Use-after-free in the Linux kernel's IPv6 stack allows a local low-privileged user to corrupt kernel memory with full high/integrity/availability impact. The race condition exists in in6_dev_get(), where dev->ip6_ptr is read under RCU and its refcount is then unconditionally incremented - device teardown can zero the pointer and drop the final reference between those two operations, resurrecting a freed inet6_dev object. No public exploit identified at time of analysis, though a proof-of-concept reproducer was confirmed functional on the unpatched v7.2-rc3 kernel by OpenAI Security Research and validated by Trail of Bits.
Use-after-free in the Linux kernel vsock/virtio RX worker allows a local low-privileged user to trigger memory corruption during device teardown, potentially achieving privilege escalation or kernel panic. The race condition exists because the RX worker's common exit path continues to refill the virtqueue even after rx_run is cleared and virtqueues have been deleted via virtio_vsock_vqs_del(). KASAN-confirmed slab-use-after-free in virtqueue_add_sgs is the direct manifestation. No public exploit or CISA KEV listing at time of analysis; EPSS of 0.22% (13th percentile) reflects low near-term exploitation probability.
Use-after-free race condition in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem allows a local attacker with low-privilege network administration access to corrupt kernel memory, achieving high impact across confidentiality, integrity, and availability. The flaw exists across multiple stable kernel branches from 5.10 through 7.1.x and is triggered by concurrent execution of TIPC bearer teardown against the link supervision timer or receive path. No public exploit or active exploitation has been confirmed; EPSS stands at 0.22% (13th percentile), and patched versions are available across all affected stable series.
The AF_XDP zero-copy TX path in the Linux kernel exposes a time-of-check/time-of-use (TOCTOU) race condition that allows a local low-privileged user to bypass TX metadata validation enforced by the kernel. Metadata is validated during descriptor context acquisition but re-read without re-validation when the hardware request is prepared, creating a window during which userspace can overwrite the shared ring buffer entry with arbitrary values. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) reflects low near-term exploitation probability, though the CVSS 7.8 High rating with C:H/I:H/A:H captures the potential for full kernel-level impact on affected systems.
Race condition in the Linux kernel's ring-buffer subsystem (ring_buffer_swap_cpu()) allows a local low-privileged user to trigger inconsistent kernel buffer state, potentially leading to kernel memory corruption or system crash. The flaw exists because the committing counter used to guard against concurrent buffer swaps transiently drops to zero within rb_move_tail(), opening an interrupt-driven window where a swap can succeed mid-write. No public exploit code has been identified at time of analysis, and EPSS of 0.22% (13th percentile) indicates negligible current exploitation pressure - but the local PR:L attack vector with C:H/I:H/A:H impact makes this significant on multi-tenant Linux systems where tracing interfaces are accessible.
Use-after-free in the Linux kernel's BPF TCP iterator exposes systems running kernel versions from 5.15 onward to local privilege escalation with high impact across confidentiality, integrity, and availability. The race condition in bpf_iter_tcp_established_batch() allows a low-privileged local attacker to hold a reference to a request_sock whose refcount is still zero, corrupting kernel memory when the publishing CPU's refcount_set() subsequently overwrites the saturated value. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), though the race is described as reproducible within seconds under controlled conditions with tcp_syncookies=0.
Stack exhaustion in Linux kernel net/sched allows a local low-privileged attacker with CAP_NET_ADMIN to crash or potentially compromise the kernel by constructing an excessively deep qdisc hierarchy. The create-and-graft code path lacked depth enforcement, permitting hierarchies that trigger unbounded recursion in qdisc tree walkers, overflowing the kernel stack. No public exploit code exists and EPSS is 0.21% (12th percentile), but the CVSS 7.8 High rating and C:H/I:H/A:H impact vector indicate vendor assessment of a privilege escalation potential beyond simple denial-of-service. Patch-confirmed fixes are available across multiple stable kernel branches.
