Race condition in the Linux kernel's AF_PACKET TX_RING send path allows a low-privileged local user to trigger kernel heap memory corruption by racing a concurrent netdevice reconfiguration. The tpacket_snd() function reads dev->hard_header_len independently at two points - for SKB headroom allocation and for header construction in tpacket_fill_skb() - so a device reconfiguration between those two reads can cause the reserved headroom to be smaller than what is later pushed, or make copylen minus hard_header_len negative. With a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and patches available across multiple stable kernel branches, this is a patching priority for multi-tenant Linux environments; no public exploit or CISA KEV listing has been identified at time of analysis.
Race condition in the Linux kernel AF_PACKET socket subsystem allows a local low-privileged attacker to dereference stale or NULL ring storage, resulting in kernel memory corruption with full confidentiality, integrity, and availability impact. The flaw arises because packet_set_ring() previously published the tpacket receive mode outside the sk_receive_queue.lock section used for ring state updates, enabling packet_poll() and packet_recvmsg() to run pressure-clearing paths against already-freed ring structures. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS places current exploitation probability at 0.21%.
Use-after-free in the Linux kernel's mac802154 (IEEE 802.15.4) subsystem allows a local low-privileged attacker to dereference freed netdev memory, potentially achieving kernel memory corruption and privilege escalation. The race window opens when mac802154_beacon_worker() drops the RCU read lock while still holding references to sdata and wpan_dev, and a concurrent interface teardown via mac802154_stop_beacons_locked() frees those structures before the worker completes. EPSS is very low at 0.21% (11th percentile) and no active exploitation or public exploit code has been identified at time of analysis; practical exploitation is limited by mac802154 hardware availability and the race condition timing requirement.
Race condition in the Linux kernel fastrpc driver allows a local low-privileged attacker on Qualcomm DSP-equipped systems to trigger a use-after-free condition by issuing concurrent munmap ioctls, potentially achieving kernel memory corruption and privilege escalation. The flaw exists in `fastrpc_req_munmap_impl()` where the internal buffer list is updated only after the DSP unmap completes, leaving a window in which a concurrent thread can operate on an already-unmapped entry. No public exploit or CISA KEV listing exists at time of analysis, and EPSS remains low at 0.21%, indicating limited observed exploitation activity.
Unprotected list manipulation in the Linux kernel FastRPC subsystem allows a local low-privileged attacker on Qualcomm-based systems to race a signal-interrupted DSP invoke operation against concurrent mmap/munmap operations. The missing `fl->lock` acquisition in `fastrpc_internal_invoke()` during the interrupt path creates a concurrent modification hazard on `fl->mmaps`, potentially yielding kernel memory corruption with full confidentiality, integrity, and availability impact. No public exploit has been identified and EPSS is 0.21% (11th percentile); this CVE is not listed in the CISA KEV catalog.
Use-after-free in the Linux kernel's ring-buffer tracing subsystem exposes non-consuming reader iterators to dangling memory when subbuffer order changes occur while resizing is disabled. The vulnerable function ring_buffer_subbuf_order_set() frees buffer pages without checking the resize_disabled flag, leaving rb_advance_iter() holding stale references to freed memory. Exploitation requires local low-privilege access; no public exploit or CISA KEV listing exists, but vendor patches are available across multiple stable kernel branches.
Race condition in the Linux kernel's mm/huge_memory subsystem allows local low-privilege users to trigger misidentification of the huge zero folio as an ordinary Transparent Huge Page (THP), potentially leading to memory corruption, incorrect folio splitting, and privilege escalation. Affected kernels spanning multiple stable branches from at least 4.19 onward are vulnerable when !CONFIG_PERSISTENT_HUGE_ZERO_FOLIO is in effect, with patched versions available for 6.12, 6.18, 7.1, and 7.2 stable series. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog; EPSS places exploitation probability at the 11th percentile.
