Uninitialized mutex use-before-initialization in the Linux kernel's ALSA pcxhr driver exposes systems with Digigram PCXHR audio hardware to a race condition during driver probe. The pcxhr_probe() function calls request_threaded_irq() before mgr->lock is initialized; if an interrupt fires during the probe window, the threaded IRQ handler attempts to acquire an uninitialized mutex, resulting in undefined kernel behavior ranging from panic to memory corruption. Patch commits are available across multiple stable kernel branches; no public exploit or active exploitation (CISA KEV) has been identified, and EPSS is 0.20% at the 10th percentile.
Dangling pointer vulnerability in the Linux kernel's Qualcomm MSM IOMMU driver (iommu/msm) can lead to kernel memory corruption on systems running Qualcomm MSM/Snapdragon SoCs. The msm_iommu_probe() function registers its devm-managed IOMMU object in the global qcom_iommu_devices list prior to completing sysfs and IOMMU core registration; if either iommu_device_sysfs_add() or iommu_device_register() fails, the devm framework releases the backing memory while the stale list entry remains, producing a dangling pointer that subsequent kernel list walks may dereference. Fixes are available in stable branches 6.18.50 and 7.2.4; no public exploit code has been identified and EPSS sits at 0.20% (10th percentile).
Memory corruption in the Linux kernel's IPMI message handler (ipmi/msghandler) stems from an incomplete error-path cleanup: when an IPMI interface encounters an error during startup, kernel workqueue items already scheduled for that interface are not canceled before the interface structure is freed, creating a use-after-free condition. Systems running kernel versions in the 6.18.20-6.18.49 and 7.0-7.2.3 ranges with IPMI-capable hardware are affected. Patches were released in stable updates 6.18.50 and 7.2.4; no public exploit exists and EPSS is very low at 0.20%.
Use-before-initialization race condition in the ADI I3C master driver of the Linux kernel allows a hardware interrupt to acquire an uninitialized spinlock during device probe. Specifically, adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR before the transfer queue lock and IBI state are initialized, so an early CMDR interrupt can invoke adi_i3c_master_irq() and attempt to take master->xferqueue.lock against an uninitialized dynamic key. No public exploit has been identified and EPSS is 0.20%, but the fix is confirmed in stable trees 6.18.50 and 7.2.4.
Seccomp filter bypass in the Linux kernel entry path allows a low-privileged local process to execute syscalls blocked by a newly installed seccomp filter. The vulnerability arises because `syscall_trace_enter()` caches the `syscall_work` flags at entry; when a sibling thread installs a seccomp filter via `SECCOMP_FILTER_FLAG_TSYNC` while the first thread is ptrace-stopped, the `SYSCALL_WORK_SECCOMP` flag is set on the stopped thread but the stale cached variable never reflects it. When the ptrace tracer also modifies the syscall number during the stop (e.g., substituting `execve`), the resumed thread bypasses the filter entirely. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.18%.
Out-of-bounds array access in the Linux kernel ntfs3 filesystem driver allows an attacker who can cause a crafted NTFS image to be mounted to trigger kernel memory corruption via an overflow of the page_lcns[] array. The copy_lcns and redo-shorten loops index page_lcns[] at j+i where i is bounded by the log record's lcns_follow field rather than the target dirty-page entry's field, and because check_dp_table() validates the entry but not the copy_lcns record, and find_dp() bounds j but not i, a crafted record can overflow the array of an otherwise structurally valid entry. No public exploit has been identified at time of analysis, and EPSS is 0.18%, but siblings CVE-2026-89610 through CVE-2026-89613 affect the same ntfs3 code path in the same kernel fix wave.
An infinite loop in the Linux kernel's device property subsystem causes system hangs when iterating firmware nodes (fwnodes) with a secondary fwnode containing more than one child. Affected are Linux kernel versions across multiple stable branches (5.10.x through 6.19.x pre-patch). An attacker or malformed firmware blob that produces such a node topology can cause a kernel thread to spin indefinitely, consuming a CPU core and ultimately triggering a watchdog reset or complete system hang. No active exploitation has been confirmed, and EPSS stands at 0.17%.
