Flame dashboards running version 2.4.0 and earlier will sign administrator JSON Web Tokens with whatever lifespan a caller supplies, letting a previously privileged user mint a near-permanent admin token that survives password changes and account deprovisioning. Exploitation is authenticated (PR:H in the assessed vector) and requires that the attacker already held admin access at least once, so this is a persistence and re-entry flaw rather than a route to first-time compromise. Because every token is verified against a single static JWT secret that Flame generates once and never rotates, revocation is effectively impossible without manual secret replacement; no public exploit code or confirmed active exploitation was identified at time of analysis.
Atom-table exhaustion in RabbitMQ 4.x lets an authenticated user who holds the 'policymaker' tag crash a broker node by sending a sustained stream of requests (roughly one million) to the Management plugin's /api/global-parameters/:name endpoint, each with a unique name value. The handler passes the URL segment through rabbit_data_coercion:to_atom/1, which uses the unsafe binary_to_atom/2; because Erlang atoms are never garbage collected, every novel name permanently consumes an atom-table slot until the VM aborts. Exposure requires the Management plugin to be enabled and an account above the management tag (but below administrator); it is not reachable unauthenticated, and the assessed impact is availability-only (no confidentiality or integrity loss). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in RabbitMQ 4.0.22, 4.1.14, 4.2.7 and 4.3.1.
Cross-site request forgery in Horilla HR (horilla-hr) versions before 2.0.0 allows an unauthenticated attacker to silently approve pending attendance requests under a logged-in manager's identity, because the /attendance/approve-validate-attendance-request/ endpoint performed state-changing work (setting attendance_validated, is_validate_request_approved, approved_by and related pending-request flags, then calling attendance.save()) over an HTTP GET that Django's CSRF middleware never validates. The CVSS 3.1 assessment rates this AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, i.e. a low-integrity-impact flaw that requires a manager holding attendance.change_attendance to be authenticated and tricked into visiting attacker-controlled content while that session is active; the attacker cannot choose the approving identity and the impact is bounded to what that victim manager could approve. Vendor-released patch: 2.0.0. No public exploit identified at time of analysis, and the flaw is not confirmed actively exploited (not in CISA KEV).
Improperly controlled modification of dynamically-determined object attributes in the Ash framework for Elixir (ash 2.17.15 through 3.33.10) lets a caller set private action arguments, declared with public?: false, on the bulk update and bulk destroy code paths. The affected matching logic in Ash.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 compares every key of a caller-supplied parameter map against all of the action's arguments without checking public?, so any application that forwards end-user parameters into Ash.bulk_update/4 or Ash.bulk_destroy/4 (for example via AshJsonApi, AshGraphql, or a controller) can have a private argument injected; when that argument is referenced by an arg(...) template driving authorization, record ownership, or audit metadata, the result is an integrity violation or privilege escalation. The vendor has released a patch in 3.33.11 that requires public? in the bulk argument matching; no public exploit code has been identified at time of analysis, and the impact is conditional on the application both exposing a bulk action to untrusted input and using a security-relevant private argument.
Missing authentication in the GibbonEdu Gibbon Unit Planner endpoint modules/Planner/units_add_blockAjax.php (makeBlock function) lets remote attackers reach an AJAX action that should require a valid session, allowing manipulation of the gibbonUnitBlockID and mode arguments against Gibbon 30.0.01 and earlier without credentials. The CVE description states that exploit code has been disclosed publicly and may be used, so exposure should be treated as foreseeable; there is no CISA KEV entry indicating confirmed active exploitation. Impact is limited to low-level confidentiality exposure of unit-planner block data according to the independent assessment, making this a moderate-severity issue rather than an urgent-priority one.
Risk cannot be meaningfully assessed from the provided data. CVE-2026-94282 is reported solely by the vendor source 'ubuntu', indicating that a package distributed through Ubuntu channels is affected, but no description, CVSS score, CVSS vector, CWE identifier, or affected-version metadata accompanies the record, so the nature of the flaw, the attack surface, and the deployment contexts at risk are all unknown. Exploitation status: no public exploit identified at time of analysis. Authentication requirements are not confirmed from available data, and no CISA KEV listing or EPSS score was provided to indicate real-world exploitation or likelihood. Until the corresponding Ubuntu Security Notice and upstream advisory are retrieved, this record should be treated as an unresolved tracking identifier rather than a characterized vulnerability.
