Integer underflow in the Linux kernel's eCryptfs filename-encryption parser allows a local attacker to trigger heap memory corruption by supplying a crafted tag 70 packet with a body shorter than the fixed metadata fields. The underflow causes ecryptfs_parse_tag_70_packet() to derive a wildly inflated encrypted-filename size, enabling out-of-bounds heap reads or writes with full confidentiality, integrity, and availability impact. No public exploit code exists and the CVSS score of 7.8 (AV:L) aligns with the local-only attack surface; vendor-confirmed patches are available across all supported stable branches.
Double-free vulnerability in the Linux kernel's IPv6 tunnel driver (ip6_tunnel) allows a local attacker with low privileges to corrupt kernel memory, potentially leading to privilege escalation or system crash. The flaw exists in ip6_tnl_xmit(), where skb_realloc_headroom() internally consumes the original socket buffer but error-handling paths in ip6_tnl_start_xmit() and IPv6 GRE callers subsequently attempt to free it again. No public exploit or active exploitation (CISA KEV) has been identified; EPSS stands at 0.18%.
Use-after-free in the Linux kernel's nouveau open-source NVIDIA GPU driver allows a local unprivileged user to corrupt kernel memory via a race between the GEM buffer object info ioctl and a concurrent GEM close operation. In the non-uvmm code path, the VMA (virtual memory area mapping) associated with a buffer object can be freed by the close path between the info ioctl's lookup and its subsequent dereference, creating a classic use-after-free condition with potential for kernel-level code execution or privilege escalation. No public exploit is identified at time of analysis; vendor-released patches are available across all active stable branches.
Buffer overflow in the Linux kernel's Intel Touch Host Controller QuickSPI HID driver allows a local user with hidraw device access to corrupt kernel memory using device-controlled content. The function `quickspi_get_report()` copies the full device-supplied response length into the caller's buffer without checking the caller-provided size bound, so a touch controller returning more bytes than allocated overflows the kernel buffer. No public exploit exists (EPSS 0.17%, no KEV), but the sibling intel-quicki2c driver already carried the correct fix, confirming the root cause is a missing bounds-check port.
Use-after-free in the Linux kernel's IPv4 and IPv6 multicast forwarding paths allows a local attacker to corrupt kernel memory by racing socket destruction against multicast skb forwarding. The flaw arises because `bpf_sk_assign()` and UDP early demux can associate a socket pointer (`skb->sk`) with a socket buffer without holding a counted reference; when `ip_mr_input()` or `ip6_mr_input()` forwards the original skb outside the RCU read section, a concurrently destroyed socket leaves `skb->sk` stale, and the eventual `sock_pfree()` call dereferences freed memory. No public exploit has been identified, and the EPSS score of 0.17% (7th percentile) confirms negligible observed exploitation activity at time of analysis.
Use-after-free race condition in the Linux kernel's mt76/mt7925 MediaTek Wi-Fi 7 driver allows a local attacker with low privileges to corrupt kernel memory or trigger execution of stale MCU commands. The driver's mlo_pm_work delayed work item lacks cancellation in teardown and suspend paths (reset recovery, PCIe unbind, PCIe/mac80211/USB suspend), creating a window where the work executes after vif/bss structures are freed or firmware becomes unavailable. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17% (7th percentile), consistent with a race-condition kernel driver flaw of limited public interest.
Use-after-free in the Linux kernel's staging Intel IPU7 media driver allows a local attacker to corrupt kernel memory and potentially escalate privileges. The `isys_probe()` error path registers the V4L2 async notifier but fails to unregister it on subsequent probe failures, leaving a dangling pointer in the global `notifier_list` after `devres` frees the enclosing `struct ipu7_isys`. Any subsequent walk of that list - an event driven by normal kernel media subsystem activity - reads freed memory, creating exploitable heap corruption. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS is 0.17% at the 7th percentile.
Heap buffer overflow in the Linux kernel's panasonic-laptop platform driver allows a local low-privileged user on affected Panasonic hardware to corrupt kernel heap memory, potentially escalating privileges. The flaw resides in acpi_pcc_retrieve_biosdata(), which writes a trailing sentinel one element past the end of the allocated pcc->sinf[] array when num_sifr equals hkey->package.count - a condition that arises specifically on Panasonic hardware where the BIOS SQTY field reports one fewer SINF entries than the actual package, triggering the driver's existing off-by-one workaround. Vendor-released patches are available in Linux 7.2.4 and 7.3-rc1; no public exploit code or active exploitation has been identified.
