Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes DDNS runtime status and the router's public IP address to any network-reachable attacker. The getDdnsStatus function in the CGI interface fails to enforce access control, allowing a crafted POST request to /cgi-bin/cstecgi.cgi to return sensitive network configuration without credentials. No active exploitation is confirmed (CISA KEV absent, EPSS at 0.18%), though SSVC notes the attack is automatable with no required privileges or user interaction.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes Wi-Fi credentials - including SSIDs and plaintext Wi-Fi keys - to any attacker on the network or internet who can reach the device's web interface. The getWiFiEasyCfg function in the CGI handler accepts POST requests without enforcing authentication, classifying this as CWE-284 improper access control rather than a logic bypass. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis, but two independent researcher disclosure repositories on GitHub reference this CVE, consistent with coordinated disclosure that may include proof-of-concept detail.
Unauthenticated access to the getWiFiMeshConfig endpoint on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes mesh network configuration and runtime state to any attacker reachable over the management interface. The CGI handler at /cgi-bin/cstecgi.cgi fails to enforce authentication before executing getWiFiMeshConfig, returning sensitive mesh topology data in response to a single crafted POST request with no credentials. No public exploit or active exploitation has been identified; EPSS at 0.18% (7th percentile) and SSVC exploitation=none confirm low observed exploitation pressure despite the SSVC automatable=yes rating.
Unauthenticated WAN configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any attacker with network access to the router management interface to retrieve WAN interface data - potentially including ISP credentials - by sending a single crafted POST request to /cgi-bin/cstecgi.cgi without any authentication. This is part of a documented pattern of missing access control enforcement across multiple CGI endpoint functions in this firmware version, with coordinated disclosure references confirming the finding. No public exploit code has been identified at time of analysis, and SSVC classifies the technical impact as partial, though the fully automated exploitation path (SSVC Automatable: yes) elevates practical risk for internet-exposed devices.
Unauthenticated DMZ configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes internal network topology data to any attacker who can reach the router's web interface. The `getUrlFilterRules` handler at `/cgi-bin/cstecgi.cgi` fails to enforce access control before returning DMZ forwarding configuration - including internal host addresses and ports - in response to a crafted POST request. No public exploit has been identified at time of analysis; EPSS sits at 0.18% (7th percentile), though SSVC confirms the attack vector is automatable.
Unauthenticated remote-management configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes whether remote administration is enabled and on which port, via a crafted POST to /cgi-bin/cstecgi.cgi invoking the getRemoteCfg function. The root cause is CWE-284 incorrect access control - no authentication check gates the function before returning configuration data. No public exploit or KEV listing exists at time of analysis, but the endpoint is automatable per SSVC, making it trivial to mass-scan for affected devices.
Unauthenticated network topology and interface configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any attacker with access to the device's web management interface to retrieve sensitive network layout data without credentials. The getNetInfoCfg function in /cgi-bin/cstecgi.cgi enforces no access control, so a single crafted POST request returns interface and topology details that support downstream reconnaissance and targeted follow-on attacks. No public exploit code is confirmed and EPSS sits at 0.18% (7th percentile), but SOHO routers are frequently internet-exposed with factory defaults intact, elevating practical risk above what EPSS alone implies.
