Monthly
Incorrect spinlock initialization ordering in the Linux kernel's idpf network driver (Intel Infrastructure Data Path Function) causes the PTP auxiliary worker to acquire the read_dev_clk_lock before spin_lock_init() has run, producing a lockdep 'non-static key' warning and a race on an uninitialized lock during device init/reset. This is a local kernel-driver initialization bug affecting systems using the idpf driver with PTP enabled, not a remotely reachable code-execution flaw; no public exploit identified at time of analysis and the EPSS score is negligible (0.15%). Despite an automated CVSS of 9.8, the real-world security impact is minimal and confined to hosts running specific Intel networking hardware.
Physically attached USB hosts can crash Zephyr RTOS builds that use the ITE it82xx2 USB device-controller driver, because the driver re-initializes an already-pending delayed work item during a disable-then-enable cycle, corrupting kernel timeout and workqueue linked lists and causing a kernel panic. Affected builds are those running Zephyr 3.7.0 through versions below 4.4.2 with the it82xx2 UDC driver enabled, typically on hardware that faces a removable USB host — kiosks, field instrumentation, or development boards. Exploitation requires a direct physical USB connection (CVSS AV:P, score 4.6), delivers denial of service only with no confidentiality or integrity impact, and is not currently listed as actively exploited or accompanied by published exploit code.
Bluetooth Classic L2CAP channel state confusion in Zephyr RTOS (versions 1.6.0 through pre-4.4.2) enables an adjacent unauthenticated peer to inject data PDUs into half-open L2CAP channels before configuration or security handshaking completes, forcing processing on stale or uninitialized channel fields. In the worst case, reused channel objects expose dangling _sdu reassembly buffer pointers, creating a memory-safety condition that causes channel and link teardown (denial of service) alongside unintended delivery of attacker-controlled data to upper-layer protocol handlers. No public exploit has been identified and the flaw is absent from CISA KEV; a vendor-released fix is available via Zephyr commit 2738ee9, targeting release 4.4.2.
Channel lifecycle enforcement failure in russh (Rust SSH library, versions <= 0.62.4) allows authenticated clients to invoke server-side handler callbacks - including exec_request, shell_request, subsystem_request, data, channel_eof, and channel_close - for SSH channel IDs that were never opened or confirmed by the transport layer. An authenticated peer can send crafted SSH_MSG_CHANNEL_REQUEST packets without ever issuing SSH_MSG_CHANNEL_OPEN, or after having a channel_open_session request explicitly denied by the application, and still trigger all channel-scoped callbacks. A working Python PoC is publicly available demonstrating 32 exec_request invocations with zero channels ever opened; no active exploitation is confirmed (not in CISA KEV) and a vendor patch exists in v0.62.5.
Incorrect spinlock initialization ordering in the Linux kernel's idpf network driver (Intel Infrastructure Data Path Function) causes the PTP auxiliary worker to acquire the read_dev_clk_lock before spin_lock_init() has run, producing a lockdep 'non-static key' warning and a race on an uninitialized lock during device init/reset. This is a local kernel-driver initialization bug affecting systems using the idpf driver with PTP enabled, not a remotely reachable code-execution flaw; no public exploit identified at time of analysis and the EPSS score is negligible (0.15%). Despite an automated CVSS of 9.8, the real-world security impact is minimal and confined to hosts running specific Intel networking hardware.
Physically attached USB hosts can crash Zephyr RTOS builds that use the ITE it82xx2 USB device-controller driver, because the driver re-initializes an already-pending delayed work item during a disable-then-enable cycle, corrupting kernel timeout and workqueue linked lists and causing a kernel panic. Affected builds are those running Zephyr 3.7.0 through versions below 4.4.2 with the it82xx2 UDC driver enabled, typically on hardware that faces a removable USB host — kiosks, field instrumentation, or development boards. Exploitation requires a direct physical USB connection (CVSS AV:P, score 4.6), delivers denial of service only with no confidentiality or integrity impact, and is not currently listed as actively exploited or accompanied by published exploit code.
Bluetooth Classic L2CAP channel state confusion in Zephyr RTOS (versions 1.6.0 through pre-4.4.2) enables an adjacent unauthenticated peer to inject data PDUs into half-open L2CAP channels before configuration or security handshaking completes, forcing processing on stale or uninitialized channel fields. In the worst case, reused channel objects expose dangling _sdu reassembly buffer pointers, creating a memory-safety condition that causes channel and link teardown (denial of service) alongside unintended delivery of attacker-controlled data to upper-layer protocol handlers. No public exploit has been identified and the flaw is absent from CISA KEV; a vendor-released fix is available via Zephyr commit 2738ee9, targeting release 4.4.2.
Channel lifecycle enforcement failure in russh (Rust SSH library, versions <= 0.62.4) allows authenticated clients to invoke server-side handler callbacks - including exec_request, shell_request, subsystem_request, data, channel_eof, and channel_close - for SSH channel IDs that were never opened or confirmed by the transport layer. An authenticated peer can send crafted SSH_MSG_CHANNEL_REQUEST packets without ever issuing SSH_MSG_CHANNEL_OPEN, or after having a channel_open_session request explicitly denied by the application, and still trigger all channel-scoped callbacks. A working Python PoC is publicly available demonstrating 32 exec_request invocations with zero channels ever opened; no active exploitation is confirmed (not in CISA KEV) and a vendor patch exists in v0.62.5.