Uninitialized mutex race condition in the Linux kernel's omapfb DSI command-mode panel driver (panel-dsi-cm) exposes OMAP SoC systems to kernel panic or memory corruption. dsicm_probe() calls omapdss_register_display() to publish the display device before executing mutex_init() on ddata->lock, creating a window where any concurrently-invoked dsicm callback can attempt to acquire an uninitialized mutex with undefined results. No public exploit exists and EPSS sits at 0.17% (6th percentile), accurately reflecting the extreme niche of OMAP hardware in current deployments. Vendor-released patches are available across affected stable branches.
Dangling pointer in the Linux kernel AS3722 PMIC regulator driver leaves `pdev->dev.of_node` referencing freed memory after `of_node_put()` prematurely drops the reference acquired by `of_get_child_by_name()` during Device Tree parsing in `as3722_get_regulator_dt_data()`. Systems running the ams AS3722 Power Management IC driver - predominantly NVIDIA Tegra-based embedded platforms - are affected across all kernel versions since Linux 3.13. If the stale pointer is subsequently dereferenced by regulator framework operations, kernel memory corruption, information disclosure, or local privilege escalation may result; no public exploit code has been identified at time of analysis.
Slab out-of-bounds write in the Linux kernel's cros_usbpd-charger driver allows a malfunctioning, malicious, or compromised Chrome Embedded Controller (EC) to corrupt kernel heap memory during device probe. The driver accepts EC-reported USB PD port counts as loop bounds without validating them against EC_USB_PD_MAX_PORTS (8), so an EC returning any count N > 8 - up to the u8 maximum of 255 - writes N pointers into an 8-entry slab-allocated array, overflowing by up to 247 entries (~1976 bytes). No public exploit exists and EPSS is 0.17%, reflecting the high-complexity attack path that requires prior EC firmware compromise.
Out-of-bounds write in the Linux kernel's cros_usbpd-charger driver allows kernel memory corruption when a malicious or compromised ChromeOS Embedded Controller (EC) returns a falsified USB PD port count. Kernels from approximately v4.20 through unpatched 6.12.x, 6.18.x, and 7.2.x stable branches fail to clamp the EC-supplied charger port count to EC_USB_PD_MAX_PORTS before iterating, enabling heap corruption with potential for privilege escalation or system crash. No public exploit exists (EPSS 0.17%, 6th percentile), and patches have been released in 6.12.109, 6.18.50, and 7.2.4.
Use-after-free in the Linux kernel's LP8727 battery charger driver allows local exploitation via a race condition in lp8727_release_irq() that can corrupt kernel memory. The defect exists because lp8727_release_irq() cancelled the delayed work before freeing the IRQ, leaving a window where a concurrently delivered IRQ could cause the threaded handler lp8727_isr_func() to re-arm the work via schedule_delayed_work(); after the .remove path returned and the devm layer freed pchg, lp8727_delayed_func() could still execute and dereference the freed structure. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17%, consistent with a static-analysis-detected defect with no known weaponization.
Use-after-free vulnerability in the Linux kernel's rt9455 power supply driver allows local exploitation through a race condition between delayed workqueue callbacks and driver teardown. The rt9455_remove() function cancels work items in an order that permits batt_presence_work to re-queue max_charging_time_work after the latter has already been cancelled, resulting in a callback executing against already-freed rt9455_info memory. Identical UAF exposure exists in the probe error path if rt9455_hw_init() fails after the IRQ is registered. No public exploit exists and EPSS is 0.17% (6th percentile); the vulnerability was identified by static analysis rather than observed in exploitation.
Off-by-one out-of-bounds NUL write in the Linux kernel's HP BIOS configuration driver (hp-bioscfg) corrupts kernel memory when hp_get_string_from_buffer() receives a BIOS attribute string whose length exactly matches the destination buffer size, causing the terminator write to land one byte past the allocation. The flaw affects multiple fixed-size kernel buffers - path[512], current_value[512], current_password/current_value[64], and the per-entry encodings[][512] and prerequisites[][512] arrays - exclusively on HP hardware with the hp-bioscfg module loaded. No public exploit code has been identified and EPSS stands at 0.17%, but the kernel write primitive carries theoretical privilege escalation potential alongside a realistic denial-of-service outcome.