Secret disclosure in kitty 0.25.0 through versions before 0.49.0 lets a second local user on the same host capture text that the victim types into prompts rendered by kitty itself, including masked password prompts, without holding any privilege on the victim's account. The askpass escape-code handler in kitty/window.py (handle_remote_askpass) opens a POSIX shared-memory object named in an attacker-supplied device control string and later writes the typed answer back into an object of that same name, never verifying that the object is owned by the user running kitty or that its permissions exclude other users, unlike the equivalent ssh kitten path which performs exactly that check. Exploitation is tightly bounded: it requires a POSIX shared-memory namespace shared between attacker and victim, attacker-influenced bytes being displayed in the victim's terminal, and the victim actually answering the rendered prompt; no public exploit code has been identified at time of analysis and this CVE is not in CISA KEV, and hosts with isolated shared memory, single-user workstations, and kitty 0.49.0 or later are not affected.
Kernel-log flooding in the Linux kernel's in-kernel ksmbd SMB3 server lets an authenticated SMB client degrade host availability by submitting a single DACL containing many structurally valid but unmapped SIDs, each of which previously produced an unthrottled kernel error message. Only systems that have enabled ksmbd and exposed a share are affected (not a default configuration on most distributions, which ship userspace Samba or no SMB server), and the attacker must already hold a valid SMB session, so the practical exposure is narrow; realized impact is limited to availability/log degradation with no confidentiality, integrity, or code-execution consequence. EPSS is low (0.20%, 9th percentile), the issue is not listed in CISA KEV, and the flaw is not known to be actively exploited; vendor patches are available in the listed stable kernel releases. A public fix commit exists upstream, but no verified working exploit code has been identified at time of analysis.
Kernel denial of service in the Linux kernel's netfs unbuffered (direct) write path: when netfs_alloc_subrequest() fails and returns NULL, netfs_prepare_write() dereferences the missing subrequest and the kernel oopses. Local users able to issue direct writes through a netfs-backed filesystem - the reported stack is a 9p (v9fs) mount - can reach the flaw, but only if a slab allocation inside netfs_alloc_subrequest() fails, a condition syzbot produced through deliberate failslab fault injection rather than normal attacker input, so AV:L/AC:H/PR:L per this assessment. Impact is limited to a crash; there is no code execution or data disclosure, no public exploit has been identified, EPSS is 0.18% (7th percentile), and priority is this_month.
Free-space accounting in the Linux kernel's legacy in-kernel NTFS driver can be corrupted by a local, low-privileged user with write access to a mounted NTFS volume: when a cluster-free operation spanning multiple runmap runs hits a bitmap-clear failure, the driver counts the failed run's length as freed, inflating vol->free_clusters and skewing statfs output plus the allocator's free-space gate. The issue is a local-only, low-severity (CVSS 5.5 vendor vector; independently assessed as AV:L/AC:H/PR:L with availability impact only) correctness bug affecting kernels that use the legacy ntfs driver rather than ntfs3, and it depends on an error condition such as memory pressure or an I/O/media failure that an attacker cannot deterministically force. EPSS is 0.18% (7th percentile), CISA KEV does not list it, and no public exploit identified at time of analysis.
The in-kernel CIFS/SMB client in the Linux kernel fails to validate the resulting file size when a local user invokes fallocate(2) with FALLOC_FL_INSERT_RANGE on a file residing on a mounted SMB share, allowing the insert to grow the file past RLIMIT_FSIZE, past s_maxbytes, or outside the loff_t range. The result is a file whose size violates the limits the kernel enforces for ordinary writes, producing an inconsistent on-disk/in-core state that can be leveraged for denial of service; there is no confidentiality or integrity impact (C:N/I:N/A:H) and the vector is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/A:H). Exploitation requires an authenticated local user with write access to a file on a CIFS mount and the ability to issue insert-range fallocate, and no public exploit has been identified at time of analysis; EPSS is 0.18% (6th percentile) and the vulnerability is not in CISA KEV. Vendor-released patches exist in 6.12.111, 6.18.53, 7.2.7 and 7.3-rc2, and the priority signal is this_month.
Local users on systems running the TIPC subsystem can exhaust the TIPC name table by binding more than 65,535 local-scope service addresses, which suppresses protocol service-type publications and can drive a NULL pointer dereference in tipc_named_node_up() when a node-up event processes an empty publication list. The result is a kernel crash and denial of service; confidentiality and integrity are unaffected. Exploitation is limited to kernels with TIPC enabled and configured, no public exploit was identified at time of analysis, and EPSS is low at 0.18% (6th percentile).
