2026-09-16
Local privilege escalation in Dell Update Package (DUP) Framework versions prior to 26.07.03 lets a low-privileged local user obtain elevated privileges when a Dell Update Package is executed through the affected framework. Exploitation is not autonomous: per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) it requires an already-authenticated low-privileged local account plus user interaction to trigger the vulnerable code path, and the impact crosses a security boundary (S:C) with high confidentiality, integrity and availability consequences. There is no public exploit identified at time of analysis and no indication of confirmed active exploitation; the issue is rated 8.2 High, making it a credible but not urgent local escalation risk that is fully closed by upgrading to 26.07.03 or later.
OAuth access-token theft in the rmcp Rust SDK (the official Rust SDK for the Model Context Protocol) before 2.0.0 allows a malicious MCP server to harvest a victim's legitimate bearer token by publishing RFC 9728 protected-resource metadata that names a different, legitimate MCP resource together with that resource's authorization server. The OAuth client transport never verifies that the returned `resource` identifier matches the MCP server URL it was actually configured to contact, so a victim who connects and completes the normal authorization/consent flow receives a genuine access token and then sends it to the attacker's endpoint, letting the attacker replay it against the legitimate MCP resource within the granted scopes. Exploitation requires the user to be induced to connect to the attacker-controlled server and to complete consent (UI:R; CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, SSVC Automatable=no), publicly available exploit code exists per the SSVC exploitation signal, and there is no CISA KEV entry confirming active exploitation.
Denial of service in the RabbitMQ amqp091-go Go AMQP 0.9.1 client affects all releases prior to 1.13.0: the library's frame-dispatch path synchronously pushes publisher confirms, flow-control events, consumer cancellations, returned messages and connection-block notifications into application-registered listener channels, so an unbuffered, undersized or not-promptly-drained listener channel permanently blocks the connection's sole reader goroutine. Once that goroutine stalls, the client stops processing incoming frames, acknowledgments, deliveries and heartbeats, which leads to connection stalls, missed heartbeats, deadlocks and eventual broker-initiated disconnection; exploitation requires a broker-driven burst of the corresponding events against an application that registered an affected listener, rather than any attacker-supplied payload. Unauthenticated remote triggering is possible per the published PR:N vector, but only applications built on versions below 1.13.0 that back a notification listener with a small or undrained channel are exposed, and no public exploit code has been identified at time of analysis. The issue is fixed in v1.13.0, where each notification send is bounded by a 5-second timeout and slow deliveries are dropped instead of blocking the reader.
Memory exhaustion in the RabbitMQ amqp091-go Go AMQP 0.9.1 client library prior to 1.13.0 lets unauthenticated remote attackers who can influence an application's Qos settings make the client request an absurdly large prefetch limit and then buffer enough broker-delivered messages to exhaust host memory. Channel.Qos performs no bounds validation, so a negative prefetchCount or prefetchSize is cast straight into the uint16/uint32 fields of the basic.qos method and wraps to 65535 or 4294967295 instead of being rejected. The vendor CVSS 4.0 score of 8.2 (High) is availability-only and materially gated by the attack requirement that the embedding application accept untrusted Qos values; default usage with hard-coded, non-negative values is unaffected, and no public exploit code was identified at time of analysis. The defect is repaired in 1.13.0 via a new validateQos check.
Heap memory corruption in the userspace SMB daemon of MikroTik RouterOS before 7.24 lets remote, unauthenticated attackers crash or destabilize the service by sending a crafted SMB1 SessionSetupAndX request whose uniPwdLen field triggers an integer underflow and an oversized copy into a smaller heap buffer (CWE-122). The independently assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this as an availability-only impact - adjacent heap corruption in a userspace daemon, not a confirmed path to code execution - and the primary limiting factor is that the SMB service is not enabled by default on RouterOS. No public exploit code has been identified at time of analysis, and exploitation requires the SMB service to be enabled and network-reachable with legacy SMB1 dialect handling active; a vendor fix shipped in RouterOS 7.24.
An out-of-bounds write in Arista VeloCloud Edge and VeloCloud Gateway affects the VCMP tunnel protocol when it processes tunneled IP fragments, causing the affected process to crash and restart and briefly disrupting traffic on the affected SD-WAN node. Exploitation requires the attacker to already be an authenticated overlay neighbor with an established VCMP peer relationship to the target (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) - internet hosts that are unauthenticated and cannot form an overlay peer relationship cannot reach the vulnerable logic. No public exploit code has been identified at time of analysis; the impact is bounded to a temporary availability loss, with no code execution or data compromise demonstrated.
