Improper re-initialization of the AFS inode's work_struct (`lock_work`) in the Linux kernel allows a low-privileged local user to trigger a kernel-level bug during file locking operations on AFS-mounted filesystems, potentially causing a kernel crash or enabling privilege escalation. The vulnerability affects Linux kernels from v2.6.23 (commit e8d6c554126b) through all stable branches prior to 6.18.40 and 7.1.5. No public exploit code exists and no active exploitation has been reported; EPSS is 0.21% (11th percentile), consistent with a kernel bug requiring specific subsystem use.
Context confusion in the Linux kernel's uprobes/x86 subsystem allows a local attacker with low privileges to trigger incorrect VMA lookups by exploiting the use of `current->mm` (the tracer's memory map) instead of the traced process's `mm_struct` during uprobe unregistration. Affected are kernel versions in the 6.18.x, 7.1.x, and pre-rc2 7.2 branches originating from commit ba2bfc97b462. Patches are confirmed in 6.18.40, 7.1.5, and 7.2-rc2; no public exploit code has been identified and the vulnerability is not listed in CISA KEV, with EPSS at a low 0.21% (11th percentile).
Use-after-free race condition in the Linux kernel's AMD XDNA accelerator driver (accel/amdxdna) allows a local, low-privileged attacker on systems with AMD XDNA hardware to corrupt kernel memory, potentially achieving full privilege escalation. The race window opens because amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove() before removing the object from abo->mem.umap_list, permitting aie2_populate_range() to obtain a stale reference concurrently. No public exploit has been identified at time of analysis, and an EPSS of 0.21% (11th percentile) signals minimal current exploitation interest.
Use-after-free in the Linux kernel Bluetooth management subsystem allows a low-privileged local attacker to corrupt kernel heap memory and achieve privilege escalation to root. Kernels from approximately 2.6.39 through unpatched revisions of the 6.6.x, 6.12.x, 6.18.x, and 7.1.x stable series are vulnerable when Bluetooth hardware is present and the mgmt interface is accessible. No public exploit has been identified at time of analysis, and EPSS at 0.20% (10th percentile) reflects limited current exploitation probability, though UAF primitives in the Linux kernel are historically weaponized following public disclosure.
Incomplete error-path cleanup in the Linux kernel's dell-laptop platform driver exposes systems running Dell hardware to resource leak conditions that can be leveraged for privilege escalation by local low-privileged users. The dell_init() function fails to release the notifier, debugfs directory, keyboard backlight LED, and optional touchpad LED when a later initialization step fails, leaving dangling kernel object registrations. No active exploitation is confirmed (not in CISA KEV), and the EPSS score is very low at 0.20% (10th percentile), but the CVSS 3.1 score of 7.8 High with local-access C:H/I:H/A:H reflects the theoretical privilege escalation ceiling if the dangling resources are abused post-init.
Null pointer dereference in the Linux kernel's fhandle subsystem allows a local low-privileged user to trigger a kernel panic via a race condition in capable_wrt_mount(). The vulnerable path is reached when open_by_handle_at() processes a file handle whose detached mount - created via open_tree(OPEN_TREE_CLONE) - is concurrently dissolved by fput(), causing umount_tree() to clear mount->mnt_ns to NULL before capable_wrt_mount() can safely dereference mnt_ns->user_ns. No public exploit identified at time of analysis (EPSS 0.20%, no CISA KEV listing), and patched kernel versions 6.12.97, 6.18.40, 7.1.5, and 7.2-rc2 are available from upstream stable trees.
Out-of-bounds write in the Linux kernel's dibs loopback subsystem enables a local low-privileged attacker to corrupt kernel memory by supplying a crafted offset or oversized write through the move_data() interface, which calls memcpy() without verifying that offset + size stays within the registered DMB's allocated length. The software loopback omits the memory-region bounds enforcement that real ISM hardware provides natively, leaving peer-supplied parameters unchecked. Patch commits are confirmed across four stable kernel branches (6.12.97, 6.18.40, 7.1.5, 7.2-rc3); the vulnerability is not in CISA KEV and no public exploit code has been identified at time of analysis.
