev introspection operations, with potential for kernel memory corruption yielding high confidentiality, integrity, and availability impact. The flaw affects Linux 4.18 and later on any system with RDMA-capable hardware, with upstream fixes committed to stable branches at 7.1.5 and 7.2-rc1. No public exploit code exists and EPSS exploitation probability is very low at 0.15%, consistent with the specialized hardware requirement and race timing dependency.
Linux kernel ixgbe driver on Intel E610 adapters triggers a KASAN slab-out-of-bounds write when an XDP program is loaded on hosts with 64 or more logical CPUs. The root cause is a queue-count mismatch: MSI-X constraints cap the netdev at 63 queue pairs on E610, but XDP allocates 64 queues on ≥64-CPU systems, causing netif_set_xps_queue() to write 4 bytes beyond the allocated slab at queue index 63. With EPSS at 0.15% (5th percentile), no KEV listing, and hardware-specific trigger conditions, real-world exploitation is low-probability but not negligible in high-CPU-count data center environments running this Intel hardware.
Use-after-free in the Linux kernel's IPv4 Forwarding Information Base (FIB) subsystem enables a local low-privileged attacker to corrupt kernel memory, potentially escalating to root. The flaw manifests in fib_leaf_notify() when network device driver callbacks - mlxsw, rocker, and nsim - invoke refcount_inc() on a dying fib_info object under RCU, violating reference-counting safety and triggering the 'addition on 0; use-after-free' kernel warning confirmed by syzbot. Patches are available in Linux 7.1.5 stable and 7.2-rc1; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds memory access in the Linux kernel PCI ROM parsing subsystem crashes or leaks kernel memory on both x86_64 and arm64 architectures. The `pci_get_rom_size()` function fails to validate ROM image header and PCI data structure pointer bounds before dereferencing them, allowing a crafted or malformed PCI ROM space to induce a kernel page fault (x86_64) or alignment fault (arm64). Any local actor able to trigger a PCI ROM sysfs read against a device with a broken ROM region can crash the kernel (DoS) or expose kernel memory contents (information disclosure). EPSS is 0.21% with no KEV listing, indicating no confirmed broad exploitation, though the local crash path is straightforwardly reproducible as demonstrated by stress-ng.
Unauthenticated SQL injection in the Object Sync for Salesforce WordPress plugin exposes any site running the plugin to full database read access via its publicly accessible REST push endpoint. The vulnerable route `/wp-json/object-sync-for-salesforce/push/` imposes no capability check or nonce validation, and the `wordpress_object_type` parameter is concatenated directly into a raw SQL query without `$wpdb->prepare()` parameterization, enabling time-based blind injection. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication and only a valid post ID, making exploitation trivially accessible to any remote attacker with network reach to the target.
Uncontrolled resource consumption in @fastify/multipart (versions 5.3.0 through 10.1.0) allows any unauthenticated remote client to permanently leak temporary files on disk and suspend Fastify request handler executions, ultimately exhausting both disk space and the Node.js event loop. The root defect is a state-management flaw: when busboy's fileSize limit truncates an incoming file part, the plugin prematurely clears its internal stream reference, so a subsequent client-initiated abort finds nothing to clean up, leaving saveRequestFiles() awaiting a settlement that never arrives. No public exploit code has been identified at the time of analysis, but the attack is trivially repeatable with standard HTTP tooling, making this a realistic denial-of-service risk for any service that accepts multipart file uploads from untrusted clients.
Disk exhaustion via orphaned temporary files in @fastify/multipart versions 3.0.0 through 10.1.0 allows unauthenticated remote clients to cause persistent denial of service against Fastify applications that use the `request.saveRequestFiles()` API. The defect is an incomplete fix of CVE-2025-24033: while the per-file cleanup path was previously patched, the iterator rejection raised between multipart parts falls outside that cleanup scope, leaving already-completed temporary files permanently on disk. Repeated client disconnections mid-upload cause linear, unbounded disk consumption that can exhaust storage and render the host or container unavailable. No public exploit identified at time of analysis, but the attack is trivially automatable given the unauthenticated, low-complexity network vector.