Unauthenticated online client enumeration in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes connected device information to any attacker who can reach the router's HTTP management interface. The getOnlineClient function within the /cgi-bin/cstecgi.cgi CGI dispatcher applies no access control, so a crafted POST request returns the router's live client inventory without credentials. No public exploit has been identified at time of analysis and the EPSS score sits at 0.18% (7th percentile), indicating this is not being exploited at scale - consistent with a batch of researcher-coordinated disclosures across multiple T6 CGI endpoints rather than active threat actor campaigns.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes mesh routing table data through the getMeshRoutingTable CGI function. An attacker with network access to the device can send a crafted POST request to /cgi-bin/cstecgi.cgi and retrieve internal mesh routing topology without any credentials. No public exploit has been identified at time of analysis, and EPSS probability is low at 0.18%, though GitHub-hosted CVE coordination repositories suggest researcher awareness and POC development activity.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes connected client MAC addresses to any remote attacker via the getStationMacByIp CGI function. The /cgi-bin/cstecgi.cgi endpoint processes crafted POST requests without enforcing any access control, returning MAC address data that can enable network reconnaissance and bypass of MAC-based access filtering. No confirmed active exploitation or CISA KEV listing exists, and EPSS probability is negligible at 0.18%, though the fully unauthenticated network vector makes automated scanning trivial.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the router's DMZ configuration to any network-reachable attacker. The getDmzCfg function in /cgi-bin/cstecgi.cgi fails to enforce access controls, allowing crafted POST requests to return DMZ host mappings and related network settings without credentials. No active exploitation is confirmed (absent from CISA KEV), though GitHub vendor-coordination repositories indicate researcher involvement and potential public disclosure of attack methodology.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes cloud remote-control (CRPC) status and management URL through the getCrpcCfg function. The /cgi-bin/cstecgi.cgi endpoint processes POST requests without enforcing access control, allowing any network-adjacent attacker to enumerate whether cloud remote management is active and retrieve its target URL. No public exploit has been identified at time of analysis and EPSS sits at the 7th percentile, indicating low current exploitation pressure despite the trivially simple attack vector.
Unauthenticated remote access to setup wizard and onboarding configuration is possible on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 through missing access control on the getWizardCfg CGI handler. Any attacker reachable to the device's web management interface can send a crafted POST to /cgi-bin/cstecgi.cgi and receive wizard configuration data - which may include ISP connection parameters or other sensitive values collected during initial device setup - without supplying credentials. No active exploitation has been identified (EPSS 0.18%, 7th percentile; not in CISA KEV), and disclosure follows a researcher-coordinated process documented on GitHub.
Unauthenticated LAN and DHCP configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to retrieve internal network topology data by sending a crafted POST request to /cgi-bin/cstecgi.cgi without any credentials. The getLanCfg CGI handler applies no access control before returning LAN addressing and DHCP server configuration. EPSS at 0.18% (7th percentile) and SSVC 'Exploitation: none' confirm no observed active exploitation; no CISA KEV listing or public exploit code has been identified at time of analysis.
Null pointer dereference in the Linux kernel's SCSI target iblock driver crashes the kernel when processing Persistent Reservation PREEMPT or RELEASE operations against storage backends with unimplemented PR hooks. Systems running the kernel as an iSCSI target are vulnerable - an attacker who can issue SCSI Persistent Reservation commands can trigger a kernel panic, causing a complete denial of service. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but patches are available across multiple stable branches and should be applied promptly on iSCSI target infrastructure.
Unaligned memory access in the Linux kernel netfilter synproxy timestamp adjustment code can crash the kernel or degrade performance on strict-alignment CPU architectures when synproxy is actively configured. Systems running synproxy as a SYN-flood mitigation layer on architectures such as SPARC, classic MIPS, or ARM without hardware unaligned-access emulation are exposed to remote-triggered denial of service via crafted TCP packets. No active exploitation is confirmed (absent from CISA KEV) and EPSS at 0.17% (6th percentile) indicates negligible observed exploitation probability, though the network-reachable vector warrants timely patching on vulnerable platforms.
NULL pointer dereference in the Linux kernel's EMAC (Ethernet MAC) network driver during device probe can crash the kernel, resulting in complete system availability loss on affected hardware. The fault lies in `emac_probe()` where `devm_request_irq()` is called before `dev->emacp` is mapped via `devm_platform_ioremap_resource()`, leaving a race window during initialization in which any hardware interrupt invoking `emac_irq()` will dereference a NULL pointer and trigger a kernel panic. No public exploit code exists and the vulnerability is absent from CISA KEV; patches have been released across multiple Linux stable branches.
Out-of-bounds read in the Linux kernel SCTP subsystem leaks up to four bytes of receive-buffer tail memory to remote unauthenticated attackers via a malformed INIT chunk. When an Adaptation Layer Indication parameter is sent with only its 4-byte header (omitting the mandatory 32-bit Adaptation Code Point), the kernel reads past the declared parameter boundary and copies those bytes into the state cookie of the INIT ACK response, exposing them to the peer. No public exploit has been identified and EPSS of 0.16% (6th percentile) indicates low exploitation probability, though the unauthenticated, network-accessible attack surface on any SCTP-enabled system warrants prompt patching.
