2026-09-16
Cross-site request forgery in the LuCI administrative web interface of Advantech EKI-1242IEIMS running firmware V1.06.01 allows a remote, unauthenticated attacker to make an authenticated administrator's browser issue unauthorized state-changing requests, reaching privileged device management functions with high integrity and availability impact (vendor CVSS 4.0 base 8.6; independent 3.1 assessment AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H). Exploitation is conditional and social-engineering dependent: the administrator must hold an active LuCI session and be lured into visiting attacker-controlled content, so the technique fails against logged-out or idle-session administrators and reliability is constrained by the required user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based memory corruption in NLnet Labs Unbound up to and including 1.26.0 lets a remote, unauthenticated attacker who controls or spoofs the upstream DNS response (PR:N/UI:N) gradually overwrite heap memory, with the reliable outcome being a crash and remote code execution possible only on certain systems and compilation options that lack hardening. The flaw is scored CVSS 8.4 (CVSS:4.0) and by the independent assessment as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, with the high attack complexity reflecting heavy dependence on heap layout and non-deterministic results. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no KEV listing or EPSS signal is present, so this is a genuine but not-yet-urgent priority for internet-facing recursive resolvers.
Mounting a crafted NTFS filesystem image can corrupt Linux kernel memory through the in-kernel fs/ntfs3 driver, where an integer truncation in restart-table growth (a u32 'used + add' cast to the u16 __le16 count of struct RESTART_TABLE) produces an undersized allocation that is subsequently written past its bounds during $LogFile replay. The issue is local and requires an attacker-supplied image to actually be mounted: on default configurations this needs mount privileges (CAP_SYS_ADMIN/root), while the unprivileged path depends on a USB-automount daemon plus physical insertion of the media, so it is not remotely reachable. Kernels carrying the vulnerable ntfs3 log-replay code before the listed stable fixes are affected; vendor patches are available (Linux 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52 and 7.2.6, plus 7.3-rc1 in mainline), no public exploit was identified at time of analysis, and EPSS is low at 0.21% (11th percentile).
Mounting a crafted NTFS image on a Linux system with the ntfs3 driver loaded triggers an out-of-bounds read in read_log_rec_buf(), causing a kernel crash and possible disclosure of adjacent slab memory into the log replay buffer. This is a local-only issue that requires the attacker to get the malicious volume mounted, either through physical media with an active automount daemon or a process/user holding mount privileges such as CAP_SYS_ADMIN, and no public exploit was identified at the time of analysis. Vendor patches are available in stable releases 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6, and 7.3-rc1, and the independent assessment (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) is lower than the provided 8.4 vector because impact is limited to crash and potential disclosure rather than code execution.
Sandbox escape in RestrictedPython versions prior to 8.4 lets code executing inside the restricted context reach host-level primitives - function globals, builtins, file access, and code-execution gadgets - whenever the host exposes the standard-library string module, the string.Formatter class, a Formatter instance, or a Formatter subclass to that restricted code. The prerequisite is non-default: stock RestrictedPython does not surface these objects, so a custom import policy or specially crafted globals must be in place, and the attacker must also be able to submit restricted Python code (typically an authenticated user of the hosting application). A vendor patch is available in 8.4; no public exploit was identified at time of analysis.
Cross-site request forgery in the WNC T-Mobile 5G Box IDU router (portal.cgi) lets a remote attacker drive privileged actions through an already-authenticated administrator's browser, because the anti-CSRF check accepts any value supplied in the csrf_token_value parameter. The flaw affects firmware versions below 1.1.0.651412, is rated 8.4 under CVSS 4.0 (AV:A/PR:N/UI:A, high confidentiality and integrity impact, low availability impact), and requires the victim to be logged into the router portal while being lured to an attacker-controlled page reachable over the adjacent network. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released a fixed firmware build, so risk is real but conditional rather than an emergency patch-now scenario.
LoongArch Linux kernels overflow the fixed-size acpi_package_ids[] array while parsing the ACPI PPTT table, so a system whose firmware or hypervisor advertises more CPU packages (sockets) than the array can hold crashes during topology setup - the concrete case in the description being a LoongArch virt VM configured with one core per socket for up to 256 sockets. Affected builds are those before the fixed 6.12.110, 6.18.51, 7.2.5 and 7.3-rc1 kernels; the flaw is reachable only on LoongArch, and the assessed precondition (per our independent analysis: AV:L/AC:H/PR:H, C:N/I:L/A:H) is control over the guest's ACPI topology rather than an ordinary unprivileged runtime action, with the practical outcome being a boot-time crash and memory corruption rather than remote code execution. No public exploit code was identified at the time of analysis and there is no CISA KEV record, so this is not confirmed as actively exploited; the vendor has released patches and the relevant upstream commits are public.