A NULL pointer dereference in the Linux kernel's mpi3mr SCSI driver (mpi3mr_sas_port_add()) can crash the host when sas_port_alloc_num() returns NULL after a memory allocation failure and the result is passed unchecked into sas_port_add(); a second path in the same function leaks the allocated sas_port structure when sas_port_add() itself fails. Exposure is limited to systems running an affected kernel on hardware with a Broadcom/LSI MPI 3.0 tri-mode SAS/SATA HBA, since the mpi3mr module must be loaded for the code to be reachable, and the trigger is a kernel allocation failure rather than a condition an attacker directly controls, so it typically surfaces under memory pressure during device discovery or hotplug. Impact is a kernel crash (denial of service) with no confidentiality or integrity effect; EPSS is 0.17% (5th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis. Vendor patches are available in the 6.12.111, 6.18.53, 7.2.7 and 7.3-rc2 releases.
A target-device reference-count leak in the Linux kernel's mpi3mr SCSI driver can be triggered by a local user with low privileges on a host that has a Broadcom MPI 3.0 SAS/SATA controller and the mpi3mr driver loaded, causing kernel memory to be retained indefinitely. Each occurrence strands one target-device structure, so the flaw only becomes meaningful if the internal SAS device-discovery error path is reached repeatedly and enough memory accumulates to degrade availability; there is no confidentiality or integrity impact and no remote vector. Exploitation status is unconfirmed: no public exploit has been identified at time of analysis, it is not in CISA KEV, and EPSS is only 0.17% (5th percentile), consistent with a low-priority, hardware-dependent local defect rather than the 'Medium' 5.5 base score suggests. This is a genuinely low-priority issue despite the 5.5 CVSS label, and the trigger is not described in the available sources as directly attacker-controllable.
Linux kernel SMB client mishandles FALLOC_FL_ZERO_RANGE on CIFS/SMB3 mounts: when the zero-range request would extend a file's EOF and FALLOC_FL_KEEP_SIZE is not set, smb3_zero_range() does not validate the new size against RLIMIT_FSIZE, so a local user with write access can grow a file past the caller's file-size limit. This is a local-only, authenticated availability/resource-limit bypass; it is irrelevant without a CIFS/SMB3 mount and has low EPSS (0.17%). No public exploit was identified at time of analysis, and the issue is not in CISA KEV.
Denial of service in the Linux kernel SCTP stack affects systems using the RFC 5061 ADD-IP extension with an outstanding ASCONF request, where a crafted ASCONF-ACK containing an odd-length parameter desynchronizes the verifier and consumer parameter walks and can spin forever in softirq context, producing a soft lockup and watchdog report. The same parameter family can also reach the SCTP_PARAM_ERR_CAUSE consumer with an incomplete error header and cause an out-of-bounds read. The assessed vector is remote and unauthenticated (AV:N/AC:L/PR:N/UI:N), although the supplied CVE record lists a local, authenticated vector; practical exposure is limited because SCTP and the ADD-IP feature are uncommon in typical server and desktop environments. No KEV entry or public exploit code is identified at time of analysis, EPSS is 0.17% (5th percentile), and vendor patches are listed for Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc2.
Linux kernel systems running the msc313e watchdog driver on MStar/SigmaStar MSC313e-series ARM SoCs can crash during a power-management suspend or resume cycle because msc313e_wdt_probe() never sets the platform device driver data, so dev_get_drvdata() in the suspend/resume callbacks returns NULL and is dereferenced. The flaw is local and requires low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, CWE-476) and affects availability only; installations without this hardware or CONFIG_MSC313E_WATCHDOG are not exposed. It is not in CISA KEV, no public exploit has been identified at time of analysis, and EPSS is 0.17% (5th percentile), consistent with a low-priority, hardware-specific denial-of-service issue.
The in-kernel ksmbd SMB3 server in Linux fails to propagate DACL parsing and allocation errors out of parse_dacl(), so a malformed security descriptor carrying a truncated ACE can flow through set_info_sec() and leave inode attributes or ACL xattrs updated from an incomplete ACL conversion. Only systems that explicitly run ksmbd with an exported share are exposed; most distributions do not enable it by default and use userspace Samba instead, and the assessed vector requires an authenticated low-privileged session (PR:L) able to issue an SMB SET_INFO request that sets a security descriptor. Severity is moderate (CVSS 5.5, availability impact only per the supplied vector), EPSS is 0.17% at the 5th percentile, there is no CISA KEV entry, and no public exploit has been identified at time of analysis; vendor fixes are available in the stable trees.
