Use-after-free in the rtl8xxxu WiFi driver allows a local authenticated attacker to corrupt kernel memory during device teardown. The flaw exists in two races within the rx_urb_wq work queue shutdown path: schedule_work() is called outside the shutdown lock, and the worker can submit URBs after usb_kill_anchored_urbs() has returned, both permitting the worker to dereference the freed priv structure after ieee80211_free_hw() releases it. Exploitation requires specific hardware (Realtek RTL8XXXU USB WiFi adapter), active RX traffic, and a concurrent disconnect event. No public exploit exists; this was discovered by static analysis with an EPSS of 0.20%.
Local privilege escalation in the Linux kernel BPF bloom filter implementation (bloom_map_alloc) affects 32-bit x86 kernels via two compounding integer arithmetic bugs: a BITS_TO_BYTES(U32_MAX) wrap at allocation time causes under-allocation of the bitset, and a u32-to-signed-long sign-extension in set_bit/test_bit causes negative bit offsets, enabling out-of-bounds kernel heap reads and writes. Exploitation requires a process holding CAP_BPF on a 32-bit x86 kernel; 64-bit kernels are entirely unaffected. No public exploit identified at time of analysis; EPSS at 0.20% reflects the narrow attack surface imposed by the 32-bit-only constraint.
Use-after-free in the Linux kernel NFSD localio code path allows a local user to dereference recycled slab memory by exploiting a missing RCU read-lock window in `nfsd_open_local_fh()`. The `again:` retry block performs a `cmpxchg` on an `nfsd_file` pointer and then calls `nfsd_file_get()` (refcount_inc_not_zero) without holding `rcu_read_lock`, while the sole caller drops the lock before the helper runs - leaving a race window where CPU1 can put the last reference, trigger `call_rcu`, and have the slab page recycled before CPU0 increments the refcount. Vendor-released patches are available for the 6.15, 6.18, 7.2, and 7.3-rc1 stable trees; no public exploit exists and EPSS is 0.20%.
Write use-after-free in the Linux kernel HID mcp2221 driver allows a local low-privileged user to corrupt kernel memory via a dangling pointer left in the driver's rxbuf field after an I2C/SMBus read transfer ends. The mcp_i2c_smbus_read() function stores the caller-supplied buffer pointer in mcp->rxbuf for the transfer's lifetime but fails to clear it on any return path; a delayed or spurious MCP2221_I2C_GET_DATA USB HID report arriving after the caller frees or reuses the buffer causes mcp2221_raw_event() to memcpy device-controlled data into freed kernel memory. No public exploit has been identified and EPSS is 0.20%, but the kernel write primitive makes this a realistic local privilege escalation path on any system with an MCP2221 USB device attached.
Heap buffer overflow in the Linux kernel's Intel THC HID QuickSPI driver allows a local low-privileged user to corrupt kernel memory via the hidraw interface. The driver's write_cmd_to_txdma() function performs an unbounded memcpy from a caller-supplied HID report into a device-descriptor-derived heap buffer of only a few hundred bytes, while the HID core permits reports up to 16,384 bytes through SET_REPORT/SET_FEATURE ioctls - a size mismatch that lets an attacker overflow the buffer with attacker-controlled length and content, enabling potential local privilege escalation to root. Vendor-released patches are available in Linux 7.2.4, 7.3-rc1, and 6.18.50; no public exploit or active exploitation has been identified at time of analysis.
Heap out-of-bounds write in the Linux kernel erofs compressed filesystem driver corrupts kernel memory when a global buffer pool resize fails mid-way and is retried. During the retry, a temporary pointer array is allocated to the (smaller) intermediate target size, then populated with all existing pointers from a larger-than-expected buffer - writing past the end of the allocation. A separate retry path also triggers spurious -ENOMEM from alloc_pages_bulk() when no new pages are needed. No active exploitation is recorded (not in CISA KEV), and EPSS is 0.20% at the 10th percentile. Vendor-released patches are available in Linux 6.18.51, 7.2.4, and 7.3-rc1.