Unbounded memory consumption in Apache Struts allows a single unauthenticated HTTP request to exhaust JVM heap and deny service to all concurrent users on applications that expose a Content Security Policy violation report collection endpoint. Affected versions span the 6.0.0-6.10.0 and 7.0.0-7.2.1 release branches; applications that have not implemented a custom CSP report endpoint are unaffected regardless of Struts version. No public exploit code has been identified and EPSS places current exploitation probability at 0.23% (14th percentile), though the trivial, unauthenticated attack path means any exposed endpoint represents a reliable, low-effort denial-of-service target.
Connection limit bypass in the Linux kernel's netfilter nf_conncount subsystem allows network-reachable attackers to exhaust host resources by exploiting incorrect zone direction bitmask handling in tuple deduplication. The bug in __nf_conncount_add() conflates the u8 zone direction bitmask (NF_CT_ZONE_DIR_ORIG=1, NF_CT_ZONE_DIR_REPL=2, NF_CT_DEFAULT_ZONE_DIR=3) with the ip_conntrack_dir enum (IP_CT_DIR_ORIGINAL=0, IP_CT_DIR_REPLY=1), causing non-default directional zones to be erroneously treated as equivalent and bypassing per-connection counting. No active exploitation is confirmed (EPSS 0.22%, 13th percentile); upstream fixes have been committed across multiple stable kernel branches.
Request storm vulnerability in the Linux kernel's batman-adv mesh networking subsystem (B.A.T.M.A.N. Advanced) exposes nodes to availability degradation through an inverted boolean condition in batadv_send_tt_request(). When a send buffer allocation fails, an incorrect check (ret == true instead of ret == false) causes the tt_req_node tracking structure to be retained rather than cleaned up, breaking the de-duplication mechanism that prevents simultaneous TT requests to the same originator. The result is that repeated, redundant translation table requests can flood a mesh peer - a request storm - degrading availability of nodes on the batman-adv overlay. No public exploit code exists and EPSS exploitation probability is very low (0.22%, 13th percentile); no active exploitation is confirmed.
Netfilter connection-count logic in the Linux kernel falsely drops legitimate TCP connections on systems using xt_connlimit or nft_connlimit in soft-limiting mode, across multiple stable branches from 5.10.248 through 6.18.39. The regression, introduced by commit 69894e5b4c5e, causes the active connection count to drop to zero when a new connection reuses a TIME_WAIT socket, after which xt_connlimit misinterprets the zeroed count and rejects valid sessions. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the condition can be triggered by ordinary connection-cycling traffic without authentication.
Permanent network connectivity loss on Marvell MPIC platforms (Armada 370/XP/38x) results from the mvneta driver failing to re-enable its per-CPU interrupt after a suspend/resume cycle when a NAPI poll was in-flight at suspend time. The race leaves the MPIC per-CPU interrupt masked indefinitely post-resume: the NIC generates interrupts that the CPU never receives, causing a complete outage until reboot. No public exploit exists (EPSS 0.22%, 13th percentile) and the vulnerability is absent from CISA KEV; patches have been released across eight Linux stable branches.
Incorrect error code propagation in the Linux kernel's AFS (Andrew File System) subsystem allows a remote attacker capable of influencing AFS Volume Location server responses to trigger incorrect error handling in `afs_extract_vl_addrs()`, potentially causing availability impact on affected kernels. Systems running AFS-enabled Linux kernels from version 4.20 through the unpatched stable branches are affected, with all known impact limited to availability (C:N/I:N in CVSS). No public exploit code exists and this vulnerability is not listed in CISA KEV; EPSS probability is 0.22%, consistent with low current exploitation interest.
Denial of service in the Linux kernel AFS filesystem client can be triggered by remote attackers sending crafted rxrpc callback notification messages, exploiting a bug where afs_extract_data() inadvertently converts -EAGAIN return values to 0 in callback service message parsers. Systems actively mounting AFS volumes are affected across multiple stable kernel branches prior to patch releases 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code exists and EPSS exploitation probability is low at 0.22%, though the unauthenticated network attack vector yields a CVSS 7.5 base score reflecting the potential to crash or destabilize the AFS subsystem on affected hosts.
