Uninitialized memory use in the Linux kernel MPTCP subsystem allows a remote off-path peer to corrupt MPTCP subflow path manager bookkeeping by influencing a stale slab byte. Since Linux 5.9, mptcp_token_join_cookie_init_state() restores six fields from the SYN cookie entry during MP_JOIN 4th-ACK processing but omits local_id; subflow_ulp_clone() then reads whatever byte the SLAB_TYPESAFE_BY_RCU allocator left behind - a value an off-path attacker can steer by racing concurrent MP_JOIN SYNs against the slab recycler. The result is an incorrect address-ID on the joined subflow, corrupting path manager bookkeeping and potentially causing subflow teardown or misdirection. No public exploit is identified at time of analysis; EPSS is 0.21% (11th percentile).
TRIM/discard is completely broken on 4Kn (4096-byte native sector) block devices in the Linux kernel's libata-scsi layer, causing every ATA DSM TRIM command to fail with 'Parameter list length error' and trigger WARN_ON() splats on each attempt. The bug is in ata_scsi_write_same_xlat(): ata_format_dsm_trim_descr() caps its output at 2048 bytes (ATA_SCSI_RBUF_SIZE), but the caller compares this return value against the logical sector size - on 4Kn devices (sector_size=4096), this equality check always fails and every TRIM is rejected. No public exploit exists; this is a deterministic functional regression on specific hardware. Vendor-released patches are available in stable kernels 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Out-of-bounds buffer read in the Linux kernel SMC-Rv2 LLC message handler allows a malicious remote SMC peer to corrupt rtoken state by triggering reads from stale shared receive-buffer data. Specifically, smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() process a crafted DELETE_RKEY_V2 or ADD_LINK v2 message declaring up to 255 rkeys, reading the overflow portion from whatever a prior message left in lgr->wr_rx_buf_v2, potentially deleting valid registered memory keys or installing spurious ones. No public exploit code exists and EPSS is 0.20% (10th percentile), but the impact within SMC-R-enabled datacenter environments is real - disrupted RDMA sessions and hard-to-diagnose memory-token corruption.
Linux kernel NFS server (NFSD) contains a spurious WARN_ON_ONCE in nfsd_mode_check() that fires when an authorized NFS client performs a LOOKUP on a re-exported NFS filesystem whose dentry legitimately lacks i_op->lookup (mountpoints, V4 referrals). On systems configured with panic_on_warn=1 - common in production-hardened Linux deployments - this constitutes a remotely triggerable kernel panic and full availability loss. The nfserr_notdir guard that prevents the downstream NULL pointer dereference in lookup_one_unlocked() → __lookup_slow() → inode->i_op->lookup() is preserved in the fix; without it, the same codepath would dereference a NULL method pointer. No public exploit is identified at time of analysis and EPSS is 0.17%.
Out-of-bounds read in the Linux kernel SMB client's reparse_buf_ptr() function allows a malicious or MITM-positioned SMB server to trigger a kernel-level OOB memory read by returning a crafted IOCTL response with OutputCount below 6 bytes. The function reads ReparseDataLength at byte offset 4-5 of struct reparse_data_buffer before verifying that count covers the full 8-byte fixed header, exposing unvalidated memory and potentially crashing the client kernel. No public exploit code exists and EPSS is 0.15%, consistent with the network-positioning requirement and absence of weaponized tooling.
Arbitrary file deletion in UsersWP ≤ 1.2.70 for WordPress allows authenticated Subscriber-level users to delete any file on the server - including wp-config.php - via a path traversal bypass in the upload_file_remove() AJAX handler. The exploit exploits a two-phase validation failure: validate_file() only rejects literal '../' sequences, but the uwp_get_file_relative_url() helper later performs a global str_replace() that collapses crafted embedded tokens into directory traversal sequences after the final validation gate, with the result passed directly to wp_delete_file() without canonical containment. No public exploit code or CISA KEV listing is confirmed at time of analysis; however, the low privilege requirement and precise Wordfence source-level write-up substantially reduce the research barrier for threat actors.
