Stack information disclosure and use-after-free in the Linux kernel i3c master driver allow a local, low-privileged user to leak kernel stack contents through the sysfs modalias interface during device unregistration. The defect exists from kernel 5.0 onward through 6.12.108, 6.18.49, and 7.2.3: i3cdev->dev->desc is zeroed before device_unregister() completes, so racing calls to i3c_device_uevent() and modalias_show() read a NULL descriptor and fall back to an uninitialized stack struct i3c_device_info, exposing raw kernel stack bytes in the generated uevent string. No public exploit code has been identified at time of analysis; patches are available in stable releases 6.12.109, 6.18.50, 7.2.4, and the 7.3-rc1 mainline tree.
Stack corruption in the Linux kernel mwifiex WiFi driver allows a local low-privileged user to corrupt kernel stack memory and trigger a kernel panic, with potential for arbitrary code execution in kernel context. The driver's synchronous firmware command path stores caller-provided stack-allocated buffers in cmd_node->data_buf; when wait_event_interruptible_timeout() is interrupted, the caller returns and reclaims its stack frame while the in-flight command node retains a stale pointer - a late firmware VERSION_EXT response then writes firmware string data through that freed stack address. The issue is confirmed reproducible on i.MX8MP/88W8997 hardware via documented kernel panics, with no public exploit code identified at time of analysis (EPSS 0.17%).
Out-of-bounds kernel heap write in the Linux kernel's DS28E17 1-Wire-to-I2C bridge driver allows a local attacker controlling a malicious I2C slave device to write up to 222 bytes past a 34-byte kernel buffer. The driver's w1_f19_i2c_read() unconditionally trusts a device-supplied length byte (0-255) on I2C_M_RECV_LEN transactions, but the caller buffer is only I2C_SMBUS_BLOCK_MAX + 2 bytes; the SMBus core's own BLOCK_MAX check runs only after the overwrite has already occurred. No public exploit has been identified at time of analysis; EPSS sits at 0.17%, reflecting the niche hardware prerequisite.
Use-after-free in the Linux kernel's Smack LSM `smack_file_send_sigiotask()` function allows a local attacker with low privileges to trigger kernel memory corruption by racing credential pointer changes on a non-current task. The function incorrectly accessed both `tsk->cred` (subjective credentials, unprotected) and `__task_cred(tsk)` (objective credentials) on the same task; because a task may change its own `->cred` pointer at any time without synchronization, the first access can race with a credential transition, yielding a freed `struct cred` deref. The author confirmed KASAN-reported UAF reproduction and verified the fix. No public exploit exists and EPSS is low at 0.17%, but the CVSS-assessed local impact (C:H/I:H/A:H) reflects the potential for privilege escalation on affected kernels.
Use-after-free in the Linux kernel fanotify subsystem (introduced in 6.14) copies stale kernel stack memory to userspace and may enable local privilege escalation on unpatched 6.18.x and 7.x kernels. When a signal interrupts the triggering task precisely after the event reader sets FAN_EVENT_REPORTED but before it finishes preparing the file descriptor, fanotify_get_response() unwinds the stack-allocated file_range frame while the reader retains a dangling pointer to range.pos; the subsequent copy_range_info_to_user() dereferences freed stack memory, confirmed by KASAN. No public exploit code exists and EPSS is very low (0.17%), but vendor patches are available in 6.18.50, 7.2.4, and 7.3-rc1.
NULL pointer dereference and use-after-free conditions in the Linux kernel's CXL (Compute Express Link) MCE notifier path allow a local attacker with low privileges to corrupt kernel memory or achieve privilege escalation on systems with CXL memory hardware and extended linear cache enabled. The notifier was incorrectly anchored to the memory device lifetime (`cxl_memdev_state`) rather than to the region lifetime (`cxl_region`), meaning the MCE interrupt handler could fire against freed or nulled objects during device or region teardown. No public exploit has been identified and EPSS sits at 0.17%, consistent with the niche hardware dependency. Vendor-released patches are available in Linux 6.18.51, 7.2.4, and 7.3-rc1.
