Reference count leak in the Linux kernel AppArmor security module allows a local low-privileged user to trigger use-after-free conditions via a bug in update_sk_ctx() socket context management, potentially achieving privilege escalation with high confidentiality, integrity, and availability impact. The fix, backported across stable branches (6.18.40, 7.1.5, 7.2-rc1), corrects the unconditional plabel reference put in the caller by adding a compensating reference acquisition. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation probability.
Wrong MTD geometry is applied in the Linux kernel's mchp23k256 SPI SRAM driver when the chip is matched via the SPI id-table rather than via Device Tree, potentially exposing or corrupting unintended SRAM address regions. The driver's probe function calls of_device_get_match_data() exclusively, causing any non-OF SPI modalias match to silently fall back to the default mchp23k256_caps structure regardless of which part was actually selected by the SPI id-table, leading to incorrect chip capacity and address geometry. No public exploit exists and EPSS places this at the 7th percentile (0.17%), but the C:H/I:H/A:H CVSS impact flags reflect that incorrect geometry can expose the entire SRAM contents or allow out-of-bounds writes on affected embedded systems.
Uninitialized pointer dereference in the Linux kernel's `fwnode_init()` function exposes systems to local privilege escalation or kernel crash via a garbage `secondary` pointer in `struct fwnode_handle`. When firmware nodes are allocated on the stack or via non-zeroing heap allocators, `fwnode_init()` leaves `fwnode->secondary` containing arbitrary memory content; subsequent kernel functions such as `dev_to_swnode()` that check `IS_ERR_OR_NULL()` before dereferencing will silently proceed with the garbage pointer. Patches are confirmed available across all active stable kernel branches (5.15.x through 7.x); no public exploit code exists and this CVE is not listed in the CISA KEV catalog.
Use-after-free and NULL-pointer dereference in the Linux kernel ALSA sequencer MIDI subsystem allows a local low-privileged user to crash the kernel or potentially escalate privileges by racing MIDI output event processing against port teardown. The flaw exists because `event_process_midi()` reads `msynth->output_rfile.output` without holding any lock, while `midisynth_unuse()` can concurrently free `substream->runtime` before `snd_rawmidi_kernel_write1()` pins its buffer reference - leaving the event path with a dangling pointer confirmed via KASAN null-ptr-deref reproduction. No public exploit identified at time of analysis, and EPSS of 0.17% (7th percentile) signals low current exploitation interest despite the 7.8 CVSS score.
Out-of-bounds memory access in the Linux kernel RDMA/rxe (Soft RoCE) subsystem enables a local low-privileged attacker to corrupt kernel heap data or leak sensitive memory, potentially achieving local privilege escalation. The non-SRQ receive path in rxe_resp_check_length() and copy_data() reads WQE fields directly from a userspace-mapped shared buffer without snapshotting them first, creating a TOCTOU race window exploitable by any local user controlling a non-SRQ queue pair. Patches are confirmed available across multiple stable kernel branches; no public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.17% indicates low current exploitation probability consistent with the niche RDMA prerequisite.
Use-after-free in the Linux kernel BPF filesystem (bpffs) inode lifecycle exposes freed kernel memory during concurrent path traversal, enabling local attackers with low privileges to crash the kernel or potentially escalate privileges. The flaw was introduced by commit 4f375ade6aa9, which incorrectly removed the RCU grace-period delay protecting inodes and cached symlink bodies accessible via concurrent RCU pathwalk operations (pick_link, may_lookup). KASAN confirmed the slab-use-after-free at inode offset +2 (i_opflags). No public exploit has been identified and EPSS is very low at 0.17% (7th percentile), with no CISA KEV listing.
Use-after-free in Linux kernel's configfs_lookup() allows a local low-privilege attacker to trigger kernel memory corruption via a dangling pointer in configfs_dirent->s_dentry. When inode allocation fails during a directory lookup, the code drops the configfs_dirent reference but neglects to clear ->s_dentry, leaving it pointing at a dentry object that is subsequently freed; a follow-on getdents(2) call in the same directory dereferences that stale pointer to read the inode number, producing the UAF condition. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at 0.17% (7th percentile), but the defect has been latent since Linux 2.6.16 in 2006, meaning a vast range of unpatched production kernels carries the flaw.