Slab-use-after-free in the Linux kernel vsock/virtio transport driver allows a local attacker to trigger kernel memory corruption by exploiting a work-item flush ordering bug during device removal. The virtio_vsock_remove() path flushes work items without respecting producer-to-consumer dependencies (tx_work → send_pkt_work → rx_work), allowing kfree(vsock) to race with a newly queued rx_work item, as confirmed by KASAN reporting a UAF read in virtio_transport_rx_work. No public exploit exists and no active exploitation has been identified; EPSS is 0.17% (6th percentile). Patches are available in stable releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Landlock LSM in Linux kernel 5.13+ fails to enforce filesystem creation restrictions for whiteout objects across two distinct syscall paths, enabling a sandboxed process to escape its Landlock domain constraints. The renameat2(2) syscall with RENAME_WHITEOUT performs no Landlock MAKE_* access control check whatsoever, allowing any Landlock-restricted process to create whiteout directory entries even when all filesystem creation rights are denied; separately, mknod(2)-based whiteout creation was gated on the incorrect permission class (MAKE_CHAR instead of MAKE_REG). No public exploit exists, EPSS is 0.17%, and the vulnerability is not in CISA KEV, but the renameat2 bypass is a genuine Landlock sandbox escape present in kernels from 5.13 through 7.2.3/6.18.49.
Command injection in projen's task synthesis component before version 0.103.0 allows context-dependent attackers to execute arbitrary commands on developer workstations or CI/CD runners. Shell metacharacters embedded in project configuration values or repository file names are interpolated unescaped into generated .projen/tasks.json task definitions, which execute when developers or automated pipelines invoke synthesized tasks. No public exploit code has been identified at time of analysis, but the supply-chain attack surface - malicious pull requests, forked repositories - significantly lowers the exploitation bar.
OS command injection in TUBITAK BILGEM's Pardus Software (the software center/package management application for the Pardus Linux distribution) allows a local unprivileged user to execute arbitrary OS commands, likely with elevated privileges. Versions before 1.0.5 are affected; the fix is available in 1.0.5. Reported by Turkish national CERT (USOM) and published via the Turkish cyber security authority's advisory portal. No public exploit code or active exploitation confirmed at time of analysis.
Remote code execution in SICK AG's Sentio Creator Extension 'Device Manager' allows an unauthenticated network attacker, with required user interaction, to execute arbitrary code on a target system by delivering a malicious device driver package that bypasses the application's driver verification mechanism. The vulnerability (CWE-347) stems from improper verification of cryptographic signatures on driver packages, with the 'Jwt Attack' tag suggesting the verification layer uses JWT tokens susceptible to forgery or algorithm manipulation. CVSS S:C (scope changed) reflects that driver-level execution escapes application boundaries and achieves OS/kernel-level impact. No public exploit or KEV listing has been identified at time of analysis.
Cookie-signing secret forgery in an ICS platform's bundled packet-analysis component allows unauthenticated network attackers to bypass authentication entirely when the deployment was initialized from an example configuration file without running the required secret-regeneration routine. The vulnerability (CWE-1392) is contingent on a specific, detectable misconfiguration: the example `.env`-style file ships a publicly known static secret, and deployments that skip the setup step remain permanently vulnerable. Reported under an ICS-CERT advisory (ICSA-26-254-01), this affects operational technology environments where the packet-analysis UI is network-exposed.
Process termination via unrecovered panic in AWS SDK for Go v2's EventStream header decoder allows a remote actor to crash any Go application consuming AWS streaming service responses. Sending a crafted EventStream response frame containing a header value type byte outside the valid range triggers an unhandled Go panic that propagates to terminate the host process. The affected surface includes Bedrock inference and agent runtime packages, making AI/ML workloads on AWS a particularly relevant target; no public exploit or active exploitation has been confirmed.
Integer overflow during NFSv2 SETATTR/CREATE decoding in the Linux kernel NFSD corrupts file timestamps before proc-level validation can occur. On ILP32 (32-bit) kernels, `tmp2 * NSEC_PER_USEC` overflows a 32-bit unsigned long, wrapping an out-of-range useconds value into an in-range tv_nsec - bypassing the subsequent range check and letting a bogus nanosecond value reach the filesystem. A secondary defect on all platforms allows a client placing useconds==1000000 in the atime field (without also setting mtime to 1000000) to leave ATTR_ATIME_SET armed with tv_nsec=10^9, which also reaches the filesystem unchecked. No public exploit has been identified at time of analysis; EPSS is 0.21%.