Denial of service in the Linux kernel's NVMe-over-TCP (nvme-tcp) host driver, where nvme_tcp_handle_c2h_data() accepts a controller-to-host data PDU for a command that did not request a read; the receive path then hits WARN_ON_ONCE(i->data_source) inside _copy_to_iter(), returns -EFAULT, and resets the controller. The impacted component is the initiator side of the NVMe-oF TCP transport, so hosts are only at risk when they attach to a malicious or compromised NVMe-oF TCP target that can dictate PDU sequencing; there is no public exploit identified at time of analysis, and the practical severity is modest because the trigger requires control of the storage controller the host talks to (inverted trust model). Impact is normally limited to a failed command plus a controller reset, but on hosts booted with panic_on_warn the same warning becomes an immediate kernel panic and full system outage, which is the key amplifying condition behind the assigned A:H rating.
Cross-site request forgery in djust's Server-Sent-Events transport affects all versions prior to 1.0.7 and allows a cross-origin attacker page to drive a victim's cookie-authenticated SSE session, firing state-changing LiveView event handlers as that victim. Remote attackers need no authentication of their own, but exploitation requires the victim to be lured to an attacker-controlled page while holding an active authenticated djust session and while the SSE transport is enabled (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - integrity impact only, no confidentiality or availability impact). The flaw is fully fixed in 1.0.7 (Origin validated against ALLOWED_HOSTS with 403 for cross-origin requests, and POST endpoints now requiring Content-Type: application/json with 415 otherwise); no public exploit code was identified at time of analysis and the CVE has not been listed in CISA KEV.
Improper authentication in Dell ObjectScale versions prior to 4.4.0.0 allows remote, unauthenticated attackers to bypass authentication and gain unauthorized access to the platform, with full impact to confidentiality, integrity, and availability (CVSS 3.1 8.1 High). The High attack complexity (AC:H) indicates exploitation requires satisfying a non-trivial precondition - such as a timing window or a specific system state in the authentication flow - rather than a single deterministic request, and no public exploit code has been identified at time of analysis. Only deployments running ObjectScale 4.4.0.0 and later are remediated, so older installations exposed on reachable management or S3 interfaces should be prioritized for upgrade.
Missing authorization enforcement in the Keycloak policy enforcer lets an authenticated user bypass path-based security policies in Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments, gaining access to administrative or private application endpoints that the configured policies intended to protect. The flaw lies in how the enforcer normalizes request URLs containing encoded semicolons or directory-traversal segments, causing it to select a less restrictive policy than the one the backend application ultimately resolves to. Exploitation requires a valid account (even low-privileged), network reachability and an application deployed behind the policy enforcer using path-based authorization; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited. Red Hat has published errata addressing the defect.
Client-side cross-site scripting in @nuxtjs/mdc before 0.22.1 allows attackers to execute arbitrary JavaScript in the page origin by smuggling executable URLs past the module's built-in Markdown sanitizer. Because parseMarkdown runs with allowDangerousHtml enabled by default and the sanitizer (validateProps/validateProp plus unsafeLinkPrefix) is the only defense, two sibling gaps are exploitable: an SVG anchor xlink:href (surfaced as the xLinkHref prop) carrying a javascript: URL, and an iframe src set to data:text/html that survives because the denylist compares url.protocol ('data:') rather than the full URL. The vendor rates this CVSS 8.1, the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (unauthenticated per PR:N), and exploitation requires an application that renders attacker-controlled Markdown through the vulnerable versions. No CISA KEV listing or public exploit code was identified at time of analysis, though the fix PR (#491) and its regression tests publicly document both bypass payloads.
Authorization bypass in @fastify/auth versions 5.0.0 through 5.1.0 lets an authenticated low-privileged attacker who possesses a credential satisfying only the final member of a nested AND group, such as a valid API key without administrator rights, be authorized instead of rejected. The flaw occurs when strategies are composed with the relation "or" option together with the run "all" option and an entry is a nested array acting as an AND group, causing the group result to collapse to its last check; a mirror order-dependent bypass exists for top-level relation "and" with a nested "or" group. No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation; the vendor-released fix is version 5.1.1 or later.
An out-of-bounds read in the Linux kernel's Wacom Bluetooth HID driver (wacom_intuos_pro2_bt_irq) allows an attacker in Bluetooth range who controls, spoofs, or merely operates a malfunctioning paired peripheral advertising a Wacom Intuos Pro/Intuos BT VID/PID to make the kernel parse a report shorter than the branch's fixed offsets, reading past the end of the received buffer. Because the driver force-registers pen, pad and touch input nodes for the matched device type via wacom_setup_device_quirks(), the leaked bytes are forwarded to userspace through evdev (MSC_SERIAL, ABS_MISC, ABS_WHEEL), giving a concrete confidentiality channel in addition to the immediate availability impact of a kernel OOB access on short descriptors. The reported CVSS is 8.1 (AV:A/AC:L/PR:N/UI:N), while our independent assessment rates it CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - still adjacent and unauthenticated from a credential standpoint, but requiring the victim to pair/trust the hostile peripheral and, for any real confidentiality payoff, a local process consuming the evdev stream. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (not CISA KEV); vendor patches are available in current stable trees.