Out-of-bounds memory access in the Linux kernel BPF cgroup storage subsystem exposes multiple stable kernel branches to local privilege escalation, stemming from an incomplete fix for predecessor commit abad3d0bad72. A local attacker with CAP_BPF privilege can construct a tail call chain using a storage-less intermediate BPF program as a bridge between two cgroup-storage-using programs (A→B(no storage)→C(storage)), bypassing cookie validation and causing runtime cgroup local storage in the callee to operate on the original caller's context, triggering an out-of-bounds kernel memory access with C:H/I:H/A:H impact. EPSS is low at 0.17% (7th percentile) and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Incorrect UAR index release in the Linux kernel RDMA/mlx5 driver allows a local attacker with low privileges to corrupt kernel-level resource tracking structures, potentially enabling privilege escalation, information disclosure, or denial-of-service via kernel crash. All kernel versions from 4.16 through the fixed stable releases (6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5) are affected on systems equipped with Mellanox/NVIDIA ConnectX RDMA hardware. No public exploit code or active exploitation has been identified; EPSS stands at 0.17% (7th percentile), indicating very low current exploitation probability.
Unsafe destructor execution in the Linux kernel BPF subsystem allows a local attacker with BPF program loading privileges to trigger memory corruption by causing map value cleanup routines to run from NMI (Non-Maskable Interrupt) context. The flaw affects array and hashtab BPF maps containing special fields such as referenced kptrs, uptr, timer, workqueue, and graph roots - destructors for these types are not NMI-safe, yet tracing BPF programs can invoke map update or delete operations from that context. No active exploitation has been identified (not in CISA KEV); EPSS is 0.17% (7th percentile), consistent with a locally-exploitable kernel flaw requiring specialized capabilities.
Memory corruption in the Linux kernel's nzxt-smart2 hwmon driver exposes systems on non-coherent DMA architectures (ARM, MIPS) to deterministic kernel memory corruption whenever the NZXT Smart Device 2 USB hardware triggers a DMA-mapped output report. The driver's send_output_report() passes a misaligned buffer to hid_hw_output_report(), which hands it to usb_interrupt_msg() for DMA mapping; on non-coherent caches, cache line flush or invalidate operations corrupt adjacent kernel variables (mutex, update_interval) sharing the same cache line. No public exploit has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects low exploitation probability, and the bug is not listed in CISA KEV.
Out-of-bounds array access in the Linux kernel nct6775-core hardware monitoring driver allows a local low-privileged user on systems equipped with the nct6116 Super I/O chip to trigger reads beyond 3-element weight register arrays (up to index 4), with the resulting garbage values subsequently used as hardware I/O register addresses. This can cause invalid hardware register writes, hardware misconfiguration, or system crashes. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), making this a patch-priority rather than emergency-response item; exploitation is bounded by the hardware specificity of the nct6116 chip.
Use-after-free in the Linux kernel's forcedeth Ethernet driver allows a local user to trigger kernel memory corruption during device removal. The driver's nv_remove() function frees per-CPU txrx_stats before unregister_netdev() completes, leaving the ndo_get_stats64 statistics path, NAPI polling, xmit data path, and nv_close()/drain all capable of accessing the already-freed structure. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and no public exploit identified at time of analysis, the immediate risk is narrow but the potential for local privilege escalation on systems with NVIDIA nForce-era hardware warrants prompt patching.
List corruption in the Linux kernel's hugetlb memory management subsystem (`mm/hugetlb`) allows a local low-privileged attacker to trigger kernel memory corruption, potentially achieving privilege escalation or host crash. The flaw was confirmed as causing real-world KVM host panics in dense virtualization environments where QEMU and SPDK/DPDK vhost-user processes share a hugetlbfs MAP_SHARED mapping; with CONFIG_DEBUG_LIST disabled, the corruption silently embeds a kernel stack address into an active cache list, setting up a use-after-free. No public exploit has been identified at time of analysis; EPSS is 0.17% and the vulnerability is not in CISA KEV, but fixed stable kernel releases are available across all active branches.
