A use-after-free race condition in the Linux kernel's SUNRPC client-side TLS handshake path (introduced in 6.5) allows the lower RPC transport to be freed while the xs_tls_handshake_done() completion callback is still running. When a synchronous handshake waiter times out or is signaled and tls_handshake_cancel() loses the race to handshake completion, the waiter drops the callback-owned reference, freeing the transport before the callback stores xprt_err or releases its own reference. Exploitation requires RPC-over-TLS client configuration (e.g. NFS mounted with xprtsec=tls/mtls) and winning a narrow timing race; no public exploit identified at time of analysis and EPSS is low at 0.20%.
Out-of-bounds slab memory disclosure in the Linux kernel's svcrdma (NFS-over-RDMA server) transport allows a connected RDMA client to leak adjacent kernel heap contents. The RPC/RDMA Read chunk position field is taken verbatim from the remote client and only alignment-checked, never bounded against the received inline body length, so a malicious client can drive kvec/gap-length integer underflows that expose adjacent slab memory to the XDR decoder or copy past the receive buffer into reply pages returned to the client. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile), and a vendor patch is available in the stable trees.
Heap out-of-bounds write in the Linux kernel's ocfs2 o2dlm (distributed lock manager) allows a malicious cluster member to corrupt or panic peer nodes. The dlm_migrate_request_handler() accepts a peer-supplied name-length field (migrate->namelen) from a DLM_MIGRATE_REQUEST message without bounds-checking and passes it to dlm_init_mle(), which memcpy()s up to ~215 attacker-controlled bytes past the 32-byte mname[] field of an o2dlm_mle slab object. Any node that has joined the DLM domain can trigger it; there is no public exploit and it is not in CISA KEV, with EPSS at just 0.20%.
Kernel memory corruption in the Linux kernel's OCFS2 cluster filesystem distributed lock manager (o2dlm) allows any node in a DLM domain to crash or corrupt the heap of a peer node. The dlm_mig_lockres_handler for DLM_MIG_LOCKRES recovery messages trusts the peer-supplied num_locks and lockname_len fields without validation, producing an out-of-bounds read that ends in a BUG_ON panic and a heap out-of-bounds write into a fixed 32-byte lockname slab object. No public exploit identified at time of analysis; EPSS is low at 0.20% (10th percentile), and the fix is available across multiple stable kernel branches.
Use-after-free in the Linux kernel's lockd (NFS Network Lock Manager) service allows freed-memory access during hash-bucket file traversal. The nlm_traverse_files() iterator pinned the current file but not the saved 'next' pointer across a mutex_unlock window, so a concurrent nlm_release_file() could kfree the next file and cause the iterator to dereference freed memory on its next step. Fixed across stable kernels; no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a hard-to-time race rather than a turnkey exploit.
Kernel memory corruption in the Linux NVMe/TCP host driver (nvme-tcp) allows a malicious or compromised NVMe-over-TCP target to trigger a wild-memory-access write on the connecting host. The receive path gated C2HData PDUs on blk_rq_payload_bytes() alone; for a REQ_OP_WRITE_ZEROES command (no physical segments but non-zero byte count) the request iterator is never initialized, so an attacker-supplied C2HData is copied into whatever stale, driver-private iterator the previous command on that tag left behind. Fixed across stable trees; no public exploit identified at time of analysis and EPSS is low (0.20%).
Out-of-bounds kernel memory read in the Linux kernel's IPv6 Segment Routing (SRv6/seg6) local processing allows a local unprivileged user to leak adjacent slab memory and potentially crash the host. After decap_and_validate() strips outer SRv6 headers for End.DX6/End.DT6 behaviors, the IPv6 control block (IP6CB) retains a stale nhoff from the outer packet, causing ip6_protocol_deliver_rcu() to read beyond the skb head on the inner packet (KASAN slab-out-of-bounds). There is no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a locally-reachable kernel bug rather than a mass-exploitable remote flaw.
Memory corruption in the Linux kernel NFSD server (NFSv4.1+ session handling) occurs because nfsd4_sequence() can free the very session slot it is currently processing. When the session slot shrinker lowers se_target_maxslots below the channel's maxreqs, free_session_slots() kfrees every slot at index >= se_target_maxslots without verifying the caller's own slotid or the NFSD4_SLOT_INUSE flag, so an authenticated NFSv4.1+ client using a high-numbered slot can have its live slot freed, after which the code writes to the freed object and nfsd4_store_cache_entry() copies the compound reply into the dangling sl_data[] buffer, corrupting the slab. This is a use-after-free / heap out-of-bounds write with no public exploit identified at time of analysis and a low EPSS (0.20%, 10th percentile).
