2026-09-16
A race condition in the Linux kernel ALSA PCM (sound) subsystem allows a local, authenticated user with access to a sound device node to trigger conflicting PCM state transitions - specifically, an atomic trigger-start racing a non-atomic hw_params, hw_free, or prepare operation on the same stream. The realistic outcome is internal state inconsistency and a kernel ODEBUG warning (as reported by syzkaller), not memory corruption or privilege escalation; the distro-assigned CVSS of 7.8 is substantially overstated relative to the assessed vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L), which reflects low availability impact only. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so exploitation requires winning a tight, non-deterministic timing race from an already-privileged local position.
An out-of-bounds write in the Linux kernel's device-memory migration helpers (mm/migrate_device) allows a local user who holds a file descriptor to a ZONE_DEVICE/HMM-capable device to corrupt kernel memory. When a compound (transparent huge) folio is migrated into device memory and its page-granular span extends past the end of the caller-supplied npages PFN array, migrate_device_range() and migrate_device_pfns() clear folio entries past the array boundary; the path is exercised in practice by dmirror_fops_release() on /dev/hmm_dmirror0 and by GPU shared-virtual-memory drivers such as nouveau or amdgpu SVM. Exploitation is local only and conditional, requiring a device-memory migration-capable kernel build and a specific huge-page-versus-range boundary condition (assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, integrity and availability impact with no confidentiality impact); no public exploit identified at time of analysis.
Out-of-bounds write in the Linux kernel's nvdimm BTT (Block Translation Table) driver allows a privileged local attacker who can supply a crafted or foreign BTT arena to corrupt kernel memory, primarily degrading availability and potentially altering data. The flaw is triggered when the BTT info block's unvalidated nfree field is set below the host's per-lane count (ND_MAX_LANES), so the I/O path indexes freelist[]/rtt[] arrays past their allocations; exploitation requires local root/CAP_SYS_ADMIN or physical control over the persistent-memory medium being probed, making it a low-real-risk issue despite a high base score. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing); EPSS data was not supplied.
Incorrect PFN bookkeeping in the Linux kernel's PowerPC compound vmemmap population path (vmemmap_populate_compound_pages) causes the kernel to compute the wrong pfn_offset and therefore make the head/tail struct-page mapping decision for the wrong position within a compound page, which can corrupt vmemmap contents or crash the system when PowerPC systems exercise compound-page vmemmap optimization (ZONE_DEVICE / device-DAX / persistent memory or memory-hotplug configurations). This is a deterministic setup- or boot-time arithmetic miscalculation rather than an attacker-controlled primitive: the vendor CVSS of 7.8 assumes local, low-privilege access with high confidentiality and integrity impact, but an independent re-assessment scores it CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H, noting the vendor vector appears over-scored because triggering the mis-decision requires high privileges to drive memory hotplug/device configuration, depends on specific compound-page population and alignment conditions, and has no remote or unauthenticated vector. No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is limited to PowerPC (PPC) kernels, and vendor-released fixes are available in the 6.6.157, 6.12.110, 6.18.51, 7.2.5, and 7.3-rc1 stable/mainline trees.
A local use-after-free in the Linux kernel's Industrial I/O (IIO) subsystem can crash or corrupt the kernel when an anonymous IIO buffer handle is released while its underlying IIO device is being torn down at the same time. Only kernels built with the anonymous/DMABUF buffer interface introduced in 6.11 are affected, and the vendor-scored 7.8 severity is not supported by the evidence: exploitation requires local low-privileged access (CVSS PR:L), a narrow race with driver unbind or hot-unplug (AC:H), and results in denial of service (kernel memory corruption/crash) rather than the high confidentiality and integrity impact the vendor vector claims. Patches are available in the stable tree (6.12.110, 6.18.51, 7.2.5, and 7.3-rc1); no confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis.
A race-condition use-after-free in the Linux kernel's IIO (Industrial I/O) buffer DMA-fence implementation allows a local attacker with access to an IIO device exposing the DMABUF buffer interface to corrupt kernel memory by racing the fence's teardown against lockless RCU readers - the custom release path calls kfree() rather than deferring the free through RCU or the standard dma_fence_free() helper. The flaw affects kernels that include the IIO DMABUF buffer support introduced in 6.11 and was fixed in 6.12.110, 6.18.51, 7.2.5 and 7.3-rc1; exploitation requires a vulnerable IIO DMABUF-capable device, a build with that support enabled, and a timing-dependent race window, so it is local-only and not deterministic. Per independent assessment the realistic impact is availability and limited integrity loss (AC:H, C:N/I:L/A:H) rather than the confidentiality breach suggested by the higher vendor-published score, and no public exploit code has been identified at time of analysis.