Kernel memory corruption in the Linux TLS software path allows an unprivileged local user to trigger a NULL pointer dereference - potentially enabling a kernel crash or privilege escalation. The flaw exists in `tls_sw_sendmsg_locked()`: when the copy path fills the plaintext `sk_msg` scatter-gather ring, it omits setting `full_record`, leaving the full ring unpushed; a subsequent `splice()` call then wraps `sg.end` back to `sg.start`, corrupts live scatterlist entries, and drives the scatterwalk off the end of the list during AES-GCM encryption. No public exploit has been identified and EPSS is 0.21% (11th percentile), but the confirmed kernel memory-corruption primitive and C:H/I:H/A:H CVSS impact make patching urgent for any host where kernel TLS is in use.
Use-after-free in the Linux kernel's eventfs subsystem allows a local low-privileged user to corrupt kernel memory by triggering unsafe iterator advancement after recursive child removal in eventfs_remove_rec(). Affected stable branches span Linux 6.6.18 through pre-6.6.152, 6.7.6 through pre-6.8, and related ranges; patched versions (6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2) are available via upstream kernel.org stable commits. No public exploit has been identified at time of analysis and EPSS is very low at 0.21% (11th percentile), though successful exploitation could yield local privilege escalation to root.
Race condition exploitation in the Linux kernel's BPF fsverity interface (bpf_get_fsverity_digest()) enables a local low-privileged attacker to crash the kernel or potentially corrupt memory by racing a concurrent modification of dynptr contents against the kfunc's use of arg->digest_size. Affected are Linux kernel versions from 6.8 through multiple stable branches prior to patched releases 6.12.104, 6.18.45, 7.1.9, and 7.2. No public exploit or active exploitation has been confirmed; EPSS at 0.21% (11th percentile) reflects low near-term exploitation probability, and no CISA KEV listing exists at time of analysis.
Memory corruption in the Linux kernel's AF_XDP socket (xsk) subsystem arises from two related flaws: missing size validation for launch-time metadata fields that extend beyond the first 16 bytes of struct xsk_tx_metadata, and a race condition where user space can modify transmit flags concurrently with kernel transmit processing. A local attacker with low-privilege access who can create and configure AF_XDP sockets may trigger out-of-bounds memory access, leading to high-impact compromise of confidentiality, integrity, and availability consistent with the CVSS 7.8 score. No public exploit code has been identified, EPSS sits at 0.21% (11th percentile), and the CVE is absent from CISA KEV, placing practical exploitation risk well below what the raw CVSS score might suggest.
Use-after-free race condition in the Linux kernel at91sam9_wdt watchdog driver allows a local attacker with low privileges on affected AT91 SAM9 SoC hardware to corrupt freed memory, potentially achieving kernel-level code execution. The flaw arises because at91_ping() rearms a kernel timer from within its own callback, while timer_delete() neither waits for an in-flight callback to finish nor prevents rearming - leaving a window during probe failure or driver removal where the timer accesses devm-allocated memory that has already been freed. No public exploit has been identified at time of analysis, and EPSS probability is very low (0.21%, 11th percentile), consistent with the hardware-specific and timing-dependent nature of this race.
Use-after-free race condition in the Linux kernel's amba-pl011 serial driver allows a local unprivileged user on ARM-based hardware to corrupt kernel memory, potentially escalating to full system compromise. The RS485 hrtimers embedded in the devm-managed port structure can fire after the port is freed, and the IRQ handler can arm a timer immediately before teardown, creating the race window. No public exploit exists and EPSS is 0.21% (11th percentile), but kernel-level use-after-free primitives are well-understood exploitation targets and patched stable releases are available.
Out-of-bounds slab write in the Linux kernel ALSA FCP (FireWire Control Protocol) driver allows local unprivileged processes to corrupt up to 888 bytes of adjacent kernel heap memory by reading audio controls on /dev/snd/controlC0, once a privileged actor has installed an oversized Level Meter map. The mismatch between the driver's 255-entry map limit and the 128-entry ABI array in struct snd_ctl_elem_value creates a persistent, exploitable write primitive reachable by any process with device read access. No public exploit has been identified and no active exploitation is confirmed; vendor-released patches are available in Linux 7.2, 7.1.9, and 6.18.45.