Use-after-free in the Linux kernel's SUNRPC server thread cleanup allows local attackers to trigger kernel heap reads of freed memory when RCU readers race with svc_exit_thread(). The root cause is an asymmetry in svc_rqst_free(): the rqstp struct is correctly deferred via kfree_rcu(), but rq_argp and rq_resp are freed synchronously before the RCU grace period expires - leaving a window where readers like nfsd_nl_rpc_status_get_dumpit() can dereference the freed pointers. No public exploit or KEV listing exists; EPSS is low at 0.20% (10th percentile), but the kernel UAF primitive carries realistic privilege-escalation potential in environments running NFS servers.
Lock confusion in the Linux kernel's core scheduling subsystem (sched/core) exposes systems with SMT/hyperthreading and CONFIG_SCHED_CORE enabled to a local privilege escalation path from a low-privileged user. During pick_next_task() under the shared core-wide lock, a ->pick_task() implementation that momentarily drops the per-rq lock creates a window where __sched_core_flip(false) can complete and rebind rq_lockp(), causing the scheduler to operate on sibling run-queue state without holding the correct locks - __schedule() then releases a lock it never acquired while leaking the one it holds. No public exploit code exists and EPSS is 0.20%, but vendor-released patches are confirmed in Linux 6.18.51, 7.2.4, and 7.3-rc1.
Memory order mismatch in the Linux kernel ring-buffer subsystem exposes a race condition between ring_buffer_alloc_read_page() and ring_buffer_subbuf_order_set() that can corrupt the bpage->order metadata field relative to actual allocated memory size. When subbuf_order changes mid-allocation, subsequent operations using bpage->order to calculate buffer boundaries may read or write outside the allocated slab region, enabling a low-privileged local attacker with access to tracefs/debugfs interfaces to potentially disclose kernel memory contents or destabilize the kernel. No public exploit code exists and EPSS is low at 0.20%, indicating limited exploitation interest despite the fix being available in stable kernel releases.
Memory management order mismatch in the Linux kernel ring-buffer tracing subsystem allows a local low-privileged user to corrupt kernel memory or crash the system by triggering a ring buffer resize concurrently with cached reader page discard. The root cause is that cpu_buffer::free_page stores only a page address without preserving the allocation order; after a resize changes cpu_buffer->subbuf_order, free_pages() is invoked with the new order rather than the original, corrupting the buddy allocator's state. Vendor-released patches exist in Linux 6.18.51, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV listing exists, and EPSS stands at 0.20%.
Incomplete error-path cleanup in the AMD PMC driver (`platform/x86/amd/pmc`) corrupts the kernel's global LPS0 s2idle linked list when `amd_stb_s2d_init()` fails during module probe, leaving a dangling registered handler whose backing `devm`-managed memory has been freed. On AMD-based x86 Linux systems running an affected kernel, this causes a kernel BUG (`list_add corruption`) upon module reload and a use-after-free condition on any subsequent suspend-to-idle (s2idle) transition. No public exploit exists and EPSS is 0.20% (10th percentile), but the failure condition can arise naturally on long-running systems or specific SMU firmware, making this a realistic local denial-of-service and a potential kernel code-execution path on vulnerable AMD hardware.
Stack memory corruption in the Linux kernel's qnap-mcu MFD driver allows a local low-privileged user on QNAP hardware to corrupt kernel stack memory, potentially enabling privilege escalation. The driver's qnap_mcu_exec() publishes an on-stack receive buffer to the serdev receive path, which runs asynchronously; when a command times out and the function returns, reply->data still points at the deallocated stack frame. A late MCU reply or unsolicited MCU message then overwrites whatever occupies that stack memory next, yielding C:H/I:H/A:H impact. No public exploit exists and EPSS is 0.20% (10th percentile), consistent with a kernel driver bug requiring physical or local QNAP hardware access.
Out-of-bounds read and write in the Linux kernel's dm-pcache (device mapper persistent cache) module allow a local attacker with CAP_SYS_ADMIN to corrupt kernel memory by loading a device mapper table backed by a crafted cache device containing malformed geometry metadata. The root cause is that cache_segs_init() and get_seg_id() consume on-disk cache_info fields - specifically n_segs and per-segment next_seg link IDs - without range validation before indexing into kernel-allocated arrays, and the only integrity protection on this metadata is a CRC computed with a fixed, public seed that offers no adversarial resistance. No public exploit or active exploitation has been identified; EPSS is 0.20% at the 10th percentile, consistent with the constrained attack prerequisites.
