Denial of service and stale-memory disclosure in the Linux kernel SMB/CIFS client (cifs.ko) arise from an integer-overflow in symlink_data()'s error-context parsing loop. A previous fix (commit 7d9a7f1f96cd) checked the post-ALIGN() length against the remaining buffer, but ALIGN() itself overflows: an ErrorDataLength near UINT32_MAX (e.g. 0xFFFFFFF9) makes ALIGN(x,8) wrap to 0, so the bounds check passes and the loop advances by zero bytes, spinning indefinitely while 'p' points into stale data. A malicious or MITM SMB server can trigger this against a connecting client; no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile).
Append-only file protection bypass in the Linux kernel NFS server (nfsd) allows an authenticated NFS client to truncate a file that the kernel would normally protect from truncation. nfsd_setattr() decides whether a SETATTR size change requires the NFSD_MAY_TRUNC permission using an i_size value read without inode_lock, but the actual ATTR_SIZE truncation is applied later under the lock by notify_change(); a concurrent append that extends the file between the two points causes notify_change() to truncate an IS_APPEND file without the check that would reject it. There is no public exploit identified at time of analysis and the EPSS score is low (0.20%, 10th percentile).
Missing mount write-reference in the Linux kernel NFS server (nfsd) lets an authenticated NFSv2 client's SETATTR request run notify_change() without acquiring a mount write reference, bypassing the read-only-remount protection that fh_want_write() normally provides. The flaw affects the BOTH_TIME_SET branch of nfsd_proc_setattr(), which calls fh_verify() early so setattr_prepare() can inspect the dentry, causing nfsd_setattr() to skip the fh_want_write() call. This is a server-side correctness bug with no public exploit identified at time of analysis (EPSS 0.20%, 10th percentile) and is fixed in stable kernels; the assigned CVSS 9.1 with I:H/A:H is substantially overstated.
Silent ACL removal in the Linux kernel NFSv3 server (nfsd) lets a SETACL request unintentionally strip POSIX access or default ACLs from files and directories on an exported filesystem. The NFSACL SETACL handler passes the decoded acl_access/acl_default pointers to set_posix_acl() unconditionally, but the decoder leaves those pointers NULL whenever the client omits the corresponding NFS_ACL/NFS_DFACL mask bit - and a NULL pointer is the VFS signal to delete that ACL type, so a request with mask=NFS_ACL drops the directory's default ACL and mask=0 drops both. Present since 2.6.13 and fixed in 6.12.109/6.18.50/7.2.4/7.3-rc1; no public exploit identified at time of analysis and EPSS is low (0.20%).
Decompression result corruption in the Linux kernel's Intel IAA (In-Memory Analytics Accelerator) crypto driver (iaa_crypto) occurs when a hardware analytics error forces a software fallback that writes the destination buffer with the CPU while it is still mapped DMA_FROM_DEVICE; with SWIOTLB active, the subsequent dma_unmap_sg() overwrites req->dst with the stale bounce buffer, corrupting the decompressed output. The issue was resolved upstream and affects kernels from ~6.8 through the fixed releases. No public exploit identified at time of analysis, and EPSS is low at 0.20%.
Kernel heap information disclosure in the Linux CephFS client (fs/ceph) lets a malicious or compromised Ceph metadata server (MDS) leak adjacent kernel heap bytes to a local user. __build_xattrs() fails to bounds-check the value length of the final xattr in an MDS-supplied blob, so an oversized length is stored verbatim and later copied out of bounds by getxattr(2). No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile) and the flaw is not in CISA KEV.
Out-of-bounds slab read in the Linux kernel SUNRPC Kerberos GSS layer allows a malicious NFS peer to make gss_krb5_verify_mic_v2() read past an undersized buffer when verifying an RFC 4121 MIC token. The function dereferences the token header, flags, and padding and builds a scatterlist over the checksum without ever checking that the wire-supplied token is at least GSS_KRB5_TOK_HDR_LEN (16) plus the enctype checksum length; all callers only enforce loose upper bounds, so a short checksum opaque produces a small allocation the verifier reads beyond. Exploitation is limited to deployments using RPCSEC_GSS Kerberos (NFS sec=krb5); there is no public exploit identified at time of analysis and EPSS is low (0.19%).
Out-of-bounds read in the Linux kernel CephFS client (fs/ceph/mdsmap.c) lets a malicious or compromised Ceph monitor crash a client that has a CephFS mount. ceph_mdsmap_decode() advances its decode cursor by num_export_targets*4 bytes for each per-MDS info record without verifying enough bytes remain, and the only runaway-cursor guard is skipped for info versions 2 and 3, so an oversized count walks the cursor past the message front buffer and a later ceph_decode_32() reads slab memory out of bounds. No public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile).
Remote out-of-bounds read and general protection fault in the Linux kernel's svcrdma (RPC-over-RDMA server) code allows a connected RDMA client to crash the kernel by advertising a Write or Reply chunk with zero segments. The pcl_for_each_segment iteration macro computed an inclusive upper bound of &ch_segments[ch_segcount - 1]; with a u32 ch_segcount of 0 this underflows to 0xFFFFFFFF, walking far past the flex array until it faults when svc_rdma_get_inv_rkey() dereferences segment->rs_handle. Fixed upstream; EPSS is low (0.17%, 6th percentile) and no public exploit is identified at time of analysis.
Kernel-memory disclosure in the Linux kernel's SMB/CIFS client (cifs.ko) lets a malicious or compromised SMB server leak up to ~65535 bytes of adjacent slab memory to userspace. CIFSTCon() computes its string-parsing bound from the server-supplied ByteCount minus two; a ByteCount of 0 or 1 underflows to a negative int that converts to a huge size_t and wraps the __u16 bytes_left, so cifs_strndup_from_utf16() reads far past the ~16 KB cifs_req_poolp slab object, and the leaked bytes surface via tcon->nativeFileSystem in /proc/fs/cifs/DebugData. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Out-of-bounds read in the Linux kernel's SMB/CIFS client allows a malicious or compromised SMB server to trigger memory over-reads while the client processes oplock-break responses. A refactor (commit 83bfbd0bb902 removing the RFC1002 header from smb_hdr) mechanically rewrote a DataOffset bounds check in is_valid_oplock_break() into an expression that is identically zero, silently disabling the guard that commit 097f5863b1a0 originally added - so an attacker-supplied 32-bit DataOffset again escapes validation. No public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile).