Deadlock in the Linux kernel qede NIC driver's recovery path permanently wedges the rtnetlink control plane of any affected host when a TX timeout fires on a QLogic/Cavium FastLinQ interface with VXLAN or GENEVE tunnel ports configured. Systems in this state remain pingable but every subsequent caller of rtnl_lock - including ip, sshd, ovs-vswitchd, IPv6 addrconf, and lldpad - blocks indefinitely, denying all network management access until reboot. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the impact on unpatched datacenter hosts in tunnel-overlay environments is severe and patch adoption should be prioritized.
Resource leak in the Linux kernel NFS server (NFSD) allows connected NFS clients to cause a denial-of-service condition by sending FREE_STATEID for an admin-revoked parallel NFS (pNFS) layout stateid. The kernel function nfsd4_drop_revoked_stid() lacks handling for the SC_TYPE_LAYOUT case, causing the stateid to remain allocated in the IDR tree and on the per-client list indefinitely rather than being properly unhashed and freed. No public exploit exists and EPSS is 0.17% (6th percentile), but the unauthenticated network vector and availability impact score of 7.5 warrant attention on NFS servers with pNFS layouts enabled. Vendor-released patches are available in stable kernel branches.
Resource leakage in the Linux kernel's NVMe-over-TCP target subsystem (nvmet-tcp) allows unauthenticated network clients to exhaust kernel queue and socket resources by manipulating a TLS handshake. The flaw in `nvmet_tcp_tls_handshake_done()` ignores the return value of `nvmet_tcp_set_queue_sock()`, so if the socket leaves TCP_ESTABLISHED state during handshake completion - a condition an attacker can induce by timing a connection abort - resources are never cleaned up. No public exploit is identified and EPSS is 0.17%, but repeated triggering can deny service to storage infrastructure running nvmet-tcp with TLS configured.
Reference accounting defects in the Linux kernel's md/raid10 driver allow writes_pending and barrier references to permanently leak on discard operation failure paths, leading to an unrecoverable hang of the RAID10 array. raid10_make_request() acquires these references before entering raid10_handle_discard(), but multiple failure exits in that function bypass the corresponding release calls md_write_end() and allow_barrier(), causing write accounting and resync barriers to become permanently imbalanced. With no confirmed active exploitation (no CISA KEV listing), an EPSS of 0.16% at the 6th percentile, and no public exploit identified at time of analysis, this is a targeted kernel-configuration issue whose impact is confined to systems explicitly running md/raid10 with discard enabled.
Deadlock in the Linux kernel btrfs zoned filesystem causes an unrecoverable filesystem hang on hosts using zoned block devices (SMR HDDs or ZNS SSDs). The writeback path in btree_writepages() holds zoned_meta_io_lock while the tree-log block group fallback path waits for a transaction commit, while the concurrent transaction commit path blocks on that same lock - a classic ABBA deadlock resulting in complete filesystem unavailability. No public exploit exists and EPSS is 0.16% (5th percentile), reflecting a niche-deployment reliability issue rather than a broad security threat; the condition can be triggered by normal I/O stress and was confirmed reproducible via fstests generic/475.
Stale kernel memory leaks to userspace through an off-by-two bounds error in the Linux kernel's libiscsi subsystem, specifically in `iscsi_scsi_cmd_rsp()`. Systems running an iSCSI initiator (libiscsi loaded) that connect to a malicious or compromised iSCSI target are exposed: the target crafts a SCSI Response PDU where the data segment length equals the declared sense length, causing a `memcpy()` to read two bytes past the received buffer boundary into stale `conn->data` contents, which are then returned to userspace in the SCSI sense buffer. No public exploit exists and EPSS stands at 0.16% (5th percentile); exploitation requires adversary control of an iSCSI target the victim connects to, making this a concern primarily for enterprise iSCSI storage environments rather than general internet-facing systems.
NULL pointer dereference in the Linux kernel's rxrpc subsystem allows a remote unauthenticated attacker to crash the kernel, causing a denial of service. The flaw exists in rxrpc_verify_data(), which skips allocating the rx_dec_buffer when the associated skb private length is zero, while its caller rxrpc_recvmsg_data() unconditionally assumes the buffer is populated after a successful return. A crafted RxRPC network packet with zero-length payload data can trigger this path, passing a NULL pointer to skb_copy_bits() and causing a kernel panic. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is very low at 0.16% (5th percentile), consistent with a niche kernel subsystem.