A race condition in the Linux kernel's qla2xxx QLogic Fibre Channel driver allows a concurrent vport deallocation to free an NPIV virtual port while the format-1 report-ID-acquisition path still dereferences it, producing a use-after-free. The flaw is reachable only on systems that run a qla2xxx-driven QLogic FC HBA with NPIV virtual ports configured and that grant an attacker the local privilege needed to create and tear down virtual ports; the window is narrow (AC:H) and no attacker-controlled network input reaches the freed pointer, so the realistic outcome is a kernel crash or denial of service rather than controlled memory corruption. An independent assessment rates this CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, notably lower than the published AV:N/PR:N vector, and no public exploit has been identified at time of analysis.
Use-after-free in the Linux kernel qla2xxx QLogic Fibre Channel SCSI driver lets a local user who can trigger queue-pair teardown reach freed request-queue memory through a late response-queue interrupt. On hosts with a QLogic FC HBA using MSI-X multiqueue qpairs, qla2xxx_delete_qpair() frees the request queue via qla25xx_free_req_que() before the response-queue IRQ is released in qla25xx_free_rsp_que(), so a response interrupt firing in that window causes qla2xxx_msix_rsp_q() to queue qpair->q_work and qla_do_work() -> qla24xx_process_response_queue() to dereference the now-freed rsp->req (LOGINOUT/CT/ELS entries and the status path). The result is full memory corruption with high confidentiality, integrity, and availability impact, but exploitation requires winning a narrow local race during qpair deletion; no public exploit code or active exploitation was identified at time of analysis, and vendor patches are available.
Out-of-bounds access in the Linux kernel MTD AFS (ARM Flash Structure) v2 partition parser lets crafted flash contents drive the image-information offset and region count beyond the bounds of the local image-info array, producing a kernel memory-safety fault during partition scanning. The code path is only reachable on platforms that enable and scan AFS v2 partitions, and per the independent assessment exploitation requires a local actor with high privileges (PR:H) - root or CAP_SYS_ADMIN write access to the raw MTD device, or physical replacement/tampering of the flash chip - with the malicious data consumed when the kernel parses the partition table at boot or device attach. It is deterministic once the crafted flash is in place, and no public exploit identified at time of analysis; the CVE carries an NVD base score of 8.0 while cross-checked analysis places the practical risk substantially lower because there is no remote or unprivileged path. Vendor-released fixes are available in the stable trees listed below.
An out-of-bounds read in the Amlogic Meson GXBB clock controller driver causes a kernel global-out-of-bounds report (KASAN: read of size 8 in gxbb_32k_clk_parents) during clock registration at boot on GXBB-based boards such as the WeTek Hub. The defect comes from a mux parent count that was left hard-coded after a stale parent entry was removed, so the driver walks one slot past the end of its parent array; affected code shipped in stable kernels including 5.4.292+, 5.10.236-5.10.269, 5.15.180-5.15.220, 6.1.134-6.1.187, 6.6.87-6.6.156, 6.12.23-6.12.109, 6.13.11-6.13.x, 6.14.2-6.14.x and the 6.15 mainline series, and is fixed in newer stable releases (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5, 7.3-rc1). There is no public exploit identified at time of analysis and no CISA KEV listing, and nothing more than a local unauthenticated vector exists in the CVSS data (AV:L, PR:N); our independent assessment rates it CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, far below the vendor's 8.0 vector, because the read is triggered solely by the driver's own probe and is not controllable by any user, network input, or configuration toggle.
Host denial of service (with potential low integrity impact) in the Linux kernel's KVM/arm64 hypervisor allows a local attacker with guest execution privileges to trigger a TLB invalidation range overflow, corrupting hypervisor state. The flaw affects kernels approximately from 6.16 until the fixes in 6.18.51, 7.2.5, and 7.3-rc1, and requires the guest to issue TLB Invalidation by Range operations with an attacker-chosen virtual address. No public exploit code is identified at time of analysis.
A use-after-free in the Linux kernel GTP (GPRS Tunnelling Protocol) module allows a local attacker who can create GTP links to trigger a race between link teardown and inbound packet processing, potentially leading to kernel memory corruption with high confidentiality, integrity, and availability impact. Only systems that have the gtp module loaded or reachable are exposed - a mobile-core/telecom feature uncommon in general-purpose Linux deployments - and exploitation requires CAP_NET_ADMIN (obtainable by an unprivileged user within a user namespace) plus a non-deterministic race win, which is why our independent assessment rates the vector AV:L/AC:H/PR:L rather than the published AV:L/AC:L/PR:L. No public exploit code has been identified at time of analysis (EPSS 0.21%, 11th percentile) and the issue is not confirmed actively exploited (CISA KEV).