A use-after-free in the Linux kernel's NFSv4 server (NFSD) admin-state revocation path lets a client structure be freed while still in use, introduced in 6.9 and fixed in 6.18.51, 7.2.4, and 7.3-rc1. When an administrator revokes NFSv4 state, nfsd4_revoke_states() temporarily drops the client_lock while revoke_one_stid() dereferences a stateid's bare (non-pinning) pointer to its nfs4_client; a concurrent client teardown via force_expire_client() can free that client first, causing NFSD to read freed memory. No public exploit is identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not on CISA KEV; the practical impact is server crash/DoS on the NFS server rather than remote code execution.
A use-after-free and memory leak in the Linux kernel's CIFS/SMB client (cifs_check_trans2 in the SMB1 TRANSACT2 reassembly path) can be triggered when a malicious or man-in-the-middle SMB server sends a malformed secondary TRANSACT2 response after a valid primary one. Because handle_mid() overwrites mid->resp_buf and skips clearing the server's smallbuf/bigbuf pointers when multiRsp is set, the demux thread later reuses a freed buffer, corrupting kernel memory. Despite a 9.8 CVSS rating, EPSS is only 0.20% and no public exploit is identified; the flaw is DoS/memory-corruption-leaning and requires the client to mount a share from an attacker-controlled server plus a demux-thread timing race.
A use-after-free in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated SMB client to trigger a slab-use-after-free write and likely kernel crash by abusing durable file-handle reconnection. When two sessions hold durable-v2 handles on the same file under different AppInstanceIds, ksmbd_reopen_durable_fd() rebinds every detached oplock on that inode to the reconnecting session instead of only the file's own, so one session adopts another's oplock without a session reference; after the adopted session is destroyed, ksmbd_close_fd_app_instance_id() dereferences the freed session. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), and the fix is present in kernels 7.2.4 and 7.3-rc1.
Improper metadata validation in the Linux kernel's NTFS3 filesystem driver allows a crafted NTFS image to pass consistency checks when an attribute declares empty mapping pairs while carrying an inconsistent highest VCN and size. Parsing such an attribute can drive out-of-bounds memory access during runlist decoding, leading to memory corruption or a denial of service when the malicious image is mounted. The fix rejects attributes whose empty mapping pairs contradict their highest VCN/size fields; no public exploit identified at time of analysis and EPSS is low (0.20%).
Out-of-bounds memory access in the Linux kernel ntfs3 filesystem driver occurs because parse_ntfs_boot_sector() decodes the boot sector's unsigned 64-bit MFT and MFTMirr Logical Cluster Numbers (LCNs) into a signed s64. A crafted NTFS image with a high-bit-set LCN wraps to a negative value that slips past the existing upper-bound check and propagates into the MFT zone allocator, driving an out-of-bounds access to lcn_empty_bits_per_page. Exploitation requires mounting an attacker-supplied NTFS volume; there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Out-of-bounds memory access in the Linux kernel's NTFS (ntfs3) driver arises because the mapping-pairs runlist decoder confirms that a run's starting LCN falls inside the volume but never checks that the run's end (lcn + length) also stays within nr_clusters. Mounting or parsing a crafted NTFS image can therefore drive the kernel to reference clusters beyond the volume boundary, corrupting memory and potentially escalating privilege. No public exploit has been identified and EPSS is low (0.20%), indicating this is a hardening/DoS-leaning fix rather than an imminent mass-exploitation threat.
Slab out-of-bounds read in the Linux kernel's ocfs2 filesystem lets a crafted on-disk image trigger memory disclosure once mounted. The indexed-directory validators ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check ECC and signature but never bound the ocfs2_dx_entry_list de_num_used/de_count counts against the 4KB metadata block capacity, so ocfs2_dx_dir_search() walks up to 0xffff entries far past the block. Any path lookup, stat(), or open() on an indexed directory in a malicious image reads adjacent slab memory. EPSS is low (0.20%, 10th percentile); no public exploit identified at time of analysis and it is not in CISA KEV.
