Privilege escalation in WWBN AVideo through commit 9c39d8c8 enables any user with upload permission to silently hijack an administrator session without knowing their credentials. Two chained functions - deduplicateByEncoderQueueId() exposing video hash tokens without ownership verification, and useVideoHashOrLogin() accepting those tokens as passwordless authentication - create a direct path from low-privilege user to full administrative access. No public exploit has been confirmed and the vulnerability is not listed in CISA KEV, but the low attack complexity and high CIA impact make this a high-priority remediation for any internet-accessible AVideo deployment.
Unbounded recursion in NLTK's JSONTaggedDecoder.decode_obj() (nltk/jsontags.py) allows unauthenticated remote attackers to crash the Python process by submitting a deeply nested JSON payload exceeding Python's default recursion limit of 1000. All NLTK releases before 3.9.4 are affected; exploitation depends on whether the calling application exposes JSONTaggedDecoder to externally-supplied JSON input. A public proof-of-concept is included in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated remote attackers can invoke the onAjax_getFolders AJAX method in the Fabrik Extension for Joomla to enumerate arbitrary server-side directories, exposing file system structure without credentials or user interaction. All versions from 1.0.0 through 4.7.1 are affected across the extension's full release history; version 4.7.2 was released to remediate the flaw. No public exploit code or CISA KEV-confirmed active exploitation has been identified at time of analysis, though the unauthenticated network-accessible nature of the endpoint lowers the bar for opportunistic reconnaissance by automated scanners.
Path traversal and pickle deserialization protections in NLTK before 3.10.0 are effectively disabled by default - pathsec.py sets ENFORCE=False, causing all security validation to emit warnings rather than raise blocking exceptions. Any application using NLTK to process untrusted file paths or serialized data is exposed unless operators have explicitly overridden this default. No public exploit has been identified at time of analysis, but the attack surface is significant wherever NLTK handles attacker-controlled inputs, particularly given that Python pickle deserialization can enable arbitrary code execution.
Unauthorized access to restricted video content in WWBN AVideo (through commit 9c39d8c8) is enabled by a fundamental design flaw in the platform's token subsystem: getToken() produces tokens with no binding to user identity or intended purpose, and the Gallery plugin endpoint (plugin/Gallery/view/sections.php) distributes these tokens freely to unauthenticated visitors. Because the tokens carry no scope constraint, they are accepted as valid authorization across unrelated subsystems including the HLS streaming endpoint (view/hls.php), allowing any remote unauthenticated party to retrieve private video content. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a trivially simple, two-step attack requiring no special tools.
Unauthenticated arbitrary file upload to the web root is possible in Fabrik (a Joomla extension by fabrikar.com) versions 1.0.0 through 4.7.1, via the list email plugin controller which applies no access control before processing uploads. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero authentication and zero complexity requirements against any publicly reachable Joomla deployment running the affected extension. The description constrains uploads to non-executable files, which limits direct remote code execution on hardened servers, but still enables web root content injection, defacement, and potential escalation on misconfigured systems. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated table truncation in the Fabrik Extension for Joomla (versions 1.0.0 through 4.7.1) allows any remote attacker to destroy data by issuing a single HTTP GET request to the list.doempty controller action. The endpoint lacks all ACL gates, making exploitation trivially automatable against any publicly accessible Joomla installation running the affected component. No public exploit has been identified at time of analysis, but the absence of any authentication or complexity barrier means the effective exploitation threshold is near zero.
Unauthenticated database schema disclosure in Fabrik for Joomla (versions 1.0.0-4.7.1) exposes arbitrary table names, column listings, and the Joomla database table prefix to any remote attacker without credentials. The vulnerable ajax_tables method in the extension's elements model responds to AJAX requests without enforcing access control, violating the principle of least privilege (CWE-284). No public exploit code or active exploitation has been identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects the low attack complexity and the high value of schema metadata for downstream attacks.
