2026-09-16
A use-after-free in the Linux kernel's usbtv media driver ALSA audio path can crash the kernel or trigger limited memory corruption when a Fushicai USBTV007 USB analog TV/audio capture device is physically disconnected while a local user still has the PCM substream open. The driver frees its per-device state (struct usbtv) during the disconnect path while ALSA still references it via pcm->private_data, so a later snd_usbtv_pcm_close() dereferences freed memory; the kernel fix takes an extra V4L2 device reference for the lifetime of the ALSA card and releases it in the card's private_free callback. Vendor CVSS is 7.8, but the independent assessment rates the practical risk lower (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) because exploitation requires the specific USB hardware, a local user with ALSA access, a USB unplug race, and yields no confidentiality impact under assessment; no public exploit code or confirmed active exploitation was identified at time of analysis.
Incorrect forceRM handling during EndTransfer in the Linux kernel's dwc3 USB gadget driver can leave a transfer aborted via ep_dequeue still active on Synopsys DWC_usb31 v2.00a/v2.10a controllers, so a later StartTransfer on the same endpoint writes into a DMA buffer that was already unmapped and raises an SMMU/IOMMU fault, producing a denial-of-service condition. Only systems running a vulnerable kernel with those specific controller revisions in USB gadget mode behind an SMMU are affected, and exploitation requires local authenticated access (CVSS PR:L) to the gadget/endpoint path rather than remote or crafted network input. No public exploit identified at time of analysis, and the vendor CVSS of 7.8 (C:H/I:H/A:H) is assessed as overstated; the realistic impact is availability-only (assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).
A race condition in the Linux kernel's Qualcomm PMIC USB Type-C driver (qcom-pmic-typec) can leave the cc_debounce_dwork delayed work queued after the port is torn down, resulting in a use-after-free once devres frees the pmic_typec_port structure. Systems running affected kernels from roughly 6.5 through the unfixed 6.12.110/6.18.51/7.2.5 baselines on Qualcomm PMIC Type-C hardware - typically Snapdragon-based phones and embedded boards - are exposed. Exploitation requires local privileged access (root or CAP_SYS_ADMIN) to trigger the port_stop()/tcpm_unregister_port() teardown path and the ability to win a narrow TCPM-kthread timing race; no public exploit code has been identified at time of analysis, and the independent assessment rates the practical severity lower than the vendor's published CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8), assigning AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H instead.
A use-after-free race in the Linux kernel's Qualcomm PMIC USB Type-C Power Delivery PHY driver (qcom-pmic) can be triggered during driver teardown: pdphy_stop() disables the PD interrupts but does not flush the pending reset_work work item, so if the IRQ handler schedules that work just before disable_irq() takes effect, the work can execute after remove() has already freed the containing structure through devm. Reachability is narrow - it requires local privileged access (the ability to unbind/remove the driver, typically root-gated), the specific Qualcomm PMIC Type-C hardware, and winning a tight timing window, so the assessed vector is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H rather than the higher base score sometimes published. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the flaw was found by an in-house static analysis tool.
Use-after-free in the Linux kernel's USB MIDI 2.0 gadget function driver (f_midi2) allows a local attacker who already holds privileged access to the gadget configfs interface to corrupt or read freed memory by winning a narrow race between a string attribute's show path and a concurrent store. The show handler f_midi2_opts_str_show() dereferences opts->info.<field> before acquiring opts->lock, while f_midi2_opts_str_store() frees the previous string under that same lock, so a colliding read can touch a pointer that has already been released - affecting iface_name, block name, and the EP string option attributes. Exploitation requires CAP_SYS_ADMIN-level local access to configfs on a kernel built with USB gadget support and f_midi2 configured; it is not remotely reachable, and no public exploit code or confirmed active exploitation was identified at time of analysis. NVD scores this at CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while our independent assessment rates it lower (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H) because of the privileged prerequisite and the narrow, timing-dependent race window.
A use-after-free in the Linux kernel ftrace tracing subsystem lets a privileged local user crash the machine by racing a read of the newly added per-instance show_event_filters or show_event_triggers files against deletion (rmdir) of the trace instance those files belong to. The bug affects kernels that ship these files, i.e. roughly Linux 7.0 through the pre-fix 7.2.x and 7.3-rc series, and it was resolved by taking a trace_array reference in the files' open path (commits f4a771cc684c and 2ee3f7d43f79). Exploitation requires local access to a mounted tracefs, PR:H privileges per the assessed vector (normally root/CAP_SYS_ADMIN), and winning a tight timing race; there is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV), so real-world risk is far below the headline 7.8 score.
A local use-after-free race in the Linux kernel's ftrace/tracing subsystem allows a task that has opened one of the per-instance options files to crash the kernel when a second task concurrently removes the tracing instance that option belongs to. Only systems with ftrace/tracing instances enabled and with access to the tracing filesystem (tracefs/debugfs, normally root- or CAP_SYS_ADMIN-gated) are affected; the open path never took a trace_array reference, so instance removal frees the options descriptor that the first task is still using. The vendor rates this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but our independent assessment scores it 4.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H) because exploitation needs root-equivalent tracefs access and requires winning a narrow race window, with a realistic outcome of kernel crash/denial of service rather than code execution; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and vendor patches are available in the stable trees.
