Link Library, a WordPress plugin, writes a generated image to a destination folder that is taken directly from user input without sanitization, so an authenticated user with the Contributor role or higher can create arbitrary directories and write or overwrite image files anywhere the web server process has write permission - including paths outside the site's document root (CVE-2026-78394, CWE-22 path traversal, affecting versions before 7.9.6). Because the written filename is always numeric with a fixed image extension, the primitive cannot be used to drop executable PHP, and the assessed impact is limited to low-integrity file write/overwrite (CVSS 4.1, AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N); this is confirmed not to be an actively exploited issue (no CISA KEV entry), publicly available exploit code does exist, and EPSS is negligible at 0.16% (4th percentile). The vendor has released a fix in 7.9.6, which is the straightforward and recommended remedy.
Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows unauthenticated remote attackers to cause a logged-in author or administrator to perform state-changing actions under the victim's authority, because the CSRF validation filter accepts requests that omit the required salt token and instead validates against a value the server itself generated for the request. Exploitation requires social engineering the privileged user into visiting a crafted page while their session is active (UI:R); no optional feature or non-default configuration is needed, and both standard and multipart forms are affected. A vendor patch is available in Apache Roller 6.1.6 or later; no public exploit code or active exploitation has been identified at time of analysis. The impact is bounded by the victim's own permission level (owner, editor, drafter, or administrator).
Unauthenticated SQL injection in Piwigo's pending-database-upgrade authentication path lets a remote attacker bypass administrator credentials and trigger the upgrade routine on affected galleries. The flaw lives in check_upgrade_access_rights() (admin/include/functions_upgrade.php), which only applies addslashes() escaping when the legacy get_magic_quotes_gpc function exists; because that function was removed in PHP 8.0, any Piwigo instance prior to 16.4.0 running PHP 8 concatenates the submitted username straight into the upgrade authentication query. Exploitation is gated on a transient state - the instance must have a pending database upgrade so this code path is reachable - and requires a crafted query result that satisfies both the status and password checks to set PHPWG_IN_UPGRADE, which is why the assessed vector carries AC:H. There is no public exploit code and no confirmed active exploitation (CISA KEV) at time of analysis, and an upstream fix is available in Piwigo 16.4.0.
Arbitrary file deletion in the Modula Image Gallery - Photo Grid & Video Gallery WordPress plugin, affecting all versions through 3.0.2, allows authenticated attackers with Author-level privileges or higher to delete arbitrary files on the underlying server by supplying a crafted file path to the upload_image function. The root cause is missing authorization (CWE-862) compounded by insufficient path validation; the plugin's restriction to wp-content/uploads does not act as an ownership boundary because every user attachment file resides within that tree, and Authors trivially satisfy the edit_post check on galleries they own. The vulnerability carries a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), reflecting network reachability, low complexity, and high integrity and availability impact, with no confidentiality impact; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Server-side request forgery in the Link Library WordPress plugin versions 7.8.8 through 7.9.5 allows unauthenticated visitors to make the site issue outbound requests to hosts on its internal network and to observe from the response whether an internal service answered. The flaw is an incomplete fix for CVE-2025-68600 and only manifests when the plugin's protected 'safe request' is rejected and it falls back to an unprotected fetch, so sites must have published the plugin's public link submission form with reciprocal-link validation enabled to be exposed. Publicly available exploit code exists, but EPSS is only 0.13% (2nd percentile) and the independent assessment rates this as a genuinely low-priority, information-only issue with a non-default configuration prerequisite.
Out-of-bounds memory access in the Linux kernel XFS realtime reverse-mapping (rtrmapbt) and realtime refcount (rtrefcountbt) btree code stems from _maxlevels_ondisk functions that omit the inode root level when sizing in-memory btree cursors, so a tall btree can drive accesses past the end of the allocated cursor. Local attackers on an XFS filesystem that uses a realtime device together with rtrmapbt or rtrefcountbt can trigger the condition; the non-default feature combination and the requirement for a sufficiently large btree keep exposure limited, and our assessment rates it local-only with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) rather than the more severe 7.8 vector supplied with the CVE. Vendor patches are available in stable kernels 6.18.53, 7.2.7 and 7.3-rc3, and no public exploit code or confirmed active exploitation was identified at time of analysis.
An out-of-bounds read in the Linux kernel's cachefiles coherency tracepoint lets a local user with the trace_cachefiles_coherency tracepoint enabled cause the kernel to read up to 8 bytes past a variable-length (potentially zero-length) coherency xattr buffer, triggering a KASAN warning or a use-after-free-style fault in the tracing path. Only systems actively using the cachefiles module for fscache-backed caching of network filesystems such as NFS or AFS, and where that tracepoint has been turned on, are exposed, and enabling kernel tracepoints normally requires root or CAP_SYS_ADMIN, so the practical privilege bar is higher than the nominal vector suggests. The exposed window is bounded to roughly 8 bytes, so impact is a minor information leak or a crash rather than reliable kernel code execution; EPSS is low (0.17%, 5th percentile), no public exploit code has been identified at time of analysis, and vendor patches are available.
