An out-of-bounds array access in the Linux kernel's Broadcom bnxt_en Ethernet driver can crash the kernel at boot or during receive processing on affected 57500/57600-family NICs, most notably the BCM57608 running firmware that advertises fewer concurrent TPA aggregations than the firmware's TPA ID range. Because the driver allocates rx_tpa with only bp->max_tpa entries (32 on the documented firmware version 233) while the software TPA ID derived from the firmware ID can reach 1023, bnxt_rx_pkt dereferences an invalid pointer and triggers a general protection fault. There is no public exploit identified at time of analysis, and the independent assessment is materially less severe than the published CVSS 8.1 - the flaw is a deterministic local/host-side denial-of-service condition on specific Broadcom hardware and firmware combinations, affects only kernels built from commit ec4d8e7cf024 onward, and no code execution or data disclosure primitive has been demonstrated. Remote attackers cannot trigger it without first gaining a position on the affected host's receive path; the operative impact is loss of availability (kernel panic).
A race condition in the Linux kernel's RDS-over-TCP transport (net/rds) lets a local user who can open and use an AF_RDS socket corrupt connection state when a transmit is in flight at the same moment the accept path resets the connection's callbacks. Because rds_tcp_reset_callbacks() only samples the RDS_IN_XMIT bit as clear rather than owning it, rds_send_xmit() can re-take the bit immediately afterwards and run concurrently with rds_send_path_reset() rewriting cp_xmit_* state, producing torn transmit state and a potential kernel crash/denial of service with limited integrity impact. The authoritative assessment scores this CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H - local access with low privileges, a narrow timing window, and, critically, manifestation restricted to weakly ordered CPUs (ARM, PowerPC) since the store-buffering pattern cannot occur on strongly ordered x86; no public exploit code has been identified at time of analysis and there is no confirmation of active exploitation (no CISA KEV entry), although the public tag of 'Information Disclosure' is a mischaracterization of what is really a CWE-362 concurrency bug. Vendor-released patches exist for the stable branches (6.12.111, 6.18.53, 7.2.7, and 7.3-rc2).
Remote code execution in Microsoft Outlook (delivered through Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024) arises from an integer overflow/wraparound that an unauthorized attacker can trigger by delivering a specially crafted message or file to an affected client. The vector is network-reachable, unauthenticated (PR:N), and lists no user interaction (UI:N), but high attack complexity (AC:H) means the attacker must satisfy specific, not fully controllable conditions to convert the wraparound into reliable memory corruption and code execution; CISA SSVC accordingly marks the flaw non-automatable and no exploitation has been observed. Signals are mixed and point to a serious-but-not-emergency priority: EPSS is only 0.35% (26th percentile), no public exploit code or KEV listing exists, technical impact is total if successful, and Microsoft has released a vendor patch.
A server-side request forgery in the VMware datastore driver of OpenStack glance_store lets an authenticated OpenStack user supply a crafted image location URI pointing at an attacker-controlled server, causing the driver's _retry_request function to attach sensitive vCenter authentication headers to that outbound request and disclose them. The deployment must be configured with the non-default VMware/vCenter datastore backend, and the attacker needs an account with the ability to set or override image locations (typically gated behind the set_location / show_multiple_locations policy); SSVC rates the issue as Exploitation=poc with publicly available exploit code on GitHub (sadandbset/CVE-2026-51772-CVE-2026-51773), Technical Impact=total, but Automatable=no, so it is a targeted attack rather than a mass-exploitation candidate and there is no confirmed active exploitation (CISA KEV) at time of analysis. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) reflects high confidentiality impact from credential theft; our independent assessment adjusts the integrity impact to Low because the primary outcome is leakage of authentication material rather than direct modification of data.
DNS rebinding against Rojo's unauthenticated 'rojo serve' HTTP API (default bind localhost, port 34872) allows a malicious webpage to read every file in the served project, write attacker-controlled code to disk, and trigger execution of local programs through the opener::open() handler. The issue affects pre-patch builds of the rojo-rbx/rojo crate and is network-reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, 8.1 High), but requires the developer to be running 'rojo serve' at the moment they visit an attacker-controlled page and requires the attacker to control DNS for the rebinding; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV. Impact is high for both confidentiality and integrity (full project source disclosure and arbitrary file writes) with no availability impact; exploitation is bounded to machines actively running the dev server.
Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows unauthenticated remote attackers to cause a logged-in author or administrator to perform state-changing actions under the victim's authority, because the CSRF validation filter accepts requests that omit the required salt token and instead validates against a value the server itself generated for the request. Exploitation requires social engineering the privileged user into visiting a crafted page while their session is active (UI:R); no optional feature or non-default configuration is needed, and both standard and multipart forms are affected. A vendor patch is available in Apache Roller 6.1.6 or later; no public exploit code or active exploitation has been identified at time of analysis. The impact is bounded by the victim's own permission level (owner, editor, drafter, or administrator).