Use-after-free race condition in the Linux kernel's osnoise tracing subsystem allows a local low-privileged attacker to potentially escalate privileges or destabilize the kernel. The flaw, present in kernels since commit a6ed2aee (Linux 5.17), stems from missing synchronize_rcu() synchronization during osnoise instance unregistration, leaving a window where RCU readers can dereference freed tracer memory. Patched stable releases (6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2-rc3) are available; no public exploit code and no CISA KEV listing have been identified at time of analysis.
The legacy NTFS driver in the Linux kernel fails to reject non-resident attribute records for attribute types contractually required to be resident, creating resident/non-resident union confusion paths in multiple critical code locations. Affected callers - including inode loading ($STANDARD_INFORMATION), volume flag updates ($VOLUME_INFORMATION), and directory traversal ($INDEX_ROOT) - read data.resident.value_offset directly without first verifying the a->non_resident flag, potentially acting on the wrong union member when a crafted or corrupted NTFS image is mounted. A local attacker with standard user privileges can exploit this to trigger kernel memory corruption or information disclosure; no active exploitation is confirmed (EPSS 0.20%, not in CISA KEV), and patches are available in Linux 7.1.5 and 7.2-rc1.
Data corruption in the Linux kernel's spi-imx driver causes SPI bus transfers to produce malformed data when DMA initialization fails and the driver incorrectly falls back to PIO mode without resetting the ECSPI hardware configuration. Systems running NXP i.MX SoCs with ECSPI DMA declared in the device tree but without the sdma-imx7d.bin SDMA firmware are deterministically and silently affected on every transfer. Downstream security-critical devices connected to the affected SPI bus - such as the Infineon SLB9670 TPM - receive corrupted responses that can prevent device initialization entirely, eliminating TPM-based security services; no public exploit has been identified at time of analysis.
Use-after-free of freed executable memory in the Linux kernel's io_uring/bpf-ops subsystem allows a local attacker with CAP_BPF and CAP_PERFMON capabilities to achieve arbitrary kernel code execution by registering the same io_uring_bpf_ops struct_ops map against multiple io_ring_ctx instances in sequence. The missing re-registration guard on ops->priv causes the first io_ring_ctx to be orphaned with a dangling ctx->loop_step function pointer into a freed BPF trampoline, which is invoked when io_uring_enter() is later called on that ring. No public exploit has been identified at time of analysis, and EPSS at 0.20% reflects low near-term mass-exploitation probability, though the primitive - controlled call into freed executable memory - is a classic kernel privilege escalation building block.
Client pointer confusion in the Linux kernel's amdxdna DRM accelerator driver allows a local low-privileged user to trigger cross-process access to another process's hardware context and debug buffer objects via a misrouted SYNC_DIRECT_FROM_DEVICE ioctl. Systems running AMD XDNA NPU hardware (such as AMD Ryzen AI series processors) with the amdxdna kernel module loaded are affected across kernel versions from the driver's introduction up to the patched releases in 7.1.5 and 7.2-rc1. No public exploit exists and the EPSS score of 0.20% (10th percentile) reflects low near-term exploitation probability, though the CVSS 7.8 score correctly captures the high CIA impact should exploitation succeed.
Reference count underflow in the Linux kernel IPMI subsystem's handle_read_event_rsp() function enables local privilege escalation on server hardware with active IPMI interfaces. The flaw resides in the error-rollback path: when event delivery fails after successfully allocating receive messages for some users, the rollback incorrectly drops the user reference count twice - once through ipmi_free_recv_msg() and again through a now-stale explicit put - freeing an ipmi_user object that remains linked on intf->users. Subsequent event delivery then dereferences the freed object or trips refcount_t's addition-on-zero guard, enabling kernel memory corruption leading to full system compromise. No public exploit or CISA KEV listing exists; EPSS is 0.20% at the 10th percentile, consistent with no active exploitation at time of analysis.
Shared MIPI PHY resource mismanagement in the Linux kernel's NXP i.MX93 block-control power domain driver (imx93-blk-ctrl) allows a local attacker with low privileges to trigger kernel-level incorrect behavior - including potential memory corruption, information disclosure, and system instability - by exploiting the fact that the DSI and CSI subdomains share clock and reset control bits without coordination. Patches are available across stable branches (6.18.42, 7.1.5, 7.2-rc4), and exploitation probability is low per EPSS (0.20%, 10th percentile). No public exploit or CISA KEV listing has been identified at time of analysis.