Task context confusion in the Linux kernel's io_uring waitid subsystem allows a local low-privileged attacker to trigger __do_wait() execution from a kworker thread rather than the originating task, causing child process lookups and signal structure access to operate against the wrong process namespace. Affected kernels span from the commit introducing the vulnerable io_waitid_cb() behavior through version 7.2.3; fixes are confirmed in 7.2.4 and 7.3-rc1. No public exploit code and no KEV listing exist at time of analysis; EPSS of 0.17% reflects minimal observed exploitation activity.
Use-after-free in the Linux kernel USB audio gadget driver (drivers/usb/gadget/function/u_audio.c) allows a local attacker or race condition to corrupt kernel memory when a USB audio gadget device is disconnected while userspace ALSA control file descriptors remain open. The root cause is that g_audio_cleanup() calls snd_card_free_when_closed() - which defers ALSA card teardown asynchronously - but immediately frees the underlying struct snd_uac_chip; kctl callbacks invoked when userspace closes those lingering FDs then dereference freed memory. No public exploit code exists and EPSS is 0.17%, but the kernel UAF class carries inherent privilege escalation potential on affected systems.
Incorrect REX prefix encoding in the Linux kernel's BPF x86-64 JIT compiler drops the high bit of extended destination registers (R8-R15) during per-CPU address resolution, causing GS-segment offsets to be applied to the wrong register. The affected registers alias as R5→RAX, R7→RBP, R8→RSI, R9→RDI, leaving actual per-CPU pointers unadjusted and clobbering scratch registers or the frame pointer, reliably producing kernel panics and theoretically enabling memory corruption. Vendor-released patches are available in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV listing exists and EPSS is 0.17%.
Out-of-bounds kernel memory write in Linux kernel BPF stack unwinding (`__bpf_get_stack`) exposes CONFIG_PREEMPT systems to local privilege escalation. On fully preemptible kernels, a non-sleepable BPF raw tracepoint program runs under `migrate_disable()` but not `preempt_disable()`, creating a scheduler preemption window between per-CPU callchain buffer release and consumer memcpy; a concurrent task can overwrite `trace->nr`, inflating `copy_len` past the caller's buffer boundary. The vulnerability affects Linux 4.18 through stable branches preceding 6.12.109/6.18.50/7.2.4/7.3-rc1; no public exploit exists and EPSS is 0.17%, but the C:H/I:H/A:H impact ratings reflect kernel memory corruption potential.
Out-of-bounds kernel memory access in the Linux kernel device-mapper (dm array) library allows a local attacker with crafted dm-cache metadata to trigger an 8-byte stride over 4-byte entries, computing element offsets up to 8160 bytes within a 4096-byte block. The root cause is that array_block_check() validates a block's internal self-consistency but never compares the stored value_size against the calling context's expected value_size; dm-cache's two persistent arrays (mappings at 8 bytes, hints at 4 bytes) share the same on-disk format, so a superblock pointing the mappings root at a hint block silently passes validation. Vendor-released patches are available; no public exploit exists and EPSS stands at 0.17%.
Incorrect hardware header length computation in the Linux kernel's ip6_gre driver creates a memory layout miscalculation in NBMA IPv6 GRE tunnel configurations, exploitable locally by a low-privileged user to corrupt kernel memory and potentially achieve privilege escalation. The function ip6gre_tnl_link_config_route() incorrectly accumulates the lower device's hardware header length into dev->hard_header_len when header_ops is set, affecting both NBMA ip6gre tunnels and ip6gretap/ip6erspan devices across a wide range of kernel versions from 4.19 onward. No public exploit code or active CISA KEV exploitation has been identified; EPSS probability is 0.17% (6th percentile), reflecting low current exploitation interest.
Use-after-free in the Linux kernel SUNRPC cache management subsystem allows a local low-privileged user to potentially achieve kernel code execution or crash the system. The bug exists in `sunrpc_destroy_cache_detail()`, which skips `cancel_delayed_work_sync()` when `cache_list` is non-empty - a condition that is permanently true during per-netns teardown - leaving `cache_clean()` with a dangling pointer to the already-freed `cache_detail` structure. No public exploit has been identified and EPSS probability sits at 0.17%, indicating no current active exploitation.
Linux kernel SUNRPC subsystem exposes a race condition between proc entry publication and mutex initialization in the GSS proxy path, allowing a local attacker with write access to /proc/net/rpc/use-gss-proxy to exploit an uninitialized mutex during the narrow window when auth_rpcgss loads. On a production kernel without debug options, two concurrent writers racing through set_gssp_clnt() can shut down an RPC client structure while it is still in active use, resulting in a resource leak and potential use-after-free with full kernel memory integrity and availability impact. Vendor-released patches are available across stable branches; no public exploit or KEV listing exists at time of analysis.
Use-after-free race condition in the Linux kernel RDMA/ucma subsystem allows a local attacker with access to the userspace connection manager interface to corrupt kernel memory and achieve privilege escalation. The flaw exists in ucma_set_ib_path(), which invokes ucma_event_handler() without holding the handler lock that serializes access to ctx->file; a concurrent ucma_migrate_id() call can swap ctx->file between reads inside the handler, causing an event to be enqueued on file B's list while only file A's mutex is held - a condition confirmed by a KASAN slab-use-after-free trace in the upstream commit. Patches are available for all actively supported stable kernel branches (6.12.109, 6.18.50, 7.2.4, 7.3-rc1); no public exploit or active exploitation has been identified.
Heap buffer overflow in the Linux kernel orangefs client debug-mask parser allows a local low-privileged attacker to corrupt kernel heap memory and potentially escalate privileges. The flaw originates in `orangefs_prepare_cdm_array()`, where buffer sizing via `strcspn()` and subsequent parsing via `sscanf %s` diverge in how they handle leading whitespace - a crafted debug mask entry prefixed with a space causes an undersized allocation that `sscanf` then overwrites. Vendor-released patches are available across all active stable branches (6.12.109, 6.18.50, 7.2.4, 7.3-rc1); no public exploit or active exploitation is identified.
OpenVSwitch packet forwarding in the Linux kernel exposes a page-cache write primitive ("Fragnesia") when MSG_ZEROCOPY packets are processed through the userspace upcall error path. When `queue_userspace_packet()` fails and calls `skb_tx_error()` on a still-live, still-forwarded skb, it strips `SKBFL_SHARED_FRAG` via `skb_zcopy_clear()`. A subsequent local ESP-in-UDP delivery then invokes `esp_input()` without `skb_cow_data()` copy-on-write protection, causing in-place AEAD decryption over page-cache pages the low-privileged sender does not own. Patches are available for stable series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or KEV listing exists at time of analysis.
Use-after-free in the Linux kernel SMC (Shared Memory Communications) subsystem allows a low-privileged local attacker to trigger a race condition during connection teardown, resulting in memory corruption with potential for privilege escalation. The flaw exists in smc_conn_free() and smc_lgr_terminate_sched(): when a link group is unlinked before connection cleanup completes, the device can re-arm the receive tasklet after tasklet_kill() returns, causing the tasklet to dereference an already-freed send buffer on the DMB-nocopy path. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17%.
Integer overflow in the Linux kernel IP tunnel subsystem allows a local low-privilege attacker to stack user-created tunnel devices until the cumulative advertised `needed_headroom` exceeds the 16-bit skb header offset capacity. When IP output subsequently reserves that headroom, the offset arithmetic wraps around, producing a kernel memory corruption condition with potential for local privilege escalation to root. No public exploit has been identified at time of analysis, and EPSS reports a 0.17% exploitation probability; patches are available across multiple stable kernel branches.
Shared zerocopy state corruption in the Linux kernel networking stack allows a local low-privileged attacker - via Open vSwitch - to cause kernel memory corruption leading to privilege escalation. When skb_tx_error() is called on a cloned socket buffer (skb), it unconditionally clears shared zerocopy flags in skb_shinfo(), which all clones reference. In OVS deployments using non-last OVS_ACTION_ATTR_RECIRC, a flow miss on the clone strips the SKBFL_SHARED_FRAG marker from the still-in-flight original, and subsequent local ESP/IPsec delivery decrypts in-place over memory pages it does not privately own. No public exploit has been identified at time of analysis; EPSS is 0.17%.
Stack information disclosure and use-after-free in the Linux kernel i3c master driver allow a local, low-privileged user to leak kernel stack contents through the sysfs modalias interface during device unregistration. The defect exists from kernel 5.0 onward through 6.12.108, 6.18.49, and 7.2.3: i3cdev->dev->desc is zeroed before device_unregister() completes, so racing calls to i3c_device_uevent() and modalias_show() read a NULL descriptor and fall back to an uninitialized stack struct i3c_device_info, exposing raw kernel stack bytes in the generated uevent string. No public exploit code has been identified at time of analysis; patches are available in stable releases 6.12.109, 6.18.50, 7.2.4, and the 7.3-rc1 mainline tree.
Stack corruption in the Linux kernel mwifiex WiFi driver allows a local low-privileged user to corrupt kernel stack memory and trigger a kernel panic, with potential for arbitrary code execution in kernel context. The driver's synchronous firmware command path stores caller-provided stack-allocated buffers in cmd_node->data_buf; when wait_event_interruptible_timeout() is interrupted, the caller returns and reclaims its stack frame while the in-flight command node retains a stale pointer - a late firmware VERSION_EXT response then writes firmware string data through that freed stack address. The issue is confirmed reproducible on i.MX8MP/88W8997 hardware via documented kernel panics, with no public exploit code identified at time of analysis (EPSS 0.17%).
Out-of-bounds kernel heap write in the Linux kernel's DS28E17 1-Wire-to-I2C bridge driver allows a local attacker controlling a malicious I2C slave device to write up to 222 bytes past a 34-byte kernel buffer. The driver's w1_f19_i2c_read() unconditionally trusts a device-supplied length byte (0-255) on I2C_M_RECV_LEN transactions, but the caller buffer is only I2C_SMBUS_BLOCK_MAX + 2 bytes; the SMBus core's own BLOCK_MAX check runs only after the overwrite has already occurred. No public exploit has been identified at time of analysis; EPSS sits at 0.17%, reflecting the niche hardware prerequisite.
Use-after-free in the Linux kernel's Smack LSM `smack_file_send_sigiotask()` function allows a local attacker with low privileges to trigger kernel memory corruption by racing credential pointer changes on a non-current task. The function incorrectly accessed both `tsk->cred` (subjective credentials, unprotected) and `__task_cred(tsk)` (objective credentials) on the same task; because a task may change its own `->cred` pointer at any time without synchronization, the first access can race with a credential transition, yielding a freed `struct cred` deref. The author confirmed KASAN-reported UAF reproduction and verified the fix. No public exploit exists and EPSS is low at 0.17%, but the CVSS-assessed local impact (C:H/I:H/A:H) reflects the potential for privilege escalation on affected kernels.
Use-after-free in the Linux kernel fanotify subsystem (introduced in 6.14) copies stale kernel stack memory to userspace and may enable local privilege escalation on unpatched 6.18.x and 7.x kernels. When a signal interrupts the triggering task precisely after the event reader sets FAN_EVENT_REPORTED but before it finishes preparing the file descriptor, fanotify_get_response() unwinds the stack-allocated file_range frame while the reader retains a dangling pointer to range.pos; the subsequent copy_range_info_to_user() dereferences freed stack memory, confirmed by KASAN. No public exploit code exists and EPSS is very low (0.17%), but vendor patches are available in 6.18.50, 7.2.4, and 7.3-rc1.
NULL pointer dereference and use-after-free conditions in the Linux kernel's CXL (Compute Express Link) MCE notifier path allow a local attacker with low privileges to corrupt kernel memory or achieve privilege escalation on systems with CXL memory hardware and extended linear cache enabled. The notifier was incorrectly anchored to the memory device lifetime (`cxl_memdev_state`) rather than to the region lifetime (`cxl_region`), meaning the MCE interrupt handler could fire against freed or nulled objects during device or region teardown. No public exploit has been identified and EPSS sits at 0.17%, consistent with the niche hardware dependency. Vendor-released patches are available in Linux 6.18.51, 7.2.4, and 7.3-rc1.