The NXP i.MX fsl_micfil ASoC driver in the Linux kernel mismanages the MCLK microphone clock: hw_params() enables it and hw_free() disables it without guarding against unbalanced calls, so ALSA PCM operations can produce an "already disabled" kernel WARN() or leak an enable reference that leaves the clock permanently ungated. Only systems built with this digital PDM microphone driver and exposed to the corresponding local ALSA PCM device are affected; the practical consequence is a warning and a resource leak, with no memory corruption or code execution primitive described. No public exploit code has been identified at time of analysis, and the issue is assessed as low availability impact requiring local access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L); a vendor patch is available per the kernel stable commits.
A use-after-free race in the Linux kernel's IPv6 FIB6 route-table walker lets a local user who can delete IPv6 routes free a seq private object while it is still linked on net->ipv6.fib6_walkers, after which a subsequent route deletion traverses the dangling list and dereferences the freed walker. The race is triggered by concurrently iterating the route table through /proc/net/ipv6_route or the BPF ipv6_route iterator while removing the last route at a FIB6 table root, and the BPF show path only widens the already non-deterministic window. Exploitation requires local access on an IPv6-enabled host, is timing-dependent, and typically needs route-deletion privileges (CAP_NET_ADMIN, sometimes reachable via unprivileged user namespaces); assessed impact is kernel memory corruption resulting in low integrity impact and high availability impact (crash/DoS), with potential privilege-escalation consequences in that local context. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available in the referenced stable trees.
Linux kernel MPLS handling retains a stale inner_protocol/inner_network_header record after the last MPLS label is popped, so a subsequent MPLS push combined with Open vSwitch recirculation and fragmentation causes ovs_fragment() to trust a stale header offset and compute a wildly oversized memcpy that crashes the kernel. Affected are Linux builds exposing the MPLS datapath plus either Open vSwitch push/pop/fragment actions or the tc act_mpls action; exploitation requires local access with CAP_NET_ADMIN to program the datapath and a host already configured with those actions, and the observed outcome is a deterministic kernel BUG/page fault rather than a controllable code-execution or data-disclosure primitive, consistent with our assessed vector (AV:L/AC:H/PR:L, C:N/I:L/A:H). Vendor patches are available for the stable branches (6.12.111, 6.18.53, 7.2.7, 7.3-rc3), and no public exploit code has been identified at time of analysis; CVE-2026-97612 is not in CISA KEV.
An incorrect free in the Linux kernel's AFS (kAFS/AndrewFS) client, in afs_lookup_server(), allows a local, low-privileged user who has an AFS filesystem mounted to crash the kernel; the faulty code path is only reached during racy candidate-server cleanup, so it is confined to hosts actually running the kAFS client. Kernels from roughly 6.15 up to the fixed 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3 releases are affected, and while NVD scores this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), our independent assessment lowers it to AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H because the realistic outcome is a kernel crash in a rare configuration rather than controllable memory corruption. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
A local out-of-bounds write in the Linux kernel's MediaTek vcodec AV1 decoder (vdec_av1_slice_setup_tile) lets an attacker who can open the mtk-vcodec V4L2 stateless AV1 decode device node and submit a crafted bitstream copy tile_info entries beyond the capacity of the mi_col_starts[]/mi_row_starts[] arrays, corrupting adjacent kernel memory. Exploitation is confined to MediaTek SoC platforms that actually ship the AV1 decoder driver and expose the decode device locally; our independent assessment rates it AV:L/AC:H/PR:L with high availability impact but only limited integrity impact and no confidentiality impact, which is substantially lower than the 7.8 base score published by NVD. No public exploit code has been identified at time of analysis, and vendor-released patches are available (Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3).
A local user on Rockchip RK3588-class systems can crash the kernel, and potentially corrupt a small DMA descriptor buffer, by submitting a crafted AV1 stateless-decode request to the verisilicon VPU981 hardware decoder driver. The flaw lies in rockchip_vpu981_av1_dec_set_tile_info(), which divides context_update_tile_id by a bitstream-controlled tile_cols value without checking for zero and writes one descriptor per tile into a fixed-size tile_info buffer holding only AV1_MAX_TILES entries. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, but vendor-released fixes are available in Linux 6.12.111, 6.18.53, 7.2.7, and 7.3-rc3. Note the discrepancy between the published 7.8 score (C:H/I:H/A:H) and the independent assessment, which rates confidentiality impact None, integrity Low, and availability High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) because reachability is confined to this specific SoC decoder and the attacker must already hold local access to the V4L2 decode node.