Local denial of service in the Linux kernel AF_PACKET packet-socket TX ring path allows a local user holding CAP_NET_RAW to crash the kernel by setting tpacket_hdr.tp_len above INT_MAX and writing to the socket. The u32-to-int cast in tpacket_parse_header() turns the oversized length into a negative value that passes the size check and propagates to sock_sendmsg_nosec(), triggering BUG(); only availability is affected (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), with no confidentiality or integrity impact and no privilege escalation indicated. Vendor patches are available for the 6.12, 6.18, 7.2 and 7.3-rc branches, and no public exploit was identified at time of analysis (EPSS 0.17%).
The Linux kernel's fbtft staging driver can deadlock because dirty_lock is taken in workqueue context with interrupts enabled while fbtft_mkdirty() is reachable from the fbcon rendering path during printk() in hardirq context, creating a lock inversion with console_owner. Affected systems are those using a small SPI TFT display bound to fbtft as the framebuffer console with deferred I/O; the flaw is local, timing-dependent, and not remotely reachable. Vendor fixes are available in Linux 6.12.111, 6.18.53, 7.2.7, and 7.3-rc2; no public exploit identified at time of analysis, and EPSS is 0.17%.
The Linux kernel's AMD ASoC Yellow Carp driver fails to free a buffer in acp6x_pdm_dma_close(), so repeated open/close cycles of the ACP6x PDM DMA capture device can exhaust kernel memory and deny service to a local low-privilege user. Only AMD Yellow Carp/Rembrandt-class systems with ACP6x audio and the amd/yc driver loaded are affected; EPSS is 0.17% and no public exploit has been identified at time of analysis. Vendor patches are available in Linux 6.12.111, 6.18.53, 7.2.7, and 7.3-rc3.
Local, privileged use-after-free in the Linux kernel's btrfs seed/sprout device handling can crash the system or corrupt the transaction device list when adding a device to a sprout filesystem fails midway. Only systems running btrfs where an operator with CAP_SYS_ADMIN capability adds a device to a writable filesystem sprouted from a read-only seed are exposed, and the flaw surfaces only if the follow-on system chunk creation fails, so practical exploitation is narrow and results in denial of service rather than a reliable memory-corruption primitive. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.17% (5th percentile), and vendor patches are available for the affected stable branches.
Use-after-free in the Linux kernel's btrfs driver can crash the machine when a device is added to a seed filesystem and the operation fails partway through: btrfs_init_new_device() has already switched latest_dev and possibly s_bdev to the new sprout device, and the error path releases that device without restoring the pointers, so a later btrfs_show_devname() dereferences freed memory. The bug is local-only and requires privileges sufficient to manage btrfs devices plus a seed/sprout configuration, and it depends on writable-chunk creation or the subsequent sprout setup actually failing, so impact is confined to availability (kernel denial of service). No public exploit code or active exploitation has been reported, EPSS is 0.17% (5th percentile), and vendor fixes are available in multiple stable branches.
Memory leak in the Linux kernel's btrfs RAID stripe tree error paths causes bioc objects held on a btrfs_ordered_extent's bioc_list to be dropped without being freed, allowing kernel memory to be exhausted over time when applications repeatedly hit those failure paths. Only systems running btrfs with the relatively new RAID stripe tree feature mounted are affected, and the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects a local, low-privilege condition whose impact requires sustained or abnormal error rates rather than a single operation. No public exploit code exists and EPSS is only 0.17% (5th percentile), so this is a genuinely low-priority issue despite warranting a patch.
In the Linux kernel's Btrfs filesystem, running a block-group balance/relocation on a filesystem that has quota groups enabled can force creation of a relocation root while qgroup_account_snapshot() is committing a pending snapshot, leaving a stale metadata tree reference whose extent item has already been dropped. When delayed refs are processed the kernel hits lookup_inline_extent_backref() with a WARNING and fails the ref insertion with -117 (EUCLEAN), aborting the transaction and flipping the affected Btrfs filesystem read-only; recovery requires unmount and repair/mount, making this strictly an availability issue (no confidentiality or integrity impact). The defect is local-only: the assessed vector is AV:L/AC:H/PR:L/UI:N with high attack complexity, and the assessed risk is LOW despite the Medium 5.5 CVSS base score, because it requires (a) local access able to issue Btrfs administrative ioctls - balance/relocation normally needs CAP_SYS_ADMIN - (b) a filesystem explicitly created or mounted with quota/qgroups enabled, a non-default option, and (c) tight timing between relocation and snapshot creation. EPSS is 0.17% (5th percentile), there is no KEV entry, and no public exploit code was identified at time of analysis; vendor-released patches exist in stable 6.12.111, 6.18.53, 7.2.7 and 7.3-rc2.
