Denial Of Service
Monthly
Denial of service in SQLite 3.41 due to a use-after-free in the JSON extraction function. A local unauthenticated attacker can trigger a crash by supplying a malicious JSON input, causing the host application to terminate. No active exploitation has been confirmed in the wild, but public exploit proof-of-concept may exist.
Denial of service in OpenSBI 1.3 allows remote, unauthenticated attackers to crash the system via crafted requests to the SBI PMU extension's counter configuration function (SBI function #2). The flaw, classified as uncontrolled resource consumption (CWE-400), can be triggered without user interaction and is rated high severity (CVSS 7.5). While no active exploitation is confirmed (not in CISA KEV) and EPSS remains very low (0.14%), a proof-of-concept crash is publicly available, making it a concern for RISC-V platforms in multi-tenant or exposed firmware environments.
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix infinite loop in layout state revocation find_one_sb_stid() skips stids whose sc_status is non-zero, but the SC_TYPE_LAYOUT case in nfsd4_revoke_states() never sets sc_status before calling nfsd4_close_layout(). The retry loop therefore finds the same layout stid on every iteration, hanging the revoker indefinitely.
In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix possible NULL pointer dereference After commit 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before getting NFIT table"), acpi_nfit_probe() installs an ACPI notify handler for the NFIT device before checking the presence of the NFIT table. If that table is not there, 0 is returned without allocating the acpi_desc object and setting the driver data pointer of the NFIT device. If the platform firmware triggers an NFIT_NOTIFY_UC_MEMORY_ERROR notification on the NFIT device at that point, acpi_nfit_uc_error_notify() will dereference a NULL pointer. Prevent that from occurring by adding an acpi_desc check against NULL to acpi_nfit_uc_error_notify().
In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_ymfpci_create_spdif_controls() does not check the return value before dereferencing kctl->id.device, which can lead to a NULL pointer dereference. Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any fails.
In the Linux kernel, the following vulnerability has been resolved: ALSA: aoa: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. In layout.c, the function does not check the return value before dereferencing ctl->id.name or passing to aoa_snd_ctl_add(), which can lead to a NULL pointer dereference. Add NULL checks after snd_ctl_new1() calls and return early if any fails.
In the Linux kernel, the following vulnerability has been resolved: ALSA: cmipci: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_cmipci_spdif_controls() does not check the return value before dereferencing kctl->id.device, which can lead to a NULL pointer dereference. Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any fails.
In the Linux kernel, the following vulnerability has been resolved: ALSA: es1938: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_es1938_mixer() does not check the return value before dereferencing the pointer, which can lead to a NULL pointer dereference. Add a NULL check after snd_ctl_new1() and return -ENOMEM if it fails.
In the Linux kernel, the following vulnerability has been resolved: ALSA: gus: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_gf1_pcm_volume_control() does not check the return value before dereferencing kctl->id.index, which can lead to a NULL pointer dereference. Add a NULL check after snd_ctl_new1() and return -ENOMEM if it fails.
In the Linux kernel, the following vulnerability has been resolved: ALSA: ice1712: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. The ice1712 driver calls snd_ctl_new1() without checking the return value before dereferencing the pointer in multiple places (ice1712.c, ice1724.c, aureon.c), which can lead to NULL pointer dereferences. Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any fails.
In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc vfio_mig_get_next_state() walks vfio_from_fsm_table[] one step at a time, looping to skip optional states the device does not support until *next_fsm is supported. A blocked transition is encoded as VFIO_DEVICE_STATE_ERROR, which the trailing return reports as -EINVAL. The skip loop does not account for the ERROR sentinel. state_flags_table[ERROR] is ~0U and vfio_from_fsm_table[ERROR][*] is ERROR, so once *next_fsm becomes ERROR the loop condition stays true and *next_fsm never changes. The blocked arcs STOP_COPY -> PRE_COPY and STOP_COPY -> PRE_COPY_P2P map to ERROR yet pass the support check on a precopy-capable device, causing the loop to spin forever while holding the driver state mutex. This can result in a soft lockup, and a panic with softlockup_panic set. Terminate the skip loop on the ERROR sentinel so a blocked transition falls through to the existing return and reports -EINVAL.
In the Linux kernel, the following vulnerability has been resolved: virtio_pci: fix vq info pointer lookup via wrong index Unbinding a virtio balloon device: echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind triggers a NULL pointer dereference. The dmesg says: BUG: kernel NULL pointer dereference, address: 0000000000000008 [...] RIP: 0010:__list_del_entry_valid_or_report+0x5/0xf0 Call Trace: <TASK> vp_del_vqs+0x121/0x230 remove_common+0x135/0x150 virtballoon_remove+0xee/0x100 virtio_dev_remove+0x3b/0x80 device_release_driver_internal+0x187/0x2c0 unbind_store+0xb9/0xe0 kernfs_fop_write_iter.llvm.11660790530567441834+0xf6/0x180 vfs_write+0x2a9/0x3b0 ksys_write+0x5c/0xd0 do_syscall_64+0x54/0x230 entry_SYSCALL_64_after_hwframe+0x29/0x31 [...] </TASK> The virtio_balloon device registers 5 queues (inflate, deflate, stats, free_page, reporting) but only the first two are unconditional. The stats, free_page and reporting queues are each conditional on their respective feature bits. When any of these features are absent, the corresponding vqs_info entry has name == NULL, creating holes in the array. The root cause is an indexing mismatch introduced when vq info storage was changed to be passed as an argument. vp_find_vqs_msix() and vp_find_vqs_intx() store the info pointer at vp_dev->vqs[i], where 'i' is the caller's sparse array index. However, the virtqueue itself gets vq->index assigned from queue_idx, a dense index that skips NULL entries. When holes exist, 'i' and queue_idx diverge. Later, vp_del_vqs() looks up info via vp_dev->vqs[vq->index] using the dense index into the sparsely-populated array, and hits NULL. Fix this by storing info at vp_dev->vqs[queue_idx] instead of vp_dev->vqs[i], so the store index matches the lookup index (vq->index). Apply the fix to both the MSIX and INTX paths.
NULL pointer dereference in the Linux kernel tracing subsystem (`func_set_flag()`) allows a local attacker with tracefs write access to trigger a kernel panic and crash the system. The flaw arises when a process holds an open file descriptor to a function tracer option (e.g., `func_stack_trace`) while a concurrent tracer switch sets `tr->current_trace_flags` to NULL; a subsequent write to that option file then dereferences the NULL pointer before the function tracer guard executes. No active exploitation (KEV) or public exploit code has been identified; EPSS is 0.20% at the 10th percentile, consistent with a localized, technically specific DoS condition.
Kernel crash (availability loss) in the Linux gpio/eic-sprd Spreadtrum EIC GPIO driver affects systems running PREEMPT_RT kernels with Unisoc/Spreadtrum SoCs. The IRQ startup path - request_threaded_irq() → irq_startup() → sprd_eic_irq_unmask() - calls sprd_eic_update(), which acquires a regular spinlock_t via spin_lock_irqsave(). On PREEMPT_RT kernels, spinlock_t is a sleeping lock; sleeping in a non-sleepable IRQ-disabled context triggers a kernel BUG: 'sleeping function called from invalid context', crashing the system. No public exploit has been identified at time of analysis; patches are available across all maintained stable branches.
NULL pointer dereference in the Linux kernel's hid_logitech_dj driver causes a kernel crash (DoS) when a crafted HID descriptor is processed during device probe. The flaw exists in logi_dj_probe(): when a Logitech Unifying receiver emulation presents report ID 0x20 with only padding output items, hid-core registers the report with rep->maxfield == 0. The error-path validation then dereferences rep->field[0]->report_count while printing a diagnostic message, triggering a KASAN-visible null-ptr-deref and kernel panic. No public exploit is identified at time of analysis, but the kernel commit descriptions include a full uhid-based reproduction method, lowering the barrier for local attackers.
Kernel panic via NULL pointer dereference in the Linux kernel's memory shrinker debugfs interface allows a local attacker to crash the system. The shrinker_debugfs_add() function unconditionally creates 'count' and 'scan' debugfs files for all registered shrinkers, but some shrinkers - notably the xen-backend shrinker - only implement one of the two required callbacks (count_objects or scan_objects). Writing to the exposed 'scan' debugfs file on such a shrinker dispatches through a NULL function pointer, triggering a kernel panic. No public exploit has been identified at time of analysis, and EPSS score of 0.21% reflects low exploitation probability. Patches are available across multiple stable kernel branches.
NULL pointer dereference in the Linux kernel's swap cgroup subsystem (`mm/swap_cgroup.c`) causes a kernel panic and full system crash on swapless hosts running kernel versions after commit `bea67dcc5eea`. The batched PTE zap path introduced by that commit calls `lookup_swap_cgroup_id()` without validating the swap entry against `swap_info[]`, so any process exit involving a PTE corrupted into a type-0 swap entry dereferences the uninitialized `ctrl->map` pointer and takes the host down. The crash pattern was confirmed in production on kernel 6.12.58 and independently reproduced by syzbot; no public exploit exists, but the kernel teardown path is deterministically vulnerable once the prerequisite conditions are present.
Softlockup in the Linux kernel's swap memory reclaim path allows a local user to trigger a kernel panic by generating heavy swap pressure on systems with large swap devices. The swap_reclaim_full_clusters() function, called from a kworker context, iterates through potentially thousands of full swap clusters without yielding the CPU via cond_resched(), starving the scheduler and eventually causing the kernel watchdog timer to fire. The vulnerability was confirmed in a real-world stress test on a 320-CPU arm64 machine with ~1TB RAM and an 8.6GB swap device, resulting in a kernel panic. No public exploit code exists and EPSS is very low (0.21%, 11th percentile).
Denial of service in the Linux kernel btmtksdio (MediaTek Bluetooth SDIO) driver allows a local attacker with low privileges to permanently hang the Bluetooth stack by triggering an infinite loop in btmtksdio_txrx_work(). The root cause is an inverted timeout logic: a misused time_is_before_jiffies() call, combined via OR, causes the worker loop's exit condition to become unconditionally true after the 5-second timeout fires, so the loop never terminates and never releases the SDIO host. No public exploit has been identified at time of analysis; however, the bug can also trigger organically under hardware stress conditions.
