Monthly
Deadlock vulnerability in the Linux kernel's GPIO shared proxy subsystem allows a local, low-privileged user to cause a system hang by triggering removal of a shared GPIO proxy's parent device. The root cause is an overly-wide mutex critical section introduced in commit 710abda58055, where the gpio_shared_entry mutex was held for too long, creating a locking inversion scenario during parent device teardown. No public exploit code exists and no active exploitation has been identified; the fix narrows the critical section to protect only offset reads.
Runtime PM reference count leak in the Linux kernel's Tegra I2C driver permanently prevents the affected I2C controller from entering runtime suspend when tegra_i2c_mutex_lock() returns an error. The asymmetric acquire-without-release of pm_runtime_get_sync() causes device power management to malfunction on NVIDIA Tegra SoC hardware, covering Linux 7.0 through pre-7.0.11 and pre-7.1. No public exploit exists and EPSS at 0.14% (4th percentile) reflects minimal exploitation interest; this is a stability and power management correctness defect rather than a security attack vector in the conventional sense.
Deadlock in the Linux kernel's drm/msm (Qualcomm Snapdragon GPU) shrinker causes full kernel hang under memory reclaim pressure. The circular lock dependency arises when the kswapd0 thread holds fs_reclaim and the MSM gem shrinker calls dma_resv_lock(), which internally attempts to re-acquire fs_reclaim - producing a ABBA deadlock that renders the system unresponsive. Kernels in the affected range on Snapdragon-based hardware (Linux 6.17 through pre-patch 7.0.x and 6.18.x) are vulnerable; no public exploit code exists and no active exploitation has been confirmed.
Denial of service and potential dma_resv fence-list corruption in the Linux kernel's virtio-gpu DRM driver (drm/virtio) affects Linux guests using virtio graphics, where virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() ignore the return value of virtio_gpu_array_lock_resv(). When the lock acquisition fails with -EINTR (signal during wait) or -ENOMEM (fence-slot allocation), the code proceeds to call dma_resv_add_fence() on an unheld lock, tripping a lockdep WARNING and racing concurrent readers/writers of the fence list. There is no public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and the issue was found by syzbot via fault injection rather than in-the-wild abuse.
A locking-order inversion in the Linux kernel Bluetooth L2CAP subsystem's cleanup_listen() path lets an adjacent attacker trigger a race that can deadlock or corrupt channel state, affecting virtually every Linux distribution shipping the affected kernel with an active Bluetooth stack. cleanup_listen() called l2cap_chan_close() (which manipulates conn->chan_l) under the parent sk_lock, inverting the established conn->lock -> chan->lock -> sk_lock ordering; the fix reschedules channel teardown asynchronously via l2cap_chan_timeout. No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.17%, 6th percentile), so this is a proximity-bound reliability/memory-safety fix rather than a mass-exploitation threat.
Deadlock in the Linux kernel debugobjects subsystem on ARM64 PREEMPT_RT debug builds causes system availability loss during early boot. During the early boot window between interrupt enablement and scheduler activation (before SYSTEM_SCHEDULING is set), a hardware interrupt can fire and attempt to call fill_pool() in hard interrupt context, deadlocking if the interrupted boot path already holds a lock required by the allocation path. CVSS rates this Medium (5.5) with local access and availability-only impact; EPSS at 0.17% (6th percentile) confirms minimal exploitation interest, and no public exploit or CISA KEV listing exists at time of analysis.
Deadlock in the Linux kernel's DSA (Distributed Switch Architecture) subsystem allows a local low-privileged user to hang the kernel network stack by running ethtool against a DSA-configured conduit interface. The DSA subsystem replaces the conduit device's ethtool_ops with aggregating wrappers, but these wrappers redundantly invoke netdev_lock_ops() on a lock already held by the kernel ethtool infrastructure, creating a classic double-lock deadlock. No public exploit exists and EPSS sits at 0.15% (5th percentile), though the issue is trivially reproducible with standard system tooling on affected configurations.
Soft CPU lockup in the Linux kernel SCSI generic (sg) driver allows a local user to trigger a denial of service by writing an out-of-range value directly to the def_reserved_size sysfs module parameter, bypassing the validation enforced by sg_proc_write_dressz. Setting def_reserved_size to -1 via /sys/module/sg/parameters/def_reserved_size causes sg_build_reserve to enter a non-terminating allocation loop on the next open() of any /dev/sgX device, hanging the affected CPU core for 26+ seconds until the kernel watchdog fires. No public exploit code has been identified and EPSS probability is very low at 0.18%; patches are confirmed available across all active stable kernel branches.
Improper locking in the Linux kernel's amdgpu DRM driver allows a local low-privileged user to trigger a kernel deadlock or system crash via the AMDGPU_INFO_READ_MMR_REG ioctl. Three distinct concurrency defects exist: inverted lock ordering between the reset semaphore and mm_lock (permitting copy_to_user() under lock), memory allocation while holding the reset semaphore, and use of down_read_trylock() where a blocking wait is required. No public exploit code has been identified and EPSS is 0.17%, placing this firmly in opportunistic-rather-than-targeted risk territory.
Deadlock in the Linux kernel PHY networking subsystem (net/phy) allows a local low-privileged user to freeze the networking stack on systems using the generic PHY driver (genphy) with SFP cage hardware. When genphy triggers PHY probing - which occurs while holding the RTNL lock - it erroneously calls sfp_bus_add_upstream(), which itself attempts to acquire RTNL, producing a self-deadlock confirmed by reproduction. No public exploit exists and EPSS is 0.16% (6th percentile), reflecting that exploitation requires an uncommon hardware and driver combination.