Use-after-free in the Linux kernel audit subsystem's `audit_del_rule()` function exposes systems from kernel 4.3 onward to local privilege escalation. The flaw stems from incorrect RCU ordering: fsnotify mark resources tied to `e->rule.exe` are freed before the rule is unlinked from RCU-visible filter lists, creating a window where concurrent `audit_filter()` and `audit_filter_rules()` readers dereference already-freed memory. Patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Linux kernel Bluetooth management subsystem allows a local low-privileged user to corrupt kernel heap memory by racing MGMT_OP_SET_LOCAL_NAME against MGMT_OP_REMOVE_UUID on systems with a powered BR/EDR-capable Bluetooth controller. The race exploits a missing lock acquisition in pending_eir_or_class() and the omission of MGMT_OP_SET_LOCAL_NAME from EIR-serialization logic, enabling a freed pending command entry to be read during EIR reconstruction. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), but the kernel UAF primitive and confirmed 7.8 CVSS score make patching a clear priority for Bluetooth-enabled systems.
Use-after-free in the Linux kernel ALSA timer subsystem allows an unprivileged local user to corrupt kernel heap memory and escalate privileges to root. The flaw stems from snd_timer_close_locked() setting SNDRV_TIMER_IFLG_DEAD but never clearing it after close completes; when snd_seq_timer_open() retries on the same instance after a forced failure, snd_timer_instance_free() frees an object still referenced across multiple kernel data structures. With CVSS 7.8 and a detailed exploitation path described directly in the upstream kernel commit, this is a credible local privilege escalation on desktop and workstation Linux systems, despite a low EPSS score of 0.17% (6th percentile) and no current CISA KEV listing. No public exploit code has been identified at time of analysis.
Use-after-free in the Linux kernel's Transparent Huge Page split path exposes systems to kernel memory corruption, potential privilege escalation, or denial of service via a race condition in __folio_split(). Any local low-privilege user on affected kernels prior to the stable fixes in versions 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6 may trigger this by racing a concurrent final iput() against the shmem THP split unlock sequence. No public exploit or PoC has been identified, and the EPSS score of 0.17% (6th percentile) reflects minimal real-world exploitation activity at time of analysis.
Use-after-free in the Linux kernel tracing subsystem exposes low-privileged local attackers to kernel memory corruption and potential privilege escalation. The defect, introduced at commit ae63b31e4d0e2ec09c569306ea46f664508ef717, causes trace_module_add_events() to call __add_event_to_tracers() unconditionally even when __register_event() has failed, leaving a trace_event_file holding a dangling pointer to a freed trace_event_call after a module load failure. EPSS is 0.17% (6th percentile) and no public exploit or CISA KEV listing has been identified, but the kernel UAF class carries inherent escalation potential and patches are available across multiple stable branches.
Integer overflow in the Linux kernel's scsi_debug module allows a local low-privileged attacker on a 32-bit system to trigger an out-of-bounds write via a crafted SCSI REPORT ZONES command. When alloc_len is in the range 0xFFFFFFC1-0xFFFFFFFF, an ALIGN() rounding operation overflows to 0x100000000, which truncates to zero under 32-bit size_t, causing kzalloc(0) to return a ZERO_SIZE_PTR sentinel that passes null checks - subsequent pointer arithmetic and loop writes then corrupt kernel memory, leading to privilege escalation or kernel panic. No public exploit has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects the narrow exploitation conditions required.
Privilege escalation in the Linux kernel's s390/qeth network driver allows any local unprivileged user to invoke three network management ioctls - SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE, and SIOC_QETH_QUERY_OAT - without the CAP_NET_ADMIN capability check that should gate them. Affected deployments are exclusively IBM z Systems (s390) mainframe environments running Linux kernels from commit 18787eeebd7 through the respective stable fix points, limiting real-world exposure to a narrow architectural niche. No public exploit or active exploitation has been identified; EPSS of 0.17% at the 6th percentile is consistent with the specialized environment required.
Use-after-free in the Linux kernel's Open vSwitch meter subsystem exposes systems running OVS to local privilege escalation, memory corruption, and potential information disclosure. The flaw affects all Linux 5.8+ kernels up to the patched stable releases and is triggered by a custom userspace application interacting with OVS via Netlink uAPI - standard ovs-vswitchd deployments are not vulnerable. No public exploit has been identified and EPSS sits at the 6th percentile, but the bug was discovered by Trend Micro's Zero Day Initiative (ZDI-CAN-31642), indicating professional security research attention; multiple stable kernel patches are now available.