An unbalanced module reference count in the Linux kernel's Intel AVS (Audio, Voice, Speech) ASoC audio driver lets a local, authenticated user leak a module reference every time a specific error path in the driver-open routine is hit, which over repeated triggering can leave the driver module permanently pinned and degrade availability (module unload/reload fails). Only systems running a vulnerable kernel build with the Intel AVS DSP audio stack present and loaded are exposed, and our assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, a low-to-moderate priority local availability issue rather than a widespread emergency. EPSS is 0.17% (5th percentile), the issue is not in CISA KEV, and no public exploit identified at time of analysis; vendor-released patches exist in stable 6.12.111, 6.18.53 and 7.2.7 plus mainline 7.3-rc3.
Denial of service in the Linux kernel's bcmasp (Broadcom ASP 2.0) Ethernet driver lets a local user with low privileges (CVSS PR:L) disrupt the transmit path when the driver needs multiple consecutive descriptor slots: tx_spb_ring_full() re-initialises next_index from intf->tx_spb_index inside the loop, so incr_ring() yields the same slot every iteration and only one descriptor is ever tested instead of cnt. The defect affects kernels carrying the bcmasp driver from commit 490cb412007de593e07c1d3e2b1ec4233886707c onward and running on Broadcom embedded/SoC hardware, and is corrected in 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3. EPSS is 0.17% (5th percentile) and no public exploit has been identified at time of analysis, so no public exploit identified at time of analysis and real-world priority is low.
Memory exhaustion denial of service in the Linux kernel's netfs library: netfs_unbuffered_write() fails to drop a subrequest reference when subreq->io_iter resolves to zero length during subrequest preparation, so the reference is leaked (CWE-401). Local users with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) on systems that mount a netfs-backed filesystem and exercise it with direct/unbuffered I/O can repeatedly trigger the leak, degrading availability; there is no confidentiality or integrity impact despite one source tagging the issue as information disclosure. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.17% (5th percentile), and the priority signal places remediation in the this-month window rather than immediate action.
A local denial-of-service flaw in the Linux kernel's BPF tracing subsystem lets a user who can load and attach a BTF-enabled raw tracepoint (tp_btf) program panic the kernel by dereferencing the siginfo argument of the signal_generate or signal_deliver tracepoints, which the kernel may populate with the non-pointer sentinel values SEND_SIG_NOINFO (0) or SEND_SIG_PRIV (1). Exploitation requires local access with CAP_BPF plus CAP_PERFMON (or CAP_SYS_ADMIN) on a kernel built with BPF tracing support, matching the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H vector; there is no remote or network vector, and impact is limited to availability. Risk is considered low-to-moderate: EPSS is only 0.17% (5th percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV. Vendor patches are available in the stable trees referenced by the advisory.
Out-of-bounds read in the Linux kernel's Intel AVS ASoC audio driver can crash the kernel when a local user with low privileges causes an oversized module config ID from a DSP topology binary to index the init_configs array. The flaw is limited to local, low-privilege access on systems with Intel AVS audio hardware and the relevant driver loaded; it is not remotely reachable and, per the assessed vector, has no confidentiality or integrity impact. EPSS is low (0.17%, 5th percentile), no public exploit code has been identified at time of analysis, and vendor fixes are available in Linux 6.18.53, 7.2.7, and 7.3-rc3 or corresponding stable backports.
A mismatched memory free in the Linux kernel's staging rtl8723bs SDIO Wi-Fi driver can corrupt kernel memory: padapter->HalData is allocated with vzalloc() but is released with kfree() on the error path of rtw_sdio_if1_init(), mixing a vmalloc-backed pointer into the slab free path. The flaw is locally triggerable by an authenticated user (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H per independent assessment) and only on systems whose kernel is built with CONFIG_RTL8723BS and that have RTL8723BS SDIO hardware; because the faulty free executes only when interface initialization fails, it is far more likely to surface as an accidental crash or memory-corruption event than as a reliable attacker-controlled primitive. No public exploit code has been identified at time of analysis, EPSS is low at 0.17% (5th percentile), and vendor patches are available, so this is a low-priority, low-real-risk issue despite its MEDIUM 5.5 score.