A race condition in the Linux kernel's RDMA/ucma subsystem allows an unprivileged local user to corrupt kernel data structures and deadlock a mutex by racing ucma_write_cm_event() against ucma_migrate_id(). The device /dev/infiniband/rdma_cm carries world-readable/writable permissions (0666), and the kernel description explicitly states no physical RDMA hardware is required to reach the vulnerable code path, making this accessible to any local user on an affected system. The race causes ctx->file to be swapped mid-sequence across four dereferences - resulting in a kernel BUG at lib/list_debug.c, a permanently held mutex wedging subsequent writers in uninterruptible D-state, and a stranded uevent that outlives its owning context. No public exploit has been identified at time of analysis.
Use-after-free in the Linux kernel's OpenVSwitch connection tracking (CT) limit subsystem allows a low-privileged local user with access to user and network namespaces to trigger a slab-use-after-free in ovs_ct_execute() during network namespace teardown. The race condition arises because the CT limit pointer was freed under ovs_mutex without first removing it from RCU-protected packet processing paths or waiting for a grace period, enabling concurrent packet processing threads to dereference already-freed memory. No public exploit or CISA KEV listing exists; EPSS is 0.17%, reflecting low observed exploitation activity at the time of analysis.
Use-after-free in the Linux kernel IPMI message handler allows a local low-privileged user to corrupt kernel memory by racing `_ipmi_destroy_user()` against concurrent RCU readers in `find_cmd_rcvr()` and `handle_ipmb_get_msg_cmd()`. A regression introduced by commit 9e91f8a6c868 removed the `synchronize_rcu()` grace period that previously ensured no readers held live pointers to `cmd_rcvr` structures before `kfree()` was called, while the `cmd_rcvrs` list continues to be walked under plain RCU. No public exploit code has been identified at time of analysis; patched stable kernel versions are available.
Use-after-free in the Linux kernel's via-sdmmc MMC host controller driver allows a local attacker to corrupt kernel memory during device removal. The driver's remove path (`via_sd_remove()`) frees the host structure while a previously-queued `carddet_work` work item can still dereference that freed memory via `container_of()` and MMIO base pointer access, creating a race-window that leads to memory corruption with C:H/I:H/A:H impact. No public exploit exists and EPSS sits at 0.17%, but the VIA chipset attack surface is real on older embedded and budget hardware still running affected kernels.
Use-after-free in the Linux kernel IPMI subsystem exposes freed kernel memory through a stale sysfs attribute left behind after a failed SMI registration. When ipmi_add_smi() encounters an error creating the maintenance_mode sysfs file, the nr_msgs attribute is not removed before the smi_info interface structure is freed, leaving a dangling sysfs entry backed by released memory. A local attacker with low privileges who can reach this error condition and then access the stale attribute may achieve arbitrary kernel memory read/write, creating a potential privilege escalation path to root. No public exploit exists and no active exploitation has been confirmed.
Out-of-bounds memory access in the Linux kernel's dm-pcache (device-mapper persistent cache) subsystem allows a local privileged attacker to read past segment data boundaries. The `cache_pos_decode()` function loads `key_tail` and `dirty_tail` segment offsets (`seg_off`) directly from the cache device without validating them against the segment's `data_size`, so a crafted cache device with an oversized `seg_off` causes the kernel to address memory beyond the segment buffer. Exploitation requires CAP_SYS_ADMIN to supply the device. No public exploit or CISA KEV listing exists; EPSS is low at 0.17%.
The mt7925 WiFi driver (mt76 subsystem) in the Linux kernel fails to cancel a deferred work item on the device stop path, creating a 5-second race window during multi-link operation (MLO) power-save setup. If the mt7925 PCIe or USB device is torn down within that window, the surviving timer fires against a workqueue that has already been destroyed, triggering a kernel WARNING and potential crash. No public exploit has been identified; EPSS is 0.17% (6th percentile), and the bug requires local access to hardware running an affected kernel with MLO power-save active.
Out-of-bounds memory read in the Linux kernel mt76/mt7996 Wi-Fi driver allows a local attacker with ability to supply a truncated EEPROM firmware file to trigger kernel memory disclosure or crash during driver initialization. The driver unconditionally copies and validates the default EEPROM firmware without first checking its length against the expected MT7996_EEPROM_SIZE constant, so a file shorter than that threshold causes reads past the end of the allocated firmware buffer. No public exploit has been identified at time of analysis; EPSS sits at 0.17% (6th percentile), reflecting the hardware-gated, local-access constraint.
