Authentication bypass in the User Profile Builder WordPress plugin (versions through 3.16.4) lets unauthenticated attackers log in as the site's Administrator (user ID 1) by submitting a registration with a 61-70 character username, resulting in full site takeover. The flaw is a PHP type-confusion bug where an error object is silently coerced to the integer 1, binding an autologin nonce to the admin account. Rated CVSS 9.8; no public exploit identified at time of analysis, though the fix commit publicly reveals the exact defective code path.
Unauthenticated privilege escalation in the Pods - Custom Content Types and Fields plugin for WordPress (all versions through 3.3.9) lets remote attackers bypass every authorization guard on the pods_admin AJAX router and perform administrator-level actions. Because failed checks return false instead of halting execution, an attacker with no account can promote themselves to Administrator or overwrite any user's password - including the site owner's - leading to full site takeover. Reported by Wordfence; no public exploit identified at time of analysis, though the root cause is precisely described.
Arbitrary file write in Pandora (pandora-analysis), an open-source file/malware analysis platform, arises from unsafe TAR extraction where archive member names were passed to Python's tarfile.extract() without a safety filter. An attacker who submits a crafted TAR containing ../ sequences or absolute paths can write files outside the intended extraction directory, potentially overwriting files owned by the Pandora worker and escalating to code execution or denial of service. No public exploit identified at time of analysis, though the upstream fix commit is public and the flaw is trivially reproducible.
Incorrect IPv4 FIB route resolution in the Linux kernel causes error routes (e.g. 'unreachable') in the merged local/main routing table to be silently overwritten by matching routes in the default table. This occurs specifically when CONFIG_IP_MULTIPLE_TABLES is compiled in but no routing rules have been added, so fib_lookup() fails to bail out after the first table lookup. The result is that traffic which should be blocked/dropped is instead routed, undermining routing-based access-control expectations; no public exploit identified at time of analysis and EPSS probability is low (0.22%).
Improper error-path cleanup in the Linux kernel's Marvell OcteonTX crypto hardware-accelerator driver (crypto/marvell/octeontx) mishandles DMA unmapping: on a mapping failure the sg_cleanup loop indexes list[i] instead of list[j], leaking successfully mapped scatter-gather entries while repeatedly unmapping the already-failed one. Only systems with Marvell OcteonTX crypto hardware and this driver loaded are affected. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile) and the issue is not in CISA KEV.
Out-of-bounds access in the Linux kernel's GENEVE tunnel GRO (Generic Receive Offload) path affects systems using GENEVE overlay networking, where geneve_gro_complete() can re-derive an inner dispatch offset that disagrees with what geneve_gro_receive() recorded - either through a race with geneve_quiesce()/geneve_unquiesce() flipping gs->gro_hint, or through re-read option bytes differing from the parsed ones - and complete GRO past the validated inner network header. Successful triggering leads to memory-safety corruption in softirq packet processing, most plausibly a kernel crash (denial of service). This is fixed upstream; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Resource-leak and repeated-unmap defect in the Linux kernel's Cavium/Marvell CPT cryptographic accelerator driver (crypto/cavium/cpt) mishandles its DMA error-cleanup path, using the outer loop index (list[i]) instead of the inner index (list[j]) so that successfully mapped scatter-gather entries leak while the single failed entry is unmapped repeatedly. It affects only systems running the cavium CPT driver against OcteonTX CPT hardware, is reachable solely when a DMA mapping failure occurs during request setup, and is a local reliability/resource-management bug rather than a remotely exploitable code-execution flaw. No public exploit identified at time of analysis; EPSS is 0.18% (7th percentile) and it is not in CISA KEV.
Race-condition torn read in the Linux kernel's VXLAN driver (route_shortcircuit()) allows the neighbour hardware address (n->ha) to be read without holding the n->ha_lock seqlock, producing a partially-updated or corrupted MAC address while the neighbour subsystem concurrently updates it. Fixed by switching to neigh_ha_snapshot() for a seqlock-protected read. No public exploit identified at time of analysis; EPSS is 0.17% (6th percentile), and despite the assigned CVSS of 10.0 the practical impact is a minor data-integrity/read-consistency issue in VXLAN forwarding, not a genuine critical remote compromise.