Uninitialized memory use in the Linux kernel MPTCP subsystem allows a remote off-path peer to corrupt MPTCP subflow path manager bookkeeping by influencing a stale slab byte. Since Linux 5.9, mptcp_token_join_cookie_init_state() restores six fields from the SYN cookie entry during MP_JOIN 4th-ACK processing but omits local_id; subflow_ulp_clone() then reads whatever byte the SLAB_TYPESAFE_BY_RCU allocator left behind - a value an off-path attacker can steer by racing concurrent MP_JOIN SYNs against the slab recycler. The result is an incorrect address-ID on the joined subflow, corrupting path manager bookkeeping and potentially causing subflow teardown or misdirection. No public exploit is identified at time of analysis; EPSS is 0.21% (11th percentile).
TRIM/discard is completely broken on 4Kn (4096-byte native sector) block devices in the Linux kernel's libata-scsi layer, causing every ATA DSM TRIM command to fail with 'Parameter list length error' and trigger WARN_ON() splats on each attempt. The bug is in ata_scsi_write_same_xlat(): ata_format_dsm_trim_descr() caps its output at 2048 bytes (ATA_SCSI_RBUF_SIZE), but the caller compares this return value against the logical sector size - on 4Kn devices (sector_size=4096), this equality check always fails and every TRIM is rejected. No public exploit exists; this is a deterministic functional regression on specific hardware. Vendor-released patches are available in stable kernels 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Out-of-bounds buffer read in the Linux kernel SMC-Rv2 LLC message handler allows a malicious remote SMC peer to corrupt rtoken state by triggering reads from stale shared receive-buffer data. Specifically, smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() process a crafted DELETE_RKEY_V2 or ADD_LINK v2 message declaring up to 255 rkeys, reading the overflow portion from whatever a prior message left in lgr->wr_rx_buf_v2, potentially deleting valid registered memory keys or installing spurious ones. No public exploit code exists and EPSS is 0.20% (10th percentile), but the impact within SMC-R-enabled datacenter environments is real - disrupted RDMA sessions and hard-to-diagnose memory-token corruption.
Linux kernel NFS server (NFSD) contains a spurious WARN_ON_ONCE in nfsd_mode_check() that fires when an authorized NFS client performs a LOOKUP on a re-exported NFS filesystem whose dentry legitimately lacks i_op->lookup (mountpoints, V4 referrals). On systems configured with panic_on_warn=1 - common in production-hardened Linux deployments - this constitutes a remotely triggerable kernel panic and full availability loss. The nfserr_notdir guard that prevents the downstream NULL pointer dereference in lookup_one_unlocked() → __lookup_slow() → inode->i_op->lookup() is preserved in the fix; without it, the same codepath would dereference a NULL method pointer. No public exploit is identified at time of analysis and EPSS is 0.17%.
Out-of-bounds read in the Linux kernel SMB client's reparse_buf_ptr() function allows a malicious or MITM-positioned SMB server to trigger a kernel-level OOB memory read by returning a crafted IOCTL response with OutputCount below 6 bytes. The function reads ReparseDataLength at byte offset 4-5 of struct reparse_data_buffer before verifying that count covers the full 8-byte fixed header, exposing unvalidated memory and potentially crashing the client kernel. No public exploit code exists and EPSS is 0.15%, consistent with the network-positioning requirement and absence of weaponized tooling.
Arbitrary file deletion in UsersWP ≤ 1.2.70 for WordPress allows authenticated Subscriber-level users to delete any file on the server - including wp-config.php - via a path traversal bypass in the upload_file_remove() AJAX handler. The exploit exploits a two-phase validation failure: validate_file() only rejects literal '../' sequences, but the uwp_get_file_relative_url() helper later performs a global str_replace() that collapses crafted embedded tokens into directory traversal sequences after the final validation gate, with the result passed directly to wp_delete_file() without canonical containment. No public exploit code or CISA KEV listing is confirmed at time of analysis; however, the low privilege requirement and precise Wordfence source-level write-up substantially reduce the research barrier for threat actors.
Silent kernel memory corruption in the Linux kernel SUNRPC subsystem arises when percpu counter allocation fails undetected during RPC service creation. When `percpu_counter_init()` fails inside `__svc_create()`, the function returns a half-initialized `svc_serv` structure to nfsd, lockd, or the NFS callback service without error; subsequent hot-path increments in `svc_xprt_enqueue()`, `svc_handle_xprt()`, and `svc_pool_wake_idle_thread()` dereference the NULL per-cpu pointer, which resolves to offset zero of the running CPU's per-cpu area and silently overwrites arbitrary kernel memory. Triggering the flaw requires local administrator access plus memory pressure at RPC service startup; the description explicitly excludes remote induction. No public exploit or CISA KEV listing exists, and EPSS sits at 0.22% (13th percentile).