Silent kernel memory corruption in the Linux kernel SUNRPC subsystem arises when percpu counter allocation fails undetected during RPC service creation. When `percpu_counter_init()` fails inside `__svc_create()`, the function returns a half-initialized `svc_serv` structure to nfsd, lockd, or the NFS callback service without error; subsequent hot-path increments in `svc_xprt_enqueue()`, `svc_handle_xprt()`, and `svc_pool_wake_idle_thread()` dereference the NULL per-cpu pointer, which resolves to offset zero of the running CPU's per-cpu area and silently overwrites arbitrary kernel memory. Triggering the flaw requires local administrator access plus memory pressure at RPC service startup; the description explicitly excludes remote induction. No public exploit or CISA KEV listing exists, and EPSS sits at 0.22% (13th percentile).
Missing ingress-device validation in the Linux kernel's AF_IUCV HiperSockets receive path allows adjacent-network attackers on the same HiperSockets segment (VCHID) to deliver crafted ETH_P_AF_IUCV frames to sockets bound on different IQD devices, enabling accept-queue exhaustion, data injection into established connections, and attacker-controlled peer identity on newly accepted connections. A secondary local vector also exists: a process holding CAP_NET_RAW only within an unprivileged network namespace can send raw ETH_P_AF_IUCV frames over its loopback interface and have them matched against init_net sockets, bypassing namespace isolation. The fix - introduced in stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1 - adds a per-socket hs_dev check against the ingress netdev. No public exploit or CISA KEV listing is present at time of analysis.
Resource leak race condition in the Linux kernel NFS server (NFSD) filecache allows orphaned nfsd_file objects to accumulate when network-namespace shutdown races with the GC worker, shrinker, or fsnotify/lease callbacks. When nfsd_file_cache_shutdown_net() runs concurrently with any of these three paths, already-unhashed files queued to the per-net dispose list are missed by the shutdown drain, leaving both the file handle and associated NFS state permanently leaked. The vulnerability affects Linux 6.9 through pre-patch kernels and is DoS-leaning with no public exploit identified at time of analysis and an EPSS of 0.20%.
Use-after-free in the Linux kernel's svcrdma (NFS-over-RDMA server transport) arises from incorrect teardown ordering in svc_rdma_free(): rdma_destroy_id() frees sc_cm_id while the transport's sc_rn notification entry remains registered in the device's rd_xa xarray, leaving a dangling reference that a concurrent ib_unregister_device walk can dereference via svc_rdma_xprt_done(). Exploitation requires an NFS-over-RDMA server configuration with RDMA hardware and a race between transport teardown and device unregistration. No public exploit or CISA KEV listing exists; EPSS is 0.20%, consistent with a niche, timing-dependent kernel race.
Out-of-bounds read in the Linux kernel Bluetooth subsystem's eir_get_service_data() leaks kernel heap memory into userspace for ISO broadcast sink configurations. When an ISO broadcast sink processes periodic advertising (PA) reports from a remote Bluetooth broadcaster, a PA payload packed with multiple mismatching Service Data fields causes eir_len to undercount by 2 bytes per field iteration - the subtraction uses only the data length (dlen), omitting the 2-byte length+type header - so the pointer eventually reads past hcon->le_per_adv_data[] into the surrounding struct hci_conn; a drifted field matching the BAA UUID causes those bytes to be copied into iso_pi(sk)->base, recoverable by a local or remote-assisted userspace process via getsockopt(BT_ISO_BASE). No public exploit or CISA KEV listing exists; EPSS of 0.17% (6th percentile) reflects low opportunistic risk, though the Bluetooth adjacent-network constraint caps mass exploitation potential.
Integer underflow in the ath6kl WiFi driver's ath6kl_cfg80211_connect_event() allows an adjacent-network attacker controlling a rogue access point to trigger disclosure of kernel slab memory to userspace via nl80211. When a crafted association response shorter than 6 bytes (or request shorter than 4 bytes) is received from firmware, the u8 length fields wrap around to approximately 250, causing cfg80211_connect_result() or cfg80211_roamed() to copy ~250 bytes of adjacent slab data through netlink to any listening userspace process. Patches are available across all active stable branches; no public exploit exists at time of analysis.
Use-after-free in the Linux kernel NFS server (nfsd) file-cache disposal path allows concurrent kernel subsystem callbacks - the global memory shrinker, nfsd laundromat garbage collector, and fsnotify - to dereference a freed nfsd_fcache_disposal struct during per-network-namespace teardown, producing kernel heap corruption or a system panic. The vulnerable window opens when a network namespace hosting nfsd is destroyed while disposal callbacks remain in-flight; containerized NFS server deployments (Docker, Kubernetes) are the most realistic trigger scenario. No public exploit identified at time of analysis, with EPSS at 0.17% consistent with a race-condition-gated kernel bug.