Deadlock vulnerability in the Linux kernel's GPIO shared proxy subsystem allows a local, low-privileged user to cause a system hang by triggering removal of a shared GPIO proxy's parent device. The root cause is an overly-wide mutex critical section introduced in commit 710abda58055, where the gpio_shared_entry mutex was held for too long, creating a locking inversion scenario during parent device teardown. No public exploit code exists and no active exploitation has been identified; the fix narrows the critical section to protect only offset reads.
Runtime PM reference count leak in the Linux kernel's Tegra I2C driver permanently prevents the affected I2C controller from entering runtime suspend when tegra_i2c_mutex_lock() returns an error. The asymmetric acquire-without-release of pm_runtime_get_sync() causes device power management to malfunction on NVIDIA Tegra SoC hardware, covering Linux 7.0 through pre-7.0.11 and pre-7.1. No public exploit exists and EPSS at 0.14% (4th percentile) reflects minimal exploitation interest; this is a stability and power management correctness defect rather than a security attack vector in the conventional sense.
Deadlock in the Linux kernel's drm/msm (Qualcomm Snapdragon GPU) shrinker causes full kernel hang under memory reclaim pressure. The circular lock dependency arises when the kswapd0 thread holds fs_reclaim and the MSM gem shrinker calls dma_resv_lock(), which internally attempts to re-acquire fs_reclaim - producing a ABBA deadlock that renders the system unresponsive. Kernels in the affected range on Snapdragon-based hardware (Linux 6.17 through pre-patch 7.0.x and 6.18.x) are vulnerable; no public exploit code exists and no active exploitation has been confirmed.
Denial of service and potential dma_resv fence-list corruption in the Linux kernel's virtio-gpu DRM driver (drm/virtio) affects Linux guests using virtio graphics, where virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() ignore the return value of virtio_gpu_array_lock_resv(). When the lock acquisition fails with -EINTR (signal during wait) or -ENOMEM (fence-slot allocation), the code proceeds to call dma_resv_add_fence() on an unheld lock, tripping a lockdep WARNING and racing concurrent readers/writers of the fence list. There is no public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and the issue was found by syzbot via fault injection rather than in-the-wild abuse.
A locking-order inversion in the Linux kernel Bluetooth L2CAP subsystem's cleanup_listen() path lets an adjacent attacker trigger a race that can deadlock or corrupt channel state, affecting virtually every Linux distribution shipping the affected kernel with an active Bluetooth stack. cleanup_listen() called l2cap_chan_close() (which manipulates conn->chan_l) under the parent sk_lock, inverting the established conn->lock -> chan->lock -> sk_lock ordering; the fix reschedules channel teardown asynchronously via l2cap_chan_timeout. No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.17%, 6th percentile), so this is a proximity-bound reliability/memory-safety fix rather than a mass-exploitation threat.
Deadlock in the Linux kernel debugobjects subsystem on ARM64 PREEMPT_RT debug builds causes system availability loss during early boot. During the early boot window between interrupt enablement and scheduler activation (before SYSTEM_SCHEDULING is set), a hardware interrupt can fire and attempt to call fill_pool() in hard interrupt context, deadlocking if the interrupted boot path already holds a lock required by the allocation path. CVSS rates this Medium (5.5) with local access and availability-only impact; EPSS at 0.17% (6th percentile) confirms minimal exploitation interest, and no public exploit or CISA KEV listing exists at time of analysis.
Deadlock in the Linux kernel's DSA (Distributed Switch Architecture) subsystem allows a local low-privileged user to hang the kernel network stack by running ethtool against a DSA-configured conduit interface. The DSA subsystem replaces the conduit device's ethtool_ops with aggregating wrappers, but these wrappers redundantly invoke netdev_lock_ops() on a lock already held by the kernel ethtool infrastructure, creating a classic double-lock deadlock. No public exploit exists and EPSS sits at 0.15% (5th percentile), though the issue is trivially reproducible with standard system tooling on affected configurations.
Soft CPU lockup in the Linux kernel SCSI generic (sg) driver allows a local user to trigger a denial of service by writing an out-of-range value directly to the def_reserved_size sysfs module parameter, bypassing the validation enforced by sg_proc_write_dressz. Setting def_reserved_size to -1 via /sys/module/sg/parameters/def_reserved_size causes sg_build_reserve to enter a non-terminating allocation loop on the next open() of any /dev/sgX device, hanging the affected CPU core for 26+ seconds until the kernel watchdog fires. No public exploit code has been identified and EPSS probability is very low at 0.18%; patches are confirmed available across all active stable kernel branches.
Improper locking in the Linux kernel's amdgpu DRM driver allows a local low-privileged user to trigger a kernel deadlock or system crash via the AMDGPU_INFO_READ_MMR_REG ioctl. Three distinct concurrency defects exist: inverted lock ordering between the reset semaphore and mm_lock (permitting copy_to_user() under lock), memory allocation while holding the reset semaphore, and use of down_read_trylock() where a blocking wait is required. No public exploit code has been identified and EPSS is 0.17%, placing this firmly in opportunistic-rather-than-targeted risk territory.
Deadlock in the Linux kernel PHY networking subsystem (net/phy) allows a local low-privileged user to freeze the networking stack on systems using the generic PHY driver (genphy) with SFP cage hardware. When genphy triggers PHY probing - which occurs while holding the RTNL lock - it erroneously calls sfp_bus_add_upstream(), which itself attempts to acquire RTNL, producing a self-deadlock confirmed by reproduction. No public exploit exists and EPSS is 0.16% (6th percentile), reflecting that exploitation requires an uncommon hardware and driver combination.