Denial-of-service in the Linux kernel's AFS (Andrew File System) cache manager allows remote attackers to crash or destabilize systems running AFS by sending a crafted CB.InitCallBackState3 callback request that arrives without an associated server record. The CB.InitCallBackState3 handler failed to perform the null-check present in all other callback handlers, meaning an unexpected or spoofed callback packet lacking a peer-to-server mapping causes a kernel-level fault. No public exploits have been identified, and EPSS places exploitation probability at just 0.16% (5th percentile), reflecting the niche deployment footprint of AFS.
Null-pointer dereference in the Linux kernel's rxrpc subsystem allows a remote unauthenticated attacker to crash the kernel by sending a forged ACKALL control packet to an exposed rxrpc service. Affected systems run Linux from commit b341a0263b1b804d329f864c2dc24815364510ec through the fixes landed in stable releases 6.18.40 and 7.1.5; Linux 6.14 is explicitly confirmed affected. No public exploit has been identified and EPSS probability is very low at 0.15%, but the network-accessible, no-authentication attack path warrants immediate patching on any system actively serving rxrpc traffic.
Deadlock vulnerability in the Linux kernel md/raid1 and md/raid10 drivers can freeze systems running software RAID1 or RAID10 under concurrent memory pressure. The flaw causes incorrect GFP flag selection during block I/O error recovery - the kernel uses GFP_NOIO instead of GFP_NOIO|__GFP_HIGH after a failed bio is split and resubmitted, starving memory reclaim of emergency reserves and causing a kernel deadlock. No active exploitation has been identified (not in CISA KEV), and EPSS at 0.15% reflects low opportunistic risk; however, storage servers, hypervisors, and database hosts using Linux software RAID should prioritize patching to kernel 7.1.5 or 7.2-rc1.
Denial of service in the Linux kernel's rxrpc subsystem allows remote, unauthenticated attackers to trigger an infinite loop in rxrpc_recvmsg() by sending packets that populate the out-of-band (OOB) queue, which the wait condition fails to check. Systems exposing RxRPC endpoints - primarily AFS (Andrew File System) clients and servers - are affected from the introducing commit through Linux 7.1.4 and 6.18.39. No public exploit exists and EPSS sits at 0.15% (5th percentile), signaling negligible real-world exploitation probability; this is not listed in CISA KEV.
Kernel panic via rxrpc protocol mishandling in the Linux kernel allows a network-positioned attacker to crash an AFS client system by sending a premature reply DATA packet before any request packets have been transmitted on a client call. The flaw resides in rxrpc_receiving_reply(), which fails to verify call exposure state before invoking rxrpc_rotate_tx_window() - a function whose do...while loop oopses on an empty transmit queue. Fixes have been backported to stable branches 7.1.5 and 6.18.40; no public exploit has been identified and EPSS exploitation probability is extremely low at 0.15% (5th percentile), indicating no known active exploitation.
Unauthenticated information disclosure in Product Feed PRO for WooCommerce by AdTribes (WordPress plugin) before version 13.5.7 exposes sensitive WooCommerce store configuration to any remote party without credentials. A missing authorization check on a REST API read route allows retrieval of feed rules, filters, and field mappings - internal merchandising logic that store operators typically treat as proprietary business configuration. Additionally, the full product category taxonomy can be enumerated, enabling competitive intelligence gathering. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates low observed exploitation probability despite the straightforward unauthenticated attack vector.
Livelock in the Linux kernel's vhost-net subsystem can cause a host denial-of-service against KVM virtualization environments when mergeable receive buffers (VIRTIO_NET_F_MRG_RXBUF) are negotiated between host and guest. The defect in `vhost_get_avail_idx` propagates an incorrect return value through `vhost_enable_notify`, causing the host vhost kernel thread to spin in an immediate disable-then-retry notification loop when the guest is not consuming virtio ring entries fast enough. No public exploit code exists and EPSS stands at 0.17% (6th percentile), but the CVSS Scope Changed (S:C) metric confirms cross-VM-boundary impact on the hypervisor host, making this a meaningful availability risk for KVM-based virtualization fleets.