Out-of-bounds read in the Linux kernel's SMC-Rv2 (Shared Memory Communications over RDMA v2) LLC handling occurs in smc_llc_save_add_link_rkeys(), where the peer rkey count is read from offset 94 of a 72-byte 'ADD LINK' message allocation whenever the RDMA device reports max_recv_sge == 1 and no shared v2 receive buffer exists. Any peer that initiates an SMC-Rv2 link addition triggers the over-read on every link addition, regardless of message contents, as demonstrated by a reproducible KASAN slab-out-of-bounds report. The flaw is fixed in stable kernels; no public exploit code or active exploitation has been identified, and EPSS is low at 0.20%.
A use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem allows the server-side link-addition path (smc_llc_srv_add_link() in net/smc/smc_llc.c) to read a freed LLC queue entry. smc_llc_flow_qentry_del() kfree()s the qentry, but on links without a shared v2 receive buffer the already-freed add_llc pointer is subsequently passed to smc_llc_save_add_link_rkeys(), producing a slab-use-after-free. Affects kernels since 6.14 through the fix in 6.18.50 / 7.2.4 / 7.3-rc1; no public exploit identified at time of analysis and EPSS is low (0.20%), and the KASAN report shows it manifests as a kernel crash rather than a demonstrated code-execution primitive.
A data race in the Linux kernel's net/smc (Shared Memory Communications) subsystem allows concurrent stores to the killed, freed, and out_of_sync connection-state flags to clobber one another because all three single-bit bitfields share one byte of struct smc_connection. The receive tasklet (smc_cdc_msg_validate) and process context (smc_conn_kill) write these flags without a common lock, so each write is a read-modify-write that can silently revert a neighbouring flag, potentially corrupting connection teardown/free state. The fix gives each flag its own byte; there is no public exploit identified and EPSS is 0.20%.
A use-after-free and reference/memory leak race in the Linux kernel SUNRPC backchannel allows a NFS callback backchannel request to be enqueued onto a svc_serv (sv_cb_list) that is being destroyed, or to leak an xprt reference, when a backchannel receive completes concurrently with callback-service teardown. The flaw affects Linux kernels using the SUNRPC/NFS callback backchannel and is resolved by closing the producer side (clearing xprt->bc_serv under bc_pa_lock via a new xprt_svc_shutdown_bc()) before callback threads are stopped and draining leftover sv_cb_list entries before svc_destroy(). No public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with a hard-to-win teardown race rather than a broadly weaponizable bug.
We need answer JSON only. Need synthesize. Must use data. Need be careful with every field strings. We need analyze CVE-2026-79396. Need not copy description. Need incorporate all data. Need investigate references? We have references to GitHub and NVD. We need produce original synthesis. Let's parse input. CVE ID: CVE-2026-79396 Description: Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over the camera. CVSS Score: 9.8 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE: CWE-798 EPSS 0.18% percentile 8% Reported by mitre CPE: cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* Tags: Authentication Bypass, N A ENISA EUVD ID: EUVD-2026-76189 Affected versions: ["n/a n/a"] References: cveorg None https://github.com/ShiroiBoushi/vulnerability-research/tree/main/CVE-2026-79396 euvd advisory https://nvd.nist.gov/vuln/detail/CVE-2026-79396 Need output product_name: 1-3 words. "Xiongmai IP Camera" or "Xiongmai XM530". Product specific. I think "Xiongmai IP Camera" 3 words? Xiongmai IP Camera = 3. Or "Xiongmai XM530" = 2. Probably "Xiongmai XM530". Need product name not vendor alone. Use Xiongmai IP Camera maybe. Summary: 2-3 sentences. Do not start with A vulnerability. Start with specific impact verb and product. We can say "Hardcoded default credentials in Xiongmai XM530 IP camera firmware HMT.CM2005-v220608.1837 and earlier allow remote unauthenticated attackers to achieve full administrative control by extracting or reusing static plaintext credentials from bin/config.xml and the Sofia executable." Need mention if actively exploited? KEV absent. POC? Reference is GitHub vulnerability-research. Could mean POC exists? But not explicitly says POC. We can mention "public proof-of-concept/research is accessible on GitHub" perhaps. E
Out-of-bounds heap read and write in the Linux kernel's CIFS/SMB client (coalesce_t2() in fs/smb/client) allows a malicious or MITM SMB server to corrupt kernel memory or leak data by supplying a crafted Transaction2 DataOffset field. The function computes source and target data pointers directly from the server-controlled DataOffset with no bounds validation before a memcpy, so a small value overwrites header fields while a large value pushes the pointer past the buffer end. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; the fix adds lower- and upper-bound checks for both pointers.