Use-after-free in the Linux kernel's IIO buffer DMABUF path where an iio_dma_fence can outlive the iio_dmabuf_priv structure that holds its embedded lock, so a fence signal or release callback can touch a freed lock object. Affected kernels are Linux 6.11 through the fixed releases 6.12.110, 6.18.51, 7.2.5 and 7.3-rc1, and exploitation requires local access to a host whose hardware/driver exposes the IIO DMABUF buffer interface with permission to open the IIO device node (CVSS PR:L, no UI). The vendor advisory lists a patch, and no public exploit or CISA KEV entry was identified at time of analysis; our independent assessment rates this Medium (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) because the race window is timing-sensitive and the affected surface is driver-specific rather than universal, which is noticeably lower than the vendor-supplied 7.8 vector.
Use-after-free in the Linux kernel's IIO atlas-sensor driver (Atlas Scientific chemical sensors) is reachable when an IIO buffer is enabled and the driver is torn down: the devm-managed data-ready IRQ keeps queueing an irq_work that calls iio_trigger_poll(data->trig), and free_irq() during the devres unwind after atlas_remove() never flushes that pending work, so atlas_work_handler() can dereference an already-freed trigger/indio_dev via container_of(). The driver has existed since Linux 4.8 and is only present on systems with real Atlas Scientific I2C sensor hardware attached; exploitation requires authenticated local access (typically root privileges to unbind the device or unload the module), with an enabled buffer, and it is constrained by a narrow race-timing window - the assessed impact is low integrity and high availability (denial of service / memory corruption on teardown) with no confidentiality impact. No public exploit identified at time of analysis, and the flaw was closed upstream by calling iio_trigger_poll_nested() directly from the threaded handler so free_irq() drains it, with fixes shipped in 6.6.157, 6.12.110, 6.18.51 and 7.2.5.
A use-after-free race condition in the Linux kernel's s390 KVM guest-debug watchpoint code lets a local user who can control an IBM Z guest VM read or corrupt freed kernel memory. When a hardware watchpoint is imported via the KVM_SET_GUEST_DEBUG path, __import_wp_info() backs up guest memory with read_guest_abs() without holding kvm->srcu, so a concurrent memslot update can free the memslots array mid-read. Exploitation is s390-specific, requires local privileges over the VM/VMM (authenticated, PR:L per the assessed vector) and a narrow timing window, so reliability is limited; no public exploit code and no confirmed active exploitation were identified at time of analysis, and patch data indicates the vendor has released fixes.
Memory corruption on IBM Z (s390) KVM hosts running the Linux kernel is triggered when a channel-subsystem damage machine check (the CK bit) is reinjected into a guest, causing the host kernel to kfree() a stack variable. Exploitation requires an authenticated local actor with existing privileges on an s390 host that runs KVM guests (CVSS AV:L/PR:L) and depends on a hardware/host error condition that cannot be summoned on demand, which is reflected in the assessed AC:H and a scope-changed impact profile of low integrity and high availability impact rather than full host compromise. Vendor-released patches exist (stable 6.18.51, 7.2.5 and 7.3-rc1/mainline commits); no public exploit code and no confirmed active exploitation were identified at time of analysis.
A race condition in the Linux kernel's KVM s390 (IBM Z) keyop path lets a local user who already holds a KVM VM file descriptor cause gmap->asce to be read without the mmu_lock, potentially using a stale address-space-control element and corrupting memory. Exploitation requires s390 hardware, VM-fd access, and issuing KVM_S390_KEYOP concurrently with KVM_S390_VM_MEM_LIMIT_SIZE so that keyop reads asce while gmap_set_limit() mutates it under the write lock; it is timing-dependent, not remotely reachable, and no public exploit has been identified at time of analysis. The upstream fix has been merged and shipped in stable Linux 7.2.5 and 7.3-rc1, though an independent assessment rates real-world impact lower than the 7.8 base score by downgrading attack complexity to High and scope/confidentiality impact to None/low integrity, high availability.
Incorrect jump-offset calculation in the LoongArch BPF JIT of the Linux kernel can emit wrong tail-call branch targets, causing soft lockups (high availability impact) and, per the assessed vector, limited integrity impact, while confidentiality is unaffected. Affected are LoongArch (Loongson) systems running vulnerable kernel branches including the 6.1.x, 6.6.x, 6.12.x, 6.15.x, 6.16.x and 6.17 lines; exploitation requires local access plus the capability to load eBPF programs into the kernel (CAP_BPF or CAP_SYS_ADMIN, since unprivileged BPF is disabled by default), and only manifests when extra JIT passes occur, so it is not a deterministic single-request trigger. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the assessed severity is lower than the headline 7.8 because the flaw is architecture-specific, capability-gated and condition-dependent; vendor-released patches are available in 6.18.51, 7.2.5 and 7.3-rc1.
