Privilege escalation in WPeMatico RSS Feed Fetcher (all versions through 2.8.24) allows any authenticated WordPress subscriber to gain full administrative access by invoking the unprotected wpematico_import_settings function. The missing capability check permits arbitrary WordPress site options to be overwritten, enabling attackers to enable user registration and set the default registration role to administrator - a two-stage takeover requiring only a valid subscriber account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack chain is low-complexity and directly actionable by any authenticated user.
Stack-based buffer overflow in the Comfast CF-N1-S 2.6.0.1 web management interface enables remote code execution via the NTP timezone configuration CGI endpoint. The vulnerable function sub_41AD7C in /cgi-bin/mbox-config?method=SET§ion=ntp_timezone fails to validate the length of the timestr and ntp_client_enabled parameters before copying them to the stack. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.6 reflects high impact across both the vulnerable device and connected network infrastructure.
Remote code execution in NLTK's TransitionParser component allows arbitrary OS command execution when a victim loads a crafted transition-parser model file. The AllowlistUnpickler in NLTK before 3.10.3 validated only the module string during deserialization, not the global name - enabling attribute traversal via dotted names (e.g., resolving 'sklearn.os.system' through getattr chaining on an allowlisted 'sklearn' namespace) to reach callable sinks the allowlist never intended to expose. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with no authentication prerequisite reflects significant risk for pipelines that ingest externally-sourced NLP models.
Buffer overflow and stale-memory disclosure in the Linux kernel's staging rtl8723bs WiFi driver allow a malicious access point within radio range to corrupt kernel memory or leak sensitive buffer contents before any association occurs. The flaw resides in OnAuthClient(), which copies a WLAN_EID_CHALLENGE element's attacker-controlled length - up to 255 bytes - into a fixed 128-byte chg_txt buffer via memcpy(), enabling an overflow of up to 127 bytes or an underfill that echoes stale kernel memory. No public exploit has been identified at time of analysis and EPSS probability is low (0.26%, 18th percentile), but the adjacent-network unauthenticated attack vector and High impact across confidentiality, integrity, and availability make this a notable risk for any deployment relying on WEP shared-key authentication with this chipset.
Use-after-free in the Linux kernel VXLAN driver allows a local, low-privileged user to corrupt kernel memory, potentially escalating to full kernel compromise. The flaw exists in vxlan_changelink(), which arms age_timer without checking whether the device is up via netif_running(); when the device is subsequently deleted, free_netdev() releases the vxlan_dev struct - including the embedded timer - while that timer remains queued on a timer_base. Because the rtnl operations are netns-scoped, an unprivileged user can trigger the entire sequence inside a new user and network namespace without elevated system privileges. No public exploit or CISA KEV entry is identified at time of analysis; EPSS of 0.22% (13th percentile) reflects low current exploitation activity, though the local-user-namespace reachability makes this a meaningful local privilege escalation risk on any Linux system permitting user namespace creation.
Thunderbolt networking driver (tbnet) in the Linux kernel crashes the XDomain control channel due to an incorrect teardown ordering introduced since the driver was added in Linux 4.15, requiring a physical power cycle of the Thunderbolt controller to recover. Systems running Linux 4.15 through the pre-patch stable branches with active Thunderbolt peer-to-peer networking links (XDomain) are affected when a privileged user or process tears down the network interface. No public exploit exists and EPSS is 0.21% (12th percentile), consistent with a niche-deployment, privilege-required availability issue rather than opportunistic network attack; the NVD CVSS 8.8 with C:H/I:H appears overstated relative to the actual described impact.
TX DMA buffer mismanagement in the Linux kernel's Qualcomm GENI serial driver (qcom-geni) allows a local low-privileged user to hang the system indefinitely and potentially corrupt kernel memory on affected Qualcomm hardware. The driver's DMA-mode uart_ops lacks a flush_buffer callback, enabling in-flight DMA transfers to underflow the transmit kfifo and re-submit page-sized transfers indefinitely; a concurrent flaw in the stop path unmaps the DMA buffer while the serial engine is still reading it. No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile), but the user-triggerable hang and DMA use-after-unmap represent a real availability and potential integrity risk on affected Qualcomm platforms.