Unauthenticated SQL injection in Piwigo's pending-database-upgrade authentication path lets a remote attacker bypass administrator credentials and trigger the upgrade routine on affected galleries. The flaw lives in check_upgrade_access_rights() (admin/include/functions_upgrade.php), which only applies addslashes() escaping when the legacy get_magic_quotes_gpc function exists; because that function was removed in PHP 8.0, any Piwigo instance prior to 16.4.0 running PHP 8 concatenates the submitted username straight into the upgrade authentication query. Exploitation is gated on a transient state - the instance must have a pending database upgrade so this code path is reachable - and requires a crafted query result that satisfies both the status and password checks to set PHPWG_IN_UPGRADE, which is why the assessed vector carries AC:H. There is no public exploit code and no confirmed active exploitation (CISA KEV) at time of analysis, and an upstream fix is available in Piwigo 16.4.0.
Arbitrary file deletion in the Modula Image Gallery - Photo Grid & Video Gallery WordPress plugin, affecting all versions through 3.0.2, allows authenticated attackers with Author-level privileges or higher to delete arbitrary files on the underlying server by supplying a crafted file path to the upload_image function. The root cause is missing authorization (CWE-862) compounded by insufficient path validation; the plugin's restriction to wp-content/uploads does not act as an ownership boundary because every user attachment file resides within that tree, and Authors trivially satisfy the edit_post check on galleries they own. The vulnerability carries a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), reflecting network reachability, low complexity, and high integrity and availability impact, with no confidentiality impact; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Out-of-bounds memory access in the Linux kernel XFS realtime reverse-mapping (rtrmapbt) and realtime refcount (rtrefcountbt) btree code stems from _maxlevels_ondisk functions that omit the inode root level when sizing in-memory btree cursors, so a tall btree can drive accesses past the end of the allocated cursor. Local attackers on an XFS filesystem that uses a realtime device together with rtrmapbt or rtrefcountbt can trigger the condition; the non-default feature combination and the requirement for a sufficiently large btree keep exposure limited, and our assessment rates it local-only with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) rather than the more severe 7.8 vector supplied with the CVE. Vendor patches are available in stable kernels 6.18.53, 7.2.7 and 7.3-rc3, and no public exploit code or confirmed active exploitation was identified at time of analysis.
An out-of-bounds read in the Linux kernel's cachefiles coherency tracepoint lets a local user with the trace_cachefiles_coherency tracepoint enabled cause the kernel to read up to 8 bytes past a variable-length (potentially zero-length) coherency xattr buffer, triggering a KASAN warning or a use-after-free-style fault in the tracing path. Only systems actively using the cachefiles module for fscache-backed caching of network filesystems such as NFS or AFS, and where that tracepoint has been turned on, are exposed, and enabling kernel tracepoints normally requires root or CAP_SYS_ADMIN, so the practical privilege bar is higher than the nominal vector suggests. The exposed window is bounded to roughly 8 bytes, so impact is a minor information leak or a crash rather than reliable kernel code execution; EPSS is low (0.17%, 5th percentile), no public exploit code has been identified at time of analysis, and vendor patches are available.
The NXP i.MX fsl_micfil ASoC driver in the Linux kernel mismanages the MCLK microphone clock: hw_params() enables it and hw_free() disables it without guarding against unbalanced calls, so ALSA PCM operations can produce an "already disabled" kernel WARN() or leak an enable reference that leaves the clock permanently ungated. Only systems built with this digital PDM microphone driver and exposed to the corresponding local ALSA PCM device are affected; the practical consequence is a warning and a resource leak, with no memory corruption or code execution primitive described. No public exploit code has been identified at time of analysis, and the issue is assessed as low availability impact requiring local access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L); a vendor patch is available per the kernel stable commits.
A use-after-free race in the Linux kernel's IPv6 FIB6 route-table walker lets a local user who can delete IPv6 routes free a seq private object while it is still linked on net->ipv6.fib6_walkers, after which a subsequent route deletion traverses the dangling list and dereferences the freed walker. The race is triggered by concurrently iterating the route table through /proc/net/ipv6_route or the BPF ipv6_route iterator while removing the last route at a FIB6 table root, and the BPF show path only widens the already non-deterministic window. Exploitation requires local access on an IPv6-enabled host, is timing-dependent, and typically needs route-deletion privileges (CAP_NET_ADMIN, sometimes reachable via unprivileged user namespaces); assessed impact is kernel memory corruption resulting in low integrity impact and high availability impact (crash/DoS), with potential privilege-escalation consequences in that local context. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available in the referenced stable trees.
Linux kernel MPLS handling retains a stale inner_protocol/inner_network_header record after the last MPLS label is popped, so a subsequent MPLS push combined with Open vSwitch recirculation and fragmentation causes ovs_fragment() to trust a stale header offset and compute a wildly oversized memcpy that crashes the kernel. Affected are Linux builds exposing the MPLS datapath plus either Open vSwitch push/pop/fragment actions or the tc act_mpls action; exploitation requires local access with CAP_NET_ADMIN to program the datapath and a host already configured with those actions, and the observed outcome is a deterministic kernel BUG/page fault rather than a controllable code-execution or data-disclosure primitive, consistent with our assessed vector (AV:L/AC:H/PR:L, C:N/I:L/A:H). Vendor patches are available for the stable branches (6.12.111, 6.18.53, 7.2.7, 7.3-rc3), and no public exploit code has been identified at time of analysis; CVE-2026-97612 is not in CISA KEV.