Lockless race condition in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows local low-privileged users to trigger torn reads of socket binding state, silently redirecting CAN traffic to unintended interfaces or leaving broken RX filter operations registered as successful. The vulnerability affects all kernel branches from Linux 2.6.25 through unpatched stable releases across the 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, and 7.1.x series. No public exploit code or CISA KEV listing exists at time of analysis; EPSS probability is 0.22% (13th percentile), consistent with the local-only attack surface and specialized CAN subsystem prerequisite.
Heap out-of-bounds read in the Linux kernel MACsec subsystem (`macsec_encrypt()`) allows a local attacker with CAP_NET_RAW capability to leak 12 bytes of kernel heap memory and emit that raw heap content onto the wire as a malformed Ethernet frame, with additional potential for kernel destabilization. The flaw is triggered exclusively via the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path, where the socket buffer arrives at `macsec_start_xmit()` with `skb->mac_header` unset, resolving `eth_hdr(skb)` to `skb->head + 65535` - far outside valid headroom. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (12th percentile) reflects low exploitation probability; patches have been backported across all active stable kernel series.
Undefined-shift undefined behavior in the Linux kernel netfilter subsystem (xt_connmark) allows a local attacker with low privileges to trigger kernel crashes, potential memory corruption, and limited information disclosure. The flaw resides in the CONNMARK target revision 2, introduced in Linux 4.17, where user-supplied shift_bits values of 32 or greater are passed unchecked to 32-bit bitshift operations in connmark_tg_shift(), invoking C undefined behavior at packet-processing time. Exploitation is not confirmed active (not in CISA KEV) and EPSS sits at 0.21% (12th percentile), but the kernel-level impact and wide Linux deployment make patching a clear priority for exposed hosts.
The Linux kernel dm (device-mapper) subsystem, from version 6.9 onward, leaks the calling process's thread keyring by retaining a reference to the table device file beyond the caller's lifetime, causing LUKS volume keys to silently persist in RAM after `cryptsetup luksSuspend`. This regression, introduced by commit a28d893eb327, breaks a documented security guarantee: `luksSuspend` is expected to wipe the volume key from memory, but an unpatched kernel leaves a second copy in the retained thread keyring recoverable until `luksClose`. Any adversary capable of reading kernel memory - via physical access, cold boot attack, or a separate memory disclosure exploit - can extract the LUKS volume key and decrypt the protected volume. No public exploit is identified, and EPSS of 0.21% (11th percentile) reflects limited automated exploitation probability.
Verdict-type confusion in the Linux kernel's netfilter nft_compat layer allows a local low-privileged attacker to bypass firewall rules and destabilize packet processing on systems running ebtables emulation. The nft_compat code fails to reject non-bridge xtables targets in NFPROTO_BRIDGE context, permitting a fallback to NFPROTO_UNSPEC that was already blocked in the legacy ebtables path since commit 11ff7288beb2; the nft_compat layer simply missed that guard. No public exploit is identified at time of analysis, and EPSS sits at a low 0.21%, though patched kernel versions are available across all active stable branches.
Silent data corruption in the Linux kernel nvdimm/btt subsystem results from a broken lane-acquisition locking model that became invalid once BTT lanes were made preemptible. On systems with NVDIMM persistent memory configured in BTT (Block Translation Table) mode, a low-privileged local user can trigger a preemption-induced race where a second task observes a non-zero per-CPU recursion count, incorrectly infers it already holds the lane lock, bypasses mutual exclusion, and concurrently accesses shared per-lane metadata and workspace state, yielding high-integrity and high-confidentiality impact. No public exploit exists and EPSS is 0.18% (8th percentile), but the race is reproducible via the upstream ndctl btt-check.sh unit test and patches are available across all actively maintained stable kernel branches.
Missing input validation in the Linux kernel's ASoC Meson AIU audio driver allows a local low-privileged attacker to supply out-of-range enum values to HDMI and internal codec mux put callbacks, triggering snd_soc_enum_item_to_val() on unvalidated input and resulting in out-of-bounds kernel memory access. Systems running Linux 5.7 through pre-7.1.5 on Amlogic Meson SoC hardware are affected, with potential for high confidentiality impact (kernel memory disclosure), limited integrity impact, and kernel crash (availability). No public exploit code exists and exploitation probability is very low (EPSS 0.15%, 5th percentile), but the local attack vector and low privilege requirement mean any user with ALSA device access on affected hardware is a potential threat actor.