Use-after-free and NULL pointer dereference in the Linux kernel's lockd/nfsd subsystem allow a race between nfsd module teardown and in-flight lockd dispatch to dereference freed module memory, causing kernel panic or potential slab corruption. Any Linux NFS server running both nfsd and lockd (NFSv2/NFSv3 file locking) from kernel 2.6.12 through pre-7.2.4 is affected when nfsd is dynamically unloaded during active NFS lock operations. No public exploit has been identified and EPSS is 0.15%, consistent with the race-condition prerequisite.
Privilege escalation in the Linux kernel CIFS/SMB client allows a local user with write access to a setuid or setgid binary on a CIFS mount to retain those elevated-execution bits on the server after a write operation that should have stripped them. The flaw exists in cifs_setattr_unix() and cifs_setattr_nounix(), which unconditionally dropped the ATTR_MODE flag when ATTR_KILL_SUID/ATTR_KILL_SGID was present, preventing the cleared mode from being propagated to the server when using cifsacl, modefromsid, SMB3.1.1 POSIX extensions, or SMB1 Unix extensions. An attacker who can write to a setuid binary on such a mount can subsequently execute it with unintended elevated privileges. No public exploit has been identified and EPSS is 0.21%, but vendor-confirmed patches are available in kernels 7.2.4, 6.18.51, and 7.3-rc1.
Stale debugfs function pointers in Linux kernel NFSD create a use-after-free condition when module initialization fails partway through. Specifically, nfsd_debugfs_init() registers debugfs files containing fops pointers into module text before nfsd4_init_slabs() succeeds; if slab allocation then fails, the module's text is freed but the debugfs entries remain live with now-dangling pointers. Any subsequent access to those orphaned debugfs files - for example by a local user browsing /sys/kernel/debug - can trigger a kernel-mode UAF, potentially crashing the system or enabling privilege escalation. No public exploit code exists and EPSS is 0.21%; patch commits are available for 6.18.50, 7.2.4, and 7.3-rc1.
Missing lock acquisition in the eCryptfs filesystem layer exposes the global message context list to concurrent modification during daemon teardown. In `ecryptfs_exorcise_daemon()`, queued message contexts are moved back to the free list without holding `ecryptfs_msg_ctx_lists_mux`, while `ecryptfs_msg_ctx_alloc_to_free()` and other list consumers require that lock - creating a race window for use-after-free or memory corruption reachable by a local user. No public exploit exists and EPSS is 0.21%, but C:H/I:H/A:H impact makes this a meaningful local privilege escalation candidate on systems using eCryptfs.
Use-after-free in the Linux kernel's RDMA/cxgb4 driver (Chelsio T4/T5/T6 RDMA support) allows a local low-privileged attacker to trigger kernel heap memory corruption by racing device removal against deferred RDMA device registration work. The driver's `c4iw_remove()` teardown path frees `ctx->dev` while a `reg_work` work item queued by `c4iw_uld_state_change()` may still be executing, leaving `c4iw_register_device()` operating on freed memory. No public exploit or active exploitation has been identified; vendor-released patches are available in stable kernel series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Ceph filesystem driver in the Linux kernel leaks an inode wrbuffer reference when writeback is aborted during umount, triggering a kernel BUG and system crash. The defect manifests specifically when ceph_submit_write() fails the osd_stopping_blocker check at unmount time: the wrbuffer claim taken by ceph_dirty_folio() is never released because writepages_finish() - the only release path - never runs for aborted, never-submitted writes. Because i_wrbuffer_ref never returns to zero, the corresponding ihold() is never dropped, the inode cannot be evicted, and the kernel panics with 'VFS: Busy inodes after unmount of ceph' at fs/super.c:650. No public exploit code exists and no active exploitation has been reported; EPSS probability is 0.21%.
Use-after-free in the Linux kernel's universal-pidff HID force-feedback driver allows a local attacker with low privileges to write into freed kernel memory by exploiting a missing cleanup path when force-feedback initialization fails after device start. When hid_pidff_init_with_quirks() returns an error, hid_hw_start() is never reversed, leaving the hidraw character device node alive and pointing to freed memory; with hdev->driver set to NULL, hid_device_remove() also skips hid_hw_stop(). Any subsequent open of the surviving /dev/hidrawX can trigger a UAF write via the transport spinlock callback, potentially escalating local privileges to root. No public exploit has been identified, but the detailed commit description supplies a ready trigger condition.