Out-of-bounds access in the Linux kernel's Rockchip VPU981 stateless AV1 video decoder (drivers/media/platform/verisilicon) allows a local, low-privileged user who can open the decoder's V4L2 device node to read past the tile group entry control array and to program the hardware with more tiles than the descriptor buffer holds, by submitting a crafted AV1 frame that declares tile_cols * tile_rows larger than either the number of tile group entries supplied or AV1_MAX_TILES. The assessed impact is primarily denial of service (kernel memory corruption/hardware misprogramming can crash the decoder path) with limited integrity impact and a potential information-disclosure angle, reflected in our scored vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. Exploitation requires the specific Rockchip VPU981-class hardware plus an exposed stateless AV1 decoder node, which sharply narrows the exposed population versus a generic kernel flaw; no public exploit has been identified at time of analysis, and vendor patches are available in Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3.
Insufficient bounds validation of HEVC tile counts in the Linux kernel's V4L2 control framework lets a local user with access to a stateless HEVC decoder device node cause out-of-bounds reads by submitting a crafted V4L2_CTRL_TYPE_HEVC_PPS compound control. The kernel reads num_tile_columns_minus1 + 1 entries from column_width_minus1[] and num_tile_rows_minus1 + 1 entries from row_height_minus1[], and because std_validate_compound() does not bound these u8 counts, tile-loop bounds can run past the fixed-size uAPI arrays whenever tiling is enabled. Exploitation requires local access to a system exposing a V4L2 stateless HEVC decoder (typically ARM/SoC hardware codecs, often gated behind the 'video' group) plus the ability to issue a VIDIOC_S_EXT_CTRLS ioctl; it is not remotely reachable, and no public exploit has been identified at time of analysis. The impact is assessed as availability-focused with limited integrity effects (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) rather than the higher-confidentiality score sometimes attached to this CVE.
Out-of-range AV1 tile geometry submitted through the Video4Linux2 stateless-decoder control interface is not bounded by the kernel's compound-control validator in Linux 6.5 and later, so a local user who can open a mem2mem AV1 decode device can drive loop bounds, array indices, a divisor, and per-tile descriptor buffer sizing with attacker-controlled tile_cols/tile_rows values. The flaw is reachable only locally, requires an account with access to the relevant /dev/video* node (typically 'video' group membership) and a driver implementing a stateless AV1 decoder, and no public exploit code has been identified at time of analysis; the risk is therefore a config- and access-gated kernel memory-safety issue rather than a network-exploitable one. Exploitation prerequisites plus high attack complexity and the absence of any confidentiality impact keep the practical risk below the 7.8 score shown in some feeds - no vendor advisory has flagged active exploitation (not listed in CISA KEV).
Out-of-bounds read and incorrect per-CPU value handling in Linux kernel BPF per-CPU map update paths affect systems whose possible CPU IDs are non-contiguous, such as 0,2-3. A local attacker who can load BPF programs and update per-CPU array, hash, or cgroup storage maps without BPF_F_CPU or BPF_F_ALL_CPUS can make the kernel index the value buffer by logical CPU ID instead of a dense slot, causing out-of-bounds reads and wrong per-CPU values; this normally requires CAP_BPF or CAP_SYS_ADMIN. Exploitation is constrained by the sparse-CPU-topology requirement and local privileged access, no public exploit identified at time of analysis, and EPSS is 0.16% (5th percentile).
A local altname-conflict handling flaw in the Linux kernel's network namespace teardown path (__dev_change_net_namespace()) allows an attacker with CAP_NET_ADMIN in a network namespace to trigger a WARN_ON assertion splat in cfg80211_pernet_exit() by assigning the same alternative interface name to devices in both the root netns and a non-root netns and then destroying the non-root netns. The affected code is the wireless (cfg80211/cfg802154) per-netns cleanup, which previously lacked the conflict-removal logic already added for default_device_exit_net(); the fix generalizes that cleanup into __dev_change_net_namespace(). Exploitation requires local access and the ability to create network namespaces and devices - achievable by an unprivileged user where unprivileged user namespaces are enabled - but the practical impact is limited to a kernel warning on default configurations, escalating to a real denial of service only when panic_on_warn=1 is set; no public exploit code has been identified at time of analysis, and this issue is not confirmed actively exploited (CISA KEV). Our independent assessment rates this as low real risk and considers the supplied CVSS 7.8 (C:H/I:H/A:H) materially overstated.
Use-after-free in the Linux kernel's in-kernel Open vSwitch datapath lets a local user holding CAP_NET_ADMIN crash the kernel by racing flow-table mask reallocation against packet lookups. Because tbl_mask_array_realloc() retires the old mask array with call_rcu() before repointing tbl->mask_array at the new one, a lookup that enters ovs_flow_tbl_lookup_stats() during that preemptible window can dereference memory that mask_array_rcu_cb() has already kfree()'d, producing the KASAN slab-use-after-free observed on the fast path. Exploitation requires the openvswitch datapath to be loaded and actively processing flows and depends on winning a narrow timing window, so the realistic outcome is kernel panic/denial of service rather than reliable data disclosure or code execution; no public exploit identified at time of analysis, and vendor patches are available (Linux 6.12.111, 6.18.53, 7.2.7, 7.3-rc3).