NULL pointer dereference in the Linux kernel Bluetooth HCI connection handler crashes the kernel when aborting a pending connection while `hdev->sent_cmd` is NULL but `req_status` remains `HCI_REQ_PEND`. Local users with Bluetooth access can trigger a general protection fault from the `hci_rx_work()` receive path, producing a kernel panic and denying service to all users on the affected system. No public exploit has been identified and EPSS probability stands at 0.21% (12th percentile), indicating very limited real-world exploitation likelihood.
NULL pointer dereference in the Linux kernel's Bluetooth ISO subsystem can crash the kernel when a race condition is triggered during PA-sync broadcast sink socket operations. The flaw exists in iso_conn_big_sync(), which drops the socket lock to call hci_get_route() and then re-acquires it without re-validating that the connection structure is still intact - allowing concurrent teardown events (iso_disconn_cfm → iso_conn_del → iso_chan_del) to null out iso_pi(sk)->conn before it is dereferenced. A local low-privileged user with access to Bluetooth ISO sockets can reliably crash the kernel, resulting in a denial of service. No public exploit code has been identified and no active exploitation is confirmed.
Null pointer dereference in the Linux kernel's cpufreq subsystem during system reboot allows a local attacker with low privileges to crash the kernel. The reboot path (kernel_restart() → device_shutdown() → cpufreq_suspend()) does not invoke freeze_processes() - unlike the normal suspend path - leaving CPU hotplug operations free to run concurrently and free governor_data while cpufreq_suspend() is still reading it, producing a use-after-free null pointer dereference. No public exploit exists and EPSS probability is 0.22% (13th percentile), placing this in low-urgency territory despite the ubiquitous kernel footprint.
Kernel denial-of-service via missing exec_update_lock protection in six Linux procfs functions affects all Linux deployments running kernel 2.6.30 through multiple current stable branches. When a low-privileged local user reads specific /proc entries (stat, map_files, ns symlinks) concurrently with an execve() call in the target process, the missing lock allows ptrace_may_access() to observe transiently invalid credential or memory-map state, triggering a kernel crash. No public exploit identified at time of analysis; EPSS is 0.22% (13th percentile), consistent with low near-term automated exploitation probability.
Denial of service via infinite exception loop in the Linux kernel's s390 architecture affects systems running IBM Secure Execution (Ultravisor) workloads on kernel versions 6.7 through the patched releases. When load_unaligned_zeropad() reads across a page boundary where the adjacent page has been donated to the Ultravisor, the do_secure_storage_access() exception handler cannot resolve the fault and enters an unresolvable loop, permanently hanging the affected execution context. Patched in upstream versions 6.12.97, 7.1.4, and 7.2-rc1 via reversion of DCACHE_WORD_ACCESS support on s390; no public exploit or active exploitation is confirmed at time of analysis.
Uninitialized stack memory use in the Linux kernel HFS and HFS+ filesystem drivers allows a local user to crash the kernel by mounting a crafted filesystem image. Two early-exit paths in `hfs_bnode_read()` - an invalid offset check and a corrected-to-zero length - skip the buffer write, while downstream callers such as `hfs_bnode_read_u16()` and `hfs_bnode_read_u8()` consume the uninitialized stack buffer unconditionally, producing KMSAN uninit-value reports and risking kernel panics. Patches are available across multiple stable kernel branches; no public exploit exists and EPSS is very low at 0.22%.
Unconditional invocation of cancel_work_sync() in the mtk-jpeg media driver's release path triggers spurious WARN_ON kernel warnings on non-multicore MediaTek JPEG codec platforms where the workqueue callback pointer is NULL. Systems running affected Linux kernel versions (6.6.140-6.18.38, 7.0.4) on MediaTek SoC hardware may experience kernel log pollution or, on kernels compiled with CONFIG_PANIC_ON_WARN=y, a full system denial of service when the JPEG device is released. No public exploit has been identified and no active exploitation is recorded; this is a stability and correctness fix with strictly local trigger conditions.
The Linux kernel BPF verifier incorrectly elides null-check requirements for inner array map lookups when the BPF_F_INNER_MAP flag is set, allowing a local attacker with BPF program loading privileges to trigger a null pointer dereference and crash the kernel. The flaw arises because the verifier uses the inner map template's max_entries for bounds reasoning at verification time, while the runtime helper operates against a concrete inner map that may have a larger max_entries value. A crafted BPF program exploiting the faulty nullness elision can cause a kernel denial of service. No public exploit code has been identified at time of analysis, and EPSS is low at 0.21%.
Memory exhaustion in the Linux kernel's USB CDNSP host controller driver allows local users to trigger a kernel-level memory leak by forcing partial allocation failures in `cdnsp_alloc_stream_info()`. Systems running Linux 5.12 through unpatched stable branches accumulate unreleased `stream_ctx_array` allocations that are never freed, eventually causing availability impact on hosts with CDNSP USB hardware. No public exploit exists, EPSS stands at 0.21%, and the vulnerability carries no confidentiality or integrity impact per the CVSS vector.
Incorrect argument passing in dwc3_ulpi_setup() causes the Linux kernel's DWC3 USB controller driver to pass a raw MMIO register pointer (dwc3->regs, typed as void __iomem *) to dwc3_readl() and dwc3_writel(), which instead expect the containing struct dwc3 * pointer. Because the register accessor functions internally dereference the struct to locate ->regs, supplying ->regs directly results in incorrect memory access during ULPI (USB Low Pin Interface) initialization - flagged by the kernel sparse checker as a type-safety violation across address spaces. The practical impact is a potential kernel panic or silent misread/miswrite of a USB control register, manifesting as an availability failure in systems using DWC3 ULPI USB controllers. No public exploit exists and the issue requires local access to trigger.
Kernel denial-of-service in the Linux USB gadget composite driver crashes the system by triggering a KASAN memory fault in the USB_DT_OTG request handler when the configuration list is empty. The flaw exists because list_first_entry() never returns NULL - making the subsequent config NULL-check dead code - so when cdev->configs is empty during a gadget unbind race or when a driver sets is_otg before registering any configuration, composite_setup() dereferences a garbage pointer and memcpy() copies arbitrary kernel memory into the USB response buffer. No public exploit code has been identified, and EPSS is 0.22% (13th percentile), consistent with the local, race-condition nature of the flaw.
Reference count leak in the Linux kernel USB gadget printer driver (f_printer) allows a local user to trigger a permanent kref increment on every rejected concurrent open attempt. Each call to printer_open() that returns -EBUSY still increments dev->kref, but because VFS never invokes ->release() for a failed open, the reference is never balanced. Repeated exploitation exhausts the reference counter, preventing proper driver teardown and causing availability degradation. No public exploit has been identified at time of analysis.
Incomplete error-path cleanup in the Linux kernel's uss720 USB-to-parallel-port driver leaves a parport device registered after probe failure, creating a dangling stale pointer backed by freed private data. Systems where a Belkin F5U002 or similar USS720-based adapter is attached and causes get_1284_register() to fail during uss720_probe() are left with an orphaned kernel parport entry and a reserved parport slot, which can lead to a kernel crash when the stale pp->private_data pointer is later dereferenced. No active exploitation has been identified; the bug was discovered via static-analysis research, and patches are available across all major Linux stable branches.
DMA mapping leak in the Linux kernel's MTU3 USB device controller driver causes local denial-of-service on MediaTek SoC platforms. When mtu3_gadget_queue() maps a USB transfer request via DMA before checking whether the QMU GPD ring has capacity, then mtu3_prepare_transfer() fails and returns -EAGAIN, the error path bypasses the mtu3_req_complete() cleanup helper, permanently stranding the DMA mapping. Repeated exhaustion of the IOMMU aperture can destabilize or crash the kernel. No public exploit code exists and EPSS at 0.22% (13th percentile) confirms negligible exploitation interest; the impact is a local availability-only issue confined to MediaTek USB gadget hardware.
Availability loss in the Linux kernel's USB serial digi_acceleport driver allows a local user to permanently halt data reception on a Digi AccelePort serial port until the USB device is physically reconnected or the driver is rebound. The bug arises from a missing URB resubmission path: when a port is closed while in a throttled state, the read URB is never re-queued, leaving the port silently deaf to incoming data upon next open. No public exploit has been identified and EPSS sits at 0.22% (13th percentile), reflecting the niche hardware dependency and local-only attack surface.
Hard lockup in the Linux kernel's digi_acceleport USB serial driver causes full system freeze when a Digi AccelePort device is physically disconnected during active I/O. The driver's OOB (out-of-band) command path loops indefinitely with interrupts disabled upon persistent URB submission failure, resulting in a kernel hard lockup that effectively crashes the host. Systems with this specific USB-to-serial adapter are affected across a wide range of stable kernel branches from 2.6.12 onward; patches have been released across all active stable series.
Memory leak in the Linux kernel USB ULPI (Universal Serial Bus Link Interface) subsystem allows a local low-privileged user to trigger repeated ULPI device registration failures that leak kernel memory, potentially leading to system instability or denial of service. Affected kernel versions span from 4.2 through multiple pre-patch stable branches, with fixes backported to 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc3. No public exploit or active exploitation has been identified at time of analysis; the EPSS score of 0.22% (13th percentile) reflects minimal probability of weaponization.
NULL pointer dereference in the Linux kernel's usbip virtual UDC (vudc) subsystem crashes the kernel when FunctionFS AIO cancellations are processed. The `vep_alloc_request()` function never initialized `vrequest->udc`, so any AIO cancellation arriving at `vep_dequeue()` - such as one triggered by a host-side `usbip attach` - dereferences a null pointer and produces a kernel oops, denying service to the guest system. A local attacker with low privileges on a system configured for USB/IP with FunctionFS AIO endpoints can reliably reproduce this crash. No public exploit code exists, and EPSS at 0.22% (13th percentile) confirms the path has not seen meaningful exploitation despite the bug reportedly existing for approximately ten years since Linux 4.7.