Double-decrementing the SCP device reference in the Linux kernel's MediaTek MDP3 (mtk-mdp3) media platform driver can free or unbalance a device object that the driver still uses, producing driver instability and potentially a use-after-free on systems that take the fallback SCP lookup path. The flaw is only reachable when scp_get() fails during mdp_probe() so that __get_pdev_by_id() runs; the reference taken by that fallback is dropped immediately, yet scp_put() is later called unconditionally from the probe error path and from mdp_video_device_release(). Exposure is confined to local presence on embedded MediaTek SoC hardware running the affected driver, the triggering scp_get() failure is a non-default condition rather than an attacker-controlled input path, and no public exploit code has been identified at time of analysis. Although NVD scores this 8.4, our independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H - high severity but low realistic risk.
The Linux kernel's saa7164 media driver can leave a freed device structure dangling on the global saa7164_devlist when PCI BAR memory-region allocation fails during probe, because saa7164_dev_setup() adds the device to the list before calling get_resources() and never removes it on that error path; the probe cleanup then frees the device while the global list still points at it. Affected systems are those running the saa7164 driver against an SAA7164-based (NXP/Philips) TV capture card such as a Hauppauge HVR-22xx, and effectively any kernel built with CONFIG_VIDEO_SAA7164; the flaw was introduced with commit 443c1228d50518f3c550e1fef490a2c9d9246ce7 and is fixed in Linux 6.1.188, 6.6.157, 6.12.110, 6.18.51 and 7.2.5 (mainline 7.3-rc1). No public exploit has been identified at time of analysis (no CISA KEV entry, no published POC, no EPSS signal in the supplied data), and the vendor's CVSS 8.4 is not supported by our independent assessment, which rates the issue CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L and concludes real-world risk is LOW: the trigger is a hardware/probe-time resource failure rather than an attacker-controlled input, there is no remote vector, and no default configuration is affected.
Memory corruption and kernel crashes in the Linux kernel's qla2xxx QLogic Fibre Channel HBA driver arise from an integer truncation when the driver derives its request/response queue counts from the adapter's advertised MSI-X vector count. Affected systems are those running the CONFIG_SCSI_QLA_FC driver and bound to a QLogic FC HBA that reports a boundary MSI-X count (257 vectors, which truncates to zero in the u8 queue-count fields, or exactly 1), after which qla2x00_alloc_queues() obtains ZERO_SIZE_PTR from kzalloc_objs(struct req_que *, 0) and then dereferences it via ha->req_q_map[0]; target-mode configurations can additionally underflow max_req_queues from 0 to 255. Exploitation requires physical or firmware-level control of a PCI/FC device (per our independent assessment of CVSS:3.1/AV:P/AC:H/PR:N/UI:N, C:N/I:L/A:H) rather than any network or unprivileged-user input, and there is no public exploit identified at time of analysis. Vendor patches are available in the referenced stable tree commits.
Signed integer overflow in the Linux kernel ofdrm (Open Firmware framebuffer) driver allows the framebuffer size computation fb_size = linebytes * height to wrap when both geometry values are large, resulting in an undersized framebuffer allocation and subsequent out-of-bounds memory handling inside the drm/sysfb subsystem. Exposure is confined to systems that actually bind the ofdrm driver, effectively Open Firmware/PowerPC-class platforms whose linebytes and height come from firmware or the boot device tree rather than from runtime user input, and the assessed vector (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H) reflects that a privileged actor able to influence platform firmware or the device tree is required, which is considerably more restrictive than the published 8.4/PR:N rating. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied.
Slot reset on IBM Z (s390) Linux kernel systems can hit the wrong PCI function, and the associated slot bookkeeping leaks memory, because the PCI core assigns a single shared pci_slot object to all functions of a multifunction device. Only s390 hosts running under a machine-level hypervisor with PCI pass-through are affected, and only when multifunction devices are exposed grouped into a shared PCI domain (the topology added by commit 44510d6fa0c0); the issue is local and requires a low-privileged authenticated actor able to drive the hotplug reset path (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H, base 8.4), with no confidentiality impact and no applicability to non-s390 architectures or s390 setups that still expose virtual functions as separate PCI domains. Vendor-released patches are available in the stable and mainline trees, and no public exploit code has been identified at time of analysis.
Improper authorization checks in GitLab CE/EE's Generic Package Registry (CWE-862) allow an authenticated user holding developer-role permissions to substitute the content of an existing package file and to hide packages from their legitimate owners. The flaw affects all GitLab Community and Enterprise Editions from 13.9 up to the fixed releases 19.1.8, 19.2.6 and 19.3.2, meaning the exposure window spans multiple major release lines and any long-lived install not patched in this cycle. Impact is integrity-only (CVSS 4.3, AV:N/PR:L/UI:N) - an attacker cannot read or delete data or crash the instance, but they can silently corrupt or conceal artifacts that downstream users and CI pipelines trust; publicly available exploit detail has been published via a HackerOne report.