Out-of-bounds memory reads in the Linux kernel dm-pcache device-mapper subsystem allow a CAP_SYS_ADMIN-privileged local attacker to disclose adjacent persistent memory contents to userspace and corrupt the cache replay tree, with potential for kernel panic. Two input-validation gaps exist: kset key_num is not bounded against PCACHE_KSET_KEYS_MAX before buffer iteration, and per-key intra-segment offset+length pairs are accepted verbatim, allowing crafted on-media cache device images to trigger OOB reads that surface into caller bio buffers. No public exploit exists and EPSS sits at 0.20% (10th percentile), consistent with the elevated privilege requirement gating this attack surface.
Use-after-free and invalid segment operations in the Linux kernel's dm-pcache subsystem allow a local low-privileged attacker to corrupt kernel memory, potentially achieving privilege escalation. The flaw exists in kset_replay() where cache_key_put(key) frees key memory, yet the subsequent code dereferences key->cache_pos.cache_seg - a classic UAF pattern in kernel mempool-managed memory. No public exploit code has been identified and EPSS is 0.20%, though the local CVSS 7.8 (C:H/I:H/A:H) vector reflects the severity of kernel-level memory corruption.
Use-after-free in the Renesas I3C driver allows a local attacker with low privileges to crash the kernel or potentially escalate privileges on systems equipped with Renesas I3C hardware. The flaw stems from a race between a timed-out transfer cleanup path, which frees the transfer struct, and a late-arriving interrupt whose handler dereferences that now-freed memory. No public exploit has been identified, and exploitation requires specific hardware, but the UAF primitive theoretically supports memory corruption beyond a simple crash.
Improper sysctl table placement in the Linux kernel allows a local low-privileged user to modify the global `cad_pid` setting - which controls which process receives the Ctrl-Alt-Delete console signal - by abusing unprivileged user and PID namespace creation. A non-root user can call `unshare(CLONE_NEWUSER|CLONE_NEWPID)` to gain apparent root privileges in a child namespace and then overwrite the globally-scoped `/proc/sys/kernel/cad_pid`, even though `kill_cad_pid()` operates exclusively in the root namespace. No public exploit is identified at time of analysis; EPSS stands at 0.20% (10th percentile), and no CISA KEV listing exists.
Ring buffer corruption in the Linux kernel tracing subsystem arises from an inverted retry-exhaustion test in `simple_ring_buffer_swap_reader_page()`. When a compare-and-swap link replacement succeeds on the eighth and final attempt, the existing `!retry` guard (which triggers at zero) incorrectly returns -EBUSY while leaving the link update complete but reader bookkeeping unfinished; when all eight attempts fail, retry reaches -1, `!retry` is false, and the function falls through to update head and reader pointers as though the swap succeeded, silently corrupting the ring buffer structure. The fix, landed in Linux 7.2.4 and 7.3-rc1, corrects the guard to treat only a negative counter as exhaustion and return the documented -EBUSY. No public exploit code exists and EPSS is 0.19%.
Missing DMA alignment validation in the Linux kernel block layer allows a local unprivileged user to submit misaligned I/O vectors that bypass per-device alignment checks during bio construction from iov_iter, potentially triggering memory corruption, data leakage, or kernel crashes. Bio-based drivers lack alignment-split checks and stacking block drivers may silently mis-handle misalignment detected only after bio submission, making the window for exploitation broader than a single driver path. No public exploit has been identified and EPSS places this at the 9th percentile, though the high-C/I/A CVSS score reflects genuine kernel memory-safety consequences.
Unlocked dereference of dev->desc in the Linux kernel's i3c subsystem exposes systems with i3c-capable hardware to potential use-after-free or null pointer dereference conditions when a local low-privileged user races device descriptor teardown against calls to i3c_device_get_supported_xfer_mode(). The function accesses dev->desc to resolve the master controller without holding the required bus->lock, meaning a concurrent device detachment can free or null that pointer mid-access, leading to kernel memory corruption with CVSS-assessed C:H/I:H/A:H impact. No public exploit code or active exploitation (KEV) has been identified at time of analysis; vendor-supplied patch commits are available for stable kernel branches.
Use-after-free in the Linux kernel CIFS client's cifs_file_set_size() allows a local low-privileged user to corrupt kernel heap memory when a handle-based set-size RPC fails during SMB session teardown or reconnection. The freed tcon pointer is reused in a path-based fallback because it is not NULLed after cifsFileInfo_put(), exposing slab memory that may have been reclaimed by the kernel allocator. Patches are confirmed in versions 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation has been identified at time of analysis.