Double-free heap corruption in the Linux kernel's peak_usb CAN bus USB driver exposes systems with PEAK USB-to-CAN hardware to local privilege escalation, kernel panic, or sensitive memory disclosure. The flaw resides in the peak_usb_start() error-handling path, where a URB transfer buffer is freed explicitly via kfree(buf) before usb_free_urb() frees the same buffer a second time through the URB_FREE_BUFFER flag, corrupting kernel heap allocator metadata. Patched stable kernel releases are confirmed available (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6), no public exploit code has been identified, and EPSS at 0.17% (6th percentile) confirms no observed exploitation activity.
Arbitrary CMA memory corruption via GPU DMA in the Linux kernel's drm/vc4 VideoCore 4 driver affects Raspberry Pi and similar vc4-based platforms running kernels from version 4.13 through multiple stable series. The vc4_overflow_mem_work() function incorrectly programs BPOS with the full 16MB binner BO size instead of the correct 512KB slot size, authorizing the GPU's PTB hardware to scribble tile lists across adjacent in-flight job memory and into unrelated CMA pages beyond the BO boundary. No public exploit has been identified at time of analysis and EPSS is 0.17% (6th percentile), but the memory corruption manifests reliably as GPU hangs, userspace heap corruption, and system crashes under normal GPU workloads that overflow the initial binner slot.
Uninitialized GPU memory reuse in the Linux kernel's drm/vc4 driver (Broadcom VideoCore IV, used in Raspberry Pi) allows a local low-privileged user to trigger GPU hangs, corrupt GPU state, and read stale tile state data left by prior GPU jobs in recycled buffer slots. The vulnerability exists because the 16MB binner Buffer Object is partitioned into 512KB slots that are recycled across jobs without clearing, causing the Primitive Tile Binner (PTB) hardware to act on stale Tile State Data Array (TSDA) contents from previous jobs - producing invalid command and primitive streams. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) reflects low exploitation probability despite the high CVSS base score.
Out-of-bounds memory access in the Linux kernel's drm/panthor driver (ARM Mali Valhall GPU) allows a local authenticated attacker to read or corrupt kernel memory by supplying a crafted MCU virtual address near the end of the firmware shared memory section. The underlying flaw is in iface_fw_to_cpu_addr(), which validated only that a firmware-provided address falls within the shared section - not that the full firmware interface structure fits within it - enabling subsequent structure-level accesses to reach past the section boundary. No public exploit code exists and EPSS is 0.17% (6th percentile), indicating no evidence of active exploitation; patches are available in Linux stable releases 6.12.103, 7.1.8, and 6.18.44.
Integer overflow in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user with AMD KFD device access to bypass EOP ring buffer size validation on GFX8/GFX9 hardware, enabling out-of-bounds GPU writes that can corrupt adjacent kernel memory or trigger GPU faults. A crafted eop_ring_buffer_size of 0xFFFFF001 exploits the ALIGN macro's typeof-preserved 32-bit arithmetic to wrap the computed size to zero, causing kfd_queue_buffer_get() to skip its exact-size check and accept an undersized buffer object. No public exploit has been identified and this is not in CISA KEV; EPSS stands at 0.17% (6th percentile), reflecting very low in-the-wild exploitation probability despite a CVSS 7.8 score.
Concurrent event manipulation during CRIU checkpointing in the Linux kernel's AMD GPU driver (drm/amdkfd) exposes a race condition leading to heap out-of-bounds writes or use-after-free memory corruption. A low-privileged local attacker on a system with an AMD GPU can exploit the unprotected gap between the event count and IDR walk in kfd_criu_checkpoint_events() by racing event creation or destruction from a second thread within the same process, producing kernel heap corruption primitives exploitable for local privilege escalation. No public exploit code and no CISA KEV entry have been identified at time of analysis; EPSS is 0.17% (6th percentile), reflecting low current adversary interest despite the high C:H/I:H/A:H CVSS impact triad.
Out-of-bounds kernel memory read in the Linux kernel's vmwgfx DRM driver exposes systems running VMware-virtualized graphics to local privilege escalation or sensitive information disclosure. The flaw in vmw_cmd_draw() allows a low-privilege local user to supply a crafted DRAW_PRIMITIVES command stream header with an undersized size field, triggering unsigned integer underflow that produces a near-4 GiB loop bound and causes the kernel to dereference memory far beyond the allocated command bounce buffer. Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6); no active exploitation has been confirmed and the vulnerability is not listed in CISA KEV.