Unbounded kernel memory access in the Linux kernel's ALSA usx2y driver allows a local user with access to a Tascam US-X2Y USB audio device's hwdep node to read from and write to arbitrary kernel memory pages via a crafted mmap() call with an out-of-bounds page offset. The snd_usb_usx2y module has carried this flaw since Linux 2.6.12; no Linux capability check (CAP_SYS_ADMIN, etc.) is required - only DAC permission to the hwdep character node after completing a mandatory FPGA image upload sequence. The exploit primitive is sufficient for local privilege escalation, but real-world risk is tightly bounded by the requirement for a physically attached Tascam US-X2Y device; no public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.21% (12th percentile) reflects this narrow hardware prerequisite accurately.
Use-after-free in the Linux kernel's PSI (Pressure Stall Information) scheduler subsystem exposes local low-privilege users to potential memory corruption and privilege escalation on affected kernel versions. The race condition between psi_schedule_rtpoll_work(), called locklessly from the scheduler hotpath, and psi_trigger_destroy() allows the rtpoll_timer to be re-armed after the cgroup group has been freed, causing poll_timer_fn() to execute on deallocated memory. Vendor-released patches are available across stable branches 6.1.183, 6.6.152, 6.12.104, 7.1.9, 7.2, and 6.18.45; no public exploit has been identified and EPSS is 0.21%.
Use-after-free in the Linux kernel's enic driver (Cisco VIC Ethernet NIC) allows a local attacker with low privileges to corrupt kernel heap memory during network device removal. The enic_remove() teardown function fails to cancel or disable the tx_hang_reset work item, creating a race window where a TX watchdog timeout can reschedule enic_tx_hang_reset() to execute after free_netdev() has already released the underlying network device structure. No public exploit exists and EPSS probability is 0.21% (11th percentile), though the kernel use-after-free primitive carries high C/I/A impact if reliably triggered.
Out-of-bounds kernel memory read in the Linux kernel AF_XDP subsystem allows a local low-privileged user to trigger reads beyond registered memory regions by supplying TX metadata shorter than 16 bytes. Affected systems include Linux kernel versions from the introduction of commit 341ac980eab9 through multiple stable branches, with patches available at 6.12.104, 7.1.9, and 7.2. No public exploit has been identified and EPSS is 0.21% (11th percentile), indicating low current exploitation activity despite the high CVSS score.
Use-after-free in the Linux kernel's traffic control classifier API (net/sched/cls_api) allows a local attacker with CAP_NET_ADMIN to corrupt kernel memory by racing two concurrent tc_new_tfilter() calls targeting the same chain and priority with different classifier types. A proof-of-concept is referenced in the upstream kernel commit but is not independently confirmed as publicly released. EPSS is 0.21% and the vulnerability is not listed in CISA KEV, indicating no observed widespread exploitation at time of analysis.
Out-of-bounds write in the Linux kernel IPVS estimator subsystem allows a low-privileged local attacker to corrupt kernel memory through a race condition between network namespace teardown and IPVS kthread initialization. When ipvs->enable is cleared while kthread 0 is mid-way through its calculation phase, ip_vs_enqueue_estimator() writes past the ticks and tick_len arrays using zero-initialized limits, producing high-impact memory corruption on affected kernels from the 6.6.x through 7.1.x stable series. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) reflects very low near-term exploitation probability despite the high CVSS 3.1 base score of 7.8.
Race condition in the Linux kernel's AF_PACKET TX_RING send path allows a low-privileged local user to trigger kernel heap memory corruption by racing a concurrent netdevice reconfiguration. The tpacket_snd() function reads dev->hard_header_len independently at two points - for SKB headroom allocation and for header construction in tpacket_fill_skb() - so a device reconfiguration between those two reads can cause the reserved headroom to be smaller than what is later pushed, or make copylen minus hard_header_len negative. With a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and patches available across multiple stable kernel branches, this is a patching priority for multi-tenant Linux environments; no public exploit or CISA KEV listing has been identified at time of analysis.
Race condition in the Linux kernel AF_PACKET socket subsystem allows a local low-privileged attacker to dereference stale or NULL ring storage, resulting in kernel memory corruption with full confidentiality, integrity, and availability impact. The flaw arises because packet_set_ring() previously published the tpacket receive mode outside the sk_receive_queue.lock section used for ring state updates, enabling packet_poll() and packet_recvmsg() to run pressure-clearing paths against already-freed ring structures. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS places current exploitation probability at 0.21%.