TLS hostname verification is silently bypassed in Netty's OpenSSL client path, allowing a network man-in-the-middle attacker to intercept encrypted communications by presenting a certificate issued for a different hostname. Affected are applications using io.netty:netty-handler versions 4.2.0.Final through 4.2.16.Final or any 4.1.x through 4.1.136.Final, specifically when the SslProvider.OPENSSL client path is configured with a plain X509TrustManager and running on Java 25 or later, where Unsafe-based trust-manager wrapping is unavailable. No public exploit code has been identified at time of analysis, but the confidentiality impact is high for any affected deployment that transmits sensitive data over TLS.
Stored cross-site scripting in JoomGallery (Joomla extension by joomgalleryfriends.net) versions prior to 4.3.1 allows a privileged authenticated attacker to inject a persistent JavaScript payload into image metadata, which then executes in the browser of every subsequent visitor who views that image or gallery. The attacker plants the payload once and it fires automatically for all future visitors, making this a force-multiplier attack despite the high-privilege prerequisite. No public exploit or active exploitation via CISA KEV has been identified at time of analysis; the fix is upgrading to version 4.3.1.
Stored cross-site scripting in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows unauthenticated remote attackers to persistently inject arbitrary JavaScript via the jsactions feature. When any authenticated user - including site administrators - views content containing the malicious payload, the script executes in their browser context, enabling session hijacking, credential theft, or administrative account takeover. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write path combined with high confidentiality and integrity impact (CVSS 4.0: 8.6) makes this a meaningful risk for Joomla sites running Fabrik.
Symlink escape in NLTK's CorpusReader.open() allows local attackers to read arbitrary files outside the designated corpus root, affecting all versions before 3.9.4. Path boundary validation is performed lexically on the string representation of a path rather than on the resolved filesystem target, so an attacker with write access to the corpus directory can plant a symlink that passes the check yet redirects reads to sensitive files anywhere the host process can access. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.9.4.
Option injection in hashcat's restore file parser (all versions through 7.1.2) allows an attacker who delivers a crafted restore file to append attacker-controlled content to arbitrary files on the victim's system. When a user runs 'hashcat --restore' against the malicious file, output-redirecting options such as --outfile and --potfile-path are accepted from the restore file without restriction, enabling writes to shell startup scripts and subsequent code execution at the victim's privilege level. No public exploit identified at time of analysis; CVSS 4.0 rates this 8.5 with a strictly local attack vector and user interaction required.
Command injection in better-npm-audit through 3.11.0 (and the 4.0.0-rc.2 prerelease) allows arbitrary OS command execution when a value containing shell metacharacters is supplied to the --registry CLI flag. The vulnerability exists because handleInput.ts interpolates the raw registry value into a shell command string that is then passed to Node.js child_process.exec(), which spawns a system shell and interprets metacharacters such as semicolons, pipes, and backticks as command separators or substitutions. No confirmed active exploitation or CISA KEV listing exists at time of analysis, but the vulnerable code path is publicly documented in GitHub issue #119 and the diff of PR #120, significantly lowering the barrier to exploit development.
Arbitrary file deletion in SiYuan before v3.7.4 allows authenticated administrators to recursively destroy any file or directory accessible to the SiYuan kernel process by supplying an unsanitized absolute path to the /api/search/removeTemplate endpoint, which passes the value directly to Go's os.RemoveAll. All SiYuan releases prior to v3.7.4 are confirmed affected per vendor advisory GHSA-w938-w7m4-qrj8. No public exploit or CISA KEV listing exists at time of analysis, but the high integrity and availability impact - including potential downstream filesystem destruction beyond the application - makes admin credential hygiene the critical control.
