Monthly
Metadata corruption in the Linux kernel traffic control connection-tracking action (act_ct) allows remote attackers to crash systems or corrupt qdisc packet-segment state by sending fragmented IP or IPv6 traffic. The flaw exists because tcf_ct_handle_fragments() invokes nf_ct_handle_fragments() without preserving skb->cb, so the netfilter defragmentation helper silently overwrites tc_skb_cb/qdisc_skb_cb in-place - the same memory region. On hosts with panic_on_warn enabled, this triggers a WARN_ON_ONCE in qdisc_pkt_segs() that escalates to a kernel panic. EPSS is low (0.21%, 11th percentile) and the vulnerability is not in CISA KEV, indicating opportunistic exploitation is unlikely but targeted denial-of-service against network appliances or container hosts using tc act_ct is realistic.
A race condition in the Linux kernel's cfg80211 wifi subsystem exposes systems to kernel memory corruption by a local, low-privilege user. The flaw exists between the NETLINK_URELEASE notification path and the NETDEV_GOING_DOWN cancellation path for the wireless device autodisconnect work item: because the work is a plain work_struct, it can be re-queued after cancellation and outlive the wdev structure it references, since synchronize_net() does not drain work queued by in-flight RCU readers. Upstream fix commits are available on kernel.org stable trees, and no public exploit or CISA KEV listing has been identified at time of analysis.
ACL cache state corruption in the Linux kernel's FUSE filesystem driver allows a local low-privileged attacker to receive stale POSIX ACL values from get_acl(), potentially bypassing access controls on files. The flaw resides in forget_cached_acl(), which can silently overwrite the ACL_DONT_CACHE sentinel for FUSE mounts where the userspace server has not negotiated FUSE_POSIX_ACL, re-enabling caching that the filesystem explicitly opted out of. No public exploit exists and EPSS sits at 0.18% (7th percentile), but the CVSS 8.4 score reflects high confidentiality and integrity impact from ACL policy bypass under specific FUSE configurations.
Doorbell mapping corruption in the Linux kernel amdgpu DRM driver allows a local low-privileged user with AMD GPU access to overwrite another queue's doorbell entry by creating a second user-queue sharing the same Buffer Object handle and offset. The root cause is use of `xa_store_irq()`, which permits silent overwrites in the XArray, replaced by the patch with `xa_insert_irq()`. Consequences include fence IRQ misrouting to wrong queues and destructive cleanup that erases a live queue's mapping, yielding high integrity and availability impact. No public exploit code exists and EPSS is 0.15% (5th percentile), indicating negligible real-world exploitation activity.
Local privilege escalation potential via memory corruption in the Linux kernel's perf/core subsystem, where perf_event_remove_on_exec() fails to detach group relationships when removing a group-leader event during exec. On affected kernels, a local user who can open perf events can corrupt the PMU context active list through a double list_add, undermining kernel memory integrity (CVSS 7.8, C:H/I:H/A:H). EPSS is low at 0.16% (5th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
Denial of service in the Linux kernel's pcrypt crypto template allows remote unauthenticated attackers to crash the system by triggering a faulty fallback path. When the parallel execution via padata fails (e.g., due to resource pressure), the pcrypt module does not restore the original callback, leading to unsafe execution of the parallel-only completion routine and kernel memory corruption. The vulnerability has a low EPSS score (0.22%, 13th percentile), no public exploit or active exploitation, and patches are available in multiple stable kernel series.
Memory corruption in the Linux kernel mt76 WiFi driver (mt7925 chipset support) occurs because mt76_sta_add reinitializes the wcid->poll_list even though mt7925_mac_sta_add has already published the wcid, corrupting the dev->sta_poll_list linked list during station association. The flaw manifests as list_add corruption (observed on kernel 7.1-rc4 with mt7925 hardware) reachable from the RX NAPI poll path when TX status frames are processed, typically leading to a kernel panic. This is a vendor-fixed Linux stable-tree issue with no public exploit identified at time of analysis and a low EPSS score (0.15%).