Overlayfs in the Linux kernel exposes an unprivileged local DoS - and a theoretical privilege-escalation path - through a double `end_creating()` call in `ovl_create_real()` when a casefold consistency mismatch is detected during directory creation. The double call unlocks the parent directory's `i_rwsem` twice and calls `dput()` twice on the same dentry: the spurious unlock wedges every subsequent creation under that parent indefinitely, and the spurious `dput()` creates a reference-count imbalance that could underpin a use-after-free chain. The flaw is reachable without root in a user namespace on most modern Linux distributions. No public exploit has been identified at time of analysis and EPSS is 0.18%.
Stack buffer overflow in the Linux kernel's ACPI Platform Firmware Runtime Update (pfr_update) driver allows a local low-privileged attacker to corrupt kernel stack memory via oversized ACPI DSM buffer responses. The flaw exists in query_capability() where memcpy uses firmware-supplied buffer.length without bounds checking against fixed-size u8[16] destination fields in the stack-allocated struct pfru_update_cap_info, enabling writes up to 44 bytes past the end of the structure. KASAN confirmed exploitation on 7.2-rc6 producing three distinct stack-out-of-bounds reports; vendor-released patches are available in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit code exists and EPSS probability is low at 0.18%, but successful exploitation could yield arbitrary kernel code execution on affected systems.
Arbitrary kernel memory read/write in the Linux kernel's OpenRISC architecture syscall handler allows an unprivileged local process to overwrite kernel structures such as the sys_call_table and achieve kernel-context code execution. The `sys_or1k_atomic()` function (syscall 244 in the or1k ABI) performs a hand-written assembly atomic word swap between two user-supplied pointers without calling `access_ok()`, and its four memory-access instructions lack exception table entries - meaning any kernel address passed by a caller is directly dereferenced without fault isolation. Patches are confirmed in stable series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation is identified.
Use-after-free in the Linux kernel's Rust devres (device resource management) subsystem allows a local low-privileged attacker to cause kernel memory corruption or achieve privilege escalation. The race triggers when the driver core's devres_release_all() and Devres::drop() concurrently attempt to revoke the same Devres object - the losing revoker returns immediately while the winner's drop_in_place() is still executing, allowing adjacent resources such as DMA scatter-gather tables to be freed beneath active teardown. No public exploit code or CISA KEV listing exists; EPSS is 0.18%.
Memory corruption in the Linux kernel's mm/mempolicy subsystem allows a local unprivileged user to trigger a bogus folio pointer dereference, a VM_BUG_ON() panic, or silent LRU isolation of an unrelated live folio when an HMM-based GPU driver has migrated a transparent huge page (THP) to device memory. The flaw exists because queue_folios_pmd() does not guard against device-private PMDs before calling pmd_folio(), which misinterprets the device-private swap entry encoding as a hardware PFN. No public exploit has been identified at time of analysis, and EPSS is 0.18%, but the C:H/I:H/A:H CVSS impact rating reflects the potential severity if the precise conditions are met.
Stale swap-cache mapping in __migrate_device_pages() triggers invalid folio reference-count accounting in the Linux kernel mm/migrate_device subsystem, ultimately producing a BUG_ON kernel panic and potential memory corruption. The defect has two related components: the folio->mapping pointer is captured before folio_free_swap() executes, leaving a dangling reference to swap_space after swap-cache removal, and after a large folio is split the migration loop counter nr is not reset to 1, causing split order-0 folios to be processed with the original large-folio count. No public exploit code has been identified and EPSS is 0.18% (7th percentile), consistent with a local kernel-internals bug requiring a specific HMM/device-migration code path. Vendor-released patches are confirmed for stable trees targeting 7.2.4 and 7.3-rc1.
Out-of-bounds memory access in the Linux kernel's ntfs3 filesystem driver during log replay allows a local attacker who can mount a crafted NTFS image to corrupt kernel memory, potentially achieving privilege escalation. The root cause is that check_rstbl() validates DIR_PAGE_ENTRY table bookkeeping but never verifies that the trailing page_lcns[] array actually fits within the entry's declared size, so a crafted lcns_follow field drives a memmove and subsequent replay passes past the entry boundary. No public exploit or CISA KEV listing exists; EPSS is 0.18%, consistent with the local mount-gated attack surface shared by sibling ntfs3 CVEs (CVE-2026-89610 through CVE-2026-89614).