Out-of-bounds ring-buffer write and stale-memory disclosure in the Linux kernel NFSD server affects the nfsd_fh_verify and nfsd_fh_verify_err tracepoints, which reserve a server-address trace slot sized by the transport's remote-address length (xpt_remotelen) but populate it from the local address using xpt_locallen. On NFSv2/v3-over-UDP, xpt_remotelen stays zero for the transport's lifetime, so every file-handle verification copies 16 or 28 bytes past a zero-byte slot; in the reverse case an oversized slot leaks prior ring-buffer contents to trace consumers. Exploitation requires the tracepoint to be enabled by a local administrator, and there is no public exploit identified at time of analysis (EPSS 0.17%).
Out-of-bounds write and kernel memory disclosure in the Linux kernel NFS server (nfsd) affect deployments exporting pNFS flexfiles layouts. The XDR length calculation in nfsd4_ff_encode_layoutget() miscomputes the reservation for the encoded layout, so with certain string/file-handle sizes the server writes up to 5 bytes past the reserved XDR buffer, and with 4-byte-aligned lengths it over-reserves and transmits uninitialized (stale) kernel buffer contents to the client. It is fixed in stable releases 6.12.109, 6.18.50, and 7.2.4 (and 7.3-rc1); no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Out-of-bounds slab write in the Linux kernel's libceph/CRUSH map decoder (crush_decode) lets a malformed CRUSH map corrupt kernel memory on any RADOS client (Ceph RBD or CephFS). Because crush_decode() stores buckets by array slot while the mapper derives each bucket's workspace index from its decoded id, a map encoding an id different from '-1 - slot' makes one bucket alias another's kvmalloc'd workspace; a uniform bucket's second-replica permutation then overflows the smaller aliased buffer, producing a 4-byte OOB write in bucket_perm_choose() confirmed by KASAN. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; the CRUSH map is delivered from the Ceph monitor/OSD map, so exploitation requires a malicious or compromised monitor rather than an arbitrary internet attacker.
Out-of-bounds write in the Linux kernel CephFS client (ceph module) lets a malicious or compromised Ceph monitor corrupt kernel memory on any client with a mounted CephFS. The MDSMap decoder failed to bound export_targets rank values against CEPH_MAX_MDS, and check_new_map() then used each attacker-controlled rank as a bit index into a fixed-size stack bitmap, causing set_bit() to write past the array. No public exploit is identified at time of analysis and EPSS is low (0.17%), but the fix ships across multiple stable trees.
Slab out-of-bounds write in the Linux kernel's CephFS client (ceph_get_name() and __get_snap_name()) lets a malicious or compromised Ceph MDS overflow a NAME_MAX-sized name buffer during NFS-export name resolution. The code copies the MDS-supplied dentry name (rinfo->dname / rde->name) via memcpy and writes a NUL terminator at dname_len without ever checking dname_len against NAME_MAX, so a LOOKUPNAME reply with an oversized name corrupts adjacent slab memory (flagged by KASAN). It is only reachable when a CephFS mount is re-exported over NFS; fixed by the new ceph_export_copy_name() helper that rejects over-length names with -ENAMETOOLONG. No public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Memory-safety corruption in the Linux kernel SUNRPC layer allows a malicious NFS peer to trigger an unsigned integer underflow of the XDR stream length. When gss_krb5_unwrap_v2() decrypts a Kerberos-privacy (krb5p) message, it sets buf->len to a small wire-derived value while the underlying iovec lengths are at page scale; xdr_buf_trim() then subtracts more consumed bytes than buf->len records, wrapping the unsigned length to near UINT_MAX. That corrupted length becomes the authoritative bound for every downstream XDR decoder, enabling out-of-bounds reads and denial of service. A vendor patch is available; this is one of a cluster of related SUNRPC krb5 fixes. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Denial of service (and minor out-of-bounds read) in the Linux kernel's server-side SUNRPC GSS/krb5 code allows a client holding a valid Kerberos GSS context to crash an NFS server exporting with sec=krb5p. svcauth_gss_unwrap_priv() validated only an upper bound on the wire-supplied opaque token length, so a truncated sealed token (len 0-16) reached gss_krb5_unwrap_v2(), which read RFC 4121 header fields past the buffer and hit a divide-by-zero in _rotate_left() (shift %= buf->len with buf->len driven to zero). No public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile).
