Monthly
We need to produce a JSON output based on the multi-source intelligence. The CVE is CVE-2026-64374. Let's analyze the data: Description: The vulnerability is in the Linux kernel, specifically in the scheduler for real-time tasks (sched/rt). The RT_PUSH_IPI mechanism was introduced to solve latency issues on PREEMPT_RT kernels, but it causes a live-lock condition on non-PREEMPT_RT kernels under heavy networking workloads. The IPI handling on non-RT kernels (where softirqs run in interrupt context) can lead to a CPU being continuously interrupted by IPIs, causing it to never schedule the waiting RT tasks, leading to a live lock of that CPU. The fix is to make RT_PUSH_IPI default off for non-PREEMPT_RT configurations. CVSS: 7.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. This indicates a network attack vector, low complexity, no privileges, no user interaction, and a high availability impact. However, given the description, this seems odd: the vulnerability is a local live-lock condition due to IPI handling, which would typically require some level of access to trigger. The description mentions heavy networking traffic causing softirqs, so perhaps an attacker can send network traffic to trigger the softirq load, but that would be remote. However, CVSS: AV:N suggests remote exploitation, but PR:N implies no authentication. The attack might be sending crafted network traffic to a system that triggers the softirq storm, causing denial of service (availability impact). The CWE is N/A. EPSS: 0.22% (percentile 13%) - low probability of exploitation. Patch available: yes, "Vendor-released patch" from Linux. Tags: Information Disclosure, Linux (that seems inconsistent with the AV:N/A:H description, but tags might be incorrectly assigned). EUVD affected versions list patches for various kernel branches (like 5.10.261, 6.1.178, etc.) and commit ranges. The CPE strings are cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, which is too generic (no version range). References: sev
Denial of service and potential dma_resv fence-list corruption in the Linux kernel's virtio-gpu DRM driver (drm/virtio) affects Linux guests using virtio graphics, where virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() ignore the return value of virtio_gpu_array_lock_resv(). When the lock acquisition fails with -EINTR (signal during wait) or -ENOMEM (fence-slot allocation), the code proceeds to call dma_resv_add_fence() on an unheld lock, tripping a lockdep WARNING and racing concurrent readers/writers of the fence list. There is no public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and the issue was found by syzbot via fault injection rather than in-the-wild abuse.
Memory corruption in the Linux kernel's netfs library (introduced around v6.10) arises because netfs_retry_read_subrequests() and netfs_retry_write_stream() add new subrequests to stream->subrequests without holding the stream lock, creating a race on the shared list during I/O retry. The flaw affects systems using netfs-backed network filesystems (e.g. AFS, Ceph, CIFS/SMB, 9p) and can lead to list corruption, information disclosure, or a crash when concurrent retries mutate the list. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.15%), consistent with a hard-to-trigger local kernel race rather than a remotely weaponizable bug.
Memory-ordering defect in the Linux kernel's netfs (network filesystem helper) subsystem allows the lockless readers netfs_collect_read_results() and netfs_collect_write_results() to observe a subrequest pointer before the NETFS_SREQ_IN_PROGRESS flag and other subreq state are guaranteed visible, causing races on stream->subrequests. The flaw affects kernels from 6.10 onward that use netfs-backed filesystems (CIFS/SMB, AFS, Ceph, 9p) and can lead to stale-state reads, information disclosure, or instability during concurrent I/O collection. There is no public exploit identified at time of analysis, EPSS is very low (0.15%, 5th percentile), and it is not on CISA KEV; the upstream fix is available in stable git.
Improper locking in the Linux kernel AFS (Andrew File System) client's symbolic link handling (afs_get_link()) allows a local attacker on a host mounting an AFS volume to trigger race conditions that leak kernel memory and can expose stale or freed symlink buffers. The flaw affects kernels from roughly 6.14 up to the fixed 7.0.11/7.1 stable series and stems from a missing validate_lock, absent RCU barriering during lockless pathwalk, and unsynchronized access when a symlink is concurrently updated on the server. No public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and it is not on CISA KEV.
A locking-order inversion in the Linux kernel Bluetooth L2CAP subsystem's cleanup_listen() path lets an adjacent attacker trigger a race that can deadlock or corrupt channel state, affecting virtually every Linux distribution shipping the affected kernel with an active Bluetooth stack. cleanup_listen() called l2cap_chan_close() (which manipulates conn->chan_l) under the parent sk_lock, inverting the established conn->lock -> chan->lock -> sk_lock ordering; the fix reschedules channel teardown asynchronously via l2cap_chan_timeout. No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.17%, 6th percentile), so this is a proximity-bound reliability/memory-safety fix rather than a mass-exploitation threat.
