An out-of-bounds write in the Linux kernel's drop_monitor subsystem (reset_per_cpu_data()) lets a local user who holds CAP_NET_ADMIN and can drive the drop_monitor genetlink interface overrun a netlink message's tailroom by 4 bytes, corrupting skb_shared_info and typically crashing the kernel. Only systems built with CONFIG_NET_DROP_MONITOR are reachable, and the affected code has been present since the 2.6.31 era; the overflow is a fixed 4-byte zero write rather than attacker-controlled data, and triggering it is rated high-complexity, so the practical outcome is most likely a local denial of service with limited integrity impact. There is no public exploit code identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and EPSS is only 0.22% (12th percentile); vendor patches are available in the stable releases listed below.
Multiple Rakuten Mobile Android handsets - Rakuten Mini, Rakuten Hand, Rakuten Hand 5G, and Rakuten Bigs - ship with AOSP default test keys still trusted by Android Verified Boot, so a system image signed with those publicly known keys passes boot integrity verification instead of being rejected. An attacker with physical possession of the handset and the ability to enter its flashing/fastboot mode can therefore install a crafted system image and gain full control of confidentiality, integrity, and availability (VC:H/VI:H/VA:H), which is the basis for the CVSS 4.0 base score of 7.0 (HIGH), gated heavily by the AV:P physical-access prerequisite. There is no public exploit code identified at time of analysis and no confirmed active exploitation (no CISA KEV listing); the risk is concentrated in lost, stolen, seized, or resold devices rather than any remote or network-reachable attack path.
Local privilege escalation in the SUID-root mount(8) utility shipped with util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, where the attacker-controlled LIBMOUNT_FORCE_MOUNT2 environment variable is read with getenv() and can force the legacy, non-atomic multi-step bind-mount path. On hosts whose /etc/fstab contains a bind mount authorized for unprivileged use via the user or users option and hardened with nosuid, noexec, or nodev, a local low-privileged user can win a timing race between the initial bind mount and the follow-up remount that applies those protective flags, briefly exposing an unprotected mount from which a SUID binary can be executed to obtain root. Exploitation is conditional (it requires that specific non-default fstab configuration) and non-deterministic because it depends on a race window; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV). Vendor-released patches are available in util-linux 2.41.5 and 2.42.2.
Local privilege escalation to root in util-linux's libmount affects versions 2.17 through 2.41.6 and 2.42 through 2.42.3, and also 2.42.4 when the legacy mount(2) path is used without /proc available. A local, low-privileged user who is already authorized by an /etc/fstab entry carrying the user or users option can exploit a time-of-check/time-of-use race: libmount validates the fstab target path and then the mount operation re-resolves that pathname, so an attacker who controls a writable ancestor directory can use renameat2(RENAME_EXCHANGE) to swap a path component and redirect the authorized mount to a root-owned location such as /etc/sudoers.d, gaining root. Exploitation is local only, requires the attacker to already hold an fstab mount authorization plus a writable ancestor on the configured target, and depends on winning the race (assessed AC:H), so it is non-deterministic; patched code paths using the new mount API (2.41.5 / 2.42.2 and later) or 2.42.4 with /proc present are not affected, and no public exploit identified at time of analysis.
Local privilege escalation in util-linux's SUID mount utility affects versions 2.39 through 2.41.4 and 2.42 through 2.42.1: a local, already-authorized low-privileged user can win a narrow timing race in the post-mount hook and redirect a privileged chmod()/lchown() onto a root-owned path, potentially obtaining root privileges. Exploitation requires a non-default /etc/fstab entry that combines the 'user' or 'users' mount option with an X-mount.mode, X-mount.owner, or X-mount.group option, plus write access to a writable ancestor directory of the mount target; the race itself is difficult (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released fixes in 2.41.5 and 2.42.2.
Stored cross-site scripting in n8n's Chat Trigger hosted-chat page lets an authenticated workflow author (PR:L) inject arbitrary markup through the customCss parameter, which is interpolated unsanitized into the page and executes on the n8n instance origin in the browser of any signed-in visitor who loads the published chat. The chat itself can be published without n8n user authentication, so the poisoned page is reachable by any visitor, but the impact lands only on authenticated visitors whose sessions share the instance origin. Affects n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1; rated CVSS 4.0 base 7.0 (CWE-79), and no public exploit identified at time of analysis.
A never-ending loop condition in curl and libcurl 8.10.0 through 8.22.0 lets a malicious, compromised, or on-path-manipulated server hang the client by omitting an expected part of its response, producing availability-only impact (the affected transfer or process spins indefinitely) with no confidentiality or integrity effect. The curl project rates this flaw LOW severity, and it is one of twenty-four CVEs disclosed alongside the curl 8.23.0 release. Exploitation requires the victim to connect outbound to the attacker's endpoint, since curl is a client and cannot be attacked purely remotely against a listening service; the exploit is not confirmed as actively exploited (not in CISA KEV), no public exploit code has been identified at time of analysis, and no EPSS score was provided in the source data.
Stack exhaustion in libcurl's MIME handling can crash applications that construct deeply nested multipart structures: curl_mime_free() recurses once per nesting level, so a sufficiently deep curl_mime_subparts() hierarchy overflows the stack and aborts the process. Affected are libcurl/curl versions 7.56.0 through 8.22.0, fixed in 8.23.0; the curl project classifies this advisory as LOW severity, with the impact limited to denial of service (no code execution, no data disclosure). The assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects that exploitation is confined to libcurl-based applications that let untrusted input dictate MIME nesting depth, and there is no public exploit identified at time of analysis.