Use-after-free in the Linux kernel perf/core subsystem allows a local low-privileged user to dereference freed kernel memory by racing CPU hot-unplug against perf event group management. When a sibling event is detached via DETACH_GROUP during CPU hotplug, its group_leader pointer is not reset; if the leader is subsequently freed while the sibling's file descriptor remains open, a PERF_IOC_FLAG_GROUP ioctl on the sibling follows the stale pointer into freed memory, potentially enabling kernel crash or privilege escalation to root. No public exploit has been identified at time of analysis and EPSS is low at 0.21% (11th percentile), but the local exploit path with full C:H/I:H/A:H impact warrants prompt patching, particularly on systems permitting unprivileged perf_event_open access.
Linux kernel zero-copy networking in zerocopy_fill_skb_from_devmem() permits improper mixing of net_iov (device memory) and page-backed fragments within a single socket buffer (skb), causing type confusion and memory corruption in downstream kernel networking code. Affected are kernels from introducing commit bd61848900bff5 across the 6.18.x and 7.x stable series until the respective patch commits were applied. No public exploit or active exploitation is confirmed at time of analysis (EPSS 0.21%, no CISA KEV listing), but the local CVSS 7.8 score reflects credible kernel-level memory corruption risk for systems where devmem TCP zero-copy is configured and in use.
Out-of-bounds write in the Linux kernel's IPVS subsystem (`ip_vs_nat_icmp`) allows a local attacker with low privileges to corrupt kernel memory by exploiting a TOCTOU race on the IP header length field (`ihl`), which is read multiple times during ICMP packet NAT processing. Affected systems include any Linux kernel from version 2.6.12 through the pre-patch range across multiple stable branches (fixed in 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2). An attacker achieving kernel memory corruption via this path could escalate privileges to full kernel control; no public exploit or CISA KEV listing has been identified at time of analysis.
Race condition in the Linux kernel's GPIO PCA953x driver allows local low-privileged users on systems with PCA953x I2C GPIO expander hardware to trigger incorrect register reads or writes by exploiting missing mutex coverage in pca953x_irq_bus_sync_unlock(). A prior partial fix protected only the interrupt mask register write but left the direction register read unguarded, permitting concurrent threads to interleave I2C transactions and corrupt GPIO expander state on affected kernel stable branches including 6.1.101-6.2, 6.6.42-6.7, and 6.9.11-6.10. No public exploit has been identified and EPSS exploitation probability is 0.20% at the 10th percentile, consistent with negligible real-world exploitation interest.
Use-after-free in the Linux kernel's sched_ext (extensible BPF scheduler) subsystem allows a local low-privileged attacker to corrupt kernel memory, potentially achieving full confidentiality, integrity, and availability compromise of the affected system. The race condition arises when a sub-scheduler enable fails before being linked into the scheduler hierarchy, yet the full teardown path still executes concurrently against root scheduler disable, causing tasks to be re-homed onto an already-freed scheduler hierarchy. No public exploit or POC has been identified at time of analysis, and EPSS at 0.20% (10th percentile) reflects negligible observed exploitation activity.
Reference count underflow in the Linux kernel amdxdna (AMD XDNA NPU accelerator) driver allows a local low-privileged user to corrupt kernel memory via a double invocation of vm_ops->close() triggered by failed mmap page insertions. Two error paths in amdxdna_insert_pages() incorrectly release the shmem pages_pin_count and backing GEM object reference while the VMA remains live; the kernel's subsequent VMA teardown fires vm_ops->close() a second time, producing a reference count underflow with potential use-after-free consequences and high impact across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and EPSS is 0.20% (10th percentile), consistent with the niche AMD Ryzen AI hardware requirement limiting real-world exposure.
Reference imbalance in the Linux kernel's BPF conntrack kfuncs allows a local attacker with BPF privileges to trigger an unmatched put_net() call that can destroy a live network namespace and cause kernel panic. The flaw affects __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry(), where opts->netns_id is read non-atomically from a shared BPF map value during both namespace acquisition and release. No public exploit code exists and EPSS is low (0.20%, 10th percentile), but the kernel panic outcome is confirmed by a crash trace in the advisory. Exploitation requires local BPF capability and a concurrent writer to the shared map.