An incorrect free in the Linux kernel's AFS (kAFS/AndrewFS) client, in afs_lookup_server(), allows a local, low-privileged user who has an AFS filesystem mounted to crash the kernel; the faulty code path is only reached during racy candidate-server cleanup, so it is confined to hosts actually running the kAFS client. Kernels from roughly 6.15 up to the fixed 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3 releases are affected, and while NVD scores this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), our independent assessment lowers it to AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H because the realistic outcome is a kernel crash in a rare configuration rather than controllable memory corruption. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
A local out-of-bounds write in the Linux kernel's MediaTek vcodec AV1 decoder (vdec_av1_slice_setup_tile) lets an attacker who can open the mtk-vcodec V4L2 stateless AV1 decode device node and submit a crafted bitstream copy tile_info entries beyond the capacity of the mi_col_starts[]/mi_row_starts[] arrays, corrupting adjacent kernel memory. Exploitation is confined to MediaTek SoC platforms that actually ship the AV1 decoder driver and expose the decode device locally; our independent assessment rates it AV:L/AC:H/PR:L with high availability impact but only limited integrity impact and no confidentiality impact, which is substantially lower than the 7.8 base score published by NVD. No public exploit code has been identified at time of analysis, and vendor-released patches are available (Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3).
A local user on Rockchip RK3588-class systems can crash the kernel, and potentially corrupt a small DMA descriptor buffer, by submitting a crafted AV1 stateless-decode request to the verisilicon VPU981 hardware decoder driver. The flaw lies in rockchip_vpu981_av1_dec_set_tile_info(), which divides context_update_tile_id by a bitstream-controlled tile_cols value without checking for zero and writes one descriptor per tile into a fixed-size tile_info buffer holding only AV1_MAX_TILES entries. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, but vendor-released fixes are available in Linux 6.12.111, 6.18.53, 7.2.7, and 7.3-rc3. Note the discrepancy between the published 7.8 score (C:H/I:H/A:H) and the independent assessment, which rates confidentiality impact None, integrity Low, and availability High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) because reachability is confined to this specific SoC decoder and the attacker must already hold local access to the V4L2 decode node.
Out-of-bounds access in the Linux kernel's Rockchip VPU981 stateless AV1 video decoder (drivers/media/platform/verisilicon) allows a local, low-privileged user who can open the decoder's V4L2 device node to read past the tile group entry control array and to program the hardware with more tiles than the descriptor buffer holds, by submitting a crafted AV1 frame that declares tile_cols * tile_rows larger than either the number of tile group entries supplied or AV1_MAX_TILES. The assessed impact is primarily denial of service (kernel memory corruption/hardware misprogramming can crash the decoder path) with limited integrity impact and a potential information-disclosure angle, reflected in our scored vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. Exploitation requires the specific Rockchip VPU981-class hardware plus an exposed stateless AV1 decoder node, which sharply narrows the exposed population versus a generic kernel flaw; no public exploit has been identified at time of analysis, and vendor patches are available in Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3.
Insufficient bounds validation of HEVC tile counts in the Linux kernel's V4L2 control framework lets a local user with access to a stateless HEVC decoder device node cause out-of-bounds reads by submitting a crafted V4L2_CTRL_TYPE_HEVC_PPS compound control. The kernel reads num_tile_columns_minus1 + 1 entries from column_width_minus1[] and num_tile_rows_minus1 + 1 entries from row_height_minus1[], and because std_validate_compound() does not bound these u8 counts, tile-loop bounds can run past the fixed-size uAPI arrays whenever tiling is enabled. Exploitation requires local access to a system exposing a V4L2 stateless HEVC decoder (typically ARM/SoC hardware codecs, often gated behind the 'video' group) plus the ability to issue a VIDIOC_S_EXT_CTRLS ioctl; it is not remotely reachable, and no public exploit has been identified at time of analysis. The impact is assessed as availability-focused with limited integrity effects (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) rather than the higher-confidentiality score sometimes attached to this CVE.
Out-of-range AV1 tile geometry submitted through the Video4Linux2 stateless-decoder control interface is not bounded by the kernel's compound-control validator in Linux 6.5 and later, so a local user who can open a mem2mem AV1 decode device can drive loop bounds, array indices, a divisor, and per-tile descriptor buffer sizing with attacker-controlled tile_cols/tile_rows values. The flaw is reachable only locally, requires an account with access to the relevant /dev/video* node (typically 'video' group membership) and a driver implementing a stateless AV1 decoder, and no public exploit code has been identified at time of analysis; the risk is therefore a config- and access-gated kernel memory-safety issue rather than a network-exploitable one. Exploitation prerequisites plus high attack complexity and the absence of any confidentiality impact keep the practical risk below the 7.8 score shown in some feeds - no vendor advisory has flagged active exploitation (not listed in CISA KEV).
