Use-after-free race condition in the Linux kernel BYD PS/2 mouse driver allows a local low-privileged user to corrupt kernel memory by racing a device disconnect event against in-flight timer callbacks. Affected systems must run an unpatched Linux kernel with BYD PS/2 touchpad hardware present and the byd module loaded, spanning stable branches from approximately kernel 4.6 through pre-fix releases ahead of 6.18.46, 7.1.10, and 7.2. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.
Symlink following in Dell PowerProtect Cyber Recovery (versions prior to 20.3.0.0) enables a low-privileged local attacker to perform script injection by redirecting privileged file operations through attacker-controlled symbolic links. All three impact dimensions - confidentiality, integrity, availability - are rated High by the vendor, reflecting the potential for full local system compromise on a sensitive data-protection appliance. No public exploit exists and EPSS sits at the 2nd percentile (0.11%), with SSVC confirming no observed active exploitation, indicating limited near-term real-world risk despite the High CVSS score.
Out-of-bounds memory write in the Linux kernel's ASoC lpass-tx-macro audio codec driver allows a local low-privileged user to corrupt kernel memory via misconfigured ALSA enum kcontrol access, with potential for privilege escalation. The driver's get and put handlers for DEC0-DEC7 MODE controls incorrectly access the 8-byte integer union field instead of the 4-byte enumerated union field, writing 4 bytes beyond the intended boundary on 64-bit systems. No public exploit code has been identified at time of analysis, but the pattern mirrors two previously fixed sibling drivers (rx-macro, va-macro), confirming the root cause is well-understood.
Out-of-bounds kernel memory write in the Linux framebuffer device (fbdev) subsystem exposes systems to potential privilege escalation by local low-privileged users. The flaw resides in show_modes(), which accumulates unchecked snprintf() return values while building sysfs output, allowing the write offset to advance beyond the PAGE_SIZE sysfs buffer when a display device has a sufficiently long modelist. No public exploit has been identified at time of analysis; patched kernel versions 7.1.10 and 7.2 are available via the stable kernel tree.
Use-after-free in the Linux kernel's fbdev framebuffer subsystem allows a local low-privileged user to trigger a stale pointer dereference with potential for information disclosure, memory corruption, or privilege escalation. When userspace issues FBIOPUT_VSCREENINFO with FB_ACTIVATE_INV_MODE via the fb_set_var() path, a videomode entry may be deleted from the modelist while fb_info->mode still holds a dangling pointer to the freed entry; a subsequent sysfs read via show_mode() then dereferences freed kernel memory. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
PMD huge page mapping boundary violation in the Linux kernel's drm/shmem_helper subsystem allows local users with low privileges to trigger out-of-bounds memory mappings via the DRM ->huge_fault handler. The handler installs PMD-level Transparent Huge Page mappings without verifying they remain within Virtual Memory Area boundaries, triggering a VM_BUG_ON_VMA() assertion when the mapping subsequently reaches copy_pmd_range() during fork or remap operations. Patches have been committed to Linux 7.1.10 and 7.2 stable branches; no public exploit has been identified at time of analysis.
Out-of-bounds memory access in the Linux kernel's cs40l50-vibra haptic driver allows a local low-privileged user to read or write beyond allocated kernel buffers by submitting a crafted force-feedback effect via EVIOCSFF ioctl. The driver's cs40l50_add() function fails to validate user-supplied custom_len before dereferencing custom_data[0] and custom_data[1], and an integer sign-wrap in bank type handling permits negative array indexing into vib->dsp.banks[]. Three distinct code paths are exploitable: zero-length allocation returning ZERO_SIZE_PTR, single-word allocation followed by a two-word read, and s16 overflow enabling out-of-bounds bank array access. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Integer overflow and missing input validation flaws in the Linux kernel's s390/zcrypt subsystem allow a local low-privileged user to trigger kernel buffer overflows and uninitialized memory reads, yielding full confidentiality, integrity, and availability impact. The vulnerable function `xcrb_msg_to_type6cprb_msgx()` fails to validate CPRBX structure sizes before copying from userspace, performs signed integer arithmetic subject to overflow during alignment, and does not detect overflow when summing control and data block sizes. Upstream patches are confirmed in stable branches 7.1.10 and 7.2; no public exploit or CISA KEV listing is confirmed at time of analysis.