Incorrect TLB flush address targeting in the Linux kernel's zap_pte_range memory management function exposes systems running kernel versions prior to 7.1.9 and 7.2 to local privilege escalation and information disclosure, particularly on AMD systems with EFER.TCE enabled and Intel systems using INVPCID. A low-privileged local attacker can exploit a race where the kernel flushes the wrong virtual address after freeing a page table, leaving stale CPU paging-structure-cache entries that can be speculatively accessed or cause the freed table to be reused with potentially attacker-controlled data. No public exploit code or active exploitation (CISA KEV) has been confirmed at time of analysis, and the 0.20% EPSS score reflects the complexity of reliable exploitation.
Memory corruption in the Linux kernel's eventfs subsystem allows a local low-privileged user to trigger a use-after-free condition via a race between SRCU inode freeing and concurrent list iteration. The root cause is an unsafe union of ei->list with the RCU head, combined with absent memory barriers around the is_freed flag, permitting a racing reader to dereference a pointer that has been overwritten by the RCU freelist mechanism. No public exploit code exists and the CVE is absent from CISA KEV; EPSS of 0.20% (10th percentile) confirms negligible observed exploitation activity, placing real-world risk well below what the 7.8 CVSS score implies.
Incorrect idmap context in Linux kernel fscrypt allows a low-privileged local user on an idmapped-mount filesystem to bypass ownership checks when setting fscrypt encryption policies via FSCRYPT_IOC_SET_POLICY, and simultaneously causes legitimate directory owners to be wrongly denied access with EACCES. The flaw affects ext4, f2fs, and other fscrypt-capable filesystems mounted with idmapped-mount configurations - a setup common in container runtimes and rootless Kubernetes node deployments from kernel 5.12 onward. No public exploit is identified at time of analysis, and EPSS of 0.14% (3rd percentile) reflects minimal observed exploitation interest.
Price integrity bypass in the Advanced Product Fields (Product Addons) for WooCommerce plugin allows unauthenticated shoppers to complete purchases at the base product price while receiving paid addons without charge, effectively constituting theft of digital or physical goods from merchants. Versions up to and including 1.6.21 are affected due to a logic flaw in the cart validation function; a partial patch was shipped in 1.6.19 but did not fully close the exposure. No public exploit code or CISA KEV listing is identified at time of analysis, though the low exploitation complexity makes opportunistic abuse straightforward.
Kernel panic in Linux mlx5 (Mellanox/NVIDIA ConnectX) driver's firmware tracer subsystem allows a system crash when the devlink health reporter fires on a device where fw_tracer initialization returned ERR_PTR rather than NULL. The stored ERR_PTR is never validated against IS_ERR() before dereference in mlx5_fw_tracer_trigger_core_dump_general, resulting in an Oops and fatal kernel panic as confirmed by the full crash trace in the CVE description. No public exploit has been identified at time of analysis; EPSS is 0.22% (13th percentile), and the vulnerability is not listed in CISA KEV - though the availability impact when triggered is total (system crash). Multiple patched stable-kernel versions are available.
Memory exhaustion in the Linux kernel's netfilter bridge subsystem allows network-adjacent unauthenticated attackers to cause denial of service by sending non-IP Ethernet frames through a bridge host configured with nftables conntrack zone set rules. The root cause is that nf_ct_bridge_pre() overwrites skb->_nfct with IP_CT_UNTRACKED for non-IPv4/non-IPv6 EtherTypes without releasing the existing conntrack template reference, leaking slab memory indefinitely until the host exhausts kernel memory. No public exploit exists and EPSS is 0.22% (13th percentile), indicating low real-world exploitation likelihood despite the High availability impact rating; risk is further bounded by the requirement for a specific non-default nftables configuration.
Out-of-bounds memory read in the Linux kernel's IPv6 stack exposes up to 8 bytes of adjacent kernel memory per crafted Router Advertisement. The flaw in `rt6_route_rcv()` permits a link-local attacker to send a Route Information option with an RFC 4191-invalid prefix_len/length combination, causing `ipv6_addr_prefix()` to read beyond the option boundary and install the overread bytes as a route prefix visible to unprivileged userspace via `ip -6 route show`. No public exploit has been identified at time of analysis and EPSS is 0.22% (13th percentile), though the attack requires no authentication and only link adjacency.