Out-of-bounds read and incorrect per-CPU value handling in Linux kernel BPF per-CPU map update paths affect systems whose possible CPU IDs are non-contiguous, such as 0,2-3. A local attacker who can load BPF programs and update per-CPU array, hash, or cgroup storage maps without BPF_F_CPU or BPF_F_ALL_CPUS can make the kernel index the value buffer by logical CPU ID instead of a dense slot, causing out-of-bounds reads and wrong per-CPU values; this normally requires CAP_BPF or CAP_SYS_ADMIN. Exploitation is constrained by the sparse-CPU-topology requirement and local privileged access, no public exploit identified at time of analysis, and EPSS is 0.16% (5th percentile).
A local altname-conflict handling flaw in the Linux kernel's network namespace teardown path (__dev_change_net_namespace()) allows an attacker with CAP_NET_ADMIN in a network namespace to trigger a WARN_ON assertion splat in cfg80211_pernet_exit() by assigning the same alternative interface name to devices in both the root netns and a non-root netns and then destroying the non-root netns. The affected code is the wireless (cfg80211/cfg802154) per-netns cleanup, which previously lacked the conflict-removal logic already added for default_device_exit_net(); the fix generalizes that cleanup into __dev_change_net_namespace(). Exploitation requires local access and the ability to create network namespaces and devices - achievable by an unprivileged user where unprivileged user namespaces are enabled - but the practical impact is limited to a kernel warning on default configurations, escalating to a real denial of service only when panic_on_warn=1 is set; no public exploit code has been identified at time of analysis, and this issue is not confirmed actively exploited (CISA KEV). Our independent assessment rates this as low real risk and considers the supplied CVSS 7.8 (C:H/I:H/A:H) materially overstated.
Use-after-free in the Linux kernel's in-kernel Open vSwitch datapath lets a local user holding CAP_NET_ADMIN crash the kernel by racing flow-table mask reallocation against packet lookups. Because tbl_mask_array_realloc() retires the old mask array with call_rcu() before repointing tbl->mask_array at the new one, a lookup that enters ovs_flow_tbl_lookup_stats() during that preemptible window can dereference memory that mask_array_rcu_cb() has already kfree()'d, producing the KASAN slab-use-after-free observed on the fast path. Exploitation requires the openvswitch datapath to be loaded and actively processing flows and depends on winning a narrow timing window, so the realistic outcome is kernel panic/denial of service rather than reliable data disclosure or code execution; no public exploit identified at time of analysis, and vendor patches are available (Linux 6.12.111, 6.18.53, 7.2.7, 7.3-rc3).
A use-after-free in the Linux kernel's Landlock security module (current_check_refer_path()/hook_path_link()) lets a local process that has already entered a Landlock domain handling at least one filesystem access right race a linkat(2) loop against rename(2) plus rmdir(2) so that a freed parent dentry is walked during security_path_link(), triggering a KASAN slab-use-after-free. Impact per our independent assessment is primarily availability (kernel memory corruption/crash) with limited integrity effects, not confidentiality; the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, which is lower on complexity and confidentiality than the vendor-published CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - signals conflict sharply on severity. Exploitation requires local code execution, membership in an active Landlock domain, and winning a timing-sensitive race; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no public exploit has been identified at time of analysis.
An out-of-bounds write in the Linux kernel's ASoC compress-audio platform driver for Spreadtrum/Unisoc (sprd) SoCs lets an authenticated local user who can open the SPRD compress PCM device corrupt kernel memory: the driver allocates fixed 32 KB IRAM and 2 MB DDR stage buffers but derives all copy lengths from the user-controlled fragment_size and buffer_size supplied via SNDRV_COMPRESS_SET_PARAMS, so an oversized request overflows past those fixed allocations during write(). The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H (7.8, HIGH), reflecting deterministic local exploitation with no user interaction and no need for SNDRV_PCM_TRIGGER_START, though impact is confined to Unisoc/Spreadtrum platforms that actually build and load this driver. Vendor-released patches are available (Linux 6.12.111, 6.18.53, 7.2.7, and 7.3-rc3); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Discovery is credited to Atuin, an automated vulnerability discovery engine, and the issue is tracked as EUVD-2026-86764.
Heap corruption in the Linux kernel's IPv6 fragment reassembly logic can be turned into local privilege escalation by a low-privileged local user (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H in our assessment) on systems where unprivileged user/network namespaces are enabled and IPv6 fragment processing is reachable. The flaw stems from a race during network-namespace teardown: fqdir_pre_exit() flushes the skbs held in incomplete fragment queues without marking those queues complete, so a fragment that acquired a reference just before high_thresh was cleared can reuse stale reassembly metadata, and ip6_frag_reasm() then applies an old nhoffset to a new skb, producing an out-of-bounds write (KASAN: slab-out-of-bounds in ipv6_frag_rcv / ip6_protocol_deliver_rcu against skbuff_small_head). Successful exploitation yields kernel heap corruption exploitable for elevation to root; the primary limiting factor is winning the race between fqdir teardown and concurrent reassembly, and no public exploit code or confirmed active exploitation has been identified at time of analysis. A separate side effect is that unflushed fragments can keep conntrack references alive past the per-net conntrack cleanup point.