Missing ingress-device validation in the Linux kernel's AF_IUCV HiperSockets receive path allows adjacent-network attackers on the same HiperSockets segment (VCHID) to deliver crafted ETH_P_AF_IUCV frames to sockets bound on different IQD devices, enabling accept-queue exhaustion, data injection into established connections, and attacker-controlled peer identity on newly accepted connections. A secondary local vector also exists: a process holding CAP_NET_RAW only within an unprivileged network namespace can send raw ETH_P_AF_IUCV frames over its loopback interface and have them matched against init_net sockets, bypassing namespace isolation. The fix - introduced in stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1 - adds a per-socket hs_dev check against the ingress netdev. No public exploit or CISA KEV listing is present at time of analysis.
Resource leak race condition in the Linux kernel NFS server (NFSD) filecache allows orphaned nfsd_file objects to accumulate when network-namespace shutdown races with the GC worker, shrinker, or fsnotify/lease callbacks. When nfsd_file_cache_shutdown_net() runs concurrently with any of these three paths, already-unhashed files queued to the per-net dispose list are missed by the shutdown drain, leaving both the file handle and associated NFS state permanently leaked. The vulnerability affects Linux 6.9 through pre-patch kernels and is DoS-leaning with no public exploit identified at time of analysis and an EPSS of 0.20%.
Use-after-free in the Linux kernel's svcrdma (NFS-over-RDMA server transport) arises from incorrect teardown ordering in svc_rdma_free(): rdma_destroy_id() frees sc_cm_id while the transport's sc_rn notification entry remains registered in the device's rd_xa xarray, leaving a dangling reference that a concurrent ib_unregister_device walk can dereference via svc_rdma_xprt_done(). Exploitation requires an NFS-over-RDMA server configuration with RDMA hardware and a race between transport teardown and device unregistration. No public exploit or CISA KEV listing exists; EPSS is 0.20%, consistent with a niche, timing-dependent kernel race.
Out-of-bounds read in the Linux kernel Bluetooth subsystem's eir_get_service_data() leaks kernel heap memory into userspace for ISO broadcast sink configurations. When an ISO broadcast sink processes periodic advertising (PA) reports from a remote Bluetooth broadcaster, a PA payload packed with multiple mismatching Service Data fields causes eir_len to undercount by 2 bytes per field iteration - the subtraction uses only the data length (dlen), omitting the 2-byte length+type header - so the pointer eventually reads past hcon->le_per_adv_data[] into the surrounding struct hci_conn; a drifted field matching the BAA UUID causes those bytes to be copied into iso_pi(sk)->base, recoverable by a local or remote-assisted userspace process via getsockopt(BT_ISO_BASE). No public exploit or CISA KEV listing exists; EPSS of 0.17% (6th percentile) reflects low opportunistic risk, though the Bluetooth adjacent-network constraint caps mass exploitation potential.
Integer underflow in the ath6kl WiFi driver's ath6kl_cfg80211_connect_event() allows an adjacent-network attacker controlling a rogue access point to trigger disclosure of kernel slab memory to userspace via nl80211. When a crafted association response shorter than 6 bytes (or request shorter than 4 bytes) is received from firmware, the u8 length fields wrap around to approximately 250, causing cfg80211_connect_result() or cfg80211_roamed() to copy ~250 bytes of adjacent slab data through netlink to any listening userspace process. Patches are available across all active stable branches; no public exploit exists at time of analysis.
Use-after-free in the Linux kernel NFS server (nfsd) file-cache disposal path allows concurrent kernel subsystem callbacks - the global memory shrinker, nfsd laundromat garbage collector, and fsnotify - to dereference a freed nfsd_fcache_disposal struct during per-network-namespace teardown, producing kernel heap corruption or a system panic. The vulnerable window opens when a network namespace hosting nfsd is destroyed while disposal callbacks remain in-flight; containerized NFS server deployments (Docker, Kubernetes) are the most realistic trigger scenario. No public exploit identified at time of analysis, with EPSS at 0.17% consistent with a race-condition-gated kernel bug.