A lockless read race in the Linux kernel's ftrace ring-buffer subsystem allows a local attacker to corrupt kernel memory by concurrently triggering a subbuf resize while a reader accesses stale size metadata. Affected versions span from the commit introducing dynamic subbuf resizing (~Linux 6.8) through current stable branches. The CVSS vector rates confidentiality, integrity, and availability all high, reflecting that a successful race can yield kernel memory corruption; no public exploit or CISA KEV listing exists, and EPSS sits at a low 0.16%.
AppArmor's begin_current_label_crit_section() in the Linux kernel contains a use-after-free of struct cred that can be triggered on systems with active AppArmor profiles when those profiles are updated or disabled mid-syscall. The flaw arises from synchronous credential replacement inside LSM hooks: the override_creds() guard in aa_replace_current_label() fails to detect when overridden and objective credentials are the same object, causing two reference drops that free the struct cred while task_struct still holds a pointer to it. No public exploit or CISA KEV listing exists; EPSS is 0.16% at the 5th percentile, consistent with low immediate exploitation probability despite a theoretically high UAF impact.
Out-of-bounds write in the Linux kernel AppArmor LSM label parser allows any local user on an AppArmor-loaded system to corrupt kernel heap or stack memory by writing a crafted multi-component label string to /proc/self/attr/apparmor/current or to the world-writable (mode 0666) securityfs .access file, the latter path applying no privilege check whatsoever. The bug is a deterministic off-by-one: aa_vec_unique() writes a NULL terminator at vec[n] when no duplicates are found, but vec_setup() and DEFINE_VEC() allocate only n slots, so the write lands one entry past the end of either the local stack array or the kzalloc'd buffer. No public exploit has been identified at time of analysis; vendor-released patches are available in stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Page-list corruption in the Linux kernel ring-buffer subsystem allows a local low-privileged attacker to trigger undefined memory behavior by exploiting improper handling of a failed remote reader page swap. When the tracing ring-buffer's `swap_reader_page` callback returns `-EBUSY` - which occurs during an event storm on a small buffer - `__rb_get_reader_page_from_remote()` incorrectly proceeds as though the swap succeeded, splicing the same physical page as both the previous and new reader entry simultaneously. This corrupted page-list state can result in confidentiality loss from stale kernel memory reads, integrity violations from writes to a doubly-referenced page, or kernel panic. No public exploit or active KEV listing exists; EPSS is 0.15%, consistent with a low-likelihood local kernel race condition.
Use-after-free in the Linux kernel MCTP subsystem allows an unprivileged local user to corrupt kernel memory by racing mctp_route_lookup() against concurrent device teardown. The function accesses rt->dev without holding a reference, so mctp_dev_put() can kfree() mdev->addrs while mctp_saddr() is still reading rt->dev->addrs[0] - confirmed by a KASAN slab-use-after-free trace. No CAP_NET_RAW is required; any user who can open an AF_MCTP socket can reach this path, making it a low-barrier local privilege escalation candidate. No public exploit is identified at time of analysis, though the vulnerability reintroduces the CVE-2023-3439 use-after-free class and carries CVSS C:H/I:H/A:H.
Use-after-free in the Linux kernel's KEYS trusted TPM subsystem permits concurrent kernel threads to dereference freed memory during module teardown. trusted_tpm_exit() incorrectly releases the TPM chip reference and frees the digest array before calling unregister_key_type(), which is the actual synchronization barrier that drains in-flight key operations. A local attacker with key-creation privileges racing a module unload can trigger a KASAN-confirmed slab-use-after-free in tpm_pcr_extend(), potentially yielding kernel memory corruption with high confidentiality, integrity, and availability impact. No public exploit exists and EPSS sits at 0.15%, indicating no widespread exploitation activity at time of analysis.