A race condition in the Linux kernel's RDMA/ucma subsystem allows an unprivileged local user to corrupt kernel data structures and deadlock a mutex by racing ucma_write_cm_event() against ucma_migrate_id(). The device /dev/infiniband/rdma_cm carries world-readable/writable permissions (0666), and the kernel description explicitly states no physical RDMA hardware is required to reach the vulnerable code path, making this accessible to any local user on an affected system. The race causes ctx->file to be swapped mid-sequence across four dereferences - resulting in a kernel BUG at lib/list_debug.c, a permanently held mutex wedging subsequent writers in uninterruptible D-state, and a stranded uevent that outlives its owning context. No public exploit has been identified at time of analysis.
Use-after-free in the Linux kernel's OpenVSwitch connection tracking (CT) limit subsystem allows a low-privileged local user with access to user and network namespaces to trigger a slab-use-after-free in ovs_ct_execute() during network namespace teardown. The race condition arises because the CT limit pointer was freed under ovs_mutex without first removing it from RCU-protected packet processing paths or waiting for a grace period, enabling concurrent packet processing threads to dereference already-freed memory. No public exploit or CISA KEV listing exists; EPSS is 0.17%, reflecting low observed exploitation activity at the time of analysis.
Use-after-free in the Linux kernel IPMI message handler allows a local low-privileged user to corrupt kernel memory by racing `_ipmi_destroy_user()` against concurrent RCU readers in `find_cmd_rcvr()` and `handle_ipmb_get_msg_cmd()`. A regression introduced by commit 9e91f8a6c868 removed the `synchronize_rcu()` grace period that previously ensured no readers held live pointers to `cmd_rcvr` structures before `kfree()` was called, while the `cmd_rcvrs` list continues to be walked under plain RCU. No public exploit code has been identified at time of analysis; patched stable kernel versions are available.
Use-after-free in the Linux kernel's via-sdmmc MMC host controller driver allows a local attacker to corrupt kernel memory during device removal. The driver's remove path (`via_sd_remove()`) frees the host structure while a previously-queued `carddet_work` work item can still dereference that freed memory via `container_of()` and MMIO base pointer access, creating a race-window that leads to memory corruption with C:H/I:H/A:H impact. No public exploit exists and EPSS sits at 0.17%, but the VIA chipset attack surface is real on older embedded and budget hardware still running affected kernels.
Use-after-free in the Linux kernel IPMI subsystem exposes freed kernel memory through a stale sysfs attribute left behind after a failed SMI registration. When ipmi_add_smi() encounters an error creating the maintenance_mode sysfs file, the nr_msgs attribute is not removed before the smi_info interface structure is freed, leaving a dangling sysfs entry backed by released memory. A local attacker with low privileges who can reach this error condition and then access the stale attribute may achieve arbitrary kernel memory read/write, creating a potential privilege escalation path to root. No public exploit exists and no active exploitation has been confirmed.
Out-of-bounds memory access in the Linux kernel's dm-pcache (device-mapper persistent cache) subsystem allows a local privileged attacker to read past segment data boundaries. The `cache_pos_decode()` function loads `key_tail` and `dirty_tail` segment offsets (`seg_off`) directly from the cache device without validating them against the segment's `data_size`, so a crafted cache device with an oversized `seg_off` causes the kernel to address memory beyond the segment buffer. Exploitation requires CAP_SYS_ADMIN to supply the device. No public exploit or CISA KEV listing exists; EPSS is low at 0.17%.
The mt7925 WiFi driver (mt76 subsystem) in the Linux kernel fails to cancel a deferred work item on the device stop path, creating a 5-second race window during multi-link operation (MLO) power-save setup. If the mt7925 PCIe or USB device is torn down within that window, the surviving timer fires against a workqueue that has already been destroyed, triggering a kernel WARNING and potential crash. No public exploit has been identified; EPSS is 0.17% (6th percentile), and the bug requires local access to hardware running an affected kernel with MLO power-save active.