Missing VM_MAYWRITE clearing in the Linux kernel's ublk (userspace block driver) character-device mmap path allows the local ublk server daemon to take a read-only mapping of the per-queue command buffer and upgrade it to writable with mprotect(), giving it write access to kernel-owned ABI data. Because the command buffer holds struct ublksrv_io_desc entries (addr, op_flags, nr_sectors, start_sector) that the kernel populates and consumes, an attacker controlling a ublk device instance can corrupt those fields from an unprivileged process, yielding high confidentiality and integrity impact with a local CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is entirely local and requires the ublk subsystem to be built and in active use; EPSS is low at 0.21% (11th percentile), no public exploit has been identified at time of analysis, and the issue is not in CISA KEV, though the fix commit notes the bug was reproduced with an mprotect() proof-of-concept under KASAN before the patch was applied.
A local privilege-escalation use-after-free exists in the Linux kernel perf subsystem: an unprivileged local user can win a tight race between perf_mmap_close() and a concurrent perf_mmap_rb() revival so that a freshly revived ring buffer is freed while another process still has it mapped, yielding page-level memory corruption and a path to root. The bug is reachable under the default kernel.perf_event_paranoid=2 setting (authenticated local account per the CVSS vector PR:L, no user interaction), so hardening the setting or restricting perf_event_open is the practical interim control. Vendor-released patches are available (6.18.52, 7.2.5, 7.3-rc2), the EPSS score is low at 0.19% (9th percentile), and no public exploit code has been identified at time of analysis - but exploitation is local-only and probabilistic, requiring repeated attempts to hit the TOCTOU window.
Zip-slip path traversal in the Stanford NLP Stanza Python library before 1.14.0 lets a malicious model or resource archive write files outside the intended model directory, overwriting anything writable by the Stanza process and potentially achieving code execution via modified shell configuration, SSH authorized_keys, Python packages, or executable scripts. The vulnerable code path is reached when a victim runs stanza.download() or stanza.install_corenlp(); exploitation therefore requires the fetched archive to be attacker-controlled (compromised or malicious mirror, MITM of the transfer, or a victim-supplied resource URL) plus user interaction to initiate the download. Rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and tracked as CWE-22; unauthenticated per the PR:N vector but local and interaction-dependent, with no public exploit identified at time of analysis and a vendor patch available in 1.14.0.
The Linux kernel's drm/xe Intel GPU driver mis-computes the end of usable VRAM by rounding the flat CCS compression-storage base upward instead of downward, so a small tail of memory that belongs to the GPU's compression hardware is handed to the normal VRAM allocator as free. On affected Intel Xe hardware whose scaled flat CCS base is not 128 KiB aligned - for example a Battlemage G21 with 16 GiB, where the raw base 0x3fafff800 sits just 2 KiB below an aligned boundary - the allocator can place live kernel structures on that page, and the compression hardware then overwrites them at boot with no page-table entry, buffer object or GPU submission required, producing deterministic corruption and, in the reported case, a persistent black screen with gdm restarting in a loop. The independent assessment rates real-world risk much lower than the vendor CVSS of 7.8: exploitation is not attacker-triggered, depends entirely on unlucky hardware geometry, and no public exploit code has been identified at time of analysis, so this is best treated as a reliability/correctness defect with local integrity and availability consequences rather than a remotely reachable memory-corruption bug.
Kernel crashes or potential privilege escalation can occur in uniprocessor (non-SMP) Linux kernels when a BPF program executing in NMI context reaches the free_pages_nolock() path, due to an unsafe spin_trylock() call. This vulnerability affects only systems built with CONFIG_SMP=n, and while the alloc-side equivalent was already fixed, the free side remained vulnerable. No public exploit has been identified at time of analysis; the vendor did not reproduce the crash but acknowledges a probable privilege escalation impact, though our assessment rates availability impact as high and integrity impact as low.
A use-after-free in the Linux kernel's USB gadget FunctionFS (f_fs) implementation allows a local user with access to a mounted functionfs instance to crash or corrupt the kernel by racing an asynchronous I/O request against the exit of the task that submitted it. The bug is reachable only on systems operating in USB device/gadget mode with FunctionFS configured (predominantly Android and embedded devices), requires the attacker to be able to submit AIO against the ffs endpoint files, and is timing-sensitive; it is not reachable on ordinary USB-host servers or workstations. Exploitation is local (AV:L, PR:L per the CVSS vector), no public exploit code has been identified at time of analysis, and the vendor score of 7.8 materially overstates real-world risk because the race is narrow and the reachable impact in practice is predominantly denial of service rather than full confidentiality, integrity, and availability compromise.