A use-after-free in the Linux kernel's Landlock security module (current_check_refer_path()/hook_path_link()) lets a local process that has already entered a Landlock domain handling at least one filesystem access right race a linkat(2) loop against rename(2) plus rmdir(2) so that a freed parent dentry is walked during security_path_link(), triggering a KASAN slab-use-after-free. Impact per our independent assessment is primarily availability (kernel memory corruption/crash) with limited integrity effects, not confidentiality; the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, which is lower on complexity and confidentiality than the vendor-published CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - signals conflict sharply on severity. Exploitation requires local code execution, membership in an active Landlock domain, and winning a timing-sensitive race; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no public exploit has been identified at time of analysis.
An out-of-bounds write in the Linux kernel's ASoC compress-audio platform driver for Spreadtrum/Unisoc (sprd) SoCs lets an authenticated local user who can open the SPRD compress PCM device corrupt kernel memory: the driver allocates fixed 32 KB IRAM and 2 MB DDR stage buffers but derives all copy lengths from the user-controlled fragment_size and buffer_size supplied via SNDRV_COMPRESS_SET_PARAMS, so an oversized request overflows past those fixed allocations during write(). The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H (7.8, HIGH), reflecting deterministic local exploitation with no user interaction and no need for SNDRV_PCM_TRIGGER_START, though impact is confined to Unisoc/Spreadtrum platforms that actually build and load this driver. Vendor-released patches are available (Linux 6.12.111, 6.18.53, 7.2.7, and 7.3-rc3); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Discovery is credited to Atuin, an automated vulnerability discovery engine, and the issue is tracked as EUVD-2026-86764.
Heap corruption in the Linux kernel's IPv6 fragment reassembly logic can be turned into local privilege escalation by a low-privileged local user (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H in our assessment) on systems where unprivileged user/network namespaces are enabled and IPv6 fragment processing is reachable. The flaw stems from a race during network-namespace teardown: fqdir_pre_exit() flushes the skbs held in incomplete fragment queues without marking those queues complete, so a fragment that acquired a reference just before high_thresh was cleared can reuse stale reassembly metadata, and ip6_frag_reasm() then applies an old nhoffset to a new skb, producing an out-of-bounds write (KASAN: slab-out-of-bounds in ipv6_frag_rcv / ip6_protocol_deliver_rcu against skbuff_small_head). Successful exploitation yields kernel heap corruption exploitable for elevation to root; the primary limiting factor is winning the race between fqdir teardown and concurrent reassembly, and no public exploit code or confirmed active exploitation has been identified at time of analysis. A separate side effect is that unflushed fragments can keep conntrack references alive past the per-net conntrack cleanup point.
Linux kernel builds in the 7.2 development series contain a regression in the mm/slab allocator that lets an unprivileged local user corrupt the kernel's partial-slab lists by winning a narrow multi-CPU race, resulting in a list_add corruption BUG and a fatal kernel panic (denial of service). The independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H: the attacker needs only an ordinary local account and no user interaction, but must win a tight timing window in which one CPU inserts a slab onto pc.slabs outside n->list_lock while another is removing that slab from n->partial, as demonstrated in the upstream report through the System V message-queue (msgsnd) path running as UID 65534. The issue is not listed in CISA KEV and no public exploit was identified at time of analysis, although the upstream report includes a reproducer trace; vendor fixes are released as stable commits 570a6aaf6b52c6ec098f4811cdb52b1496f13d15 (Linux 7.2.7) and 4a724bcf5d703e18957397914d79156fa2cf1174 (Linux 7.3-rc3).
A memory-lifetime bug in the Linux kernel's ftrace function-graph tracer allows a child task to free its parent's active function-graph return stack (ret_stack), after which the parent writes to the freed slab object inside function_graph_enter_regs(). The flaw is reachable only on the fork error path: ftrace_graph_init_task() runs after copy_exec_state(), so when a non-CLONE_VM fork's task_exec_state allocation fails under memory pressure, copy_process() unwinds through bad_fork_free/free_task() and ftrace_graph_exit_task() frees the still-shared parent ret_stack; systems that never enable the function_graph tracer are unaffected, and the trigger path normally requires privileged (tracefs) access, so exploitation prerequisites are local and configuration-dependent. Published CVSS 3.1 is 7.8 (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H), but our independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H because the attacker must both have function_graph tracing active and force an allocation failure; no public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Memory corruption and denial of service in the Linux kernel's accel/ethosu driver can be triggered by an authenticated local user with access to the Arm Ethos-U NPU device by submitting a job that sets its SRAM size to 0 while the command stream still contains SRAM accesses; this causes the region base register write to be skipped and a stale base address from a prior job to be used. The independent assessment rates the impact as low confidentiality and integrity with high availability (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H), noting that the NVD score of 7.8 likely overstates the real impact because the flaw is limited to SRAM regions and requires niche Ethos-U hardware. No public exploit code has been identified, and the vulnerability is not known to be actively exploited; a vendor patch is available.