Refcount tracking race in the Linux kernel's network watchdog subsystem enables a local low-privilege user to crash the kernel via list corruption. The flaw originates from a commit that introduced `dev->watchdog_dev_tracker` to store reference tracking state without adding synchronization between `netdev_watchdog_up()` and the `dev_watchdog()` timer, allowing the pointer to be concurrently overwritten or freed. The observable outcome is a `list_del` corruption BUG followed by a kernel Oops, confirmed by syzbot; no public exploit exists and the vulnerability is not in CISA KEV, with EPSS at 0.20% (10th percentile). Patches are available in stable kernel releases.
Kernel panic in Linux CoreSight platform driver exposes ARM systems to local denial-of-service via a NULL pointer dereference on the error cleanup path. The counter tracking output and input connections is incremented before confirming that the backing allocation succeeded; when devm_krealloc_array() or devm_kmalloc() returns ENOMEM, the cleanup routine coresight_release_platform_data() walks the inflated counter and dereferences the resulting NULL or uninitialized garbage pointer, panicking instead of returning gracefully. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), and the absence of KEV listing reflects low observed exploitation. Vendor-released patches are available in Linux 7.1.5 (stable) and 7.2-rc1 (mainline).
Use-after-free in the Linux kernel mxl862xx DSA driver exposes systems running MaxLinear MXL862xx Ethernet switches to local privilege escalation via kernel heap corruption. The race condition between the MDIO CRC error work handler and driver teardown allows freed dsa_port objects to be dereferenced if a CRC error is scheduled during the narrow window between MXL862XX_FLAG_WORK_STOPPED being set and dsa_unregister_switch() completing. EPSS is 0.20% (10th percentile) with no CISA KEV listing, reflecting niche hardware dependency and low broad exploitation interest.
Use-after-free in the Linux kernel's TIPC UDP media bearer teardown path allows a local low-privileged user to trigger a kernel memory corruption by racing bearer cleanup against concurrent UDP transmission or reception. The function cleanup_bearer() calls dst_cache_destroy() - which immediately frees per-CPU cache memory - before calling synchronize_net() to drain RCU readers, leaving concurrent tipc_udp_xmit() and tipc_udp_recv() callers able to dereference freed memory. The fix is available in stable commits and kernel 7.1.5; no public exploit has been identified at time of analysis, and EPSS at the 10th percentile reflects the niche exploitability profile.
Double-unlock of an inode's rwsem in the Linux kernel cachefiles subsystem corrupts kernel locking state when start_creating() fails with ENOMEM during directory creation. Local attackers with low-privilege access on systems using network filesystem caching via cachefiles can exploit the corrupted rwsem to achieve privilege escalation or kernel crash, reflecting the high CIA impact in the CVSS 7.8 score. No public exploit has been identified and EPSS is very low (0.20%, 10th percentile), but upstream patches are confirmed available via the kernel stable tree.
Invalid cursor access in the Linux kernel's Intel Xe GPU (drm/xe) page table subsystem allows local low-privileged users to trigger kernel warnings and potentially exploit uninitialized memory during page table binding walks involving purged buffer objects. Affected kernel versions span Linux 7.1 up to the fix points in 7.1.5 and 7.2-rc2, and only systems equipped with Intel Xe GPU hardware are at risk. No public exploit identified at time of analysis; EPSS at 0.20% (10th percentile) reflects minimal current exploitation interest, though the kernel memory-management context elevates the theoretical impact ceiling.
Off-by-one memory corruption in the Linux kernel's mlx5 LAG (Link Aggregation) subsystem exposes systems with Mellanox/NVIDIA ConnectX NICs to local privilege escalation via a defective error rollback loop in `mlx5_lag_create_single_fdb()`. When rule installation fails at index `i`, the cleanup loop incorrectly begins teardown at `i` rather than `i-1`, operating on uninitialized kernel state or double-freeing a rule the `add_one` path already rolled back - resulting in heap corruption with C:H/I:H/A:H impact potential. No public exploit or CISA KEV listing exists at time of analysis; EPSS probability stands at 0.20% (10th percentile), and upstream fix commits are confirmed available.