Stale walk->action state in the Linux kernel mm/pagewalk subsystem causes walk_pud_range() to spuriously retry PUD traversal and invoke page-walk callbacks twice, resulting in a slab-out-of-bounds write reachable by unprivileged local users via the mincore(2) syscall. Affected kernels in the 6.18.21-6.18.49 and 7.0-7.2.3 ranges contain the latent logic error activated by commit 3b89863c3fa4; the bug was confirmed by KASAN output and a local fuzzer producing an OOB write into a sigqueue slab object. No public exploit is available and no active exploitation has been identified; vendor-released patches are available in 6.18.50, 7.2.4, and 7.3-rc1.
Memory corruption in the Linux kernel's swap/hibernation subsystem can produce silent data corruption and crashes in unrelated userspace processes during hibernation image preparation. swap_free_hibernation_slot() unconditionally calls __swap_cluster_free_entries() without checking whether a folio already occupies the slot in the swap cache - a state reachable when cluster readahead speculatively faults in pages over the hibernation window. The freed slot is returned to the allocator while its folio retains the stale swap offset in folio->swap; when page reclaim subsequently flushes that folio using the stale offset, it silently overwrites a swap table entry now belonging to a different process, corrupting arbitrary in-flight userspace data. No public exploit has been identified at time of analysis.
OS command injection in TUBITAK BILGEM's Pardus Boot Repair allows a local low-privileged user to execute arbitrary OS commands, likely resulting in full system compromise. The vulnerability (CWE-78) affects all versions prior to 1.0.8 of this boot repair utility for the Pardus Linux distribution. Given that boot repair tools typically run with elevated (root) privileges, this flaw effectively enables local privilege escalation to full system control with high confidentiality, integrity, and availability impact.
Local privilege escalation in Pardus-software (the software center for TUBITAK BILGEM's Pardus Linux distribution) allows a low-privileged local user to gain full system control. The flaw stems from incorrect privilege assignment (CWE-266), where the application grants elevated permissions to processes or objects that should operate with restricted rights, enabling an authenticated local user to escalate to root or equivalent. Versions before 1.0.5 are affected; no public exploit or active exploitation has been identified at time of analysis.
Cross-namespace secret disclosure in Red Hat Advanced Cluster Management for Kubernetes allows a managed-cluster agent holding low privileges to craft configuration references that point to hub Secrets outside its authorized namespace, delivering those Secrets to an attacker-controlled managed cluster. The vulnerability resides in the multicluster-observability-addon component, which previously processed ManagedClusterAddOn.status.configReferences and fetched referenced objects before enforcing any namespace boundary, allowing cross-cluster credential theft from the hub. The upstream fix (PR #644) introduces ValidateConfigNamespaces() to reject out-of-scope references before manifest generation; no public exploit has been identified at time of analysis.
Out-of-bounds kernel read in Linux UBIFS's superblock signature verifier allows mounting a crafted NAND filesystem image to disclose kernel memory or crash the system. Linux kernels from v5.3 with UBIFS authentication support compiled in are affected - the flaw is exercised before any cryptographic check occurs, so no valid signing key is required. No public exploit has been identified at time of analysis and EPSS stands at 0.20%, but the C:H/A:H impact is real on embedded or desktop Linux deployments using UBIFS.
Uninitialized physical address use in the AMD PMC driver (`amd_stb_s2d_init()`) causes the Linux kernel to call `devm_ioremap()` with physical address zero when the SMU rejects a command with error 0xff, mapping the first 16 MB of physical RAM into kernel virtual address space. Affected systems are AMD-based Linux hosts where the System Management Unit returns an error during S2D (System Trace Buffer) initialization at driver probe time. No public exploit exists and EPSS is 0.20%, consistent with the hardware-gated trigger; fixes are available in Linux 6.18.50 and 7.2.4 stable branches.