Denial of service (and short out-of-bounds read) in the Linux kernel's SUNRPC RPCSEC_GSS Kerberos privacy layer affects gss_krb5_unwrap_v2(), which parses the EC/RRC fields at ptr+4/ptr+6 before confirming the token is at least the 16-byte GSS_KRB5_TOK_HDR_LEN. A malicious NFS-with-krb5p peer supplying a sub-16-byte or malformed wrap token triggers an OOB header read, an unsigned wrap in rotate_left()/xdr_buf_subsegment(), a divide-by-zero in the modulo shift, and a dead BUG_ON that fails to stop a movelen underflow driving a ~UINT_MAX-byte memmove(). There is no public exploit identified at time of analysis; EPSS is 0.17% (6th percentile). The upstream fix adds four defense-in-depth length guards.
Out-of-bounds reads in the Linux kernel SUNRPC RPCSEC_GSS privacy (krb5p) receive path allow a malicious or compromised NFS server to crash or leak memory from a connecting client. The function gss_unwrap_resp_priv() validated the opaque token length with a single u32 addition (offset + opaque_len) and no lower bound, so a crafted reply with opaque_len near 0xffffffff wraps the sum below rcv_buf->len and passes the check, while any length below GSS_KRB5_TOK_HDR_LEN is forwarded to gss_krb5_unwrap_v2(), whose pre-decrypt header reads at ptr+4/ptr+6 then run past the token. There is no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a config-gated, DoS-leaning memory-safety bug rather than a broadly weaponizable RCE.
Denial-of-service (and potential memory corruption) in the Linux kernel's NFS-over-RDMA server (svcrdma) arises from offset arithmetic defects in svc_rdma_read_chunk_range(). A malicious or malformed RDMA client can craft Read-chunk segment lists whose offset/length values trigger a u32 underflow, producing a near-UINT_MAX per-segment length that propagates an enormous nr_bvec into svc_rdma_build_read_segment() and a multi-MiB kmalloc_array_node() allocation, while also silently dropping bytes from rebuilt chunks. Affected kernels are those with NFS-over-RDMA serving enabled from v5.11 onward; there is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Out-of-bounds heap write in the Linux kernel's server-side RPC-over-RDMA transport (svcrdma), used by the in-kernel NFS server, allows a malicious RPC-over-RDMA client to corrupt slab memory. When a client requests a reply (such as an NFS READ payload) without supplying a Write list or Reply chunk, and that reply needs more scatter/gather entries than the RDMA device's Send Queue supports, svc_rdma_pull_up_reply_msg() linearizes the entire reply into the fixed sc_max_req_size buffer; because the reply size is bounded only by the client request, the copy runs past the buffer and the oversized length is also posted to the device. There is no public exploit identified at time of analysis, and EPSS is low (0.17%).
A remotely triggerable use-after-free in the Linux kernel SCTP stack (net/sctp) lets a malicious SCTP peer free an association and its transports mid-processing, then have the kernel operate on the freed memory. By bundling COOKIE ECHO, SHUTDOWN, and SHUTDOWN ACK chunks in one packet, the peer creates an association and immediately drives it to sctp_sf_do_9_2_final(), freeing it; a subsequent chunk in the same packet then writes to the freed transport (last_time_heard) and passes the freed association to sctp_do_sm(). No public exploit is identified at time of analysis and EPSS is low (0.17%, 6th percentile), consistent with a memory-corruption bug in a non-default subsystem rather than a mass-exploited flaw.
Use-after-free in the Linux kernel SCTP stack (net/sctp) allows a peer in an established, authenticated SCTP association to trigger a stale transport reference by removing an IP address via ASCONF DEL-IP while an inbound packet is still being processed. sctp_rcv() caches the resolved transport in chunk->transport, but a concurrent sctp_assoc_rm_peer()/sctp_transport_free() can free it during the backlog window or before bh_lock_sock(), after which a delayed SACK causes sctp_outq_select_transport() to read freed memory. Fix drops such chunks in sctp_inq_push(); no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Out-of-bounds heap write in the Linux kernel's XDP subsystem allows memory corruption when an AF_XDP zero-copy packet is redirected through cpumap. The xdp_convert_zc_to_xdp_frame() routine copies an XSK packet into an order-0 page but advertises the full PAGE_SIZE as usable and records zero headroom, letting the frame overrun the page tail reserved for skb_shared_info and triggering a KASAN slab-out-of-bounds write in skb_gro_receive during GRO processing. No public exploit identified at time of analysis and EPSS is low (0.17%); the vendor has released fixes across stable branches.