Incorrect IRQ-to-ring mapping in the Linux kernel's vdpa/octeon_ep driver mishandles interrupt routing on Marvell OCTEON EP devices that expose non-contiguous or non-zero-based IRQ numbers, causing the interrupt handler to index the wrong virtqueue ring. Only systems with OCTEON EP hardware using the vDPA data path are affected, and the fix ships in stable kernels 6.18.40, 7.1.5, and 7.2-rc1. There is no public exploit identified at time of analysis, EPSS is very low (0.17%, 6th percentile), and the published 10.0 CVSS vector is inconsistent with the local, hardware-specific nature of the flaw.
Out-of-bounds kernel memory read in the Linux kernel's GENEVE tunnel GRO path (drivers/net/geneve.c) affects tunnels that have not enabled the IFLA_GENEVE_GRO_HINT feature - which is the default. geneve_gro_complete() honours an attacker-supplied GRO hint option unconditionally while geneve_gro_receive() ignores it, so the two paths disagree and dispatch the inner gro_complete handler at an unvalidated offset (nhoff + gh_len), reading past the skb head. Confirmed via a KASAN slab-out-of-bounds report in ipv6_gro_complete; there is no public exploit identified at time of analysis and EPSS is low (0.16%).
Kernel memory corruption in the Linux networking stack lets a local actor trigger a slab use-after-free in the packet-processing path (fib_rules_lookup) via a TOCTOU race in enqueue_to_backlog(). The flaw affects the per-CPU backlog flushing during device unregistration/network-namespace teardown, where a lockless transmitter such as veth_xmit can queue a packet that escapes flush_all_backlogs() and is later dereferenced after free. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and it is not on CISA KEV, so this is a defect fixed upstream rather than an actively-exploited threat.
Authentication bypass in the 6Storage Rentals WordPress plugin (versions up to and including 2.27.0) lets unauthenticated attackers log in as any existing WordPress account, including administrators, simply by submitting the victim's email address. The flaw stems from the six_storage_create_wp_user() AJAX handler being exposed to unauthenticated callers while it silently establishes an authenticated session for the resolved user. No public exploit has been identified at time of analysis, but exploitation is trivial and the CVSS score of 9.8 reflects full compromise via a single crafted request.
Account takeover in the TrueBooker appointment-booking plugin for WordPress (all versions through 1.2.6) lets remote attackers hijack any account, including administrators. The add_front_user_update() AJAX action is exposed to unauthenticated visitors and trusts a caller-supplied truebooker_wp_user_id, so an attacker can rewrite an admin's email address and then use WordPress's built-in password-reset flow to seize the account. No public exploit has been identified at time of analysis, but the flaw is trivially exploitable and carries a CVSS of 9.8.
Authentication bypass and full account takeover in the User Session Synchronizer WordPress plugin (versions ≤1.4.0) lets unauthenticated attackers log in as any user, including administrators, by abusing the init-hooked synchronize_session() handler. Because an unregistered ussync-key slot makes get_option() return false, the AES-256-CBC key silently degrades to the predictable md5('') and the referer allowlist collapses to an empty match, while the IV is hard-coded, so an attacker who knows or guesses a target email can forge a valid ussync-ref token. No public exploit is identified at time of analysis and the flaw is not in CISA KEV, but the CVSS 9.8 rating and trivial cryptographic prerequisites make weaponization straightforward.
Password reset link poisoning in the Perl module Dancer2::Plugin::Auth::Extensible (all versions through 0.713) lets an unauthenticated remote attacker trigger a genuine reset email whose link points to an attacker-chosen host, enabling account takeover. Because the reset link's authority is built from the untrusted request Host header (or X-Forwarded-Host under behind_proxy), a victim who clicks hands a valid reset code to the attacker's server. There is no public exploit identified at time of analysis; EPSS is low (0.28%, 21st percentile) and CISA SSVC lists exploitation as none, but the flaw is marked automatable with total technical impact.
