Slab-out-of-bounds memory corruption in the Linux kernel's nilfs2 log-structured filesystem allows a local low-privileged user to corrupt kernel slab memory by truncating a file whose block mapping collapses from B-tree to direct form. When this collapse occurs, an orphaned intermediate B-tree node block remains dirty in the kernel cache; the nilfs2 log writer subsequently misclassifies it as a direct-mapping data block and calls nilfs_direct_propagate() on it, causing a KASAN-detected out-of-bounds access that can lead to privilege escalation or kernel panic. No public exploit exists and EPSS is 0.20%, but the low-complexity local trigger limits the risk primarily to systems actively using nilfs2 mounts.
Use-after-free in the Linux kernel NFSD subsystem allows a local attacker with low privileges to read freed vmalloc memory or trigger kernel memory corruption via a race between the rpc_status netlink diagnostic interface and NFSv4 compound request teardown. The ops buffer (args->ops[]) is freed synchronously by vfree() in nfsd4_release_compoundargs() without waiting for an RCU grace period, while the rpc_status dumpit holds only an rcu_read_lock that protects the parent svc_rqst struct but not the separately vmalloc'd ops buffer. Vendor-released patches are available in stable series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV entry exists at time of analysis.
Two heap out-of-bounds writes in Linux kernel eCryptfs allow a local low-privileged user to corrupt kernel memory structures by supplying a crafted Tag 3 passphrase-encrypted session key packet with an oversized encrypted_key_size field. The vulnerability is exclusively triggered when AES-192 (cipher code 0x08) is used because that cipher sets crypt_stat->key_size=24 independently, permitting crypto_skcipher_setkey() to succeed while encrypted_key_size still exceeds the 64-byte ECRYPTFS_MAX_KEY_BYTES bound - overflowing into ecryptfs_auth_tok and corrupting root_iv, keysig_list, and mutexes in ecryptfs_crypt_stat. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.20% at the 10th percentile.
Resource management failure in the Linux kernel eCryptfs subsystem allows a local authenticated user to trigger a message context leak - and potentially exploit a stale pointer condition - by inducing send failures to the eCryptfs userspace daemon. The ecryptfs_send_message_locked() function moves a context from the free list to the allocated list before calling ecryptfs_send_miscdev(); on failure, it omits the rollback, leaving the context permanently stranded and the caller holding a dangling reference. Vendor-released patches are available across stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit or CISA KEV listing has been identified at time of analysis.
Incomplete error-path cleanup in the Linux kernel uvesafb framebuffer driver leaves a stale v86d connector callback registered when platform driver initialization fails, creating a potential use-after-free condition in kernel memory. All Linux kernel versions from 2.6.24 onward that include the uvesafb driver are affected; the issue was found through static analysis and is patched in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit exists; EPSS is 0.20% (10th percentile), reflecting the narrow and difficult-to-trigger conditions required.
Kernel crash exposure in the OMAP SSI/HSI driver stems from a missing DMA mask initialization on the synthetic HSI controller device allocated via hsi_alloc_controller(), which bypasses the normal OF/platform device setup path and leaves the embedded struct device without a valid dma_mask. Following DMA API hardening changes in the kernel, dma_map_sg() and related helpers enforce the presence of a valid mask before proceeding, causing warnings or kernel panics on any OMAP SoC system where the driver attempts DMA mapping. The vulnerability is tightly hardware-gated to Texas Instruments OMAP-based platforms; patches are confirmed available in kernel stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1, and no public exploit or KEV listing exists.
Use-after-free in the Linux kernel's auxdisplay charlcd driver allows a local, low-privileged attacker to potentially corrupt kernel memory when charlcd_register() fails after bl_work has already been scheduled. The root cause is that charlcd_init() schedules a delayed backlight work item referencing the charlcd object before misc_register() is called; if registration fails, the caller frees the object while the work item's reference remains valid, creating a classic UAF condition. No public exploit exists and EPSS is 0.20% (10th percentile), reflecting the niche hardware footprint and non-default kernel configuration required.