Use-after-free race condition in the Linux kernel BPF sockmap subsystem allows a local attacker with access to a sockmap-configured TCP socket to corrupt kernel memory, with high impact on confidentiality, integrity, and availability. The flaw exists in tcp_bpf_send_verdict(), where a local pointer copy of psock->sk_redir is made without incrementing the socket reference count before the source socket lock is released, enabling a concurrent sendmsg() thread to free the socket object while the first thread still holds the stale raw pointer. The vulnerability is confirmed by a full KASAN slab-use-after-free trace; no public exploit identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects low current exploitation probability despite the high CVSS base score.
Use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local attacker to trigger kernel memory corruption via a refcount underflow in smc_rx_splice(). The flaw arises because pages are handed to splice_to_pipe() before page and socket references are taken, so entries dropped by smc_rx_spd_release() are released without a matching reference, and multi-page splices pair one sock_hold() with multiple sock_put() calls. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.21% (12th percentile), consistent with limited real-world weaponization at this time.
Use-after-free memory corruption in the Linux kernel vsock/virtio subsystem arises from a race condition between virtqueue worker threads and VM suspend/resume cycles. Worker threads (RX, TX, event) read their virtqueue pointer before acquiring the protective mutex and checking the run flag; a worker delayed across a freeze/restore transition retains a dangling pointer to a freed queue while the restoration installs replacement queues. No public exploit has been identified and EPSS probability is low at 0.21%, though successful exploitation could yield full kernel-level memory corruption with high confidentiality, integrity, and availability impact.
Use-after-free in the Linux kernel's thermal/hwmon subsystem exposes local attackers to potential kernel memory corruption across a wide range of stable kernel branches. The flaw was introduced by a cosmetic code-style cleanup commit (030a48b0f6ce) that inadvertently removed a valid guard from the error path of thermal_add_hwmon_sysfs(), allowing a freed object to be referenced when the function fails. Patches are backported across six stable kernel series (5.15, 6.1, 6.6, 6.12, 6.18, 7.1, and 7.2); EPSS is low at 0.21% and no active exploitation has been identified.
Type confusion in the Linux kernel's PMBus hardware monitor driver (`pmbus_notify()`) enables a slab-out-of-bounds read and potential kernel memory corruption on systems with PMBus-capable power management hardware. The `pmbus_notify()` loop unconditionally casts all attribute pointers to `struct sensor_device_attribute`, but the attribute array also contains `struct pmbus_samples_reg` and `struct pmbus_sensor` objects that only embed a base `struct device_attribute`; reading the `index` field of these miscast pointers accesses memory beyond the allocation or overlaps with unrelated kernel struct fields, producing garbage masks that could spuriously match alert conditions. No public exploit has been identified and EPSS is low (0.21%, 11th percentile), but the theoretical impact is full kernel privilege escalation on affected hardware.
Use-after-free in the Linux kernel's s390/ism driver allows a local attacker on IBM Z (s390) hardware to access freed kernel data structures during device teardown, potentially achieving privilege escalation or kernel memory corruption. The race condition arises because ISM interrupt handlers can remain active concurrently with ism_dev_exit(), reading the already-freed sba and ieq structures before free_irq() drains them. No public exploit code or CISA KEV listing exists at time of analysis; EPSS sits at 0.21% (11th percentile), consistent with its narrow hardware prerequisite.
Insufficient access control granularity in docker-socket-proxy allows adjacent-network attackers without credentials to read arbitrary files and exfiltrate entire container filesystems via four unguarded Docker API endpoints. When the CONTAINERS environment variable is set, the HAProxy-based proxy fails to block /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top, treating namespace-level permission as blanket endpoint permission. No active exploitation or confirmed public exploit code has been identified at time of analysis, though a researcher gist is referenced alongside the upstream fix in PR #183.