GitLab CE/EE 13.0 and later (before 19.1.8, 19.2.6 and 19.3.2) fails to properly validate group URL slugs during namespace transfers, allowing any authenticated user to induce a slug collision that leaves the legitimate owners of another group unable to modify that group's settings. The flaw is an availability-only issue (CVSS 4.3, C:N/I:N/A:L) rather than a data-disclosure or code-execution bug, but publicly available exploit detail exists via the linked HackerOne report, and the CWE-862 classification indicates the transfer workflow bypasses the authorization checks that should protect the target namespace. No CISA KEV listing or EPSS score was supplied, so active exploitation is not confirmed.
Improper authorization controls in GitLab Enterprise Edition's compliance framework management allow an authenticated user holding the Security Manager role to execute arbitrary CI/CD jobs and reach protected CI/CD variables inside group projects. Affected are GitLab EE 18.11 through 19.1.7, 19.2.x before 19.2.6, and 19.3.x before 19.3.2, with fixes published in 19.1.8, 19.2.6, and 19.3.2. Exploit details are publicly available via a HackerOne report, and GitLab is credited as the reporter, though the issue is not listed in CISA KEV and no EPSS estimate was supplied.
Improper authorization on the IODD file upload endpoint of multiple Pepperl+Fuchs ICE2 and ICE3 IO-Link master devices, as well as Phoenix Contact IOL MA8 PN DI8 units, permits any low-privileged authenticated remote user to upload IO-Link Device Description (IODD) files without the privilege level required for that operation. Successful exploitation can silently alter how connected IO-Link sensors and actuators are configured or interpreted by the master, or crash the device entirely by supplying malformed IODD content. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Memory exhaustion in the RabbitMQ amqp091-go Go AMQP 0.9.1 client library prior to 1.13.0 lets unauthenticated remote attackers who can influence an application's Qos settings make the client request an absurdly large prefetch limit and then buffer enough broker-delivered messages to exhaust host memory. Channel.Qos performs no bounds validation, so a negative prefetchCount or prefetchSize is cast straight into the uint16/uint32 fields of the basic.qos method and wraps to 65535 or 4294967295 instead of being rejected. The vendor CVSS 4.0 score of 8.2 (High) is availability-only and materially gated by the attack requirement that the embedding application accept untrusted Qos values; default usage with hard-coded, non-negative values is unaffected, and no public exploit code was identified at time of analysis. The defect is repaired in 1.13.0 via a new validateQos check.
Heap memory corruption in the userspace SMB daemon of MikroTik RouterOS before 7.24 lets remote, unauthenticated attackers crash or destabilize the service by sending a crafted SMB1 SessionSetupAndX request whose uniPwdLen field triggers an integer underflow and an oversized copy into a smaller heap buffer (CWE-122). The independently assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this as an availability-only impact - adjacent heap corruption in a userspace daemon, not a confirmed path to code execution - and the primary limiting factor is that the SMB service is not enabled by default on RouterOS. No public exploit code has been identified at time of analysis, and exploitation requires the SMB service to be enabled and network-reachable with legacy SMB1 dialect handling active; a vendor fix shipped in RouterOS 7.24.
An out-of-bounds write in Arista VeloCloud Edge and VeloCloud Gateway affects the VCMP tunnel protocol when it processes tunneled IP fragments, causing the affected process to crash and restart and briefly disrupting traffic on the affected SD-WAN node. Exploitation requires the attacker to already be an authenticated overlay neighbor with an established VCMP peer relationship to the target (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) - internet hosts that are unauthenticated and cannot form an overlay peer relationship cannot reach the vulnerable logic. No public exploit code has been identified at time of analysis; the impact is bounded to a temporary availability loss, with no code execution or data compromise demonstrated.
Client-side cross-site scripting in @nuxtjs/mdc before 0.22.1 allows attackers to execute arbitrary JavaScript in the page origin by smuggling executable URLs past the module's built-in Markdown sanitizer. Because parseMarkdown runs with allowDangerousHtml enabled by default and the sanitizer (validateProps/validateProp plus unsafeLinkPrefix) is the only defense, two sibling gaps are exploitable: an SVG anchor xlink:href (surfaced as the xLinkHref prop) carrying a javascript: URL, and an iframe src set to data:text/html that survives because the denylist compares url.protocol ('data:') rather than the full URL. The vendor rates this CVSS 8.1, the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (unauthenticated per PR:N), and exploitation requires an application that renders attacker-controlled Markdown through the vulnerable versions. No CISA KEV listing or public exploit code was identified at time of analysis, though the fix PR (#491) and its regression tests publicly document both bypass payloads.