The vhost-scsi subsystem in the Linux kernel allows a local attacker with low privileges on a KVM virtualization host to trigger a kernel BUG_ON assertion and crash the host by manipulating VIRTIO feature bits after SCSI endpoint setup. The flaw is that vhost_scsi_set_features() incorrectly accepted changes to VIRTIO_SCSI_F_T10_PI after an active endpoint was established, leaving per-command protection scatterlist arrays (prot_sgl) unallocated while the I/O path proceeded under the updated feature state; when a 129-page protection payload arrives, a BUG_ON(nents > SG_CHUNK_SIZE) fires in sg_pool_index(), panicking the host kernel. Patches are confirmed for stable branches 6.18.45 and 7.1.9 and mainline 7.2; no public exploit exists and no CISA KEV listing is present, with an EPSS of 0.21% (11th percentile).
Use-after-free and double-free memory corruption in the Linux kernel's net/dibs network subsystem allows an adjacent network attacker to trigger kernel memory corruption via a race condition between the dibs device interrupt handler and device teardown. The UAF arises because an active interrupt handler can continue accessing dmb_clientid_arr after dibs_dev_del() releases it; a separate double-free path exists when dibs_dev_add() fails during dibs_lo_dev_probe(). No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile), indicating low exploitation likelihood despite the high CVSS score.
Race conditions in the Linux kernel KVM/SVM subsystem allow local attackers with low privileges to corrupt the SEV mirror VM list or trigger incorrect reference counting in the hypervisor. Two distinct concurrency flaws exist: sev_migrate_from() modifies the owner's mirror_vms list without holding the owner lock, enabling list corruption when concurrent COPY or destroy operations race with a migration; and sev_vm_destroy() can read a stale enc_context_owner pointer after it changes via a concurrent KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM ioctl, causing kvm_put_kvm() to be called on the wrong VM struct. No public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.21% (11th percentile) reflects the narrow exploitation conditions required.
Stored cross-site scripting in the Slider Hero with Video Background, Animation WordPress plugin (versions before 9.1.3) allows unauthenticated remote attackers to inject persistent malicious JavaScript by exploiting missing authorization and nonce checks on two of the plugin's request handlers. The injected payload executes in two distinct contexts: within the WordPress admin area when an administrator views the plugin's settings, and on the public-facing frontend for any visitor loading a page that embeds a slider. This dual-execution surface elevates the impact beyond a typical admin-only XSS, as it enables both administrative session hijacking (leading to full site compromise) and broad visitor-side attacks. No public exploit code or CISA KEV listing has been identified; EPSS sits at 0.19% (8th percentile), indicating low observed exploitation activity at time of analysis.
StreamBackedCorpusView in NLTK before 3.10.0 allows arbitrary local file reads by calling Python's builtins.open() directly, fully bypassing the pathsec.ENFORCE security boundary regardless of how that control is configured. Web applications and services built on NLTK that pass externally controlled values to the fileid argument are at risk of having sensitive system files, credentials, and configuration data read by remote attackers. A vendor-released patch is available in NLTK 3.10.0; no public exploit has been identified at time of analysis.
Symlink-based path traversal in NLTK's FramenetCorpusReader before version 3.10.2 permits attackers with write access to a corpus subdirectory to read arbitrary XML files outside the intended corpus root. The flaw exists because path validation in frame_by_name(), _lu_file(), and doc() checks only for path separator characters in filenames but does not resolve symbolic links before access, allowing a separator-free symlink name to bypass the guard and dereference an out-of-root target. No public exploit code or CISA KEV listing has been identified; the provided CVSS 4.0 vector of PR:N/AV:N is inconsistent with the filesystem write prerequisite described and warrants verification with the vendor.