Uninitialized receive buffer allocation in the Linux kernel's CAN J1939 transport layer exposes residual kernel heap memory to J1939 session participants. The function j1939_session_fresh_new() allocates a buffer without zeroing it, meaning any system running a CAN-capable Linux kernel with J1939 transport support may leak prior heap contents to peers exchanging Extended Transport Protocol (ETP) messages. No public exploit has been identified at time of analysis, and EPSS sits at 0.16% (6th percentile), consistent with a low-exploitation-probability kernel information-disclosure flaw in a specialized networking subsystem.
Null-pointer dereference in the Linux kernel's btrfs LZO decompression path can crash the kernel when reading a crafted compressed extent, causing a denial-of-service. Kernels in the range starting at commit a6e66e6f8c1b685e11b778bef614480a9c1a5278 through the two fix commits are affected across multiple stable branches (5.15 and later). No public exploit code or CISA KEV listing exists at time of analysis; the EPSS score of 0.15% (5th percentile) confirms this is not yet being exploited at scale. Exploitation requires the attacker to introduce a malformed btrfs filesystem image with LZO-compressed extents that the kernel then reads.
Deadlock in the Linux kernel's iomap subsystem allows local attackers to cause a denial of service by exhausting the shared bioset used by both iomap_split_ioend and its input bios. The circular dependency in bioset allocation halts I/O completion on iomap-backed filesystems (XFS, ext4 direct I/O) and can hang the affected system. No active exploitation has been confirmed (not in CISA KEV) and the EPSS probability is very low at 0.15% (5th percentile), but the impact on availability is total for the affected I/O path.
Unauthenticated access to the getSysStatusCfg handler in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes a broad set of sensitive device data - including WiFi encryption keys, SSID, WAN/LAN IP addresses, firmware version, serial number, and connected client statistics - to any attacker with network reachability to the management interface. The exposure of raw WiFi key material is notably more impactful than a typical status-read disclosure: recovered credentials can be used to join the wireless network and pivot to LAN-side targets. No public exploit or active exploitation has been identified at time of analysis, though the attack is fully automatable via a single crafted POST request.
Broken access control in the Simple Payment WordPress plugin (versions 2.5.2 and below) allows unauthenticated remote attackers to perform unauthorized actions affecting payment integrity. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and the High integrity impact (I:H) with no confidentiality or availability impact suggests attackers can manipulate payment-related functionality - such as bypassing payment verification or altering payment states - without holding any WordPress account. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated denial of service in Smush Image Compression and Optimization plugin (versions ≤ 4.2.0) allows any remote attacker to exhaust WordPress server resources without credentials or user interaction. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms trivial, unauthenticated network exploitation with high availability impact, making every site running an affected version an easy target for sustained disruption. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity means exploitation requires minimal skill.
SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-complexity conditions, to read and manipulate backend database contents - yielding high confidentiality and integrity impact with no availability disruption. Both the commercial (Pro) and community (CE) editions of the OX-branded Dovecot mail server are confirmed affected per vendor CPE data and the OX advisory OXDC-ADV-2026-0003. No public exploit code has been identified at time of analysis, and the AC:H vector indicates exploitation is non-trivial and likely requires specific environmental or protocol conditions.
OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass when the identity provider omits the scope claim from token responses. Dovecot incorrectly falls back to evaluating the audience claim as a substitute for scope, accepting any token whose audience value coincidentally matches a configured scope name - regardless of what permissions that token actually grants. The flaw also silently masks IDP misconfigurations where scope issuance is entirely absent. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the CVSS score of 7.4 (AV:N/AC:H) reflects that successful exploitation yields full confidentiality and integrity access to email.
AES-GCM nonce reuse in wolfEngine before 1.4.1 allows a network-positioned passive adversary to fully recover encrypted plaintext and forge authentication tags across all TLS 1.2 and DTLS 1.2 sessions. The 8-byte explicit nonce is generated once at TLS write-key setup and never incremented per record, meaning every GCM record within a connection shares an identical (key, nonce) pair - a catastrophic misuse of authenticated encryption. AES-CCM cipher suites, TLS 1.3, and non-TLS uses of AES-GCM are explicitly unaffected; no public exploit identified at time of analysis.