A race in the LoongArch rethook/kretprobe trampoline allows the per-CPU base register ($r21/$u0) to be restored with a stale value after a probed task is preempted and migrated to a different CPU, causing this_cpu_*() accesses (runqueues, RCU per-CPU data, timer tick programming, FPU ownership) to hit the wrong CPU's percpu area and ultimately corrupting scheduler and timer state. The result under heavy kretprobe load is scheduling-while-atomic splats, wrong-CPU RCU warnings, WARN_ON_ONCE(rq != this_rq()) in nohz_balance_exit_idle(), and in the worst case a CPU parking in the idle loop with its timer never re-armed, i.e. a hard lockup and denial of service. Only LoongArch systems running a preemptible kernel with active kretprobes/rethook are affected, and arming kretprobes normally requires CAP_SYS_ADMIN/CAP_PERFMON (root-equivalent), so this is not reachable by unprivileged local users in default configurations; there is no public exploit identified at time of analysis and no confirmed active exploitation.
A preempt-count underflow in the Linux kernel's LoongArch Kprobes breakpoint handling allows a local, low-privileged user to issue the same break 11 instruction that userspace can generate, driving do_bp() into kprobe_singlestep_handler() with no active probe attached and calling preempt_enable_no_resched() without the matching preempt_disable() that kprobe_breakpoint_handler() would normally have performed. Only LoongArch (loongarch64) kernels with Kprobes enabled are affected-other architectures do not use this break-11 path-and the corrupted preempt state makes in_interrupt() return true until the task reschedules, which causes cgroup_sk_alloc() to attribute new sockets to the root cgroup and can thereby evade a BPF_CGROUP_INET_SOCK_CREATE policy bound to the task's own cgroup. No public exploit code identified at time of analysis and the flaw is not listed in CISA KEV; the vendor CVSS of 7.8 overstates practical severity, since independent assessment limits impact to integrity and availability (Low) with no confidentiality impact and notes the notable security consequence requires a BPF cgroup socket-create policy to be present.
A race condition in the Linux kernel HDMI-CEC core (drivers/media/cec) lets a local user who can open a CEC character device (/dev/cecN) free an in-flight transmit data structure while its delayed work item is still pending, corrupting kernel state and typically crashing the system. Exploitation requires a CEC-capable adapter, permission to the device node, and a signal delivered at a narrow timing window between cancel_delayed_work_sync() and the kthread's schedule_delayed_work(&data->work) in cec_transmit_done_ts() - no public exploit code has been identified at time of analysis, and the impact is a denial of service via the debugobjects 'free active' path rather than information disclosure. Vendor-released patches exist in stable trees (6.12.110, 6.18.51, 7.2.5) and in 7.3-rc1; the affected surface is effectively absent on headless servers and most virtualized deployments without CEC hardware.
A heap out-of-bounds write in the Linux kernel's cx231xx USB video-capture driver allows a local, authenticated user (CVSS PR:L) who can open the device's V4L2 video and VBI nodes to corrupt kernel heap memory by resizing the device-wide frame geometry while a VBI stream is already running. The driver latches the VBI plane size at buffer-allocation time but recomputes the destination offset from the live dev->width and dev->norm on every URB completion, so an attacker can allocate a small VBI plane (small width or the NTSC standard), start VBI streaming, then enlarge dev->width via VIDIOC_S_FMT or switch dev->norm to PAL via VIDIOC_S_STD through the video node - the pre-patch code only checks the video queue (dev->vidq), not the VBI queue (dev->vbiq) - and have the device deliver a field-2 payload, causing cx231xx_do_vbi_copy() to memcpy() past the end of the smaller plane with an attacker-chosen offset and device-controlled contents. Vendor patches exist for Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51 and 7.2.5 (mainline 7.3-rc1); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical impact is bounded by the requirement for physical or emulated cx231xx hardware plus a race against live URB completion (the independent assessment scores this AV:L/AC:H with C:L, below the vendor's 7.8 High).
A use-after-free in the Linux kernel's cx23885 media driver lets a local attacker with low privileges (CVSS PR:L) corrupt or crash the kernel by triggering a race during teardown of a Conexant CX23885-based NetUP DVB conditional-access (CI) device. The NetUP CI work item netup_read_ci_status() can still be pending or executing on the system workqueue when netup_ci_exit() frees the associated netup_ci_state, because the removal path calls free_irq() (which stops new interrupts but does not drain already-queued work) before the CI device is unregistered; the fix inserts cancel_work_sync() before dvb_ca_en50221_release() and kfree(). Practical risk is materially lower than the headline score: our assessment rates this AV:L/AC:H (the upstream vector is AV:L/AC:L) because exploitation requires the specific NetUP CI hardware and feature to be active plus a narrow removal-time race window (module unload, device unbind, or physical hot-unplug), and there is no public exploit identified at time of analysis. Vendor-released patches exist for the affected stable series (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, and 7.2.5/7.3-rc1).
A use-after-free in the Linux kernel's go7007 media driver allows a local user who can open the driver's ALSA capture PCM node to trigger memory corruption by keeping that PCM file open across a device removal or unbind event (for example, a USB unplug). The flaw is a lifetime mismatch: go7007_snd_remove() releases the v4l2_device reference immediately after snd_card_free_when_closed(), even though the ALSA card - and its PCM callbacks reaching struct go7007 through pcm->private_data - can stay alive until the last file is closed, so go7007_snd_hw_free() may run against an already-freed object. Per the independent assessment the vector is local-only (AV:L, PR:L, AC:H) with high availability impact and limited confidentiality/integrity impact, and successful, reliable triggering requires the specific WIS GO7007 hardware to be present and the teardown timing window to be won; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV. Vendor-released patches are available in the stable branches listed below.