Multiple input validation failures in the Linux kernel s390/zcrypt driver's `xcrb_msg_to_type6_ep11cprb_msgx()` function allow a local unprivileged user on IBM Z/s390 systems with EP11 cryptographic coprocessors to trigger kernel-level buffer overflows. Three compounding weaknesses exist: missing minimum size validation before copying ep11_cprb structures from userspace, arithmetic overflow in CEIL4 alignment that can wrap around and bypass size checks, and unsafe C struct overlay on ASN.1-encoded payload without proper parsing. The official CVSS score of 7.8 (AV:L/AC:L/PR:L) reflects a realistic local privilege escalation path with full C/I/A impact. No public exploit has been identified at time of analysis, and patches are available in Linux 7.1.10 and 7.2.
Memory safety flaws in the Linux kernel s390/zcrypt EP11 CPRB domain handler allow a local low-privileged user on IBM Z mainframe systems to achieve full privilege escalation via crafted cryptographic request blocks. The vulnerable function zcrypt_msgtype6_send_ep11_cprb() uses struct overlays to access EP11 payload domain fields without performing ASN.1 validation or bounds checks at each parsing step, creating conditions for out-of-bounds memory access and incorrect domain field manipulation - the latter consistent with the intelligence-tagged 'Authentication Bypass' impact on EP11 coprocessor domain isolation. Vendor-released patches are available in Linux 7.1.10 and 7.2; no public exploit code or CISA KEV confirmation has been identified at time of analysis.
Slab-out-of-bounds write in the Linux kernel XFS real-time refcount B-tree (rtrefcountbt) subsystem allows a local attacker to trigger a kernel panic or potentially escalate privileges by mounting a crafted XFS filesystem image with the rtreflink feature set. The flaw is an off-by-one in on-disk root level validation - two check paths use '>' instead of '>=' - permitting an illegal bb_level that causes the cursor's bc_nlevels to exceed bc_maxlevels by one, indexing a 2-byte write 8 bytes past the end of a 216-byte slab object during the first B-tree operation. No public exploit or CISA KEV listing exists, but the guaranteed kernel panic and kernel heap write primitive make this a meaningful local risk on affected configurations.
Use-After-Free in the XFS filesystem online repair subsystem of the Linux kernel allows a local low-privileged user to potentially achieve full kernel memory corruption and privilege escalation to root. The flaw in `xrep_tempfile_create` leaves `sc->tempip` as a dangling pointer when tempfile creation fails partway through, enabling subsequent dereference of freed memory. No public exploit has been identified at time of analysis, but the AV:L/AC:L/PR:L/C:H/I:H/A:H CVSS vector indicates any authenticated local user on an XFS-backed system can attempt exploitation with low complexity.
Out-of-bounds write in the Linux kernel's Tegra hardware crypto driver affects AES-GCM decrypt operations on NVIDIA Tegra SoC-based systems running kernel 6.10 and later. When a caller skips invocation of tegra_gcm_setauthsize() - leaving ctx->authsize at zero - the rctx->cryptlen calculation in tegra_gcm_do_one_req() produces an inflated length that causes a subsequent decrypt operation to write beyond the rctx->dst_sg scatter-gather buffer. A local attacker with low-privilege access to the kernel crypto API on affected Tegra hardware could trigger this to achieve privilege escalation or a kernel crash. No public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 2026.7, allowing project administrators to exfiltrate host files outside their repository boundary. The vulnerability is an incomplete fix for CVE-2026-34242 - the original patch blocked path traversal via '..' sequences but failed to prevent symlink-based traversal, leaving the arbitrary file read primitive intact. No public exploit has been identified at time of analysis; the CVSS score of 7.7 High reflects scope change due to cross-boundary file disclosure, while the project-administrator privilege requirement limits the exploitable population.
Disk quota enforcement is absent from the SFTP write path in Pterodactyl Wings 1.13.2 and earlier, allowing any tenant with SFTP write access to a single server to exhaust the host node's entire physical disk. The flaw combines a stale, one-time cache check at file-handle open time with no per-write accounting, plus a logic gap that continues accepting SFTP writes to servers already stopped for quota violations. No public exploit has been identified at time of analysis, but exploitation requires only low-privilege SFTP credentials available to every legitimate tenant, making this a high-priority multi-tenant hosting risk.