Heap out-of-bounds write in the Linux kernel NVMe-oF target (nvmet) DH-HMAC-CHAP authentication handler lets a remote NVMe-oF initiator corrupt kernel heap memory when in-band authentication is enabled. nvmet_execute_auth_receive() trusts the host-supplied AUTH_RECEIVE allocation length after only checking it is nonzero, so the SUCCESS1 and FAILURE1 response builders write a fixed-size DH-HMAC-CHAP message into an undersized kmalloc() buffer, producing a 16-byte OOB write from a one-byte allocation length. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.25%, 17th percentile).
Improper validation of SCTP COOKIE-ECHO data in the Linux kernel's SCTP stack allows a remote peer to have tampered INIT chunk parameters processed by the server when cookie authentication (cookie_auth_enable) is disabled. Because the server previously reconstructed and trusted the INIT embedded in the returned cookie without re-verifying it, a manipulated cookie could drive parameter parsing beyond the embedded INIT's real bounds, risking out-of-bounds reads (information disclosure) or association instability. No public exploit has been identified at time of analysis, EPSS is low (0.25%), and the issue is not in CISA KEV; the fix adds sctp_verify_init() re-validation after cookie unpacking.
Denial-of-service in the Linux kernel ntfs3 driver lets an attacker with the ability to mount a crafted NTFS image panic the system via unbounded recursion. indx_find_buffer() descends the NTFS B+ tree index with no depth limit, so a circular index-node reference overflows the kernel stack when a file deletion hits the index rebalancing fallback path. No public exploit is identified and it is not in CISA KEV; EPSS is low at 0.23%. Note that the supplied CVSS 9.8/AV:N vector is inconsistent with the description, which requires local access to attach a malicious filesystem.
An out-of-bounds kernel write in the Linux kernel's dm-verity Forward Error Correction (FEC) code allows corruption of adjacent kernel memory when Reed-Solomon erasure recovery is triggered. An off-by-one in the erasure-counting logic lets the erasure count reach roots+1, which is then passed to decode_rs8() and overruns the lambda[] locator polynomial by one element, clobbering the syndrome buffer (syn[0]). It affects Linux systems using dm-verity with FEC enabled; there is no CISA KEV listing, no public exploit identified, and EPSS is low (0.22%, 13th percentile), indicating this is a memory-safety defect rather than an actively exploited threat.
Kernel memory disclosure and denial-of-service in the Linux kernel OrangeFS client affects systems mounting OrangeFS parallel filesystems, where fill_from_part() truncates a 64-bit directory-entry length into a __u32. An entry length near U32_MAX wraps to a small value that slips past the bounds check and is then used to index the directory part, causing an out-of-bounds read that oopses the kernel. The malformed trailer is supplied by the userspace OrangeFS client, and there is no public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and this is not in CISA KEV. Note: the input CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) conflicts with the description, which describes a local, client-supplied-data OOB read rather than remote unauthenticated code execution.
Memory-safety flaw in the Linux kernel's netfilter SIP NAT helper (net/netfilter/nf_nat_sip.c) allows a stale, freed data pointer to be used after skb_ensure_writable() reallocates a cloned socket buffer, potentially corrupting kernel memory or crashing the host when SIP connection tracking and NAT are active. The bug affects systems using the nf_nat_sip application-layer gateway; because SIP conntrack linearizes SKBs, only clones (not fragments) trigger it, and a secondary error path could invoke UDP mangling on a TCP stream. No public exploit is identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not in CISA KEV.
Use-after-free in the Linux kernel's batman-adv mesh networking module (net/batman-adv unicast path) occurs because the unicast_packet pointer is not reassigned after pskb_may_pull() inside batadv_get_vid() may reallocate the socket buffer, leaving a stale pointer into freed memory. Systems running batman-adv B.A.T.M.A.N. advanced mesh routing are affected across a wide range of stable kernel series. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.22%, 13th percentile).
Integer-overflow-driven out-of-bounds access in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh networking module allows a node on the same mesh to corrupt translation-table processing via a crafted TT unicast TVLV. The VLAN count (u16) multiplied by the 8-byte batadv_tvlv_tt_vlan_data size overflows the u16 length variable, defeating every downstream bounds check that guards the TVLV buffer. This is a fixed, patched kernel bug with a low EPSS (0.22%, 13th percentile) and no public exploit identified at time of analysis; it is not listed in CISA KEV.