Tegra GPC DMA driver in the Linux kernel hangs when a client submits a transfer whose length is not evenly divisible by the channel's configured maximum burst size, resulting in a partial-burst stall that freezes the DMA channel indefinitely. The defect is confirmed in production via the PL011 UART TX DMA path on NVIDIA Tegra SoC hardware and affects kernel branches from the introducing commit ee17028009d4 through fixed stable releases spanning 6.1, 6.6, 6.12, 6.18, and 7.1 series. No public exploit code exists and no active exploitation is confirmed; EPSS of 0.21% (12th percentile) reflects the extremely low real-world exploitation probability, consistent with a hardware-specific driver defect rather than a broadly exploitable software flaw.
Resource exhaustion in the Linux kernel's xprtrdma (RDMA transport for NFS/RPC) subsystem allows a malicious or compromised RDMA peer to trigger unbounded Receive Work Request allocation, causing denial of service on affected systems. The flaw exists in rpcrdma_reply_handler(), where the credit clamp is bypassed for replies matching no pending request (unknown XID), and rpcrdma_post_recvs() then allocates WRs past re_max_requests without bound. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), reflecting the niche RDMA deployment context. Patches are available across multiple stable kernel branches.
Receive queue exhaustion in the Linux kernel's xprtrdma subsystem allows a remote RPC/RDMA peer to stall NFS-over-RDMA client transports by sending a sustained stream of malformed replies. Each reply that is shorter than the fixed RPC/RDMA transport header or carries an unrecognized protocol version drains one posted Receive Work Request without replacement, because two early-exit paths in rpcrdma_reply_handler() return without calling rpcrdma_post_recvs(). Once the queue empties, the transport stalls until reconnect - a targeted denial-of-service with no public exploit or CISA KEV listing and a very low EPSS score of 0.21% (12th percentile).
Privilege escalation in the Real Estate Manager Pro WordPress plugin (all versions ≤ 12.8.6) allows authenticated Subscriber-level users to seize full Administrator control of a WordPress site. The flaw in `allow_attachment_actions()` confuses WordPress user IDs with media attachment IDs during capability checks, enabling a low-privileged user to edit an administrator account when those integer IDs collide. No confirmed active exploitation (CISA KEV) has been recorded, but the Subscriber-level access bar makes this a practical threat on any multi-user WordPress installation where the plugin is deployed.
TIPC connection send-side denial of service in the Linux kernel allows a remote TIPC peer to permanently wedge a connection by sending a crafted CONN_ACK message with an inflated acknowledgment count. When the peer-supplied count exceeds the unsigned 16-bit snt_unacked counter in tipc_sk_conn_proto_rcv(), integer underflow wraps the counter to a near-maximum value, causing tsk_conn_cong() to report congestion indefinitely and blocking all further transmits on that connection. This affects Linux kernels from the commit that introduced TIPC connection ack handling (around 4.7) through multiple stable branches prior to the backported fixes. No public exploit has been identified and EPSS is 0.21% (12th percentile), indicating low opportunistic risk despite the AV:N CVSS rating.
NULL pointer dereference in the Linux kernel's TCP/IPv6 stack crashes the kernel when a system with a large-MTU interface processes oversized TCP segments whose GSO size collides with the GSO_BY_FRAGS magic value (0xFFFF). Systems running Linux kernel from commit 3953c46c onwards with jumbo-frame or high-MTU IPv6 interfaces are affected across multiple stable branches up to and including 7.1.4. A remote, unauthenticated attacker capable of establishing a TCP/IPv6 session with a vulnerable host can induce a kernel panic, causing a full denial of service. No public exploit code has been identified at time of analysis, and EPSS probability is very low (0.21%, 12th percentile).
NULL pointer dereference in the Linux kernel netfilter nft_fib subsystem crashes the kernel when a FIB expression is placed in a netdev egress base chain, enabling denial of service against any system carrying that configuration. The root cause is a hook namespace collision where NF_NETDEV_EGRESS aliases NF_INET_LOCAL_IN numerically, causing nft_fib_validate() to incorrectly approve egress chain placement and then dereference nft_in(pkt) - which is NULL on the transmit path. No public exploit exists and EPSS is 0.21% (11th percentile), but systems running custom nftables egress FIB rules are at immediate kernel crash risk until patched.