Out-of-bounds kernel heap read in the Linux kernel's Nitro Secure Module (NSM) virtio driver allows a malicious or buggy NSM backend to disclose adjacent kernel heap memory to user space. The driver stores the used-ring response length reported by the backend device without clamping it to the actual response buffer size; parse_resp_raw() then copies that unclamped length of bytes to user space, leaking heap contents to the calling process. No public exploit has been identified at time of analysis; patches are available in stable kernel releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Missing null termination in the Qualcomm battery manager driver (qcom_battmgr) causes the kernel to read beyond a string buffer boundary when firmware on SC8280XP-based devices returns a string that exactly fills the BATTMGR_STRING_LEN field. The three contiguous string fields - model_number, serial_number, and oem_info - are exposed to userspace via the power supply sysfs interface using a bare "%s" format, meaning an unterminated firmware string causes the kernel to traverse into adjacent struct members and leak their contents to unprivileged local readers. No public exploit has been identified at time of analysis; patches are confirmed for stable branches 6.12.109, 6.18.50, and 7.2.4.
Race condition in MongoDB Server's document value layer permits an authenticated user with ordinary read-write database privileges to trigger unsynchronized concurrent thread access to shared internal memory over the standard client protocol, leading to server termination and potential corruption of process memory with user-influenced content. The flaw affects confidentiality, integrity, and availability of the MongoDB server process - worst-case outcomes range from a reliable denial-of-service crash loop to a write primitive enabling memory disclosure or data manipulation. No public exploit has been identified at time of analysis, and the race condition's timing dependency (AT:P in the CVSS 4.0 vector) moderates reliable exploitability despite the high theoretical impact.
Incorrect authorization in OpenStack Keystone before 29.0.3 allows holders of delegated authentication tokens (EC2 credentials, application credentials, OAuth1 access tokens, or trusts) to create, modify, or delete credentials via the /v3/credentials API without restriction. EC2-derived tokens can additionally read raw credential blobs, exposing TOTP MFA seeds and other secrets stored in Keystone. An additional authorization gap in PATCH /v3/credentials permits any delegated token to reassign a credential to an arbitrary project, bypassing project-isolation controls. No public exploit code or CISA KEV listing identified at time of analysis.
Out-of-bounds array indexing in the Linux kernel's rtl8192du Wi-Fi driver allows network-adjacent unauthenticated attackers to trigger kernel memory corruption or a crash. The driver's `rtl92du_tx_fill_desc()` function passes a raw 802.11 QoS TID value (range 0-15) as an index into `sta_entry->tids[]`, which is only allocated with MAX_TID_COUNT=9 entries; TID values 9-15 index past the array boundary. UBSAN confirms index-10 access on `rtl_tid_data [9]`. No public exploit exists and EPSS is 0.17%, indicating low real-world exploitation pressure at time of analysis.
Remote unauthenticated denial-of-service in AirSane scanner server (versions prior to 0.4.12) allows an attacker to crash the daemon by sending an HTTP POST request with an arbitrarily large Content-Length value, triggering memory exhaustion and a std::bad_alloc exception. The root cause is in httpserver.cpp, where the Content-Length header value is passed directly to std::string::resize() with no upper-bound validation. A secondary variant using non-numeric Content-Length values produces undefined behavior via NaN-to-integer conversion. No public exploit or active exploitation has been identified at time of analysis.
SQL injection in the Amelia WordPress booking plugin (versions ≤ 2.4.9) allows authenticated Editor-role users to exfiltrate data from the underlying database via crafted queries. The vulnerability is scoped-changed, meaning successful exploitation reaches beyond the plugin component to the WordPress database. Reported by Patchstack; no public exploit code or CISA KEV listing identified at time of analysis.
SQL injection in Sky Addons for Elementor (WordPress plugin by wowdevs) versions 3.8.4 and earlier allows authenticated attackers with Editor-level WordPress privileges to query the underlying database beyond the plugin's normal scope, achieving high confidentiality impact. The scope-changed CVSS vector (S:C) indicates the injection can reach data outside the plugin's own tables - including sensitive WordPress core tables - making this an information-disclosure-focused SQLi. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote denial-of-service in HPE IceWall Federation Agent and Proxy allows a network attacker to crash or render unavailable the identity federation and authentication proxy service. The root cause is improper handling of incorrect data types (CWE-241), meaning the software fails to gracefully reject or process malformed input, triggering an availability failure. No active exploitation or public exploit code has been identified at time of analysis.