Information disclosure in the Linux kernel netfilter SIP NAT helper (nf_nat_sip) affects systems that load the nf_conntrack_sip SIP application-layer gateway and act as a NAT gateway for SIP traffic. When map_addr() shrinks a SIP message because the translated public NAT address string is shorter than the internal one, the tracked header offset (coff) is not rewound, so it can overshoot and cause later ct_sip_parse_header_uri() lookups to skip subsequent Contact headers, which are then left untranslated and can expose internal addressing to the far-end peer. The helper is not loaded in default configurations and the trigger requires the ALG to be enabled, an IP string that shrinks, and additional Contact headers, so real-world exposure is narrow; EPSS is 0.17% (5th percentile) and no public exploit code or CISA KEV entry was identified at time of analysis.
The Linux kernel's Intel iwlwifi MEI (CSME) integration passes a queue-head pointer instead of the expected device structure to iwl_mei_write_cyclic_buf(), which can drive the shared cyclic buffer into an inconsistent state and crash the kernel on systems where the iwlmei component is compiled in and Intel WiFi plus CSME hardware is present. Per the assessed vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires local access with pre-existing low-level privileges and causes availability impact only, with no confidentiality or integrity loss. No public exploit code has been identified at time of analysis and EPSS is low (0.16%, 5th percentile), so this is routine kernel hygiene rather than an emergency.
Memory exhaustion in the Linux kernel's HSR (High-availability Seamless Redundancy) networking code allows a local user holding CAP_NET_ADMIN to leak kernel heap allocations by repeatedly driving HSR device setup into its failure path. Because the first slave's RX handler is registered in softirq before later failable steps (second slave, interlink), frames arriving in that window learn dynamic entries into node_db, and the error unwind never frees them - so repeated failed configurations steadily grow kernel memory use and can degrade or crash the host (availability-only impact, no code execution or data exposure). Exploitation requires the CONFIG_HSR subsystem plus privileged interface configuration and a setup-failure/timing race, so realistic exposure is confined to hosts that actually deploy HSR, largely industrial and substation redundant-network scenarios; EPSS is 0.16% (5th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis.
A resource leak in the Linux kernel's nvmet-rdma driver - the RDMA transport for NVMe-over-Fabrics targets - causes a newly allocated queue and its associated InfiniBand resources to be leaked whenever incoming disconnecting queues exceed the configured connect backlog limit. The issue is reachable without authentication (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H per independent assessment) but only on hosts actually configured as NVMe-oF RDMA targets with an active RDMA listener, and only via the adjacent RDMA fabric; an attacker or misbehaving initiator must generate rapid repeated connect/disconnect churn. Impact is limited to availability through slow, incremental resource exhaustion rather than an immediate crash, EPSS is very low (0.16%, 5th percentile), and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Denial of service in the Linux kernel EDAC subsystem can be triggered by writing an out-of-range or zero value to the per-device poll_msec sysfs attribute. The store handler uses simple_strtoul() while the target field is an unsigned int, so on 64-bit systems values above UINT_MAX are silently truncated, and a value below 1 was not rejected; either case can make the EDAC poll work item run without delay and consume CPU. This is a local-only availability issue that in practice requires privileged write access to a typically root-owned sysfs file; EPSS is low (0.16%), and no public exploit was identified at time of analysis.
Crafted pointer arithmetic in a BPF program can desynchronize the verifier's 64-bit var_off and 32-bit subregister bounds, triggering a REG INVARIANTS VIOLATION WARN in the Linux kernel and, on systems with panic_on_warn enabled, a local denial of service. The bug affects Linux kernel builds before the stable fixes 6.12.111, 6.18.53, 7.2.7, and 7.3-rc2, and requires local low-privileged access (CVSS PR:L) with the ability to load eBPF programs-typically unprivileged eBPF enabled or CAP_BPF/CAP_SYS_ADMIN. No public exploit identified at time of analysis; EPSS is 0.16% (4th percentile), and there is no confidentiality or integrity impact.
Leaked debugfs entries in the Linux kernel's USB Type-C UCSI subsystem cause repeated registration of the same UCSI instance to fail, producing the signature error "debugfs: 'pmic_glink.ucsi.0' already exists in 'ucsi'" across register/unregister cycles. The bug is reachable only locally by a low-privileged user on systems that exercise the ucsi_glink driver (Qualcomm pmic_glink/remoteproc platforms that tear down and re-create the UCSI instance), and it requires repeated cycles rather than a single action, so our assessed vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - a low-priority robustness/availability defect, not a remotely exploitable one. There is no public exploit code and no confirmed active exploitation (EPSS 0.16%, 4th percentile); vendor patches are available in Linux 6.6.157, 6.12.110, 6.18.52, 7.2.6 and mainline 7.3-rc1.