Out-of-bounds read in the Linux kernel NVMe-over-Fabrics RDMA target (nvmet-rdma) allows a connected fabric host to make the target map inline data at an attacker-chosen offset, corrupting the per-command scatterlist. When a port is configured with inline_data_size greater than PAGE_SIZE, an offset in the (PAGE_SIZE, inline_data_size] range causes the 'PAGE_SIZE - off' calculation to underflow and sets sg->length to roughly 4 GiB, so the block backend reads far past the first inline page, leaking adjacent kernel memory and risking a crash. No public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile), but the flaw is patched across all maintained stable branches.
Use-after-free in the Linux kernel's LIO SCSI target core (iSCSI transport) lets an initiator that can issue a PERSISTENT RESERVE OUT / REGISTER AND MOVE command trigger reads of an unmapped kernel virtual address, risking information disclosure or a kernel crash. The flaw exists only in the target-mode stack (drivers/target) and only manifests when the PR OUT parameter list exceeds one page (>4096 bytes), forcing transport_kmap_data_sg() down its vmap()/vunmap() path. EPSS is low (0.22%, 13th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
Kernel-level use-after-free in the Linux 9p RDMA transport (net/9p, trans_rdma.c) arises from a race on the unsynchronized rdma->state field, where recv_done() in softirq context and p9_cm_event_handler() mutate state without the req_lock that rdma_request() relies on. Concurrent teardown can silently overwrite a FLUSHING transition with CLOSING, corrupting the connection state machine and freeing RDMA request objects still in use - enabling denial of service and potential local privilege escalation on systems mounting 9p over RDMA. No public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and the flaw is not in CISA KEV.
Out-of-bounds read in the Linux kernel's Generic UDP Encapsulation (GUE) tunnel receive path lets remote attackers read adjacent packet memory by sending malformed GUE packets that set the GUE_PFLAG_REMCSUM private flag without carrying the corresponding remote-checksum start/offset bytes. Because guehdr_priv_flags_len() failed to account for GUE_PLEN_REMCSUM, such truncated packets slipped past validate_gue_flags() and were then processed by gue_remcsum()/gue_gro_remcsum(), which read the missing fields from following bytes. There is no public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and the flaw is not in CISA KEV, so despite the headline CVSS 9.8 the realistic impact is information disclosure/instability rather than confirmed remote code execution.
Memory corruption in the Linux kernel qede network driver (QLogic/Marvell FastLinQ 40/100GbE) arises because qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a NULL return from qede_build_skb(), consuming an extra buffer descriptor and desynchronizing the RX BD ring. The resulting off-by-one can corrupt DMA page reference counts and trigger SLUB freelist corruption, most plausibly a kernel-crash denial of service rather than reliable code execution. No public exploit has been identified and it is not in CISA KEV; the low EPSS (0.22%, 13th percentile) reflects that the bug only manifests under kernel memory pressure.
Kernel panic (and potential memory corruption) in the Linux kernel's IPv6 multicast stack arises from a use-after-free in the MLD delayed-work path, where a race between network-device teardown and incoming MLD query processing lets igmp6_event_query() take a reference on an inet6_dev whose refcount has already reached zero. Affected systems run kernels across the 2.6.12-through-7.x range prior to the fixed stable releases, and successful triggering causes a refcount 'addition on 0' warning followed by access to freed memory once the scheduled work runs. There is no public exploit identified at time of analysis, EPSS risk is low (0.22%, 13th percentile), and it is not listed in CISA KEV.
Improper handling of ICMP error packets in the Linux kernel's IPVS (IP Virtual Server) subsystem allows crafted ICMP errors from tunneled traffic to reference inner IP headers that are not guaranteed to reside in the skb headroom after pskb_pull() strips the outer headers, leading to out-of-bounds access in path-MTU update, icmp_send() and debug paths. The flaw affects hosts using IPVS load balancing with tunnel encapsulation; the practical consequence is an out-of-bounds read (information disclosure per source tags) or kernel crash rather than code execution. No public exploit identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not listed in CISA KEV.