Linux kernel builds in the 7.2 development series contain a regression in the mm/slab allocator that lets an unprivileged local user corrupt the kernel's partial-slab lists by winning a narrow multi-CPU race, resulting in a list_add corruption BUG and a fatal kernel panic (denial of service). The independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H: the attacker needs only an ordinary local account and no user interaction, but must win a tight timing window in which one CPU inserts a slab onto pc.slabs outside n->list_lock while another is removing that slab from n->partial, as demonstrated in the upstream report through the System V message-queue (msgsnd) path running as UID 65534. The issue is not listed in CISA KEV and no public exploit was identified at time of analysis, although the upstream report includes a reproducer trace; vendor fixes are released as stable commits 570a6aaf6b52c6ec098f4811cdb52b1496f13d15 (Linux 7.2.7) and 4a724bcf5d703e18957397914d79156fa2cf1174 (Linux 7.3-rc3).
A memory-lifetime bug in the Linux kernel's ftrace function-graph tracer allows a child task to free its parent's active function-graph return stack (ret_stack), after which the parent writes to the freed slab object inside function_graph_enter_regs(). The flaw is reachable only on the fork error path: ftrace_graph_init_task() runs after copy_exec_state(), so when a non-CLONE_VM fork's task_exec_state allocation fails under memory pressure, copy_process() unwinds through bad_fork_free/free_task() and ftrace_graph_exit_task() frees the still-shared parent ret_stack; systems that never enable the function_graph tracer are unaffected, and the trigger path normally requires privileged (tracefs) access, so exploitation prerequisites are local and configuration-dependent. Published CVSS 3.1 is 7.8 (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H), but our independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H because the attacker must both have function_graph tracing active and force an allocation failure; no public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Memory corruption and denial of service in the Linux kernel's accel/ethosu driver can be triggered by an authenticated local user with access to the Arm Ethos-U NPU device by submitting a job that sets its SRAM size to 0 while the command stream still contains SRAM accesses; this causes the region base register write to be skipped and a stale base address from a prior job to be used. The independent assessment rates the impact as low confidentiality and integrity with high availability (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H), noting that the NVD score of 7.8 likely overstates the real impact because the flaw is limited to SRAM regions and requires niche Ethos-U hardware. No public exploit code has been identified, and the vulnerability is not known to be actively exploited; a vendor patch is available.
Out-of-bounds writes in the Linux kernel's rkvdec driver for Rockchip stateless HEVC video decoding let a local user who can open the V4L2 decoder device submit a crafted HEVC Picture Parameter Set and drive tile-loop counters and the pic_parameter_set_id beyond the driver's hardware table capacity, corrupting adjacent kernel/driver memory. Exploitation is gated on Rockchip decode hardware being present and on local low-privileged access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, per the independent assessment), and the realistic outcome is a kernel crash or integrity impact rather than code execution or data disclosure; no public exploit has been identified at time of analysis. The issue is fixed in the vendor's stable trees via upstream commits 03beb248d8a7bab30559a60d4df81f167e63b9e3 and 81ad46bb33d8fd279aaa33af5296c648814c964b, corresponding to the Linux 7.2.7 and 7.3-rc3 releases.
A use-after-free (CWE-416) in the Linux kernel's ACPI platform device code lets a local attacker with low privileges crash or potentially corrupt kernel memory by racing device creation/teardown against the lifetime of the physical device node returned by acpi_get_first_physical_node(). Kernels from 4.6 onward that include the ACPI platform subsystem (standard on ACPI-based x86 systems) are affected only until the fix commits are applied; stable kernels patched to 7.2.6 or 7.3-rc1 are not vulnerable. No public exploit code has been identified and the flaw is not in CISA KEV, with EPSS at 0.14% (3rd percentile); successful abuse requires winning a race that is difficult to trigger deterministically, so real-world risk is concentrated on multi-tenant or locally shared hosts.
Xen PV guests running the Linux kernel's drm/virtio GPU driver can present the host with guest-physical page addresses as framebuffer backing, so the hypervisor-side display path resolves them to memory owned by other domains - reading and scanning out unrelated host memory instead of the intended resource. Only Xen PV domains using virtio-gpu/virtio-vga are affected, and only when VIRTIO_F_ACCESS_PLATFORM was not negotiated (QEMU's default virtio-vga does not set iommu_platform, leaving the driver's own use_dma_api flag false); PVH and HVM domains are identity-mapped and unaffected. The weakness is local to the guest with the kernel's privileges (CVSS AV:L/PR:L, AC:H, scope-changed) rather than remotely reachable, and no public exploit code has been identified at time of analysis; vendor fixes ship in kernel 6.18.53, 7.2.7 and 7.3-rc2.