Improper bounds enforcement in the Linux kernel's accel/amdxdna driver allows a local low-privileged user to trigger a kernel-to-userspace copy that exceeds the application-provided buffer size via a crafted ioctl call. The root cause is that copy_to_user() was using the kernel's internal data size rather than the caller-supplied buffer size to bound the copy, enabling overflow into adjacent userspace memory and exposure of unintended kernel data. No public exploit exists and no active exploitation has been confirmed, but the CVSS vector (C:H/I:H) reflects a real dual-impact risk: confidentiality loss from kernel memory spillover and integrity loss from overwriting adjacent user-space structures.
Stored Cross-Site Scripting in the Invisible Anti-Spam & CAPTCHA WordPress plugin (versions ≤ 5.1) allows unauthenticated remote attackers to inject persistent malicious scripts into WordPress pages via crafted admin-ajax.php requests. The plugin's explicit-actions list - auto-populated with common form builder hooks at activation - has no authentication gate on its write path, meaning any network-reachable attacker can store arbitrary JavaScript that executes in every subsequent visitor's browser context. No public exploit has been identified at time of analysis, and an upstream fix appears available via WordPress plugin repository changeset 3633500, though the exact patched release version has not been independently confirmed.
Stored XSS in the WPLP Cookie Consent WordPress plugin (all versions through 4.3.5) enables attackers to inject persistent JavaScript payloads via the unsanitized 'regionArray' parameter, executing in any visitor's browser on affected pages. The attack surface is compounded by a secondary flaw: the plugin's AJAX handler for Google Consent Mode (GCM) configuration performs no nonce verification and no capability check, permitting even Subscriber-level authenticated users to programmatically enable the GCM feature - the prerequisite for the XSS injection vector. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch appears available in version 4.4.0 based on the WordPress plugin changeset reference.
Stored Cross-Site Scripting in the Online Booking & Scheduling Calendar for WordPress by vcita (all versions through 4.6.0) allows unauthenticated remote attackers to inject persistent malicious JavaScript via the unsanitized 'business_id' parameter. Injected scripts execute in the browser of any user - including administrators - who subsequently loads an affected page, enabling session hijacking, credential theft, or secondary payload delivery. No active exploitation is confirmed by CISA KEV; no public exploit has been identified at time of analysis, though Wordfence has documented the vulnerable code paths in three specific source files.
Stale state bugs in the Linux kernel CAN Broadcast Manager (BCM) subsystem allow a local low-privileged user to trigger a runaway hrtimer loop and silently suppress CAN frame delivery following network device removal events. Affected systems span Linux 2.6.25 through unpatched stable branches, with fixes released in 6.6.148, 6.12.101, 6.18.42, 7.1.5, and 7.2-rc4. An attacker with local CAN socket access can cause indefinite bcm_tx_timeout_handler() execution and potentially inject CAN frames into a subsequently reused interface index, yielding high integrity and availability impact with no public exploit identified at time of analysis.
Denial-of-service in the Linux kernel's KVM x86 subsystem allows a guest VM to crash the host hypervisor by exploiting a state inconsistency in PV EOI (paravirtual end-of-interrupt) handling. When a guest triggers a memory read failure in `pv_eoi_get_user()` while concurrently disabling PV EOI, KVM fires a fatal assertion in `kvm_lapic_sync_from_vapic()` at `lapic.c:3338`, producing a kernel BUG and crashing the host. This takes down all co-resident virtual machines. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but vendor-confirmed patches are available across multiple stable kernel branches.
Out-of-bounds read in the Linux kernel ATM networking subsystem (`net/atm`) allows local low-privileged users to disclose kernel memory or crash the system by supplying an out-of-range `traffic_class` value via the `SO_ATMQOS` socket option. The flaw persists because `check_tp()` fails to reject traffic class values above `ATM_ANYCLASS`, leaving the invalid value in `vcc->qos` where it is later used as an unguarded array index in `pvc_info()` when `/proc/net/atm/pvc` is read. EPSS sits at 0.22% (13th percentile) with no CISA KEV listing and no public exploit identified, making real-world exploitation risk considerably lower than the CVSS 7.1 score implies, particularly given that ATM networking is a legacy subsystem absent from most modern deployments.