Authorization bypass in @fastify/auth versions 5.0.0 through 5.1.0 lets an authenticated low-privileged attacker who possesses a credential satisfying only the final member of a nested AND group, such as a valid API key without administrator rights, be authorized instead of rejected. The flaw occurs when strategies are composed with the relation "or" option together with the run "all" option and an entry is a nested array acting as an AND group, causing the group result to collapse to its last check; a mirror order-dependent bypass exists for top-level relation "and" with a nested "or" group. No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation; the vendor-released fix is version 5.1.1 or later.
A race condition in the Linux kernel's qla2xxx QLogic Fibre Channel driver allows a concurrent vport deallocation to free an NPIV virtual port while the format-1 report-ID-acquisition path still dereferences it, producing a use-after-free. The flaw is reachable only on systems that run a qla2xxx-driven QLogic FC HBA with NPIV virtual ports configured and that grant an attacker the local privilege needed to create and tear down virtual ports; the window is narrow (AC:H) and no attacker-controlled network input reaches the freed pointer, so the realistic outcome is a kernel crash or denial of service rather than controlled memory corruption. An independent assessment rates this CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, notably lower than the published AV:N/PR:N vector, and no public exploit has been identified at time of analysis.
Use-after-free in the Linux kernel qla2xxx QLogic Fibre Channel SCSI driver lets a local user who can trigger queue-pair teardown reach freed request-queue memory through a late response-queue interrupt. On hosts with a QLogic FC HBA using MSI-X multiqueue qpairs, qla2xxx_delete_qpair() frees the request queue via qla25xx_free_req_que() before the response-queue IRQ is released in qla25xx_free_rsp_que(), so a response interrupt firing in that window causes qla2xxx_msix_rsp_q() to queue qpair->q_work and qla_do_work() -> qla24xx_process_response_queue() to dereference the now-freed rsp->req (LOGINOUT/CT/ELS entries and the status path). The result is full memory corruption with high confidentiality, integrity, and availability impact, but exploitation requires winning a narrow local race during qpair deletion; no public exploit code or active exploitation was identified at time of analysis, and vendor patches are available.
Host denial of service (with potential low integrity impact) in the Linux kernel's KVM/arm64 hypervisor allows a local attacker with guest execution privileges to trigger a TLB invalidation range overflow, corrupting hypervisor state. The flaw affects kernels approximately from 6.16 until the fixes in 6.18.51, 7.2.5, and 7.3-rc1, and requires the guest to issue TLB Invalidation by Range operations with an attacker-chosen virtual address. No public exploit code is identified at time of analysis.
A use-after-free in the Linux kernel GTP (GPRS Tunnelling Protocol) module allows a local attacker who can create GTP links to trigger a race between link teardown and inbound packet processing, potentially leading to kernel memory corruption with high confidentiality, integrity, and availability impact. Only systems that have the gtp module loaded or reachable are exposed - a mobile-core/telecom feature uncommon in general-purpose Linux deployments - and exploitation requires CAP_NET_ADMIN (obtainable by an unprivileged user within a user namespace) plus a non-deterministic race win, which is why our independent assessment rates the vector AV:L/AC:H/PR:L rather than the published AV:L/AC:L/PR:L. No public exploit code has been identified at time of analysis (EPSS 0.21%, 11th percentile) and the issue is not confirmed actively exploited (CISA KEV).
Missing VM_MAYWRITE clearing in the Linux kernel's ublk (userspace block driver) character-device mmap path allows the local ublk server daemon to take a read-only mapping of the per-queue command buffer and upgrade it to writable with mprotect(), giving it write access to kernel-owned ABI data. Because the command buffer holds struct ublksrv_io_desc entries (addr, op_flags, nr_sectors, start_sector) that the kernel populates and consumes, an attacker controlling a ublk device instance can corrupt those fields from an unprivileged process, yielding high confidentiality and integrity impact with a local CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is entirely local and requires the ublk subsystem to be built and in active use; EPSS is low at 0.21% (11th percentile), no public exploit has been identified at time of analysis, and the issue is not in CISA KEV, though the fix commit notes the bug was reproduced with an mprotect() proof-of-concept under KASAN before the patch was applied.
A local privilege-escalation use-after-free exists in the Linux kernel perf subsystem: an unprivileged local user can win a tight race between perf_mmap_close() and a concurrent perf_mmap_rb() revival so that a freshly revived ring buffer is freed while another process still has it mapped, yielding page-level memory corruption and a path to root. The bug is reachable under the default kernel.perf_event_paranoid=2 setting (authenticated local account per the CVSS vector PR:L, no user interaction), so hardening the setting or restricting perf_event_open is the practical interim control. Vendor-released patches are available (6.18.52, 7.2.5, 7.3-rc2), the EPSS score is low at 0.19% (9th percentile), and no public exploit code has been identified at time of analysis - but exploitation is local-only and probabilistic, requiring repeated attempts to hit the TOCTOU window.