Out-of-bounds kernel memory read in the Linux device-mapper dm-array subsystem allows a local attacker to trigger an OOB read from a dm-bufio buffer by presenting crafted dm-cache metadata with an oversized on-disk nr_entries field, exploitable during dm-cache activation. The flaw exists because array_block_check() validated only block number and checksum while omitting structural field bounds - unlike the sibling node_check() function - leaving dm_array_cursor_next() to bound its iteration directly from the unvalidated on-disk header and element_at() to perform unguarded pointer arithmetic past the buffer end. Vendor-released patches are available for stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit code exists and EPSS is 0.20% at the 10th percentile.
Integer overflow in the Linux kernel's libnvdimm label-validation path allows a local low-privileged attacker with access to NVDIMM configuration commands (or crafted DIMM media) to trigger an out-of-bounds write in nd_label_data_init(). The on-media u32 field nslot, multiplied by sizeof_namespace_label() in 32-bit arithmetic introduced as a regression in Linux 4.13 (commit 564e871aa66f), wraps modulo 2^32 before the bounds check, causing a downstream memset() to overrun the config buffer. No public exploit code has been identified, and EPSS sits at 0.20% (10th percentile), reflecting realistic limited exposure given the niche hardware requirement.
Integer overflow in the Linux kernel's MD (software RAID) subsystem allows a local attacker who can supply or mount a crafted block device superblock to trigger an unchecked bit-shift overflow in super_1_load(), corrupting kernel memory and potentially escalating privileges. The flaw stems from sb->bblog_shift - an 8-bit on-disk value ranging 0-255 - being applied as a left-shift to a 64-bit sector variable without any upper-bound validation, allowing sector and count variables to wrap around and corrupt downstream badblocks API state. No public exploit code has been identified and EPSS sits at 0.20% (10th percentile), placing this in the low-probability-of-exploitation tier despite a CVSS score of 7.8.
Linux kernel ring-buffer subsystem exposes a race condition between subbuffer resize and page allocation/free operations, enabling local privilege escalation. When ring_buffer_subbuf_order_set() clears cpu_buffer->free_page without holding the cpu_buffer->lock, a concurrent ring_buffer_alloc_read_page() or ring_buffer_free_read_page() call can operate on a stale or freed page, producing kernel memory corruption. No public exploit code exists and EPSS is 0.20%, but the CVSS 7.8 C:H/I:H/A:H vector reflects full kernel-level impact potential once the race is won.
Use-after-free in the Linux kernel charger-manager power supply driver exposes local low-privileged users to kernel memory corruption and potential privilege escalation. The driver's probe path registers power_supply sysfs attributes before acquiring regulator handles, and its remove path frees regulator consumer handles before tearing down sysfs - creating two overlapping windows where a write to the externally_control attribute, or the remove path's own try_charger_enable() call, dereferences already-freed memory. No public exploit exists and EPSS is 0.20%, but the bug was discovered by static analysis rather than observed in-the-wild attacks, and patches are available in stable kernel trees 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Two compounding flaws in the Linux kernel's Intel Speed Select Technology (ISST) ioctl handler allow a local low-privileged user to trigger out-of-bounds memory access or NULL pointer dereference in kernel space. The `isst_if_clos_assoc()` function applies an off-by-one validator (`>` instead of `>=`) against the `sst_inst[]` array boundary, permitting socket_id equal to `topology_max_packages()` to index one entry past the allocated array; a second path omits a NULL check for valid in-range socket IDs whose package has no bound TPMI SST instance, both dereferences reaching `map_partition_power_domain_id()`. Patched kernel versions 6.12.109, 6.18.50, and 7.2.4 are available; no public exploit has been identified at time of analysis and EPSS (0.20%, 10th percentile) reflects very low observed exploitation activity.
Use-after-free memory corruption in the Linux kernel's VIA SDMMC host controller driver (mmc/via-sdmmc) can cause kernel instability and potentially enable local privilege escalation on systems equipped with VIA SD card controllers. During driver probe failure, the card-detect interrupt and pending work item (carddet_work) are not cleaned up, leaving the interrupt handler and work queue running against already-freed memory; via_sdc_isr() dereferences the freed sdhost structure while via_sdc_card_detect() performs a container_of() dereference against freed memory. No public exploit or active exploitation has been identified; the issue was discovered through in-house static analysis and manual code review.