Use-after-free in the Linux kernel's mac802154 (IEEE 802.15.4) subsystem allows a local low-privileged attacker to dereference freed netdev memory, potentially achieving kernel memory corruption and privilege escalation. The race window opens when mac802154_beacon_worker() drops the RCU read lock while still holding references to sdata and wpan_dev, and a concurrent interface teardown via mac802154_stop_beacons_locked() frees those structures before the worker completes. EPSS is very low at 0.21% (11th percentile) and no active exploitation or public exploit code has been identified at time of analysis; practical exploitation is limited by mac802154 hardware availability and the race condition timing requirement.
Race condition in the Linux kernel fastrpc driver allows a local low-privileged attacker on Qualcomm DSP-equipped systems to trigger a use-after-free condition by issuing concurrent munmap ioctls, potentially achieving kernel memory corruption and privilege escalation. The flaw exists in `fastrpc_req_munmap_impl()` where the internal buffer list is updated only after the DSP unmap completes, leaving a window in which a concurrent thread can operate on an already-unmapped entry. No public exploit or CISA KEV listing exists at time of analysis, and EPSS remains low at 0.21%, indicating limited observed exploitation activity.
Unprotected list manipulation in the Linux kernel FastRPC subsystem allows a local low-privileged attacker on Qualcomm-based systems to race a signal-interrupted DSP invoke operation against concurrent mmap/munmap operations. The missing `fl->lock` acquisition in `fastrpc_internal_invoke()` during the interrupt path creates a concurrent modification hazard on `fl->mmaps`, potentially yielding kernel memory corruption with full confidentiality, integrity, and availability impact. No public exploit has been identified and EPSS is 0.21% (11th percentile); this CVE is not listed in the CISA KEV catalog.
Use-after-free in the Linux kernel's ring-buffer tracing subsystem exposes non-consuming reader iterators to dangling memory when subbuffer order changes occur while resizing is disabled. The vulnerable function ring_buffer_subbuf_order_set() frees buffer pages without checking the resize_disabled flag, leaving rb_advance_iter() holding stale references to freed memory. Exploitation requires local low-privilege access; no public exploit or CISA KEV listing exists, but vendor patches are available across multiple stable kernel branches.
Race condition in the Linux kernel's mm/huge_memory subsystem allows local low-privilege users to trigger misidentification of the huge zero folio as an ordinary Transparent Huge Page (THP), potentially leading to memory corruption, incorrect folio splitting, and privilege escalation. Affected kernels spanning multiple stable branches from at least 4.19 onward are vulnerable when !CONFIG_PERSISTENT_HUGE_ZERO_FOLIO is in effect, with patched versions available for 6.12, 6.18, 7.1, and 7.2 stable series. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog; EPSS places exploitation probability at the 11th percentile.
Kernel memory corruption in the Linux TLS software path allows an unprivileged local user to trigger a NULL pointer dereference - potentially enabling a kernel crash or privilege escalation. The flaw exists in `tls_sw_sendmsg_locked()`: when the copy path fills the plaintext `sk_msg` scatter-gather ring, it omits setting `full_record`, leaving the full ring unpushed; a subsequent `splice()` call then wraps `sg.end` back to `sg.start`, corrupts live scatterlist entries, and drives the scatterwalk off the end of the list during AES-GCM encryption. No public exploit has been identified and EPSS is 0.21% (11th percentile), but the confirmed kernel memory-corruption primitive and C:H/I:H/A:H CVSS impact make patching urgent for any host where kernel TLS is in use.
Use-after-free in the Linux kernel's eventfs subsystem allows a local low-privileged user to corrupt kernel memory by triggering unsafe iterator advancement after recursive child removal in eventfs_remove_rec(). Affected stable branches span Linux 6.6.18 through pre-6.6.152, 6.7.6 through pre-6.8, and related ranges; patched versions (6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2) are available via upstream kernel.org stable commits. No public exploit has been identified at time of analysis and EPSS is very low at 0.21% (11th percentile), though successful exploitation could yield local privilege escalation to root.