NULL pointer dereference in the Linux kernel's mt76 driver for MediaTek mt7921/mt7925 WiFi chipsets causes a kernel panic (denial of service) via a race condition in Channel Switch Announcement (CSA) beacon processing. When a CSA beacon is received, cfg80211 queues a wiphy work item; if the station disconnects or the channel context is torn down before the work item executes, the driver's dev->new_ctx pointer is already NULL but dereferenced unconditionally in mt7921_channel_switch_rx_beacon() and mt7925_channel_switch_rx_beacon(). EPSS is 0.20% (10th percentile) and no public exploit or CISA KEV listing is identified at time of analysis.
Null pointer dereference in the Linux kernel's chacha20poly1305 crypto template allows a local unprivileged user to crash the system. The flaw exists in chachapoly_create(), which passes the unvalidated return value of crypto_attr_alg_name() directly to strcmp() when the poly1305 sub-argument is absent in a malformed template string; since that function returns an ERR_PTR on failure, the subsequent strcmp() call dereferences an invalid pointer, triggering a kernel panic. Patches are available across multiple stable branches; no public exploit or active exploitation has been identified at time of analysis.
Denial of service in the Linux kernel's AMD CCP/SEV driver allows a local low-privileged process to crash a KVM hypervisor host by submitting SEV firmware ioctls to /dev/sev, which incorrectly triggers SNP initialization and zeroes the MSR_VM_HSAVE_PA register, causing a general protection fault on the next VMRUN and terminating all running virtual machines. Affected kernels span from the introducing commit (ceac7fb89e8da465aec3ac3c20477f912f5c3a6c) through the fixed stable releases 6.12.96, 6.18.39, and 7.1.4. No public exploit has been identified and EPSS is 0.22%, but the blast radius - crashing the host and all its tenant VMs - warrants prompt patching on AMD EPYC KVM deployments.
Crash of a Linux KVM host is achievable by a local low-privileged user via the /dev/sev ioctl interface on systems running AMD SEV-SNP firmware. When SNP_COMMIT is issued after a prior failed SEV initialization, the crypto/ccp driver incorrectly proceeds with SNP initialization, zeroing out MSR_VM_HSAVE_PA - the model-specific register holding the AMD SVM host save-area pointer. Any subsequent VMRUN instruction by KVM for an already-running VM will generate a General Protection Fault, crashing the host and terminating all guest workloads. No public exploit has been identified at time of analysis; patch commits are available across multiple stable branches.
Uncontrolled SNP initialization in the Linux kernel's CCP/SEV driver allows a local low-privileged user with /dev/sev access to crash the host kernel on AMD SEV/SNP-capable systems running KVM. Sending a SNP_VLEK_LOAD ioctl when SNP has not been initialized triggers an unnecessary initialization/shutdown wrapper that zeros MSR_VM_HSAVE_PA globally; the subsequent VMRUN instruction for any active KVM guest then triggers a General Protection Fault, bringing down the host and terminating all co-hosted VMs. No public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects the specialized attack environment required.
Host crash vulnerability in the Linux kernel's AMD SEV/SNP subsystem allows a local low-privileged user to take down a virtualization host by triggering SNP re-initialization via the `/dev/sev` `SNP_CONFIG` ioctl when SNP has previously failed to initialize. When re-initialization executes while KVM guests are running, it zeroes `MSR_VM_HSAVE_PA` globally across all CPUs; the next VMRUN instruction on any active guest then raises a General Protection Fault, crashing the host kernel and terminating all hosted VMs. No public exploit identified at time of analysis; EPSS is 0.22% at the 13th percentile, consistent with low opportunistic exploitation probability.
Silent error propagation in the Linux kernel's CTR_DRBG implementation (`drbg_ctr_generate()`) causes the function to return a success code while leaving its output buffer uninitialized when an internal operation fails. Code that relies on the generated random material receives garbage data, which can trigger kernel crashes or hangs depending on how the uninitialized buffer is consumed downstream. No public exploit has been identified; patched stable kernel releases are available across all active longterm-support branches.
Reference count leak in the Linux kernel's SCMI regulator driver can exhaust kernel memory resources, leading to a denial-of-service condition on affected systems. The flaw resides in scmi_regulator_probe(), where of_find_node_by_name() acquires a reference on a device-tree node but the corresponding of_node_put() release call is omitted on the error path when process_scmi_regulator_of_node() fails, permanently leaking the reference. Exploitation requires local access; no public exploit code has been identified and EPSS probability stands at 0.21%, indicating very low likelihood of opportunistic exploitation.
Null pointer dereference in the Linux kernel module decompression path crashes the kernel when a local user loads a compressed module under memory pressure. The flaw exists across multiple stable kernel branches and was introduced at commit b1ae6dc41eaa; patches are now available for all affected stable trees. No active exploitation confirmed (not in CISA KEV), and EPSS at 0.21% (12th percentile) reflects very low exploitation probability, consistent with the local-only, condition-dependent attack surface.
NULL pointer dereference in the Linux kernel's `page_ext` memory iteration API crashes systems during dynamic memory hotplug operations. The `page_ext_iter_next()` function fails to enforce the PFN boundary, advancing the iterator index past `__pgcount` and calling `page_ext_lookup()` on an uninitialized memory section, triggering a kernel panic. With EPSS at 0.21% (11th percentile) and no CISA KEV listing, real-world exploitation is low-probability and operationally constrained to environments actively performing memory hotplug, such as cloud hypervisors or NUMA-heavy servers with memory ballooning.
Infinite loop in the Linux kernel iommufd subsystem's fault read path allows a low-privileged local user to pin a CPU core at 100% utilization while holding a kernel mutex, causing a local denial of service. The flaw exists in iommufd_fault_fops_read(), where a copy_to_user() failure in the inner list traversal loop fails to propagate its error code to the outer while loop, which then re-fetches the same fault group and retries the failing operation indefinitely with fault->mutex held. No public exploit is identified at time of analysis; EPSS indicates a very low 0.21% exploitation probability, and this CVE is not listed in the CISA KEV catalog.
Null pointer dereference in the Linux kernel's KVM arm64 nested virtualization subsystem allows a local low-privileged attacker to crash the host kernel via a race condition in VNCR pseudo-TLB invalidation. The function kvm_invalidate_vncr_va() dereferences the VNCR pseudo-TLB pointer without first verifying allocation or validity, unlike its companion kvm_invalidate_vncr_ipa(). Exploitation results in a kernel panic that disrupts all virtual machines on the affected host; no public exploit has been identified at time of analysis, and EPSS of 0.21% (11th percentile) reflects minimal observed exploitation activity.
Kernel panic in the Linux kernel's fuse-uring subsystem allows a local low-privileged attacker to crash the system by triggering a NULL pointer dereference through crafted io_uring cancellation sequences against a FUSE filesystem. The root cause is that fuse_uring_cancel() moves cancelled entries with no attached requests to the ent_in_userspace list, where ent_list_request_expired() unconditionally dereferences ent->fuse_req, crashing the kernel. No public exploit code exists and EPSS sits at 0.21% (11th percentile), indicating negligible opportunistic exploitation pressure; however, the low privilege requirement and local DoS impact make it relevant for multi-tenant or shared-access Linux environments.
NULL pointer dereference in the Linux kernel's fuse-uring subsystem enables a local low-privilege attacker to crash the kernel, causing a denial of service. The flaw arises from a state management race in the fuse-uring request lifecycle: when a copy into a userspace io_uring ring buffer fails, the entry's request pointer is nullified but the entry remains on the active queue, allowing the expiration scanner to dereference the NULL pointer in a narrow race window. No public exploit has been identified and EPSS stands at 0.21% (11th percentile), indicating low likelihood of opportunistic exploitation.
Resource exhaustion in Apache Thrift Java bindings 0.19.0 through 0.23.x allows remote denial of service via an unbounded read. No authentication or user interaction is required, and no public exploit code is known. Users should upgrade to version 0.24.0 to remediate the issue.
Denial of service via memory exhaustion affects the webtransport-go library versions 0.11.0 and earlier. A remote attacker can send a crafted WebTransport capsule with a large payload to a vulnerable client or server using HTTP/3, causing excessive memory allocation and potential crash. No active exploitation has been reported, and the vulnerability is patched in version 0.11.1.
Denial of service in Cloudreve v4 and v3 allows any authenticated user to crash the entire server instance by uploading a tiny, maliciously crafted PNG/JPG/GIF file. The built-in image processor, enabled by default, decodes images without a pixel dimension cap, causing the Go stdlib to allocate large memory buffers from header‑supplied dimensions, triggering a fatal out‑of‑memory kill. A public proof‑of‑concept exploit is available, and the vendor has released a patch in version 4.17.0.
Denial of service in valibot's flatten() helper can be triggered by attacker-controlled object keys like 'toString' or 'valueOf' when used with record() validation. An unauthenticated remote attacker can submit crafted JSON to an API that validates input via valibot's record() schema and then calls flatten() on the resulting issues, causing a TypeError that crashes the request path instead of returning structured errors. A public proof-of-concept is available, and the vendor has released a patch in version 1.4.2.
JVM crash and potential in-process memory exposure in lz4-java 1.11.0 and earlier due to insufficient
NULL pointer dereference in the Linux kernel's `copy_process()` function allows a local low-privileged user to crash the host kernel via a denial-of-service condition. During `fork()`, the child process inherits the `PF_BLOCK_TS` process flag from the parent while the child's `blk_plug` pointer is simultaneously reset to NULL, breaking the invariant that `PF_BLOCK_TS` set implies `current->plug != NULL`. Any downstream block I/O subsystem code path that dereferences `current->plug` without a NULL guard in the child will trigger a kernel panic. No public exploit is identified at time of analysis, and EPSS at 0.16% (5th percentile) reflects minimal observed exploitation interest.
Stack buffer address truncation in the MIPS DEC 64-bit Linux kernel platform layer causes kernel panics when the initial console handler is invoked from a non-initial kernel thread. The buffer resides on a stack allocated in the XKPHYS 64-bit memory segment, whose address is silently truncated by legacy 32-bit DEC firmware, producing an invalid pointer dereference and a fatal kernel exception. No public exploit identified at time of analysis and no active exploitation is confirmed; patches are available across multiple stable kernel branches including 5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3, and 7.2-rc1.