Path traversal in NLTK's FramenetCorpusReader and NKJPCorpusReader (all versions before 3.10.0) enables unauthenticated network-reachable attackers to read arbitrary XML files accessible to the application process by supplying crafted selectors or poisoned index state to methods including frame_by_name, doc, lu, and header. The CVSS 4.0 score of 8.2 reflects high confidentiality impact (VC:H) tempered by high attack complexity (AC:H) and a required attack target condition (AT:P), meaning exploitation depends on application code that exposes these specific corpus reader methods to external input. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote denial of service in the Linux kernel's CAKE traffic scheduler (sch_cake) allows an unauthenticated network attacker to trigger a kernel panic or persistent warning-log flood by sending malformed IP packets to a system with the CAKE qdisc actively configured. Affected systems running Linux 4.19 through unpatched versions of the 7.x series face kernel panic if the non-default `panic_on_warn=1` boot parameter is set, or dmesg flooding otherwise. No public exploit has been identified and this CVE is not in the CISA KEV catalog, but the fix is low-risk and multiple patched stable kernel versions are available.
Data corruption in the Linux kernel bnxt_en driver (Broadcom NetXtreme-E) occurs when TCP Packet Aggregation (TPA) is active alongside PCIe Relaxed Ordering (RO) on AGG rings. When EOP (End-of-frame padding) is used, zero-padding bytes appended at the end of one aggregated segment can spill over and overwrite valid data at the start of the subsequent segment. Older chips (P5 generation and earlier, including the Broadcom 57508) do not automatically suppress RO when EOP is active, making ARM-hosted deployments using these adapters particularly vulnerable to silent data corruption in received network traffic. No public exploit is identified at time of analysis, and EPSS probability is low at 0.21% (12th percentile).
Out-of-bounds read in the Linux kernel's staging RTL8723BS WiFi driver allows adjacent-network unauthenticated attackers to leak kernel heap memory or crash the affected system by transmitting a crafted 802.11 management frame. The flaw lives in rtw_get_wpa_ie(), which accesses fixed byte offsets within a vendor-specific information element without verifying the IE body is at least 6 bytes long, enabling reads past the end of a kmemdup'd allocation when a short trailing IE is present. No active exploitation is confirmed (absent from CISA KEV) and EPSS sits at 0.22% (13th percentile), but the adjacent-network, no-authentication attack vector represents a meaningful risk for embedded and single-board systems carrying RTL8723BS hardware.
The IMA (Integrity Measurement Architecture) subsystem in the Linux kernel fails to invalidate action cache flags (IMA_DONE_MASK) when files are truncated, because the file_truncate and path_truncate LSM hooks were not instantiated in IMA's hook logic. Authenticated local users who can truncate a file covered by an active IMA policy can exploit this gap - causing the kernel to skip re-measurement, re-auditing, and re-appraisal on the next file access, effectively bypassing IMA integrity enforcement for that file. No public exploit has been identified, the vulnerability is absent from CISA KEV, and the EPSS score of 0.21% (11th percentile) reflects very low observed exploitation probability despite the assigned CVSS score of 8.1.
Authentication bypass in the Firebase Authentication WordPress plugin (all versions before 1.7.1) permits unauthenticated remote attackers to impersonate any WordPress account - including administrators - by presenting an unverified Firebase JWT whose email claim matches a WordPress user. The plugin fails to check the `email_verified` field before binding the Firebase identity to a WordPress session, enabling account takeover without knowledge of the target's password. No public exploit is identified at time of analysis and EPSS sits at 0.20% (11th percentile), but the unauthenticated admin takeover potential makes this a high-priority patch for any site running the affected plugin.
Remote administrative account takeover in the ManageWP Worker WordPress plugin (versions before 4.9.37) is possible because login links are neither bound to a specific user account nor invalidated after first use, enabling replay attacks. Any attacker who intercepts or obtains a ManageWP-generated login link - whether it has been previously used or not - can replay it to establish an authenticated session as any WordPress user on the target site, including administrators. No public exploit has been identified at time of analysis, and the vendor-released patch (4.9.37) is available.