Privilege escalation in WWBN AVideo through commit 9c39d8c8 enables any user with upload permission to silently hijack an administrator session without knowing their credentials. Two chained functions - deduplicateByEncoderQueueId() exposing video hash tokens without ownership verification, and useVideoHashOrLogin() accepting those tokens as passwordless authentication - create a direct path from low-privilege user to full administrative access. No public exploit has been confirmed and the vulnerability is not listed in CISA KEV, but the low attack complexity and high CIA impact make this a high-priority remediation for any internet-accessible AVideo deployment.
Unbounded recursion in NLTK's JSONTaggedDecoder.decode_obj() (nltk/jsontags.py) allows unauthenticated remote attackers to crash the Python process by submitting a deeply nested JSON payload exceeding Python's default recursion limit of 1000. All NLTK releases before 3.9.4 are affected; exploitation depends on whether the calling application exposes JSONTaggedDecoder to externally-supplied JSON input. A public proof-of-concept is included in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated remote attackers can invoke the onAjax_getFolders AJAX method in the Fabrik Extension for Joomla to enumerate arbitrary server-side directories, exposing file system structure without credentials or user interaction. All versions from 1.0.0 through 4.7.1 are affected across the extension's full release history; version 4.7.2 was released to remediate the flaw. No public exploit code or CISA KEV-confirmed active exploitation has been identified at time of analysis, though the unauthenticated network-accessible nature of the endpoint lowers the bar for opportunistic reconnaissance by automated scanners.
Path traversal and pickle deserialization protections in NLTK before 3.10.0 are effectively disabled by default - pathsec.py sets ENFORCE=False, causing all security validation to emit warnings rather than raise blocking exceptions. Any application using NLTK to process untrusted file paths or serialized data is exposed unless operators have explicitly overridden this default. No public exploit has been identified at time of analysis, but the attack surface is significant wherever NLTK handles attacker-controlled inputs, particularly given that Python pickle deserialization can enable arbitrary code execution.
Unauthorized access to restricted video content in WWBN AVideo (through commit 9c39d8c8) is enabled by a fundamental design flaw in the platform's token subsystem: getToken() produces tokens with no binding to user identity or intended purpose, and the Gallery plugin endpoint (plugin/Gallery/view/sections.php) distributes these tokens freely to unauthenticated visitors. Because the tokens carry no scope constraint, they are accepted as valid authorization across unrelated subsystems including the HLS streaming endpoint (view/hls.php), allowing any remote unauthenticated party to retrieve private video content. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a trivially simple, two-step attack requiring no special tools.
Unauthenticated arbitrary file upload to the web root is possible in Fabrik (a Joomla extension by fabrikar.com) versions 1.0.0 through 4.7.1, via the list email plugin controller which applies no access control before processing uploads. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero authentication and zero complexity requirements against any publicly reachable Joomla deployment running the affected extension. The description constrains uploads to non-executable files, which limits direct remote code execution on hardened servers, but still enables web root content injection, defacement, and potential escalation on misconfigured systems. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated table truncation in the Fabrik Extension for Joomla (versions 1.0.0 through 4.7.1) allows any remote attacker to destroy data by issuing a single HTTP GET request to the list.doempty controller action. The endpoint lacks all ACL gates, making exploitation trivially automatable against any publicly accessible Joomla installation running the affected component. No public exploit has been identified at time of analysis, but the absence of any authentication or complexity barrier means the effective exploitation threshold is near zero.
Unauthenticated database schema disclosure in Fabrik for Joomla (versions 1.0.0-4.7.1) exposes arbitrary table names, column listings, and the Joomla database table prefix to any remote attacker without credentials. The vulnerable ajax_tables method in the extension's elements model responds to AJAX requests without enforcing access control, violating the principle of least privilege (CWE-284). No public exploit code or active exploitation has been identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects the low attack complexity and the high value of schema metadata for downstream attacks.