Use-after-free in the Linux kernel's at91_udc USB gadget driver allows a local low-privileged attacker to dereference freed kernel memory during driver teardown, potentially achieving kernel code execution. The vulnerability affects systems running AT91/SAM series Atmel ARM microcontrollers in polled-VBUS mode, where a self-restarting timer/work cycle is never cancelled before the devm-allocated udc structure is freed. No public exploit exists and no KEV listing has been issued, but the bug is reachable via a routine driver unbind without triggering any fault condition.
Dangling pointer use-after-free vulnerabilities in the Linux kernel USB gadget UVC (USB Video Class) driver allow a local attacker with low privileges to exploit freed memory in the uvc_function_bind() error path and uvc_function_unbind() teardown routine. The driver fails to NULL uvc->control_req after usb_ep_free_request() and uvc->control_buf after kfree(), leaving stale pointers that can be dereferenced in subsequent operations. No public exploit or active exploitation has been identified; EPSS sits at 0.20% (10th percentile), consistent with an unexploited kernel subsystem bug on niche hardware.
UAF in the Linux kernel's user_events tracing subsystem (present since kernel 6.4) allows a local unprivileged user to trigger a reference-count underflow during fork failure, freeing the parent process's user_event_mm slab object while the parent retains a stale pointer. Any subsequent user_events ioctl() call by the parent dereferences the freed memory, enabling a write primitive that can lead to local privilege escalation. No public exploit exists and EPSS is low at 0.20%; no KEV listing is present at time of analysis.
Use-after-free in the Linux kernel tracing subsystem allows a local unprivileged attacker with tracefs access to corrupt kernel memory, potentially achieving privilege escalation. The race exists between trace_pipe readers holding stale event pointers and concurrent writes to buffer_subbuf_size_kb, which triggers ring_buffer_subbuf_order_set() to free and replace all ring buffer sub-buffer pages - including reader pages - without coordinating with active readers. KASAN-confirmed reproduction via syzbot (syz-executor989/6002) demonstrates practical triggering. No public exploit or CISA KEV listing at time of analysis; EPSS of 0.20% at the 10th percentile reflects low current exploitation probability.
Use-after-free in the Linux kernel tracing subsystem allows a local attacker with tracefs write access to panic the kernel or corrupt memory by registering two hist triggers sharing the same name= parameter on different events, followed by a third trigger referencing a variable. The second trigger's hist_data is freed by hist_register_trigger() during named-data reuse detection, but its tr->hist_vars list entry is never removed; a subsequent find_var_file() call then dereferences the freed 2048-byte slab region. The bug is confirmed by an included KASAN trace showing the precise allocation and free sites, with a deterministic three-command reproduction sequence documented in the CVE description itself; no public exploit has been identified at time of analysis.
Use-after-free in the Linux kernel's RapidIO mport character device driver allows a local low-privileged user to trigger kernel memory corruption via the DMA request teardown path. The flaw exists in dma_req_free(), where the mutex protecting a mapping object is unlocked through a pointer that may have already been freed by kref_put() invoking the last-reference destructor. An attacker with access to the /dev/mport* character device interface can trigger this condition to achieve kernel privilege escalation. No public exploit code has been identified at time of analysis, and EPSS probability sits at 0.20%.
Double-free memory corruption in the Linux kernel V4L2 (Video for Linux 2) subsystem exists in the error-handling path of __video_register_device() after a prior patch introduced a put_device() call on device_register() failure. Because the V4L2 API contract requires callers to invoke video_device_release() - which kfree()s the video_device struct - on registration failure, the intermediate put_device() frees the struct first, causing a subsequent double-free. The fix reverts the erroneous commit (2a934fdb01db6458288fc9386d3d8ceba6dd551a), accepting a small memory leak in exchange for eliminating the double-free, given that device_register() failures are described as extremely rare in practice. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap out-of-bounds write in the Linux kernel vicodec virtual video codec driver's FWHT encoder allows a local low-privileged user to corrupt adjacent kernel heap memory, potentially enabling privilege escalation to root. The root cause is an undersized CAPTURE buffer: the encoder allocates output using a size multiplier of 3, but 4-component pixel formats whose planes all hit the FWHT_FRAME_UNENCODED verbatim-copy fallback require a multiplier of 4, producing a per-frame overflow of coded_w × coded_h bytes into adjacent slab memory. No public exploit has been identified at time of analysis; the EPSS score of 0.20% reflects the niche status of the vicodec driver in production deployments.