A use-after-free race condition in the Linux kernel's USB gadget FunctionFS (f_fs) driver can crash a system that is configured in USB peripheral/gadget mode, when a local attacker with access to the FunctionFS endpoint files submits asynchronous AIO reads or writes and concurrently issues cancellation calls against them. The vendor scores this 7.8 (AV:L/AC:L/PR:L/C:H/I:H/A:H), but our independent assessment is more conservative (AV:L/AC:H/PR:L/C:N/I:L/A:H): exploitation requires winning a narrow free-versus-cancel race in the ffs_epfile_io() error path and results in a kernel crash - a denial-of-service - rather than code execution or data disclosure. It is local-only and limited to gadget-mode systems; ordinary hosts, servers and desktops that are not acting as USB gadgets are not exposed, and no public exploit has been identified at time of analysis.
Improper bit placement in the Linux kernel's zram slot-locking code allows a local, authenticated user on 64-bit big-endian systems (s390x, big-endian ppc64, sparc64) to corrupt a per-slot lock word, which can let two CPUs take the same slot lock simultaneously or leave a slot appearing permanently locked, yielding low integrity impact and possible hangs or availability loss. Exploitation requires a 64-bit big-endian kernel built with ZRAM_TRACK_ENTRY_ACTIME enabled, active zram usage (swap or block device) with local activity reaching mark_slot_accessed()/slot_free(), and a successful concurrency race; little-endian architectures such as x86-64 and arm64 are unaffected because the lock bit lands in the correct half of the word there. No public exploit has been identified at time of analysis, and although the vendor assigns CVSS 7.8 (AV:L/AC:L/PR:L/C:H/I:H/A:H), the independent assessment (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) rates real-world risk materially lower given the big-endian-only, race-dependent, non-default-config prerequisites.
A use-after-free in the Linux kernel's usbtv media driver ALSA audio path can crash the kernel or trigger limited memory corruption when a Fushicai USBTV007 USB analog TV/audio capture device is physically disconnected while a local user still has the PCM substream open. The driver frees its per-device state (struct usbtv) during the disconnect path while ALSA still references it via pcm->private_data, so a later snd_usbtv_pcm_close() dereferences freed memory; the kernel fix takes an extra V4L2 device reference for the lifetime of the ALSA card and releases it in the card's private_free callback. Vendor CVSS is 7.8, but the independent assessment rates the practical risk lower (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) because exploitation requires the specific USB hardware, a local user with ALSA access, a USB unplug race, and yields no confidentiality impact under assessment; no public exploit code or confirmed active exploitation was identified at time of analysis.
Incorrect forceRM handling during EndTransfer in the Linux kernel's dwc3 USB gadget driver can leave a transfer aborted via ep_dequeue still active on Synopsys DWC_usb31 v2.00a/v2.10a controllers, so a later StartTransfer on the same endpoint writes into a DMA buffer that was already unmapped and raises an SMMU/IOMMU fault, producing a denial-of-service condition. Only systems running a vulnerable kernel with those specific controller revisions in USB gadget mode behind an SMMU are affected, and exploitation requires local authenticated access (CVSS PR:L) to the gadget/endpoint path rather than remote or crafted network input. No public exploit identified at time of analysis, and the vendor CVSS of 7.8 (C:H/I:H/A:H) is assessed as overstated; the realistic impact is availability-only (assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).
A race condition in the Linux kernel's Qualcomm PMIC USB Type-C driver (qcom-pmic-typec) can leave the cc_debounce_dwork delayed work queued after the port is torn down, resulting in a use-after-free once devres frees the pmic_typec_port structure. Systems running affected kernels from roughly 6.5 through the unfixed 6.12.110/6.18.51/7.2.5 baselines on Qualcomm PMIC Type-C hardware - typically Snapdragon-based phones and embedded boards - are exposed. Exploitation requires local privileged access (root or CAP_SYS_ADMIN) to trigger the port_stop()/tcpm_unregister_port() teardown path and the ability to win a narrow TCPM-kthread timing race; no public exploit code has been identified at time of analysis, and the independent assessment rates the practical severity lower than the vendor's published CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8), assigning AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H instead.
A use-after-free race in the Linux kernel's Qualcomm PMIC USB Type-C Power Delivery PHY driver (qcom-pmic) can be triggered during driver teardown: pdphy_stop() disables the PD interrupts but does not flush the pending reset_work work item, so if the IRQ handler schedules that work just before disable_irq() takes effect, the work can execute after remove() has already freed the containing structure through devm. Reachability is narrow - it requires local privileged access (the ability to unbind/remove the driver, typically root-gated), the specific Qualcomm PMIC Type-C hardware, and winning a tight timing window, so the assessed vector is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H rather than the higher base score sometimes published. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the flaw was found by an in-house static analysis tool.