Use-after-free in the Linux kernel's bcmasp driver for Broadcom ASP 2.0 Ethernet hardware can cause premature release of an sk_buff when a reused TX descriptor retains a stale "last" flag, affecting only systems with that specific Broadcom NIC/SoC and requiring local access plus fragmented transmission activity that leads to descriptor reuse. The assessed impact is primarily availability (A:H) with limited integrity (I:L) and no confidentiality loss (C:N) under CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, and no public exploit identified at time of analysis. The original base score of 7.8 and C:H/I:H/A:H overstate real-world risk because the trigger requires specific hardware, local privileges, and a non-deterministic timing-dependent TX-ring condition.
Use-after-free in the Linux kernel net/sched traffic-control subsystem allows a local attacker holding CAP_NET_ADMIN to crash the kernel by sending a crafted RTM_NEWQDISC netlink request that installs a clsact qdisc binding a populated shared ingress block while also carrying an invalid TCA_RATE attribute, so estimator setup fails after ->init() has already published the embedded mini_Qdisc and the unwind path synchronously frees that qdisc while lockless readers on the tc_run() packet path may still hold a pointer to it. The assessed vector (AV:L/AC:H/PR:L/UI:N) reflects that exploitation needs local privileges plus a race window that only reliably opens with concurrent traffic on the affected interface, and the resulting impact is denial of service through a kernel crash rather than code execution or data compromise. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; kernel.org released fixes in the referenced stable branches.
Use-after-free in the Linux kernel's VXLAN multicast database (MDB) handling lets a local, low-privileged attacker corrupt kernel memory by crafting netlink MDB requests, though no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV). The root cause is that vxlan_mdb_is_valid_source() accepts the all-zeros address as both MDBE_ATTR_SOURCE and a source-list member, causing the derived (S,G) key to be byte-identical to the (*,G) key, so vxlan_mdb_remote_src_del() frees an entry and then deletes it a second time. The independently assessed impact is limited to integrity and availability (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) rather than the higher confidentiality/integrity scores in the vendor-published vector, because the flaw is a local write primitive and denial-of-service/crash risk rather than a disclosure channel; exploitation requires a user namespace where an unprivileged user can obtain CAP_NET_ADMIN in a new network namespace, and is blocked where unprivileged user namespaces are disabled.
A page-level use-after-free in the Linux kernel ALSA PCM subsystem lets a local user with access to a /dev/snd PCM character device turn a race between a concurrent mmap() and a buffer reallocation into a stale, writable mapping of freed DMA buffer pages, which can be reclaimed by the allocator and reused for local privilege escalation. The attacker must issue SNDRV_PCM_IOCTL_HW_PARAMS/HW_FREE from one thread while another thread mmaps the same PCM stream, and must win a narrow timing window (assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code has been identified at time of analysis, although the upstream commit states a reproducer is available on request, and this CVE is not in CISA KEV. Vendor patches are available in the stable trees (6.12.111, 6.18.53, 7.2.7) and mainline 7.3-rc2, with backports to older long-term branches, so unpatched kernels running ALSA PCM support remain exposed to any local user who can open a PCM device.
A race condition in the Linux kernel's VXLAN driver (vxlan_fdb_destroy / vxlan_cleanup path) lets a local attacker holding CAP_NET_ADMIN corrupt the shared per-nexthop FDB list and trigger a slab-use-after-free, producing kernel memory corruption that can crash the host and may be leveraged for privilege escalation. Kernels that support FDB nexthops in VXLAN (introduced around 5.8) are affected up to the released fixes, but the bug is only reachable in a non-default EVPN-style topology in which at least two VXLAN devices reference the same FDB nexthop id, data-plane learning is disabled, and 'dynamic' FDB entries are created so they become eligible for the aging timer. Practical risk is far lower than the NVD base score of 7.8 implies: exploitation demands privileged local access, an uncommon shared-nexthop configuration, and winning a timing-dependent race, and there is no public exploit identified at time of analysis and no CISA KEV listing; the vendor has released patches.
A slab use-after-free in the Linux kernel process-exit path lets a local user with an ordinary account crash or destabilize the system by winning a narrow race between wait4(-1) reaping an exiting task and a concurrent setsid() that drops the last PIDTYPE link for that task's struct pid. The bug affects kernels carrying the 0a36bad01731 regression (Linux 6.16 through the 6.18.53/7.2.7 fixes) and requires local authenticated access (CVSS PR:L), with success being timing-dependent; the outcome observed under KASAN is a kernel crash from a bad read of pid->inodes in proc_invalidate_siblings_dcache, not a controlled read/write or privilege gain. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, although a tested reproducer exists privately; patch status is vendor-released, with fixes shipping in 6.18.53, 7.2.7, and 7.3-rc3.