Null pointer dereference in the Linux kernel's netfilter SIP connection tracking helper (nf_conntrack_sip) can crash the kernel when the non-default sip_external_media=1 module parameter is active and SIP traffic traverses tc ingress or OpenVSwitch paths. Successful exploitation causes a complete availability loss (kernel panic/crash), satisfying the CVSS A:H rating. No public exploit code has been identified and EPSS sits at the 11th percentile, indicating low observed exploitation activity despite the high base score.
NULL pointer dereference in the Linux kernel's SELinux `selinux_sctp_bind_connect()` hook crashes affected systems when SCTP ASCONF chunks are processed via the softirq path, where no file reference guarantees `sk->sk_socket` is non-NULL. Systems running Linux kernel 4.17 through current mainline with SELinux enforcing and SCTP active are vulnerable; patched stable releases exist at 6.12.97, 6.6.148, 6.18.40, 7.1.5, and 7.2-rc3. No public exploit has been identified and EPSS sits at 0.21%, but the unauthenticated network-reachable attack path warrants prompt patching on SCTP-exposed infrastructure.
Denial-of-service in the Linux kernel's AFS (Andrew File System) client allows a remote attacker to crash the kernel by triggering a NULL pointer dereference in `afs_break_some_callbacks()`. The flaw exists because `afs_lookup_volume_rcu()` can return NULL when a referenced volume is unknown, and this return value is used without a NULL check. No public exploit code exists and EPSS sits at 0.21%, though the official CVSS scores it 7.5 (High) due to a network attack vector with no authentication required.
Credit resource leak in the Linux kernel CIFS client function cifs_issue_read() enables a server-side actor to exhaust the SMB flow-control credit pool on a connected Linux host, producing a denial of service for all I/O on the affected CIFS mount. Linux kernel versions from commit 69c3c023af25edb5433a2db824d3e7cc328f0183 onward are affected until stable-tree patches landing in 6.12.97, 6.18.40, 7.1.5, and 7.2-rc2. No public exploit identified at time of analysis; EPSS of 0.21% (11th percentile) confirms very low real-world exploitation probability and no CISA KEV listing exists.
Denial of service in the Linux kernel's kernel TLS (kTLS) subsystem allows a remote peer to permanently stall a TLS connection by sending a single zero-length TLS 1.3 application_data record. The `tls_sw_read_sock()` function misinterprets the empty record's zero-length return as a backpressure signal, requeuing the record indefinitely at the head of rx_list and blocking all subsequent TLS data on that connection. No public exploit code exists, the CVE is absent from the CISA KEV catalog, and EPSS sits at 0.21% (11th percentile), indicating low current exploitation interest despite the 7.5 CVSS score.
Permanent I2C bus lockup in the Linux kernel i2c-imx driver (NXP i.MX SoCs) occurs when an SMBus block-read response returns a byte count of 0, a condition explicitly permitted by SMBus 3.1 specification section 6.5.7. The interrupt-driven state machine introduced in the v6.13 rework rejects count=0 with -EPROTO but critically fails to issue NACK+STOP before returning, leaving the target device holding SDA and the entire I2C bus permanently stuck until the controller is power-cycled. A secondary bug on the count > I2C_SMBUS_BLOCK_MAX error path exhibits the same failure mode. No public exploit or active exploitation is identified; vendor-released patches are available in kernel versions 6.18.40, 7.1.5, and 7.2-rc4.
Unbounded kernel memory exhaustion in the Linux kernel TIPC subsystem allows a malicious peer node to cause a denial-of-service condition by sending PUBLICATION messages with inverted service-range bounds (lower > upper). Kernels from version 4.17 onward accept these malformed bindings in the name-distribution network receive path - unlike the local bind path, which enforces ordering via tipc_uaddr_valid() - causing service_range rbtree entries and associated publication structures to be permanently leaked with no per-peer cap, for the lifetime of the namespace. No public exploit or CISA KEV listing exists, and EPSS is very low (0.21%, 11th percentile), but the attack is mechanically straightforward for any attacker already operating as a TIPC peer.