An out-of-bounds write in the Linux kernel's SCSI bsg io_uring completion path allows a local attacker with low privileges (CVSS PR:L) to overrun a user-supplied response buffer that is smaller than SCSI_SENSE_BUFFERSIZE, because the completed sense length is copied back without being capped to the caller's max_response_len. The io_uring-backed bsg passthrough interface that exposes the flaw was introduced in kernel 7.1 and is fixed in 7.2.5 and 7.3-rc2, so exposure is limited to very recent kernels on hosts where a bsg device node is reachable; no public exploit identified at time of analysis. The vendor's CVSS 7.8 (C:H/I:H/A:H) overstates real-world risk - our independent assessment scores it C:N/I:L/A:H, with the impact largely a memory-corruption/denial-of-service concern rather than a full confidentiality breach.
Local privilege escalation in the Linux kernel's SCSI bsg io_uring passthrough path (bsg_uring_cmd) allows an authenticated low-privileged local user (PR:L) to corrupt kernel memory via an out-of-bounds write, potentially escalating privileges or crashing the host. The handler validates fields read directly out of the user-shared, mmap'd io_uring SQE, so a racing thread can enlarge request_len after the bound check but before copy_from_user(), overflowing the fixed-size scmd->cmnd buffer inside the kernel. Affected are kernels built with bsg io_uring passthrough support (EUVD lists Linux 7.1 in the affected commit range), with exploitation requiring local access to a /dev/bsg device node plus a multi-threaded racer that wins a narrow check-to-use window; the vendor rates it 7.8 while the independent assessment agrees it is a genuinely serious bug but raises attack complexity to AC:H because success is probabilistic per attempt. No publicly available exploit code was identified at the time of analysis, and no KEV listing was provided.
An out-of-bounds write in the Linux kernel's megaraid_sas driver (megasas_make_prp_nvme) lets a locally present user submitting large block I/O to an NVMe drive behind a Broadcom/LSI MegaRAID controller overflow the cmd->sg_frame DMA pool buffer, corrupting such a list to run up to a full page past its allocation. The flaw is only reachable on Linux 6.17 and later, after block commit 9b8b84879d4a raised the default maximum transfer size to 4 MiB, and on drives whose firmware reports a large MDTS so max_hw_sectors is not clamped; systems with small-MDTS drives never hit the condition. Per the independent assessment, the vendor score of 7.8 overstates real-world risk (assessed AV:L/AC:H/PR:L with C:N/I:L/A:H): exploitation requires local access plus specific storage hardware, is not remotely reachable, and no public exploit was identified at time of analysis. Consequences range from a kernel page fault and crash (availability) to silent corruption of a neighbouring in-flight command's PRP list when the following page happens to be mapped.
Linux kernel pm8001 SAS/SATA HBA driver contains an error-path cleanup bug that can leave MSI-X interrupt handlers installed when request_irq() fails during driver initialization, because the rollback loop uses the failing index instead of the previously registered vector index. Systems with a PMC-Sierra/Adaptec 8001-series controller bound to the pm8001/pm80xx driver and kernel versions from 4.11 up to the fixed releases are affected. The issue is not attacker-reachable-it requires a non-attacker-influenced interrupt allocation failure-so independent assessment rates it low-impact availability-only (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L), and no public exploit has been identified at time of analysis.
A race condition in the Linux kernel futex priority-inheritance requeue path (FUTEX_CMP_REQUEUE_PI) allows a waiter's stack-allocated futex_q to be freed while a concurrent requeue task is still about to call rcuwait_wake_up() on it, producing a slab-out-of-bounds use-after-free that typically surfaces as a KASAN report and kernel crash. Only kernels built with PREEMPT_RT reach the affected code path; on such systems any local, unprivileged process can trigger it, but exploitation requires winning a narrow, non-deterministic timing window in which an early wakeup (futex timeout or delivered signal) races the concurrent PI requeue. No confirmed active exploitation and no public exploit code had been identified at time of analysis, and the practical outcome is denial of service rather than code execution or data disclosure.
A race-condition use-after-free in the Linux kernel ftrace subsystem lets a local attacker with root or CAP_SYS_ADMIN privileges crash the kernel by opening a per-instance set_ftrace_filter or set_ftrace_notrace file at the moment another thread removes (rmdir) that same trace instance, causing the freed ftrace_ops structure referenced from inode->private to be dereferenced before a trace_array reference is taken. Affected kernels are those built with ftrace/CONFIG_FUNCTION_TRACER in the range introduced around Linux 3.15 through before the fixes released in 6.18.52, 7.2.5, and 7.3-rc2; only per-instance tracing files are exposed, since the top-level instance uses global_ops and is unaffected. Exploitation is limited to a narrow, non-deterministic timing window that typically requires repeated attempts, and no public exploit code or active exploitation has been identified at time of analysis.