Integer underflow in the Linux kernel's eCryptfs filename-encryption parser allows a local attacker to trigger heap memory corruption by supplying a crafted tag 70 packet with a body shorter than the fixed metadata fields. The underflow causes ecryptfs_parse_tag_70_packet() to derive a wildly inflated encrypted-filename size, enabling out-of-bounds heap reads or writes with full confidentiality, integrity, and availability impact. No public exploit code exists and the CVSS score of 7.8 (AV:L) aligns with the local-only attack surface; vendor-confirmed patches are available across all supported stable branches.
Double-free vulnerability in the Linux kernel's IPv6 tunnel driver (ip6_tunnel) allows a local attacker with low privileges to corrupt kernel memory, potentially leading to privilege escalation or system crash. The flaw exists in ip6_tnl_xmit(), where skb_realloc_headroom() internally consumes the original socket buffer but error-handling paths in ip6_tnl_start_xmit() and IPv6 GRE callers subsequently attempt to free it again. No public exploit or active exploitation (CISA KEV) has been identified; EPSS stands at 0.18%.
Use-after-free in the Linux kernel's nouveau open-source NVIDIA GPU driver allows a local unprivileged user to corrupt kernel memory via a race between the GEM buffer object info ioctl and a concurrent GEM close operation. In the non-uvmm code path, the VMA (virtual memory area mapping) associated with a buffer object can be freed by the close path between the info ioctl's lookup and its subsequent dereference, creating a classic use-after-free condition with potential for kernel-level code execution or privilege escalation. No public exploit is identified at time of analysis; vendor-released patches are available across all active stable branches.
Buffer overflow in the Linux kernel's Intel Touch Host Controller QuickSPI HID driver allows a local user with hidraw device access to corrupt kernel memory using device-controlled content. The function `quickspi_get_report()` copies the full device-supplied response length into the caller's buffer without checking the caller-provided size bound, so a touch controller returning more bytes than allocated overflows the kernel buffer. No public exploit exists (EPSS 0.17%, no KEV), but the sibling intel-quicki2c driver already carried the correct fix, confirming the root cause is a missing bounds-check port.
Use-after-free in the Linux kernel's IPv4 and IPv6 multicast forwarding paths allows a local attacker to corrupt kernel memory by racing socket destruction against multicast skb forwarding. The flaw arises because `bpf_sk_assign()` and UDP early demux can associate a socket pointer (`skb->sk`) with a socket buffer without holding a counted reference; when `ip_mr_input()` or `ip6_mr_input()` forwards the original skb outside the RCU read section, a concurrently destroyed socket leaves `skb->sk` stale, and the eventual `sock_pfree()` call dereferences freed memory. No public exploit has been identified, and the EPSS score of 0.17% (7th percentile) confirms negligible observed exploitation activity at time of analysis.
Use-after-free race condition in the Linux kernel's mt76/mt7925 MediaTek Wi-Fi 7 driver allows a local attacker with low privileges to corrupt kernel memory or trigger execution of stale MCU commands. The driver's mlo_pm_work delayed work item lacks cancellation in teardown and suspend paths (reset recovery, PCIe unbind, PCIe/mac80211/USB suspend), creating a window where the work executes after vif/bss structures are freed or firmware becomes unavailable. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17% (7th percentile), consistent with a race-condition kernel driver flaw of limited public interest.
Use-after-free in the Linux kernel's staging Intel IPU7 media driver allows a local attacker to corrupt kernel memory and potentially escalate privileges. The `isys_probe()` error path registers the V4L2 async notifier but fails to unregister it on subsequent probe failures, leaving a dangling pointer in the global `notifier_list` after `devres` frees the enclosing `struct ipu7_isys`. Any subsequent walk of that list - an event driven by normal kernel media subsystem activity - reads freed memory, creating exploitable heap corruption. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS is 0.17% at the 7th percentile.
Heap buffer overflow in the Linux kernel's panasonic-laptop platform driver allows a local low-privileged user on affected Panasonic hardware to corrupt kernel heap memory, potentially escalating privileges. The flaw resides in acpi_pcc_retrieve_biosdata(), which writes a trailing sentinel one element past the end of the allocated pcc->sinf[] array when num_sifr equals hkey->package.count - a condition that arises specifically on Panasonic hardware where the BIOS SQTY field reports one fewer SINF entries than the actual package, triggering the driver's existing off-by-one workaround. Vendor-released patches are available in Linux 7.2.4 and 7.3-rc1; no public exploit code or active exploitation has been identified.