Use-after-free and NULL pointer dereference in the Linux kernel's lockd/nfsd subsystem allow a race between nfsd module teardown and in-flight lockd dispatch to dereference freed module memory, causing kernel panic or potential slab corruption. Any Linux NFS server running both nfsd and lockd (NFSv2/NFSv3 file locking) from kernel 2.6.12 through pre-7.2.4 is affected when nfsd is dynamically unloaded during active NFS lock operations. No public exploit has been identified and EPSS is 0.15%, consistent with the race-condition prerequisite.
Privilege escalation in the Linux kernel CIFS/SMB client allows a local user with write access to a setuid or setgid binary on a CIFS mount to retain those elevated-execution bits on the server after a write operation that should have stripped them. The flaw exists in cifs_setattr_unix() and cifs_setattr_nounix(), which unconditionally dropped the ATTR_MODE flag when ATTR_KILL_SUID/ATTR_KILL_SGID was present, preventing the cleared mode from being propagated to the server when using cifsacl, modefromsid, SMB3.1.1 POSIX extensions, or SMB1 Unix extensions. An attacker who can write to a setuid binary on such a mount can subsequently execute it with unintended elevated privileges. No public exploit has been identified and EPSS is 0.21%, but vendor-confirmed patches are available in kernels 7.2.4, 6.18.51, and 7.3-rc1.
Stale debugfs function pointers in Linux kernel NFSD create a use-after-free condition when module initialization fails partway through. Specifically, nfsd_debugfs_init() registers debugfs files containing fops pointers into module text before nfsd4_init_slabs() succeeds; if slab allocation then fails, the module's text is freed but the debugfs entries remain live with now-dangling pointers. Any subsequent access to those orphaned debugfs files - for example by a local user browsing /sys/kernel/debug - can trigger a kernel-mode UAF, potentially crashing the system or enabling privilege escalation. No public exploit code exists and EPSS is 0.21%; patch commits are available for 6.18.50, 7.2.4, and 7.3-rc1.
Missing lock acquisition in the eCryptfs filesystem layer exposes the global message context list to concurrent modification during daemon teardown. In `ecryptfs_exorcise_daemon()`, queued message contexts are moved back to the free list without holding `ecryptfs_msg_ctx_lists_mux`, while `ecryptfs_msg_ctx_alloc_to_free()` and other list consumers require that lock - creating a race window for use-after-free or memory corruption reachable by a local user. No public exploit exists and EPSS is 0.21%, but C:H/I:H/A:H impact makes this a meaningful local privilege escalation candidate on systems using eCryptfs.
Use-after-free in the Linux kernel's RDMA/cxgb4 driver (Chelsio T4/T5/T6 RDMA support) allows a local low-privileged attacker to trigger kernel heap memory corruption by racing device removal against deferred RDMA device registration work. The driver's `c4iw_remove()` teardown path frees `ctx->dev` while a `reg_work` work item queued by `c4iw_uld_state_change()` may still be executing, leaving `c4iw_register_device()` operating on freed memory. No public exploit or active exploitation has been identified; vendor-released patches are available in stable kernel series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Ceph filesystem driver in the Linux kernel leaks an inode wrbuffer reference when writeback is aborted during umount, triggering a kernel BUG and system crash. The defect manifests specifically when ceph_submit_write() fails the osd_stopping_blocker check at unmount time: the wrbuffer claim taken by ceph_dirty_folio() is never released because writepages_finish() - the only release path - never runs for aborted, never-submitted writes. Because i_wrbuffer_ref never returns to zero, the corresponding ihold() is never dropped, the inode cannot be evicted, and the kernel panics with 'VFS: Busy inodes after unmount of ceph' at fs/super.c:650. No public exploit code exists and no active exploitation has been reported; EPSS probability is 0.21%.
Use-after-free in the Linux kernel's universal-pidff HID force-feedback driver allows a local attacker with low privileges to write into freed kernel memory by exploiting a missing cleanup path when force-feedback initialization fails after device start. When hid_pidff_init_with_quirks() returns an error, hid_hw_start() is never reversed, leaving the hidraw character device node alive and pointing to freed memory; with hdev->driver set to NULL, hid_device_remove() also skips hid_hw_stop(). Any subsequent open of the surviving /dev/hidrawX can trigger a UAF write via the transport spinlock callback, potentially escalating local privileges to root. No public exploit has been identified, but the detailed commit description supplies a ready trigger condition.