TLS hostname verification is silently bypassed in Netty's OpenSSL client path, allowing a network man-in-the-middle attacker to intercept encrypted communications by presenting a certificate issued for a different hostname. Affected are applications using io.netty:netty-handler versions 4.2.0.Final through 4.2.16.Final or any 4.1.x through 4.1.136.Final, specifically when the SslProvider.OPENSSL client path is configured with a plain X509TrustManager and running on Java 25 or later, where Unsafe-based trust-manager wrapping is unavailable. No public exploit code has been identified at time of analysis, but the confidentiality impact is high for any affected deployment that transmits sensitive data over TLS.
Stored cross-site scripting in JoomGallery (Joomla extension by joomgalleryfriends.net) versions prior to 4.3.1 allows a privileged authenticated attacker to inject a persistent JavaScript payload into image metadata, which then executes in the browser of every subsequent visitor who views that image or gallery. The attacker plants the payload once and it fires automatically for all future visitors, making this a force-multiplier attack despite the high-privilege prerequisite. No public exploit or active exploitation via CISA KEV has been identified at time of analysis; the fix is upgrading to version 4.3.1.
Stored cross-site scripting in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows unauthenticated remote attackers to persistently inject arbitrary JavaScript via the jsactions feature. When any authenticated user - including site administrators - views content containing the malicious payload, the script executes in their browser context, enabling session hijacking, credential theft, or administrative account takeover. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write path combined with high confidentiality and integrity impact (CVSS 4.0: 8.6) makes this a meaningful risk for Joomla sites running Fabrik.
Symlink escape in NLTK's CorpusReader.open() allows local attackers to read arbitrary files outside the designated corpus root, affecting all versions before 3.9.4. Path boundary validation is performed lexically on the string representation of a path rather than on the resolved filesystem target, so an attacker with write access to the corpus directory can plant a symlink that passes the check yet redirects reads to sensitive files anywhere the host process can access. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.9.4.
Option injection in hashcat's restore file parser (all versions through 7.1.2) allows an attacker who delivers a crafted restore file to append attacker-controlled content to arbitrary files on the victim's system. When a user runs 'hashcat --restore' against the malicious file, output-redirecting options such as --outfile and --potfile-path are accepted from the restore file without restriction, enabling writes to shell startup scripts and subsequent code execution at the victim's privilege level. No public exploit identified at time of analysis; CVSS 4.0 rates this 8.5 with a strictly local attack vector and user interaction required.
Command injection in better-npm-audit through 3.11.0 (and the 4.0.0-rc.2 prerelease) allows arbitrary OS command execution when a value containing shell metacharacters is supplied to the --registry CLI flag. The vulnerability exists because handleInput.ts interpolates the raw registry value into a shell command string that is then passed to Node.js child_process.exec(), which spawns a system shell and interprets metacharacters such as semicolons, pipes, and backticks as command separators or substitutions. No confirmed active exploitation or CISA KEV listing exists at time of analysis, but the vulnerable code path is publicly documented in GitHub issue #119 and the diff of PR #120, significantly lowering the barrier to exploit development.
Arbitrary file deletion in SiYuan before v3.7.4 allows authenticated administrators to recursively destroy any file or directory accessible to the SiYuan kernel process by supplying an unsanitized absolute path to the /api/search/removeTemplate endpoint, which passes the value directly to Go's os.RemoveAll. All SiYuan releases prior to v3.7.4 are confirmed affected per vendor advisory GHSA-w938-w7m4-qrj8. No public exploit or CISA KEV listing exists at time of analysis, but the high integrity and availability impact - including potential downstream filesystem destruction beyond the application - makes admin credential hygiene the critical control.
Use-after-free race condition in the Linux kernel BPF sockmap subsystem allows a local attacker with access to a sockmap-configured TCP socket to corrupt kernel memory, with high impact on confidentiality, integrity, and availability. The flaw exists in tcp_bpf_send_verdict(), where a local pointer copy of psock->sk_redir is made without incrementing the socket reference count before the source socket lock is released, enabling a concurrent sendmsg() thread to free the socket object while the first thread still holds the stale raw pointer. The vulnerability is confirmed by a full KASAN slab-use-after-free trace; no public exploit identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects low current exploitation probability despite the high CVSS base score.