Race condition exploitation in the Linux kernel's BPF fsverity interface (bpf_get_fsverity_digest()) enables a local low-privileged attacker to crash the kernel or potentially corrupt memory by racing a concurrent modification of dynptr contents against the kfunc's use of arg->digest_size. Affected are Linux kernel versions from 6.8 through multiple stable branches prior to patched releases 6.12.104, 6.18.45, 7.1.9, and 7.2. No public exploit or active exploitation has been confirmed; EPSS at 0.21% (11th percentile) reflects low near-term exploitation probability, and no CISA KEV listing exists at time of analysis.
Memory corruption in the Linux kernel's AF_XDP socket (xsk) subsystem arises from two related flaws: missing size validation for launch-time metadata fields that extend beyond the first 16 bytes of struct xsk_tx_metadata, and a race condition where user space can modify transmit flags concurrently with kernel transmit processing. A local attacker with low-privilege access who can create and configure AF_XDP sockets may trigger out-of-bounds memory access, leading to high-impact compromise of confidentiality, integrity, and availability consistent with the CVSS 7.8 score. No public exploit code has been identified, EPSS sits at 0.21% (11th percentile), and the CVE is absent from CISA KEV, placing practical exploitation risk well below what the raw CVSS score might suggest.
Use-after-free race condition in the Linux kernel at91sam9_wdt watchdog driver allows a local attacker with low privileges on affected AT91 SAM9 SoC hardware to corrupt freed memory, potentially achieving kernel-level code execution. The flaw arises because at91_ping() rearms a kernel timer from within its own callback, while timer_delete() neither waits for an in-flight callback to finish nor prevents rearming - leaving a window during probe failure or driver removal where the timer accesses devm-allocated memory that has already been freed. No public exploit has been identified at time of analysis, and EPSS probability is very low (0.21%, 11th percentile), consistent with the hardware-specific and timing-dependent nature of this race.
Use-after-free race condition in the Linux kernel's amba-pl011 serial driver allows a local unprivileged user on ARM-based hardware to corrupt kernel memory, potentially escalating to full system compromise. The RS485 hrtimers embedded in the devm-managed port structure can fire after the port is freed, and the IRQ handler can arm a timer immediately before teardown, creating the race window. No public exploit exists and EPSS is 0.21% (11th percentile), but kernel-level use-after-free primitives are well-understood exploitation targets and patched stable releases are available.
Out-of-bounds slab write in the Linux kernel ALSA FCP (FireWire Control Protocol) driver allows local unprivileged processes to corrupt up to 888 bytes of adjacent kernel heap memory by reading audio controls on /dev/snd/controlC0, once a privileged actor has installed an oversized Level Meter map. The mismatch between the driver's 255-entry map limit and the 128-entry ABI array in struct snd_ctl_elem_value creates a persistent, exploitable write primitive reachable by any process with device read access. No public exploit has been identified and no active exploitation is confirmed; vendor-released patches are available in Linux 7.2, 7.1.9, and 6.18.45.
Use-after-free in the Linux kernel perf/core subsystem allows a local low-privileged user to dereference freed kernel memory by racing CPU hot-unplug against perf event group management. When a sibling event is detached via DETACH_GROUP during CPU hotplug, its group_leader pointer is not reset; if the leader is subsequently freed while the sibling's file descriptor remains open, a PERF_IOC_FLAG_GROUP ioctl on the sibling follows the stale pointer into freed memory, potentially enabling kernel crash or privilege escalation to root. No public exploit has been identified at time of analysis and EPSS is low at 0.21% (11th percentile), but the local exploit path with full C:H/I:H/A:H impact warrants prompt patching, particularly on systems permitting unprivileged perf_event_open access.
Linux kernel zero-copy networking in zerocopy_fill_skb_from_devmem() permits improper mixing of net_iov (device memory) and page-backed fragments within a single socket buffer (skb), causing type confusion and memory corruption in downstream kernel networking code. Affected are kernels from introducing commit bd61848900bff5 across the 6.18.x and 7.x stable series until the respective patch commits were applied. No public exploit or active exploitation is confirmed at time of analysis (EPSS 0.21%, no CISA KEV listing), but the local CVSS 7.8 score reflects credible kernel-level memory corruption risk for systems where devmem TCP zero-copy is configured and in use.