Linux kernel builds with HID-BPF support (CONFIG_HID_BPF) can be crashed by a race that double-releases a HID device reference: a BPF map delete invoking hid_bpf_unreg() (no BPF_F_LINK) can run concurrently with device destruction via hid_destroy_device(), so both paths call hid_put_device() on the same registration reference and the struct hid_device is freed while teardown is still executing inside hid_destroy_device(). The attacker must already hold the local privileges required to attach a HID-BPF struct_ops program (CAP_BPF/CAP_SYS_ADMIN, effectively root) and win a narrow timing window, so the independent assessment is materially lower than the vendor's 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and rates it as a crash-class fault (A:H, I:L, C:N) rather than code execution or data disclosure. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; patched stable releases (6.12.110, 6.18.51, 7.2.5, with a 7.3-rc2 fix) are available from the vendor.
A use-after-free race condition in the Linux kernel's device-mapper (dm) subsystem can be triggered when two concurrent DM_TABLE_LOAD ioctls are issued against the same device and one succeeds while the other fails, allowing the unlocked walk of md->table_devices in dm_setup_md_queue to dereference memory already freed by dm_table_destroy. The vendor scored this 7.8, but our independent assessment places it at CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - exploitation requires local, root-equivalent CAP_SYS_ADMIN access to /dev/mapper/control and winning a narrow, non-deterministic timing window, so the realistic worst case is a host crash or denial of service rather than code execution or data disclosure. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; vendor patches are available for the 6.1, 6.6, 6.12, 6.18 and 7.2 stable branches.
Local attackers holding CAP_SYS_ADMIN can crash or destabilize the Linux kernel by racing the device-mapper resume ioctl against a concurrent device removal on the same mapped device, so the table is torn down in __dm_destroy without the postsuspend callback the dm targets depend on. The most concrete consequence documented is a use-after-free in the dm-integrity target, whose reboot notifier is left registered when postsuspend is skipped, while other targets may simply misbehave; the independent assessment rates this as a privilege-gated, non-deterministic denial-of-service rather than code execution or data disclosure, materially below the vendor's 7.8 HIGH score. No public exploit code has been identified at time of analysis, and the flaw is not known to be actively exploited.
Denial of service in the Linux kernel's fsl-edma DMA engine driver lets a local user with write access to tracefs event-injection files crash the system by causing the fsl_edma trace event handler to dereference a stale struct fsl_edma_engine pointer. Affected systems are those running NXP/Freescale eDMA hardware (for example i.MX or Layerscape) with kernel tracing enabled; the independent assessment rates this as a local DoS requiring root/CAP_SYS_ADMIN (assessed CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H), which is narrower than the vendor's 7.8 score. A local trigger is described in the upstream fix, so publicly available exploit code exists, but there is no CISA KEV entry indicating active exploitation.
A use-after-free race condition in the Linux kernel kprobes subsystem (CVE-2026-89988) lets a highly privileged local actor corrupt kernel memory by racing a blacklist traversal against a concurrent kernel module unload. Specifically, __within_kprobe_blacklist() walks kprobe_blacklist without holding kprobe_mutex, while kprobe_remove_area_blacklist() unlinks and immediately kfree()s those same entries when a module is unloaded, so a traversal that lands in the race window dereferences freed memory. The upstream fix converts the list to RCU (guard(rcu)(), list_for_each_entry_rcu(), list_add_tail_rcu(), list_del_rcu(), kfree_rcu()); it is not known to be exploited and no public exploit code was identified at time of analysis, and EPSS/KEV data are absent. Our independent assessment rates this materially lower than the published CVSS 7.8: it requires local access with the ability to register kprobes (root / CAP_SYS_ADMIN / CAP_SYS_MODULE or the debugfs kprobe interface) plus concurrent module load/unload churn, and the timing window is narrow (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H, moderate, ~4.7).
A context-inappropriate allocation in the Linux kernel's weighted-interleave memory policy path causes a sleeping (GFP_KERNEL) allocation to be performed while executing in atomic/RCU context. The bug exists only in kernels that provide the MPOL_WEIGHTED_INTERLEAVE mempolicy, introduced in Linux 6.9, and is triggered when an authenticated local user has that policy set on the current task while an rhashtable bucket-table allocation rehashes under rcu_read_lock() with GFP_ATOMIC and falls back to vmalloc (__vmalloc_node_range_noprof → vm_area_alloc_pages → alloc_pages_bulk_mempolicy → alloc_pages_bulk_weighted_interleave), which then hardcodes GFP_KERNEL for its temporary weights array. The observable impact is a might_alloc()/might_sleep() splat - most visible with CONFIG_DEBUG_ATOMIC_SLEEP enabled - with no confidentiality or integrity consequence and at most a minor availability effect; the window is timing- and workload-dependent and not directly attacker-controlled, and no public exploit has been identified at time of analysis. The vendor's assigned CVSS of 7.8 is substantially higher than the assessed real-world risk, which our analysis rates as low (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L).