NULL pointer dereference in the Linux kernel's pch_uart serial driver allows a local low-privileged user to crash the kernel by triggering a failed DMA memory allocation in dma_handle_rx(). Systems running Intel PCH (Platform Controller Hub) hardware with the pch_uart driver active and DMA enabled are vulnerable to denial of service via kernel panic. No public exploit or CISA KEV listing exists; with an EPSS of 0.17% (6th percentile), real-world exploitation risk is low, but patches are confirmed across multiple stable kernel branches.
Kernel panic via NULL pointer dereference in the Linux tps65219 PMIC regulator driver crashes affected systems when a hardware IRQ fires on the device, producing a local denial-of-service condition. The regression was introduced by commit 64a6b577490c, which removed the helper function `tps65219_get_rdev_by_name()` and inadvertently eliminated the only code path that assigned `irq_data.rdev`, leaving the pointer uninitialized for every registered IRQ. Systems running Linux kernel versions from that commit through the stable-branch fix points (6.18.34 and 7.0.11) on hardware equipped with the TI tps65219 PMIC are affected; no public exploit has been identified and the EPSS score of 0.17% reflects low exploitation probability.
Broadcast TLB flush in the Linux kernel x86 memory management subsystem triggers a General Protection Fault (#GP) on AMD INVLPGB-capable systems booted with the 'nopcid' parameter, causing a kernel panic and local denial of service. When PCID is disabled via 'nopcid', CR4.PCIDE is not set, but the INVLPGB broadcast TLB invalidation path remains enabled; once a memory descriptor becomes active across more than three CPUs, the kernel assigns it a global ASID and issues INVLPGB with a non-zero PCID - an illegal state that crashes the kernel. No public exploit exists, EPSS is 0.17% (6th percentile), and this is not in CISA KEV; real-world impact is constrained to the uncommon 'nopcid' boot configuration on AMD hardware.
NULL pointer dereference in the Linux kernel ethtool PHY subsystem allows a local low-privileged user to trigger a kernel panic (denial of service) by unbinding a PHY driver via sysfs while the device remains registered in the ethtool link topology. Affected kernel versions span the 6.16, 6.18.x, 7.0.x, and 7.1 stable branches; upstream fixes are available in commits targeting 6.18.34 and 7.0.11. No public exploit code exists and no active exploitation has been identified at time of analysis, consistent with EPSS at 0.17% (6th percentile).
NULL pointer dereference in the Linux kernel ACPI platform driver subsystem crashes the kernel when 13 core ACPI drivers are force-matched to devices lacking an ACPI companion object. The root cause is the absence of ACPI_COMPANION() or ACPI_HANDLE() null-checks in affected drivers, combined with the kernel's device_match_driver_override() mechanism which can bypass normal device-ID matching. Impact is limited to local denial of service (kernel panic); no active exploitation is confirmed (not in CISA KEV) and EPSS sits at 0.17% (6th percentile), placing this firmly in the maintenance-fix rather than urgent-remediation category.
NULL pointer dereference in the Linux kernel's Qualcomm Adreno GPU driver (drm/msm/a6xx) crashes the kernel when `a8xx_hfi_send_perf_table()` proceeds to dereference a kzalloc() return value without first validating it against NULL. Systems running affected kernel versions with Qualcomm Adreno 6xx or 8xx GPU hardware - primarily Snapdragon-based ARM devices, smartphones, and servers - can be crashed by a local low-privileged user who triggers the GPU HFI performance table code path under memory pressure. EPSS of 0.16% (5th percentile) and no CISA KEV listing confirm no known active exploitation; patches are available in stable kernel releases 7.0.11 and 7.1.
Kernel panic in the Linux kernel's PowerPC-specific arch_irq_work_raise() function crashes affected systems when machine check exception handlers invoke the function from real mode, a context where virtual memory translation is disabled and preempt_count access via a virtual address faults with a bad area data access error. PowerPC deployments running kernel versions prior to 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1 are affected; x86, ARM, and other non-PowerPC architectures are completely unaffected. No public exploit code exists and EPSS is 0.17% (7th percentile), consistent with a hardware-architecture-specific reliability defect rather than an attacker-driven threat; the vulnerability does not appear in the CISA KEV catalog.
NULL pointer dereference in the Linux kernel's iwlwifi MLD (Multi-Link Device) Wi-Fi driver allows a local low-privileged user to crash the kernel, resulting in a denial-of-service condition. The flaw resides in `iwl_mld_remove_link`, where the `link->fw_id` field is read before the `link` pointer is validated for NULL, enabling a kernel panic on affected systems with Intel wireless hardware. No public exploit code exists and the vulnerability is not listed in CISA KEV; patches are available in stable kernel releases 6.18.34, 7.0.11, and 7.1.
Persistent denial of service in Loytec LIP-ME201C and related building automation controllers through version 8.4.16 allows unauthenticated remote attackers to cause CPU exhaustion via a crafted SNMP GETNEXT request with a large OID component. This vulnerability, tracked as CVE-2026-55731 and assigned CVSS 4.0 base score 6.6, has an EPSS exploitation probability of 0.32% and is not known to be actively exploited at analysis time.
Denial of service in Zephyr RTOS versions before 4.5.0 occurs when mounting a crafted ext2 filesystem with zero values in superblock fields s_blocks_per_group or s_inodes_per_group. An attacker with physical access via removable media can trigger a division-by-zero fault on ARM Cortex-M targets, causing a system crash. No other impact beyond availability; no active exploitation or public exploit is known.
Directory traversal in the Nexter Blocks WordPress plugin (all versions through 5.0.0) allows authenticated attackers holding only subscriber-level accounts to delete arbitrary JavaScript and CSS files on the server by manipulating the unsanitized 'plus_name' parameter. Successful exploitation can destroy plugin and theme asset files, causing denial of service or permanent visual breakage of affected WordPress sites. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low authentication bar (subscriber-level) meaningfully elevates real-world risk for multi-tenant or open-registration WordPress deployments.
Red Hat Certificate System (RHCS) 9 is susceptible to a resource exhaustion denial-of-service condition triggered by unauthenticated remote attackers flooding its TLS-exposed HTTP endpoint. Repeated requests cause the underlying Java process to exhaust available heap memory, resulting in an Out of Memory crash that takes the certificate authority service offline. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this a realistic threat to any internet- or intranet-exposed RHCS deployment.
Unthrottled resource allocation in BizimHesap Online Pre-Accounting Software allows authenticated low-privileged network attackers to exhaust system resources, causing a denial of service condition. All versions through 17072026 are confirmed affected. Reported by Turkey's National Cyber Incident Response Center (USOM), no public exploit code or active exploitation has been identified at time of analysis. The vulnerability carries a CVSS 4.3 score, reflecting a low-availability-impact DoS limited to authenticated users.
Format string vulnerability in GNU nano's multi-buffer error message handling allows a local low-privileged attacker to cause stack information disclosure, denial of service via crash, or potentially achieve arbitrary memory writes. The flaw (CWE-134) is triggered when a user opens multiple files at startup, one of which carries a specially crafted name containing printf format specifiers and another triggers an ALERT-level error - causing nano to misinterpret the filename as a format string. Reported by Red Hat and scoped to RHEL 6 through 10 and OpenShift Container Platform 4, no public exploit or CISA KEV listing exists at time of analysis.
Grafana OSS exposes an unauthenticated or low-privilege denial-of-service path through its alertmanager templates test endpoint, which executes Go templates with no memory limits. Mass-execution of requests to `/api/alertmanager/grafana/config/api/v1/templates/test` in a short window exhausts heap memory, crashing the Grafana process entirely. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the anonymous-access exploitation path and low privilege bar make this a realistic availability risk for internet-exposed Grafana instances.
Incorrect NSEC owner computation in the mod-onlinesign module of Knot DNS can cause overly broad authenticated denial intervals, allowing downstream validating resolvers that use aggressive negative caching to synthesize negative answers for legitimate names, resulting in resolver-side denial of service. This issue affects versions before 3.4.10 and 3.5.x before 3.5.4, and is exploitable by a low-privileged authenticated user. No active exploitation or public proof-of-concept code is currently known.
Unbounded Server Action payload processing in Next.js App Router exhausts server memory when the affected Server Action uses the Edge runtime, enabling remote denial of service without authentication. Any Next.js application on npm/next versions 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 that exposes at least one Server Action on the Edge runtime is vulnerable. An attacker can send arbitrarily large HTTP request bodies to trigger runaway memory allocation, potentially crashing the process or degrading service for all users. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
Resource exhaustion in Dompdf v3.1.5 allows remote attackers to crash the PHP process by submitting a crafted HTML document containing a high-entropy PNG image encoded in Base64 at dimensions of 30,000x30,000 pixels. The attack bypasses Dompdf's dimension validation by exploiting the gap between the early-stage dimension check and the unbounded memory allocation during the rendering phase, forcing ~1.2 GB of uncompressed bitmap allocation that triggers a PHP Fatal Error or OS-level OOM kill. Publicly available exploit code exists (full PoC published in the GHSA advisory); no confirmed active exploitation in CISA KEV at time of analysis.
Uncontrolled resource consumption in dompdf's BMP image processing pipeline allows any unauthenticated attacker who can submit HTML to a dompdf-powered endpoint to exhaust server memory and stall PHP-FPM worker pools with a 169-byte HTTP request. The library trusts attacker-controlled BMP header dimensions without bounding width × height, causing PHP's GD extension to allocate a full native pixel canvas - bypassing PHP's memory_limit entirely because GD allocates through its own native allocator. A publicly available, verified proof-of-concept demonstrates ~12× memory amplification (34 MB control vs ~412 MB attack peak RSS) from identically-sized requests, making this a high-impact, low-effort denial-of-service primitive. No active exploitation confirmed in CISA KEV at time of analysis.
Resource exhaustion in Netty's HttpContentEncoder allows unauthenticated remote attackers to crash JVM-based servers via HTTP/1.1 pipelining. The per-channel acceptEncodingQueue accumulates attacker-controlled Accept-Encoding header values on the I/O thread without any bound, and is only drained when the application emits a non-1xx response - meaning a client pipelining requests faster than the server responds can inflate heap usage without limit. Vendor-released patches are available in 4.1.136.Final and 4.2.16.Final; no public exploit or CISA KEV listing is present at time of analysis.