Slab-out-of-bounds memory corruption in the Linux kernel's nilfs2 log-structured filesystem allows a local low-privileged user to corrupt kernel slab memory by truncating a file whose block mapping collapses from B-tree to direct form. When this collapse occurs, an orphaned intermediate B-tree node block remains dirty in the kernel cache; the nilfs2 log writer subsequently misclassifies it as a direct-mapping data block and calls nilfs_direct_propagate() on it, causing a KASAN-detected out-of-bounds access that can lead to privilege escalation or kernel panic. No public exploit exists and EPSS is 0.20%, but the low-complexity local trigger limits the risk primarily to systems actively using nilfs2 mounts.
Use-after-free in the Linux kernel NFSD subsystem allows a local attacker with low privileges to read freed vmalloc memory or trigger kernel memory corruption via a race between the rpc_status netlink diagnostic interface and NFSv4 compound request teardown. The ops buffer (args->ops[]) is freed synchronously by vfree() in nfsd4_release_compoundargs() without waiting for an RCU grace period, while the rpc_status dumpit holds only an rcu_read_lock that protects the parent svc_rqst struct but not the separately vmalloc'd ops buffer. Vendor-released patches are available in stable series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV entry exists at time of analysis.
Two heap out-of-bounds writes in Linux kernel eCryptfs allow a local low-privileged user to corrupt kernel memory structures by supplying a crafted Tag 3 passphrase-encrypted session key packet with an oversized encrypted_key_size field. The vulnerability is exclusively triggered when AES-192 (cipher code 0x08) is used because that cipher sets crypt_stat->key_size=24 independently, permitting crypto_skcipher_setkey() to succeed while encrypted_key_size still exceeds the 64-byte ECRYPTFS_MAX_KEY_BYTES bound - overflowing into ecryptfs_auth_tok and corrupting root_iv, keysig_list, and mutexes in ecryptfs_crypt_stat. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.20% at the 10th percentile.
Resource management failure in the Linux kernel eCryptfs subsystem allows a local authenticated user to trigger a message context leak - and potentially exploit a stale pointer condition - by inducing send failures to the eCryptfs userspace daemon. The ecryptfs_send_message_locked() function moves a context from the free list to the allocated list before calling ecryptfs_send_miscdev(); on failure, it omits the rollback, leaving the context permanently stranded and the caller holding a dangling reference. Vendor-released patches are available across stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit or CISA KEV listing has been identified at time of analysis.
Incomplete error-path cleanup in the Linux kernel uvesafb framebuffer driver leaves a stale v86d connector callback registered when platform driver initialization fails, creating a potential use-after-free condition in kernel memory. All Linux kernel versions from 2.6.24 onward that include the uvesafb driver are affected; the issue was found through static analysis and is patched in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit exists; EPSS is 0.20% (10th percentile), reflecting the narrow and difficult-to-trigger conditions required.
Kernel crash exposure in the OMAP SSI/HSI driver stems from a missing DMA mask initialization on the synthetic HSI controller device allocated via hsi_alloc_controller(), which bypasses the normal OF/platform device setup path and leaves the embedded struct device without a valid dma_mask. Following DMA API hardening changes in the kernel, dma_map_sg() and related helpers enforce the presence of a valid mask before proceeding, causing warnings or kernel panics on any OMAP SoC system where the driver attempts DMA mapping. The vulnerability is tightly hardware-gated to Texas Instruments OMAP-based platforms; patches are confirmed available in kernel stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1, and no public exploit or KEV listing exists.
Use-after-free in the Linux kernel's auxdisplay charlcd driver allows a local, low-privileged attacker to potentially corrupt kernel memory when charlcd_register() fails after bl_work has already been scheduled. The root cause is that charlcd_init() schedules a delayed backlight work item referencing the charlcd object before misc_register() is called; if registration fails, the caller frees the object while the work item's reference remains valid, creating a classic UAF condition. No public exploit exists and EPSS is 0.20% (10th percentile), reflecting the niche hardware footprint and non-default kernel configuration required.