Out-of-bounds writes in the Linux kernel's rkvdec driver for Rockchip stateless HEVC video decoding let a local user who can open the V4L2 decoder device submit a crafted HEVC Picture Parameter Set and drive tile-loop counters and the pic_parameter_set_id beyond the driver's hardware table capacity, corrupting adjacent kernel/driver memory. Exploitation is gated on Rockchip decode hardware being present and on local low-privileged access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, per the independent assessment), and the realistic outcome is a kernel crash or integrity impact rather than code execution or data disclosure; no public exploit has been identified at time of analysis. The issue is fixed in the vendor's stable trees via upstream commits 03beb248d8a7bab30559a60d4df81f167e63b9e3 and 81ad46bb33d8fd279aaa33af5296c648814c964b, corresponding to the Linux 7.2.7 and 7.3-rc3 releases.
A use-after-free (CWE-416) in the Linux kernel's ACPI platform device code lets a local attacker with low privileges crash or potentially corrupt kernel memory by racing device creation/teardown against the lifetime of the physical device node returned by acpi_get_first_physical_node(). Kernels from 4.6 onward that include the ACPI platform subsystem (standard on ACPI-based x86 systems) are affected only until the fix commits are applied; stable kernels patched to 7.2.6 or 7.3-rc1 are not vulnerable. No public exploit code has been identified and the flaw is not in CISA KEV, with EPSS at 0.14% (3rd percentile); successful abuse requires winning a race that is difficult to trigger deterministically, so real-world risk is concentrated on multi-tenant or locally shared hosts.
Xen PV guests running the Linux kernel's drm/virtio GPU driver can present the host with guest-physical page addresses as framebuffer backing, so the hypervisor-side display path resolves them to memory owned by other domains - reading and scanning out unrelated host memory instead of the intended resource. Only Xen PV domains using virtio-gpu/virtio-vga are affected, and only when VIRTIO_F_ACCESS_PLATFORM was not negotiated (QEMU's default virtio-vga does not set iommu_platform, leaving the driver's own use_dma_api flag false); PVH and HVM domains are identity-mapped and unaffected. The weakness is local to the guest with the kernel's privileges (CVSS AV:L/PR:L, AC:H, scope-changed) rather than remotely reachable, and no public exploit code has been identified at time of analysis; vendor fixes ship in kernel 6.18.53, 7.2.7 and 7.3-rc2.
Use-after-free in the Linux kernel's bcmasp driver for Broadcom ASP 2.0 Ethernet hardware can cause premature release of an sk_buff when a reused TX descriptor retains a stale "last" flag, affecting only systems with that specific Broadcom NIC/SoC and requiring local access plus fragmented transmission activity that leads to descriptor reuse. The assessed impact is primarily availability (A:H) with limited integrity (I:L) and no confidentiality loss (C:N) under CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, and no public exploit identified at time of analysis. The original base score of 7.8 and C:H/I:H/A:H overstate real-world risk because the trigger requires specific hardware, local privileges, and a non-deterministic timing-dependent TX-ring condition.
Use-after-free in the Linux kernel net/sched traffic-control subsystem allows a local attacker holding CAP_NET_ADMIN to crash the kernel by sending a crafted RTM_NEWQDISC netlink request that installs a clsact qdisc binding a populated shared ingress block while also carrying an invalid TCA_RATE attribute, so estimator setup fails after ->init() has already published the embedded mini_Qdisc and the unwind path synchronously frees that qdisc while lockless readers on the tc_run() packet path may still hold a pointer to it. The assessed vector (AV:L/AC:H/PR:L/UI:N) reflects that exploitation needs local privileges plus a race window that only reliably opens with concurrent traffic on the affected interface, and the resulting impact is denial of service through a kernel crash rather than code execution or data compromise. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; kernel.org released fixes in the referenced stable branches.
Use-after-free in the Linux kernel's VXLAN multicast database (MDB) handling lets a local, low-privileged attacker corrupt kernel memory by crafting netlink MDB requests, though no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV). The root cause is that vxlan_mdb_is_valid_source() accepts the all-zeros address as both MDBE_ATTR_SOURCE and a source-list member, causing the derived (S,G) key to be byte-identical to the (*,G) key, so vxlan_mdb_remote_src_del() frees an entry and then deletes it a second time. The independently assessed impact is limited to integrity and availability (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) rather than the higher confidentiality/integrity scores in the vendor-published vector, because the flaw is a local write primitive and denial-of-service/crash risk rather than a disclosure channel; exploitation requires a user namespace where an unprivileged user can obtain CAP_NET_ADMIN in a new network namespace, and is blocked where unprivileged user namespaces are disabled.