Excessive CPU consumption in MongoDB Server's awaitable hello command exhaust mode allows unauthenticated remote clients to degrade server availability without any credentials. A specific parameter combination triggers a server-side response loop that bypasses normal throttling mechanisms, meaning even a small number of malicious connections can measurably impair database availability. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.9 with VA:L reflects a real but bounded availability impact.
MongoDB's mongod daemon can be crashed by any authenticated user holding only read-only privileges, dropping database service for every connected client until an operator restarts the process. The root cause is CWE-617 (Reachable Assertion) inside the aggregation framework's engine selection logic - a state the codebase assumed unreachable that a crafted combination of aggregation options can actually trigger. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the PR:L attack vector makes this a reliable insider-threat and post-compromise availability weapon against any network-reachable MongoDB deployment.
MongoDB Server terminates abnormally during outbound TLS handshake when a remote peer delivers a malformed OCSP response, producing a denial-of-service condition against the database process itself. OCSP stapling validation is enabled by default for all outgoing TLS connections, meaning no operator misconfiguration is required to expose this attack surface - any MongoDB server initiating TLS connections is potentially reachable. No public exploit code exists and no CISA KEV listing is present at time of analysis, but the default-enabled feature combined with the adjacent-network attack vector makes this a credible operational risk for MongoDB clusters traversing partially trusted or shared network segments.
Elgg's ImageService processes avatar uploads without validating source image dimensions prior to resizing, allowing authenticated users to trigger out-of-memory (OOM) conditions on the hosting server. All Elgg releases before 7.0.0 are affected; the fix introduced in 7.0.0 enforces hard limits on image height, width, and total resolution before any GD library resize operation is invoked. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the technique is conceptually trivial for any authenticated user with avatar upload access.
Missing authorization in Caliptra Core Runtime Firmware 2.1.0 exposes three mailbox command handlers - INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, and EXTERNAL_MAILBOX_CMD - to abuse by a privileged local attacker operating in subsystem mode. By supplying mailbox commands containing unverified AXI bus addresses, an attacker can crash the Caliptra Root of Trust firmware, causing a denial of service against the hardware security enclave. The vendor notes that security impact beyond availability is integration-specific, meaning depending on how the SoC integrates Caliptra, subsequent-system integrity (SI:L per CVSS 4.0) may also be affected. No public exploit is identified at time of analysis.
Unauthenticated denial-of-service in Progress Telerik UI for ASP.NET AJAX (all versions prior to 2026.2.708) is possible because the internal LayoutBuilder control parses client-submitted XML without disabling DTD processing, exposing recursive XML entity expansion (CWE-776, 'Billion Laughs'). Any network-reachable attacker can send a crafted HTTP request containing a self-referencing DTD payload to cause exponential memory and CPU exhaustion on the server-side process. No public exploit code or CISA KEV entry has been identified at time of analysis, but the low attack complexity and absence of authentication make this a straightforward DoS primitive once the target endpoint is located.
Remote unauthenticated termination of Unbound 1.22.0 through 1.25.1 is possible via a crafted DNS-over-QUIC (DoQ) connection that exploits a signed-to-unsigned integer conversion error when Unbound mishandles the NGTCP2_ERR_STREAM_DATA_BLOCKED error condition. The flaw propagates an implicit conversion of the C literal `-1` to a 64-bit unsigned integer (0xFFFFFFFFFFFFFFFF), which exceeds the 62-bit QUIC varint ceiling and triggers a libngtcp2 assertion that aborts the entire resolver process. Exploitation is deterministic - a single QUIC connection with one crafted transport parameter and one DNS query is sufficient - though the attack surface is constrained to deployments compiled with assertions enabled and DoQ actively configured. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Denial of service in NLnet Labs Unbound 1.10.0 through 1.25.1 allows a remote attacker controlling any delegated DNS zone to crash the resolver daemon via a NULL pointer dereference. The vulnerable path is activated only when both the serve-expired feature and a response-ip or RPZ CNAME redirect rule are configured simultaneously; the serve-expired-client-timeout callback's two-pass CNAME alias loop resets alias_rrset on the second pass without resetting partial_rep, causing an eventual null dereference and process crash. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the network-accessible attack surface makes it a meaningful availability risk for any resolver running these co-configured features.
Use-after-free in NLnet Labs Unbound 1.15.0 through 1.25.1 crashes the DNS daemon via a dangling pointer to a freed TLS server name string in the DNS-over-TLS forwarding path. A remote attacker with knowledge of the target resolver's configuration can trigger the crash by sustaining query pressure against the configured DoT zone while inducing a transient upstream connection failure, causing denial of service. No public exploit code exists and this vulnerability has not been confirmed as actively exploited, but the network-accessible attack surface (PR:N) makes it relevant to operators running internet-facing recursive resolvers with DoT forwarding.
Denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 causes server termination when DNS-over-QUIC (DoQ) is enabled and the resolver operates under high concurrency. Unbound incorrectly passes realtime clock values to libngtcp2 where monotonic timestamps are required; under load, the resulting assertion failure in libngtcp2 abruptly kills the Unbound process. No public exploit code exists and no active exploitation has been reported, but the self-termination of a DNS resolver constitutes a severe availability impact for any infrastructure depending on it.
Heap buffer overflow in Red Hat Directory Server (389-ds-base) exposes LDAP services to remote unauthenticated denial of service or potential arbitrary memory write via malformed DN input. When a Distinguished Name containing a legacy-quoted value is processed, the server fails to close the associated heap allocation, permitting a subsequent operation to reference the same memory pointer - a classic heap confusion primitive. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, though the network-accessible unauthenticated attack surface warrants prompt patching for any externally reachable Directory Server deployment.
Denial-of-service via ReDoS in Open Mercato affects all versions prior to 0.6.4, allowing an authenticated administrator who can create custom-field regex rules to introduce catastrophic backtracking patterns that block the Node.js event loop when a crafted input string is submitted. The vulnerability affects the custom-field validation pipeline across server-side (packages/core, packages/shared) and client-side (packages/ui CrudForm) components, with confirmed exposure at the PUT /api/customers/companies endpoint. No active exploitation is recorded in CISA KEV, but a proof-of-concept was submitted as part of the CERT-PL disclosure and is referenced in the public patch PR.
Denial of service in SQLite 3.41 due to a use-after-free in the JSON extraction function. A local unauthenticated attacker can trigger a crash by supplying a malicious JSON input, causing the host application to terminate. No active exploitation has been confirmed in the wild, but public exploit proof-of-concept may exist.
Denial of service in OpenSBI 1.3 allows remote, unauthenticated attackers to crash the system via crafted requests to the SBI PMU extension's counter configuration function (SBI function #2). The flaw, classified as uncontrolled resource consumption (CWE-400), can be triggered without user interaction and is rated high severity (CVSS 7.5). While no active exploitation is confirmed (not in CISA KEV) and EPSS remains very low (0.14%), a proof-of-concept crash is publicly available, making it a concern for RISC-V platforms in multi-tenant or exposed firmware environments.
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix infinite loop in layout state revocation find_one_sb_stid() skips stids whose sc_status is non-zero, but the SC_TYPE_LAYOUT case in nfsd4_revoke_states() never sets sc_status before calling nfsd4_close_layout(). The retry loop therefore finds the same layout stid on every iteration, hanging the revoker indefinitely.
In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix possible NULL pointer dereference After commit 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before getting NFIT table"), acpi_nfit_probe() installs an ACPI notify handler for the NFIT device before checking the presence of the NFIT table. If that table is not there, 0 is returned without allocating the acpi_desc object and setting the driver data pointer of the NFIT device. If the platform firmware triggers an NFIT_NOTIFY_UC_MEMORY_ERROR notification on the NFIT device at that point, acpi_nfit_uc_error_notify() will dereference a NULL pointer. Prevent that from occurring by adding an acpi_desc check against NULL to acpi_nfit_uc_error_notify().
In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_ymfpci_create_spdif_controls() does not check the return value before dereferencing kctl->id.device, which can lead to a NULL pointer dereference. Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any fails.
In the Linux kernel, the following vulnerability has been resolved: ALSA: aoa: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. In layout.c, the function does not check the return value before dereferencing ctl->id.name or passing to aoa_snd_ctl_add(), which can lead to a NULL pointer dereference. Add NULL checks after snd_ctl_new1() calls and return early if any fails.
In the Linux kernel, the following vulnerability has been resolved: ALSA: cmipci: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_cmipci_spdif_controls() does not check the return value before dereferencing kctl->id.device, which can lead to a NULL pointer dereference. Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any fails.
In the Linux kernel, the following vulnerability has been resolved: ALSA: es1938: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_es1938_mixer() does not check the return value before dereferencing the pointer, which can lead to a NULL pointer dereference. Add a NULL check after snd_ctl_new1() and return -ENOMEM if it fails.
In the Linux kernel, the following vulnerability has been resolved: ALSA: gus: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_gf1_pcm_volume_control() does not check the return value before dereferencing kctl->id.index, which can lead to a NULL pointer dereference. Add a NULL check after snd_ctl_new1() and return -ENOMEM if it fails.
In the Linux kernel, the following vulnerability has been resolved: ALSA: ice1712: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. The ice1712 driver calls snd_ctl_new1() without checking the return value before dereferencing the pointer in multiple places (ice1712.c, ice1724.c, aureon.c), which can lead to NULL pointer dereferences. Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any fails.
In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc vfio_mig_get_next_state() walks vfio_from_fsm_table[] one step at a time, looping to skip optional states the device does not support until *next_fsm is supported. A blocked transition is encoded as VFIO_DEVICE_STATE_ERROR, which the trailing return reports as -EINVAL. The skip loop does not account for the ERROR sentinel. state_flags_table[ERROR] is ~0U and vfio_from_fsm_table[ERROR][*] is ERROR, so once *next_fsm becomes ERROR the loop condition stays true and *next_fsm never changes. The blocked arcs STOP_COPY -> PRE_COPY and STOP_COPY -> PRE_COPY_P2P map to ERROR yet pass the support check on a precopy-capable device, causing the loop to spin forever while holding the driver state mutex. This can result in a soft lockup, and a panic with softlockup_panic set. Terminate the skip loop on the ERROR sentinel so a blocked transition falls through to the existing return and reports -EINVAL.