Task context confusion in the Linux kernel's io_uring waitid subsystem allows a local low-privileged attacker to trigger __do_wait() execution from a kworker thread rather than the originating task, causing child process lookups and signal structure access to operate against the wrong process namespace. Affected kernels span from the commit introducing the vulnerable io_waitid_cb() behavior through version 7.2.3; fixes are confirmed in 7.2.4 and 7.3-rc1. No public exploit code and no KEV listing exist at time of analysis; EPSS of 0.17% reflects minimal observed exploitation activity.
Use-after-free in the Linux kernel USB audio gadget driver (drivers/usb/gadget/function/u_audio.c) allows a local attacker or race condition to corrupt kernel memory when a USB audio gadget device is disconnected while userspace ALSA control file descriptors remain open. The root cause is that g_audio_cleanup() calls snd_card_free_when_closed() - which defers ALSA card teardown asynchronously - but immediately frees the underlying struct snd_uac_chip; kctl callbacks invoked when userspace closes those lingering FDs then dereference freed memory. No public exploit code exists and EPSS is 0.17%, but the kernel UAF class carries inherent privilege escalation potential on affected systems.
Incorrect REX prefix encoding in the Linux kernel's BPF x86-64 JIT compiler drops the high bit of extended destination registers (R8-R15) during per-CPU address resolution, causing GS-segment offsets to be applied to the wrong register. The affected registers alias as R5→RAX, R7→RBP, R8→RSI, R9→RDI, leaving actual per-CPU pointers unadjusted and clobbering scratch registers or the frame pointer, reliably producing kernel panics and theoretically enabling memory corruption. Vendor-released patches are available in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV listing exists and EPSS is 0.17%.
Out-of-bounds kernel memory write in Linux kernel BPF stack unwinding (`__bpf_get_stack`) exposes CONFIG_PREEMPT systems to local privilege escalation. On fully preemptible kernels, a non-sleepable BPF raw tracepoint program runs under `migrate_disable()` but not `preempt_disable()`, creating a scheduler preemption window between per-CPU callchain buffer release and consumer memcpy; a concurrent task can overwrite `trace->nr`, inflating `copy_len` past the caller's buffer boundary. The vulnerability affects Linux 4.18 through stable branches preceding 6.12.109/6.18.50/7.2.4/7.3-rc1; no public exploit exists and EPSS is 0.17%, but the C:H/I:H/A:H impact ratings reflect kernel memory corruption potential.
Out-of-bounds kernel memory access in the Linux kernel device-mapper (dm array) library allows a local attacker with crafted dm-cache metadata to trigger an 8-byte stride over 4-byte entries, computing element offsets up to 8160 bytes within a 4096-byte block. The root cause is that array_block_check() validates a block's internal self-consistency but never compares the stored value_size against the calling context's expected value_size; dm-cache's two persistent arrays (mappings at 8 bytes, hints at 4 bytes) share the same on-disk format, so a superblock pointing the mappings root at a hint block silently passes validation. Vendor-released patches are available; no public exploit exists and EPSS stands at 0.17%.
Incorrect hardware header length computation in the Linux kernel's ip6_gre driver creates a memory layout miscalculation in NBMA IPv6 GRE tunnel configurations, exploitable locally by a low-privileged user to corrupt kernel memory and potentially achieve privilege escalation. The function ip6gre_tnl_link_config_route() incorrectly accumulates the lower device's hardware header length into dev->hard_header_len when header_ops is set, affecting both NBMA ip6gre tunnels and ip6gretap/ip6erspan devices across a wide range of kernel versions from 4.19 onward. No public exploit code or active CISA KEV exploitation has been identified; EPSS probability is 0.17% (6th percentile), reflecting low current exploitation interest.
Use-after-free in the Linux kernel SUNRPC cache management subsystem allows a local low-privileged user to potentially achieve kernel code execution or crash the system. The bug exists in `sunrpc_destroy_cache_detail()`, which skips `cancel_delayed_work_sync()` when `cache_list` is non-empty - a condition that is permanently true during per-netns teardown - leaving `cache_clean()` with a dangling pointer to the already-freed `cache_detail` structure. No public exploit has been identified and EPSS probability sits at 0.17%, indicating no current active exploitation.