Use-after-free in the Linux kernel's ov02a10 MIPI CSI-2 sensor driver (media: i2c) can abort or destabilize driver probe on systems that physically include an OmniVision OV02A10 camera together with a firmware/device-tree description that binds that driver. The ov02a10_check_hwcfg() function calls fwnode_handle_put() on the parsed endpoint and then reads the optional 'ovti,mipi-clock-voltage' property through the same stale handle, while also letting the failure code from that optional property overwrite the function's return value, so probe can fail even when nothing else is wrong. Affected code ships from Linux 5.11 onward and is fixed in 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 and 7.3-rc1; no public exploit has been identified at time of analysis, and although the vendor scored this 7.8 (HIGH), real-world risk is LOW because the path is reachable only in kernel probe context on specific sensor hardware and is not a remote or user-controllable trigger.
A teardown-order defect in the Linux kernel's ov7740 i2c camera-sensor driver causes a use-after-destroy and a double-free when the driver is unbound or the OmniVision OV7740 sensor is physically removed, panicking the kernel or otherwise taking the system down. Only systems that ship an OV7740 sensor with the CONFIG_VIDEO_OV7740 driver built or loaded are affected, so exposure is limited to specific embedded/SoC platforms. The flaw is local-only, cannot be triggered by an unprivileged process on a default configuration, and no public exploit identified at time of analysis; the vendor scores it 7.8, whereas our reassessment is lower (AV:L/AC:H/PR:L/UI:N/C:N/I:L/A:H) because the realistic impact is a crash rather than code execution or data disclosure - the accompanying 'Information Disclosure' tag is not supported by the assessed vector.
The Linux kernel's sunxi-cir driver (Allwinner CIR/IR receiver, media/rc subsystem) fails to unregister the rc device when probe fails after rc_register_device() has already succeeded, leaving the registration and its resources behind. This is a local, low-severity driver lifecycle bug: the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, since the fault requires a genuine probe failure at IRQ lookup, IRQ request, or hardware initialization - conditions that are not attacker-controllable in a default configuration and generally need local privileged access (forced bind/unbind, resource exhaustion, or device-tree/IRQ faults) to induce. No public exploit code has been identified at time of analysis, and vendor-released fixes exist in stable kernels including 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, and 7.2.5.
Out-of-bounds array reads in the Linux kernel's Rockchip rkvdec stateless HEVC decoder allow a local user who can open the V4L2 mem2m decoder device node to trigger an unsigned integer underflow in short-term reference picture set (RPS) prediction, causing the driver to index far outside the calculated_rps_st_sets array. The flaw is reached by submitting an EXT_SPS_ST_RPS control with the INTER_REF_PIC_SET_PRED flag set and a crafted delta_idx_minus1 value that exceeds the current RPS index; the CVSS vector requires local access with low privileges (PR:L), so no third-party user interaction is needed but the attacker must already hold permissions on the decoder device. Impact is bounded to information disclosure and availability (the assessed vector is AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H), and it is confined to embedded Rockchip ARM platforms where the rkvdec driver is present and loaded; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). The vendor-published CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates real-world risk because exploitation demands specific hardware, driver availability, and a stateless decode session that raises attack complexity and limits the outcome to a memory read rather than code execution.
A missing error-path teardown in the Linux kernel's rtl2832_sdr SDR driver lets a local attacker with low privileges (PR:L) who can reach the V4L2/SDR device node for an RTL2832U-based USB dongle leak coherent DMA memory and trigger an out-of-bounds read/pass-garbage-pointer condition in USB URB cleanup. The defect only manifests when rtl2832_sdr_start_streaming() fails after allocation - realistically an induced -ENOMEM during alloc_stream_bufs()/alloc_urbs()/submit_urbs() - and is then followed by a second VIDIOC_STREAMON, which over-increments urbs_initialized past MAX_BULK_BUFS and causes rtl2832_sdr_free_urbs() to index beyond dev->urb_list[] before handing stale pointers to usb_free_urb(). The result is a resource leak and memory-corruption/denial-of-service condition rather than direct data theft, and our independent assessment scores this AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, materially below the vendor's 7.8 C:H/I:H/A:H rating; exploitation requires specific SDR hardware, the driver being loaded, and memory-pressure conditions, and there is no public exploit identified at time of analysis.