Out-of-bounds memory access in the Linux kernel's packet socket subsystem (net/packet) allows a local attacker with CAP_NET_RAW or equivalent network namespace privileges to trigger kernel memory corruption via the PACKET_QDISC_BYPASS transmit path. The flaw exists because packet_parse_headers() fails to reset skb->mac_header for SOCK_DGRAM, SOCK_PACKET, and protocol-bound SOCK_RAW sockets, causing any driver that reads eth_hdr(skb) during transmit to dereference an address approximately 64 KiB past the socket buffer head. No public exploit has been identified and no CISA KEV listing exists; patches are available across at least eight stable kernel branches.
Privilege escalation in the Linux kernel BPF verifier affects versions from 4.16 through current stable branches due to incomplete pointer state propagation during commuted arithmetic (scalar += pointer) in adjust_ptr_min_max_vals(). Local attackers with BPF program loading privileges can exploit the verifier's failure to copy the full bpf_reg_state structure, potentially bypassing memory safety enforcement and achieving arbitrary kernel memory access. No public exploit has been identified at time of analysis and EPSS is low at 0.22%, but the CVSS score of 7.8 (C:H/I:H/A:H) reflects the severity of kernel-level impact if successfully exploited.
Kernel BUG triggerable in the Open vSwitch (OVS) net subsystem allows a local low-privileged attacker to crash the kernel or potentially escalate privileges by injecting undersized Ethernet frames through a TUN device. Affected kernels from Linux 4.10 onward trust the user-supplied skb->protocol field on ARPHRD_NONE devices without validating that sufficient linear data exists for Ethernet header parsing, causing __skb_pull() to hit an unconditional BUG halt. No public exploit code has been identified and EPSS probability stands at 0.22% (13th percentile), indicating low opportunistic exploitation risk; however, patches are available across all active stable branches.
Race condition in the Linux kernel virtual terminal subsystem exposes a use-after-free condition when kbd_keycode() reads vc->port.tty without holding a reference, while con_shutdown() concurrently clears that pointer under a separate lock. Affected versions span every maintained stable series from 5.10 through 7.x; patches are available across all branches. No public exploit code exists and EPSS is very low at 0.22% (13th percentile), but the CVSS 7.8 local score reflects real kernel memory corruption potential that could enable privilege escalation.
Use-after-free in the Linux kernel netfilter ebt_nflog subsystem allows a local attacker with low privileges to trigger kernel memory corruption by racing ebtables NFLOG rule execution against nfnetlink_log module teardown. Affected kernels from version 4.12 through multiple stable branches (pre-patch) fail to acquire a module reference on the nfnetlink_log backend before invoking nfulnl_log_packet(), unlike the xt_NFLOG and nft_log frontends. KASAN-confirmed heap use-after-free at instance_lookup_get_rcu can result in full kernel compromise (C:H/I:H/A:H). No public exploit identified at time of analysis; EPSS at 0.22% (13th percentile) reflects low near-term exploitation probability.
Use-after-free race condition in the Linux kernel's IPv4 routing subsystem allows a local low-privileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw is in fib_nhc_update_mtu(), which traverses the PMTU nexthop exception (FNHE) table without proper serialization against concurrent FNHE eviction, creating a window where freed memory is accessed after a completed RCU grace period. No public exploit code has been identified at time of analysis, and an EPSS of 0.22% (13th percentile) reflects very low near-term exploitation probability despite the 7.8 CVSS score.
Out-of-bounds reads in the staging rtl8723bs WiFi driver's monitor mode transmit path expose Linux kernel systems equipped with Realtek RTL8723BS hardware to memory disclosure, corruption, and denial of service. The driver function rtw_cfg80211_monitor_if_xmit_entry() strips the variable-length radiotap header and then reads the 802.11 frame control field without verifying the socket buffer still contains a minimum MAC header; for data frames it additionally pulls the full calculated 802.11/QoS/SNAP span before confirming the skb holds that much data. A local attacker with low privileges can inject a truncated 802.11 frame to trigger the flaw; no public exploit has been identified at time of analysis and EPSS stands at 0.22%, indicating low automated exploitation probability.