Local users who already hold access to a vdpa_sim_blk virtio-block device can drive requests whose start sector is at or beyond the device capacity, causing an unsigned underflow in vdpasim_blk_check_range() that forwards a wildly out-of-range buffer offset into the data path and yields out-of-bounds writes (VIRTIO_BLK_T_OUT copy-in, VIRTIO_BLK_T_WRITE_ZEROES memset) and out-of-bounds reads (VIRTIO_BLK_T_IN). The flaw affects Linux kernels built with the CONFIG_VDPA_SIM_BLK simulator driver since the feature was introduced (around 5.13) and is fixed by stable patches 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3; there is no public exploit code and no confirmed active exploitation (no public exploit identified at time of analysis), and the practical risk is bounded because this is a development/simulation driver that is rarely enabled on production systems. The independently assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H) treats integrity and availability as the dominant impacts and downgrades confidentiality relative to the vendor score.
Use-after-free race in the Linux kernel's ksmbd SMB3 server can be triggered when a network-device event such as an interface up/down operation invokes ksmbd's netdevice notifier during listener teardown, potentially allowing a local actor who can induce netdev events to corrupt memory and cause denial of service. Affected systems are those with CONFIG_SMB_SERVER enabled and at least one ksmbd listener bound to a network interface; hosts using userspace Samba instead of ksmbd are not affected. No CISA KEV entry or public exploit code was provided, and no public exploit identified at time of analysis; the assessed vector is local, high complexity, PR:L, C:N/I:L/A:H, so the NVD 7.8 vector overstates confidentiality and integrity risk, while vendor-released fixes are available in Linux 7.2.7 and 7.3-rc2.
Local denial of service in the Linux kernel's newly introduced nstree/listns() namespace-listing infrastructure, where the kernel takes a reference on a candidate mount namespace before the caller's permission to see it has been checked, so on the denial path the final reference can be dropped inside an RCU read-side critical section and put_mnt_ns() may sleep there. Only kernels new enough to contain the nstree code (introduced by commit 76b6f5dfb3fd, present in Linux 6.19 and 7.x builds such as the 7.0.0-30-generic Ubuntu kernel in the reported splat) are affected, and triggering requires a local, already-authenticated user (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H per our assessment - no confidentiality impact and only low integrity impact, far below the formally published 7.8 vector) who can invoke listns(). The result is a 'Voluntary context switch within RCU read-side critical section' splat that can escalate to an RCU stall or hang on affected kernels; no public exploit has been identified at time of analysis and there is no KEV listing.
Incorrect interpretation of the NPU_SET_IFM/OFM_PRECISION field by the Linux kernel's accel/ethosu driver on Arm Ethos-U65 hardware lets a local user with access to the accelerator character device corrupt command-stream processing. Because bits 15:14 are read as an activation storage mode instead of the U65 rounding mode, natural rounding (value 2) streams are rejected with -EINVAL, and truncating rounding (value 1) streams are misrouted to the two-tile address path where a feature-map size is computed from tile bases the stream never initialized, degrading integrity of NPU operations and potentially crashing the affected subsystem. Authentication is required (CVSS vector PR:L, local vector AV:L); no public exploit code has been identified at time of analysis, and exploitation is limited to systems running the driver bound to real Ethos-U65 silicon, such as NXP i.MX93 SoCs. Vendor-released patches are available in the referenced kernel stable commits, with EUVD listing Linux 7.2.7 and 7.3-rc2 as fixed.
A kernel error-handling bug in the AMD IOMMU nested-domain allocation path of the Linux kernel (7.x, AMD-Vi/vIOMMU systems) causes domain-ID allocation failures to be silently ignored, so a nested IOMMU domain can be set up using a host domain ID that was never actually allocated. The flaw is reachable only by a locally privileged caller able to create IOMMU domains (iommufd/vIOMMU nested translation) and only when amd_iommu_pdom_id_alloc() actually fails (domain-ID space exhaustion or short memory), so it is a real but difficult-to-trigger error-path defect with no public exploit identified at time of analysis. Notably, the 7.8 NVD-style score (S:C/C:H/I:H/A:H) is inconsistent with the practical impact, which the independent assessment rates as limited integrity and availability gain on the error path only; vendor patches are available.
Privilege escalation in the Seclore FileSecure Desktop Client affects Windows hosts running any client version before 3.25.1.0, where an authenticated local user can abuse an improper access control weakness in the product's kernel-mode driver to obtain NT AUTHORITY\SYSTEM. The flaw is rated CVSS 3.1 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-269) and is strictly a post-authentication escalation - it cannot be used for initial access or network exploitation and requires an existing low-privileged session on the vulnerable host. There is no public exploit identified at time of analysis and no CISA KEV listing; SSVC records Exploitation: none, so the operational risk is concentrated in insider-threat and post-compromise scenarios rather than mass exploitation. A vendor-released patch is available in version 3.25.1.0.