Use-after-free in the Linux kernel's TI VPE/VIP media capture driver (media: ti: vpe) allows a locally authenticated attacker who can open and stream from a VIP /dev/videoN node to trigger memory corruption by racing stream teardown against outstanding interrupt work. The driver's VIP overflow recovery worker - armed from the hardirq handler when a FIFO overflow is detected - and the VPDMA list-complete path both continue to dereference stream, port, and device state after vip_release_stream() or free_stream() has freed those resources, because vip_stop_streaming() masks the per-list IRQs without synchronizing the hardirq handler or disabling recovery_work. Exploitation requires local access plus the ability to induce a FIFO overflow and win a tight timing window against file release or unbind/remove, so our independent assessment rates this AC:H with limited confidentiality and integrity impact but high availability impact (NVD scores it 7.8 AV:L/AC:L/PR:L). No public exploit code was identified at time of analysis, and the flaw is hardware-specific to TI Davinci/OMAP/AM-class SoCs with VIP capture hardware.
Out-of-bounds array access in the Linux kernel V4L2 control framework for stateless HEVC decoders lets a local user who can write to a V4L2 device node (/dev/video*) supply HEVC SPS short-term and long-term reference picture set counts that exceed the HEVC limits of 64 ST RPS sets and 32 LT references, so a decoder driver that trusts those counts can index past the EXT SPS dynamic arrays. The published CVSS vector rates this as 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), whereas our independent assessment scores it lower (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H) because the flaw only manifests when a stateless HEVC decoder driver consumes the attacker-supplied counts without performing its own bounds validation; there is no public exploit identified at time of analysis and no CISA KEV entry. Vendor-released fixes are available in Linux 7.2.5 and 7.3-rc1.
Double-free in the Linux kernel's legacy zoran V4L2 media driver on teardown allows a local user who can trigger device/driver removal to kfree() the same registered video_device twice, crashing the kernel or corrupting kernel memory. Only systems where the zoran driver is bound to real Zoran ZR36057/ZR36067-based PCI MJPEG framegrabber hardware (Buz, DC10, LML33-class cards) are affected, and the flaw is reachable only through teardown paths such as module unload, PCI unbind/removal, or driver shutdown - not through normal runtime device I/O and not remotely. Vendor patches are available across maintained stable branches (6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5, and 7.3-rc1); exploitation requires the local authenticated context indicated by the CVSS vector (PR:L), and no public exploit code or confirmed active exploitation was identified at time of analysis. The practical impact is bounded to local denial of service because the affected hardware is obsolete and rarely deployed and the outcome is a crash rather than a controlled memory write.
A use-after-free read in the Linux kernel's qla2xxx SCSI driver allows a local low-privilege (authenticated) user on a host with a QLogic cs84xx-capable Fibre Channel HBA to dereference freed memory by reading the 84xx_fw_version sysfs attribute while the adapter is being torn down. The race is bounded to the teardown window between qla84xx_put_chip() freeing ha->cs84xx and scsi_remove_host() draining the sysfs show handler, and since the dereference in qla24xx_84xx_fw_version_show() is read-only the realistic impact is an information leak or kernel crash rather than controlled corruption, meaning the vendor CVSS of 7.8 overstates real risk for this narrow, hardware-dependent timing bug. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); vendor patches are available in the stable kernel releases listed in remediation.
A folio reference-count imbalance in the Linux kernel's f2fs filesystem lets a local user who can drive the redirty_blocks() path over-decrement a pinned folio when read_cache_folio() fails before any folio is pinned and readahead has already cached that same folio, after which drop_caches or reclaim can emit "BUG: Bad page state" and corrupt kernel memory state. Only kernels that include the folio-conversion commit 5951fee46bef are affected, i.e. Linux 6.16 through the fixed releases 6.18.51, 7.2.5 and 7.3-rc1. Exploitation requires local access with low privileges (CVSS:3.1/AV:L/PR:L) and is gated on a non-deterministic failure-plus-readahead race, so reliability is poor (AC:H); the independent assessment rates confidentiality impact as none with limited integrity and high availability impact, and no public exploit has been identified at time of analysis.
A use-after-put race in the Linux kernel's f2fs filesystem during large-folio invalidation allows a local low-privileged attacker who can concurrently drive a truncate or folio split against f2fs_get_read_data_folio() to leave stale xarray slots and corrupted page state in the page cache, resulting in livelocks, bad page statistics, and possible memory corruption. Only kernels built with f2fs large/compound folio support are affected - the flaw was introduced on the v6.18/7.0 development line (commit 05e65c14ea59a401cec4284e9d612f9d5dc1b3f8 and later) and is fixed in the vendor-released 7.2.5 stable update and 7.3-rc1. The vendor rates this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but independent assessment downgrades it to AC:H/C:L because a narrow timing window must be won and the outcome is memory corruption or denial of service rather than reliable code execution; no public exploit identified at time of analysis.
A missing dirty-flag clear on f2fs node folios in the Linux kernel's error-handling path can leave inconsistent node data unpersisted to storage, degrading on-disk filesystem consistency. The flaw is reachable only with local access (PR:L per CVSS vector) and requires encountering or supplying a corrupted f2fs node block (checksum mismatch or inconsistent footer information) to trigger the vulnerable code path. The vendor-assigned CVSS 3.1 score of 7.8 is materially over-scored per independent analysis, which assesses AV:L/AC:H/PR:L with no confidentiality impact and low integrity/availability impact; no public exploit identified at time of analysis, and vendor patches are available in stable kernel releases (6.18.51, 7.2.5, 7.3-rc1).