Race condition in the Linux kernel's drm/xe Intel GPU driver allows a locally-authenticated user to schedule a GPU job that executes concurrently with an in-flight kernel memory management operation on an external buffer object, violating the DMA_RESV_USAGE_KERNEL cross-driver synchronization contract. Affected systems are those running Linux 6.8 or later with compatible Intel Xe-architecture GPU hardware and the xe driver loaded; the race can result in reading or writing memory that is simultaneously being evicted or relocated. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV), consistent with the low EPSS score of 0.17% at the 6th percentile.
Resource leak and premature mutex use in the Linux kernel's mlx5 InfiniBand driver (IB/mlx5) expose systems with Mellanox/NVIDIA ConnectX hardware to local privilege escalation, denial of service, and potential information disclosure. When mlx5_ib_alloc_transport_domain() successfully allocates a transport domain (TD) but mlx5_ib_enable_lb() subsequently fails, the TD object is never freed, leaking kernel memory. Compounding this, the loopback mutex (dev->lb.mutex) was initialized too late - after code paths that could use it - creating a window for undefined kernel behavior. No public exploit exists and EPSS sits at 0.17% (7th percentile), placing real-world risk well below the CVSS 7.8 headline score.
Out-of-bounds write in the Linux kernel's vfio/qat driver allows a local low-privileged user with access to the Intel QuickAssist Technology virtual function migration interface to corrupt kernel memory through a race condition. The root cause is a Time-of-Check Time-of-Use flaw in qat_vf_resume_write(), where two concurrent writers can both pass the filp->f_pos boundary check before the lock is held, causing the second writer to copy data past the end of the migration-state buffer once the first writer has already advanced the file position. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% at the 6th percentile reflects low current exploitation probability; vendor-released patches are available in stable kernel series 6.12.97, 6.18.40, and 7.1.5.
Use-after-free in the Linux kernel Bluetooth HCI core subsystem allows a local attacker with low privileges to corrupt kernel memory and potentially escalate privileges or crash the system. The hci_unregister_dev() function fails to quiesce cmd_timer and ncmd_timer delayed work items before freeing the hci_dev structure, creating a race window where timer callbacks dereference stale memory including the hdev->reset function pointer. EPSS is very low at 0.17% (6th percentile), no active exploitation has been confirmed, and patched versions are available across multiple Linux stable kernel branches.
Missing authorization on the handshake genl family's DONE downcall in Linux kernel 6.4 and later allows a local low-privileged process to forge TLS handshake completion signals to the kernel's TLS infrastructure. Any unprivileged user that can observe or guess a valid sockfd associated with an in-flight handshake request can submit a crafted DONE message - either with STATUS=0 to make the kernel consumer accept a session as if TLS authentication succeeded, or with a non-zero status to abort a legitimate handshake before the trusted agent tlshd can report its real result. No public exploit has been identified at time of analysis, and EPSS is very low (0.17%), but patches are confirmed across multiple stable branches.
Use-after-free in the Linux kernel's dibs loopback subsystem allows a local low-privileged attacker to corrupt kernel memory during concurrent DMB node attach, detach, and unregister operations. The vulnerability arises from a race window between hash table lookup under dmb_ht_lock and the subsequent refcount operation performed after the lock is dropped, enabling a concurrent unregister path to free the node before the refcount transition completes. With a CVSS score of 7.8 and C:H/I:H/A:H impact metrics, successful exploitation can lead to privilege escalation or kernel crash; however, no public exploit is identified at time of analysis and EPSS at 0.17% reflects low current exploitation probability.
Use-after-free in the Linux kernel's AFS (Andrew File System) subsystem exposes systems running the kafs module to kernel memory corruption exploitable by local low-privileged users, potentially enabling privilege escalation to root. The race condition in afs_make_call() allows the afs_call structure to be freed by an arriving async server response while the sending function - having transferred its reference rather than retaining one - continues to access the freed memory. EPSS is 0.17% (6th percentile), no CISA KEV listing exists, and upstream fix commits are publicly available on stable kernel trees.