Use-after-free in the Linux kernel's interconnect subsystem allows local low-privileged attackers to corrupt kernel heap memory, potentially enabling privilege escalation to root. The flaw resides in `icc_get()` and `of_icc_get_by_index()`: when `kasprintf()` fails to allocate memory for `path->name`, the error handler calls `kfree(path)` directly while the path's request structures are already linked into interconnect-node hash lists via `hlist_add_head()`, leaving dangling pointers that subsequent interconnect operations dereference. Patched kernel versions 6.12.109, 6.18.50, and 7.2.4 are available; no public exploit or CISA KEV listing exists at time of analysis.
Use-after-free race condition in the Linux kernel SLIP driver's sl_sync() function exposes systems running kernels from 2.6.32 onward to local privilege escalation. The slip_devs[] global array stores bare net_device pointers without reference counting; when sl_sync() races with slip_close() teardown, a pointer can be read and dereferenced after netdev_run_todo() has already freed the backing structure because the RTNL semaphore is intentionally dropped during teardown. No public exploit or CISA KEV listing exists at time of analysis; EPSS stands at 0.20%, and the bug was surfaced by syzkaller fuzzing on kernel 6.1.134.
Memory corruption in the Linux kernel TUN/TAP driver allows a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges to root. The flaw exists in tun_get_user(), where an oversized headroom alignment value - most realistically propagated from Open vSwitch to a TUN or TAP device - causes an integer underflow in SKB_MAX_HEAD(align), producing a negative good_linear value that wraps to a massive size_t, causing tun_alloc_skb() to position skb->data outside the allocated skb head. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Use-after-free in the Linux kernel's Open vSwitch (OVS) flow deletion path allows a local attacker with low privileges to crash the kernel or potentially escalate privileges. The bug exists in ovs_flow_cmd_del(): when a CMD_DEL netlink command removes a flow from the OVS table, flow->mask is scheduled for RCU-deferred free, but ovs_flow_cmd_fill_info() subsequently reads that pointer after the RCU grace period may have already freed it-a narrow but real race window confirmed by KASAN traces. Reported by Trend Micro's Zero Day Initiative as ZDI-CAN-32042; no public exploit or active exploitation is confirmed at time of analysis.
NULL and error pointer dereference in the Linux kernel's ravb (Renesas Ethernet AVB) driver allows a local attacker with low privileges to crash the kernel or potentially escalate privileges by querying PTP hardware clock state during an invalid lifecycle window. The flaw affects the ravb driver from Linux 4.2 onward, where priv->ptp.clock is either NULL before the first interface open or left holding an error pointer after a failed PTP clock registration. Fixes are confirmed across stable branches in kernels 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV listing exists.
Use-after-free in the Linux kernel's ravb (Renesas Ethernet AVB) PTP driver allows a local attacker with code execution to potentially escalate privileges or crash the system. The race condition between ravb_ptp_interrupt() and ravb_ptp_stop() permits the interrupt handler to invoke ptp_clock_event() on a clock pointer already freed by ptp_clock_unregister() during interface teardown. No public exploit has been identified at time of analysis, and EPSS is very low (0.20%, 10th percentile), consistent with a hardware-specific kernel bug affecting Renesas SoC deployments.
Use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem, introduced circa v4.18, allows a local low-privileged user to corrupt kernel memory with full read, write, and availability impact. The race condition arises because smc_rx_pipe_buf_release() tests sk_state before acquiring the socket lock, permitting a concurrent smc_conn_free() call to release conn->rmb_desc and walk conn->lgr between the test and the lock - both of which smc_rx_pipe_buf_release() then dereferences, triggering use-after-free. Vendor-released patches are available for stable branches 6.12.109, 7.2.4, and 6.18.50; EPSS at 0.20% (10th percentile) and no CISA KEV listing confirm no known active exploitation at time of analysis.
Use-after-free in the Linux kernel ALSA bcd2000 USB MIDI driver allows a local attacker with low privileges to corrupt kernel memory, potentially achieving privilege escalation or system crash. When a BCD2000 USB device is disconnected while a MIDI rawmidi substream remains open, bcd2000_midi_send() and bcd2000_input_complete() continue to read and write previously freed URB structures, as the pointers are not nulled after usb_free_urb(). KASAN confirmed the slab-use-after-free on Linux 7.2.0-rc5 (arm64), and patches have been released across all active stable branches. No public exploit or KEV listing exists; EPSS is 0.20%.