Linux kernel SUNRPC subsystem exposes a race condition between proc entry publication and mutex initialization in the GSS proxy path, allowing a local attacker with write access to /proc/net/rpc/use-gss-proxy to exploit an uninitialized mutex during the narrow window when auth_rpcgss loads. On a production kernel without debug options, two concurrent writers racing through set_gssp_clnt() can shut down an RPC client structure while it is still in active use, resulting in a resource leak and potential use-after-free with full kernel memory integrity and availability impact. Vendor-released patches are available across stable branches; no public exploit or KEV listing exists at time of analysis.
Use-after-free race condition in the Linux kernel RDMA/ucma subsystem allows a local attacker with access to the userspace connection manager interface to corrupt kernel memory and achieve privilege escalation. The flaw exists in ucma_set_ib_path(), which invokes ucma_event_handler() without holding the handler lock that serializes access to ctx->file; a concurrent ucma_migrate_id() call can swap ctx->file between reads inside the handler, causing an event to be enqueued on file B's list while only file A's mutex is held - a condition confirmed by a KASAN slab-use-after-free trace in the upstream commit. Patches are available for all actively supported stable kernel branches (6.12.109, 6.18.50, 7.2.4, 7.3-rc1); no public exploit or active exploitation has been identified.
Heap buffer overflow in the Linux kernel orangefs client debug-mask parser allows a local low-privileged attacker to corrupt kernel heap memory and potentially escalate privileges. The flaw originates in `orangefs_prepare_cdm_array()`, where buffer sizing via `strcspn()` and subsequent parsing via `sscanf %s` diverge in how they handle leading whitespace - a crafted debug mask entry prefixed with a space causes an undersized allocation that `sscanf` then overwrites. Vendor-released patches are available across all active stable branches (6.12.109, 6.18.50, 7.2.4, 7.3-rc1); no public exploit or active exploitation is identified.
OpenVSwitch packet forwarding in the Linux kernel exposes a page-cache write primitive ("Fragnesia") when MSG_ZEROCOPY packets are processed through the userspace upcall error path. When `queue_userspace_packet()` fails and calls `skb_tx_error()` on a still-live, still-forwarded skb, it strips `SKBFL_SHARED_FRAG` via `skb_zcopy_clear()`. A subsequent local ESP-in-UDP delivery then invokes `esp_input()` without `skb_cow_data()` copy-on-write protection, causing in-place AEAD decryption over page-cache pages the low-privileged sender does not own. Patches are available for stable series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or KEV listing exists at time of analysis.
Use-after-free in the Linux kernel SMC (Shared Memory Communications) subsystem allows a low-privileged local attacker to trigger a race condition during connection teardown, resulting in memory corruption with potential for privilege escalation. The flaw exists in smc_conn_free() and smc_lgr_terminate_sched(): when a link group is unlinked before connection cleanup completes, the device can re-arm the receive tasklet after tasklet_kill() returns, causing the tasklet to dereference an already-freed send buffer on the DMB-nocopy path. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17%.
Integer overflow in the Linux kernel IP tunnel subsystem allows a local low-privilege attacker to stack user-created tunnel devices until the cumulative advertised `needed_headroom` exceeds the 16-bit skb header offset capacity. When IP output subsequently reserves that headroom, the offset arithmetic wraps around, producing a kernel memory corruption condition with potential for local privilege escalation to root. No public exploit has been identified at time of analysis, and EPSS reports a 0.17% exploitation probability; patches are available across multiple stable kernel branches.
Shared zerocopy state corruption in the Linux kernel networking stack allows a local low-privileged attacker - via Open vSwitch - to cause kernel memory corruption leading to privilege escalation. When skb_tx_error() is called on a cloned socket buffer (skb), it unconditionally clears shared zerocopy flags in skb_shinfo(), which all clones reference. In OVS deployments using non-last OVS_ACTION_ATTR_RECIRC, a flow miss on the clone strips the SKBFL_SHARED_FRAG marker from the still-in-flight original, and subsequent local ESP/IPsec delivery decrypts in-place over memory pages it does not privately own. No public exploit has been identified at time of analysis; EPSS is 0.17%.