DMA memory corruption in Linux kernel mlx5e driver allows denial-of-service and potential data integrity violations when recovering from TX error completion queue entries. The vulnerability affects mlx5 Ethernet driver users from kernel 4.17 onwards, causing desynchronization between DMA FIFO producer/consumer counters during error recovery, leading to unmapping of stale DMA addresses and IOMMU warnings. Exploitation probability is low (EPSS 0.02%, 7th percentile) with no public exploit identified at time of analysis. Vendor-released patches available across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9, 7.0).
Local privilege escalation and kernel memory corruption in the Linux kernel's Intel Xe (drm/xe) GPU driver arises from incorrect prev/next tracking in the VM bind ioctl unwind path, affecting kernel 6.8 through 7.0-rc6 and stable branches before the 6.12.80/6.18.21/6.19.11 fixes. When a vectored bind operation fails and unwinds, the driver leaves overlapping GPU virtual-memory areas (VMAs) in place, corrupting VM state and triggering a WARNING at xe_vm.c:1217; a local user with access to the DRM/render device can reach this via crafted xe_vm_bind_ioctl calls (as observed with the vkd3d Direct3D-to-Vulkan translation layer). No public exploit identified at time of analysis, and EPSS is negligible at 0.02%.
Improper response routing in xiaozhi-esp32 firmware up to version 2.2.6 allows any authenticated WebSocket client to receive MCP (Model Context Protocol) responses intended for other connected clients, enabling cross-client information disclosure and low-integrity interference. The flaw resides in the ParseMessage function within main/mcp_server.cc, where the MCP Response Handler broadcasts responses globally to all connected WebSocket clients on port 8080 rather than routing replies back to the originating client. A public proof-of-concept is available via GitHub issue #2020; no active exploitation has been confirmed in CISA KEV, and the CVSS 4.0 score of 2.3 reflects high attack complexity and limited overall impact in this niche IoT context.
Metadata corruption in the Linux kernel traffic control connection-tracking action (act_ct) allows remote attackers to crash systems or corrupt qdisc packet-segment state by sending fragmented IP or IPv6 traffic. The flaw exists because tcf_ct_handle_fragments() invokes nf_ct_handle_fragments() without preserving skb->cb, so the netfilter defragmentation helper silently overwrites tc_skb_cb/qdisc_skb_cb in-place - the same memory region. On hosts with panic_on_warn enabled, this triggers a WARN_ON_ONCE in qdisc_pkt_segs() that escalates to a kernel panic. EPSS is low (0.21%, 11th percentile) and the vulnerability is not in CISA KEV, indicating opportunistic exploitation is unlikely but targeted denial-of-service against network appliances or container hosts using tc act_ct is realistic.
A race condition in the Linux kernel's cfg80211 wifi subsystem exposes systems to kernel memory corruption by a local, low-privilege user. The flaw exists between the NETLINK_URELEASE notification path and the NETDEV_GOING_DOWN cancellation path for the wireless device autodisconnect work item: because the work is a plain work_struct, it can be re-queued after cancellation and outlive the wdev structure it references, since synchronize_net() does not drain work queued by in-flight RCU readers. Upstream fix commits are available on kernel.org stable trees, and no public exploit or CISA KEV listing has been identified at time of analysis.
ACL cache state corruption in the Linux kernel's FUSE filesystem driver allows a local low-privileged attacker to receive stale POSIX ACL values from get_acl(), potentially bypassing access controls on files. The flaw resides in forget_cached_acl(), which can silently overwrite the ACL_DONT_CACHE sentinel for FUSE mounts where the userspace server has not negotiated FUSE_POSIX_ACL, re-enabling caching that the filesystem explicitly opted out of. No public exploit exists and EPSS sits at 0.18% (7th percentile), but the CVSS 8.4 score reflects high confidentiality and integrity impact from ACL policy bypass under specific FUSE configurations.