Nonce reuse in wolfProvider before 1.2.2 completely breaks AES-GCM confidentiality and integrity guarantees for every TLS 1.2 and DTLS 1.2 connection using that cipher suite. Because the 8-byte explicit nonce is set once at key establishment and never incremented, every record in a session is encrypted under an identical (key, nonce) pair - the classical 'forbidden attack' condition where XORing two ciphertexts yields the XOR of the plaintexts, and the GHASH authentication key can be algebraically recovered to enable tag forgery. No active exploitation is confirmed in CISA KEV, and no public proof-of-concept has been identified at time of analysis; however, the attack is well-understood cryptography with no special tooling required beyond captured traffic.
NULL pointer dereference in the Linux kernel netfilter subsystem's xt_nat module allows a local attacker with low privileges to crash the kernel by instantiating SNAT or DNAT targets through the nft_compat compatibility layer using an unsupported bridge family, triggering a NULL dereference in nf_nat_setup_info(). Multiple stable kernel branches from 5.10 through 7.x are affected across numerous long-term support trees. No public exploit has been identified at time of analysis, and EPSS probability is very low at 0.18% (7th percentile); critically, the description itself notes the original crash was already mitigated by a prior upstream commit, making this patch a defense-in-depth hardening measure rather than a primary fix.
Stored XSS in the Amelia WordPress booking plugin (versions ≤ 2.2) allows unauthenticated attackers to persist malicious JavaScript that fires when a site administrator views the Calendar page. The attack chain exploits two compounding weaknesses: an explicit nonce-verification skip in AddBookingCommand (Command.php:186) that permits unauthenticated booking submissions, and unsafe interpolation of customer name fields into JavaScript template literals rendered via innerHTML in the FullCalendar eventContent callback (redesign/dist/index.js:199). No public exploit is confirmed at time of analysis, but the Wordfence disclosure provides sufficient technical detail for trivial weaponization.
Stored Cross-Site Scripting in the Optimole image optimization plugin for WordPress (all versions through 4.2.10) allows unauthenticated network attackers to inject persistent JavaScript payloads via the 'above_fold_images' ('a') REST API parameter. Injected scripts execute in any visitor's browser upon accessing an affected page, enabling session hijacking, credential theft, or administrative account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported the issue and a patch was confirmed in version 4.2.11.
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.1) enables unauthenticated attackers to inject persistent malicious scripts via Rich-Text Textarea fields, which execute in any visitor's or administrator's browser upon page access. The flaw originates from insufficient input sanitization at submission time and missing output escaping at render time, with vulnerable code paths confirmed across multiple plugin files including textarea.php, abstract-class-front-action.php, and admin-page-entries.php. A patched release (1.57.0.2) is confirmed available via the WordPress plugin repository changeset; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (all versions through 3.3.3) allows unauthenticated attackers to permanently inject arbitrary JavaScript into translated pages visible to all site visitors. The attack exploits a bypass of WordPress's native comment sanitization (KSES): a crafted payload using anchor and code tags is permitted by the allowlist, stored verbatim in the database, and later executed when the plugin's bundled simple_html_dom parser processes comments during page translation rendering. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Stored XSS in the LiteSpeed Cache WordPress plugin (all versions through 7.8.1) allows unauthenticated attackers to permanently inject malicious JavaScript into comment-bearing pages by exploiting a bypass in WordPress's wp_kses sanitizer via decimal numeric character references inside permitted HTML elements. The payload persists in the database and executes in every subsequent visitor's browser, creating session-hijacking, credential-theft, and site-defacement opportunities at scale. No active exploitation is confirmed in CISA KEV, but the changeset between tags 7.8.1 and 7.9 on the WordPress plugin repository confirms a vendor-released fix is available.