A page-level use-after-free in the Linux kernel ALSA PCM subsystem lets a local user with access to a /dev/snd PCM character device turn a race between a concurrent mmap() and a buffer reallocation into a stale, writable mapping of freed DMA buffer pages, which can be reclaimed by the allocator and reused for local privilege escalation. The attacker must issue SNDRV_PCM_IOCTL_HW_PARAMS/HW_FREE from one thread while another thread mmaps the same PCM stream, and must win a narrow timing window (assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code has been identified at time of analysis, although the upstream commit states a reproducer is available on request, and this CVE is not in CISA KEV. Vendor patches are available in the stable trees (6.12.111, 6.18.53, 7.2.7) and mainline 7.3-rc2, with backports to older long-term branches, so unpatched kernels running ALSA PCM support remain exposed to any local user who can open a PCM device.
A race condition in the Linux kernel's VXLAN driver (vxlan_fdb_destroy / vxlan_cleanup path) lets a local attacker holding CAP_NET_ADMIN corrupt the shared per-nexthop FDB list and trigger a slab-use-after-free, producing kernel memory corruption that can crash the host and may be leveraged for privilege escalation. Kernels that support FDB nexthops in VXLAN (introduced around 5.8) are affected up to the released fixes, but the bug is only reachable in a non-default EVPN-style topology in which at least two VXLAN devices reference the same FDB nexthop id, data-plane learning is disabled, and 'dynamic' FDB entries are created so they become eligible for the aging timer. Practical risk is far lower than the NVD base score of 7.8 implies: exploitation demands privileged local access, an uncommon shared-nexthop configuration, and winning a timing-dependent race, and there is no public exploit identified at time of analysis and no CISA KEV listing; the vendor has released patches.
A slab use-after-free in the Linux kernel process-exit path lets a local user with an ordinary account crash or destabilize the system by winning a narrow race between wait4(-1) reaping an exiting task and a concurrent setsid() that drops the last PIDTYPE link for that task's struct pid. The bug affects kernels carrying the 0a36bad01731 regression (Linux 6.16 through the 6.18.53/7.2.7 fixes) and requires local authenticated access (CVSS PR:L), with success being timing-dependent; the outcome observed under KASAN is a kernel crash from a bad read of pid->inodes in proc_invalidate_siblings_dcache, not a controlled read/write or privilege gain. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, although a tested reproducer exists privately; patch status is vendor-released, with fixes shipping in 6.18.53, 7.2.7, and 7.3-rc3.
Local users who already hold access to a vdpa_sim_blk virtio-block device can drive requests whose start sector is at or beyond the device capacity, causing an unsigned underflow in vdpasim_blk_check_range() that forwards a wildly out-of-range buffer offset into the data path and yields out-of-bounds writes (VIRTIO_BLK_T_OUT copy-in, VIRTIO_BLK_T_WRITE_ZEROES memset) and out-of-bounds reads (VIRTIO_BLK_T_IN). The flaw affects Linux kernels built with the CONFIG_VDPA_SIM_BLK simulator driver since the feature was introduced (around 5.13) and is fixed by stable patches 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3; there is no public exploit code and no confirmed active exploitation (no public exploit identified at time of analysis), and the practical risk is bounded because this is a development/simulation driver that is rarely enabled on production systems. The independently assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H) treats integrity and availability as the dominant impacts and downgrades confidentiality relative to the vendor score.
Use-after-free race in the Linux kernel's ksmbd SMB3 server can be triggered when a network-device event such as an interface up/down operation invokes ksmbd's netdevice notifier during listener teardown, potentially allowing a local actor who can induce netdev events to corrupt memory and cause denial of service. Affected systems are those with CONFIG_SMB_SERVER enabled and at least one ksmbd listener bound to a network interface; hosts using userspace Samba instead of ksmbd are not affected. No CISA KEV entry or public exploit code was provided, and no public exploit identified at time of analysis; the assessed vector is local, high complexity, PR:L, C:N/I:L/A:H, so the NVD 7.8 vector overstates confidentiality and integrity risk, while vendor-released fixes are available in Linux 7.2.7 and 7.3-rc2.
Local denial of service in the Linux kernel's newly introduced nstree/listns() namespace-listing infrastructure, where the kernel takes a reference on a candidate mount namespace before the caller's permission to see it has been checked, so on the denial path the final reference can be dropped inside an RCU read-side critical section and put_mnt_ns() may sleep there. Only kernels new enough to contain the nstree code (introduced by commit 76b6f5dfb3fd, present in Linux 6.19 and 7.x builds such as the 7.0.0-30-generic Ubuntu kernel in the reported splat) are affected, and triggering requires a local, already-authenticated user (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H per our assessment - no confidentiality impact and only low integrity impact, far below the formally published 7.8 vector) who can invoke listns(). The result is a 'Voluntary context switch within RCU read-side critical section' splat that can escalate to an RCU stall or hang on affected kernels; no public exploit has been identified at time of analysis and there is no KEV listing.