Use-after-free in the Linux kernel NFSD server's NFSv4.1+ callback channel lets a slab object be read after it is freed when a client's session is torn down. After a DESTROY_SESSION, the teardown path can kfree() a session while an inflight callback rpc_task on rpciod still dereferences clp->cl_cb_session, because flushing the callback workqueue does not wait for tasks already handed to rpc_call_async() and the 1-second rpc_shutdown_client() drain can be outlived by tasks parked in rpc_delay() during NFS4ERR_DELAY retries. The fix RCU-protects cl_cb_session and switches session freeing to kfree_rcu(); no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a race-dependent server-side kernel bug rather than a mass-exploitation target.
Use-after-free / dangling-pointer corruption in the Linux kernel NFSD server allows an NFSv4.2 client performing an asynchronous server-side COPY to leave a stale IDR entry in the s2s_cp_stateids table, pointing at per-request COMPOUND buffer memory that is immediately recycled. When the NFSD laundromat or manage_cpntf_state() later walks that IDR, it dereferences reused request memory and can be steered into refcount_dec()/idr_remove()/kfree() on attacker-influenced garbage, corrupting kernel memory or crashing the server. No public exploit is identified at time of analysis, EPSS is low (0.17%, 6th percentile), and a vendor patch is available; the CVSS 9.8 rating substantially overstates the practical risk.
A use-after-free in the Linux kernel NFSD server's asynchronous server-side copy (NFSv4.2 COPY offload) lets teardown paths race the copy kthread, corrupting or freeing the copy object early. When an OFFLOAD_CANCEL request, an nfsd export/superblock shutdown, or a per-filesystem cancel runs concurrently with the reaping copy kthread, nfsd_file structures (nf_src/nf_dst) are double-put and freed, the STOPPED flag is set before final dereferences, and the copy_task/callback are used after free - causing NULL derefs, double frees, and UAF that can crash an NFSv4.2-serving host. Fixed in stable kernels 6.18.51, 7.2.4, and 7.3-rc1; no public exploit identified at time of analysis and EPSS is low (0.17%).
Use-after-free in the Linux kernel's NFS server (nfsd) allows a freed nfs4_client structure to be dereferenced during NFSv4 delegation revocation. When a recalled delegation times out, nfs4_laundromat() briefly unhashes it from cl_delegations before revoke_delegation() relinks it onto cl_revoked, and in that window client_has_state() can report no remaining state, letting free_client() run while revoke_delegation() is still about to touch cl_lock. Fixed versions are available; no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Use-after-free in the Linux kernel's ksmbd in-kernel SMB3 server lets any authenticated SMB client holding a durable batch oplock corrupt kernel memory during oplock-break notification. smb2_oplock_break_noti() reads opinfo->conn without a lock and dereferences it after two sleep-capable allocations; if the durable handle owning the oplock is disconnected concurrently, the connection is freed and a racing break from another connection resurrects the stale pointer, leading to a use-after-free in ksmbd_conn_write(). No public exploit identified at time of analysis, and EPSS is low (0.17%), consistent with a race-dependent, DoS-leaning memory-safety bug rather than a turnkey RCE.
Use-after-free in the Linux kernel's NFS server (nfsd4_create_file, the NFSv4 OPEN-with-create path) allows a stale dentry to be dereferenced after being freed. When the exported filesystem is itself NFS (an NFS re-export), dentry_create() can return a different dentry than the one passed in, so the original 'child' dentry already recorded in resfhp may be freed and later dereferenced via fh_compose(), leading to memory corruption and likely a server crash. No public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile), and the fix is available upstream in stable kernels.
Use-after-free in the Linux kernel CephFS client (check_new_map()) lets a freed ceph_mds_session be dereferenced during MDS map processing, enabling memory corruption and likely denial of service on machines with a mounted CephFS. When check_new_map() releases mdsc->mutex to handle a session's address change, reconnect, or active transition, it fails to take a reference on the session (unlike the forced-close path), so a concurrent thread can unregister and kfree that session before the original thread touches s->s_mutex. This is no public exploit identified at time of analysis; EPSS is low at 0.16%.