Use-after-free in the Linux kernel's at91_udc USB gadget driver allows a local low-privileged attacker to dereference freed kernel memory during driver teardown, potentially achieving kernel code execution. The vulnerability affects systems running AT91/SAM series Atmel ARM microcontrollers in polled-VBUS mode, where a self-restarting timer/work cycle is never cancelled before the devm-allocated udc structure is freed. No public exploit exists and no KEV listing has been issued, but the bug is reachable via a routine driver unbind without triggering any fault condition.
Dangling pointer use-after-free vulnerabilities in the Linux kernel USB gadget UVC (USB Video Class) driver allow a local attacker with low privileges to exploit freed memory in the uvc_function_bind() error path and uvc_function_unbind() teardown routine. The driver fails to NULL uvc->control_req after usb_ep_free_request() and uvc->control_buf after kfree(), leaving stale pointers that can be dereferenced in subsequent operations. No public exploit or active exploitation has been identified; EPSS sits at 0.20% (10th percentile), consistent with an unexploited kernel subsystem bug on niche hardware.
UAF in the Linux kernel's user_events tracing subsystem (present since kernel 6.4) allows a local unprivileged user to trigger a reference-count underflow during fork failure, freeing the parent process's user_event_mm slab object while the parent retains a stale pointer. Any subsequent user_events ioctl() call by the parent dereferences the freed memory, enabling a write primitive that can lead to local privilege escalation. No public exploit exists and EPSS is low at 0.20%; no KEV listing is present at time of analysis.
Use-after-free in the Linux kernel tracing subsystem allows a local unprivileged attacker with tracefs access to corrupt kernel memory, potentially achieving privilege escalation. The race exists between trace_pipe readers holding stale event pointers and concurrent writes to buffer_subbuf_size_kb, which triggers ring_buffer_subbuf_order_set() to free and replace all ring buffer sub-buffer pages - including reader pages - without coordinating with active readers. KASAN-confirmed reproduction via syzbot (syz-executor989/6002) demonstrates practical triggering. No public exploit or CISA KEV listing at time of analysis; EPSS of 0.20% at the 10th percentile reflects low current exploitation probability.
Use-after-free in the Linux kernel tracing subsystem allows a local attacker with tracefs write access to panic the kernel or corrupt memory by registering two hist triggers sharing the same name= parameter on different events, followed by a third trigger referencing a variable. The second trigger's hist_data is freed by hist_register_trigger() during named-data reuse detection, but its tr->hist_vars list entry is never removed; a subsequent find_var_file() call then dereferences the freed 2048-byte slab region. The bug is confirmed by an included KASAN trace showing the precise allocation and free sites, with a deterministic three-command reproduction sequence documented in the CVE description itself; no public exploit has been identified at time of analysis.
Use-after-free in the Linux kernel's RapidIO mport character device driver allows a local low-privileged user to trigger kernel memory corruption via the DMA request teardown path. The flaw exists in dma_req_free(), where the mutex protecting a mapping object is unlocked through a pointer that may have already been freed by kref_put() invoking the last-reference destructor. An attacker with access to the /dev/mport* character device interface can trigger this condition to achieve kernel privilege escalation. No public exploit code has been identified at time of analysis, and EPSS probability sits at 0.20%.
Double-free memory corruption in the Linux kernel V4L2 (Video for Linux 2) subsystem exists in the error-handling path of __video_register_device() after a prior patch introduced a put_device() call on device_register() failure. Because the V4L2 API contract requires callers to invoke video_device_release() - which kfree()s the video_device struct - on registration failure, the intermediate put_device() frees the struct first, causing a subsequent double-free. The fix reverts the erroneous commit (2a934fdb01db6458288fc9386d3d8ceba6dd551a), accepting a small memory leak in exchange for eliminating the double-free, given that device_register() failures are described as extremely rare in practice. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap out-of-bounds write in the Linux kernel vicodec virtual video codec driver's FWHT encoder allows a local low-privileged user to corrupt adjacent kernel heap memory, potentially enabling privilege escalation to root. The root cause is an undersized CAPTURE buffer: the encoder allocates output using a size multiplier of 3, but 4-component pixel formats whose planes all hit the FWHT_FRAME_UNENCODED verbatim-copy fallback require a multiplier of 4, producing a per-frame overflow of coded_w × coded_h bytes into adjacent slab memory. No public exploit has been identified at time of analysis; the EPSS score of 0.20% reflects the niche status of the vicodec driver in production deployments.