Out-of-bounds memory read in the Linux kernel mt76/mt7996 Wi-Fi driver allows a local attacker with ability to supply a truncated EEPROM firmware file to trigger kernel memory disclosure or crash during driver initialization. The driver unconditionally copies and validates the default EEPROM firmware without first checking its length against the expected MT7996_EEPROM_SIZE constant, so a file shorter than that threshold causes reads past the end of the allocated firmware buffer. No public exploit has been identified at time of analysis; EPSS sits at 0.17% (6th percentile), reflecting the hardware-gated, local-access constraint.
A lockless read race in the Linux kernel's ftrace ring-buffer subsystem allows a local attacker to corrupt kernel memory by concurrently triggering a subbuf resize while a reader accesses stale size metadata. Affected versions span from the commit introducing dynamic subbuf resizing (~Linux 6.8) through current stable branches. The CVSS vector rates confidentiality, integrity, and availability all high, reflecting that a successful race can yield kernel memory corruption; no public exploit or CISA KEV listing exists, and EPSS sits at a low 0.16%.
AppArmor's begin_current_label_crit_section() in the Linux kernel contains a use-after-free of struct cred that can be triggered on systems with active AppArmor profiles when those profiles are updated or disabled mid-syscall. The flaw arises from synchronous credential replacement inside LSM hooks: the override_creds() guard in aa_replace_current_label() fails to detect when overridden and objective credentials are the same object, causing two reference drops that free the struct cred while task_struct still holds a pointer to it. No public exploit or CISA KEV listing exists; EPSS is 0.16% at the 5th percentile, consistent with low immediate exploitation probability despite a theoretically high UAF impact.
Out-of-bounds write in the Linux kernel AppArmor LSM label parser allows any local user on an AppArmor-loaded system to corrupt kernel heap or stack memory by writing a crafted multi-component label string to /proc/self/attr/apparmor/current or to the world-writable (mode 0666) securityfs .access file, the latter path applying no privilege check whatsoever. The bug is a deterministic off-by-one: aa_vec_unique() writes a NULL terminator at vec[n] when no duplicates are found, but vec_setup() and DEFINE_VEC() allocate only n slots, so the write lands one entry past the end of either the local stack array or the kzalloc'd buffer. No public exploit has been identified at time of analysis; vendor-released patches are available in stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Page-list corruption in the Linux kernel ring-buffer subsystem allows a local low-privileged attacker to trigger undefined memory behavior by exploiting improper handling of a failed remote reader page swap. When the tracing ring-buffer's `swap_reader_page` callback returns `-EBUSY` - which occurs during an event storm on a small buffer - `__rb_get_reader_page_from_remote()` incorrectly proceeds as though the swap succeeded, splicing the same physical page as both the previous and new reader entry simultaneously. This corrupted page-list state can result in confidentiality loss from stale kernel memory reads, integrity violations from writes to a doubly-referenced page, or kernel panic. No public exploit or active KEV listing exists; EPSS is 0.15%, consistent with a low-likelihood local kernel race condition.
Use-after-free in the Linux kernel MCTP subsystem allows an unprivileged local user to corrupt kernel memory by racing mctp_route_lookup() against concurrent device teardown. The function accesses rt->dev without holding a reference, so mctp_dev_put() can kfree() mdev->addrs while mctp_saddr() is still reading rt->dev->addrs[0] - confirmed by a KASAN slab-use-after-free trace. No CAP_NET_RAW is required; any user who can open an AF_MCTP socket can reach this path, making it a low-barrier local privilege escalation candidate. No public exploit is identified at time of analysis, though the vulnerability reintroduces the CVE-2023-3439 use-after-free class and carries CVSS C:H/I:H/A:H.
Use-after-free in the Linux kernel's KEYS trusted TPM subsystem permits concurrent kernel threads to dereference freed memory during module teardown. trusted_tpm_exit() incorrectly releases the TPM chip reference and frees the digest array before calling unregister_key_type(), which is the actual synchronization barrier that drains in-flight key operations. A local attacker with key-creation privileges racing a module unload can trigger a KASAN-confirmed slab-use-after-free in tpm_pcr_extend(), potentially yielding kernel memory corruption with high confidentiality, integrity, and availability impact. No public exploit exists and EPSS sits at 0.15%, indicating no widespread exploitation activity at time of analysis.