Out-of-bounds slab read in the Linux kernel NTFS driver's cluster allocator lets a crafted NTFS image trigger a KASAN-detected memory read when a file on the volume is extended. The free-cluster bitmap array (vol->lcn_empty_bits_per_page) is sized from the volume's nr_clusters at mount, but ntfs_cluster_alloc() bounds its scan by the on-disk $Bitmap size instead; an image whose $Bitmap advertises more clusters than the volume actually has drives the allocator past the array. Reported through the Linux stable tree with an upstream fix; no public exploit identified at time of analysis and EPSS is low (0.16%).
Denial of service in the Linux kernel NFS server (nfsd) pNFS layout subsystem allows an authenticated NFSv4.1+ client to leak layout stateids, gradually exhausting kernel memory. A race in the layout fence/recall path (lm_breaker_timedout) lets the block-lease breaker acquire a duplicate sc_count reference that is never released, pinning the layout stateid forever. Rated CVSS 9.8 but the real-world impact is availability-only and gated on a niche pNFS export configuration plus a race window; no public exploit identified at time of analysis and EPSS is very low (0.15%, 5th percentile).
Out-of-bounds kernel memory write in the Linux kernel ntfs3 driver allows a local attacker to corrupt memory by mounting a crafted NTFS image. ntfs_attr_update_meta() shifts an attribute name forward by eight bytes when converting a non-sparse attribute to sparse (to insert the compressed_size field), but the record validator never confirms name_offset is within bounds, that the name does not overlap the mapping pairs, or that eight free bytes exist after mapping_pairs_offset - so a malicious MFT record can force a write past the attribute boundary. No public exploit identified at time of analysis; EPSS is low at 0.15% (5th percentile) and the issue is fixed in kernel 7.2.4 and 7.3-rc1.
Unauthenticated PHP Object Injection in the ThemeREX Addons (trx_addons) WordPress plugin before 2.45.0 lets remote attackers inject arbitrary serialized PHP objects into the application. Because no authentication is required (CVSS 9.8, PR:N/UI:N), an attacker can supply crafted serialized data to a vulnerable entry point; when combined with a suitable POP gadget chain present in the plugin, another plugin, a theme, or WordPress core, this can escalate to code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection affects the Everest Forms WordPress plugin (wpeverest) in all versions up to and including 3.6.0, allowing remote attackers to pass attacker-controlled serialized data into a PHP unserialize() call. If a suitable POP (property-oriented programming) gadget chain is present in the plugin, an installed theme, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis, and no EPSS or KEV signal was provided.
Sensitive information embedded in the source code of Fortinet FortiMonitorOnSight (7.2.0-7.2.2 and 7.2.4-7.2.7) can be recovered by an attacker and leveraged to bypass access controls. The exposed data (CWE-540) may include credentials, keys, or other secrets that grant unauthorized access to protected functionality. No public exploit is identified at time of analysis, and the CVE's own attack-vector text is an unfilled placeholder, so the exact delivery path is not documented by the vendor.
Unsafe UAV swarm trajectory planning in Robotics-STAR-Lab's RACER exploration framework (SYSU STAR Group, commit abcdef1234567890) arises from a missing default case in the finite-state machine: when a drone transitions into the IDLE state, it silently stops publishing swarm trajectories, which can lead peer drones to plan collision-prone paths and physically collide. This is a logic/safety defect in academic research code rather than a memory-corruption or data-exposure flaw. A gist writeup is referenced (publicly available exploit code exists as a proof-of-concept), but there is no CISA KEV listing and no EPSS signal provided.
Authentication bypass in the Xiongmai XM530 IP camera firmware (HMT.CM2005-v220608.1837 and earlier) lets remote unauthenticated attackers execute privileged ONVIF actions - PTZ control, RTSP/stream URL retrieval, and system reboot - by sending a crafted SOAP request supplying the admin username with any arbitrary password whenever the account's stored password is empty. The flaw sits in the WS-Security (wsse:UsernameToken) verification routine of the Sofia IPC daemon, which fails to reject a token when no password is set. Publicly available exploit code exists (GitHub research repository); no public evidence of active in-the-wild exploitation at time of analysis.