Hardware protection bypass in the Linux kernel's PMBus hwmon driver silently discards concurrent regulator fault events, preventing hw_protection_trigger() from firing when multiple power faults coincide. Systems running affected kernel versions (6.6.143-6.6.145, 6.12.92-6.12.97, 6.18.21-6.18.40, 6.19.11-6.20, 7.0-7.1.4) with PMBus-managed power rails may fail to respond to simultaneous under-voltage and over-current events, leaving hardware operating without critical protection. No public exploit has been identified; EPSS of 0.22% (13th percentile) and absence from CISA KEV confirm this is not actively exploited.
Resource exhaustion in the Linux kernel ice driver allows accumulated CTRL VSI memory leaks during VF resets on Intel E800-series adapters with FDIR filters active, ultimately degrading host availability after repeated VF lifecycle operations. Affected kernel versions span from the introducing commit (da62c5ff9dcd) through all stable branches prior to the fix commits, with patched releases confirmed at 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. No public exploit tool exists and EPSS is a negligible 0.21% (12th percentile), placing this squarely in the patch-when-convenient tier for most deployments - with the exception of high-density SR-IOV virtualization hosts running frequent VF resets, where the cumulative leak poses a realistic availability risk.
Raw AES-128 LLSEC key exposure in the Linux kernel's legacy ieee802154 netlink family allows any local user to extract 16-byte cryptographic key material directly from the kernel keytable on systems running IEEE 802.15.4 (wpan) interfaces with link-layer security configured. Because IEEE 802.15.4 LLSEC uses CCM* mode where the same key both encrypts frames and provides message authentication, key disclosure simultaneously breaks confidentiality and authenticity of the entire 802.15.4 wireless network. No confirmed active exploitation and no public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), consistent with the niche hardware requirement.
Page-counter underflow in Linux kernel's hugetlb cgroup accounting allows a local low-privileged user to corrupt memory accounting state, causing integrity and availability impacts on affected systems. The flaw exists in alloc_hugetlb_folio() where a shared h_cg pointer is overwritten during sequential rsvd and non-rsvd hugetlb cgroup charges, causing the wrong cgroup to be committed to the folio's reserved slot. When the folio is freed, the mismatched uncharge path decrements a counter on a cgroup that was never charged, triggering a page_counter underflow (WARNING: mm/page_counter.c:61). No public exploit exists and EPSS sits at 0.21% (11th percentile), but the flaw affects a broad swath of kernel versions from 5.7 onward.
Race condition in the Linux kernel's HugeTLB page table protection code allows a local low-privileged user to corrupt page tracking state or leak memory access metadata. Specifically, make_uffd_wp_huge_pte() in fs/proc/task_mmu.c invokes huge_ptep_modify_prot_commit() on a PTE snapshot captured without the preceding huge_ptep_modify_prot_start() atomic clear, creating a window where hardware can set Dirty or Accessed bits between the read and commit, which are then silently overwritten with stale values. EPSS is 0.21% (11th percentile) and no active exploitation has been confirmed - this is a correctness/integrity fix in the kernel stable queue, not a commonly weaponized class of vulnerability.
Integrity bypass in the Linux kernel dm-integrity device mapper subsystem allows low-privileged users to undermine block-level data integrity guarantees through a double-increment logic error in hash_offset tracking. The introduced commit 84597a44a9d86ac949900441cea7da0af0f2f473 (present since Linux 5.7) causes the hash_offset variable to advance by two positions per iteration instead of one, meaning integrity hashes are verified against incorrect offsets - allowing corrupted data to pass or valid data to fail integrity checks. No public exploit identified at time of analysis, and EPSS at 0.21% (11th percentile) reflects low near-term exploitation probability.
Integer underflow in the Linux kernel's Intel VPU accelerator driver (accel/ivpu) allows a local low-privileged attacker to trigger out-of-bounds kernel memory reads and infinite loops via a malformed firmware log buffer. The vulnerability exists because fw_log_from_bo() never validates that log->size is at least log->header_size before fw_log_print_buffer() computes data_size = log->size - log->header_size - a u32 subtraction that wraps to near-U32_MAX, defeating the bounds checks from commit dd1311bcf0e6 and enabling fw_log_print_lines() to read far past the allocated BO region. No active exploitation is confirmed (not in CISA KEV), and EPSS is 0.21% (11th percentile), indicating low near-term exploitation likelihood despite the 7.1 CVSS score.