In the Linux kernel, the following vulnerability has been resolved: virtio_pci: fix vq info pointer lookup via wrong index Unbinding a virtio balloon device: echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind triggers a NULL pointer dereference. The dmesg says: BUG: kernel NULL pointer dereference, address: 0000000000000008 [...] RIP: 0010:__list_del_entry_valid_or_report+0x5/0xf0 Call Trace: <TASK> vp_del_vqs+0x121/0x230 remove_common+0x135/0x150 virtballoon_remove+0xee/0x100 virtio_dev_remove+0x3b/0x80 device_release_driver_internal+0x187/0x2c0 unbind_store+0xb9/0xe0 kernfs_fop_write_iter.llvm.11660790530567441834+0xf6/0x180 vfs_write+0x2a9/0x3b0 ksys_write+0x5c/0xd0 do_syscall_64+0x54/0x230 entry_SYSCALL_64_after_hwframe+0x29/0x31 [...] </TASK> The virtio_balloon device registers 5 queues (inflate, deflate, stats, free_page, reporting) but only the first two are unconditional. The stats, free_page and reporting queues are each conditional on their respective feature bits. When any of these features are absent, the corresponding vqs_info entry has name == NULL, creating holes in the array. The root cause is an indexing mismatch introduced when vq info storage was changed to be passed as an argument. vp_find_vqs_msix() and vp_find_vqs_intx() store the info pointer at vp_dev->vqs[i], where 'i' is the caller's sparse array index. However, the virtqueue itself gets vq->index assigned from queue_idx, a dense index that skips NULL entries. When holes exist, 'i' and queue_idx diverge. Later, vp_del_vqs() looks up info via vp_dev->vqs[vq->index] using the dense index into the sparsely-populated array, and hits NULL. Fix this by storing info at vp_dev->vqs[queue_idx] instead of vp_dev->vqs[i], so the store index matches the lookup index (vq->index). Apply the fix to both the MSIX and INTX paths.
NULL pointer dereference in the Linux kernel tracing subsystem (`func_set_flag()`) allows a local attacker with tracefs write access to trigger a kernel panic and crash the system. The flaw arises when a process holds an open file descriptor to a function tracer option (e.g., `func_stack_trace`) while a concurrent tracer switch sets `tr->current_trace_flags` to NULL; a subsequent write to that option file then dereferences the NULL pointer before the function tracer guard executes. No active exploitation (KEV) or public exploit code has been identified; EPSS is 0.20% at the 10th percentile, consistent with a localized, technically specific DoS condition.
Kernel crash (availability loss) in the Linux gpio/eic-sprd Spreadtrum EIC GPIO driver affects systems running PREEMPT_RT kernels with Unisoc/Spreadtrum SoCs. The IRQ startup path - request_threaded_irq() → irq_startup() → sprd_eic_irq_unmask() - calls sprd_eic_update(), which acquires a regular spinlock_t via spin_lock_irqsave(). On PREEMPT_RT kernels, spinlock_t is a sleeping lock; sleeping in a non-sleepable IRQ-disabled context triggers a kernel BUG: 'sleeping function called from invalid context', crashing the system. No public exploit has been identified at time of analysis; patches are available across all maintained stable branches.
NULL pointer dereference in the Linux kernel's hid_logitech_dj driver causes a kernel crash (DoS) when a crafted HID descriptor is processed during device probe. The flaw exists in logi_dj_probe(): when a Logitech Unifying receiver emulation presents report ID 0x20 with only padding output items, hid-core registers the report with rep->maxfield == 0. The error-path validation then dereferences rep->field[0]->report_count while printing a diagnostic message, triggering a KASAN-visible null-ptr-deref and kernel panic. No public exploit is identified at time of analysis, but the kernel commit descriptions include a full uhid-based reproduction method, lowering the barrier for local attackers.
Kernel panic via NULL pointer dereference in the Linux kernel's memory shrinker debugfs interface allows a local attacker to crash the system. The shrinker_debugfs_add() function unconditionally creates 'count' and 'scan' debugfs files for all registered shrinkers, but some shrinkers - notably the xen-backend shrinker - only implement one of the two required callbacks (count_objects or scan_objects). Writing to the exposed 'scan' debugfs file on such a shrinker dispatches through a NULL function pointer, triggering a kernel panic. No public exploit has been identified at time of analysis, and EPSS score of 0.21% reflects low exploitation probability. Patches are available across multiple stable kernel branches.
NULL pointer dereference in the Linux kernel's swap cgroup subsystem (`mm/swap_cgroup.c`) causes a kernel panic and full system crash on swapless hosts running kernel versions after commit `bea67dcc5eea`. The batched PTE zap path introduced by that commit calls `lookup_swap_cgroup_id()` without validating the swap entry against `swap_info[]`, so any process exit involving a PTE corrupted into a type-0 swap entry dereferences the uninitialized `ctrl->map` pointer and takes the host down. The crash pattern was confirmed in production on kernel 6.12.58 and independently reproduced by syzbot; no public exploit exists, but the kernel teardown path is deterministically vulnerable once the prerequisite conditions are present.
Softlockup in the Linux kernel's swap memory reclaim path allows a local user to trigger a kernel panic by generating heavy swap pressure on systems with large swap devices. The swap_reclaim_full_clusters() function, called from a kworker context, iterates through potentially thousands of full swap clusters without yielding the CPU via cond_resched(), starving the scheduler and eventually causing the kernel watchdog timer to fire. The vulnerability was confirmed in a real-world stress test on a 320-CPU arm64 machine with ~1TB RAM and an 8.6GB swap device, resulting in a kernel panic. No public exploit code exists and EPSS is very low (0.21%, 11th percentile).
Denial of service in the Linux kernel btmtksdio (MediaTek Bluetooth SDIO) driver allows a local attacker with low privileges to permanently hang the Bluetooth stack by triggering an infinite loop in btmtksdio_txrx_work(). The root cause is an inverted timeout logic: a misused time_is_before_jiffies() call, combined via OR, causes the worker loop's exit condition to become unconditionally true after the 5-second timeout fires, so the loop never terminates and never releases the SDIO host. No public exploit has been identified at time of analysis; however, the bug can also trigger organically under hardware stress conditions.
NULL pointer dereference in the Linux kernel Bluetooth HCI connection handler crashes the kernel when aborting a pending connection while `hdev->sent_cmd` is NULL but `req_status` remains `HCI_REQ_PEND`. Local users with Bluetooth access can trigger a general protection fault from the `hci_rx_work()` receive path, producing a kernel panic and denying service to all users on the affected system. No public exploit has been identified and EPSS probability stands at 0.21% (12th percentile), indicating very limited real-world exploitation likelihood.
NULL pointer dereference in the Linux kernel's Bluetooth ISO subsystem can crash the kernel when a race condition is triggered during PA-sync broadcast sink socket operations. The flaw exists in iso_conn_big_sync(), which drops the socket lock to call hci_get_route() and then re-acquires it without re-validating that the connection structure is still intact - allowing concurrent teardown events (iso_disconn_cfm → iso_conn_del → iso_chan_del) to null out iso_pi(sk)->conn before it is dereferenced. A local low-privileged user with access to Bluetooth ISO sockets can reliably crash the kernel, resulting in a denial of service. No public exploit code has been identified and no active exploitation is confirmed.
Null pointer dereference in the Linux kernel's cpufreq subsystem during system reboot allows a local attacker with low privileges to crash the kernel. The reboot path (kernel_restart() → device_shutdown() → cpufreq_suspend()) does not invoke freeze_processes() - unlike the normal suspend path - leaving CPU hotplug operations free to run concurrently and free governor_data while cpufreq_suspend() is still reading it, producing a use-after-free null pointer dereference. No public exploit exists and EPSS probability is 0.22% (13th percentile), placing this in low-urgency territory despite the ubiquitous kernel footprint.
Kernel denial-of-service via missing exec_update_lock protection in six Linux procfs functions affects all Linux deployments running kernel 2.6.30 through multiple current stable branches. When a low-privileged local user reads specific /proc entries (stat, map_files, ns symlinks) concurrently with an execve() call in the target process, the missing lock allows ptrace_may_access() to observe transiently invalid credential or memory-map state, triggering a kernel crash. No public exploit identified at time of analysis; EPSS is 0.22% (13th percentile), consistent with low near-term automated exploitation probability.
Denial of service via infinite exception loop in the Linux kernel's s390 architecture affects systems running IBM Secure Execution (Ultravisor) workloads on kernel versions 6.7 through the patched releases. When load_unaligned_zeropad() reads across a page boundary where the adjacent page has been donated to the Ultravisor, the do_secure_storage_access() exception handler cannot resolve the fault and enters an unresolvable loop, permanently hanging the affected execution context. Patched in upstream versions 6.12.97, 7.1.4, and 7.2-rc1 via reversion of DCACHE_WORD_ACCESS support on s390; no public exploit or active exploitation is confirmed at time of analysis.
Uninitialized stack memory use in the Linux kernel HFS and HFS+ filesystem drivers allows a local user to crash the kernel by mounting a crafted filesystem image. Two early-exit paths in `hfs_bnode_read()` - an invalid offset check and a corrected-to-zero length - skip the buffer write, while downstream callers such as `hfs_bnode_read_u16()` and `hfs_bnode_read_u8()` consume the uninitialized stack buffer unconditionally, producing KMSAN uninit-value reports and risking kernel panics. Patches are available across multiple stable kernel branches; no public exploit exists and EPSS is very low at 0.22%.
Unconditional invocation of cancel_work_sync() in the mtk-jpeg media driver's release path triggers spurious WARN_ON kernel warnings on non-multicore MediaTek JPEG codec platforms where the workqueue callback pointer is NULL. Systems running affected Linux kernel versions (6.6.140-6.18.38, 7.0.4) on MediaTek SoC hardware may experience kernel log pollution or, on kernels compiled with CONFIG_PANIC_ON_WARN=y, a full system denial of service when the JPEG device is released. No public exploit has been identified and no active exploitation is recorded; this is a stability and correctness fix with strictly local trigger conditions.