TCP Fast Open queue accounting in the Linux kernel becomes inaccurate following SO_REUSEPORT listener migration, permitting far more pending TFO connection requests than the configured TCP_FASTOPEN max_qlen limit allows. The root cause is a counter mismatch: fastopenq.qlen is charged against the original listener during child creation in tcp_fastopen_create_child() but uncharged against a different socket after inet_reqsk_clone() repoints the migrated child's rsk_listener to the new listener, causing the surviving listener's qlen to drift negative and its max_qlen guard to stop firing. No public exploit has been identified and EPSS stands at 0.21% (12th percentile), but any server combining SO_REUSEPORT with TCP Fast Open is vulnerable once listener migration has occurred.
Kernel memory exhaustion in the Linux net/smc subsystem enables remote denial-of-service against servers using SMC listen sockets. A TOCTOU race between smc_listen_out() and listener socket close allows an unauthenticated remote attacker to enqueue child socket objects onto a dead listener - each leaking a smc_sock, clcsock, and unreleased reference - by flooding TCP connections during the server's close() window. Patches are confirmed available across multiple stable kernel branches (5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2+); no public exploit code or CISA KEV listing has been identified at time of analysis.
Memory exhaustion in the Linux kernel's ax88179_178a USB Ethernet driver allows socket buffers to leak on every failed TX linearization attempt under memory pressure. Systems with ASIX AX88179 or AX88178A USB-to-Ethernet adapters loaded with scatter-gather (NETIF_F_SG) enabled are affected: when skb_linearize() fails inside ax88179_tx_fixup(), the function returns NULL without freeing the original skb, and the caller usbnet_start_xmit() never releases it because its local skb pointer is now NULL. No public exploit has been identified and EPSS probability is negligible (0.21%, 12th percentile); the practical risk is gradual kernel memory exhaustion on systems continuously operating under low-memory, high-TX-load conditions with the specific USB hardware connected.
Deadlock in the Linux kernel's netfilter nf_conntrack subsystem can be triggered remotely by sending malformed TCP or SCTP packets when nfnetlink_log with conntrack export is active as the logging target. The logging emission path re-enters conntrack netlink glue code and attempts to re-acquire ct->lock already held by the conntrack processing path, causing a kernel deadlock and system-wide denial of service. No exploit code is publicly available and EPSS stands at 0.21% (11th percentile), indicating very low current exploitation activity; patches for multiple stable kernel branches are confirmed available.
Unbounded kernel memory exhaustion in the Linux kernel's traffic control connection tracking action (act_ct) allows unauthenticated remote attackers to leak one sk_buff plus its data buffer per malformed IP packet on systems with a clsact TC chain configured with 'action ct'. The defect in tcf_ct_act() causes error paths from header sanity checks to return TC_ACT_CONSUMED - signaling ownership transfer - while the sk_buff is still owned by the caller and never freed, resulting in progressive kernel memory exhaustion. No public exploit has been identified at time of analysis; EPSS is low at 0.21% (percentile 11%), and the vulnerability is not in CISA KEV.
Reference count leak in the Linux kernel netfilter flowtable offload path allows a remote attacker to cause a denial of service by sending network packets through a system with nf_flow_table offload configured. The flaw occurs in nf_flow_offload_ip_hook() and the XFRM offload path when skb_dst_set_noref() overwrites an existing ref-counted dst_entry without first dropping it, leaking the reference and triggering a DEBUG_NET_WARN_ON_ONCE kernel assertion. No public exploit has been identified at time of analysis; EPSS of 0.21% (11th percentile) and absence from CISA KEV confirm low opportunistic exploitation activity. Upstream patch commits and fixed stable releases 6.18.45, 7.1.9, and 7.2 are available.
Reception stall denial-of-service in the Linux kernel's ntb_netdev driver allows remote unauthenticated attackers to progressively exhaust the NTB network interface's RX queue by triggering repeated memory allocation failures during packet reception, ultimately halting all inbound packet delivery while the interface remains administratively up. Systems with NTB-capable PCIe hardware (Non-Transparent Bridge interconnects) running affected kernel versions are at risk; standard Linux deployments without this hardware are entirely unaffected. No public exploit has been identified at time of analysis, and EPSS sits at the 10th percentile, consistent with the specialized hardware prerequisite; upstream stable commits confirming the fix are publicly available.