Improper error handling in the Linux kernel's netfs (network filesystem) subsystem allows a local user with low privileges to corrupt kernel folio state or trigger a kernel hang. The writeback_iter() loop fails to re-invoke itself with the error code set when a write operation fails, leaving folios unlocked and non-redirtied, which produces incorrect iteration state with high integrity and availability consequences. No public exploit code has been identified, and EPSS places exploitation probability at 0.21% (11th percentile), consistent with a constrained local kernel defect rather than a broadly weaponized vulnerability.
Denial of service in the Linux kernel's KVM arm64 nested virtualization subsystem allows a guest to crash the host hypervisor by writing to the ZCR_EL2 system register alias during a nested context. Affected systems run arm64 Linux kernel builds where FEAT_NV2 is advertised to an L1 guest hypervisor; the write is architecturally legitimate in this context, but a misplaced WARN triggers a hyp_panic, taking down the KVM hypervisor layer. No public exploit or CISA KEV listing exists, and EPSS probability sits at 0.21% (11th percentile), reflecting low observed exploitation activity.
Incorrect pointer usage in the Intel Speed Select Technology (ISST) platform driver causes SST-PP control registers to be restored only for power domain 0 during system resume from suspend, leaving all non-zero power domains with corrupted performance profile settings. Systems running affected Linux kernel versions (6.18.16-6.18.39, 6.19.x, 7.0) on Intel Xeon hardware with multi-domain ISST configurations will silently misconfigure CPU performance profiles after any suspend/resume cycle, leading to integrity and availability impact. EPSS is at 0.21% (11th percentile) and no active exploitation has been identified; a vendor patch is available across multiple stable branches.
Data corruption in the Linux kernel's LoongArch memory management subsystem allows a local low-privileged user to cause silent loss of written data or potential exposure of stale page contents via a race condition between hardware page table walker behavior and software dirty-bit tracking. Affected systems are those running LoongArch CPUs with hardware PTW enabled - a condition that applies to the architecture by design - across kernel versions from 5.19 through stable branches prior to 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code exists and EPSS stands at 0.21% (11th percentile), though the bug was reliably reproduced via the LTP madvise09 test, confirming it is not theoretical.
Uninitialized kernel memory read in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3) allows a low-privileged local user to potentially leak sensitive kernel memory contents via a crafted or specially structured NTFS file. The flaw manifests in ni_seek_data_or_hole() when run_lookup() fails to locate the target VCN in runs[0], causing attr_data_get_block_locked() to exit prematurely without initializing the lcn variable - a KMSAN-confirmed uninit-value read triggered through the ntfs_llseek/vfs_llseek call chain. No public exploit exists at time of analysis (EPSS 0.20%, 10th percentile) and this is not listed in CISA KEV, indicating low active exploitation risk despite the CVSS 7.1 base score.
Reference count and barrier leaks in the Linux kernel md/raid1 write dispatch path leave writes_pending and barrier accounting permanently imbalanced on certain write failure conditions, producing a high availability impact - potential system hang or crash - on any Linux host running software RAID-1 from kernel 5.17 through pre-7.1.5. The vulnerability is fixed in stable trees at 7.1.5 and 7.2-rc1 via two upstream commits. No active exploitation has been confirmed (no CISA KEV listing), no public exploit code exists, and an EPSS score of 0.20% at the 10th percentile indicates very low current real-world exploitation probability.
Out-of-bounds heap read in the Linux kernel ASoC SDCA subsystem allows a local attacker with low privileges to read past the end of a kernel heap buffer by writing an out-of-range enumeration index to the ge_put_enum_double() ALSA control handler. Affected kernels from commit 812ff1baa764 through pre-7.1.5 are vulnerable; the existing bounds check in snd_soc_dapm_put_enum_double() runs only after the unsafe read, providing no protection. No public exploit code has been identified and no active exploitation is confirmed; EPSS of 0.20% (10th percentile) reflects low near-term exploitation probability.