Out-of-bounds kernel memory read in the Linux device-mapper dm-array subsystem allows a local attacker to trigger an OOB read from a dm-bufio buffer by presenting crafted dm-cache metadata with an oversized on-disk nr_entries field, exploitable during dm-cache activation. The flaw exists because array_block_check() validated only block number and checksum while omitting structural field bounds - unlike the sibling node_check() function - leaving dm_array_cursor_next() to bound its iteration directly from the unvalidated on-disk header and element_at() to perform unguarded pointer arithmetic past the buffer end. Vendor-released patches are available for stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit code exists and EPSS is 0.20% at the 10th percentile.
Integer overflow in the Linux kernel's libnvdimm label-validation path allows a local low-privileged attacker with access to NVDIMM configuration commands (or crafted DIMM media) to trigger an out-of-bounds write in nd_label_data_init(). The on-media u32 field nslot, multiplied by sizeof_namespace_label() in 32-bit arithmetic introduced as a regression in Linux 4.13 (commit 564e871aa66f), wraps modulo 2^32 before the bounds check, causing a downstream memset() to overrun the config buffer. No public exploit code has been identified, and EPSS sits at 0.20% (10th percentile), reflecting realistic limited exposure given the niche hardware requirement.
Integer overflow in the Linux kernel's MD (software RAID) subsystem allows a local attacker who can supply or mount a crafted block device superblock to trigger an unchecked bit-shift overflow in super_1_load(), corrupting kernel memory and potentially escalating privileges. The flaw stems from sb->bblog_shift - an 8-bit on-disk value ranging 0-255 - being applied as a left-shift to a 64-bit sector variable without any upper-bound validation, allowing sector and count variables to wrap around and corrupt downstream badblocks API state. No public exploit code has been identified and EPSS sits at 0.20% (10th percentile), placing this in the low-probability-of-exploitation tier despite a CVSS score of 7.8.
Linux kernel ring-buffer subsystem exposes a race condition between subbuffer resize and page allocation/free operations, enabling local privilege escalation. When ring_buffer_subbuf_order_set() clears cpu_buffer->free_page without holding the cpu_buffer->lock, a concurrent ring_buffer_alloc_read_page() or ring_buffer_free_read_page() call can operate on a stale or freed page, producing kernel memory corruption. No public exploit code exists and EPSS is 0.20%, but the CVSS 7.8 C:H/I:H/A:H vector reflects full kernel-level impact potential once the race is won.
Use-after-free in the Linux kernel charger-manager power supply driver exposes local low-privileged users to kernel memory corruption and potential privilege escalation. The driver's probe path registers power_supply sysfs attributes before acquiring regulator handles, and its remove path frees regulator consumer handles before tearing down sysfs - creating two overlapping windows where a write to the externally_control attribute, or the remove path's own try_charger_enable() call, dereferences already-freed memory. No public exploit exists and EPSS is 0.20%, but the bug was discovered by static analysis rather than observed in-the-wild attacks, and patches are available in stable kernel trees 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Two compounding flaws in the Linux kernel's Intel Speed Select Technology (ISST) ioctl handler allow a local low-privileged user to trigger out-of-bounds memory access or NULL pointer dereference in kernel space. The `isst_if_clos_assoc()` function applies an off-by-one validator (`>` instead of `>=`) against the `sst_inst[]` array boundary, permitting socket_id equal to `topology_max_packages()` to index one entry past the allocated array; a second path omits a NULL check for valid in-range socket IDs whose package has no bound TPMI SST instance, both dereferences reaching `map_partition_power_domain_id()`. Patched kernel versions 6.12.109, 6.18.50, and 7.2.4 are available; no public exploit has been identified at time of analysis and EPSS (0.20%, 10th percentile) reflects very low observed exploitation activity.
Use-after-free memory corruption in the Linux kernel's VIA SDMMC host controller driver (mmc/via-sdmmc) can cause kernel instability and potentially enable local privilege escalation on systems equipped with VIA SD card controllers. During driver probe failure, the card-detect interrupt and pending work item (carddet_work) are not cleaned up, leaving the interrupt handler and work queue running against already-freed memory; via_sdc_isr() dereferences the freed sdhost structure while via_sdc_card_detect() performs a container_of() dereference against freed memory. No public exploit or active exploitation has been identified; the issue was discovered through in-house static analysis and manual code review.