A race condition in the Linux kernel's KVM s390 (IBM Z) keyop path lets a local user who already holds a KVM VM file descriptor cause gmap->asce to be read without the mmu_lock, potentially using a stale address-space-control element and corrupting memory. Exploitation requires s390 hardware, VM-fd access, and issuing KVM_S390_KEYOP concurrently with KVM_S390_VM_MEM_LIMIT_SIZE so that keyop reads asce while gmap_set_limit() mutates it under the write lock; it is timing-dependent, not remotely reachable, and no public exploit has been identified at time of analysis. The upstream fix has been merged and shipped in stable Linux 7.2.5 and 7.3-rc1, though an independent assessment rates real-world impact lower than the 7.8 base score by downgrading attack complexity to High and scope/confidentiality impact to None/low integrity, high availability.
Incorrect jump-offset calculation in the LoongArch BPF JIT of the Linux kernel can emit wrong tail-call branch targets, causing soft lockups (high availability impact) and, per the assessed vector, limited integrity impact, while confidentiality is unaffected. Affected are LoongArch (Loongson) systems running vulnerable kernel branches including the 6.1.x, 6.6.x, 6.12.x, 6.15.x, 6.16.x and 6.17 lines; exploitation requires local access plus the capability to load eBPF programs into the kernel (CAP_BPF or CAP_SYS_ADMIN, since unprivileged BPF is disabled by default), and only manifests when extra JIT passes occur, so it is not a deterministic single-request trigger. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the assessed severity is lower than the headline 7.8 because the flaw is architecture-specific, capability-gated and condition-dependent; vendor-released patches are available in 6.18.51, 7.2.5 and 7.3-rc1.
A race in the LoongArch rethook/kretprobe trampoline allows the per-CPU base register ($r21/$u0) to be restored with a stale value after a probed task is preempted and migrated to a different CPU, causing this_cpu_*() accesses (runqueues, RCU per-CPU data, timer tick programming, FPU ownership) to hit the wrong CPU's percpu area and ultimately corrupting scheduler and timer state. The result under heavy kretprobe load is scheduling-while-atomic splats, wrong-CPU RCU warnings, WARN_ON_ONCE(rq != this_rq()) in nohz_balance_exit_idle(), and in the worst case a CPU parking in the idle loop with its timer never re-armed, i.e. a hard lockup and denial of service. Only LoongArch systems running a preemptible kernel with active kretprobes/rethook are affected, and arming kretprobes normally requires CAP_SYS_ADMIN/CAP_PERFMON (root-equivalent), so this is not reachable by unprivileged local users in default configurations; there is no public exploit identified at time of analysis and no confirmed active exploitation.
A preempt-count underflow in the Linux kernel's LoongArch Kprobes breakpoint handling allows a local, low-privileged user to issue the same break 11 instruction that userspace can generate, driving do_bp() into kprobe_singlestep_handler() with no active probe attached and calling preempt_enable_no_resched() without the matching preempt_disable() that kprobe_breakpoint_handler() would normally have performed. Only LoongArch (loongarch64) kernels with Kprobes enabled are affected-other architectures do not use this break-11 path-and the corrupted preempt state makes in_interrupt() return true until the task reschedules, which causes cgroup_sk_alloc() to attribute new sockets to the root cgroup and can thereby evade a BPF_CGROUP_INET_SOCK_CREATE policy bound to the task's own cgroup. No public exploit code identified at time of analysis and the flaw is not listed in CISA KEV; the vendor CVSS of 7.8 overstates practical severity, since independent assessment limits impact to integrity and availability (Low) with no confidentiality impact and notes the notable security consequence requires a BPF cgroup socket-create policy to be present.
A race condition in the Linux kernel HDMI-CEC core (drivers/media/cec) lets a local user who can open a CEC character device (/dev/cecN) free an in-flight transmit data structure while its delayed work item is still pending, corrupting kernel state and typically crashing the system. Exploitation requires a CEC-capable adapter, permission to the device node, and a signal delivered at a narrow timing window between cancel_delayed_work_sync() and the kthread's schedule_delayed_work(&data->work) in cec_transmit_done_ts() - no public exploit code has been identified at time of analysis, and the impact is a denial of service via the debugobjects 'free active' path rather than information disclosure. Vendor-released patches exist in stable trees (6.12.110, 6.18.51, 7.2.5) and in 7.3-rc1; the affected surface is effectively absent on headless servers and most virtualized deployments without CEC hardware.