Use-after-free in the Linux kernel's USB MIDI 2.0 gadget function driver (f_midi2) allows a local attacker who already holds privileged access to the gadget configfs interface to corrupt or read freed memory by winning a narrow race between a string attribute's show path and a concurrent store. The show handler f_midi2_opts_str_show() dereferences opts->info.<field> before acquiring opts->lock, while f_midi2_opts_str_store() frees the previous string under that same lock, so a colliding read can touch a pointer that has already been released - affecting iface_name, block name, and the EP string option attributes. Exploitation requires CAP_SYS_ADMIN-level local access to configfs on a kernel built with USB gadget support and f_midi2 configured; it is not remotely reachable, and no public exploit code or confirmed active exploitation was identified at time of analysis. NVD scores this at CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while our independent assessment rates it lower (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H) because of the privileged prerequisite and the narrow, timing-dependent race window.
A use-after-free in the Linux kernel ftrace tracing subsystem lets a privileged local user crash the machine by racing a read of the newly added per-instance show_event_filters or show_event_triggers files against deletion (rmdir) of the trace instance those files belong to. The bug affects kernels that ship these files, i.e. roughly Linux 7.0 through the pre-fix 7.2.x and 7.3-rc series, and it was resolved by taking a trace_array reference in the files' open path (commits f4a771cc684c and 2ee3f7d43f79). Exploitation requires local access to a mounted tracefs, PR:H privileges per the assessed vector (normally root/CAP_SYS_ADMIN), and winning a tight timing race; there is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV), so real-world risk is far below the headline 7.8 score.
A local use-after-free race in the Linux kernel's ftrace/tracing subsystem allows a task that has opened one of the per-instance options files to crash the kernel when a second task concurrently removes the tracing instance that option belongs to. Only systems with ftrace/tracing instances enabled and with access to the tracing filesystem (tracefs/debugfs, normally root- or CAP_SYS_ADMIN-gated) are affected; the open path never took a trace_array reference, so instance removal frees the options descriptor that the first task is still using. The vendor rates this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but our independent assessment scores it 4.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H) because exploitation needs root-equivalent tracefs access and requires winning a narrow race window, with a realistic outcome of kernel crash/denial of service rather than code execution; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and vendor patches are available in the stable trees.
An out-of-bounds write in the Linux kernel's SCSI bsg io_uring completion path allows a local attacker with low privileges (CVSS PR:L) to overrun a user-supplied response buffer that is smaller than SCSI_SENSE_BUFFERSIZE, because the completed sense length is copied back without being capped to the caller's max_response_len. The io_uring-backed bsg passthrough interface that exposes the flaw was introduced in kernel 7.1 and is fixed in 7.2.5 and 7.3-rc2, so exposure is limited to very recent kernels on hosts where a bsg device node is reachable; no public exploit identified at time of analysis. The vendor's CVSS 7.8 (C:H/I:H/A:H) overstates real-world risk - our independent assessment scores it C:N/I:L/A:H, with the impact largely a memory-corruption/denial-of-service concern rather than a full confidentiality breach.
Local privilege escalation in the Linux kernel's SCSI bsg io_uring passthrough path (bsg_uring_cmd) allows an authenticated low-privileged local user (PR:L) to corrupt kernel memory via an out-of-bounds write, potentially escalating privileges or crashing the host. The handler validates fields read directly out of the user-shared, mmap'd io_uring SQE, so a racing thread can enlarge request_len after the bound check but before copy_from_user(), overflowing the fixed-size scmd->cmnd buffer inside the kernel. Affected are kernels built with bsg io_uring passthrough support (EUVD lists Linux 7.1 in the affected commit range), with exploitation requiring local access to a /dev/bsg device node plus a multi-threaded racer that wins a narrow check-to-use window; the vendor rates it 7.8 while the independent assessment agrees it is a genuinely serious bug but raises attack complexity to AC:H because success is probabilistic per attempt. No publicly available exploit code was identified at the time of analysis, and no KEV listing was provided.
An out-of-bounds write in the Linux kernel's megaraid_sas driver (megasas_make_prp_nvme) lets a locally present user submitting large block I/O to an NVMe drive behind a Broadcom/LSI MegaRAID controller overflow the cmd->sg_frame DMA pool buffer, corrupting such a list to run up to a full page past its allocation. The flaw is only reachable on Linux 6.17 and later, after block commit 9b8b84879d4a raised the default maximum transfer size to 4 MiB, and on drives whose firmware reports a large MDTS so max_hw_sectors is not clamped; systems with small-MDTS drives never hit the condition. Per the independent assessment, the vendor score of 7.8 overstates real-world risk (assessed AV:L/AC:H/PR:L with C:N/I:L/A:H): exploitation requires local access plus specific storage hardware, is not remotely reachable, and no public exploit was identified at time of analysis. Consequences range from a kernel page fault and crash (availability) to silent corruption of a neighbouring in-flight command's PRP list when the following page happens to be mapped.
Linux kernel pm8001 SAS/SATA HBA driver contains an error-path cleanup bug that can leave MSI-X interrupt handlers installed when request_irq() fails during driver initialization, because the rollback loop uses the failing index instead of the previously registered vector index. Systems with a PMC-Sierra/Adaptec 8001-series controller bound to the pm8001/pm80xx driver and kernel versions from 4.11 up to the fixed releases are affected. The issue is not attacker-reachable-it requires a non-attacker-influenced interrupt allocation failure-so independent assessment rates it low-impact availability-only (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L), and no public exploit has been identified at time of analysis.