Arbitrary file write and directory deletion in compliance-trestle's catalog-generate, profile-generate, and ssp-generate author commands exposes CI/CD pipelines to workspace-escape attacks when output arguments are derived from untrusted data. The affected commands construct output paths by joining a user-supplied argument onto the Trestle workspace root, but apply only a task-name-collision check rather than the PathSecurityValidator guard already used by the jinja command - allowing absolute paths or traversal sequences to escape the workspace entirely. With --force-overwrite, the primitive escalates to recursive deletion of an attacker-chosen directory tree followed by file creation, enabling indirect code execution by overwriting files (e.g., .github/workflows, .git/hooks, shell profile scripts) that a downstream pipeline subsequently executes. No public exploit is identified at time of analysis, though the GHSA advisory for the related jinja variant (GHSA-4q5v-7g7x-j79w) contains a detailed reproduction procedure.
Privilege escalation in the Forminator Forms WordPress plugin (all versions before 1.57.1) allows unauthenticated remote attackers to register new sites on WordPress multisite networks regardless of whether the network administrator has enabled site registration, granting the attacker administrator-level privileges over each newly created sub-site. This flaw is scoped exclusively to WordPress multisite deployments; standard single-site WordPress installations are completely unaffected regardless of plugin version. No active exploitation has been confirmed by CISA KEV, though WPScan has published a public proof-of-concept and a vendor patch is available at version 1.57.1.
SeaweedFS 4.39's TUS resumable-upload handler fails to re-validate JWT prefix scoping on HEAD, PATCH, and DELETE operations against existing sessions, enabling a low-privilege authenticated tenant to hijack cross-tenant upload sessions. An attacker holding a valid but restricted JWT token can PATCH arbitrary content into another tenant's in-progress upload by reusing the victim's session ID, causing the completed file to land at a filesystem path the attacker's token explicitly forbids. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 4.40.
Stored cross-site scripting in Penpot versions through 2.14.3 allows an authenticated team member to execute arbitrary JavaScript in collaborators' browsers by uploading a custom font whose family name contains HTML markup. The backend accepted arbitrary font-family strings and the frontend injected the resulting @font-face rule into the page via innerHTML without sanitization, enabling style-element breakout via a crafted closing tag. The attack is passive — any teammate who opens a file referencing the poisoned font silently triggers execution, enabling session cookie theft, unauthorized actions as the victim, and access to shared files. No public exploit has been identified at time of analysis; vendor-released patch is available in version 2.15.3.
Directory traversal in Formidable Charts (WordPress plugin, versions up to and including 2.0.1) allows unauthenticated network attackers to read arbitrary server-side files via the unsanitized `frm_graph` parameter, exposing sensitive data such as WordPress configuration credentials. Exploitation requires three co-active plugins and a pre-existing image-chart uploads directory, making this a targeted but credible risk for active users of the full Formidable Forms and Charts stack. No public exploit code or CISA KEV listing has been identified at time of analysis; fix version 2.0.2 is available per the official Formidable Forms changelog.
Indefinite process hang in the Linux kernel Ceph filesystem client allows a remote Ceph cluster participant to cause a denial of service by triggering MDS capability revocation on a victim client. The flaw in `__ceph_get_caps()` causes a reading process to sleep forever on `i_cap_wq` when stale `cap->mds_wanted` state prevents the client from reacquiring FILE_RD without an external wake-up. No public exploit code has been identified at time of analysis; patches are available across multiple Linux stable branches.
Time-based SQL injection in the WooCommerce Lottery WordPress plugin by WPGenie - all versions through 2.2.9 - allows unauthenticated remote attackers to extract arbitrary data from the WordPress database by appending malicious payloads to the 'orderby' and 'order' GET parameters on publicly accessible lottery entry list pages. The flaw originates in class-wc-lottery-entry-list-tables.php where sort parameters are passed into SQL ORDER BY clauses without proper escaping or whitelisting. No public exploit code has been identified at time of analysis, but the unauthenticated, low-complexity attack surface makes automated scanning and exploitation with tools like sqlmap straightforward.
Stack-based buffer overflow in Dell PowerProtect One versions 20.1.0.0 and below enables unauthenticated remote attackers to crash the service, resulting in denial of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special network positioning, making this trivially reachable in any environment where the product is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity warrants prompt patching in environments relying on this platform for data protection.