Missing authorization controls in HyperDX through 1.10.1 allow any authenticated team member to perform privileged administrative actions across team management endpoints. Three API endpoints - PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member - fail to enforce role-based access controls, enabling a low-privileged team member to rotate API keys, rename teams, and delete any team member including account owners. No public exploit has been identified at time of analysis, but the attack surface is straightforward given the explicit endpoint enumeration in the disclosure.
Remote code execution in the Rank Math SEO WordPress plugin (versions <= 1.0.276) is reachable by any user holding WordPress Author-level privileges, exploiting unsafe PHP deserialization (CWE-502) to execute arbitrary server-side code. The CVSS vector (AV:N/AC:L/PR:H) confirms the attack is network-delivered with low complexity once Author credentials are in hand, yielding full confidentiality, integrity, and availability compromise of the host. No active exploitation confirmed in CISA KEV and no public proof-of-concept has been identified in the available intelligence at time of analysis.
Stored cross-site scripting in the Customer Reviews for WooCommerce WordPress plugin (versions up to and including 5.106.0) enables unauthenticated attackers to inject persistent malicious scripts into WooCommerce product pages, where they execute in every subsequent visitor's browser. The flaw resides in the 'cr_local_forms_submit' AJAX handler, which stores unsanitized HTML review text via wp_insert_comment() without sanitization and later renders it through comment_text() without output escaping - a textbook inject-store-render CWE-79 chain. No active exploitation has been confirmed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, though the attack requires only a review form URL that the plugin routinely distributes to customers via order-reminder emails, lowering the practical barrier to abuse.
Stored Cross-Site Scripting in WP Rocket versions up to and including 3.21.0.1 allows unauthenticated remote attackers to inject persistent malicious scripts via the rocket_beacon AJAX endpoint. Any user who subsequently visits a page where the payload has been stored will execute the attacker-controlled script in their browser context. A patched release (v3.21.1) is available from WP Media, and no public exploit or active exploitation has been identified in the provided data.
Missing authorization on license management REST endpoints in Budibase server before 3.41.3 allows any low-privilege authenticated user to delete license keys or manipulate offline tokens via /api/global/license/* - degrading or disabling premium features for the entire deployment. The flaw (CWE-862) is network-exploitable with low complexity and requires only a valid user account, making it accessible to the broadest possible authenticated audience within a deployment. No public exploit or CISA KEV listing exists at time of analysis, but the attack path is trivially reproducible given endpoint documentation.
OS command injection in PowSyBl Core's AbstractLocalCommandExecutor implementations allows authenticated callers who forward untrusted data to the vulnerable public APIs to execute arbitrary shell commands as the JVM process user on both Unix and Windows hosts. Affected versions are com.powsybl:powsybl-computation-local up to and including 7.2.1; the flaw is a library-level sink, meaning any REST front-end, pypowsybl integration, or multi-tenant grid analysis platform embedding powsybl-core that passes external parameters to LocalComputationManager.execute(), ActionSimulatorTool.run(), or AmplModelRunner.run() inherits the vulnerability without modifying powsybl code. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the advisory documents multiple injection vectors with bypass paths for the previously weak escaping.
Locked asset visibility bypass in Immich through 3.1.0 exposes private photo and video assets to unauthorized viewers via shared albums and shared links. When a user locks an asset using the single-asset locking endpoint, the lock flag is not enforced by the access control logic that governs shared album and shared link contexts, leaving those assets readable through pre-existing shares. An authenticated or link-holding attacker can enumerate and retrieve locked media and its metadata without any further privilege escalation. No public exploit or CISA KEV listing has been identified at time of analysis.
Index-out-of-bounds panic in gitoxide's gix-packetline library (versions before 0.21.5) allows a malicious Git server to abort the client process during fetch operations by sending a crafted side-band packet line with an empty payload. The TextRef implementation fails to handle zero-length payloads, triggering an unconditional Rust panic that terminates the connecting client. No authentication is required on the attacker's side; the victim need only initiate a fetch or clone against a hostile server. No public exploit code or CISA KEV listing identified at time of analysis.