Use-after-free in the rtl8xxxu WiFi driver allows a local authenticated attacker to corrupt kernel memory during device teardown. The flaw exists in two races within the rx_urb_wq work queue shutdown path: schedule_work() is called outside the shutdown lock, and the worker can submit URBs after usb_kill_anchored_urbs() has returned, both permitting the worker to dereference the freed priv structure after ieee80211_free_hw() releases it. Exploitation requires specific hardware (Realtek RTL8XXXU USB WiFi adapter), active RX traffic, and a concurrent disconnect event. No public exploit exists; this was discovered by static analysis with an EPSS of 0.20%.
Local privilege escalation in the Linux kernel BPF bloom filter implementation (bloom_map_alloc) affects 32-bit x86 kernels via two compounding integer arithmetic bugs: a BITS_TO_BYTES(U32_MAX) wrap at allocation time causes under-allocation of the bitset, and a u32-to-signed-long sign-extension in set_bit/test_bit causes negative bit offsets, enabling out-of-bounds kernel heap reads and writes. Exploitation requires a process holding CAP_BPF on a 32-bit x86 kernel; 64-bit kernels are entirely unaffected. No public exploit identified at time of analysis; EPSS at 0.20% reflects the narrow attack surface imposed by the 32-bit-only constraint.
Use-after-free in the Linux kernel NFSD localio code path allows a local user to dereference recycled slab memory by exploiting a missing RCU read-lock window in `nfsd_open_local_fh()`. The `again:` retry block performs a `cmpxchg` on an `nfsd_file` pointer and then calls `nfsd_file_get()` (refcount_inc_not_zero) without holding `rcu_read_lock`, while the sole caller drops the lock before the helper runs - leaving a race window where CPU1 can put the last reference, trigger `call_rcu`, and have the slab page recycled before CPU0 increments the refcount. Vendor-released patches are available for the 6.15, 6.18, 7.2, and 7.3-rc1 stable trees; no public exploit exists and EPSS is 0.20%.
Write use-after-free in the Linux kernel HID mcp2221 driver allows a local low-privileged user to corrupt kernel memory via a dangling pointer left in the driver's rxbuf field after an I2C/SMBus read transfer ends. The mcp_i2c_smbus_read() function stores the caller-supplied buffer pointer in mcp->rxbuf for the transfer's lifetime but fails to clear it on any return path; a delayed or spurious MCP2221_I2C_GET_DATA USB HID report arriving after the caller frees or reuses the buffer causes mcp2221_raw_event() to memcpy device-controlled data into freed kernel memory. No public exploit has been identified and EPSS is 0.20%, but the kernel write primitive makes this a realistic local privilege escalation path on any system with an MCP2221 USB device attached.
Heap buffer overflow in the Linux kernel's Intel THC HID QuickSPI driver allows a local low-privileged user to corrupt kernel memory via the hidraw interface. The driver's write_cmd_to_txdma() function performs an unbounded memcpy from a caller-supplied HID report into a device-descriptor-derived heap buffer of only a few hundred bytes, while the HID core permits reports up to 16,384 bytes through SET_REPORT/SET_FEATURE ioctls - a size mismatch that lets an attacker overflow the buffer with attacker-controlled length and content, enabling potential local privilege escalation to root. Vendor-released patches are available in Linux 7.2.4, 7.3-rc1, and 6.18.50; no public exploit or active exploitation has been identified at time of analysis.
Heap out-of-bounds write in the Linux kernel erofs compressed filesystem driver corrupts kernel memory when a global buffer pool resize fails mid-way and is retried. During the retry, a temporary pointer array is allocated to the (smaller) intermediate target size, then populated with all existing pointers from a larger-than-expected buffer - writing past the end of the allocation. A separate retry path also triggers spurious -ENOMEM from alloc_pages_bulk() when no new pages are needed. No active exploitation is recorded (not in CISA KEV), and EPSS is 0.20% at the 10th percentile. Vendor-released patches are available in Linux 6.18.51, 7.2.4, and 7.3-rc1.
Use-after-free in the Linux kernel's SUNRPC server thread cleanup allows local attackers to trigger kernel heap reads of freed memory when RCU readers race with svc_exit_thread(). The root cause is an asymmetry in svc_rqst_free(): the rqstp struct is correctly deferred via kfree_rcu(), but rq_argp and rq_resp are freed synchronously before the RCU grace period expires - leaving a window where readers like nfsd_nl_rpc_status_get_dumpit() can dereference the freed pointers. No public exploit or KEV listing exists; EPSS is low at 0.20% (10th percentile), but the kernel UAF primitive carries realistic privilege-escalation potential in environments running NFS servers.