Out-of-bounds write in the Linux kernel's IPVS subsystem (`ip_vs_nat_icmp`) allows a local attacker with low privileges to corrupt kernel memory by exploiting a TOCTOU race on the IP header length field (`ihl`), which is read multiple times during ICMP packet NAT processing. Affected systems include any Linux kernel from version 2.6.12 through the pre-patch range across multiple stable branches (fixed in 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2). An attacker achieving kernel memory corruption via this path could escalate privileges to full kernel control; no public exploit or CISA KEV listing has been identified at time of analysis.
Race condition in the Linux kernel's GPIO PCA953x driver allows local low-privileged users on systems with PCA953x I2C GPIO expander hardware to trigger incorrect register reads or writes by exploiting missing mutex coverage in pca953x_irq_bus_sync_unlock(). A prior partial fix protected only the interrupt mask register write but left the direction register read unguarded, permitting concurrent threads to interleave I2C transactions and corrupt GPIO expander state on affected kernel stable branches including 6.1.101-6.2, 6.6.42-6.7, and 6.9.11-6.10. No public exploit has been identified and EPSS exploitation probability is 0.20% at the 10th percentile, consistent with negligible real-world exploitation interest.
Use-after-free in the Linux kernel's sched_ext (extensible BPF scheduler) subsystem allows a local low-privileged attacker to corrupt kernel memory, potentially achieving full confidentiality, integrity, and availability compromise of the affected system. The race condition arises when a sub-scheduler enable fails before being linked into the scheduler hierarchy, yet the full teardown path still executes concurrently against root scheduler disable, causing tasks to be re-homed onto an already-freed scheduler hierarchy. No public exploit or POC has been identified at time of analysis, and EPSS at 0.20% (10th percentile) reflects negligible observed exploitation activity.
Reference count underflow in the Linux kernel amdxdna (AMD XDNA NPU accelerator) driver allows a local low-privileged user to corrupt kernel memory via a double invocation of vm_ops->close() triggered by failed mmap page insertions. Two error paths in amdxdna_insert_pages() incorrectly release the shmem pages_pin_count and backing GEM object reference while the VMA remains live; the kernel's subsequent VMA teardown fires vm_ops->close() a second time, producing a reference count underflow with potential use-after-free consequences and high impact across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and EPSS is 0.20% (10th percentile), consistent with the niche AMD Ryzen AI hardware requirement limiting real-world exposure.
Reference imbalance in the Linux kernel's BPF conntrack kfuncs allows a local attacker with BPF privileges to trigger an unmatched put_net() call that can destroy a live network namespace and cause kernel panic. The flaw affects __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry(), where opts->netns_id is read non-atomically from a shared BPF map value during both namespace acquisition and release. No public exploit code exists and EPSS is low (0.20%, 10th percentile), but the kernel panic outcome is confirmed by a crash trace in the advisory. Exploitation requires local BPF capability and a concurrent writer to the shared map.
Incorrect TLB flush address targeting in the Linux kernel's zap_pte_range memory management function exposes systems running kernel versions prior to 7.1.9 and 7.2 to local privilege escalation and information disclosure, particularly on AMD systems with EFER.TCE enabled and Intel systems using INVPCID. A low-privileged local attacker can exploit a race where the kernel flushes the wrong virtual address after freeing a page table, leaving stale CPU paging-structure-cache entries that can be speculatively accessed or cause the freed table to be reused with potentially attacker-controlled data. No public exploit code or active exploitation (CISA KEV) has been confirmed at time of analysis, and the 0.20% EPSS score reflects the complexity of reliable exploitation.
Memory corruption in the Linux kernel's eventfs subsystem allows a local low-privileged user to trigger a use-after-free condition via a race between SRCU inode freeing and concurrent list iteration. The root cause is an unsafe union of ei->list with the RCU head, combined with absent memory barriers around the is_freed flag, permitting a racing reader to dereference a pointer that has been overwritten by the RCU freelist mechanism. No public exploit code exists and the CVE is absent from CISA KEV; EPSS of 0.20% (10th percentile) confirms negligible observed exploitation activity, placing real-world risk well below what the 7.8 CVSS score implies.