Memory-safety flaw in the Linux kernel's legacy NTFS (read) driver lets a crafted NTFS filesystem image bypass a resident/non-resident attribute check in ntfs_map_runlist_nolock(). When the driver expects a non-resident attribute during mount, an attacker-supplied image can substitute a resident attribute; the code previously only flagged this with a non-fatal WARN_ON() and then read a->data.non_resident.highest_vcn from the wrong union member, corrupting the VCN range check. The fix replaces WARN_ON() with an -EIO return so the malicious image is rejected at mount. There is no public exploit identified at time of analysis, and EPSS is low (0.22%).
Heap out-of-bounds write in the Linux kernel's ntfs3 filesystem driver lets a local user corrupt kernel slab memory by mounting and accessing a crafted NTFS image. When indx_insert_into_root() promotes a full resident $INDEX_ROOT into $INDEX_ALLOCATION, hdr_insert_head() copies resident entry bytes ('to_move') sized from on-disk data into a destination buffer sized from an attacker-shrunk root->index_block_size, writing 120-136 bytes of attacker-controlled data past a kmalloc allocation. The flaw is fixed across multiple stable trees; there is no public exploit identified at time of analysis and EPSS is low (0.21%), and despite the NVD CVSS of 9.8 the described trigger is local rather than network-reachable.
Kernel out-of-bounds read in the Linux SCSI target (LIO/TCM) subsystem lets a SCSI initiator crash the host by sending a malformed PERSISTENT RESERVE OUT command. The iSCSI TransportID parser (target_parse_pr_out_transport_id / iscsi_parse_pr_out_transport_id) scans for the ',i,0x' ISID separator with an unbounded strstr(), so a TransportID whose iSCSI name has no separator and no NUL terminator runs the scan off the end of a multi-page vmap buffer into the vmalloc guard page, oopsing the kernel (KASAN: vmalloc-out-of-bounds). It is reachable by any fabric delivering PR OUT to an iSCSI-exported device, including a guest via vhost-scsi. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and it is not in CISA KEV.
Memory corruption in the Linux kernel's xprtrdma (RPC-over-RDMA / NFS-over-RDMA) transport arises from a use-after-free in request-slot lifetime management: the RPC Reply handler could drop the rl_kref refcount to zero and return an rpcrdma_req to its free pool while the RDMA HCA was still DMA-reading from that request's send buffer, specifically when a Send carried only pre-registered buffers (sc_unmap_count == 0). This affects Linux systems using RPC-over-RDMA transport (introduced around 5.3) and is fixed by decoupling req recycling from RPC completion. EPSS is low (0.21%, 12th percentile) and there is no public exploit identified at time of analysis; the auto-assigned 9.8 CVSS overstates real-world risk for a race-condition kernel bug on a niche transport.
Out-of-bounds read and receive-buffer leak in the Linux kernel's RPC-over-RDMA client transport (xprtrdma) let a malicious or malfunctioning RDMA peer send a short or malformed reply that is misclassified as a backchannel call. The flaw causes the kernel to read up to 20 bytes of stale DMA buffer contents past the wire payload and to orphan a persistently DMA-mapped receive buffer, progressively draining the Receive queue until the peer's Sends draw RNR NAKs. No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.21%); despite the NVD-assigned 9.8 CVSS, the real-world impact is bounded to limited information exposure and connection-level denial of service on systems actually using RPC/RDMA.
Improper memory-barrier handling in the Linux kernel's netfilter ipset subsystem affects hash-type sets, where lockless RCU readers used the relaxed test_bit() operation instead of test_bit_acquire(), allowing readers running concurrently with add/delete/garbage-collection to observe stale or improperly ordered bit state. The flaw was fixed upstream and backported to stable trees; there is no public exploit identified at time of analysis and it is not in CISA KEV, and the EPSS score is very low (0.21%). Despite an automated NVD CVSS of 9.8, the defect is a memory-ordering race in a kernel packet-filtering path rather than a straightforward remote code execution primitive.
Use-after-free in the Linux kernel's in-kernel SMB server (ksmbd) lets a remote client that opens an SMB connection race two concurrent SMB2 NEGOTIATE requests to trigger a slab UAF read of the shared conn->preauth_info structure (kmalloc-96). The response send path smb3_preauth_hash_rsp() reads and dereferences conn->preauth_info->Preauth_HashValue without holding conn_lock, so one worker can free the object on the failing-negotiate path while another reads it - a window a bare NULL check cannot close. Exploitation is pre-authentication over the network but requires ksmbd to be actively serving shares plus precise timing; EPSS is low (0.21%, 12th percentile), it is not on CISA KEV, and no public exploit identified at time of analysis.