Replay of a captured WSSE digest authentication header against Apache Roller 6.1.5 allows an attacker to assume the victim's AtomPub authority - publishing, editing, and deleting blog content under that identity - without ever knowing the underlying password. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L, 7.7) rates it as remotely reachable without valid credentials, but real-world exposure is tightly gated: the AtomPub API must be explicitly enabled (it ships off by default), WSSE must be the configured AtomPub authentication method, the install must use plaintext-compatible password storage, and the attacker must first be able to observe a legitimate user's header in transit, which is what drives the High attack complexity. Only version 6.1.5 is affected; 6.1.6 removes WSSE as an AtomPub authentication option, and no public exploit code has been identified at time of analysis (the issue is not in CISA KEV, so there is no confirmation of active exploitation).
Brute-force compromise of the second authentication factor in GLPI 11.0.0 through 11.0.7 lets an attacker who already holds a user's valid primary credentials repeatedly submit TOTP codes to the MFA verification endpoint, which applies no per-user limit on failed submissions, resulting in full account takeover. The weakness is a missing-anti-automation defect (CWE-307) that is reachable only after primary credential compromise and only on accounts where TOTP multi-factor authentication is actually enabled, so default deployments without MFA and instances patched to 11.0.8 are not affected. Exploitation is remote, requires authenticated (PR:L) access in the form of already-stolen credentials, and needs no user interaction, but no public exploit code has been identified and no active exploitation has been reported; the short validity window of a rotating time-based code is what pushes the official CVSS 4.0 score to 7.7 with high attack complexity rather than a critical rating.
XML external entity (XXE) processing in Apache Roller 6.1.5 allows an authenticated weblog administrator to read files accessible to the Roller process and to reach internal network addresses by importing a crafted OPML bookmark document, because the bookmark-import parser does not disable external entity resolution. The advisory confirms no non-default configuration is required - the administrator bookmark-import action is vulnerable out of the box on the affected release - which is consistent with the assessed CVSS 3.1 score of 7.7 High (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, scope changed, confidentiality-only impact). No public exploit code and no confirmed active exploitation have been identified at time of analysis; the issue is remediated in Apache Roller 6.1.6, which uses a hardened parser that disables external entities and document type declarations.
Stored cross-site scripting (XSS) in the RabbitMQ stream management UI allows an attacker who can present a trusted TLS client certificate with a crafted Distinguished Name to inject script into the certificate subject/issuer fields, which is then rendered unescaped when an operator opens the affected stream-connection detail page in the management UI. RabbitMQ 3.13.0 through 3.13.17, 4.0.x before 4.0.23, 4.1.x before 4.1.14, 4.2.x before 4.2.9, and 4.3.x before 4.3.3 are affected; fixes are released in 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, though the CVSS 4.0 base score is 7.6; the independent assessment rates real-world risk as low because exploitation requires non-default plugins, mutual-TLS with an attacker-controlled trusted certificate, and operator interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N).
A soft-lockup denial of service in the Linux kernel NVMe driver lets an attacker-controlled or misbehaving NVMe target stall host CPUs by advertising a sparse 32-bit namespace ID list containing a large gap, because nvme_scan_ns_list() walks every missing NSID one at a time instead of only the namespaces actually present. Practical exploitation is not drive-by: the host administrator must first attach the host to the hostile target, either over NVMe-over-Fabrics (an 'nvme connect' style operation) or through a crafted local NVMe device, and the resulting impact is availability only (C:N/I:N, A:H; assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, feed score 7.5). No public exploit identified at time of analysis and no CISA KEV entry is associated with this CVE, but vendor-released patches exist in the 6.12.111, 6.18.53, 7.2.7 and 7.3-rc2 kernel releases.
A reference-count leak in the Linux kernel CIFS/SMB client's oplock-break handling (cifs_queue_oplock_break) allows a failure path to hold an extra cifsFileInfo reference, which later causes unmount of the CIFS filesystem to fail with 'VFS: Busy inodes after unmount' and a kernel BUG at fs/super.c:777, resulting in a denial-of-service condition on affected hosts. The flaw is reachable when a second oplock break arrives while the first cifs_oplock_break work item is still queued, causing queue_work() to return false and the corresponding reference drop to be skipped; triggering it requires an SMB/CIFS share mounted from a server the attacker controls or that responds slowly, and mounting a share is normally a privileged operation on the client. No public exploit code was identified at time of analysis, and this issue is not in CISA KEV; while NVD assigns 7.5 (HIGH), the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, making this a moderate-to-low real-world risk because the race window is timing-dependent and the outcome is availability loss only.
Denial of service in the Linux kernel's Multipath TCP (MPTCP) receive path can occur when a subflow is reset during exceptional error handling, letting the receive path recursively re-enter mptcp_data_ready() and attempt to take the data lock a second time. The defect affects MPTCP-enabled kernels across several stable branches prior to fixes released in 6.12.111, 6.18.53, 7.2.7 and 7.3-rc4, and only hosts that actually run MPTCP connections carrying subflows are exposed; the traffic is reachable unauthenticated from the network (CVSS PR:N), but the triggering window is exceptionally rare and not deterministically reachable, which is why attack complexity is assessed as High. No public exploit identified at time of analysis and there is no confirmed active exploitation; the authoritative assessment classifies this as a robustness/reliability bug rather than a security-priority issue.