Cross-node folio migration in the Linux kernel 7.1 memory cgroup controller can leave a folio's objcg pointing at a different node than the LRU list the folio actually belongs to, so memcg reparenting resolves the wrong lruvec and takes the wrong lru_lock, corrupting memory-cgroup accounting and risking kernel failure (assessed availability impact High, integrity Low, confidentiality None). Exposure is narrow: it requires the memory controller active (default in modern container/systemd deployments), genuinely multi-node NUMA hardware, local authenticated access (CVSS vector PR:L) to trigger cross-node migration, and a race with memcg_reparent_objcgs() during cgroup offline in the non-atomic window between objcg and LRU-splicing iterations; single-node systems and kernels before 7.1 are unaffected. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; vendor fixes are 7.2.5 and 7.3-rc1, so the vendor score of 7.8 (AV:L/AC:L/.../C:H/I:H/A:H) materially overstates real-world risk relative to the assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H.
A race condition in the Linux kernel ALSA PCM (sound) subsystem allows a local, authenticated user with access to a sound device node to trigger conflicting PCM state transitions - specifically, an atomic trigger-start racing a non-atomic hw_params, hw_free, or prepare operation on the same stream. The realistic outcome is internal state inconsistency and a kernel ODEBUG warning (as reported by syzkaller), not memory corruption or privilege escalation; the distro-assigned CVSS of 7.8 is substantially overstated relative to the assessed vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L), which reflects low availability impact only. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so exploitation requires winning a tight, non-deterministic timing race from an already-privileged local position.
An out-of-bounds write in the Linux kernel's device-memory migration helpers (mm/migrate_device) allows a local user who holds a file descriptor to a ZONE_DEVICE/HMM-capable device to corrupt kernel memory. When a compound (transparent huge) folio is migrated into device memory and its page-granular span extends past the end of the caller-supplied npages PFN array, migrate_device_range() and migrate_device_pfns() clear folio entries past the array boundary; the path is exercised in practice by dmirror_fops_release() on /dev/hmm_dmirror0 and by GPU shared-virtual-memory drivers such as nouveau or amdgpu SVM. Exploitation is local only and conditional, requiring a device-memory migration-capable kernel build and a specific huge-page-versus-range boundary condition (assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, integrity and availability impact with no confidentiality impact); no public exploit identified at time of analysis.
Out-of-bounds write in the Linux kernel's nvdimm BTT (Block Translation Table) driver allows a privileged local attacker who can supply a crafted or foreign BTT arena to corrupt kernel memory, primarily degrading availability and potentially altering data. The flaw is triggered when the BTT info block's unvalidated nfree field is set below the host's per-lane count (ND_MAX_LANES), so the I/O path indexes freelist[]/rtt[] arrays past their allocations; exploitation requires local root/CAP_SYS_ADMIN or physical control over the persistent-memory medium being probed, making it a low-real-risk issue despite a high base score. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing); EPSS data was not supplied.
Incorrect PFN bookkeeping in the Linux kernel's PowerPC compound vmemmap population path (vmemmap_populate_compound_pages) causes the kernel to compute the wrong pfn_offset and therefore make the head/tail struct-page mapping decision for the wrong position within a compound page, which can corrupt vmemmap contents or crash the system when PowerPC systems exercise compound-page vmemmap optimization (ZONE_DEVICE / device-DAX / persistent memory or memory-hotplug configurations). This is a deterministic setup- or boot-time arithmetic miscalculation rather than an attacker-controlled primitive: the vendor CVSS of 7.8 assumes local, low-privilege access with high confidentiality and integrity impact, but an independent re-assessment scores it CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H, noting the vendor vector appears over-scored because triggering the mis-decision requires high privileges to drive memory hotplug/device configuration, depends on specific compound-page population and alignment conditions, and has no remote or unauthenticated vector. No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is limited to PowerPC (PPC) kernels, and vendor-released fixes are available in the 6.6.157, 6.12.110, 6.18.51, 7.2.5, and 7.3-rc1 stable/mainline trees.
A local use-after-free in the Linux kernel's Industrial I/O (IIO) subsystem can crash or corrupt the kernel when an anonymous IIO buffer handle is released while its underlying IIO device is being torn down at the same time. Only kernels built with the anonymous/DMABUF buffer interface introduced in 6.11 are affected, and the vendor-scored 7.8 severity is not supported by the evidence: exploitation requires local low-privileged access (CVSS PR:L), a narrow race with driver unbind or hot-unplug (AC:H), and results in denial of service (kernel memory corruption/crash) rather than the high confidentiality and integrity impact the vendor vector claims. Patches are available in the stable tree (6.12.110, 6.18.51, 7.2.5, and 7.3-rc1); no confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis.
A race-condition use-after-free in the Linux kernel's IIO (Industrial I/O) buffer DMA-fence implementation allows a local attacker with access to an IIO device exposing the DMABUF buffer interface to corrupt kernel memory by racing the fence's teardown against lockless RCU readers - the custom release path calls kfree() rather than deferring the free through RCU or the standard dma_fence_free() helper. The flaw affects kernels that include the IIO DMABUF buffer support introduced in 6.11 and was fixed in 6.12.110, 6.18.51, 7.2.5 and 7.3-rc1; exploitation requires a vulnerable IIO DMABUF-capable device, a build with that support enabled, and a timing-dependent race window, so it is local-only and not deterministic. Per independent assessment the realistic impact is availability and limited integrity loss (AC:H, C:N/I:L/A:H) rather than the confidentiality breach suggested by the higher vendor-published score, and no public exploit code has been identified at time of analysis.