A heap out-of-bounds write in the Linux kernel's cx231xx USB video-capture driver allows a local, authenticated user (CVSS PR:L) who can open the device's V4L2 video and VBI nodes to corrupt kernel heap memory by resizing the device-wide frame geometry while a VBI stream is already running. The driver latches the VBI plane size at buffer-allocation time but recomputes the destination offset from the live dev->width and dev->norm on every URB completion, so an attacker can allocate a small VBI plane (small width or the NTSC standard), start VBI streaming, then enlarge dev->width via VIDIOC_S_FMT or switch dev->norm to PAL via VIDIOC_S_STD through the video node - the pre-patch code only checks the video queue (dev->vidq), not the VBI queue (dev->vbiq) - and have the device deliver a field-2 payload, causing cx231xx_do_vbi_copy() to memcpy() past the end of the smaller plane with an attacker-chosen offset and device-controlled contents. Vendor patches exist for Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51 and 7.2.5 (mainline 7.3-rc1); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical impact is bounded by the requirement for physical or emulated cx231xx hardware plus a race against live URB completion (the independent assessment scores this AV:L/AC:H with C:L, below the vendor's 7.8 High).
A use-after-free in the Linux kernel's cx23885 media driver lets a local attacker with low privileges (CVSS PR:L) corrupt or crash the kernel by triggering a race during teardown of a Conexant CX23885-based NetUP DVB conditional-access (CI) device. The NetUP CI work item netup_read_ci_status() can still be pending or executing on the system workqueue when netup_ci_exit() frees the associated netup_ci_state, because the removal path calls free_irq() (which stops new interrupts but does not drain already-queued work) before the CI device is unregistered; the fix inserts cancel_work_sync() before dvb_ca_en50221_release() and kfree(). Practical risk is materially lower than the headline score: our assessment rates this AV:L/AC:H (the upstream vector is AV:L/AC:L) because exploitation requires the specific NetUP CI hardware and feature to be active plus a narrow removal-time race window (module unload, device unbind, or physical hot-unplug), and there is no public exploit identified at time of analysis. Vendor-released patches exist for the affected stable series (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, and 7.2.5/7.3-rc1).
A use-after-free in the Linux kernel's go7007 media driver allows a local user who can open the driver's ALSA capture PCM node to trigger memory corruption by keeping that PCM file open across a device removal or unbind event (for example, a USB unplug). The flaw is a lifetime mismatch: go7007_snd_remove() releases the v4l2_device reference immediately after snd_card_free_when_closed(), even though the ALSA card - and its PCM callbacks reaching struct go7007 through pcm->private_data - can stay alive until the last file is closed, so go7007_snd_hw_free() may run against an already-freed object. Per the independent assessment the vector is local-only (AV:L, PR:L, AC:H) with high availability impact and limited confidentiality/integrity impact, and successful, reliable triggering requires the specific WIS GO7007 hardware to be present and the teardown timing window to be won; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV. Vendor-released patches are available in the stable branches listed below.
Use-after-free in the Linux kernel's ov02a10 MIPI CSI-2 sensor driver (media: i2c) can abort or destabilize driver probe on systems that physically include an OmniVision OV02A10 camera together with a firmware/device-tree description that binds that driver. The ov02a10_check_hwcfg() function calls fwnode_handle_put() on the parsed endpoint and then reads the optional 'ovti,mipi-clock-voltage' property through the same stale handle, while also letting the failure code from that optional property overwrite the function's return value, so probe can fail even when nothing else is wrong. Affected code ships from Linux 5.11 onward and is fixed in 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 and 7.3-rc1; no public exploit has been identified at time of analysis, and although the vendor scored this 7.8 (HIGH), real-world risk is LOW because the path is reachable only in kernel probe context on specific sensor hardware and is not a remote or user-controllable trigger.
A teardown-order defect in the Linux kernel's ov7740 i2c camera-sensor driver causes a use-after-destroy and a double-free when the driver is unbound or the OmniVision OV7740 sensor is physically removed, panicking the kernel or otherwise taking the system down. Only systems that ship an OV7740 sensor with the CONFIG_VIDEO_OV7740 driver built or loaded are affected, so exposure is limited to specific embedded/SoC platforms. The flaw is local-only, cannot be triggered by an unprivileged process on a default configuration, and no public exploit identified at time of analysis; the vendor scores it 7.8, whereas our reassessment is lower (AV:L/AC:H/PR:L/UI:N/C:N/I:L/A:H) because the realistic impact is a crash rather than code execution or data disclosure - the accompanying 'Information Disclosure' tag is not supported by the assessed vector.
The Linux kernel's sunxi-cir driver (Allwinner CIR/IR receiver, media/rc subsystem) fails to unregister the rc device when probe fails after rc_register_device() has already succeeded, leaving the registration and its resources behind. This is a local, low-severity driver lifecycle bug: the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, since the fault requires a genuine probe failure at IRQ lookup, IRQ request, or hardware initialization - conditions that are not attacker-controllable in a default configuration and generally need local privileged access (forced bind/unbind, resource exhaustion, or device-tree/IRQ faults) to induce. No public exploit code has been identified at time of analysis, and vendor-released fixes exist in stable kernels including 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, and 7.2.5.