Incorrect node-block validation in the Linux kernel's f2fs filesystem causes f2fs_sanity_check_node_footer() to be invoked with the wrong folio index, so the sanity check re-validates the same nid instead of the node actually being read, allowing a local user who is permitted to mount a crafted or corrupted f2fs volume to bypass the intended footer validation and trigger out-of-range metadata access - most plausibly a kernel crash or denial of service. The affected code path is reachable only when an attacker-influenced f2fs image is mounted (CVSS AV:L, PR:L), and exploitation requires supplying malicious on-disk metadata, which raises real attack complexity. Vendor patches are available in stable releases 6.18.51 and 7.2.5 (plus mainline 7.3-rc1); no public exploit identified at time of analysis, and the CNA's boilerplate 7.8 HIGH score (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H) overstates the issue relative to the assessed vector AV:L/AC:H/PR:L/UI:N/C:L/I:L/A:H, whose dominant impact is availability loss.
Out-of-bounds memory access in the Linux kernel's drm/panthor driver for Arm Mali CSF-class GPUs, caused by 32-bit offset arithmetic wrapping before a bounds check in panthor_init_cs_iface() and panthor_init_csg_iface(). A local attacker with low privileges on a system that has CONFIG_DRM_PANTHOR loaded and a Mali CSF GPU present could influence firmware-provided control-interface strides/offsets to escape the mapped region, yielding potential information disclosure and memory corruption (high confidentiality, integrity, and availability impact per the assessed vector). Exploitation requires the ability to supply malicious or compromised firmware content and is rated high complexity in our independent assessment (AV:L/AC:H/PR:L/UI:N); no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation.
A race condition in the Linux kernel's Direct Rendering Manager (DRM) core allows a local low-privileged user to trigger use-after-free-style resource teardown by issuing an ioctl on a partially registered DRM device node. When drm_dev_register() fails after one minor (for example the render minor) has already been registered and opened by userspace, the error path tears down device resources without first setting the unplugged flag, so an in-flight drm_dev_enter() critical section can continue operating on freed state. The vendor rates this CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); our independent assessment keeps the same CIA and local/low-privilege prerequisites but raises attack complexity to High because the attacker must win a narrow window during a probe or hot-plug registration failure that is not normally under their control. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); vendor patches are available across the supported stable branches.
Missing validation of the plane degamma LUT size in the Linux kernel's AMD display driver (amdgpu/DC) lets a local, authenticated user who can submit DRM atomic commits supply a malformed AMD_PLANE_DEGAMMA_LUT blob - for example a single-entry LUT - and drive the kernel into a divide-by-zero in __is_lut_linear() or an out-of-bounds read in __drm_lut_to_dc_gamma(). The practical consequence is a kernel crash or denial of service and, via the out-of-bounds read, potential disclosure of kernel memory contents; there is no evidence of memory corruption leading to code execution, and this is a local-only issue. Reachability is narrow: the vulnerable property is exposed only on kernels built with AMD_PRIVATE_COLOR (not enabled in mainstream distribution kernels) and only on systems with an AMD GPU using the amdgpu/DC display path. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available in the stable trees (6.12.110, 6.18.51, 7.2.5) and in mainline 7.3-rc1.
Memory corruption in the Linux kernel's TTM pool for Intel Xe graphics allows a local attacker with access to the DRM render node to trigger a stale restore state, leading to kernel crashes or potential privilege escalation. The flaw affects Linux 6.15 through the fix in 7.2.5/7.3-rc1 and requires the TTM backup/restore path (memory pressure or suspend/resume) to be exercised; no public exploit code or active exploitation has been identified at time of analysis.
An out-of-bounds array access in the Linux kernel's AMDGPU driver (drm/amdgpu) lets a local user who can submit GPU work trigger a kernel fault when a ring that was never assigned to a compute partition (AMDGPU_XCP_NO_PARTITION, i.e. ~0) is used on the SDMA isolation-enforcement or VM-flush paths. The access is caught by UBSAN and can crash the kernel, giving a denial-of-service condition with only limited memory-disclosure potential; because the trigger requires local access to an affected AMD GPU running with partition isolation active, exploitation is hardware- and configuration-dependent rather than universally reachable. The vendor has released patches (Linux 6.18.51, 7.2.5 and 7.3-rc1), and no public exploit code was identified at time of analysis; the independent assessment scores this locally as CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H, i.e. availability-weighted with low confidentiality impact.