Kernel crash via bad memory access in the mlx5e traffic control peer flow cleanup path affects Linux systems running Mellanox/NVIDIA mlx5 NICs in LAG (Link Aggregation Group) mode. When mlx5_lag_get_dev_seq() returns an error during device teardown - because the peer is absent from the LAG or no master device is marked - the driver proceeds to dereference an invalid pointer in mlx5e_tc_del_fdb_peers_flow, causing a kernel panic. No public exploit exists and EPSS is 0.20% (10th percentile), but the crash is deterministically reproducible on affected hardware configurations during device removal or driver teardown sequences.
Use-after-free in the Linux kernel's accel/amdxdna driver exposes systems with AMD XDna NPU hardware to local privilege escalation by a low-privileged attacker. The race condition exists between `aie2_populate_range()` and `amdxdna_umap_release()`, both of which dereference a stale VMA pointer after the underlying virtual memory area may have been freed by the kernel memory manager. With EPSS at 0.20% (10th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, active exploitation is not currently observed - though the CVSS 7.8 score correctly reflects the theoretical potential for full kernel compromise on affected hardware configurations.
Linux kernel SMB/CIFS client exposes a race condition between direct I/O (DIO) write completion and filesystem unmount that leaves dentry reference counts unreleased, triggering a kernel BUG warning and potential use-after-free condition. Local users with access to CIFS-mounted shares can trigger this by initiating a DIO write and concurrently unmounting the filesystem, allowing the kernel's shrink_dcache_for_umount() to fire before deferred workqueue cleanup has decremented the dentry refcount. With CVSS 7.8 and C:H/I:H/A:H, the theoretical impact is full kernel compromise, though no public exploit and an EPSS of 0.20% (10th percentile) indicate this remains a low-exploitation-probability vulnerability at time of analysis.
Missing payload size validation in the Linux kernel's ASoC SOF IPC4 control subsystem allows a local low-privileged attacker to trigger out-of-bounds memory access when the kernel processes MODULE_NOTIFICATION messages. Affected systems are those running Linux kernel 7.0 and related stable branches where the SOF IPC4 audio driver is active - typically Intel hardware using Sound Open Firmware. No public exploit or CISA KEV listing exists, and EPSS sits at 0.20% (10th percentile), indicating low current exploitation interest, though the CVSS 7.8 score reflects real kernel-level impact potential.
Improper state unwinding in the Linux kernel KVM nested VMX (nVMX) subsystem allows a low-privileged local attacker operating within an L1 guest to potentially escape the virtualization boundary and gain control over the host hypervisor's page table base register (CR3). When EPT is disabled and the deferred vTPR-vs-TPR Threshold consistency check fails, KVM does not restore vmcs01.GUEST_CR3 to its own value, leaving it set to an L1-controlled address - enabling a malicious guest to redirect hypervisor memory mappings to attacker-controlled structures. No public exploit has been identified and no CISA KEV listing exists; EPSS at 0.20% (10th percentile) confirms currently low observed exploitation probability.
Out-of-bounds kernel memory access in Linux KVM's Intel TDX subsystem allows a local, low-privileged user to exploit a TOCTOU race condition during TD virtual machine initialization, potentially achieving kernel memory disclosure, corruption, or denial of service. The vulnerable path exists in tdx_td_init(), where the cpuid.nent field is read once to size a flexible allocation and then again from the copied structure - allowing userspace to change the count between those two references. No active exploitation has been confirmed and EPSS probability is very low (0.20%, 10th percentile), limiting immediate real-world risk to TDX-enabled production environments.
Out-of-bounds kernel memory corruption in the QCOM USB audio ALSA driver (`sound/usb/qcom/`) allows a local unprivileged user to corrupt kernel slab memory or trigger a kernel oops by sending a crafted stream-disable request over AF_QIPCRTR. The disable path in `handle_uaudio_stream_req()` fails to guard against a negative index returned by `info_idx_from_ifnum()`, an invariant violation that the enable path already handles - resulting in a wild-pointer dereference when the card has never been enabled, or an out-of-bounds 4-byte slab write when it has. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low-complexity local exploit path on QCOM-equipped systems warrants prompt patching.
Heap buffer overflow in the Linux kernel's RDMA/rxe (Soft-RoCE) subsystem exposes local low-privileged users to a TOCTOU race condition in get_srq_wqe(), where a concurrent userspace thread can corrupt the num_sge field in a kernel-userspace shared SRQ buffer between its validation and use, bypassing bounds checks on the memcpy into qp->resp.srq_wqe. Affected kernels span from the rxe SRQ introduction at commit 8700e3e7c485 (circa Linux 4.8) through multiple stable branches, with fixes backported to 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit has been identified at time of analysis, and EPSS at 0.19% reflects limited real-world exploitation activity despite the 7.8 CVSS score.