Incorrect idmap context in Linux kernel fscrypt allows a low-privileged local user on an idmapped-mount filesystem to bypass ownership checks when setting fscrypt encryption policies via FSCRYPT_IOC_SET_POLICY, and simultaneously causes legitimate directory owners to be wrongly denied access with EACCES. The flaw affects ext4, f2fs, and other fscrypt-capable filesystems mounted with idmapped-mount configurations - a setup common in container runtimes and rootless Kubernetes node deployments from kernel 5.12 onward. No public exploit is identified at time of analysis, and EPSS of 0.14% (3rd percentile) reflects minimal observed exploitation interest.
Price integrity bypass in the Advanced Product Fields (Product Addons) for WooCommerce plugin allows unauthenticated shoppers to complete purchases at the base product price while receiving paid addons without charge, effectively constituting theft of digital or physical goods from merchants. Versions up to and including 1.6.21 are affected due to a logic flaw in the cart validation function; a partial patch was shipped in 1.6.19 but did not fully close the exposure. No public exploit code or CISA KEV listing is identified at time of analysis, though the low exploitation complexity makes opportunistic abuse straightforward.
Kernel panic in Linux mlx5 (Mellanox/NVIDIA ConnectX) driver's firmware tracer subsystem allows a system crash when the devlink health reporter fires on a device where fw_tracer initialization returned ERR_PTR rather than NULL. The stored ERR_PTR is never validated against IS_ERR() before dereference in mlx5_fw_tracer_trigger_core_dump_general, resulting in an Oops and fatal kernel panic as confirmed by the full crash trace in the CVE description. No public exploit has been identified at time of analysis; EPSS is 0.22% (13th percentile), and the vulnerability is not listed in CISA KEV - though the availability impact when triggered is total (system crash). Multiple patched stable-kernel versions are available.
Memory exhaustion in the Linux kernel's netfilter bridge subsystem allows network-adjacent unauthenticated attackers to cause denial of service by sending non-IP Ethernet frames through a bridge host configured with nftables conntrack zone set rules. The root cause is that nf_ct_bridge_pre() overwrites skb->_nfct with IP_CT_UNTRACKED for non-IPv4/non-IPv6 EtherTypes without releasing the existing conntrack template reference, leaking slab memory indefinitely until the host exhausts kernel memory. No public exploit exists and EPSS is 0.22% (13th percentile), indicating low real-world exploitation likelihood despite the High availability impact rating; risk is further bounded by the requirement for a specific non-default nftables configuration.
Out-of-bounds memory read in the Linux kernel's IPv6 stack exposes up to 8 bytes of adjacent kernel memory per crafted Router Advertisement. The flaw in `rt6_route_rcv()` permits a link-local attacker to send a Route Information option with an RFC 4191-invalid prefix_len/length combination, causing `ipv6_addr_prefix()` to read beyond the option boundary and install the overread bytes as a route prefix visible to unprivileged userspace via `ip -6 route show`. No public exploit has been identified at time of analysis and EPSS is 0.22% (13th percentile), though the attack requires no authentication and only link adjacency.
TCP Fast Open queue accounting in the Linux kernel becomes inaccurate following SO_REUSEPORT listener migration, permitting far more pending TFO connection requests than the configured TCP_FASTOPEN max_qlen limit allows. The root cause is a counter mismatch: fastopenq.qlen is charged against the original listener during child creation in tcp_fastopen_create_child() but uncharged against a different socket after inet_reqsk_clone() repoints the migrated child's rsk_listener to the new listener, causing the surviving listener's qlen to drift negative and its max_qlen guard to stop firing. No public exploit has been identified and EPSS stands at 0.21% (12th percentile), but any server combining SO_REUSEPORT with TCP Fast Open is vulnerable once listener migration has occurred.
Kernel memory exhaustion in the Linux net/smc subsystem enables remote denial-of-service against servers using SMC listen sockets. A TOCTOU race between smc_listen_out() and listener socket close allows an unauthenticated remote attacker to enqueue child socket objects onto a dead listener - each leaking a smc_sock, clcsock, and unreleased reference - by flooding TCP connections during the server's close() window. Patches are confirmed available across multiple stable kernel branches (5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2+); no public exploit code or CISA KEV listing has been identified at time of analysis.