Out-of-bounds memory read in the Linux kernel's fbdev bitblit subsystem allows a local attacker with tty group write access to /dev/vcsa to crash the kernel or disclose kernel memory by supplying an out-of-range glyph index through the virtual console screen interface. The root cause is a missing bounds check in bit_cursor() in drivers/video/fbdev/core/bitblit.c - a sibling function to bit_putcs_aligned() and bit_putcs_unaligned(), which already received the same clamp in commit 18c4ef4e765a. No public exploit has been released and EPSS of 0.22% (13th percentile) indicates very low active exploitation probability; this is not in CISA KEV.
Use-after-free in the Linux kernel's IPv6 stack allows a local low-privileged user to corrupt kernel memory with full high/integrity/availability impact. The race condition exists in in6_dev_get(), where dev->ip6_ptr is read under RCU and its refcount is then unconditionally incremented - device teardown can zero the pointer and drop the final reference between those two operations, resurrecting a freed inet6_dev object. No public exploit identified at time of analysis, though a proof-of-concept reproducer was confirmed functional on the unpatched v7.2-rc3 kernel by OpenAI Security Research and validated by Trail of Bits.
Use-after-free in the Linux kernel vsock/virtio RX worker allows a local low-privileged user to trigger memory corruption during device teardown, potentially achieving privilege escalation or kernel panic. The race condition exists because the RX worker's common exit path continues to refill the virtqueue even after rx_run is cleared and virtqueues have been deleted via virtio_vsock_vqs_del(). KASAN-confirmed slab-use-after-free in virtqueue_add_sgs is the direct manifestation. No public exploit or CISA KEV listing at time of analysis; EPSS of 0.22% (13th percentile) reflects low near-term exploitation probability.
Use-after-free race condition in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem allows a local attacker with low-privilege network administration access to corrupt kernel memory, achieving high impact across confidentiality, integrity, and availability. The flaw exists across multiple stable kernel branches from 5.10 through 7.1.x and is triggered by concurrent execution of TIPC bearer teardown against the link supervision timer or receive path. No public exploit or active exploitation has been confirmed; EPSS stands at 0.22% (13th percentile), and patched versions are available across all affected stable series.
The AF_XDP zero-copy TX path in the Linux kernel exposes a time-of-check/time-of-use (TOCTOU) race condition that allows a local low-privileged user to bypass TX metadata validation enforced by the kernel. Metadata is validated during descriptor context acquisition but re-read without re-validation when the hardware request is prepared, creating a window during which userspace can overwrite the shared ring buffer entry with arbitrary values. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) reflects low near-term exploitation probability, though the CVSS 7.8 High rating with C:H/I:H/A:H captures the potential for full kernel-level impact on affected systems.
Race condition in the Linux kernel's ring-buffer subsystem (ring_buffer_swap_cpu()) allows a local low-privileged user to trigger inconsistent kernel buffer state, potentially leading to kernel memory corruption or system crash. The flaw exists because the committing counter used to guard against concurrent buffer swaps transiently drops to zero within rb_move_tail(), opening an interrupt-driven window where a swap can succeed mid-write. No public exploit code has been identified at time of analysis, and EPSS of 0.22% (13th percentile) indicates negligible current exploitation pressure - but the local PR:L attack vector with C:H/I:H/A:H impact makes this significant on multi-tenant Linux systems where tracing interfaces are accessible.
Use-after-free in the Linux kernel's BPF TCP iterator exposes systems running kernel versions from 5.15 onward to local privilege escalation with high impact across confidentiality, integrity, and availability. The race condition in bpf_iter_tcp_established_batch() allows a low-privileged local attacker to hold a reference to a request_sock whose refcount is still zero, corrupting kernel memory when the publishing CPU's refcount_set() subsequently overwrites the saturated value. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), though the race is described as reproducible within seconds under controlled conditions with tcp_syncookies=0.