Race condition in the Linux kernel's KCM (Kernel Connection Multiplexor) subsystem exposes systems to potential privilege escalation, memory corruption, and information disclosure when KCM sockets are in active use on multi-CPU systems. The kcm_attach() and kcm_unattach() functions modify live TCP socket callback pointers (sk_data_ready, sk_write_space) via plain stores rather than WRITE_ONCE(), violating the kernel's memory visibility contract and allowing a concurrent CPU to invoke a KCM handler against a mismatched sk_user_data pointer. No active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.19% (9th percentile), but vendor-supplied patches are available across all active stable kernel branches.
PowerPC E500 systems running Linux kernel 7.0 through 7.1.4 and 7.2-rc4 silently lose kernel address-masking protection due to a compile-time preprocessor symbol typo - `CONFIG_E500` instead of `CONFIG_PPC_E500` - causing `mask_user_address_isel()` to be omitted from E500 builds entirely. A local low-privileged user on affected E500 hardware can exploit the absent address-masking primitive to achieve high-impact memory disclosure, integrity corruption, or denial of service against the kernel. No public exploit exists, EPSS is 0.19% (9th percentile), and this vulnerability is not in CISA KEV, indicating very limited current exploitation activity despite a CVSS score of 7.8.
Netfilter's nf_dup_netdev component in the Linux kernel exposes a race condition in nft_dup and nft_fwd expressions where the absence of Bottom Half disabling during skb transmission permits CPU migration, causing imbalanced decrementation of xmit recursion counters. A locally authenticated low-privilege user who can influence netfilter packet processing paths may exploit this counter imbalance to escalate privileges or destabilize the kernel. No public exploit code has been identified at time of analysis, and EPSS probability sits at a low 0.19%, indicating limited current exploitation interest despite the high CVSS base score.
Missing access_ok bounds validation in the Linux kernel's BPF uprobe_multi subsystem exposes systems running affected kernel versions to local privilege escalation, kernel memory disclosure, and system crash. Low-privileged local users on systems within the vulnerable commit range - spanning Linux 6.6 and related stable branches - can submit crafted user-space pointers via uprobe_multi BPF configuration that the kernel reads using __get_user without prior bounds verification. No public exploit identified at time of analysis, and EPSS of 0.19% at the 9th percentile reflects low current exploitation activity, but the full C:H/I:H/A:H CVSS impact triad warrants prompt kernel patching on multi-tenant and shared-access systems.
Heap buffer overflow in the Linux kernel CCP driver's snp_filter_reserved_mem_regions() function enables a low-privileged local attacker to corrupt kernel memory on AMD SEV-SNP-enabled systems. The off-by-one error in the boundary check permits a 4-byte write past a PAGE_SIZE kzalloc buffer when 255 or more IOMEM reserved memory regions are present, yielding full High impact on confidentiality, integrity, and availability per CVSS 7.8. No public exploit has been identified and EPSS stands at 0.19% (8th percentile), indicating no current widespread exploitation activity despite the severity score.
Double-decrement of the descriptor_busy reference counter in the Linux kernel's GPIB driver re-introduces a use-after-free condition that a prior security patch (commit d1857f8296dc) was specifically designed to prevent. Affected kernels include the 6.18.22-6.18.39 range and Linux 7.0, with patched releases available at 6.18.40, 7.1.5, and 7.2-rc1. Exploitation requires a local low-privilege account and access to GPIB device nodes; no public exploit code has been identified at time of analysis, and the EPSS score of 0.19% reflects negligible observed exploitation activity.
Heap buffer overflow and potential kernel memory mass-zeroing in the Linux kernel drm/panthor GPU driver allow a local attacker to corrupt kernel heap structures or trigger catastrophic out-of-bounds writes by supplying a crafted firmware image to the Arm Mali Valhall (Panthor) DRM subsystem. The root cause is that panthor_fw_load_section_entry() computes section->data.size from raw firmware header fields without bounding it against the allocated section_size, allowing both a memcpy overflow and an unsigned integer underflow in a subsequent memset that could zero arbitrarily large kernel memory regions. No public exploit has been identified and EPSS is low at 0.18% (8th percentile), but the CVSS impact ratings of C:H/I:H/A:H reflect the realistic worst case of full kernel compromise on affected hardware.