Use-after-free in the Linux kernel's IIO buffer DMABUF path where an iio_dma_fence can outlive the iio_dmabuf_priv structure that holds its embedded lock, so a fence signal or release callback can touch a freed lock object. Affected kernels are Linux 6.11 through the fixed releases 6.12.110, 6.18.51, 7.2.5 and 7.3-rc1, and exploitation requires local access to a host whose hardware/driver exposes the IIO DMABUF buffer interface with permission to open the IIO device node (CVSS PR:L, no UI). The vendor advisory lists a patch, and no public exploit or CISA KEV entry was identified at time of analysis; our independent assessment rates this Medium (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) because the race window is timing-sensitive and the affected surface is driver-specific rather than universal, which is noticeably lower than the vendor-supplied 7.8 vector.
Use-after-free in the Linux kernel's IIO atlas-sensor driver (Atlas Scientific chemical sensors) is reachable when an IIO buffer is enabled and the driver is torn down: the devm-managed data-ready IRQ keeps queueing an irq_work that calls iio_trigger_poll(data->trig), and free_irq() during the devres unwind after atlas_remove() never flushes that pending work, so atlas_work_handler() can dereference an already-freed trigger/indio_dev via container_of(). The driver has existed since Linux 4.8 and is only present on systems with real Atlas Scientific I2C sensor hardware attached; exploitation requires authenticated local access (typically root privileges to unbind the device or unload the module), with an enabled buffer, and it is constrained by a narrow race-timing window - the assessed impact is low integrity and high availability (denial of service / memory corruption on teardown) with no confidentiality impact. No public exploit identified at time of analysis, and the flaw was closed upstream by calling iio_trigger_poll_nested() directly from the threaded handler so free_irq() drains it, with fixes shipped in 6.6.157, 6.12.110, 6.18.51 and 7.2.5.
A use-after-free race condition in the Linux kernel's s390 KVM guest-debug watchpoint code lets a local user who can control an IBM Z guest VM read or corrupt freed kernel memory. When a hardware watchpoint is imported via the KVM_SET_GUEST_DEBUG path, __import_wp_info() backs up guest memory with read_guest_abs() without holding kvm->srcu, so a concurrent memslot update can free the memslots array mid-read. Exploitation is s390-specific, requires local privileges over the VM/VMM (authenticated, PR:L per the assessed vector) and a narrow timing window, so reliability is limited; no public exploit code and no confirmed active exploitation were identified at time of analysis, and patch data indicates the vendor has released fixes.
Memory corruption on IBM Z (s390) KVM hosts running the Linux kernel is triggered when a channel-subsystem damage machine check (the CK bit) is reinjected into a guest, causing the host kernel to kfree() a stack variable. Exploitation requires an authenticated local actor with existing privileges on an s390 host that runs KVM guests (CVSS AV:L/PR:L) and depends on a hardware/host error condition that cannot be summoned on demand, which is reflected in the assessed AC:H and a scope-changed impact profile of low integrity and high availability impact rather than full host compromise. Vendor-released patches exist (stable 6.18.51, 7.2.5 and 7.3-rc1/mainline commits); no public exploit code and no confirmed active exploitation were identified at time of analysis.
A race condition in the Linux kernel's KVM s390 (IBM Z) keyop path lets a local user who already holds a KVM VM file descriptor cause gmap->asce to be read without the mmu_lock, potentially using a stale address-space-control element and corrupting memory. Exploitation requires s390 hardware, VM-fd access, and issuing KVM_S390_KEYOP concurrently with KVM_S390_VM_MEM_LIMIT_SIZE so that keyop reads asce while gmap_set_limit() mutates it under the write lock; it is timing-dependent, not remotely reachable, and no public exploit has been identified at time of analysis. The upstream fix has been merged and shipped in stable Linux 7.2.5 and 7.3-rc1, though an independent assessment rates real-world impact lower than the 7.8 base score by downgrading attack complexity to High and scope/confidentiality impact to None/low integrity, high availability.
Incorrect jump-offset calculation in the LoongArch BPF JIT of the Linux kernel can emit wrong tail-call branch targets, causing soft lockups (high availability impact) and, per the assessed vector, limited integrity impact, while confidentiality is unaffected. Affected are LoongArch (Loongson) systems running vulnerable kernel branches including the 6.1.x, 6.6.x, 6.12.x, 6.15.x, 6.16.x and 6.17 lines; exploitation requires local access plus the capability to load eBPF programs into the kernel (CAP_BPF or CAP_SYS_ADMIN, since unprivileged BPF is disabled by default), and only manifests when extra JIT passes occur, so it is not a deterministic single-request trigger. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the assessed severity is lower than the headline 7.8 because the flaw is architecture-specific, capability-gated and condition-dependent; vendor-released patches are available in 6.18.51, 7.2.5 and 7.3-rc1.