Incorrect VID encoding in the Linux kernel PMBus hwmon driver causes dangerously wrong voltage commands to be written to PMBus power management chips when non-VR11 VID modes are configured. The function `pmbus_data2reg_vid()` hardcoded VR11 encoding for writes while `pmbus_reg2data_vid()` correctly honored the driver-configured `vrm_version` for reads, creating an asymmetry that sends incorrect PMBUS_VOUT_COMMAND values - for example, a request for 200 mV on a VR12/VR13-mode device results in 1080 mV being delivered instead. No public exploit has been identified at time of analysis, and EPSS probability is 0.20% (10th percentile), reflecting the niche hardware and configuration requirements.
AppArmor's aa_change_profile() in the Linux kernel dereferences a potentially NULL or ERR_PTR label value before the existing IS_ERR_OR_NULL() guard is reached, allowing a local low-privilege attacker to trigger a kernel crash or kernel memory disclosure. Affected are kernel versions from the introducing commit e00b02bb6ac2a1893227ce8014b649028d6425d2 through multiple stable branches, with vendor-released patches confirmed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 7.1.5, and 7.2-rc1. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) reflects minimal current exploitation interest.
Exclusive BPF maps in the Linux kernel can be inserted as inner maps within non-exclusive outer map-in-map structures, allowing any unrelated local BPF program to look up and mutate a map that is supposed to be bound exclusively to a single program by cryptographic hash. This bypasses the signed BPF loader's integrity guarantee - an adversary on a hostile host can rewrite the frozen metadata map contents that the loader has already validated against a signed hash. No public exploit is identified at time of analysis and EPSS is very low (0.18%), but the impact is high for environments relying on exclusive maps as a trust boundary.
Integer underflow in the ocfs2 filesystem's FITRIM implementation allows a local low-privileged user to corrupt filesystem data or trigger a crash by submitting a trim range shorter than one cluster. The validation in ocfs2_trim_mainbm() checks against sb->s_blocksize instead of s_clustersize; on filesystems where cluster size exceeds block size, a range that passes the block-size check gets shifted to len==0, after which pointer arithmetic involving start + len - 1 and len -= ... underflows, driving the trim operation past the requested bounds. No public exploit has been identified at time of analysis, and EPSS is 0.18% (7th percentile), consistent with its low real-world exploitation priority.
Out-of-bounds array read in the Linux kernel's ASoC Tegra audio driver (tegra210_ahub) allows a local attacker with low privileges to disclose kernel memory contents or trigger a kernel panic on NVIDIA Tegra 210-based systems. The flaw in tegra_ahub_put_value_enum() accesses e->values[item[0]] before validating that item[0] falls within the valid enum range, making the existing bounds check ineffective. Patches are confirmed across multiple stable kernel branches; no public exploit code or active exploitation has been identified at time of analysis.
Kernel page fault in Linux kernel AppArmor's file auditing path allows a local low-privileged user to crash the system or leak kernel memory via the audit log. The regression was introduced by commit 4a134723f9f1, which left the *name pointer uninitialized when path->dentry is the aa_null sentinel, then passed it to audit_log_untrustedstring() where strlen() dereferences an invalid address. No public exploit code exists and EPSS probability is 0.17% (7th percentile), but patched stable releases 6.18.40, 7.1.5, and 7.2-rc1 are confirmed available.
Out-of-bounds read in the Linux kernel's ASoC hdac_hdmi HDMI audio codec driver allows a local attacker with low privileges to expose sensitive kernel memory or crash the kernel by writing a crafted out-of-range enum value to the ALSA control interface. The flaw exists in hdac_hdmi_set_pin_port_mux(), which indexes the texts array using the attacker-supplied value before the bounds-checking helper snd_soc_dapm_put_enum_double() has a chance to reject it. Patches are confirmed available across seven stable kernel branches; with an EPSS of 0.17% and no CISA KEV listing, no active exploitation has been identified at time of analysis.
Bluetooth HIDP in the Linux kernel exposes an uninitialized-memory read and a peer-controlled out-of-bounds byte access in hidp_session_run() when processing numbered HID report responses. Systems running Linux with active Bluetooth HID sessions are vulnerable to a malicious adjacent Bluetooth peer leveraging this to disclose kernel memory contents (rated C:H, enabling potential KASLR bypass) or manipulate HIDIOCGFEATURE report completion with attacker-controlled data. No public exploit has been identified, EPSS is 0.17% (6th percentile), and this vulnerability is not listed in CISA KEV.