Incorrect interpretation of the NPU_SET_IFM/OFM_PRECISION field by the Linux kernel's accel/ethosu driver on Arm Ethos-U65 hardware lets a local user with access to the accelerator character device corrupt command-stream processing. Because bits 15:14 are read as an activation storage mode instead of the U65 rounding mode, natural rounding (value 2) streams are rejected with -EINVAL, and truncating rounding (value 1) streams are misrouted to the two-tile address path where a feature-map size is computed from tile bases the stream never initialized, degrading integrity of NPU operations and potentially crashing the affected subsystem. Authentication is required (CVSS vector PR:L, local vector AV:L); no public exploit code has been identified at time of analysis, and exploitation is limited to systems running the driver bound to real Ethos-U65 silicon, such as NXP i.MX93 SoCs. Vendor-released patches are available in the referenced kernel stable commits, with EUVD listing Linux 7.2.7 and 7.3-rc2 as fixed.
A kernel error-handling bug in the AMD IOMMU nested-domain allocation path of the Linux kernel (7.x, AMD-Vi/vIOMMU systems) causes domain-ID allocation failures to be silently ignored, so a nested IOMMU domain can be set up using a host domain ID that was never actually allocated. The flaw is reachable only by a locally privileged caller able to create IOMMU domains (iommufd/vIOMMU nested translation) and only when amd_iommu_pdom_id_alloc() actually fails (domain-ID space exhaustion or short memory), so it is a real but difficult-to-trigger error-path defect with no public exploit identified at time of analysis. Notably, the 7.8 NVD-style score (S:C/C:H/I:H/A:H) is inconsistent with the practical impact, which the independent assessment rates as limited integrity and availability gain on the error path only; vendor patches are available.
Privilege escalation in the Seclore FileSecure Desktop Client affects Windows hosts running any client version before 3.25.1.0, where an authenticated local user can abuse an improper access control weakness in the product's kernel-mode driver to obtain NT AUTHORITY\SYSTEM. The flaw is rated CVSS 3.1 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-269) and is strictly a post-authentication escalation - it cannot be used for initial access or network exploitation and requires an existing low-privileged session on the vulnerable host. There is no public exploit identified at time of analysis and no CISA KEV listing; SSVC records Exploitation: none, so the operational risk is concentrated in insider-threat and post-compromise scenarios rather than mass exploitation. A vendor-released patch is available in version 3.25.1.0.
Replay of a captured WSSE digest authentication header against Apache Roller 6.1.5 allows an attacker to assume the victim's AtomPub authority - publishing, editing, and deleting blog content under that identity - without ever knowing the underlying password. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L, 7.7) rates it as remotely reachable without valid credentials, but real-world exposure is tightly gated: the AtomPub API must be explicitly enabled (it ships off by default), WSSE must be the configured AtomPub authentication method, the install must use plaintext-compatible password storage, and the attacker must first be able to observe a legitimate user's header in transit, which is what drives the High attack complexity. Only version 6.1.5 is affected; 6.1.6 removes WSSE as an AtomPub authentication option, and no public exploit code has been identified at time of analysis (the issue is not in CISA KEV, so there is no confirmation of active exploitation).
Brute-force compromise of the second authentication factor in GLPI 11.0.0 through 11.0.7 lets an attacker who already holds a user's valid primary credentials repeatedly submit TOTP codes to the MFA verification endpoint, which applies no per-user limit on failed submissions, resulting in full account takeover. The weakness is a missing-anti-automation defect (CWE-307) that is reachable only after primary credential compromise and only on accounts where TOTP multi-factor authentication is actually enabled, so default deployments without MFA and instances patched to 11.0.8 are not affected. Exploitation is remote, requires authenticated (PR:L) access in the form of already-stolen credentials, and needs no user interaction, but no public exploit code has been identified and no active exploitation has been reported; the short validity window of a rotating time-based code is what pushes the official CVSS 4.0 score to 7.7 with high attack complexity rather than a critical rating.
XML external entity (XXE) processing in Apache Roller 6.1.5 allows an authenticated weblog administrator to read files accessible to the Roller process and to reach internal network addresses by importing a crafted OPML bookmark document, because the bookmark-import parser does not disable external entity resolution. The advisory confirms no non-default configuration is required - the administrator bookmark-import action is vulnerable out of the box on the affected release - which is consistent with the assessed CVSS 3.1 score of 7.7 High (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, scope changed, confidentiality-only impact). No public exploit code and no confirmed active exploitation have been identified at time of analysis; the issue is remediated in Apache Roller 6.1.6, which uses a hardened parser that disables external entities and document type declarations.