An out-of-bounds write in the Linux kernel's mt76 driver for MediaTek MT7921 Wi-Fi chipsets (wifi: mt76: mt7921 CLC record validation) allows a local attacker with existing privileges to corrupt kernel memory by supplying a malformed CLC firmware image whose region count or per-record length is attacker-controlled. The bug is a missing-bounds-check issue (CWE-787) during CLC region parsing on firmware load: the region-table pointer can be forced to precede the firmware buffer, the record loop can fail to advance, or an index can run past the end of phy->clc. The assessed impact is availability-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5) with EPSS of 0.16% (4th percentile) and no public exploit identified at time of analysis; it is not listed in CISA KEV, and a vendor patch is available.
Kernel panic in the Linux kernel's PPP async receive path (ppp_async) can be triggered when the PPP peer sends a bad-FCS frame followed by a frame beginning with the ff 03 header, leaving a reused skb without the headroom that ppp_receive_nonmp_frame assumes. The CVSS 3.1 score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting an availability-only crash after root has configured PPP async and an attacker can act as the link peer; when CCP compression is enabled, the same headroom corruption produces an out-of-bounds read. EPSS is low at 0.16% (4th percentile), no public exploit identified at time of analysis, and vendor patches are available.
Out-of-bounds writes in the Linux kernel cirrus-qemu DRM driver can crash the system when a PCI device whose BAR0 is smaller than the expected 4 MB VRAM is bound to the driver and a display-plane atomic update copies an oversized framebuffer into the undersized mapping. The issue is availability-only and requires a privileged local actor able to bind a non-default or malformed undersized PCI device to cirrus-qemu; the standard QEMU Cirrus device exposes a 4 MB BAR0 and is not affected in default configurations. No public exploit was identified at time of analysis, EPSS is low at 0.16% (4th percentile), and the supplied data does not indicate CISA KEV listing.
A local NULL-pointer dereference in the Linux kernel's BPF verifier (CVE-2026-98134) lets a crafted eBPF program reach an unchecked NULL dereference, crashing the kernel and denying service. The flaw lives in check_cond_jmp_op(), which strips PTR_MAYBE_NULL when comparing two pointer registers based purely on the absence of that flag, an assumption that breaks for types such as PTR_TO_MEM produced by bpf_rdonly_cast(0, 0); kernels carrying the affected inference (introduced around Linux 6.2) are exposed. Exploitation requires the ability to load eBPF programs, which in practice means CAP_BPF or CAP_SYS_ADMIN, or a host with unprivileged BPF enabled, and the CVSS 3.1 vector (5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects local, privilege-gated, availability-only impact with no code execution or data disclosure. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.16% (4th percentile), making this a moderate-priority kernel robustness fix rather than an urgent, actively exploited threat.
Denial of service in the Linux kernel eBPF verifier allows a local attacker with low privileges (PR:L) to craft a BPF program containing a scalar zero spill, a verifier checkpoint, and a partial stack read, causing __clean_func_state() to incorrectly downgrade a half-dead slot to STACK_ZERO and break precision-propagation chains. The flaw is scored CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so the primary impact is availability, and exploitation requires the ability to load eBPF programs (CAP_BPF, CAP_SYS_ADMIN, or unprivileged BPF enabled). No public exploit identified at time of analysis; EPSS is low at 0.16% (4th percentile), and vendor patches are available in Linux 7.2.7 and 7.3-rc2.
Stale-data reads in the Linux kernel CIFS/SMB client let a local user with write access to a cached file retrieve pre-modification contents after a fallocate range operation has already rewritten that range on the server. The four affected paths - smb3_zero_range(), smb3_punch_hole(), smb3_insert_range() and smb3_collapse_range() - discard the affected page cache but leave the FS-Cache cookie valid, so a later read can be served from persistent cache instead of the server; the flaw only manifests on a CIFS mount that uses the non-default 'fsc' mount option with an active CacheFiles backend, which keeps realistic exposure narrow even though the kernel itself is ubiquitous. A reproducer script is included in the upstream commit message; it is not verified as working exploit code, EPSS is 0.16% (4th percentile), and there is no CISA KEV listing, so no public exploit beyond that reference was identified at time of analysis.