Memory corruption in the Linux kernel's AMD KFD (amdkfd) driver allows a local user with access to the GPU compute interface to corrupt kernel page state when a GPU Shared Virtual Memory (SVM) page migration from device memory to system RAM fails. The error-path cleanup derives the struct page from a DMA/bus address instead of the page's physical address (pfn), so on systems with an enabled IOMMU it releases and unlocks system-RAM pages that the migration never pinned, while the genuinely allocated pages are leaked and their DMA mappings are not torn down correctly. The vendor assigns CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); our independent assessment keeps the same impact but raises attack complexity to AC:H because the faulty cleanup is reachable only after a device-to-system-RAM migration has already failed and requires IOMMU plus an active ROCm/HSA SVM workload. No public exploit identified at time of analysis and it is not confirmed actively exploited (CISA KEV).
Linux kernel AMD KFD (amdkfd) SVM migration code can use an uninitialized return value when migrating a VM range whose CPU side is a hole, causing the driver to tear down all VRAM pages it has just allocated and leaving memory state inconsistent. Affected are Linux kernel builds using the AMD GPU compute path (SVM/HMM migration to VRAM on ROCm/HSA-capable AMD hardware); the flaw affects code reachable from the commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 baseline and is fixed in 6.18.51, 7.2.5 and 7.3-rc1. Triggering requires a local user holding a GPU device handle and hitting a racy, non-default memory-layout condition, and no public exploit code was identified at time of analysis; the vendor's CVSS 3.1 score of 7.8 is assessed as overstated relative to this local, condition-gated error-handling defect.
A use-after-put in the Linux kernel's DRM pagemap device-memory migration code (drm_pagemap_migrate_populate_ram_pfn) lets a local, low-privileged user who can drive the GPU/device-private-memory migration path corrupt kernel memory and potentially escalate privileges. The defect has two parts: higher-order (THP) folio allocations lack __GFP_NOWARN and any order-0 fallback, and the free_pages error path computes folio_order(page_folio(page)) after put_page(page) has already dropped the reference, so corrupting state occurs when that put released the last reference. Exploitation requires the DRM pagemap subsystem (new in Linux 6.18) to be built and actively used on supported hardware, plus attacker-induced memory pressure to force the allocation failure, and the severity is moderated by the AC:H assessment in the authoritative analysis; there is no public exploit code and no confirmed active exploitation (no CISA KEV listing) at time of analysis.
Use-after-free in the Linux kernel's in-tree nouveau DRM driver lets a local user who can access the nouveau device node on a Fermi-generation or newer NVIDIA GPU potentially corrupt memory during channel teardown. The bug is an ordering flaw in nouveau_channel_del(): the channel's fence context is freed by context_del() before the channel-kill event subscription is dropped, so a kill event delivered in that narrow window makes nouveau_channel_killed() call nouveau_fence_context_kill() on an already-freed fence context. No public exploit code has been identified at time of analysis, and although the CNA assigned CVSS 7.8 (AV:L/AC:L/PR:L), our assessment raises attack complexity to High because a kill event must land in a very tight race window - and on current kernels nothing actually kills a channel on this path, making real-world triggerability very low.
Linux kernel builds containing the open-source Nouveau GPU driver (drm/nouveau/uvmm) fail to clear op->reg on two error paths in nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE arm, so a job that never created a sparse region can drop the region's only reference in nouveau_uvmm_bind_job_cleanup() and free a live object; a second job still owning that region then performs a use-after-free. Exploitation requires local access to the DRM/render device node and the ability to submit VM_BIND jobs (PR:L), plus a trigger of the -ENOENT busy-region check or an -ENOMEM failure from drm_gpuvm_sm_unmap_ops_create(), with the full use-after-free needing a concurrent job holding the same region. No public exploit code or confirmed active exploitation was identified at time of analysis, and systems running the proprietary NVIDIA driver rather than Nouveau are not affected.
A preemption-handling defect in the Linux kernel's BPF stack-collection path (bpf_get_stackid) allows a local attacker who can load and attach a BPF program to race the perf callchain buffer, where the kernel accesses trace entries after get_perf_callchain returns without preemption disabled; the race can corrupt or leak kernel memory, yielding high confidentiality and integrity impact plus availability loss. Affected kernels span roughly 4.6 up to the fixes shipped in 6.18.51, 7.2.5, and 7.3-rc1, with vendor CVSS 3.1 scored 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); our independent assessment keeps the same impact triad but raises the attack complexity from Low to High (AC:H) because success depends on hitting a narrow timing window, and the practical attack surface is further gated by CAP_BPF/CAP_PERFMON or by a system built with unprivileged BPF enabled. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so risk should be treated as a hardening/patch-priority issue rather than an emergency.
Mis-enforced authorization in Arista EOS allows an authenticated gNMI user to read or write management paths that an active gNSI Pathz policy is meant to deny, specifically when a single Pathz policy contains both a group rule and a user rule referencing the same path. Exposure is limited to EOS deployments that combine OpenConfig, a running gNMI server, and gNSI Pathz authorization - a non-default, advanced management-plane configuration - and the attacker must already hold valid gNMI credentials, consistent with the assessed vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (confidentiality and integrity High, no availability impact). No public exploit code exists and there is no confirmed active exploitation (not in CISA KEV); the supplied CVSS 4.0 score of 7.7 overstates day-to-day risk given the narrow prerequisite stack.