Denial of service in Spring AI's PDF document ingestion crashes the processing thread when parsing a crafted PDF with a deeply nested or cyclic table of contents structure. Affected versions span the 1.0.x and 1.1.x release lines as well as the 2.0.0 release. An unauthenticated remote attacker who can supply a malicious PDF to an application's ingestion pipeline can trigger a StackOverflowError, halting document processing availability with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in TeamViewer Desktop Clients prior to version 15.81.5 allows an authenticated remote session participant to write files to arbitrary locations on the victim's local filesystem via the file transfer and virtual file clipboard features. The affected product family spans Full Client, Host, QuickSupport, and Portable editions across Windows, Linux, and macOS, covering the v13, v14, and current v15 release lines. Arbitrary file write can be chained to code execution at the privilege level of the user running TeamViewer; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Improper authorization in GitLab Enterprise Edition allows an authenticated reporter-level user who authored a merge request to reset that MR's approval rules, potentially bypassing mandatory code-review controls enforced by administrators. All GitLab EE versions from 13.1 through 19.3.0 are affected, with remediated releases published. A publicly available exploit exists via HackerOne, though the vulnerability is not listed in CISA KEV and the low CVSS score (3.5) reflects the constrained attack conditions requiring authentication and prior MR authorship.
Denial of service in Spring Reactor Core exposes reactive Java applications to an infinite-loop condition (CWE-835) when the Flux.bufferTimeout operator is used with fairBackpressure enabled. Affected branches span 3.7.x through 3.7.19 and 3.8.0 through 3.8.6, meaning applications on both supported and legacy release trains are vulnerable. No active exploitation has been identified (SSVC: none), and EPSS probability sits at 0.22%, but the network-accessible nature of reactive endpoints makes this a realistic denial-of-service vector for exposed services using the specific configuration.
Path traversal in UnPoller 2.33.0's password field enables unauthenticated remote attackers to read arbitrary files from the host filesystem and exfiltrate their contents over the network. The CVSS 7.5 (High) vector reflects a fully network-accessible, zero-authentication attack with high confidentiality impact against the affected version. A public exploit repository (github.com/SyntaxSaiyan/CVE-2026-36851) exists, though EPSS stands at just 0.22% (12th percentile) and no CISA KEV listing is present, indicating no public exploit identified at time of analysis as having been broadly weaponized.
Predictable ONNX model cache path creation in Spring AI enables a local attacker on a shared multi-user host to pre-create the cache location and substitute a malicious ONNX model before the application writes its legitimate copy. Affected versions span Spring AI 1.0.0-1.0.9, 1.1.0-1.1.8, and 2.0.0. No public exploit code or CISA KEV listing has been identified at time of analysis; critically, the supplied CVSS vector (AV:N/PR:N) is materially inconsistent with the description's local-access requirement, meaning the raw score of 7.5 substantially overstates the realistic attack surface.
Unauthenticated arbitrary file download in DocSys V2.02.80 exposes the entire server filesystem to remote attackers via the `downloadDocEx.do` endpoint. The `targetPath` parameter accepts arbitrary filesystem paths with no authentication gate, allowing any unauthenticated network attacker to retrieve sensitive files such as configuration files, credentials, or application data. No public exploit code has been identified at time of analysis, and EPSS at 0.17% (6th percentile) signals low current exploitation activity, though the attack is trivially simple to reproduce.
Null pointer dereference in Stomper (commit 5e2741e) allows any remote unauthenticated client to crash the STOMP server process by sending a SEND frame with the destination header omitted. The crash is deterministic and repeatable, making sustained denial-of-service trivially achievable without credentials or prior session state. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.15% (5th percentile) indicates low current exploitation probability, but the attack complexity is minimal for any attacker with network access to the service.
Heap use-after-free in Stomper (commit 5e2741e) allows any unauthenticated network client to reliably crash the broker process by repeatedly issuing SUBSCRIBE commands for the same destination on a single connection and then closing it. The broker's subscription cleanup logic leaves dangling pointers in internal structures that are dereferenced during StompClient destruction, causing a denial of service. A proof-of-concept bug report is publicly available; SSVC classifies exploitation as automatable, though EPSS sits at only 0.15% (5th percentile), consistent with a niche product not yet widely targeted.
Stomper at commit 5e2741e crashes its server process when a broker attempts to write data to a TCP socket already closed by the client peer, delivering a SIGPIPE signal that the process does not handle, causing immediate termination. Any unauthenticated remote client can reliably trigger this by closing the socket at the right moment during a broker-to-client transmission, making the denial-of-service condition automatable. No patch version has been confirmed; a publicly available proof-of-concept bug report exists, though EPSS places exploitation probability at only 0.15%.