Path traversal in SignalWire's libks HTTP request parser exposes consumers to arbitrary file read. The `clean_uri()` function fails to reject oversized URI paths - when the path contains more segments than the internal canonicalization buffer accommodates, embedded `..` sequences survive unfiltered into any downstream code that joins the URI with a filesystem path. Unauthenticated remote attackers can exploit this against any application built on libks prior to 2.0.11. No public exploit code has been identified at time of analysis, but the CVSS 3.1 score of 7.5 (C:H) reflects the potential for full confidentiality loss through arbitrary file traversal.
Unauthenticated SQL injection in the Unlimited Elements For Elementor WordPress plugin (versions ≤2.0.16) allows remote attackers to extract sensitive data from the WordPress database without any credentials. The flaw exists in getWhereString() where the 'addontype' parameter, when submitted as an array, has its first element injected verbatim as the SQL comparison operator into the WHERE clause; the companion normalizeAjaxInputData() method strips WordPress's built-in magic_quotes protection, eliminating the last layer of defense. No public exploit or KEV listing has been identified at time of analysis, but the unauthenticated network attack path and confirmed Wordfence disclosure make this a credible priority for sites running the affected plugin.
SQL injection in the Sticky Chat Widget WordPress plugin (versions ≤1.4.2) allows unauthenticated remote attackers to extract sensitive data from the underlying WordPress database via the scw_save_form_data AJAX action. Three compounding weaknesses enable exploitation: $wpdb->insert() wraps column identifiers in unescaped backticks, PHP's filter_input() retrieves raw POST data bypassing WordPress's wp_magic_quotes() sanitization, and a widget_id validation loop that is never executed when no valid widget_id is supplied leaves the $isValid flag at its initialized true value. No public exploit has been confirmed at time of analysis, but the publicly accessible unauthenticated AJAX endpoint makes this mechanically straightforward to exploit against any site running the affected plugin.
Memory exhaustion in multiparty Node.js library (versions 2.1.0 through <4.3.1) allows any unauthenticated network attacker to crash the host process with a single crafted HTTP request. The parser accumulates multipart part headers into an unbounded in-memory buffer with no size cap, consuming available process memory until the Node.js server is killed. The vulnerability carries no confidentiality or integrity impact - this is a pure availability issue addressed in multiparty 4.3.1, which enforces a maximum on the bytes buffered per part header block.
Remote kernel crash in the Linux kernel NFSv4 server (nfsd) allows any unauthenticated network client to trigger a NULL pointer dereference and kernel oops by sending a crafted SETATTR compound request. The flaw resides in nfsd4_setattr() when delegation timestamp attributes (FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY) are included alongside the NFSv4 'one stateid' (all-0xFF bytes): the special-stateid handling path in nfs4_preprocess_stateid_op() exits without populating the nfs4_stid output pointer, leaving the local variable NULL, after which the unconditional dereference of st->sc_type at offset 4 from NULL panics the kernel. No public exploit has been identified at time of analysis, and EPSS sits at 0.24% (15th percentile), though the zero-prerequisite attack surface makes this straightforward to trigger against any exposed NFSv4 server running an affected kernel.
Xiongmai XM530-based IP cameras running firmware HMT.CM2005-v220608.1837 and earlier ship the embedded Happytime RTSP server inside the Sofia IPC daemon with authentication disabled by default, so anyone who can reach the RTSP port can pull the live H.264 video and G.711 audio streams. The media leaves the device in cleartext over RTP/UDP, meaning the feed is also recoverable by an on-path observer on the same network segment. There is no CISA KEV entry and EPSS is very low at 0.22% (13th percentile), so this is currently an exposure-driven rather than campaign-driven risk, though exploitation requires no credentials, no user interaction, and only a standard RTSP client.
NULL pointer dereference in Linux kernel NFSD's NFSv4.2 compound dispatch loop allows remote clients to crash NFS servers built with CONFIG_NFSD_V4_2_INTER_SSC. By inserting an operation such as SETATTR between a foreign PUTFH and SAVEFH within a crafted COMPOUND request, an attacker causes fh_want_write() to dereference a NULL fh_export pointer - killing the nfsd kthread and denying NFS service to all clients. No public exploit has been identified and EPSS stands at 0.22%, reflecting low current exploitation interest.