Stored cross-site scripting in Concrete CMS versions below 9.5.4 allows an attacker to persist a JavaScript payload in the user timezone field (uTimezone), which the Dashboard user-management page renders without output encoding so that the script runs inside an administrator's authenticated session - enabling theft of CSRF tokens, creation of rogue administrator accounts, or modification of site settings. Exploitation is conditionally gated rather than a broad drive-by threat: it requires the non-default setting concrete.misc.user_timezones to be enabled, and the unauthenticated write path exists only in 9.5.3 and only when public registration is also enabled, while versions below 9.5.3 permit only an authenticated user to write the field via the account profile editor; an administrator must subsequently view the malicious user record. No public exploit code was identified at time of analysis, and the vendor's CVSS v4.0 score of 7.7 is substantially moderated by these stacked non-default preconditions, which our independent assessment reflects with a higher attack-complexity and user-interaction-dependent CVSS 3.1 vector.
Cross-tenant data disclosure in djust before 1.0.7 allows an authenticated low-privileged user who holds a WebSocket or SSE connection to read every tenant's rows, because the tenant-isolation manager failed open on the live path rather than rejecting the unscoped query. Only applications using the djust.tenants multi-tenancy feature and serving data over WebSocket/SSE mount or event dispatch are affected; pure HTTP requests remained correctly tenant-scoped. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV - the vendor's fix is djust 1.0.7, and there is no workaround on the live path short of upgrading.
Out-of-bounds array indexing in the Linux kernel's USB Type-C UCSI DisplayPort alternate-mode driver (drivers/usb/typec/ucsi/displayport.c) can crash the kernel when the UCSI platform firmware returns a GET_CURRENT_CAM response that exceeds UCSI_MAX_ALTMODES without being 0xff. All Linux kernels exposing the ucsi_displayport code path - introduced around 5.2 and present on modern USB-C laptops with DisplayPort alt-mode - are potentially affected; the vector is local (CVSS:3.1/AV:L/AC:L/PR:N/UI:N) and requires either rogue/buggy PPM firmware or a malicious USB-C DisplayPort partner to steer the alternate-mode negotiation, so stock systems with honest firmware are not reachable. Impact is limited to a kernel crash (denial of service); no confidentiality or integrity impact is supported by the assessed vector, and no public exploit code or CISA KEV entry has been identified at time of analysis.
Missing cryptographic signature verification of firmware update packages in FERMAX VEO and VEO-XS Wi-Fi monitors running firmware prior to 01.48.001 allows anyone who controls the delivery of an update to install unauthorized, attacker-supplied firmware on the device. The attacker must be on the adjacent network (typically the same LAN or Wi-Fi segment as the monitor) and positioned to substitute or serve the update package, such as through an on-path man-in-the-middle position or a rogue update server; no authentication or user interaction is required once that delivery-control precondition is met, and the flaw is not exploitable across the open Internet. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); devices already updated to 01.48.001 or later are not affected.
Signature-verification bypass in Kong API Gateway Enterprise lets an unauthenticated remote attacker present a forged JWT that the gateway accepts as valid, defeating token-based authentication for the MCP OAuth2 and DataKit integration code paths. The vulnerable logic fails to confirm that the JWT's declared signing algorithm is compatible with the key type actually used for verification, so an attacker who can reach a protected endpoint that relies on these integrations can slip through as an authenticated principal; the independent assessment scopes the impact to the backend resources the gateway protects (C:H/I:H under a changed-scope CVSS:3.1 vector) rather than to the gateway host itself. Exposure is gated by configuration - gateways that do not enable MCP OAuth2 or DataKit JWT validation are not reachable - and no public exploit code or confirmed active exploitation was identified at time of analysis.
SAML authentication bypass in Kong Enterprise Gateway allows an unauthenticated remote attacker to impersonate arbitrary users, including administrators, by submitting a crafted SAML response containing an unsigned assertion. Exploitation is strictly gated by a non-default configuration: the Kong SAML plugin's validate_assertion_signature option must have been explicitly set to false, since it defaults to true - default deployments are not affected. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; patch status is Vendor-released patch: Kong Gateway 3.15.0.3.
Firmware update downloads on Fermax VEO and VEO-XS Wi-Fi monitors (DUOX Plus range) running firmware prior to 01.48.001 are not validated against a TLS certificate, so an attacker who already holds a man-in-the-middle position on the network segment carrying that traffic can deliver a spoofed update and have the device install it. The practical result is full loss of integrity, confidentiality and availability on the device, since attacker-supplied firmware runs with the monitor's privileges; the assessed severity is 7.7 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), and exploitation is conditional: the attacker must be network-adjacent, must catch or induce a firmware update event, and cannot succeed against monitors already updated to 01.48.001 or later. This is a supply-chain/update-integrity weakness rather than a drive-by remote takeover, and no device credentials are required (PR:N).