Deadlock in the Linux kernel NTFS driver allows local users with write access to an NTFS-mounted volume to render the system completely unresponsive by triggering an ABBA lock ordering race between concurrent VFS writeback paths. The vulnerability affects kernels since commit 6994acf33bae and manifests when inode writeback (acquiring extent_lock then mrec_lock) races with MFT folio writeback (holding mrec_lock while attempting extent_lock). No active exploitation has been confirmed - EPSS places this at the 10th percentile (0.20%) - reflecting the narrow real-world surface: production Linux systems rarely mount NTFS volumes. Patches are available in Linux 7.1.5 and 7.2-rc1.
Indefinite thread blocking in the Linux kernel's NTFS driver can cause a local denial of service on systems mounting NTFS volumes under memory pressure. Specifically, `get_nr_free_clusters()` and `__get_nr_free_mft_records()` allocate heap memory for a readahead state structure; if that allocation fails, neither `NVolFreeClusterKnown()` is set nor `vol->free_waitq` is woken, leaving any waiting kernel thread blocked indefinitely. Kernels prior to 7.1.5 and 7.2-rc1 are affected; no public exploit has been identified and EPSS is 0.20% (10th percentile).
Unbounded locale cache growth in Apache Struts allows unauthenticated remote attackers to exhaust JVM heap memory and deny service to all users of the application. The vulnerability spans an exceptionally wide version range - from 2.0.0 through 7.2.1 across four release branches - and is exploitable only when no fixed locale is configured, a condition common in multilingual deployments. No public exploit has been identified at time of analysis, and EPSS at 0.19% (9th percentile) reflects low observed exploitation activity; however, the network vector with zero prerequisites on vulnerable configurations makes this a meaningful DoS risk in exposed environments.
Resource leak and potential mutex deadlock in the Linux kernel's RDMA/mlx5 driver (UMR XLT cleanup path) enables denial-of-service conditions on systems using Mellanox/NVIDIA ConnectX RDMA adapters. The vulnerability exists from commit 1efe8c0670d6a6883faa09c9abc746c741f5664a onward, including Linux 6.16, where a fallible error path in mlx5_odp_populate_xlt() skips the mandatory DMA buffer and XLT mapping cleanup performed by mlx5r_umr_unmap_free_xlt(), and if the emergency XLT page code path was taken, permanently locks xlt_emergency_page_mutex. EPSS is very low at 0.18% (8th percentile), no public exploit code exists, and the vulnerability is not listed in CISA KEV, but RDMA-enabled HPC, storage, and financial infrastructure running affected kernel versions should prioritize patching.
Invalid pointer dereference in the Linux kernel btrfs delayed reference processing loop (`__btrfs_run_delayed_refs()`) allows a local attacker with access to a btrfs-mounted volume to crash the kernel, causing a denial of service. The defect was introduced by a refactoring commit (0110a4c43451) that inadvertently removed safety guards which reset an internal pointer to NULL when `btrfs_select_ref_head()` returns `ERR_PTR(-EAGAIN)`, causing a subsequent `spin_lock()` call on the error code value treated as a pointer address. No public exploit code has been identified and EPSS probability is 0.18% (7th percentile), though patches are available across all active stable kernel branches.
Unbounded recursion in the Linux kernel's slab allocator free path can crash the kernel when memory allocation profiling or cgroup memory accounting is active. Specific size relationships between KMALLOC_NORMAL caches cause circular obj_exts array dependencies - for example, kmalloc-512 and kmalloc-1k each hold the other's obj_exts array - so freeing one slab triggers a chain of recursive kfree/discard_slab calls that exhausts the kernel task stack. This was confirmed to cause production kernel stack overflows at Meta's infrastructure (approximately 125 recursive frames observed) and is fixed in Linux 6.12.103, 6.18.44, and 7.1.8; no public exploit code exists and exploitation probability is very low (EPSS 0.18%).
Un-rate-limited ICMP and NDISC Redirect packet storms are possible in the Linux kernel when peer entry allocation fails inside `inet_getpeer_v4()` or `inet_getpeer_v6()`, affecting all kernels from 2.6.39 through the fixed stable releases. A remote unauthenticated attacker who can trigger peer table exhaustion against a Linux system acting as a network forwarder can cause the kernel to emit unbounded ICMP/NDISC Redirect messages, producing severe network availability degradation. No public exploit or proof-of-concept is identified at time of analysis, and EPSS sits at 0.17%, but the no-authentication CVSS profile warrants prompt patching on any Linux routing infrastructure.