A race condition in the Linux kernel's RISC-V KVM support for AIA IMSIC interrupt virtualization lets a local user who can issue KVM device ioctls read or modify another vCPU's interrupt file. The kvm_riscv_aia_imsic_rw_attr() handler snapshots the physical CPU and HGEI of an IMSIC VS-file without serialization against a concurrent KVM_RUN, so a vCPU migration can release and reallocate that HGEI before the stale tuple is used, giving a GET or SET attribute access to the new owner's VS-file. Exposure is limited to RISC-V KVM hosts using IMSIC, the timing window is narrow (AC:H), and no public exploit or CISA KEV entry exists at time of analysis, with EPSS at 0.20% (9th percentile); vendor fixes are available in 6.12.112, 6.18.55, 7.2.9 and 7.3-rc5.
Out-of-bounds VRAM access in the Linux kernel's nouveau DRM device-private memory (dmem) migration path lets a local, low-privileged user read and write GPU memory beyond the buffer object that backs the registered region. Affected systems are those running nouveau with the transparent-huge-page GPU memory migration support introduced by upstream commit c32287471077, which enlarged the registered device-private region to DMEM_CHUNK_SIZE * NR_CHUNKS while the backing VRAM buffer object remained DMEM_CHUNK_SIZE, so any page past the first chunk resolves to VRAM outside that object. Exploitation is local, requires authentication and a compatible NVIDIA GPU running nouveau rather than the proprietary driver, with high attack complexity; there is no KEV entry and no confirmed public exploit code, and EPSS is low at 0.19% (8th percentile), so the practical signal is a scheduled patch rather than an emergency.
An out-of-bounds write in the Linux kernel Bluetooth management interface (read_unconf_index_list() in net/bluetooth/mgmt.c) lets a local caller with CAP_NET_ADMIN corrupt kernel memory by winning a narrow timing window during asynchronous controller setup. Affected are Linux kernels built with the Bluetooth subsystem from the affected commit range onward; fixes are published in 6.6.158, 6.12.112, 6.18.55, 7.2.9 and 7.3-rc5. EPSS is 0.17% (6th percentile), the issue is not in CISA KEV, and no public exploit was identified at time of analysis, so the practical risk is a moderate local privilege-escalation/memory-corruption concern rather than an urgent remote threat.
A lifetime-management flaw in the Linux kernel's arm64 KVM nested-virtualization (nv) support frees shadow stage-2 structures from kvm_arch_flush_shadow_all() while other parts of the system may still hold references to that container, exposing the host kernel to use-after-free-style memory corruption, crash, or code execution in kernel context. Only arm64 hosts running KVM with nested virtualization active on an affected kernel are exposed - a non-default, recently introduced feature - and the assessed CVSS vector (AV:L/AC:H/PR:L) reflects a local attacker with privileges to create and destroy KVM guests and a narrow, hard-to-win lifetime window. No public exploit code or confirmed active exploitation was identified at time of analysis (EPSS 0.17%, 6th percentile), and vendor fixes are listed for 6.12.113, 6.18.56, 7.2.9 and 7.3-rc5.