Use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local attacker to trigger kernel memory corruption via a refcount underflow in smc_rx_splice(). The flaw arises because pages are handed to splice_to_pipe() before page and socket references are taken, so entries dropped by smc_rx_spd_release() are released without a matching reference, and multi-page splices pair one sock_hold() with multiple sock_put() calls. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.21% (12th percentile), consistent with limited real-world weaponization at this time.
Use-after-free memory corruption in the Linux kernel vsock/virtio subsystem arises from a race condition between virtqueue worker threads and VM suspend/resume cycles. Worker threads (RX, TX, event) read their virtqueue pointer before acquiring the protective mutex and checking the run flag; a worker delayed across a freeze/restore transition retains a dangling pointer to a freed queue while the restoration installs replacement queues. No public exploit has been identified and EPSS probability is low at 0.21%, though successful exploitation could yield full kernel-level memory corruption with high confidentiality, integrity, and availability impact.
Use-after-free in the Linux kernel's thermal/hwmon subsystem exposes local attackers to potential kernel memory corruption across a wide range of stable kernel branches. The flaw was introduced by a cosmetic code-style cleanup commit (030a48b0f6ce) that inadvertently removed a valid guard from the error path of thermal_add_hwmon_sysfs(), allowing a freed object to be referenced when the function fails. Patches are backported across six stable kernel series (5.15, 6.1, 6.6, 6.12, 6.18, 7.1, and 7.2); EPSS is low at 0.21% and no active exploitation has been identified.
Type confusion in the Linux kernel's PMBus hardware monitor driver (`pmbus_notify()`) enables a slab-out-of-bounds read and potential kernel memory corruption on systems with PMBus-capable power management hardware. The `pmbus_notify()` loop unconditionally casts all attribute pointers to `struct sensor_device_attribute`, but the attribute array also contains `struct pmbus_samples_reg` and `struct pmbus_sensor` objects that only embed a base `struct device_attribute`; reading the `index` field of these miscast pointers accesses memory beyond the allocation or overlaps with unrelated kernel struct fields, producing garbage masks that could spuriously match alert conditions. No public exploit has been identified and EPSS is low (0.21%, 11th percentile), but the theoretical impact is full kernel privilege escalation on affected hardware.
Use-after-free in the Linux kernel's s390/ism driver allows a local attacker on IBM Z (s390) hardware to access freed kernel data structures during device teardown, potentially achieving privilege escalation or kernel memory corruption. The race condition arises because ISM interrupt handlers can remain active concurrently with ism_dev_exit(), reading the already-freed sba and ieq structures before free_irq() drains them. No public exploit code or CISA KEV listing exists at time of analysis; EPSS sits at 0.21% (11th percentile), consistent with its narrow hardware prerequisite.
Insufficient access control granularity in docker-socket-proxy allows adjacent-network attackers without credentials to read arbitrary files and exfiltrate entire container filesystems via four unguarded Docker API endpoints. When the CONTAINERS environment variable is set, the HAProxy-based proxy fails to block /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top, treating namespace-level permission as blanket endpoint permission. No active exploitation or confirmed public exploit code has been identified at time of analysis, though a researcher gist is referenced alongside the upstream fix in PR #183.
Path traversal in NLTK's FramenetCorpusReader and NKJPCorpusReader (all versions before 3.10.0) enables unauthenticated network-reachable attackers to read arbitrary XML files accessible to the application process by supplying crafted selectors or poisoned index state to methods including frame_by_name, doc, lu, and header. The CVSS 4.0 score of 8.2 reflects high confidentiality impact (VC:H) tempered by high attack complexity (AC:H) and a required attack target condition (AT:P), meaning exploitation depends on application code that exposes these specific corpus reader methods to external input. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote denial of service in the Linux kernel's CAKE traffic scheduler (sch_cake) allows an unauthenticated network attacker to trigger a kernel panic or persistent warning-log flood by sending malformed IP packets to a system with the CAKE qdisc actively configured. Affected systems running Linux 4.19 through unpatched versions of the 7.x series face kernel panic if the non-default `panic_on_warn=1` boot parameter is set, or dmesg flooding otherwise. No public exploit has been identified and this CVE is not in the CISA KEV catalog, but the fix is low-risk and multiple patched stable kernel versions are available.