Out-of-bounds array access in the Linux kernel's NXP ENETC Ethernet driver (net/ethernet/freescale/enetc) occurs on the XDP_REDIRECT transmit path when an xdp_frame carries a number of fragments greater than or equal to ENETC_MAX_SKB_FRAGS, overrunning the fixed-size xdp_redirect_arr buffer-descriptor array. Affected are systems using NXP/Freescale ENETC MACs (e.g., LS1028A-class SoCs) with an XDP program that performs redirect on multi-buffer frames, introduced in 5.13 and fixed across current stable branches. No public exploit identified at time of analysis, and EPSS is low (0.21%, 12th percentile), consistent with a driver-specific memory-safety bug rather than a broadly exploited flaw.
Information disclosure and TCP flow corruption in the Linux kernel's IPVS (IP Virtual Server) load balancer arises because ip_vs_conn_new() only zeroes the delta fields of its two ip_vs_seq structures, leaving init_seq and previous_delta filled with stale slab data. A director acting as a connection-sync backup can hash a connection with IP_VS_CONN_F_IN_SEQ/OUT_SEQ flags set (inherited from IP_VS_CONN_F_BACKUP_MASK) while an attacker-supplied sync message omits IPVS_OPT_SEQ_DATA, so an IPVS application helper later rewrites forwarded TCP sequence/ack numbers using uninitialized kernel memory. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and the issue is not in CISA KEV.
Incorrect IPv6 transport-header offset handling in the Linux kernel's IPVS (IP Virtual Server) load-balancing subsystem causes application-layer helper code and ICMPv6 checksum validation to misread packet headers when IPv6 traffic - particularly packets carrying extension headers - is processed. The IPVS TCP application path wrongly assumed an IPv4 network header even after the ipvsh offset argument was supplied, and ip_vs_out_icmp_v6() used an incorrect ICMPv6 offset. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and this is not on CISA KEV, and for the only in-tree app (FTP) the maintainers note the effect is harmless because port mangling is handled by Netfilter without TCP sequence adjustment.
Memory corruption in the Linux kernel network scheduler (net/sched/sch_codel) allows a privileged local user to trigger a wild/dangling pointer dereference by mis-accounting queue length during the CoDel peek operation. When CoDel drops packets during peek it calls qdisc_tree_reduce_backlog before re-incrementing qlen; if qlen momentarily hits zero while peek still returns an skb, the parent qdisc's qlen_notify prematurely deactivates the class, corrupting scheduler state (demonstrated as a KASAN wild-memory-access in qfq_deactivate_agg when qfq parents a codel child). No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and this is not in CISA KEV.
Kernel-side race condition in the Linux SUNRPC server's TLS handshake path (svc_tcp_handshake) allows a lost cancellation race to corrupt an embedded swait_queue or prematurely tear down a succeeding handshake, leading to kernel memory corruption or connection instability on NFS/RPC servers using RPC-with-TLS. Affects servers that terminate kernel RPC TLS sessions; it is a resolved upstream kernel bug with no public exploit and a very low EPSS (0.21%, 11th percentile), and it is not in CISA KEV. Despite the NVD-propagated 9.8 rating typical of auto-generated kernel CVEs, the practical impact is a narrow timing window affecting availability/state integrity rather than turnkey remote code execution.
Out-of-bounds slab write in the Linux kernel SUNRPC layer (xdr_buf_to_bvec()) lets a remote NFS client corrupt kernel memory via the in-kernel NFS server (nfsd) write path. The function stores a bio_vec into the caller's rq_bvec array before verifying the slot is in range - and the head branch stores with no check at all - so when the exactly-sized rq_maxpages budget is used up, one bio_vec lands past the array into adjacent slab memory, with attacker-influenced bv_len and bv_offset values taken from client-supplied RPC payload sizes. Rated CVSS 9.8 by the source, but with low EPSS (0.21%), no CISA KEV listing, and no public exploit identified at time of analysis.