Insecure Direct Object Reference in R2R's conversation API through version 3.6.5 enables any authenticated user to modify conversations owned by other users by supplying arbitrary conversation identifiers. The flaw, located in the conversations router (conversations_router.py), bypasses ownership validation in both the conversation update and message append handlers, enabling cross-user data corruption and content injection. No public exploit code or active exploitation has been confirmed at time of analysis, but the attack surface is the network-accessible API layer requiring only a valid authenticated session.
Heap-based buffer overflow in openNDS before 11.0.0 allows an unauthenticated attacker positioned on the captive portal network to crash the openNDS daemon and potentially execute arbitrary code remotely. The flaw is in the redirect_to_splashpage function in http_microhttpd.c, where the query string buffer is under-allocated at QUERYMAXLEN bytes despite URL encoding expanding input by up to 1.5x - when a crafted request triggers the redirect path, the encoded data overflows the heap allocation. No public exploit identified at time of analysis, though the upstream fix commit is publicly available and exposes the exact vulnerable code path.
Prompt endpoint ownership validation failure in Quivr through 0.0.322 enables authenticated users with only read-only brain access to overwrite any system prompt by supplying a harvested prompt identifier to an unprotected write endpoint. The IDOR flaw (CWE-639) means that low-privileged authenticated accounts can silently corrupt AI brain behavior for all users of a shared brain, with no elevated privileges required beyond a valid session. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and broad scope of impact across all brain users make this a practical integrity threat in multi-tenant Quivr deployments.
Availability denial in the Linux kernel's KVM ARM64 nested virtualization stack allows a guest VM to crash the host through improper Synchronous External Abort (SEA) handling when Stage 1 translation resolves a Guest Frame Number outside configured memory slots. Affected systems must run a vulnerable Linux 6.16-era kernel on ARM64 hardware with KVM nested virtualization explicitly enabled; fixed versions are 6.18.40, 7.1.5, and 7.2. No public exploit exists and no active exploitation is confirmed; EPSS stands at 0.18% (7th percentile), reflecting the niche attack surface.
Symlink-based file clobbering in the Linux kernel's intel-speed-select daemon allows a local low-privileged user to redirect root-process writes to an attacker-chosen file by pre-positioning a symlink at the daemon's fixed /tmp pidfile path. Affected systems are those running Linux 5.18 through unpatched 6.x and 7.x branches on Intel Speed Select Technology hardware with the daemon active. No public exploit is identified at time of analysis and EPSS is low (0.17%, 7th percentile), but the attack is mechanically simple and requires only a local shell account.
Out-of-bounds vmemmap read in the Linux kernel's mm/util snapshot_page() crashes or leaks kernel memory during page isolation on memory-remove paths. The function incorrectly reads __page_2 when nr_pages > 1 rather than the correct threshold of nr_pages > 2, causing an illegal access into an adjacent, unmapped vmemmap section when an order-1 folio sits at a vmemmap section boundary. This was observed producing a kernel oops on ppc64le systems during DLPAR memory remove on a 22 TB LPAR. No public exploit is identified and EPSS is 0.17%, but the defect can cause a local denial-of-service or kernel memory disclosure. Patches are available across multiple stable kernel branches.
The BPF signed loader in the Linux kernel fails to enforce map exclusivity before performing SHA-based integrity validation of metadata maps, allowing a local attacker with BPF privileges to race a mutation of the shared map's contents after the hash is computed but before validation completes. Systems running Linux kernel between commit fb2b0e290147ba01a53dfd92cf91058c9d2ee254 and the patched stable releases (6.18.40, 7.1.5, 7.2) are affected. Exploitation bypasses the integrity guarantees of the signed BPF loader, enabling the attacker to make the check pass on stale, attacker-controlled data; no public exploit exists and EPSS is 0.17% (6th percentile), indicating low current exploitation probability.
Kernel stack disclosure and potential denial-of-service affect Linux systems with CXL hardware due to an off-by-8 size constant in the CXL RAS capability subsystem introduced in Linux 6.2. A local user who can trigger a CXL AER uncorrectable error and read tracefs can obtain up to 448 bytes of adjacent kernel stack data - potentially including code pointers and sensitive in-flight values - from the tracefs ring buffer. No public exploit identified at time of analysis; EPSS at 0.17% (6th percentile) reflects the niche CXL hardware dependency and local-only attack vector.