Use-after-free in the Linux kernel pktgen subsystem exposes local attackers with low privileges to kernel memory corruption, potential privilege escalation, or system crash. The flaw arises from a race condition between pktgen_change_name() and pktgen_remove_device() on a shared proc_dir_entry pointer, allowing a kpktgend kernel thread to dereference a stale, freed pointer after a concurrent rename operation releases it. No public exploit code or active exploitation has been identified; EPSS stands at 0.17% (6th percentile), consistent with the niche production footprint of the pktgen testing module.
The Linux kernel's binder IPC driver contains a use-after-clear bug in binder_transaction() where lsmctx.len is re-read after security_release_secctx() has already zeroed the field via memset, causing sg_buf_end_offset to be inflated by the full aligned LSM security context size on every transaction to a txn_security_ctx binder node. This allows BINDER_TYPE_PTR scatter-gather copies to overrun into bytes already populated with the secctx data, enabling LSM security context disclosure and potential kernel buffer corruption. No public exploit or CISA KEV listing exists at time of analysis; the EPSS score of 0.17% reflects low current exploitation probability, though the low-privilege local attack vector is meaningful on Android where binder IPC is the foundational IPC mechanism.
Reference count corruption in the Linux kernel's Operating Performance Points (OPP) subsystem exposes systems to memory corruption and potential privilege escalation via a race condition between OPP object addition and frequency lookup. Affected kernels from 4.11 through stable branches predating commits to 7.1.5 and 6.18.40 are vulnerable when concurrent DVFS (Dynamic Voltage and Frequency Scaling) operations race during OPP table construction. No public exploit exists and EPSS sits at 0.17% (6th percentile), suggesting no known widespread exploitation; however, the H/H/H CVSS impact reflects the severity of kernel memory corruption if triggered.
Use-after-free in the Linux kernel's ALSA OSS sequencer subsystem allows a local low-privileged attacker to corrupt kernel heap memory by racing SysEx MIDI event dispatch against concurrent sequencer port closure. The vulnerable code path in snd_seq_oss_process_event() stores a raw pointer to SysEx byte data in the event record without retaining a refcount across the full dispatch lifecycle, enabling freed memory to be accessed in snd_seq_event_dup() if the OSS MIDI port is closed before dispatch completes. Vendor-released patches are available at kernel versions 6.18.40 and 7.1.5; no public exploit code and no active exploitation have been identified at time of analysis.
Out-of-bounds write in the Linux kernel BPF subsystem allows a local low-privileged user to corrupt memory by issuing a BPF_PROG_QUERY syscall with an undersized bpf_attr buffer that omits the query.revision field introduced in v6.6. The cgroup attach-type code path is the primary hazard: BPF_PROG_QUERY on cgroup types shipped in 2017, and the revision write-back was added years later, creating a real population of legacy callers whose smaller buffers trigger the unconditional OOB write. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the CVSS 7.8 high-impact rating reflects that successful kernel memory corruption can yield full system compromise.
Stale red-black tree node linkage in the Linux kernel BPF subsystem enables a use-after-free condition when a refcounted BPF object survives teardown of its owning rbtree root and that root's memory address is subsequently reused. Local attackers with BPF-capable low-privilege accounts can exploit the incorrect owner validation in bpf_rbtree_remove() to trigger rb_erase_cached() against stale, invalid tree pointers, potentially achieving kernel memory corruption with full confidentiality, integrity, and availability impact. No public exploit code has been identified and EPSS sits at the 6th percentile; patch commits are available across multiple stable branches.
Use-after-free in the Linux kernel mt76 MediaTek WiFi driver allows a local low-privileged attacker to dereference freed memory during concurrent TX datapath operations, potentially achieving full kernel compromise (C:H/I:H/A:H). The flaw exists in mt76_put_vif_phy_link(), where kfree() is called on an offchannel link structure immediately after rcu_assign_pointer(NULL) - without synchronizing against in-flight RCU readers in the TX softirq path (mt7996_mac_write_txwi) that already hold the pointer. No public exploit is identified at time of analysis, and EPSS of 0.17% (6th percentile) confirms very low current exploitation activity despite a CVSS score of 7.8.