Stored cross-site scripting (XSS) in the RabbitMQ stream management UI allows an attacker who can present a trusted TLS client certificate with a crafted Distinguished Name to inject script into the certificate subject/issuer fields, which is then rendered unescaped when an operator opens the affected stream-connection detail page in the management UI. RabbitMQ 3.13.0 through 3.13.17, 4.0.x before 4.0.23, 4.1.x before 4.1.14, 4.2.x before 4.2.9, and 4.3.x before 4.3.3 are affected; fixes are released in 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, though the CVSS 4.0 base score is 7.6; the independent assessment rates real-world risk as low because exploitation requires non-default plugins, mutual-TLS with an attacker-controlled trusted certificate, and operator interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N).
A soft-lockup denial of service in the Linux kernel NVMe driver lets an attacker-controlled or misbehaving NVMe target stall host CPUs by advertising a sparse 32-bit namespace ID list containing a large gap, because nvme_scan_ns_list() walks every missing NSID one at a time instead of only the namespaces actually present. Practical exploitation is not drive-by: the host administrator must first attach the host to the hostile target, either over NVMe-over-Fabrics (an 'nvme connect' style operation) or through a crafted local NVMe device, and the resulting impact is availability only (C:N/I:N, A:H; assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, feed score 7.5). No public exploit identified at time of analysis and no CISA KEV entry is associated with this CVE, but vendor-released patches exist in the 6.12.111, 6.18.53, 7.2.7 and 7.3-rc2 kernel releases.
A reference-count leak in the Linux kernel CIFS/SMB client's oplock-break handling (cifs_queue_oplock_break) allows a failure path to hold an extra cifsFileInfo reference, which later causes unmount of the CIFS filesystem to fail with 'VFS: Busy inodes after unmount' and a kernel BUG at fs/super.c:777, resulting in a denial-of-service condition on affected hosts. The flaw is reachable when a second oplock break arrives while the first cifs_oplock_break work item is still queued, causing queue_work() to return false and the corresponding reference drop to be skipped; triggering it requires an SMB/CIFS share mounted from a server the attacker controls or that responds slowly, and mounting a share is normally a privileged operation on the client. No public exploit code was identified at time of analysis, and this issue is not in CISA KEV; while NVD assigns 7.5 (HIGH), the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, making this a moderate-to-low real-world risk because the race window is timing-dependent and the outcome is availability loss only.
Denial of service in the Linux kernel's Multipath TCP (MPTCP) receive path can occur when a subflow is reset during exceptional error handling, letting the receive path recursively re-enter mptcp_data_ready() and attempt to take the data lock a second time. The defect affects MPTCP-enabled kernels across several stable branches prior to fixes released in 6.12.111, 6.18.53, 7.2.7 and 7.3-rc4, and only hosts that actually run MPTCP connections carrying subflows are exposed; the traffic is reachable unauthenticated from the network (CVSS PR:N), but the triggering window is exceptionally rare and not deterministically reachable, which is why attack complexity is assessed as High. No public exploit identified at time of analysis and there is no confirmed active exploitation; the authoritative assessment classifies this as a robustness/reliability bug rather than a security-priority issue.
Divide-by-zero in the Linux kernel's Multipath TCP (MPTCP) scheduler allows an unauthenticated remote peer to crash an affected host, because a race between subflow selection for transmission and a subflow socket state change can leave the connection's MSS value (mss_now) reset to zero, which is then used as a divisor on a later release path. Only systems built with CONFIG_MPTCP and carrying multipath connections with multiple subflows are exposed - single-path TCP is unaffected - and successful triggering depends on hitting a narrow timing window rather than deterministic attacker control, consistent with an assessed vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (availability-only impact, no confidentiality or integrity loss). No public exploit code and no evidence of active exploitation were identified at time of analysis, and although the CVE is tagged 'Information Disclosure', the described behavior and the CVSS vector indicate a pure denial-of-service defect.
Reflected cross-site scripting in the RabbitMQ management UI lets an attacker execute arbitrary JavaScript in the management interface origin by injecting content into a bearer token that is embedded unescaped in the OAuth bootstrap script generated by set_token_auth/2. RabbitMQ server 4.2.0 through 4.2.7 and 4.3.0/4.3.1 are affected only when the management plugin is configured with management.oauth_enabled=true, which is what exposes the OAuth bootstrap endpoint before authentication; the attacker must also induce an administrator to load the affected page (UI:R), and the cookie-based variant additionally requires the attacker to first plant an access_token cookie on the management host. The vendor-supplied CVSS 4.0 base score of 7.5 is higher than our independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N), which better reflects the non-default configuration gate and the extra cookie-planting prerequisite; no public exploit code has been identified at time of analysis.
Local file inclusion in InvoicePlane before 1.7.2 allows an authenticated low-privileged user who can influence the e-invoice xml_id configuration to use path traversal sequences to include an existing .php file from the XMLconfigs helper directory. This is a moderate-priority, not urgent, finding: the advisory establishes local file inclusion, while full code execution would require a separate file-upload or file-write primitive, and no public exploit identified at time of analysis. The issue is fixed in version 1.7.2 via an allowlist on xml_id.