A race in the LoongArch rethook/kretprobe trampoline allows the per-CPU base register ($r21/$u0) to be restored with a stale value after a probed task is preempted and migrated to a different CPU, causing this_cpu_*() accesses (runqueues, RCU per-CPU data, timer tick programming, FPU ownership) to hit the wrong CPU's percpu area and ultimately corrupting scheduler and timer state. The result under heavy kretprobe load is scheduling-while-atomic splats, wrong-CPU RCU warnings, WARN_ON_ONCE(rq != this_rq()) in nohz_balance_exit_idle(), and in the worst case a CPU parking in the idle loop with its timer never re-armed, i.e. a hard lockup and denial of service. Only LoongArch systems running a preemptible kernel with active kretprobes/rethook are affected, and arming kretprobes normally requires CAP_SYS_ADMIN/CAP_PERFMON (root-equivalent), so this is not reachable by unprivileged local users in default configurations; there is no public exploit identified at time of analysis and no confirmed active exploitation.
A preempt-count underflow in the Linux kernel's LoongArch Kprobes breakpoint handling allows a local, low-privileged user to issue the same break 11 instruction that userspace can generate, driving do_bp() into kprobe_singlestep_handler() with no active probe attached and calling preempt_enable_no_resched() without the matching preempt_disable() that kprobe_breakpoint_handler() would normally have performed. Only LoongArch (loongarch64) kernels with Kprobes enabled are affected-other architectures do not use this break-11 path-and the corrupted preempt state makes in_interrupt() return true until the task reschedules, which causes cgroup_sk_alloc() to attribute new sockets to the root cgroup and can thereby evade a BPF_CGROUP_INET_SOCK_CREATE policy bound to the task's own cgroup. No public exploit code identified at time of analysis and the flaw is not listed in CISA KEV; the vendor CVSS of 7.8 overstates practical severity, since independent assessment limits impact to integrity and availability (Low) with no confidentiality impact and notes the notable security consequence requires a BPF cgroup socket-create policy to be present.
A race condition in the Linux kernel HDMI-CEC core (drivers/media/cec) lets a local user who can open a CEC character device (/dev/cecN) free an in-flight transmit data structure while its delayed work item is still pending, corrupting kernel state and typically crashing the system. Exploitation requires a CEC-capable adapter, permission to the device node, and a signal delivered at a narrow timing window between cancel_delayed_work_sync() and the kthread's schedule_delayed_work(&data->work) in cec_transmit_done_ts() - no public exploit code has been identified at time of analysis, and the impact is a denial of service via the debugobjects 'free active' path rather than information disclosure. Vendor-released patches exist in stable trees (6.12.110, 6.18.51, 7.2.5) and in 7.3-rc1; the affected surface is effectively absent on headless servers and most virtualized deployments without CEC hardware.
A heap out-of-bounds write in the Linux kernel's cx231xx USB video-capture driver allows a local, authenticated user (CVSS PR:L) who can open the device's V4L2 video and VBI nodes to corrupt kernel heap memory by resizing the device-wide frame geometry while a VBI stream is already running. The driver latches the VBI plane size at buffer-allocation time but recomputes the destination offset from the live dev->width and dev->norm on every URB completion, so an attacker can allocate a small VBI plane (small width or the NTSC standard), start VBI streaming, then enlarge dev->width via VIDIOC_S_FMT or switch dev->norm to PAL via VIDIOC_S_STD through the video node - the pre-patch code only checks the video queue (dev->vidq), not the VBI queue (dev->vbiq) - and have the device deliver a field-2 payload, causing cx231xx_do_vbi_copy() to memcpy() past the end of the smaller plane with an attacker-chosen offset and device-controlled contents. Vendor patches exist for Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51 and 7.2.5 (mainline 7.3-rc1); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical impact is bounded by the requirement for physical or emulated cx231xx hardware plus a race against live URB completion (the independent assessment scores this AV:L/AC:H with C:L, below the vendor's 7.8 High).
A use-after-free in the Linux kernel's cx23885 media driver lets a local attacker with low privileges (CVSS PR:L) corrupt or crash the kernel by triggering a race during teardown of a Conexant CX23885-based NetUP DVB conditional-access (CI) device. The NetUP CI work item netup_read_ci_status() can still be pending or executing on the system workqueue when netup_ci_exit() frees the associated netup_ci_state, because the removal path calls free_irq() (which stops new interrupts but does not drain already-queued work) before the CI device is unregistered; the fix inserts cancel_work_sync() before dvb_ca_en50221_release() and kfree(). Practical risk is materially lower than the headline score: our assessment rates this AV:L/AC:H (the upstream vector is AV:L/AC:L) because exploitation requires the specific NetUP CI hardware and feature to be active plus a narrow removal-time race window (module unload, device unbind, or physical hot-unplug), and there is no public exploit identified at time of analysis. Vendor-released patches exist for the affected stable series (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, and 7.2.5/7.3-rc1).