The Linux kernel BPF verifier incorrectly elides null-check requirements for inner array map lookups when the BPF_F_INNER_MAP flag is set, allowing a local attacker with BPF program loading privileges to trigger a null pointer dereference and crash the kernel. The flaw arises because the verifier uses the inner map template's max_entries for bounds reasoning at verification time, while the runtime helper operates against a concrete inner map that may have a larger max_entries value. A crafted BPF program exploiting the faulty nullness elision can cause a kernel denial of service. No public exploit code has been identified at time of analysis, and EPSS is low at 0.21%.
Memory exhaustion in the Linux kernel's USB CDNSP host controller driver allows local users to trigger a kernel-level memory leak by forcing partial allocation failures in `cdnsp_alloc_stream_info()`. Systems running Linux 5.12 through unpatched stable branches accumulate unreleased `stream_ctx_array` allocations that are never freed, eventually causing availability impact on hosts with CDNSP USB hardware. No public exploit exists, EPSS stands at 0.21%, and the vulnerability carries no confidentiality or integrity impact per the CVSS vector.
Incorrect argument passing in dwc3_ulpi_setup() causes the Linux kernel's DWC3 USB controller driver to pass a raw MMIO register pointer (dwc3->regs, typed as void __iomem *) to dwc3_readl() and dwc3_writel(), which instead expect the containing struct dwc3 * pointer. Because the register accessor functions internally dereference the struct to locate ->regs, supplying ->regs directly results in incorrect memory access during ULPI (USB Low Pin Interface) initialization - flagged by the kernel sparse checker as a type-safety violation across address spaces. The practical impact is a potential kernel panic or silent misread/miswrite of a USB control register, manifesting as an availability failure in systems using DWC3 ULPI USB controllers. No public exploit exists and the issue requires local access to trigger.
Kernel denial-of-service in the Linux USB gadget composite driver crashes the system by triggering a KASAN memory fault in the USB_DT_OTG request handler when the configuration list is empty. The flaw exists because list_first_entry() never returns NULL - making the subsequent config NULL-check dead code - so when cdev->configs is empty during a gadget unbind race or when a driver sets is_otg before registering any configuration, composite_setup() dereferences a garbage pointer and memcpy() copies arbitrary kernel memory into the USB response buffer. No public exploit code has been identified, and EPSS is 0.22% (13th percentile), consistent with the local, race-condition nature of the flaw.
Reference count leak in the Linux kernel USB gadget printer driver (f_printer) allows a local user to trigger a permanent kref increment on every rejected concurrent open attempt. Each call to printer_open() that returns -EBUSY still increments dev->kref, but because VFS never invokes ->release() for a failed open, the reference is never balanced. Repeated exploitation exhausts the reference counter, preventing proper driver teardown and causing availability degradation. No public exploit has been identified at time of analysis.
Incomplete error-path cleanup in the Linux kernel's uss720 USB-to-parallel-port driver leaves a parport device registered after probe failure, creating a dangling stale pointer backed by freed private data. Systems where a Belkin F5U002 or similar USS720-based adapter is attached and causes get_1284_register() to fail during uss720_probe() are left with an orphaned kernel parport entry and a reserved parport slot, which can lead to a kernel crash when the stale pp->private_data pointer is later dereferenced. No active exploitation has been identified; the bug was discovered via static-analysis research, and patches are available across all major Linux stable branches.
DMA mapping leak in the Linux kernel's MTU3 USB device controller driver causes local denial-of-service on MediaTek SoC platforms. When mtu3_gadget_queue() maps a USB transfer request via DMA before checking whether the QMU GPD ring has capacity, then mtu3_prepare_transfer() fails and returns -EAGAIN, the error path bypasses the mtu3_req_complete() cleanup helper, permanently stranding the DMA mapping. Repeated exhaustion of the IOMMU aperture can destabilize or crash the kernel. No public exploit code exists and EPSS at 0.22% (13th percentile) confirms negligible exploitation interest; the impact is a local availability-only issue confined to MediaTek USB gadget hardware.
Availability loss in the Linux kernel's USB serial digi_acceleport driver allows a local user to permanently halt data reception on a Digi AccelePort serial port until the USB device is physically reconnected or the driver is rebound. The bug arises from a missing URB resubmission path: when a port is closed while in a throttled state, the read URB is never re-queued, leaving the port silently deaf to incoming data upon next open. No public exploit has been identified and EPSS sits at 0.22% (13th percentile), reflecting the niche hardware dependency and local-only attack surface.
Hard lockup in the Linux kernel's digi_acceleport USB serial driver causes full system freeze when a Digi AccelePort device is physically disconnected during active I/O. The driver's OOB (out-of-band) command path loops indefinitely with interrupts disabled upon persistent URB submission failure, resulting in a kernel hard lockup that effectively crashes the host. Systems with this specific USB-to-serial adapter are affected across a wide range of stable kernel branches from 2.6.12 onward; patches have been released across all active stable series.
Memory leak in the Linux kernel USB ULPI (Universal Serial Bus Link Interface) subsystem allows a local low-privileged user to trigger repeated ULPI device registration failures that leak kernel memory, potentially leading to system instability or denial of service. Affected kernel versions span from 4.2 through multiple pre-patch stable branches, with fixes backported to 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc3. No public exploit or active exploitation has been identified at time of analysis; the EPSS score of 0.22% (13th percentile) reflects minimal probability of weaponization.
NULL pointer dereference in the Linux kernel's usbip virtual UDC (vudc) subsystem crashes the kernel when FunctionFS AIO cancellations are processed. The `vep_alloc_request()` function never initialized `vrequest->udc`, so any AIO cancellation arriving at `vep_dequeue()` - such as one triggered by a host-side `usbip attach` - dereferences a null pointer and produces a kernel oops, denying service to the guest system. A local attacker with low privileges on a system configured for USB/IP with FunctionFS AIO endpoints can reliably reproduce this crash. No public exploit code exists, and EPSS at 0.22% (13th percentile) confirms the path has not seen meaningful exploitation despite the bug reportedly existing for approximately ten years since Linux 4.7.
NULL pointer dereference in the Linux kernel's mt76 driver for MediaTek mt7921/mt7925 WiFi chipsets causes a kernel panic (denial of service) via a race condition in Channel Switch Announcement (CSA) beacon processing. When a CSA beacon is received, cfg80211 queues a wiphy work item; if the station disconnects or the channel context is torn down before the work item executes, the driver's dev->new_ctx pointer is already NULL but dereferenced unconditionally in mt7921_channel_switch_rx_beacon() and mt7925_channel_switch_rx_beacon(). EPSS is 0.20% (10th percentile) and no public exploit or CISA KEV listing is identified at time of analysis.
Null pointer dereference in the Linux kernel's chacha20poly1305 crypto template allows a local unprivileged user to crash the system. The flaw exists in chachapoly_create(), which passes the unvalidated return value of crypto_attr_alg_name() directly to strcmp() when the poly1305 sub-argument is absent in a malformed template string; since that function returns an ERR_PTR on failure, the subsequent strcmp() call dereferences an invalid pointer, triggering a kernel panic. Patches are available across multiple stable branches; no public exploit or active exploitation has been identified at time of analysis.
Denial of service in the Linux kernel's AMD CCP/SEV driver allows a local low-privileged process to crash a KVM hypervisor host by submitting SEV firmware ioctls to /dev/sev, which incorrectly triggers SNP initialization and zeroes the MSR_VM_HSAVE_PA register, causing a general protection fault on the next VMRUN and terminating all running virtual machines. Affected kernels span from the introducing commit (ceac7fb89e8da465aec3ac3c20477f912f5c3a6c) through the fixed stable releases 6.12.96, 6.18.39, and 7.1.4. No public exploit has been identified and EPSS is 0.22%, but the blast radius - crashing the host and all its tenant VMs - warrants prompt patching on AMD EPYC KVM deployments.
Crash of a Linux KVM host is achievable by a local low-privileged user via the /dev/sev ioctl interface on systems running AMD SEV-SNP firmware. When SNP_COMMIT is issued after a prior failed SEV initialization, the crypto/ccp driver incorrectly proceeds with SNP initialization, zeroing out MSR_VM_HSAVE_PA - the model-specific register holding the AMD SVM host save-area pointer. Any subsequent VMRUN instruction by KVM for an already-running VM will generate a General Protection Fault, crashing the host and terminating all guest workloads. No public exploit has been identified at time of analysis; patch commits are available across multiple stable branches.
Uncontrolled SNP initialization in the Linux kernel's CCP/SEV driver allows a local low-privileged user with /dev/sev access to crash the host kernel on AMD SEV/SNP-capable systems running KVM. Sending a SNP_VLEK_LOAD ioctl when SNP has not been initialized triggers an unnecessary initialization/shutdown wrapper that zeros MSR_VM_HSAVE_PA globally; the subsequent VMRUN instruction for any active KVM guest then triggers a General Protection Fault, bringing down the host and terminating all co-hosted VMs. No public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects the specialized attack environment required.
Host crash vulnerability in the Linux kernel's AMD SEV/SNP subsystem allows a local low-privileged user to take down a virtualization host by triggering SNP re-initialization via the `/dev/sev` `SNP_CONFIG` ioctl when SNP has previously failed to initialize. When re-initialization executes while KVM guests are running, it zeroes `MSR_VM_HSAVE_PA` globally across all CPUs; the next VMRUN instruction on any active guest then raises a General Protection Fault, crashing the host kernel and terminating all hosted VMs. No public exploit identified at time of analysis; EPSS is 0.22% at the 13th percentile, consistent with low opportunistic exploitation probability.
Silent error propagation in the Linux kernel's CTR_DRBG implementation (`drbg_ctr_generate()`) causes the function to return a success code while leaving its output buffer uninitialized when an internal operation fails. Code that relies on the generated random material receives garbage data, which can trigger kernel crashes or hangs depending on how the uninitialized buffer is consumed downstream. No public exploit has been identified; patched stable kernel releases are available across all active longterm-support branches.