Lock confusion in the Linux kernel's core scheduling subsystem (sched/core) exposes systems with SMT/hyperthreading and CONFIG_SCHED_CORE enabled to a local privilege escalation path from a low-privileged user. During pick_next_task() under the shared core-wide lock, a ->pick_task() implementation that momentarily drops the per-rq lock creates a window where __sched_core_flip(false) can complete and rebind rq_lockp(), causing the scheduler to operate on sibling run-queue state without holding the correct locks - __schedule() then releases a lock it never acquired while leaking the one it holds. No public exploit code exists and EPSS is 0.20%, but vendor-released patches are confirmed in Linux 6.18.51, 7.2.4, and 7.3-rc1.
Memory order mismatch in the Linux kernel ring-buffer subsystem exposes a race condition between ring_buffer_alloc_read_page() and ring_buffer_subbuf_order_set() that can corrupt the bpage->order metadata field relative to actual allocated memory size. When subbuf_order changes mid-allocation, subsequent operations using bpage->order to calculate buffer boundaries may read or write outside the allocated slab region, enabling a low-privileged local attacker with access to tracefs/debugfs interfaces to potentially disclose kernel memory contents or destabilize the kernel. No public exploit code exists and EPSS is low at 0.20%, indicating limited exploitation interest despite the fix being available in stable kernel releases.
Memory management order mismatch in the Linux kernel ring-buffer tracing subsystem allows a local low-privileged user to corrupt kernel memory or crash the system by triggering a ring buffer resize concurrently with cached reader page discard. The root cause is that cpu_buffer::free_page stores only a page address without preserving the allocation order; after a resize changes cpu_buffer->subbuf_order, free_pages() is invoked with the new order rather than the original, corrupting the buddy allocator's state. Vendor-released patches exist in Linux 6.18.51, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV listing exists, and EPSS stands at 0.20%.
Incomplete error-path cleanup in the AMD PMC driver (`platform/x86/amd/pmc`) corrupts the kernel's global LPS0 s2idle linked list when `amd_stb_s2d_init()` fails during module probe, leaving a dangling registered handler whose backing `devm`-managed memory has been freed. On AMD-based x86 Linux systems running an affected kernel, this causes a kernel BUG (`list_add corruption`) upon module reload and a use-after-free condition on any subsequent suspend-to-idle (s2idle) transition. No public exploit exists and EPSS is 0.20% (10th percentile), but the failure condition can arise naturally on long-running systems or specific SMU firmware, making this a realistic local denial-of-service and a potential kernel code-execution path on vulnerable AMD hardware.
Stack memory corruption in the Linux kernel's qnap-mcu MFD driver allows a local low-privileged user on QNAP hardware to corrupt kernel stack memory, potentially enabling privilege escalation. The driver's qnap_mcu_exec() publishes an on-stack receive buffer to the serdev receive path, which runs asynchronously; when a command times out and the function returns, reply->data still points at the deallocated stack frame. A late MCU reply or unsolicited MCU message then overwrites whatever occupies that stack memory next, yielding C:H/I:H/A:H impact. No public exploit exists and EPSS is 0.20% (10th percentile), consistent with a kernel driver bug requiring physical or local QNAP hardware access.
Out-of-bounds read and write in the Linux kernel's dm-pcache (device mapper persistent cache) module allow a local attacker with CAP_SYS_ADMIN to corrupt kernel memory by loading a device mapper table backed by a crafted cache device containing malformed geometry metadata. The root cause is that cache_segs_init() and get_seg_id() consume on-disk cache_info fields - specifically n_segs and per-segment next_seg link IDs - without range validation before indexing into kernel-allocated arrays, and the only integrity protection on this metadata is a CRC computed with a fixed, public seed that offers no adversarial resistance. No public exploit or active exploitation has been identified; EPSS is 0.20% at the 10th percentile, consistent with the constrained attack prerequisites.