Data corruption in the Linux kernel bnxt_en driver (Broadcom NetXtreme-E) occurs when TCP Packet Aggregation (TPA) is active alongside PCIe Relaxed Ordering (RO) on AGG rings. When EOP (End-of-frame padding) is used, zero-padding bytes appended at the end of one aggregated segment can spill over and overwrite valid data at the start of the subsequent segment. Older chips (P5 generation and earlier, including the Broadcom 57508) do not automatically suppress RO when EOP is active, making ARM-hosted deployments using these adapters particularly vulnerable to silent data corruption in received network traffic. No public exploit is identified at time of analysis, and EPSS probability is low at 0.21% (12th percentile).
Out-of-bounds read in the Linux kernel's staging RTL8723BS WiFi driver allows adjacent-network unauthenticated attackers to leak kernel heap memory or crash the affected system by transmitting a crafted 802.11 management frame. The flaw lives in rtw_get_wpa_ie(), which accesses fixed byte offsets within a vendor-specific information element without verifying the IE body is at least 6 bytes long, enabling reads past the end of a kmemdup'd allocation when a short trailing IE is present. No active exploitation is confirmed (absent from CISA KEV) and EPSS sits at 0.22% (13th percentile), but the adjacent-network, no-authentication attack vector represents a meaningful risk for embedded and single-board systems carrying RTL8723BS hardware.
The IMA (Integrity Measurement Architecture) subsystem in the Linux kernel fails to invalidate action cache flags (IMA_DONE_MASK) when files are truncated, because the file_truncate and path_truncate LSM hooks were not instantiated in IMA's hook logic. Authenticated local users who can truncate a file covered by an active IMA policy can exploit this gap - causing the kernel to skip re-measurement, re-auditing, and re-appraisal on the next file access, effectively bypassing IMA integrity enforcement for that file. No public exploit has been identified, the vulnerability is absent from CISA KEV, and the EPSS score of 0.21% (11th percentile) reflects very low observed exploitation probability despite the assigned CVSS score of 8.1.
Authentication bypass in the Firebase Authentication WordPress plugin (all versions before 1.7.1) permits unauthenticated remote attackers to impersonate any WordPress account - including administrators - by presenting an unverified Firebase JWT whose email claim matches a WordPress user. The plugin fails to check the `email_verified` field before binding the Firebase identity to a WordPress session, enabling account takeover without knowledge of the target's password. No public exploit is identified at time of analysis and EPSS sits at 0.20% (11th percentile), but the unauthenticated admin takeover potential makes this a high-priority patch for any site running the affected plugin.
Remote administrative account takeover in the ManageWP Worker WordPress plugin (versions before 4.9.37) is possible because login links are neither bound to a specific user account nor invalidated after first use, enabling replay attacks. Any attacker who intercepts or obtains a ManageWP-generated login link - whether it has been previously used or not - can replay it to establish an authenticated session as any WordPress user on the target site, including administrators. No public exploit has been identified at time of analysis, and the vendor-released patch (4.9.37) is available.
Out-of-bounds memory access in the Linux kernel's packet socket subsystem (net/packet) allows a local attacker with CAP_NET_RAW or equivalent network namespace privileges to trigger kernel memory corruption via the PACKET_QDISC_BYPASS transmit path. The flaw exists because packet_parse_headers() fails to reset skb->mac_header for SOCK_DGRAM, SOCK_PACKET, and protocol-bound SOCK_RAW sockets, causing any driver that reads eth_hdr(skb) during transmit to dereference an address approximately 64 KiB past the socket buffer head. No public exploit has been identified and no CISA KEV listing exists; patches are available across at least eight stable kernel branches.