Stale walk->action state in the Linux kernel mm/pagewalk subsystem causes walk_pud_range() to spuriously retry PUD traversal and invoke page-walk callbacks twice, resulting in a slab-out-of-bounds write reachable by unprivileged local users via the mincore(2) syscall. Affected kernels in the 6.18.21-6.18.49 and 7.0-7.2.3 ranges contain the latent logic error activated by commit 3b89863c3fa4; the bug was confirmed by KASAN output and a local fuzzer producing an OOB write into a sigqueue slab object. No public exploit is available and no active exploitation has been identified; vendor-released patches are available in 6.18.50, 7.2.4, and 7.3-rc1.
Memory corruption in the Linux kernel's swap/hibernation subsystem can produce silent data corruption and crashes in unrelated userspace processes during hibernation image preparation. swap_free_hibernation_slot() unconditionally calls __swap_cluster_free_entries() without checking whether a folio already occupies the slot in the swap cache - a state reachable when cluster readahead speculatively faults in pages over the hibernation window. The freed slot is returned to the allocator while its folio retains the stale swap offset in folio->swap; when page reclaim subsequently flushes that folio using the stale offset, it silently overwrites a swap table entry now belonging to a different process, corrupting arbitrary in-flight userspace data. No public exploit has been identified at time of analysis.
OS command injection in TUBITAK BILGEM's Pardus Boot Repair allows a local low-privileged user to execute arbitrary OS commands, likely resulting in full system compromise. The vulnerability (CWE-78) affects all versions prior to 1.0.8 of this boot repair utility for the Pardus Linux distribution. Given that boot repair tools typically run with elevated (root) privileges, this flaw effectively enables local privilege escalation to full system control with high confidentiality, integrity, and availability impact.
Local privilege escalation in Pardus-software (the software center for TUBITAK BILGEM's Pardus Linux distribution) allows a low-privileged local user to gain full system control. The flaw stems from incorrect privilege assignment (CWE-266), where the application grants elevated permissions to processes or objects that should operate with restricted rights, enabling an authenticated local user to escalate to root or equivalent. Versions before 1.0.5 are affected; no public exploit or active exploitation has been identified at time of analysis.
Cross-namespace secret disclosure in Red Hat Advanced Cluster Management for Kubernetes allows a managed-cluster agent holding low privileges to craft configuration references that point to hub Secrets outside its authorized namespace, delivering those Secrets to an attacker-controlled managed cluster. The vulnerability resides in the multicluster-observability-addon component, which previously processed ManagedClusterAddOn.status.configReferences and fetched referenced objects before enforcing any namespace boundary, allowing cross-cluster credential theft from the hub. The upstream fix (PR #644) introduces ValidateConfigNamespaces() to reject out-of-scope references before manifest generation; no public exploit has been identified at time of analysis.
Out-of-bounds kernel read in Linux UBIFS's superblock signature verifier allows mounting a crafted NAND filesystem image to disclose kernel memory or crash the system. Linux kernels from v5.3 with UBIFS authentication support compiled in are affected - the flaw is exercised before any cryptographic check occurs, so no valid signing key is required. No public exploit has been identified at time of analysis and EPSS stands at 0.20%, but the C:H/A:H impact is real on embedded or desktop Linux deployments using UBIFS.
Uninitialized physical address use in the AMD PMC driver (`amd_stb_s2d_init()`) causes the Linux kernel to call `devm_ioremap()` with physical address zero when the SMU rejects a command with error 0xff, mapping the first 16 MB of physical RAM into kernel virtual address space. Affected systems are AMD-based Linux hosts where the System Management Unit returns an error during S2D (System Trace Buffer) initialization at driver probe time. No public exploit exists and EPSS is 0.20%, consistent with the hardware-gated trigger; fixes are available in Linux 6.18.50 and 7.2.4 stable branches.
Out-of-bounds kernel heap read in the Linux kernel's Nitro Secure Module (NSM) virtio driver allows a malicious or buggy NSM backend to disclose adjacent kernel heap memory to user space. The driver stores the used-ring response length reported by the backend device without clamping it to the actual response buffer size; parse_resp_raw() then copies that unclamped length of bytes to user space, leaking heap contents to the calling process. No public exploit has been identified at time of analysis; patches are available in stable kernel releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.