Out-of-bounds memory reads in the Linux kernel dm-pcache device-mapper subsystem allow a CAP_SYS_ADMIN-privileged local attacker to disclose adjacent persistent memory contents to userspace and corrupt the cache replay tree, with potential for kernel panic. Two input-validation gaps exist: kset key_num is not bounded against PCACHE_KSET_KEYS_MAX before buffer iteration, and per-key intra-segment offset+length pairs are accepted verbatim, allowing crafted on-media cache device images to trigger OOB reads that surface into caller bio buffers. No public exploit exists and EPSS sits at 0.20% (10th percentile), consistent with the elevated privilege requirement gating this attack surface.
Use-after-free and invalid segment operations in the Linux kernel's dm-pcache subsystem allow a local low-privileged attacker to corrupt kernel memory, potentially achieving privilege escalation. The flaw exists in kset_replay() where cache_key_put(key) frees key memory, yet the subsequent code dereferences key->cache_pos.cache_seg - a classic UAF pattern in kernel mempool-managed memory. No public exploit code has been identified and EPSS is 0.20%, though the local CVSS 7.8 (C:H/I:H/A:H) vector reflects the severity of kernel-level memory corruption.
Use-after-free in the Renesas I3C driver allows a local attacker with low privileges to crash the kernel or potentially escalate privileges on systems equipped with Renesas I3C hardware. The flaw stems from a race between a timed-out transfer cleanup path, which frees the transfer struct, and a late-arriving interrupt whose handler dereferences that now-freed memory. No public exploit has been identified, and exploitation requires specific hardware, but the UAF primitive theoretically supports memory corruption beyond a simple crash.
Improper sysctl table placement in the Linux kernel allows a local low-privileged user to modify the global `cad_pid` setting - which controls which process receives the Ctrl-Alt-Delete console signal - by abusing unprivileged user and PID namespace creation. A non-root user can call `unshare(CLONE_NEWUSER|CLONE_NEWPID)` to gain apparent root privileges in a child namespace and then overwrite the globally-scoped `/proc/sys/kernel/cad_pid`, even though `kill_cad_pid()` operates exclusively in the root namespace. No public exploit is identified at time of analysis; EPSS stands at 0.20% (10th percentile), and no CISA KEV listing exists.
Ring buffer corruption in the Linux kernel tracing subsystem arises from an inverted retry-exhaustion test in `simple_ring_buffer_swap_reader_page()`. When a compare-and-swap link replacement succeeds on the eighth and final attempt, the existing `!retry` guard (which triggers at zero) incorrectly returns -EBUSY while leaving the link update complete but reader bookkeeping unfinished; when all eight attempts fail, retry reaches -1, `!retry` is false, and the function falls through to update head and reader pointers as though the swap succeeded, silently corrupting the ring buffer structure. The fix, landed in Linux 7.2.4 and 7.3-rc1, corrects the guard to treat only a negative counter as exhaustion and return the documented -EBUSY. No public exploit code exists and EPSS is 0.19%.
Missing DMA alignment validation in the Linux kernel block layer allows a local unprivileged user to submit misaligned I/O vectors that bypass per-device alignment checks during bio construction from iov_iter, potentially triggering memory corruption, data leakage, or kernel crashes. Bio-based drivers lack alignment-split checks and stacking block drivers may silently mis-handle misalignment detected only after bio submission, making the window for exploitation broader than a single driver path. No public exploit has been identified and EPSS places this at the 9th percentile, though the high-C/I/A CVSS score reflects genuine kernel memory-safety consequences.
Unlocked dereference of dev->desc in the Linux kernel's i3c subsystem exposes systems with i3c-capable hardware to potential use-after-free or null pointer dereference conditions when a local low-privileged user races device descriptor teardown against calls to i3c_device_get_supported_xfer_mode(). The function accesses dev->desc to resolve the master controller without holding the required bus->lock, meaning a concurrent device detachment can free or null that pointer mid-access, leading to kernel memory corruption with CVSS-assessed C:H/I:H/A:H impact. No public exploit code or active exploitation (KEV) has been identified at time of analysis; vendor-supplied patch commits are available for stable kernel branches.
Use-after-free in the Linux kernel CIFS client's cifs_file_set_size() allows a local low-privileged user to corrupt kernel heap memory when a handle-based set-size RPC fails during SMB session teardown or reconnection. The freed tcon pointer is reused in a path-based fallback because it is not NULLed after cifsFileInfo_put(), exposing slab memory that may have been reclaimed by the kernel allocator. Patches are confirmed in versions 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation has been identified at time of analysis.