A use-after-free in the Linux kernel's go7007 media driver allows a local user who can open the driver's ALSA capture PCM node to trigger memory corruption by keeping that PCM file open across a device removal or unbind event (for example, a USB unplug). The flaw is a lifetime mismatch: go7007_snd_remove() releases the v4l2_device reference immediately after snd_card_free_when_closed(), even though the ALSA card - and its PCM callbacks reaching struct go7007 through pcm->private_data - can stay alive until the last file is closed, so go7007_snd_hw_free() may run against an already-freed object. Per the independent assessment the vector is local-only (AV:L, PR:L, AC:H) with high availability impact and limited confidentiality/integrity impact, and successful, reliable triggering requires the specific WIS GO7007 hardware to be present and the teardown timing window to be won; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV. Vendor-released patches are available in the stable branches listed below.
Use-after-free in the Linux kernel's ov02a10 MIPI CSI-2 sensor driver (media: i2c) can abort or destabilize driver probe on systems that physically include an OmniVision OV02A10 camera together with a firmware/device-tree description that binds that driver. The ov02a10_check_hwcfg() function calls fwnode_handle_put() on the parsed endpoint and then reads the optional 'ovti,mipi-clock-voltage' property through the same stale handle, while also letting the failure code from that optional property overwrite the function's return value, so probe can fail even when nothing else is wrong. Affected code ships from Linux 5.11 onward and is fixed in 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 and 7.3-rc1; no public exploit has been identified at time of analysis, and although the vendor scored this 7.8 (HIGH), real-world risk is LOW because the path is reachable only in kernel probe context on specific sensor hardware and is not a remote or user-controllable trigger.
A teardown-order defect in the Linux kernel's ov7740 i2c camera-sensor driver causes a use-after-destroy and a double-free when the driver is unbound or the OmniVision OV7740 sensor is physically removed, panicking the kernel or otherwise taking the system down. Only systems that ship an OV7740 sensor with the CONFIG_VIDEO_OV7740 driver built or loaded are affected, so exposure is limited to specific embedded/SoC platforms. The flaw is local-only, cannot be triggered by an unprivileged process on a default configuration, and no public exploit identified at time of analysis; the vendor scores it 7.8, whereas our reassessment is lower (AV:L/AC:H/PR:L/UI:N/C:N/I:L/A:H) because the realistic impact is a crash rather than code execution or data disclosure - the accompanying 'Information Disclosure' tag is not supported by the assessed vector.
The Linux kernel's sunxi-cir driver (Allwinner CIR/IR receiver, media/rc subsystem) fails to unregister the rc device when probe fails after rc_register_device() has already succeeded, leaving the registration and its resources behind. This is a local, low-severity driver lifecycle bug: the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, since the fault requires a genuine probe failure at IRQ lookup, IRQ request, or hardware initialization - conditions that are not attacker-controllable in a default configuration and generally need local privileged access (forced bind/unbind, resource exhaustion, or device-tree/IRQ faults) to induce. No public exploit code has been identified at time of analysis, and vendor-released fixes exist in stable kernels including 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, and 7.2.5.
Out-of-bounds array reads in the Linux kernel's Rockchip rkvdec stateless HEVC decoder allow a local user who can open the V4L2 mem2m decoder device node to trigger an unsigned integer underflow in short-term reference picture set (RPS) prediction, causing the driver to index far outside the calculated_rps_st_sets array. The flaw is reached by submitting an EXT_SPS_ST_RPS control with the INTER_REF_PIC_SET_PRED flag set and a crafted delta_idx_minus1 value that exceeds the current RPS index; the CVSS vector requires local access with low privileges (PR:L), so no third-party user interaction is needed but the attacker must already hold permissions on the decoder device. Impact is bounded to information disclosure and availability (the assessed vector is AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H), and it is confined to embedded Rockchip ARM platforms where the rkvdec driver is present and loaded; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). The vendor-published CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates real-world risk because exploitation demands specific hardware, driver availability, and a stateless decode session that raises attack complexity and limits the outcome to a memory read rather than code execution.
A missing error-path teardown in the Linux kernel's rtl2832_sdr SDR driver lets a local attacker with low privileges (PR:L) who can reach the V4L2/SDR device node for an RTL2832U-based USB dongle leak coherent DMA memory and trigger an out-of-bounds read/pass-garbage-pointer condition in USB URB cleanup. The defect only manifests when rtl2832_sdr_start_streaming() fails after allocation - realistically an induced -ENOMEM during alloc_stream_bufs()/alloc_urbs()/submit_urbs() - and is then followed by a second VIDIOC_STREAMON, which over-increments urbs_initialized past MAX_BULK_BUFS and causes rtl2832_sdr_free_urbs() to index beyond dev->urb_list[] before handing stale pointers to usb_free_urb(). The result is a resource leak and memory-corruption/denial-of-service condition rather than direct data theft, and our independent assessment scores this AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, materially below the vendor's 7.8 C:H/I:H/A:H rating; exploitation requires specific SDR hardware, the driver being loaded, and memory-pressure conditions, and there is no public exploit identified at time of analysis.