Denial of service in the Linux kernel timer migration subsystem allows the global timer hierarchy to enter an indefinite livelock, hanging the affected CPU. The flaw is in tmigr_handle_remote_up(), where tmigr_handle_remote_cpu() skipped timer_expire_remote() for the local CPU on the assumption that the softirq path already serviced its timers; when jiffies advance between local timer processing and remote evaluation, a newly expired timer is never run and is re-queued with expires==now, spinning the goto-again loop forever. The CVSS 3.1 base score is 7.5 (availability only) but EPSS is just 0.18% (7th percentile), there is no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Use-after-free in the Linux kernel Bluetooth subsystem allows kernel memory corruption when the HCI connection-request handler (hci_conn_request_evt()) invokes hci_connect_cfm() without holding hdev->lock under the HCI_PROTO_DEFER path. An adjacent attacker within Bluetooth range can race a concurrent connection teardown against a deferred-setup SCO listener to free and reuse the conn object, yielding high confidentiality, integrity, and availability impact (CVSS 8.8). There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile), reflecting the narrow, race-dependent trigger rather than broad exploitability.
Concurrent cache-block invalidation in the Linux kernel's device-mapper dm-cache `smq` policy (running in passthrough mode) corrupts shared state because the `invalidate_mapping` operation is invoked from multiple workers without locking. This produces data races on the allocated-blocks counter and use-after-free conditions in internal data structures during concurrent writes, enabling local memory corruption with potential for privilege escalation or denial of service. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.18%, 7th percentile), consistent with a hard-to-trigger local race rather than a remotely weaponizable flaw.
Local memory-corruption in the Linux kernel's drm/msm (Qualcomm Adreno GPU) driver stems from a VM_BIND UNMAP locking bug where a wrong argument left the GPU buffer objects involved in UNMAP operations unlocked. A low-privileged local user with GPU/render access on systems using the msm driver can trigger races that, per the 7.8 CVSS vector (AV:L/AC:L/PR:L), yield high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and EPSS is low at 0.17%, indicating limited near-term mass-exploitation likelihood.
We need to produce a JSON output based on the multi-source intelligence. The CVE is CVE-2026-64374. Let's analyze the data: Description: The vulnerability is in the Linux kernel, specifically in the scheduler for real-time tasks (sched/rt). The RT_PUSH_IPI mechanism was introduced to solve latency issues on PREEMPT_RT kernels, but it causes a live-lock condition on non-PREEMPT_RT kernels under heavy networking workloads. The IPI handling on non-RT kernels (where softirqs run in interrupt context) can lead to a CPU being continuously interrupted by IPIs, causing it to never schedule the waiting RT tasks, leading to a live lock of that CPU. The fix is to make RT_PUSH_IPI default off for non-PREEMPT_RT configurations. CVSS: 7.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. This indicates a network attack vector, low complexity, no privileges, no user interaction, and a high availability impact. However, given the description, this seems odd: the vulnerability is a local live-lock condition due to IPI handling, which would typically require some level of access to trigger. The description mentions heavy networking traffic causing softirqs, so perhaps an attacker can send network traffic to trigger the softirq load, but that would be remote. However, CVSS: AV:N suggests remote exploitation, but PR:N implies no authentication. The attack might be sending crafted network traffic to a system that triggers the softirq storm, causing denial of service (availability impact). The CWE is N/A. EPSS: 0.22% (percentile 13%) - low probability of exploitation. Patch available: yes, "Vendor-released patch" from Linux. Tags: Information Disclosure, Linux (that seems inconsistent with the AV:N/A:H description, but tags might be incorrectly assigned). EUVD affected versions list patches for various kernel branches (like 5.10.261, 6.1.178, etc.) and commit ranges. The CPE strings are cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, which is too generic (no version range). References: sev
Denial of service and potential dma_resv fence-list corruption in the Linux kernel's virtio-gpu DRM driver (drm/virtio) affects Linux guests using virtio graphics, where virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() ignore the return value of virtio_gpu_array_lock_resv(). When the lock acquisition fails with -EINTR (signal during wait) or -ENOMEM (fence-slot allocation), the code proceeds to call dma_resv_add_fence() on an unheld lock, tripping a lockdep WARNING and racing concurrent readers/writers of the fence list. There is no public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and the issue was found by syzbot via fault injection rather than in-the-wild abuse.