Use-after-free in the Linux kernel's interconnect subsystem allows local low-privileged attackers to corrupt kernel heap memory, potentially enabling privilege escalation to root. The flaw resides in `icc_get()` and `of_icc_get_by_index()`: when `kasprintf()` fails to allocate memory for `path->name`, the error handler calls `kfree(path)` directly while the path's request structures are already linked into interconnect-node hash lists via `hlist_add_head()`, leaving dangling pointers that subsequent interconnect operations dereference. Patched kernel versions 6.12.109, 6.18.50, and 7.2.4 are available; no public exploit or CISA KEV listing exists at time of analysis.
Use-after-free race condition in the Linux kernel SLIP driver's sl_sync() function exposes systems running kernels from 2.6.32 onward to local privilege escalation. The slip_devs[] global array stores bare net_device pointers without reference counting; when sl_sync() races with slip_close() teardown, a pointer can be read and dereferenced after netdev_run_todo() has already freed the backing structure because the RTNL semaphore is intentionally dropped during teardown. No public exploit or CISA KEV listing exists at time of analysis; EPSS stands at 0.20%, and the bug was surfaced by syzkaller fuzzing on kernel 6.1.134.
Memory corruption in the Linux kernel TUN/TAP driver allows a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges to root. The flaw exists in tun_get_user(), where an oversized headroom alignment value - most realistically propagated from Open vSwitch to a TUN or TAP device - causes an integer underflow in SKB_MAX_HEAD(align), producing a negative good_linear value that wraps to a massive size_t, causing tun_alloc_skb() to position skb->data outside the allocated skb head. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Use-after-free in the Linux kernel's Open vSwitch (OVS) flow deletion path allows a local attacker with low privileges to crash the kernel or potentially escalate privileges. The bug exists in ovs_flow_cmd_del(): when a CMD_DEL netlink command removes a flow from the OVS table, flow->mask is scheduled for RCU-deferred free, but ovs_flow_cmd_fill_info() subsequently reads that pointer after the RCU grace period may have already freed it-a narrow but real race window confirmed by KASAN traces. Reported by Trend Micro's Zero Day Initiative as ZDI-CAN-32042; no public exploit or active exploitation is confirmed at time of analysis.
NULL and error pointer dereference in the Linux kernel's ravb (Renesas Ethernet AVB) driver allows a local attacker with low privileges to crash the kernel or potentially escalate privileges by querying PTP hardware clock state during an invalid lifecycle window. The flaw affects the ravb driver from Linux 4.2 onward, where priv->ptp.clock is either NULL before the first interface open or left holding an error pointer after a failed PTP clock registration. Fixes are confirmed across stable branches in kernels 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV listing exists.
Use-after-free in the Linux kernel's ravb (Renesas Ethernet AVB) PTP driver allows a local attacker with code execution to potentially escalate privileges or crash the system. The race condition between ravb_ptp_interrupt() and ravb_ptp_stop() permits the interrupt handler to invoke ptp_clock_event() on a clock pointer already freed by ptp_clock_unregister() during interface teardown. No public exploit has been identified at time of analysis, and EPSS is very low (0.20%, 10th percentile), consistent with a hardware-specific kernel bug affecting Renesas SoC deployments.
Use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem, introduced circa v4.18, allows a local low-privileged user to corrupt kernel memory with full read, write, and availability impact. The race condition arises because smc_rx_pipe_buf_release() tests sk_state before acquiring the socket lock, permitting a concurrent smc_conn_free() call to release conn->rmb_desc and walk conn->lgr between the test and the lock - both of which smc_rx_pipe_buf_release() then dereferences, triggering use-after-free. Vendor-released patches are available for stable branches 6.12.109, 7.2.4, and 6.18.50; EPSS at 0.20% (10th percentile) and no CISA KEV listing confirm no known active exploitation at time of analysis.
Use-after-free in the Linux kernel ALSA bcd2000 USB MIDI driver allows a local attacker with low privileges to corrupt kernel memory, potentially achieving privilege escalation or system crash. When a BCD2000 USB device is disconnected while a MIDI rawmidi substream remains open, bcd2000_midi_send() and bcd2000_input_complete() continue to read and write previously freed URB structures, as the pointers are not nulled after usb_free_urb(). KASAN confirmed the slab-use-after-free on Linux 7.2.0-rc5 (arm64), and patches have been released across all active stable branches. No public exploit or KEV listing exists; EPSS is 0.20%.