A race condition in the Linux kernel futex priority-inheritance requeue path (FUTEX_CMP_REQUEUE_PI) allows a waiter's stack-allocated futex_q to be freed while a concurrent requeue task is still about to call rcuwait_wake_up() on it, producing a slab-out-of-bounds use-after-free that typically surfaces as a KASAN report and kernel crash. Only kernels built with PREEMPT_RT reach the affected code path; on such systems any local, unprivileged process can trigger it, but exploitation requires winning a narrow, non-deterministic timing window in which an early wakeup (futex timeout or delivered signal) races the concurrent PI requeue. No confirmed active exploitation and no public exploit code had been identified at time of analysis, and the practical outcome is denial of service rather than code execution or data disclosure.
A race-condition use-after-free in the Linux kernel ftrace subsystem lets a local attacker with root or CAP_SYS_ADMIN privileges crash the kernel by opening a per-instance set_ftrace_filter or set_ftrace_notrace file at the moment another thread removes (rmdir) that same trace instance, causing the freed ftrace_ops structure referenced from inode->private to be dereferenced before a trace_array reference is taken. Affected kernels are those built with ftrace/CONFIG_FUNCTION_TRACER in the range introduced around Linux 3.15 through before the fixes released in 6.18.52, 7.2.5, and 7.3-rc2; only per-instance tracing files are exposed, since the top-level instance uses global_ops and is unaffected. Exploitation is limited to a narrow, non-deterministic timing window that typically requires repeated attempts, and no public exploit code or active exploitation has been identified at time of analysis.
Linux kernel builds with HID-BPF support (CONFIG_HID_BPF) can be crashed by a race that double-releases a HID device reference: a BPF map delete invoking hid_bpf_unreg() (no BPF_F_LINK) can run concurrently with device destruction via hid_destroy_device(), so both paths call hid_put_device() on the same registration reference and the struct hid_device is freed while teardown is still executing inside hid_destroy_device(). The attacker must already hold the local privileges required to attach a HID-BPF struct_ops program (CAP_BPF/CAP_SYS_ADMIN, effectively root) and win a narrow timing window, so the independent assessment is materially lower than the vendor's 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and rates it as a crash-class fault (A:H, I:L, C:N) rather than code execution or data disclosure. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; patched stable releases (6.12.110, 6.18.51, 7.2.5, with a 7.3-rc2 fix) are available from the vendor.
A use-after-free race condition in the Linux kernel's device-mapper (dm) subsystem can be triggered when two concurrent DM_TABLE_LOAD ioctls are issued against the same device and one succeeds while the other fails, allowing the unlocked walk of md->table_devices in dm_setup_md_queue to dereference memory already freed by dm_table_destroy. The vendor scored this 7.8, but our independent assessment places it at CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - exploitation requires local, root-equivalent CAP_SYS_ADMIN access to /dev/mapper/control and winning a narrow, non-deterministic timing window, so the realistic worst case is a host crash or denial of service rather than code execution or data disclosure. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; vendor patches are available for the 6.1, 6.6, 6.12, 6.18 and 7.2 stable branches.
Local attackers holding CAP_SYS_ADMIN can crash or destabilize the Linux kernel by racing the device-mapper resume ioctl against a concurrent device removal on the same mapped device, so the table is torn down in __dm_destroy without the postsuspend callback the dm targets depend on. The most concrete consequence documented is a use-after-free in the dm-integrity target, whose reboot notifier is left registered when postsuspend is skipped, while other targets may simply misbehave; the independent assessment rates this as a privilege-gated, non-deterministic denial-of-service rather than code execution or data disclosure, materially below the vendor's 7.8 HIGH score. No public exploit code has been identified at time of analysis, and the flaw is not known to be actively exploited.
Denial of service in the Linux kernel's fsl-edma DMA engine driver lets a local user with write access to tracefs event-injection files crash the system by causing the fsl_edma trace event handler to dereference a stale struct fsl_edma_engine pointer. Affected systems are those running NXP/Freescale eDMA hardware (for example i.MX or Layerscape) with kernel tracing enabled; the independent assessment rates this as a local DoS requiring root/CAP_SYS_ADMIN (assessed CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H), which is narrower than the vendor's 7.8 score. A local trigger is described in the upstream fix, so publicly available exploit code exists, but there is no CISA KEV entry indicating active exploitation.