Overlayfs in the Linux kernel exposes an unprivileged local DoS - and a theoretical privilege-escalation path - through a double `end_creating()` call in `ovl_create_real()` when a casefold consistency mismatch is detected during directory creation. The double call unlocks the parent directory's `i_rwsem` twice and calls `dput()` twice on the same dentry: the spurious unlock wedges every subsequent creation under that parent indefinitely, and the spurious `dput()` creates a reference-count imbalance that could underpin a use-after-free chain. The flaw is reachable without root in a user namespace on most modern Linux distributions. No public exploit has been identified at time of analysis and EPSS is 0.18%.
Stack buffer overflow in the Linux kernel's ACPI Platform Firmware Runtime Update (pfr_update) driver allows a local low-privileged attacker to corrupt kernel stack memory via oversized ACPI DSM buffer responses. The flaw exists in query_capability() where memcpy uses firmware-supplied buffer.length without bounds checking against fixed-size u8[16] destination fields in the stack-allocated struct pfru_update_cap_info, enabling writes up to 44 bytes past the end of the structure. KASAN confirmed exploitation on 7.2-rc6 producing three distinct stack-out-of-bounds reports; vendor-released patches are available in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit code exists and EPSS probability is low at 0.18%, but successful exploitation could yield arbitrary kernel code execution on affected systems.
Arbitrary kernel memory read/write in the Linux kernel's OpenRISC architecture syscall handler allows an unprivileged local process to overwrite kernel structures such as the sys_call_table and achieve kernel-context code execution. The `sys_or1k_atomic()` function (syscall 244 in the or1k ABI) performs a hand-written assembly atomic word swap between two user-supplied pointers without calling `access_ok()`, and its four memory-access instructions lack exception table entries - meaning any kernel address passed by a caller is directly dereferenced without fault isolation. Patches are confirmed in stable series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation is identified.
Use-after-free in the Linux kernel's Rust devres (device resource management) subsystem allows a local low-privileged attacker to cause kernel memory corruption or achieve privilege escalation. The race triggers when the driver core's devres_release_all() and Devres::drop() concurrently attempt to revoke the same Devres object - the losing revoker returns immediately while the winner's drop_in_place() is still executing, allowing adjacent resources such as DMA scatter-gather tables to be freed beneath active teardown. No public exploit code or CISA KEV listing exists; EPSS is 0.18%.
Memory corruption in the Linux kernel's mm/mempolicy subsystem allows a local unprivileged user to trigger a bogus folio pointer dereference, a VM_BUG_ON() panic, or silent LRU isolation of an unrelated live folio when an HMM-based GPU driver has migrated a transparent huge page (THP) to device memory. The flaw exists because queue_folios_pmd() does not guard against device-private PMDs before calling pmd_folio(), which misinterprets the device-private swap entry encoding as a hardware PFN. No public exploit has been identified at time of analysis, and EPSS is 0.18%, but the C:H/I:H/A:H CVSS impact rating reflects the potential severity if the precise conditions are met.
Stale swap-cache mapping in __migrate_device_pages() triggers invalid folio reference-count accounting in the Linux kernel mm/migrate_device subsystem, ultimately producing a BUG_ON kernel panic and potential memory corruption. The defect has two related components: the folio->mapping pointer is captured before folio_free_swap() executes, leaving a dangling reference to swap_space after swap-cache removal, and after a large folio is split the migration loop counter nr is not reset to 1, causing split order-0 folios to be processed with the original large-folio count. No public exploit code has been identified and EPSS is 0.18% (7th percentile), consistent with a local kernel-internals bug requiring a specific HMM/device-migration code path. Vendor-released patches are confirmed for stable trees targeting 7.2.4 and 7.3-rc1.
Out-of-bounds memory access in the Linux kernel's ntfs3 filesystem driver during log replay allows a local attacker who can mount a crafted NTFS image to corrupt kernel memory, potentially achieving privilege escalation. The root cause is that check_rstbl() validates DIR_PAGE_ENTRY table bookkeeping but never verifies that the trailing page_lcns[] array actually fits within the entry's declared size, so a crafted lcns_follow field drives a memmove and subsequent replay passes past the entry boundary. No public exploit or CISA KEV listing exists; EPSS is 0.18%, consistent with the local mount-gated attack surface shared by sibling ntfs3 CVEs (CVE-2026-89610 through CVE-2026-89614).