Out-of-bounds kernel write in the Linux kernel's ntfs3 filesystem driver allows a local attacker to corrupt kernel memory and panic the system by mounting a crafted NTFS image and performing a single directory operation. The flaw lives in indx_insert_into_buffer(), where an unvalidated split-point size from hdr_find_split() causes a u32 subtraction underflow and a near-4-GiB memmove. A vendor fix is available across multiple stable branches; EPSS is low (0.21%) and no public exploit is identified at time of analysis, though the trigger is trivial (a 'touch' on a mounted attacker-supplied image).
Kernel memory corruption (double free) in the Linux kernel's XFRM/IPsec NAT keepalive path allows a crash or potential heap exploitation when a keepalive transmission fails after the socket buffer has already been handed to the IPv4/IPv6 output stack. Introduced with the nat_keepalive feature in Linux 6.11 and affecting recent stable branches, nat_keepalive_send() incorrectly frees an skb that ip_build_and_send_pkt() or ip6_xmit() may already have consumed, producing a double free. EPSS is low (0.21%, 11th percentile), no public exploit has been identified, and it is not listed in CISA KEV; despite the auto-assigned 9.8 CVSS, realistic impact centers on denial of service and requires an IPsec NAT-traversal configuration.
Local privilege escalation / memory corruption in the Linux kernel's PREEMPT_RT locking substitution stems from rt_spin_unlock() (and the rwlock substitution) releasing RCU read-side protection before completing the unlock, creating a use-after-free window where an object freed via kfree_rcu() can be accessed by rt_mutex_cmpxchg_release(). Only PREEMPT_RT (real-time) kernel builds are affected, since regular spinlocks keep preemption disabled across unlock and thus retain full RCU protection. The upstream fix has been merged and backported to multiple stable trees; no public exploit identified at time of analysis, and EPSS is low (0.21%).
Out-of-bounds memory access in the Linux kernel MANA (Microsoft Azure Network Adapter) Ethernet driver arises because the RX completion queue entry (CQE) packet length reported by the NIC was passed to skb processing without validation. Affected systems are Linux VMs running the mana_en driver, predominantly Azure guests using MANA/SR-IOV networking. A NIC (or malicious hypervisor/device) supplying a crafted oversized length can trigger an out-of-bounds read leading to information disclosure or a kernel crash; the vulnerability is tagged Information Disclosure, has no public exploit identified at time of analysis, and carries a low EPSS of 0.21%.
Use-after-free memory corruption in the Linux kernel's NFSv4 client fixes a race in file-lock list traversal, where nfs_delegation_claim_locks, nfs4_locku_done, and nfs4_lock_done manipulated the inode file-lock list without holding nfsi->rwsem, allowing the list to change under iteration during delegation recall and lock reclaim. The fix serializes traversal under nfsi->rwsem and relocates locks_lock_inode_wait into _nfs4_proc_setlk. This is a locally-triggered kernel race affecting NFSv4 client mounts; no public exploit identified at time of analysis, EPSS is low (0.21%), and it is not on CISA KEV.
Denial-of-service (and potential use-after-free) in the Linux kernel's xfrm/IPsec state-cache logic lets a stale state be inserted into the input-path cache because the state's validity is checked before the global xfrm_state_lock is taken. In the window between the check and the lock, a concurrent operation can kill the state, so a dead (freed-path) state gets cached and later dereferenced on the IPsec input path. Despite an auto-generated 9.8 CVSS, real-world signals are modest: EPSS is 0.21% (11th percentile), the issue is tagged Denial of Service, it is not in CISA KEV, and no public exploit was identified at time of analysis.
A use-after-free in the Linux kernel's in-kernel SMB3 server (ksmbd) durable-handle path lets a concurrent SMB2 durable reconnect (DH2C/DHnC) read the freed fp->owner.name buffer via strcmp() in ksmbd_vfs_compare_durable_owner(), as caught by KASAN. Only systems that enable and export shares over ksmbd are affected, and exploitation requires winning a tight race between two reconnects on the same persistent_id. No public exploit identified at time of analysis, and EPSS is low (0.21%), consistent with a hard-to-time kernel race rather than a turnkey remote exploit despite the 9.8 input score.