Memory corruption in the Linux kernel's netfs library (introduced around v6.10) arises because netfs_retry_read_subrequests() and netfs_retry_write_stream() add new subrequests to stream->subrequests without holding the stream lock, creating a race on the shared list during I/O retry. The flaw affects systems using netfs-backed network filesystems (e.g. AFS, Ceph, CIFS/SMB, 9p) and can lead to list corruption, information disclosure, or a crash when concurrent retries mutate the list. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.15%), consistent with a hard-to-trigger local kernel race rather than a remotely weaponizable bug.
Memory-ordering defect in the Linux kernel's netfs (network filesystem helper) subsystem allows the lockless readers netfs_collect_read_results() and netfs_collect_write_results() to observe a subrequest pointer before the NETFS_SREQ_IN_PROGRESS flag and other subreq state are guaranteed visible, causing races on stream->subrequests. The flaw affects kernels from 6.10 onward that use netfs-backed filesystems (CIFS/SMB, AFS, Ceph, 9p) and can lead to stale-state reads, information disclosure, or instability during concurrent I/O collection. There is no public exploit identified at time of analysis, EPSS is very low (0.15%, 5th percentile), and it is not on CISA KEV; the upstream fix is available in stable git.
Improper locking in the Linux kernel AFS (Andrew File System) client's symbolic link handling (afs_get_link()) allows a local attacker on a host mounting an AFS volume to trigger race conditions that leak kernel memory and can expose stale or freed symlink buffers. The flaw affects kernels from roughly 6.14 up to the fixed 7.0.11/7.1 stable series and stems from a missing validate_lock, absent RCU barriering during lockless pathwalk, and unsynchronized access when a symlink is concurrently updated on the server. No public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and it is not on CISA KEV.
A locking-order inversion in the Linux kernel Bluetooth L2CAP subsystem's cleanup_listen() path lets an adjacent attacker trigger a race that can deadlock or corrupt channel state, affecting virtually every Linux distribution shipping the affected kernel with an active Bluetooth stack. cleanup_listen() called l2cap_chan_close() (which manipulates conn->chan_l) under the parent sk_lock, inverting the established conn->lock -> chan->lock -> sk_lock ordering; the fix reschedules channel teardown asynchronously via l2cap_chan_timeout. No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.17%, 6th percentile), so this is a proximity-bound reliability/memory-safety fix rather than a mass-exploitation threat.
Denial of service in the Linux kernel timer migration subsystem allows the global timer hierarchy to enter an indefinite livelock, hanging the affected CPU. The flaw is in tmigr_handle_remote_up(), where tmigr_handle_remote_cpu() skipped timer_expire_remote() for the local CPU on the assumption that the softirq path already serviced its timers; when jiffies advance between local timer processing and remote evaluation, a newly expired timer is never run and is re-queued with expires==now, spinning the goto-again loop forever. The CVSS 3.1 base score is 7.5 (availability only) but EPSS is just 0.18% (7th percentile), there is no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Use-after-free in the Linux kernel Bluetooth subsystem allows kernel memory corruption when the HCI connection-request handler (hci_conn_request_evt()) invokes hci_connect_cfm() without holding hdev->lock under the HCI_PROTO_DEFER path. An adjacent attacker within Bluetooth range can race a concurrent connection teardown against a deferred-setup SCO listener to free and reuse the conn object, yielding high confidentiality, integrity, and availability impact (CVSS 8.8). There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile), reflecting the narrow, race-dependent trigger rather than broad exploitability.
Concurrent cache-block invalidation in the Linux kernel's device-mapper dm-cache `smq` policy (running in passthrough mode) corrupts shared state because the `invalidate_mapping` operation is invoked from multiple workers without locking. This produces data races on the allocated-blocks counter and use-after-free conditions in internal data structures during concurrent writes, enabling local memory corruption with potential for privilege escalation or denial of service. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.18%, 7th percentile), consistent with a hard-to-trigger local race rather than a remotely weaponizable flaw.
Local memory-corruption in the Linux kernel's drm/msm (Qualcomm Adreno GPU) driver stems from a VM_BIND UNMAP locking bug where a wrong argument left the GPU buffer objects involved in UNMAP operations unlocked. A low-privileged local user with GPU/render access on systems using the msm driver can trigger races that, per the 7.8 CVSS vector (AV:L/AC:L/PR:L), yield high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and EPSS is low at 0.17%, indicating limited near-term mass-exploitation likelihood.