Permanent resource exhaustion in the stomper STOMP broker (commit 5e2741e) allows any unauthenticated remote client to hang the broker's event loop by sending partial STOMP frames without completing them. The flaw exploits the interaction between edge-triggered epoll (EPOLLET) and a MSG_PEEK-based recv() pattern: because EPOLLET only fires on state transitions, a socket that holds partial data but never completes a frame stops generating new epoll events, trapping it in a permanent half-read state. As such connections accumulate, the broker's epoll_wait call never returns for those sockets, and the broker eventually stops processing all new messages. No public exploitation has been confirmed by CISA KEV; EPSS stands at 0.15% (5th percentile), suggesting low observed exploitation activity at time of analysis.
Unauthenticated information disclosure in Cohere North AI v1.1.5 exposes sensitive data through an improperly secured WebSocket endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact accessible without credentials or user interaction over a network. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% at the 4th percentile indicates negligible observed exploitation activity across the threat landscape.
Unauthenticated integrity compromise in Cohere North AI v1.1.5 exposes an internal user-management API endpoint with no effective access control, allowing any remote attacker to overwrite arbitrary user account data via crafted HTTP requests to /api/internal/v1/users/{USER_ID}. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and the 'Authentication Bypass' tag both confirm exploitation requires no credentials and no user interaction. A researcher-published PoC exists on GitHub, though EPSS remains low (0.14%, 4th percentile) and no CISA KEV listing has been issued.
Improper certificate validation in Dell PowerProtect One (versions below 20.3.0.0) enables a remote unauthenticated attacker to bypass TLS certificate checks, intercepting or decrypting protected communications between the appliance and connected systems. The CVSS 3.1 base score is 7.5 with high confidentiality impact, though EPSS sits at 0.14% (4th percentile) and SSVC records exploitation as 'none,' indicating no observed threat-actor activity. Vendor patch DSA-2026-369 is available and upgrade to 20.3.0.0 or later is the primary remediation.
Unauthenticated path traversal in yx-image-recognition v1.0 exposes arbitrary files on the host filesystem to remote attackers. Parameters `dir` and `filePath` are passed unsanitized directly to Java's `new File()` constructor, enabling directory traversal sequences (e.g., `../../`) to escape the intended working directory. No public exploit identified at time of analysis, and EPSS of 0.14% (4th percentile) indicates low observed exploitation probability, though a researcher-published report with technical detail exists on GitHub.
Header-based identity forgery in AntFlow V2.0.0 allows unauthenticated remote attackers to impersonate any user by supplying an arbitrary userid value in the HTTP request header. The flaw exists because `JiMuMDCCommonsRequestLoggingFilter.java` treats a user-controlled request header as the authoritative identity token, implementing no cryptographic validation, signature check, or server-side session verification. With PR:N and AC:L confirmed by the CVSS vector, exploitation is trivially simple and results in full confidentiality breach of any targeted user account's sensitive data. EPSS is low (0.14%), and no KEV listing exists, but a public researcher write-up is available on GitHub, lowering the bar for exploitation.
TCP connection teardown handling in the Vanderbilt/Acre Security SPC5300.000 Main Board firmware v.3.14.1 accepts spoofed TCP FIN packets without validating sequence or acknowledgment numbers, enabling an attacker in physical or network proximity to forcibly terminate active TCP sessions and cause a denial of service. The affected device is a physical access control security panel, meaning exploitation could disrupt building access control operations. No public exploit code has been identified at time of analysis, and EPSS remains at the 4th percentile, reflecting minimal observed exploitation activity.
Replay attack vulnerability in the Acre Security (formerly Vanderbilt Industries) SPC5300.000 access-control panel allows a physically proximate attacker to cause a denial of service by injecting replayed application-layer payloads into an active TCP session handled by SPC Connect Pro software. Affected firmware is version 3.14.1 of the SPC5300.000 Main Board. No public exploit code has been identified at time of analysis, and EPSS probability is extremely low at 0.14% (4th percentile), but the target is life-safety physical security infrastructure where availability impacts carry elevated real-world consequences.
Arbitrary file read via path traversal in DocSys-master V2.02.85 exposes the server filesystem to unauthenticated remote attackers through the downloadDocEx endpoint in DocController.java, which fails to sanitize user-supplied path parameters. Publicly available exploit code exists per SSVC poc status and the GitHub reference. Despite a CVSS 7.5 score with high confidentiality impact, EPSS of 0.14% (4th percentile) indicates very low observed exploitation activity, likely reflecting the product's obscure deployment footprint rather than low exploitability.
