Out-of-bounds slab read in the Linux kernel's binfmt_misc subsystem allows local low-privileged users - including those operating within unprivileged user namespaces - to trigger heap memory exposure or a kernel crash by registering a binary format with a flag character ('P', 'O', 'C', or 'F') as the field delimiter. The flaw exists because check_special_flags() consumes flag characters without using the delimiter as a terminator, swallowing the 8-byte padding appended by create_entry() and reading past the end of the allocated buffer. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates low near-term exploitation probability; however, reachability from unprivileged user namespaces on most modern Linux distributions meaningfully broadens the real-world attack surface.
Out-of-bounds slab read in the Linux kernel keyring subsystem's `keyring_get_key_chunk()` exposes kernel heap memory and enables potential kernel crashes from any unprivileged local user account. Affected kernels fail to bounds-check the full computed byte offset when walking description-level key chunks, allowing reads past a `kmemdup`-allocated buffer. This is reachable via the standard `add_key(2)` syscall with no elevated privileges and is confirmed by KASAN as a slab-out-of-bounds read; no public exploit exists and EPSS is 0.16% (5th percentile), but multi-tenant and container environments with untrusted local users face meaningful exposure.
Uninitialized memory access in the Linux kernel's netfilter xt_hashlimit module allows local users with netfilter rule configuration privileges to read uninitialized kernel memory and potentially corrupt rate-limiting state. The flaw exists in the .checkentry validation path, which failed to detect when XT_HASHLIMIT_RATE_MATCH mode is applied across multiple rules sharing the same hashtable, leaving the burst field in the dsthash_ent union uninitialized. No public exploit or CISA KEV listing exists at time of analysis; an EPSS score of 0.16% reflects low near-term exploitation probability.