Guest kernel crash in the Linux virtio RTC driver occurs during device restore when stale virtqueues are not cleaned up before reinitialization. Systems running virtual machines with a virtio-rtc device exposed are affected across Linux kernel versions up to 6.18.40 and 7.1.5 stable series. A local low-privileged user on the guest who triggers a suspend/resume cycle under conditions where virtqueue reinitialization fails can dereference a NULL info pointer in vp_del_vq(), panicking the guest kernel. No public exploit is identified at time of analysis, and EPSS of 0.17% (6th percentile) confirms exploitation is not currently widespread.
Use-after-free in the Linux kernel's BPF sockmap UDP receive path allows a local low-privileged attacker to corrupt kernel heap memory, enabling potential privilege escalation, kernel memory disclosure, or system crash. The race condition in udp_bpf_recvmsg() allows concurrent threads to access a sk_msg structure after it has been freed, because a prior refactor removed the lock_sock() serialization that TCP and AF_UNIX sockets retain. Discovered by Google's syzbot automated fuzzer on Google Compute Engine; no public exploit beyond that reproduction harness and no CISA KEV listing exist at time of analysis.
Sleepable BPF_LSM_CGROUP programs can be loaded into the Linux kernel without verifier rejection, causing a kernel BUG when those programs invoke blocking helpers inside an RCU read-side critical section. The cgroup BPF shim runs under rcu_read_lock_dont_migrate(), which prohibits sleeping; if a program marked BPF_F_SLEEPABLE attaches to an LSM cgroup hook such as file_open and calls bpf_get_dentry_xattr(), the kernel triggers a 'sleeping function called from invalid context' BUG. No public exploit identified at time of analysis; EPSS at 0.17% reflects the niche exploitation path requiring BPF-loading capability.
Use-after-free and kernel crash exposure in the Linux kernel's MIPI I3C HCI driver stems from a locking gap between the IRQ handler and the bus device list. The `i3c_hci_addr_to_dev()` function traverses the bus device list from interrupt context without holding `bus.lock`, while concurrent I3C core operations can mutate that list under the lock - creating a window where the IRQ handler dereferences stale or freed device pointers. No public exploit code exists and EPSS sits at 0.16%, but exploitation on a system with I3C HCI hardware and active device hotplug could yield privilege escalation or a kernel panic.
Deadlock and use-after-free conditions in the Linux kernel's IDXD character device driver expose local low-privileged users on Intel DSA-equipped systems to potential kernel memory corruption or denial of service. The vulnerability resides in `idxd_cdev_open()`, where error cleanup paths call `put_device(fdev)` while still holding `wq->wq_lock`, causing `idxd_file_dev_release()` to deadlock on synchronous reentry; a secondary fallthrough defect then allows `idxd_xa_pasid_remove(ctx)` and `kfree(ctx)` to operate on memory already freed by that release callback. No public exploit has been identified at time of analysis, and an EPSS score of 0.16% (6th percentile) reflects the low observed exploitation probability consistent with the specialized hardware prerequisite.
Use-after-free in the Linux kernel's RDS/TCP subsystem allows a local authenticated attacker to read freed kernel memory via a race condition in `rds_tcp_laddr_check()`, potentially enabling privilege escalation. The flaw is triggered through the `bind()` syscall when the RCU read lock is incorrectly released between a `dev_get_by_index_rcu()` lookup and a subsequent `ipv6_chk_addr()` call, creating a window for concurrent interface deletion to free the `net_device` struct. No public exploit is identified at time of analysis, and EPSS of 0.16% (5th percentile) indicates low near-term exploitation probability despite the CVSS 7.8 High rating.
Use-after-free in the Linux kernel's nf_tables netfilter subsystem exposes local attackers with low-privilege accounts to potential kernel-level privilege escalation by exploiting a race condition in nft_object lifecycle management across network namespaces. The nft_object rhltable was implemented as a global structure, meaning that as one network namespace tears down its objects via nft_rcv_nl_event(), another namespace can still resolve pointers to those objects through the shared lookup table - and since nft_obj_destroy() frees memory immediately, a concurrent lookup dereferences freed memory. No active exploitation has been identified (not in CISA KEV) and EPSS sits at 0.16% (5th percentile), though the vulnerability's kernel-level impact warrants patching on multi-tenant and containerized Linux hosts.