Stack exhaustion in Linux kernel net/sched allows a local low-privileged attacker with CAP_NET_ADMIN to crash or potentially compromise the kernel by constructing an excessively deep qdisc hierarchy. The create-and-graft code path lacked depth enforcement, permitting hierarchies that trigger unbounded recursion in qdisc tree walkers, overflowing the kernel stack. No public exploit code exists and EPSS is 0.21% (12th percentile), but the CVSS 7.8 High rating and C:H/I:H/A:H impact vector indicate vendor assessment of a privilege escalation potential beyond simple denial-of-service. Patch-confirmed fixes are available across multiple stable kernel branches.
Unbounded kernel memory access in the Linux kernel's ALSA usx2y driver allows a local user with access to a Tascam US-X2Y USB audio device's hwdep node to read from and write to arbitrary kernel memory pages via a crafted mmap() call with an out-of-bounds page offset. The snd_usb_usx2y module has carried this flaw since Linux 2.6.12; no Linux capability check (CAP_SYS_ADMIN, etc.) is required - only DAC permission to the hwdep character node after completing a mandatory FPGA image upload sequence. The exploit primitive is sufficient for local privilege escalation, but real-world risk is tightly bounded by the requirement for a physically attached Tascam US-X2Y device; no public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.21% (12th percentile) reflects this narrow hardware prerequisite accurately.
Use-after-free in the Linux kernel's PSI (Pressure Stall Information) scheduler subsystem exposes local low-privilege users to potential memory corruption and privilege escalation on affected kernel versions. The race condition between psi_schedule_rtpoll_work(), called locklessly from the scheduler hotpath, and psi_trigger_destroy() allows the rtpoll_timer to be re-armed after the cgroup group has been freed, causing poll_timer_fn() to execute on deallocated memory. Vendor-released patches are available across stable branches 6.1.183, 6.6.152, 6.12.104, 7.1.9, 7.2, and 6.18.45; no public exploit has been identified and EPSS is 0.21%.
Use-after-free in the Linux kernel's enic driver (Cisco VIC Ethernet NIC) allows a local attacker with low privileges to corrupt kernel heap memory during network device removal. The enic_remove() teardown function fails to cancel or disable the tx_hang_reset work item, creating a race window where a TX watchdog timeout can reschedule enic_tx_hang_reset() to execute after free_netdev() has already released the underlying network device structure. No public exploit exists and EPSS probability is 0.21% (11th percentile), though the kernel use-after-free primitive carries high C/I/A impact if reliably triggered.
Out-of-bounds kernel memory read in the Linux kernel AF_XDP subsystem allows a local low-privileged user to trigger reads beyond registered memory regions by supplying TX metadata shorter than 16 bytes. Affected systems include Linux kernel versions from the introduction of commit 341ac980eab9 through multiple stable branches, with patches available at 6.12.104, 7.1.9, and 7.2. No public exploit has been identified and EPSS is 0.21% (11th percentile), indicating low current exploitation activity despite the high CVSS score.
Use-after-free in the Linux kernel's traffic control classifier API (net/sched/cls_api) allows a local attacker with CAP_NET_ADMIN to corrupt kernel memory by racing two concurrent tc_new_tfilter() calls targeting the same chain and priority with different classifier types. A proof-of-concept is referenced in the upstream kernel commit but is not independently confirmed as publicly released. EPSS is 0.21% and the vulnerability is not listed in CISA KEV, indicating no observed widespread exploitation at time of analysis.
Out-of-bounds write in the Linux kernel IPVS estimator subsystem allows a low-privileged local attacker to corrupt kernel memory through a race condition between network namespace teardown and IPVS kthread initialization. When ipvs->enable is cleared while kthread 0 is mid-way through its calculation phase, ip_vs_enqueue_estimator() writes past the ticks and tick_len arrays using zero-initialized limits, producing high-impact memory corruption on affected kernels from the 6.6.x through 7.1.x stable series. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) reflects very low near-term exploitation probability despite the high CVSS 3.1 base score of 7.8.