Denial of service in the Vanderbilt Industries / Acre Security SPC5300.000 Main Board running firmware v.3.14.1 allows a physically proximate attacker to crash the device by sending spoofed SYN packets, exploiting the panel's failure to bound resource consumption from crafted TCP traffic. The NVD-assigned CVSS vector uses AV:N (network), but the CVE description explicitly qualifies the attacker as physically proximate - a material, unresolved discrepancy that defenders must clarify with the vendor before assessing remote exploitability. No public exploit code and no active KEV-listed exploitation have been identified; EPSS probability is negligible at 0.14%.
Denial of service in the openRISC OR1200 soft-core processor (commit 83ac6b) stems from inaccurate program counter updates when Special Purpose Registers are modified, causing the processor to enter an invalid execution state. The flaw, classified under CWE-691 (Insufficient Control Flow Management), was discovered through hardware synthesis fuzzing (SynFuzz) at George Mason University. No public exploit code or active exploitation has been identified, and EPSS places the exploitation probability at 0.14% (4th percentile), consistent with a niche research-grade hardware target.
Memory exhaustion in the Linux kernel's MPTCP (Multipath TCP) subsystem allows unauthenticated remote attackers to drive forward-allocated memory growth without bound, resulting in kernel memory exhaustion and denial of service. The flaw is a regression introduced by commit 9db5b3cec4ec, which added forward-memory borrowing from MPTCP subflows but omitted the corresponding reclaim step when socket buffers are dropped before reaching the receive queue. Stable-branch patches have been released across the 6.18.x and 7.1.x series; no active exploitation or public exploit code has been identified.
NULL pointer dereference in the Linux kernel's in-kernel OpenVPN data-plane module (ovpn) allows a network-reachable peer to crash the kernel by triggering key removal against a crypto slot that is not populated. Affected kernels span the ovpn-enabled range from commit 89d3c0e4612afa1c6429ed68d298e35592fbe208 through versions prior to 6.18.46, 7.1.10, and 7.2. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation impact is full availability loss of the VPN gateway via kernel panic.
Unsafe sleeping in atomic context within the Linux kernel's ovpn module can crash affected systems during VPN key slot teardown. When AEAD crypto transforms are freed via a plain RCU callback, implementations backed by asynchronous or hardware crypto accelerators may block inside crypto_free_aead - an operation forbidden in softirq/atomic context - triggering a kernel BUG or panic and denying service to the host. Systems running Linux 6.16 or unpatched stable branches with the ovpn kernel module active and a non-synchronous AEAD backend are at risk; no public exploit has been identified and the flaw is absent from CISA KEV.
Deadlock vulnerability in the Linux kernel's bnxt (Broadcom NetXtreme) ethernet driver causes kernel hangs or crashes on systems with Broadcom bnxt NICs when an IRQ affinity notifier callback and the bnxt work-cancellation path simultaneously contend for the netdev instance lock. The affinity notifier callback acquires the lock to restart the queue while cancellation synchronously waits for that callback to finish - both paths block indefinitely, resulting in full availability loss for the affected network interface and potentially the host. No public exploit code exists and the vulnerability is absent from CISA KEV; the assigned CVSS vector (AV:N/PR:N) is inconsistent with the described kernel-local race and should be treated with skepticism.
Indefinite TX queue stall in the Linux kernel veth driver allows a denial-of-service condition against multi-queue virtual Ethernet interfaces running GRO without an XDP program attached. The root cause is that veth_poll() incorrectly uses rq->xdp_rxq.queue_index to determine which peer TX queue to wake - a field that is zero-initialized and only populated when XDP is active - causing all NAPI instances to wake peer TX queue 0 instead of the correct queue. In a multi-queue veth setup, a stopped TX queue (e.g., queue 1 halted due to ptr_ring saturation) is never woken, producing an indefinite transmit stall with no watchdog recovery because veth implements no ndo_tx_timeout. No public exploit is identified at time of analysis; reproduction scripts are publicly available from the reporter.
NULL pointer dereference in the Linux kernel ngbe (Wangxun) network driver crashes the kernel when the NIC operates in non-MSI-X interrupt mode (legacy INTx or single MSI). Systems running affected kernel versions with Wangxun WX1860-series NICs configured in non-MSI-X mode are exposed to a kernel panic, resulting in complete system availability loss. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, patch commits are available across multiple stable kernel branches.