Memory exhaustion in the Linux kernel's ax88179_178a USB Ethernet driver allows socket buffers to leak on every failed TX linearization attempt under memory pressure. Systems with ASIX AX88179 or AX88178A USB-to-Ethernet adapters loaded with scatter-gather (NETIF_F_SG) enabled are affected: when skb_linearize() fails inside ax88179_tx_fixup(), the function returns NULL without freeing the original skb, and the caller usbnet_start_xmit() never releases it because its local skb pointer is now NULL. No public exploit has been identified and EPSS probability is negligible (0.21%, 12th percentile); the practical risk is gradual kernel memory exhaustion on systems continuously operating under low-memory, high-TX-load conditions with the specific USB hardware connected.
Deadlock in the Linux kernel's netfilter nf_conntrack subsystem can be triggered remotely by sending malformed TCP or SCTP packets when nfnetlink_log with conntrack export is active as the logging target. The logging emission path re-enters conntrack netlink glue code and attempts to re-acquire ct->lock already held by the conntrack processing path, causing a kernel deadlock and system-wide denial of service. No exploit code is publicly available and EPSS stands at 0.21% (11th percentile), indicating very low current exploitation activity; patches for multiple stable kernel branches are confirmed available.
Unbounded kernel memory exhaustion in the Linux kernel's traffic control connection tracking action (act_ct) allows unauthenticated remote attackers to leak one sk_buff plus its data buffer per malformed IP packet on systems with a clsact TC chain configured with 'action ct'. The defect in tcf_ct_act() causes error paths from header sanity checks to return TC_ACT_CONSUMED - signaling ownership transfer - while the sk_buff is still owned by the caller and never freed, resulting in progressive kernel memory exhaustion. No public exploit has been identified at time of analysis; EPSS is low at 0.21% (percentile 11%), and the vulnerability is not in CISA KEV.
Reference count leak in the Linux kernel netfilter flowtable offload path allows a remote attacker to cause a denial of service by sending network packets through a system with nf_flow_table offload configured. The flaw occurs in nf_flow_offload_ip_hook() and the XFRM offload path when skb_dst_set_noref() overwrites an existing ref-counted dst_entry without first dropping it, leaking the reference and triggering a DEBUG_NET_WARN_ON_ONCE kernel assertion. No public exploit has been identified at time of analysis; EPSS of 0.21% (11th percentile) and absence from CISA KEV confirm low opportunistic exploitation activity. Upstream patch commits and fixed stable releases 6.18.45, 7.1.9, and 7.2 are available.
Reception stall denial-of-service in the Linux kernel's ntb_netdev driver allows remote unauthenticated attackers to progressively exhaust the NTB network interface's RX queue by triggering repeated memory allocation failures during packet reception, ultimately halting all inbound packet delivery while the interface remains administratively up. Systems with NTB-capable PCIe hardware (Non-Transparent Bridge interconnects) running affected kernel versions are at risk; standard Linux deployments without this hardware are entirely unaffected. No public exploit has been identified at time of analysis, and EPSS sits at the 10th percentile, consistent with the specialized hardware prerequisite; upstream stable commits confirming the fix are publicly available.
Null-pointer dereference and promiscuity counter underflow in the Linux kernel bonding driver's ALB monitor can crash the kernel or permanently pin a network interface in promiscuous mode. The bond_alb_monitor() workqueue function reads primary_is_promisc under RCU, drops that lock, then acquires RTNL - allowing the active slave to be removed or changed in the intervening window, leaving the monitor to act on stale state. Linux systems from kernel 2.6.24 through unpatched stable branches (5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, 7.2) with network bonding explicitly configured in ALB mode are affected. No public exploit identified at time of analysis.
Privilege boundary bypass in the Forminator Forms WordPress plugin (versions 1.40.0 through 1.57.0.5) enables any site-level administrator on a WordPress multisite network to modify a network-wide setting that triggers arbitrary code execution across all sites on the network, effectively allowing lateral escalation from single-site admin to full network compromise. This collapses the critical trust boundary between WordPress multisite's site administrator and network (super) administrator roles. No public exploit or CISA KEV listing exists at time of analysis, but the EPSS score of 0.18% (8th percentile) indicates low automated exploitation activity - not low potential impact.