Privilege escalation in the Linux kernel BPF verifier affects versions from 4.16 through current stable branches due to incomplete pointer state propagation during commuted arithmetic (scalar += pointer) in adjust_ptr_min_max_vals(). Local attackers with BPF program loading privileges can exploit the verifier's failure to copy the full bpf_reg_state structure, potentially bypassing memory safety enforcement and achieving arbitrary kernel memory access. No public exploit has been identified at time of analysis and EPSS is low at 0.22%, but the CVSS score of 7.8 (C:H/I:H/A:H) reflects the severity of kernel-level impact if successfully exploited.
Kernel BUG triggerable in the Open vSwitch (OVS) net subsystem allows a local low-privileged attacker to crash the kernel or potentially escalate privileges by injecting undersized Ethernet frames through a TUN device. Affected kernels from Linux 4.10 onward trust the user-supplied skb->protocol field on ARPHRD_NONE devices without validating that sufficient linear data exists for Ethernet header parsing, causing __skb_pull() to hit an unconditional BUG halt. No public exploit code has been identified and EPSS probability stands at 0.22% (13th percentile), indicating low opportunistic exploitation risk; however, patches are available across all active stable branches.
Race condition in the Linux kernel virtual terminal subsystem exposes a use-after-free condition when kbd_keycode() reads vc->port.tty without holding a reference, while con_shutdown() concurrently clears that pointer under a separate lock. Affected versions span every maintained stable series from 5.10 through 7.x; patches are available across all branches. No public exploit code exists and EPSS is very low at 0.22% (13th percentile), but the CVSS 7.8 local score reflects real kernel memory corruption potential that could enable privilege escalation.
Use-after-free in the Linux kernel netfilter ebt_nflog subsystem allows a local attacker with low privileges to trigger kernel memory corruption by racing ebtables NFLOG rule execution against nfnetlink_log module teardown. Affected kernels from version 4.12 through multiple stable branches (pre-patch) fail to acquire a module reference on the nfnetlink_log backend before invoking nfulnl_log_packet(), unlike the xt_NFLOG and nft_log frontends. KASAN-confirmed heap use-after-free at instance_lookup_get_rcu can result in full kernel compromise (C:H/I:H/A:H). No public exploit identified at time of analysis; EPSS at 0.22% (13th percentile) reflects low near-term exploitation probability.
Use-after-free race condition in the Linux kernel's IPv4 routing subsystem allows a local low-privileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw is in fib_nhc_update_mtu(), which traverses the PMTU nexthop exception (FNHE) table without proper serialization against concurrent FNHE eviction, creating a window where freed memory is accessed after a completed RCU grace period. No public exploit code has been identified at time of analysis, and an EPSS of 0.22% (13th percentile) reflects very low near-term exploitation probability despite the 7.8 CVSS score.
Out-of-bounds reads in the staging rtl8723bs WiFi driver's monitor mode transmit path expose Linux kernel systems equipped with Realtek RTL8723BS hardware to memory disclosure, corruption, and denial of service. The driver function rtw_cfg80211_monitor_if_xmit_entry() strips the variable-length radiotap header and then reads the 802.11 frame control field without verifying the socket buffer still contains a minimum MAC header; for data frames it additionally pulls the full calculated 802.11/QoS/SNAP span before confirming the skb holds that much data. A local attacker with low privileges can inject a truncated 802.11 frame to trigger the flaw; no public exploit has been identified at time of analysis and EPSS stands at 0.22%, indicating low automated exploitation probability.
Out-of-bounds memory read in the Linux kernel's fbdev bitblit subsystem allows a local attacker with tty group write access to /dev/vcsa to crash the kernel or disclose kernel memory by supplying an out-of-range glyph index through the virtual console screen interface. The root cause is a missing bounds check in bit_cursor() in drivers/video/fbdev/core/bitblit.c - a sibling function to bit_putcs_aligned() and bit_putcs_unaligned(), which already received the same clamp in commit 18c4ef4e765a. No public exploit has been released and EPSS of 0.22% (13th percentile) indicates very low active exploitation probability; this is not in CISA KEV.