Silent data-durability loss in the Linux kernel's nvdimm pmem driver occurs when a failed REQ_PREFLUSH barrier is not propagated synchronously, allowing data writes to proceed and a later successful REQ_FUA flush to overwrite the recorded error so the bio completes as if the ordering barrier succeeded. This affects Linux kernels with NVDIMM/PMEM persistent-memory support prior to fixed versions 6.18.52 and 7.2.6; the flaw requires local, low-privileged block I/O submission to a pmem device and only manifests when a real preflush error occurs, yielding silent integrity/durability loss rather than a directly attacker-controllable compromise. No public exploit code or confirmed active exploitation is identified (EPSS 0.15%, 4th percentile).
A use-after-free in the Linux kernel's drm/msm driver (Qualcomm Adreno GPU support) can be triggered when a hung GPU submit is retired before hardware recovery completes, freeing buffer objects that the GPU may still be actively reading and producing GPU pagefaults and a kernel crash. Affected are Linux systems built with the msm DRM driver - predominantly Android devices and ARM/Snapdragon Linux platforms - where a locally authenticated user able to submit GPU command buffers can drive a submit into the hang path (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5, availability-only). There is no public exploit identified at time of analysis, EPSS is a low 0.15% (4th percentile), and the issue is not listed in CISA KEV; vendor fixes exist in Linux 6.18.52, 7.2.6, and 7.3-rc1.
Repeated management-frame error paths in the Linux kernel's staging rtl8723bs WiFi driver leak management xmit_frame/xmit_buf objects out of the driver's fixed-size management-TX pools, and enough repeated hits exhaust those pools so the interface can no longer send beacons or probe/association responses (denial of wireless management service, CVSS 5.5, A:H). The bug is CWE-401 (missing release of memory after effective lifetime) and is reachable only by local, low-privileged users who can drive wireless configuration on a system that actually has the niche Realtek rtl8723bs hardware operating in a mode that issues management frames (beaconing/AP, probe-response, or assoc-response handling); EPSS is 0.15% (4th percentile) and no public exploit identified at time of analysis. Vendor-released fixes exist in the referenced kernel stable/mainline commits, so the issue is a low-to-moderate priority patching item rather than an urgent one.
A missing uniqueness annotation on the BPF_REFCOUNT field in the Linux kernel's BPF struct metadata causes the verifier to mis-handle refcounted BPF objects, which a local attacker already authorized to load eBPF programs (PR:L) can abuse to crash or destabilize the kernel, producing a denial-of-service condition (C:N/I:N/A:H, CVSS 5.5). Affected code was introduced with BPF refcount support in Linux 6.4 and persists until the stable fixes shipped in 6.18.52, 7.2.6 and 7.3-rc1; only hosts that grant BPF-loading capabilities (CAP_BPF/CAP_SYS_ADMIN or equivalent in-namespace) are realistically exposed, which narrows practical risk to multi-tenant and container hosts. There is no remote vector, no disclosure or integrity impact, and no public exploit identified at time of analysis; EPSS is 0.15% (4th percentile), consistent with a genuinely low-priority issue despite the MEDIUM severity score, and no public exploit identified at time of analysis.
The Linux kernel's gud driver (Generic USB Display, CONFIG_DRM_GUD) creates a DRM plane rotation property without checking that the device-advertised rotation bitmask actually contains GUD_ROTATION_0, so a USB display whose GUD_PROPERTY_ROTATION omits that bit trips the WARN_ON(rotation & ~supported_rotations) assertion in drm_plane_create_rotation_property(). Because the trigger requires physically attaching a GUD-protocol USB device running custom or malicious firmware, and because the WARN_ON produces only a log warning unless the kernel is built with panic_on_warn (in which case it can halt the system), the realistic impact is limited availability disruption rather than remote compromise; no public exploit has been identified at time of analysis. This is best treated as a low-priority, defense-in-depth hardening fix, not an urgent security issue.
Local availability degradation in the Linux kernel's NTFS extended-attribute handling allows an authenticated local user to transiently hide existing on-disk extended attributes (EAs) on a mounted NTFS volume. When ntfs_set_ea() fails on an exit path reached before ea_info_qsize is updated, the driver unconditionally calls NInoClearHasEA(), so pre-existing EAs become invisible through the ntfs3 driver until the affected inode is evicted; the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects local, authenticated access with high availability impact and no confidentiality or integrity loss. EPSS is 0.15% (4th percentile) and no public exploit identified at time of analysis; exploitation requires the non-default presence of an NTFS volume, and this remains a genuinely low-priority, local-only availability issue.