Null-pointer dereference and promiscuity counter underflow in the Linux kernel bonding driver's ALB monitor can crash the kernel or permanently pin a network interface in promiscuous mode. The bond_alb_monitor() workqueue function reads primary_is_promisc under RCU, drops that lock, then acquires RTNL - allowing the active slave to be removed or changed in the intervening window, leaving the monitor to act on stale state. Linux systems from kernel 2.6.24 through unpatched stable branches (5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, 7.2) with network bonding explicitly configured in ALB mode are affected. No public exploit identified at time of analysis.
Privilege boundary bypass in the Forminator Forms WordPress plugin (versions 1.40.0 through 1.57.0.5) enables any site-level administrator on a WordPress multisite network to modify a network-wide setting that triggers arbitrary code execution across all sites on the network, effectively allowing lateral escalation from single-site admin to full network compromise. This collapses the critical trust boundary between WordPress multisite's site administrator and network (super) administrator roles. No public exploit or CISA KEV listing exists at time of analysis, but the EPSS score of 0.18% (8th percentile) indicates low automated exploitation activity - not low potential impact.
Arbitrary file read in NLTK before 3.10.0 stems from a logic defect in FileSystemPathPointer.open() where the sandbox path validation compares a normalized path against itself, rendering the security boundary permanently non-functional rather than conditionally bypassable. Authenticated attackers who can influence calls to nltk.data.load() - for example, via an application that accepts user-supplied resource identifiers - can supply file:// URLs to exfiltrate any file accessible to the process account, including credentials, environment files, and application configuration. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code is identified at time of analysis; however, the trivially exploitable nature of the tautological check warrants prompt patching.
Slab-out-of-bounds read in the Linux kernel's ATM subsystem `vcc_setsockopt()` exposes kernel heap memory and can crash the kernel for local low-privileged users. The defect stems from a short-circuited optlen validation - when the caller passes a mismatched `level` parameter, the length check is bypassed entirely, and a secondary path through cgroup BPF setsockopt filters can shrink optlen after a passing check, both leading to `copy_from_sockptr()` reading beyond the supplied buffer. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.24% at the 16th percentile, reflecting low real-world exploitation probability against a legacy subsystem.
Kernel memory disclosure in the Linux bnxt_re RDMA driver (Broadcom NetXtreme RDMA) exposes 4092 bytes of stale kernel data to local users holding InfiniBand device access. The bnxt_re_alloc_ucontext() function allocates the user context shared page with __get_free_page(GFP_KERNEL), which does not zero memory, then maps the page into userspace - leaving all bytes beyond the 4-byte AVID write at offset 0x10 uninitialized and fully readable by the calling process. Exploitation requires only a single mmap() call after IB_USER_VERBS_CMD_GET_CONTEXT, making it trivially scriptable; no public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects low observed exploitation activity.
Out-of-bounds read in the Linux kernel ptp_ocp driver exposes kernel memory and risks availability on systems equipped with OCP PTP time-synchronization hardware. The ptp: ocp driver reads a fixed 13-byte EEPROM board ID field without enforcing a NUL terminator before passing it to devlink_info_version_fixed_put(), causing the function to scan beyond the field boundary as a C string. An attacker with local, low-privilege access on an affected host could trigger this over-read by querying devlink device info, potentially leaking adjacent kernel memory (C:H) or inducing a kernel fault (A:H). No public exploit exists and EPSS is 0.21% (12th percentile), indicating low real-world exploitation activity; however, patches are available across multiple stable kernel branches.
Kernel panic in Linux kernel's vhost-scsi subsystem can be triggered by a malicious guest VM when T10 Protection Information (PI) is negotiated, crashing the host kernel and all co-hosted virtual machines. A guest sends a malformed SCSI request with protection byte lengths equal to or exceeding the payload, causing an integer underflow or zero-count scatterlist that hits an unconditional BUG_ON assertion in sg_alloc_table_chained(). With EPSS at 0.21% (11th percentile), no CISA KEV listing, and no public proof-of-concept identified at time of analysis, exploitation probability is currently low but the guest-to-host scope change makes this a meaningful availability risk in multi-tenant virtualized storage environments.