Out-of-bounds array reads in the Linux kernel's Rockchip rkvdec stateless HEVC decoder allow a local user who can open the V4L2 mem2m decoder device node to trigger an unsigned integer underflow in short-term reference picture set (RPS) prediction, causing the driver to index far outside the calculated_rps_st_sets array. The flaw is reached by submitting an EXT_SPS_ST_RPS control with the INTER_REF_PIC_SET_PRED flag set and a crafted delta_idx_minus1 value that exceeds the current RPS index; the CVSS vector requires local access with low privileges (PR:L), so no third-party user interaction is needed but the attacker must already hold permissions on the decoder device. Impact is bounded to information disclosure and availability (the assessed vector is AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H), and it is confined to embedded Rockchip ARM platforms where the rkvdec driver is present and loaded; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). The vendor-published CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates real-world risk because exploitation demands specific hardware, driver availability, and a stateless decode session that raises attack complexity and limits the outcome to a memory read rather than code execution.
A missing error-path teardown in the Linux kernel's rtl2832_sdr SDR driver lets a local attacker with low privileges (PR:L) who can reach the V4L2/SDR device node for an RTL2832U-based USB dongle leak coherent DMA memory and trigger an out-of-bounds read/pass-garbage-pointer condition in USB URB cleanup. The defect only manifests when rtl2832_sdr_start_streaming() fails after allocation - realistically an induced -ENOMEM during alloc_stream_bufs()/alloc_urbs()/submit_urbs() - and is then followed by a second VIDIOC_STREAMON, which over-increments urbs_initialized past MAX_BULK_BUFS and causes rtl2832_sdr_free_urbs() to index beyond dev->urb_list[] before handing stale pointers to usb_free_urb(). The result is a resource leak and memory-corruption/denial-of-service condition rather than direct data theft, and our independent assessment scores this AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, materially below the vendor's 7.8 C:H/I:H/A:H rating; exploitation requires specific SDR hardware, the driver being loaded, and memory-pressure conditions, and there is no public exploit identified at time of analysis.
Use-after-free in the Linux kernel's TI VPE/VIP media capture driver (media: ti: vpe) allows a locally authenticated attacker who can open and stream from a VIP /dev/videoN node to trigger memory corruption by racing stream teardown against outstanding interrupt work. The driver's VIP overflow recovery worker - armed from the hardirq handler when a FIFO overflow is detected - and the VPDMA list-complete path both continue to dereference stream, port, and device state after vip_release_stream() or free_stream() has freed those resources, because vip_stop_streaming() masks the per-list IRQs without synchronizing the hardirq handler or disabling recovery_work. Exploitation requires local access plus the ability to induce a FIFO overflow and win a tight timing window against file release or unbind/remove, so our independent assessment rates this AC:H with limited confidentiality and integrity impact but high availability impact (NVD scores it 7.8 AV:L/AC:L/PR:L). No public exploit code was identified at time of analysis, and the flaw is hardware-specific to TI Davinci/OMAP/AM-class SoCs with VIP capture hardware.
Out-of-bounds array access in the Linux kernel V4L2 control framework for stateless HEVC decoders lets a local user who can write to a V4L2 device node (/dev/video*) supply HEVC SPS short-term and long-term reference picture set counts that exceed the HEVC limits of 64 ST RPS sets and 32 LT references, so a decoder driver that trusts those counts can index past the EXT SPS dynamic arrays. The published CVSS vector rates this as 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), whereas our independent assessment scores it lower (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H) because the flaw only manifests when a stateless HEVC decoder driver consumes the attacker-supplied counts without performing its own bounds validation; there is no public exploit identified at time of analysis and no CISA KEV entry. Vendor-released fixes are available in Linux 7.2.5 and 7.3-rc1.
Double-free in the Linux kernel's legacy zoran V4L2 media driver on teardown allows a local user who can trigger device/driver removal to kfree() the same registered video_device twice, crashing the kernel or corrupting kernel memory. Only systems where the zoran driver is bound to real Zoran ZR36057/ZR36067-based PCI MJPEG framegrabber hardware (Buz, DC10, LML33-class cards) are affected, and the flaw is reachable only through teardown paths such as module unload, PCI unbind/removal, or driver shutdown - not through normal runtime device I/O and not remotely. Vendor patches are available across maintained stable branches (6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5, and 7.3-rc1); exploitation requires the local authenticated context indicated by the CVSS vector (PR:L), and no public exploit code or confirmed active exploitation was identified at time of analysis. The practical impact is bounded to local denial of service because the affected hardware is obsolete and rarely deployed and the outcome is a crash rather than a controlled memory write.
A use-after-free read in the Linux kernel's qla2xxx SCSI driver allows a local low-privilege (authenticated) user on a host with a QLogic cs84xx-capable Fibre Channel HBA to dereference freed memory by reading the 84xx_fw_version sysfs attribute while the adapter is being torn down. The race is bounded to the teardown window between qla84xx_put_chip() freeing ha->cs84xx and scsi_remove_host() draining the sysfs show handler, and since the dereference in qla24xx_84xx_fw_version_show() is read-only the realistic impact is an information leak or kernel crash rather than controlled corruption, meaning the vendor CVSS of 7.8 overstates real risk for this narrow, hardware-dependent timing bug. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); vendor patches are available in the stable kernel releases listed in remediation.