Resource exhaustion in the Linux kernel NFSv4.2 inter-server copy (COPY offload) path allows an authenticated NFS client to leak nfsd_file objects on the server. Each inter-server COPY request that triggers a failed nfsd4_setup_inter_ssc() call bypasses the cleanup path where release_copy_files() drops the nf_dst reference, permanently pinning a file, inode, dentry, and vfsmount. Over time, repeated failed COPY requests exhaust kernel memory resources, producing a denial-of-service condition. No public exploit exists and EPSS is 0.21%, reflecting the niche NFSv4.2 inter-server copy configuration required.
NULL pointer dereference in the Linux kernel svcrdma subsystem (NFS over RDMA) allows unauthenticated remote clients to crash the kernel by sending a crafted RDMA Read list whose cumulative segment lengths overflow the rq_pages page array. The vulnerability bypasses per-segment length validation by exploiting an edge case where a single segment fills the page array exactly, causing the loop guard to exit prematurely; a subsequent segment then dereferences the NULL sentinel slot at rq_pages[rq_maxpages] during DMA mapping, triggering a kernel panic. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS is low at 0.21%, but the network-exposed crash vector warrants patching on any host running NFS-over-RDMA.
CPU exhaustion DoS in the Linux kernel's Ceph filesystem client affects systems with mounted Ceph volumes: `ceph_cap_reclaim_work()` enters a busy loop by unconditionally re-queuing itself whenever `ceph_trim_dentries()` returns `-EAGAIN`, which occurs even when no leases are eligible for reclaim. The underlying cause is `__dir_lease_check()` returning `TOUCH` for every valid lease when `expire_dir_lease=false`, churning the dentry list, resetting timestamps (preventing natural aging), and always exhausting the `nr_to_scan` budget - guaranteeing the `-EAGAIN` re-queue cycle. Vendor-confirmed data shows this produced 500 `ceph_trim_dentries()` calls per second and 128,000+ lock contentions on `dentry_list_lock` in a 5-minute window. No public exploit code exists and the CISA KEV does not list this vulnerability.
NFS server availability in the Linux kernel SUNRPC subsystem can be disrupted when svc_pool_for_cpu() routes incoming transports to CPU-affine service pools that contain no active threads. Affected deployments running nfsd in pernode or percpu pool mode with fewer configured threads than NUMA nodes (or CPUs) will silently enqueue inbound NFS transports on threadless pools, where they are never picked up - causing NFS connections to hang indefinitely. Patches are available in stable kernel series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit exists and EPSS is 0.21% (11th percentile).
Kernel panic via NULL pointer dereference in the Linux kernel qede Ethernet driver (used by QLogic/Marvell FastLinQ NICs) can be triggered under memory pressure conditions during TPA (Transparent Packet Aggregation) fragment processing. A regression introduced by commit 8a8633978b84 omitted the assignment of tpa_info->buffer.data in qede_tpa_start(), causing a 'ghost' buffer descriptor with a NULL data pointer to be reinserted into the active Rx ring upon SKB allocation failure. When hardware subsequently uses the poisoned ring slot, qede_fill_frag_skb() dereferences the NULL pointer, panicking the kernel. No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile).
Uncontrolled resource consumption in the Linux kernel Ceph client's ceph_parse_deleg_inos() function allows a malicious or compromised Ceph MDS (Metadata Server) to trigger denial of service against any connected client. The 64-bit interval length field in MDS create-with-delegation replies is decoded without value validation, enabling a crafted reply to spin the client's insert loop indefinitely or grow the per-session delegated-inode xarray without bound, exhausting CPU or kernel memory. No public exploit code exists and no CISA KEV listing is present, consistent with the EPSS score of 0.21%.
Reference leak in Linux kernel NFSD's nfsd_cross_mnt() allows any authenticated NFS client to incrementally exhaust VFS mount and dentry reference counts, ultimately blocking umount operations and degrading dentry cache reclaim. The err < 0 arm of follow_down() uniquely omits the path_put() call present in every other exit path of the function, making the leak reachable via nfsd_lookup_dentry and NFSv4 READDIR encoding. No public exploit is identified at time of analysis; EPSS is 0.20% at the 10th percentile, and no KEV listing exists.