NULL pointer dereference in the Linux kernel's tap_get_user_xdp() function can be triggered by a local attacker or malicious guest VM to crash the host kernel. The flaw arises because skb->dev is not assigned before tun_vnet_hdr_to_skb() is called in the XDP path, while the parallel code path tap_get_user() had already received a fix for the identical ordering defect. Impact is limited to availability - host kernel panic - with no confidentiality or integrity compromise possible. No public exploit or CISA KEV listing has been identified; EPSS at 0.21% reflects negligible observed exploitation activity.
Authorization bypass in WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 allows any authenticated user to forge two-party affiliation consent records and subsequently hijack video ownership of arbitrary content on the platform. The Users_affiliations add.json.php endpoint accepts attacker-controlled counterparty agreement timestamps without verification, enabling creation of forged affiliation records with approved status that are then unconditionally trusted by the videoAddNew.json.php ownership-transfer endpoint. No public exploit code or CISA KEV listing has been identified at time of analysis; however, only a low-privilege account is required, making this accessible to any registered user on a vulnerable instance.
Unbounded memory allocation in the Linux kernel's vhost_iotlb subsystem allows availability impact on the host system via exhaustion of kernel memory. The flaw exists in vhost_iotlb_add_range_ctx(), where non-retiring IOTLB tables bypass the configured entry limit and continue allocating entries indefinitely - including via guest-controlled or userspace requests to vhost, mlx5 vDPA, VDUSE, and vhost-vDPA subsystems. No public exploit code has been identified at time of analysis, and EPSS probability is very low (0.20%), but the CVSS scope-change metric (S:C) reflects that a guest workload can impact host kernel availability.
Cross-site request forgery in WWBN AVideo through commit 9c39d8c8 allows remote attackers to permanently publish embargoed videos by tricking an authenticated administrator into loading a malicious GET request targeting the releaseVideoNow.json.php endpoint. The endpoint accepts state-changing GET requests without any CSRF token or origin validation, relying solely on the browser's ambient session cookie. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, though the GET-based CSRF pattern is trivially weaponizable via a one-pixel image tag or link.
Out-of-bounds read in S2OPC's AddNodes service allows remote attackers to trigger memory read violations via a crafted UserAccessLevel argument, causing low-severity availability impact on vulnerable server instances running version 1.7.3 and earlier. The flaw resides in SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes within the address space management layer of this OPC UA stack, which is deployed primarily in industrial automation and ICS/SCADA environments. A public proof-of-concept exploit has been disclosed, though high attack complexity (AC:H) limits opportunistic exploitation; no public exploit identified at time of analysis as a KEV-confirmed active threat.
Password-protected gallery categories in JoomGallery versions prior to 4.3.1 are fully accessible to unauthenticated remote attackers by switching the request format to JSON via the `format=json` URL parameter. The HTML view correctly enforces the password gate, but the JSON view controller lacks any equivalent access control check, exposing protected image metadata and content without requiring credentials. No public exploit has been identified at time of analysis, though the bypass is trivially replicable directly from the vulnerability description.
Secret exfiltration via URL parameter interpolation in SiYuan's http_request MCP tool affects all versions before v3.8.0. An MCP client with elevated access can embed secret placeholder references directly in the destination URL of an http_request tool call, causing SiYuan to resolve and transmit stored plaintext secrets to any attacker-controlled host without user confirmation. No public exploit has been identified at time of analysis, but the exploitation mechanism is straightforward for any party holding MCP client access.
Unauthenticated row disclosure in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows any remote, unauthenticated user to read arbitrary form row data by invoking the form.inlineedit controller, which performs no access checks before returning database rows. The flaw is purely an authorization omission (CWE-284) rather than a logic or cryptographic weakness, making it trivial to exploit against any Joomla installation with Fabrik active. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated network-accessible nature (CVSS 4.0: AV:N/AC:L/PR:N) keeps real-world risk meaningful for sites that store sensitive user-submitted form data.