Doorbell mapping corruption in the Linux kernel amdgpu DRM driver allows a local low-privileged user with AMD GPU access to overwrite another queue's doorbell entry by creating a second user-queue sharing the same Buffer Object handle and offset. The root cause is use of `xa_store_irq()`, which permits silent overwrites in the XArray, replaced by the patch with `xa_insert_irq()`. Consequences include fence IRQ misrouting to wrong queues and destructive cleanup that erases a live queue's mapping, yielding high integrity and availability impact. No public exploit code exists and EPSS is 0.15% (5th percentile), indicating negligible real-world exploitation activity.
Local privilege escalation potential via memory corruption in the Linux kernel's perf/core subsystem, where perf_event_remove_on_exec() fails to detach group relationships when removing a group-leader event during exec. On affected kernels, a local user who can open perf events can corrupt the PMU context active list through a double list_add, undermining kernel memory integrity (CVSS 7.8, C:H/I:H/A:H). EPSS is low at 0.16% (5th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
Denial of service in the Linux kernel's pcrypt crypto template allows remote unauthenticated attackers to crash the system by triggering a faulty fallback path. When the parallel execution via padata fails (e.g., due to resource pressure), the pcrypt module does not restore the original callback, leading to unsafe execution of the parallel-only completion routine and kernel memory corruption. The vulnerability has a low EPSS score (0.22%, 13th percentile), no public exploit or active exploitation, and patches are available in multiple stable kernel series.
Memory corruption in the Linux kernel mt76 WiFi driver (mt7925 chipset support) occurs because mt76_sta_add reinitializes the wcid->poll_list even though mt7925_mac_sta_add has already published the wcid, corrupting the dev->sta_poll_list linked list during station association. The flaw manifests as list_add corruption (observed on kernel 7.1-rc4 with mt7925 hardware) reachable from the RX NAPI poll path when TX status frames are processed, typically leading to a kernel panic. This is a vendor-fixed Linux stable-tree issue with no public exploit identified at time of analysis and a low EPSS score (0.15%).
DMA memory corruption in Linux kernel mlx5e driver allows denial-of-service and potential data integrity violations when recovering from TX error completion queue entries. The vulnerability affects mlx5 Ethernet driver users from kernel 4.17 onwards, causing desynchronization between DMA FIFO producer/consumer counters during error recovery, leading to unmapping of stale DMA addresses and IOMMU warnings. Exploitation probability is low (EPSS 0.02%, 7th percentile) with no public exploit identified at time of analysis. Vendor-released patches available across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9, 7.0).
Local privilege escalation and kernel memory corruption in the Linux kernel's Intel Xe (drm/xe) GPU driver arises from incorrect prev/next tracking in the VM bind ioctl unwind path, affecting kernel 6.8 through 7.0-rc6 and stable branches before the 6.12.80/6.18.21/6.19.11 fixes. When a vectored bind operation fails and unwinds, the driver leaves overlapping GPU virtual-memory areas (VMAs) in place, corrupting VM state and triggering a WARNING at xe_vm.c:1217; a local user with access to the DRM/render device can reach this via crafted xe_vm_bind_ioctl calls (as observed with the vkd3d Direct3D-to-Vulkan translation layer). No public exploit identified at time of analysis, and EPSS is negligible at 0.02%.
Improper response routing in xiaozhi-esp32 firmware up to version 2.2.6 allows any authenticated WebSocket client to receive MCP (Model Context Protocol) responses intended for other connected clients, enabling cross-client information disclosure and low-integrity interference. The flaw resides in the ParseMessage function within main/mcp_server.cc, where the MCP Response Handler broadcasts responses globally to all connected WebSocket clients on port 8080 rather than routing replies back to the originating client. A public proof-of-concept is available via GitHub issue #2020; no active exploitation has been confirmed in CISA KEV, and the CVSS 4.0 score of 2.3 reflects high attack complexity and limited overall impact in this niche IoT context.