Resource leak in Linux kernel AppArmor's aa_label_alloc() function exposes local attackers with low privileges to potential privilege escalation. When proxy allocation fails during label creation, the error path bypasses aa_label_free(), leaving the security identifier (secid) and other label resources unreleased. No public exploit has been identified at time of analysis, and EPSS at 0.18% (8th percentile) reflects low near-term exploitation probability, though the C:H/I:H/A:H CVSS impact ratings signal meaningful consequence if exploited.
Double-free memory corruption in the Linux kernel's pinctrl/devicetree subsystem enables a local low-privileged attacker on systems running affected pinctrl drivers - such as pinctrl-imx on NXP iMX6 platforms - to corrupt kernel heap memory, with theoretical potential for local privilege escalation. The flaw resides in the error-cleanup path of `dt_remember_or_free_map()`: when `kstrdup_const()` fails mid-loop, `dt_free_map()` iterates over all map entries including those never initialized by the core, passing uninitialized `kmalloc()` data to `kfree_const()` - a KASAN-confirmed double-free. No public exploit identified at time of analysis; the EPSS score of 0.18% (8th percentile) reflects very low real-world exploitation probability despite the formal CVSS 7.8 rating.
Use-After-Free in the Linux kernel's mm/page_reporting subsystem triggers a General Protection Fault during PM suspend and hibernation on systems running virtio_balloon with page reporting enabled. When the PM freezer initiates a suspend or S4 hibernation cycle, the virtio_balloon driver tears down its virtqueues via del_vqs(), but page_reporting_process - scheduled on the non-freezable system_wq workqueue - remains active. If the buddy allocator frees pages during this window (e.g., the balloon shrinker runs during S4 image saving), the reporting worker calls virtballoon_free_page_report() on already-deleted virtqueues, causing kernel memory corruption. No public exploit has been identified at time of analysis; EPSS is 0.18% (8th percentile), reflecting minimal exploitation probability, though this is a confirmed kernel UAF with crash-level impact validated by Google in production virtualization infrastructure.
Out-of-bounds memory access in the Linux kernel's xilinx-ams IIO ADC driver allows a local low-privileged user to corrupt kernel memory through malformed event handling in ams_handle_event(). Affected versions span multiple stable kernel branches beginning with the commit that introduced the xilinx-ams driver, with the flaw present from Linux 5.17 onward across the 6.1, 6.6, 6.12, 6.18, and 7.1 stable series. No public exploit exists and EPSS sits at 0.18% (8th percentile), though vendor-released patches are confirmed across six stable branches and the CVSS 7.8 score reflects genuine kernel memory corruption potential on affected Xilinx hardware platforms.
Uninitialized kernel memory exposure in Linux kernel's flow_dissector subsystem allows a local low-privileged attacker to leak kernel memory contents by exploiting a missing device-type check in __skb_flow_dissect(). Affected are Linux kernel versions from 4.2 through stable branches prior to 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. An attacker who can create TUN devices and configure TC qdiscs reads 12 bytes of uninitialized skb memory through the flow dissector's Ethernet address extraction path, which then propagates into rhashtable lookups - a condition confirmed reported via KMSAN. No public exploit identified at time of analysis.
Buffer overflow and missing locking in the Linux kernel's sun4i-ss PRNG driver expose local low-privilege users on AllWinner sun4i SoC hardware to potential kernel memory corruption and privilege escalation. Two distinct flaws exist: sun4i_ss_prng_seed() lacks mutual exclusion and accepts input without bounds checking, while sun4i_ss_prng_generate() truncates output length and fails to synchronize with hardware before reading bytes, producing cryptographically unreliable output. No public exploit has been identified, EPSS sits at 0.18% (8th percentile), and the kernel maintainers resolved the issue by removing the entire dead code block rather than patching individual bugs.
Lockless directory traversal in the Linux kernel configfs subsystem allows a low-privileged local user to race concurrent lseek() operations against directory iteration, corrupting or dereferencing freed cursor objects in kernel memory. Affecting all Linux kernels from version 2.6.27 through multiple long-term stable branches (fixed in 7.1.5, 6.18.40, 6.12.97, 6.6.145, 6.1.178, 5.15.212, and 5.10.261), successful exploitation could yield full kernel privilege escalation with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and EPSS sits at 0.18% (7th percentile), indicating low near-term exploitation probability.