Use-after-free in the Linux kernel's TI VPE/VIP media capture driver (media: ti: vpe) allows a locally authenticated attacker who can open and stream from a VIP /dev/videoN node to trigger memory corruption by racing stream teardown against outstanding interrupt work. The driver's VIP overflow recovery worker - armed from the hardirq handler when a FIFO overflow is detected - and the VPDMA list-complete path both continue to dereference stream, port, and device state after vip_release_stream() or free_stream() has freed those resources, because vip_stop_streaming() masks the per-list IRQs without synchronizing the hardirq handler or disabling recovery_work. Exploitation requires local access plus the ability to induce a FIFO overflow and win a tight timing window against file release or unbind/remove, so our independent assessment rates this AC:H with limited confidentiality and integrity impact but high availability impact (NVD scores it 7.8 AV:L/AC:L/PR:L). No public exploit code was identified at time of analysis, and the flaw is hardware-specific to TI Davinci/OMAP/AM-class SoCs with VIP capture hardware.
Out-of-bounds array access in the Linux kernel V4L2 control framework for stateless HEVC decoders lets a local user who can write to a V4L2 device node (/dev/video*) supply HEVC SPS short-term and long-term reference picture set counts that exceed the HEVC limits of 64 ST RPS sets and 32 LT references, so a decoder driver that trusts those counts can index past the EXT SPS dynamic arrays. The published CVSS vector rates this as 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), whereas our independent assessment scores it lower (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H) because the flaw only manifests when a stateless HEVC decoder driver consumes the attacker-supplied counts without performing its own bounds validation; there is no public exploit identified at time of analysis and no CISA KEV entry. Vendor-released fixes are available in Linux 7.2.5 and 7.3-rc1.
Double-free in the Linux kernel's legacy zoran V4L2 media driver on teardown allows a local user who can trigger device/driver removal to kfree() the same registered video_device twice, crashing the kernel or corrupting kernel memory. Only systems where the zoran driver is bound to real Zoran ZR36057/ZR36067-based PCI MJPEG framegrabber hardware (Buz, DC10, LML33-class cards) are affected, and the flaw is reachable only through teardown paths such as module unload, PCI unbind/removal, or driver shutdown - not through normal runtime device I/O and not remotely. Vendor patches are available across maintained stable branches (6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5, and 7.3-rc1); exploitation requires the local authenticated context indicated by the CVSS vector (PR:L), and no public exploit code or confirmed active exploitation was identified at time of analysis. The practical impact is bounded to local denial of service because the affected hardware is obsolete and rarely deployed and the outcome is a crash rather than a controlled memory write.
A use-after-free read in the Linux kernel's qla2xxx SCSI driver allows a local low-privilege (authenticated) user on a host with a QLogic cs84xx-capable Fibre Channel HBA to dereference freed memory by reading the 84xx_fw_version sysfs attribute while the adapter is being torn down. The race is bounded to the teardown window between qla84xx_put_chip() freeing ha->cs84xx and scsi_remove_host() draining the sysfs show handler, and since the dereference in qla24xx_84xx_fw_version_show() is read-only the realistic impact is an information leak or kernel crash rather than controlled corruption, meaning the vendor CVSS of 7.8 overstates real risk for this narrow, hardware-dependent timing bug. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); vendor patches are available in the stable kernel releases listed in remediation.
A folio reference-count imbalance in the Linux kernel's f2fs filesystem lets a local user who can drive the redirty_blocks() path over-decrement a pinned folio when read_cache_folio() fails before any folio is pinned and readahead has already cached that same folio, after which drop_caches or reclaim can emit "BUG: Bad page state" and corrupt kernel memory state. Only kernels that include the folio-conversion commit 5951fee46bef are affected, i.e. Linux 6.16 through the fixed releases 6.18.51, 7.2.5 and 7.3-rc1. Exploitation requires local access with low privileges (CVSS:3.1/AV:L/PR:L) and is gated on a non-deterministic failure-plus-readahead race, so reliability is poor (AC:H); the independent assessment rates confidentiality impact as none with limited integrity and high availability impact, and no public exploit has been identified at time of analysis.
A use-after-put race in the Linux kernel's f2fs filesystem during large-folio invalidation allows a local low-privileged attacker who can concurrently drive a truncate or folio split against f2fs_get_read_data_folio() to leave stale xarray slots and corrupted page state in the page cache, resulting in livelocks, bad page statistics, and possible memory corruption. Only kernels built with f2fs large/compound folio support are affected - the flaw was introduced on the v6.18/7.0 development line (commit 05e65c14ea59a401cec4284e9d612f9d5dc1b3f8 and later) and is fixed in the vendor-released 7.2.5 stable update and 7.3-rc1. The vendor rates this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but independent assessment downgrades it to AC:H/C:L because a narrow timing window must be won and the outcome is memory corruption or denial of service rather than reliable code execution; no public exploit identified at time of analysis.
A missing dirty-flag clear on f2fs node folios in the Linux kernel's error-handling path can leave inconsistent node data unpersisted to storage, degrading on-disk filesystem consistency. The flaw is reachable only with local access (PR:L per CVSS vector) and requires encountering or supplying a corrupted f2fs node block (checksum mismatch or inconsistent footer information) to trigger the vulnerable code path. The vendor-assigned CVSS 3.1 score of 7.8 is materially over-scored per independent analysis, which assesses AV:L/AC:H/PR:L with no confidentiality impact and low integrity/availability impact; no public exploit identified at time of analysis, and vendor patches are available in stable kernel releases (6.18.51, 7.2.5, 7.3-rc1).