A folio reference-count imbalance in the Linux kernel's f2fs filesystem lets a local user who can drive the redirty_blocks() path over-decrement a pinned folio when read_cache_folio() fails before any folio is pinned and readahead has already cached that same folio, after which drop_caches or reclaim can emit "BUG: Bad page state" and corrupt kernel memory state. Only kernels that include the folio-conversion commit 5951fee46bef are affected, i.e. Linux 6.16 through the fixed releases 6.18.51, 7.2.5 and 7.3-rc1. Exploitation requires local access with low privileges (CVSS:3.1/AV:L/PR:L) and is gated on a non-deterministic failure-plus-readahead race, so reliability is poor (AC:H); the independent assessment rates confidentiality impact as none with limited integrity and high availability impact, and no public exploit has been identified at time of analysis.
A use-after-put race in the Linux kernel's f2fs filesystem during large-folio invalidation allows a local low-privileged attacker who can concurrently drive a truncate or folio split against f2fs_get_read_data_folio() to leave stale xarray slots and corrupted page state in the page cache, resulting in livelocks, bad page statistics, and possible memory corruption. Only kernels built with f2fs large/compound folio support are affected - the flaw was introduced on the v6.18/7.0 development line (commit 05e65c14ea59a401cec4284e9d612f9d5dc1b3f8 and later) and is fixed in the vendor-released 7.2.5 stable update and 7.3-rc1. The vendor rates this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but independent assessment downgrades it to AC:H/C:L because a narrow timing window must be won and the outcome is memory corruption or denial of service rather than reliable code execution; no public exploit identified at time of analysis.
A missing dirty-flag clear on f2fs node folios in the Linux kernel's error-handling path can leave inconsistent node data unpersisted to storage, degrading on-disk filesystem consistency. The flaw is reachable only with local access (PR:L per CVSS vector) and requires encountering or supplying a corrupted f2fs node block (checksum mismatch or inconsistent footer information) to trigger the vulnerable code path. The vendor-assigned CVSS 3.1 score of 7.8 is materially over-scored per independent analysis, which assesses AV:L/AC:H/PR:L with no confidentiality impact and low integrity/availability impact; no public exploit identified at time of analysis, and vendor patches are available in stable kernel releases (6.18.51, 7.2.5, 7.3-rc1).
Incorrect node-block validation in the Linux kernel's f2fs filesystem causes f2fs_sanity_check_node_footer() to be invoked with the wrong folio index, so the sanity check re-validates the same nid instead of the node actually being read, allowing a local user who is permitted to mount a crafted or corrupted f2fs volume to bypass the intended footer validation and trigger out-of-range metadata access - most plausibly a kernel crash or denial of service. The affected code path is reachable only when an attacker-influenced f2fs image is mounted (CVSS AV:L, PR:L), and exploitation requires supplying malicious on-disk metadata, which raises real attack complexity. Vendor patches are available in stable releases 6.18.51 and 7.2.5 (plus mainline 7.3-rc1); no public exploit identified at time of analysis, and the CNA's boilerplate 7.8 HIGH score (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H) overstates the issue relative to the assessed vector AV:L/AC:H/PR:L/UI:N/C:L/I:L/A:H, whose dominant impact is availability loss.
Out-of-bounds memory access in the Linux kernel's drm/panthor driver for Arm Mali CSF-class GPUs, caused by 32-bit offset arithmetic wrapping before a bounds check in panthor_init_cs_iface() and panthor_init_csg_iface(). A local attacker with low privileges on a system that has CONFIG_DRM_PANTHOR loaded and a Mali CSF GPU present could influence firmware-provided control-interface strides/offsets to escape the mapped region, yielding potential information disclosure and memory corruption (high confidentiality, integrity, and availability impact per the assessed vector). Exploitation requires the ability to supply malicious or compromised firmware content and is rated high complexity in our independent assessment (AV:L/AC:H/PR:L/UI:N); no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation.
A race condition in the Linux kernel's Direct Rendering Manager (DRM) core allows a local low-privileged user to trigger use-after-free-style resource teardown by issuing an ioctl on a partially registered DRM device node. When drm_dev_register() fails after one minor (for example the render minor) has already been registered and opened by userspace, the error path tears down device resources without first setting the unplugged flag, so an in-flight drm_dev_enter() critical section can continue operating on freed state. The vendor rates this CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); our independent assessment keeps the same CIA and local/low-privilege prerequisites but raises attack complexity to High because the attacker must win a narrow window during a probe or hot-plug registration failure that is not normally under their control. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); vendor patches are available across the supported stable branches.