A use-after-free race condition in the Linux kernel kprobes subsystem (CVE-2026-89988) lets a highly privileged local actor corrupt kernel memory by racing a blacklist traversal against a concurrent kernel module unload. Specifically, __within_kprobe_blacklist() walks kprobe_blacklist without holding kprobe_mutex, while kprobe_remove_area_blacklist() unlinks and immediately kfree()s those same entries when a module is unloaded, so a traversal that lands in the race window dereferences freed memory. The upstream fix converts the list to RCU (guard(rcu)(), list_for_each_entry_rcu(), list_add_tail_rcu(), list_del_rcu(), kfree_rcu()); it is not known to be exploited and no public exploit code was identified at time of analysis, and EPSS/KEV data are absent. Our independent assessment rates this materially lower than the published CVSS 7.8: it requires local access with the ability to register kprobes (root / CAP_SYS_ADMIN / CAP_SYS_MODULE or the debugfs kprobe interface) plus concurrent module load/unload churn, and the timing window is narrow (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H, moderate, ~4.7).
A context-inappropriate allocation in the Linux kernel's weighted-interleave memory policy path causes a sleeping (GFP_KERNEL) allocation to be performed while executing in atomic/RCU context. The bug exists only in kernels that provide the MPOL_WEIGHTED_INTERLEAVE mempolicy, introduced in Linux 6.9, and is triggered when an authenticated local user has that policy set on the current task while an rhashtable bucket-table allocation rehashes under rcu_read_lock() with GFP_ATOMIC and falls back to vmalloc (__vmalloc_node_range_noprof → vm_area_alloc_pages → alloc_pages_bulk_mempolicy → alloc_pages_bulk_weighted_interleave), which then hardcodes GFP_KERNEL for its temporary weights array. The observable impact is a might_alloc()/might_sleep() splat - most visible with CONFIG_DEBUG_ATOMIC_SLEEP enabled - with no confidentiality or integrity consequence and at most a minor availability effect; the window is timing- and workload-dependent and not directly attacker-controlled, and no public exploit has been identified at time of analysis. The vendor's assigned CVSS of 7.8 is substantially higher than the assessed real-world risk, which our analysis rates as low (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L).
Cross-node folio migration in the Linux kernel 7.1 memory cgroup controller can leave a folio's objcg pointing at a different node than the LRU list the folio actually belongs to, so memcg reparenting resolves the wrong lruvec and takes the wrong lru_lock, corrupting memory-cgroup accounting and risking kernel failure (assessed availability impact High, integrity Low, confidentiality None). Exposure is narrow: it requires the memory controller active (default in modern container/systemd deployments), genuinely multi-node NUMA hardware, local authenticated access (CVSS vector PR:L) to trigger cross-node migration, and a race with memcg_reparent_objcgs() during cgroup offline in the non-atomic window between objcg and LRU-splicing iterations; single-node systems and kernels before 7.1 are unaffected. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; vendor fixes are 7.2.5 and 7.3-rc1, so the vendor score of 7.8 (AV:L/AC:L/.../C:H/I:H/A:H) materially overstates real-world risk relative to the assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H.
A race condition in the Linux kernel ALSA PCM (sound) subsystem allows a local, authenticated user with access to a sound device node to trigger conflicting PCM state transitions - specifically, an atomic trigger-start racing a non-atomic hw_params, hw_free, or prepare operation on the same stream. The realistic outcome is internal state inconsistency and a kernel ODEBUG warning (as reported by syzkaller), not memory corruption or privilege escalation; the distro-assigned CVSS of 7.8 is substantially overstated relative to the assessed vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L), which reflects low availability impact only. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so exploitation requires winning a tight, non-deterministic timing race from an already-privileged local position.
An out-of-bounds write in the Linux kernel's device-memory migration helpers (mm/migrate_device) allows a local user who holds a file descriptor to a ZONE_DEVICE/HMM-capable device to corrupt kernel memory. When a compound (transparent huge) folio is migrated into device memory and its page-granular span extends past the end of the caller-supplied npages PFN array, migrate_device_range() and migrate_device_pfns() clear folio entries past the array boundary; the path is exercised in practice by dmirror_fops_release() on /dev/hmm_dmirror0 and by GPU shared-virtual-memory drivers such as nouveau or amdgpu SVM. Exploitation is local only and conditional, requiring a device-memory migration-capable kernel build and a specific huge-page-versus-range boundary condition (assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, integrity and availability impact with no confidentiality impact); no public exploit identified at time of analysis.
Out-of-bounds write in the Linux kernel's nvdimm BTT (Block Translation Table) driver allows a privileged local attacker who can supply a crafted or foreign BTT arena to corrupt kernel memory, primarily degrading availability and potentially altering data. The flaw is triggered when the BTT info block's unvalidated nfree field is set below the host's per-lane count (ND_MAX_LANES), so the I/O path indexes freelist[]/rtt[] arrays past their allocations; exploitation requires local root/CAP_SYS_ADMIN or physical control over the persistent-memory medium being probed, making it a low-real-risk issue despite a high base score. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing); EPSS data was not supplied.