Linux Kernel EUVD-2026-28601

Requires local authenticated access with at least low-privilege user credentials (PR:L). The MOST core driver (most_core.ko) must be loaded in the running kernel - this typically occurs only in systems with MOST hardware present or when explicitly loaded via modprobe. Exploitation targets systems running Linux kernel versions 5.6 through 7.0-rc7 prior to the patch commits. The attacker must have permission to interact with the MOST driver's control interfaces (sysfs entries or device files under /sys/devices/most_*). Most general-purpose Linux distributions do not load this driver by default, limiting real-world exposure primarily to automotive embedded systems, industrial control devices, and specialized multimedia transport deployments. Standard desktop and server Linux installations without MOST hardware are not vulnerable in practice even if running affected kernel versions.

Real-world risk is LOW despite the 5.5 CVSS score. Multiple factors constrain practical exploitation: the CVSS vector (AV:L/AC:L/PR:L/UI:N) requires local authenticated access with low-privilege credentials, limiting the attack surface to already-compromised systems or malicious insiders. The EPSS score of 0.02% (5th percentile) indicates security researchers and threat actors assess exploitation probability as minimal. The vulnerability affects a specialized subsystem (MOST driver) primarily used in automotive and embedded contexts, not general-purpose server deployments where most Linux kernel vulnerabilities are weaponized. Impact is limited to availability (C:N/I:N/A:H) through resource exhaustion - no data disclosure or privilege escalation. The vulnerability requires repeated triggering of specific error conditions during interface registration, which may be difficult to induce reliably in production environments. Patches are available across all supported stable kernel branches, and no CISA KEV listing or public exploit code exists. Priority should be MEDIUM for automotive/embedded systems using MOST hardware, LOW for general Linux deployments where the driver is typically not loaded.

A local authenticated user with standard privileges repeatedly attempts to register MOST interfaces through the driver's sysfs or ioctl interface while intentionally triggering early registration failures. Each failed registration leaks kernel memory and interface resources. Over multiple iterations, system memory is exhausted, causing kernel resource starvation and eventual denial of service affecting all processes. No public exploit code exists, but the attack logic is straightforward for anyone with kernel programming knowledge.