Out-of-bounds kernel memory access in the Linux kernel vhost/vdpa subsystem allows a local attacker with low privileges to crash the system or trigger invalid physical memory mappings via crafted mmap operations. The vhost_vdpa_mmap() and vhost_vdpa_fault() functions accept a user-controlled virtqueue index from vma->vm_pgoff without validating it against the driver's configured queue count (v->nvqs), while the ioctl path already enforces both a bounds check and array_index_nospec(). Patches are available across all active stable branches; EPSS is 0.18% (7th percentile) and the vulnerability is not listed in CISA KEV.
Undefined behavior from a signed integer overflow in the Linux kernel's RDMA/mlx5 driver exposes systems with Mellanox ConnectX RDMA hardware to local privilege escalation or kernel crash. The flaw in set_rq_size() accepts user-supplied rq_wqe_shift values up to and including 32, causing signed 32-bit integer overflow when computing '1 << rq_wqe_shift' - undefined behavior under the C standard that can corrupt kernel memory structures. The vulnerability carries a CVSS 7.8 High score but EPSS of just 0.18% (7th percentile) and is absent from CISA KEV, indicating no public exploit or active exploitation at time of analysis.
Input validation bypass in the Linux kernel's FSL audmix ASoC driver allows a local low-privileged user to write out-of-range enum values to ALSA mixer controls, triggering out-of-bounds memory access in kernel space with potential for privilege escalation or kernel memory disclosure. Specifically, fsl_audmix_put_mix_clk_src() uses an unvalidated value in a BIT() shift operation, and fsl_audmix_put_out_src() uses it to index the prms transition table, both before any bounds check is performed. No public exploit exists and EPSS is extremely low (0.18%, 7th percentile), but the CVSS score of 7.8 reflects the high kernel-level impact if exploited on hardware where the driver is active.
Concurrent use-after-free-adjacent race condition in the Linux kernel's FIB rules subsystem allows a local low-privileged user to trigger a kernel refcount complaint - and potentially a system crash or memory corruption - by racing a FIB rules dump against the teardown of a dying fib_rule object. Affected versions span multiple long-term stable branches from 4.12 onward through 7.x series kernels prior to the backported fix commits. No public exploit has been identified at time of analysis, and the EPSS score of 0.18% (7th percentile) reflects low exploitation probability; exploitation is not confirmed in the CISA KEV catalog.
Heap buffer overflow in the Linux kernel ntfs3 filesystem driver's log_replay() function allows a local authenticated user to corrupt kernel heap memory by mounting a dirty NTFS volume whose on-disk log page size exceeds the host PAGE_SIZE. The one_page_buf scratch buffer is allocated using the host page size but never resized when a larger on-disk page size is adopted from the restart area, causing read_log_page() to write beyond the allocation boundary. No public exploit code exists, EPSS is 0.18% (7th percentile), and this is not listed in the CISA KEV catalog, placing current exploitation probability very low despite a CVSS 7.8 base score.
Use-after-free and effective program array corruption in the Linux kernel's BPF cgroup subsystem allow a local attacker with BPF attachment privileges to escalate to root via kernel memory corruption. The flaw in replace_effective_prog() and purge_effective_progs() miscalculates array slot positions when BPF_F_PREORDER programs are present in a cgroup hierarchy, causing purge_effective_progs() to zero the wrong slot and call bpf_prog_put() while a stale reference to the freed program remains in the array. With CVSS 7.8, EPSS at 0.18% (7th percentile), and no CISA KEV listing or public exploit identified at time of analysis, real-world risk is modulated by the non-default precondition of BPF_F_PREORDER cgroup program usage.
Use-after-free in the Linux kernel's UDP tunnel NIC device sync workqueue allows a local low-privileged attacker to corrupt kernel memory during concurrent device operations, potentially achieving full kernel compromise. The flaw stems from a race condition between the workqueue subsystem's internal pending bit and the driver-level work_pending flag in udp_tunnel_nic_device_sync_work(), causing udp_tunnel_nic_unregister() to free the structure while a second work item is still queued and active. No public exploit identified at time of analysis, but patched versions are available across all active stable kernel branches.