Reference count leak in the Linux kernel's SCMI regulator driver can exhaust kernel memory resources, leading to a denial-of-service condition on affected systems. The flaw resides in scmi_regulator_probe(), where of_find_node_by_name() acquires a reference on a device-tree node but the corresponding of_node_put() release call is omitted on the error path when process_scmi_regulator_of_node() fails, permanently leaking the reference. Exploitation requires local access; no public exploit code has been identified and EPSS probability stands at 0.21%, indicating very low likelihood of opportunistic exploitation.
Null pointer dereference in the Linux kernel module decompression path crashes the kernel when a local user loads a compressed module under memory pressure. The flaw exists across multiple stable kernel branches and was introduced at commit b1ae6dc41eaa; patches are now available for all affected stable trees. No active exploitation confirmed (not in CISA KEV), and EPSS at 0.21% (12th percentile) reflects very low exploitation probability, consistent with the local-only, condition-dependent attack surface.
NULL pointer dereference in the Linux kernel's `page_ext` memory iteration API crashes systems during dynamic memory hotplug operations. The `page_ext_iter_next()` function fails to enforce the PFN boundary, advancing the iterator index past `__pgcount` and calling `page_ext_lookup()` on an uninitialized memory section, triggering a kernel panic. With EPSS at 0.21% (11th percentile) and no CISA KEV listing, real-world exploitation is low-probability and operationally constrained to environments actively performing memory hotplug, such as cloud hypervisors or NUMA-heavy servers with memory ballooning.
Infinite loop in the Linux kernel iommufd subsystem's fault read path allows a low-privileged local user to pin a CPU core at 100% utilization while holding a kernel mutex, causing a local denial of service. The flaw exists in iommufd_fault_fops_read(), where a copy_to_user() failure in the inner list traversal loop fails to propagate its error code to the outer while loop, which then re-fetches the same fault group and retries the failing operation indefinitely with fault->mutex held. No public exploit is identified at time of analysis; EPSS indicates a very low 0.21% exploitation probability, and this CVE is not listed in the CISA KEV catalog.
Null pointer dereference in the Linux kernel's KVM arm64 nested virtualization subsystem allows a local low-privileged attacker to crash the host kernel via a race condition in VNCR pseudo-TLB invalidation. The function kvm_invalidate_vncr_va() dereferences the VNCR pseudo-TLB pointer without first verifying allocation or validity, unlike its companion kvm_invalidate_vncr_ipa(). Exploitation results in a kernel panic that disrupts all virtual machines on the affected host; no public exploit has been identified at time of analysis, and EPSS of 0.21% (11th percentile) reflects minimal observed exploitation activity.
Kernel panic in the Linux kernel's fuse-uring subsystem allows a local low-privileged attacker to crash the system by triggering a NULL pointer dereference through crafted io_uring cancellation sequences against a FUSE filesystem. The root cause is that fuse_uring_cancel() moves cancelled entries with no attached requests to the ent_in_userspace list, where ent_list_request_expired() unconditionally dereferences ent->fuse_req, crashing the kernel. No public exploit code exists and EPSS sits at 0.21% (11th percentile), indicating negligible opportunistic exploitation pressure; however, the low privilege requirement and local DoS impact make it relevant for multi-tenant or shared-access Linux environments.
NULL pointer dereference in the Linux kernel's fuse-uring subsystem enables a local low-privilege attacker to crash the kernel, causing a denial of service. The flaw arises from a state management race in the fuse-uring request lifecycle: when a copy into a userspace io_uring ring buffer fails, the entry's request pointer is nullified but the entry remains on the active queue, allowing the expiration scanner to dereference the NULL pointer in a narrow race window. No public exploit has been identified and EPSS stands at 0.21% (11th percentile), indicating low likelihood of opportunistic exploitation.
Resource exhaustion in Apache Thrift Java bindings 0.19.0 through 0.23.x allows remote denial of service via an unbounded read. No authentication or user interaction is required, and no public exploit code is known. Users should upgrade to version 0.24.0 to remediate the issue.
Denial of service via memory exhaustion affects the webtransport-go library versions 0.11.0 and earlier. A remote attacker can send a crafted WebTransport capsule with a large payload to a vulnerable client or server using HTTP/3, causing excessive memory allocation and potential crash. No active exploitation has been reported, and the vulnerability is patched in version 0.11.1.
Denial of service in Cloudreve v4 and v3 allows any authenticated user to crash the entire server instance by uploading a tiny, maliciously crafted PNG/JPG/GIF file. The built-in image processor, enabled by default, decodes images without a pixel dimension cap, causing the Go stdlib to allocate large memory buffers from header‑supplied dimensions, triggering a fatal out‑of‑memory kill. A public proof‑of‑concept exploit is available, and the vendor has released a patch in version 4.17.0.
Denial of service in valibot's flatten() helper can be triggered by attacker-controlled object keys like 'toString' or 'valueOf' when used with record() validation. An unauthenticated remote attacker can submit crafted JSON to an API that validates input via valibot's record() schema and then calls flatten() on the resulting issues, causing a TypeError that crashes the request path instead of returning structured errors. A public proof-of-concept is available, and the vendor has released a patch in version 1.4.2.
JVM crash and potential in-process memory exposure in lz4-java 1.11.0 and earlier due to insufficient
NULL pointer dereference in the Linux kernel's `copy_process()` function allows a local low-privileged user to crash the host kernel via a denial-of-service condition. During `fork()`, the child process inherits the `PF_BLOCK_TS` process flag from the parent while the child's `blk_plug` pointer is simultaneously reset to NULL, breaking the invariant that `PF_BLOCK_TS` set implies `current->plug != NULL`. Any downstream block I/O subsystem code path that dereferences `current->plug` without a NULL guard in the child will trigger a kernel panic. No public exploit is identified at time of analysis, and EPSS at 0.16% (5th percentile) reflects minimal observed exploitation interest.
Stack buffer address truncation in the MIPS DEC 64-bit Linux kernel platform layer causes kernel panics when the initial console handler is invoked from a non-initial kernel thread. The buffer resides on a stack allocated in the XKPHYS 64-bit memory segment, whose address is silently truncated by legacy 32-bit DEC firmware, producing an invalid pointer dereference and a fatal kernel exception. No public exploit identified at time of analysis and no active exploitation is confirmed; patches are available across multiple stable kernel branches including 5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3, and 7.2-rc1.
NULL pointer dereference in the Linux kernel's pch_uart serial driver allows a local low-privileged user to crash the kernel by triggering a failed DMA memory allocation in dma_handle_rx(). Systems running Intel PCH (Platform Controller Hub) hardware with the pch_uart driver active and DMA enabled are vulnerable to denial of service via kernel panic. No public exploit or CISA KEV listing exists; with an EPSS of 0.17% (6th percentile), real-world exploitation risk is low, but patches are confirmed across multiple stable kernel branches.
Kernel panic via NULL pointer dereference in the Linux tps65219 PMIC regulator driver crashes affected systems when a hardware IRQ fires on the device, producing a local denial-of-service condition. The regression was introduced by commit 64a6b577490c, which removed the helper function `tps65219_get_rdev_by_name()` and inadvertently eliminated the only code path that assigned `irq_data.rdev`, leaving the pointer uninitialized for every registered IRQ. Systems running Linux kernel versions from that commit through the stable-branch fix points (6.18.34 and 7.0.11) on hardware equipped with the TI tps65219 PMIC are affected; no public exploit has been identified and the EPSS score of 0.17% reflects low exploitation probability.
Broadcast TLB flush in the Linux kernel x86 memory management subsystem triggers a General Protection Fault (#GP) on AMD INVLPGB-capable systems booted with the 'nopcid' parameter, causing a kernel panic and local denial of service. When PCID is disabled via 'nopcid', CR4.PCIDE is not set, but the INVLPGB broadcast TLB invalidation path remains enabled; once a memory descriptor becomes active across more than three CPUs, the kernel assigns it a global ASID and issues INVLPGB with a non-zero PCID - an illegal state that crashes the kernel. No public exploit exists, EPSS is 0.17% (6th percentile), and this is not in CISA KEV; real-world impact is constrained to the uncommon 'nopcid' boot configuration on AMD hardware.
NULL pointer dereference in the Linux kernel ethtool PHY subsystem allows a local low-privileged user to trigger a kernel panic (denial of service) by unbinding a PHY driver via sysfs while the device remains registered in the ethtool link topology. Affected kernel versions span the 6.16, 6.18.x, 7.0.x, and 7.1 stable branches; upstream fixes are available in commits targeting 6.18.34 and 7.0.11. No public exploit code exists and no active exploitation has been identified at time of analysis, consistent with EPSS at 0.17% (6th percentile).
NULL pointer dereference in the Linux kernel ACPI platform driver subsystem crashes the kernel when 13 core ACPI drivers are force-matched to devices lacking an ACPI companion object. The root cause is the absence of ACPI_COMPANION() or ACPI_HANDLE() null-checks in affected drivers, combined with the kernel's device_match_driver_override() mechanism which can bypass normal device-ID matching. Impact is limited to local denial of service (kernel panic); no active exploitation is confirmed (not in CISA KEV) and EPSS sits at 0.17% (6th percentile), placing this firmly in the maintenance-fix rather than urgent-remediation category.
NULL pointer dereference in the Linux kernel's Qualcomm Adreno GPU driver (drm/msm/a6xx) crashes the kernel when `a8xx_hfi_send_perf_table()` proceeds to dereference a kzalloc() return value without first validating it against NULL. Systems running affected kernel versions with Qualcomm Adreno 6xx or 8xx GPU hardware - primarily Snapdragon-based ARM devices, smartphones, and servers - can be crashed by a local low-privileged user who triggers the GPU HFI performance table code path under memory pressure. EPSS of 0.16% (5th percentile) and no CISA KEV listing confirm no known active exploitation; patches are available in stable kernel releases 7.0.11 and 7.1.
Kernel panic in the Linux kernel's PowerPC-specific arch_irq_work_raise() function crashes affected systems when machine check exception handlers invoke the function from real mode, a context where virtual memory translation is disabled and preempt_count access via a virtual address faults with a bad area data access error. PowerPC deployments running kernel versions prior to 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1 are affected; x86, ARM, and other non-PowerPC architectures are completely unaffected. No public exploit code exists and EPSS is 0.17% (7th percentile), consistent with a hardware-architecture-specific reliability defect rather than an attacker-driven threat; the vulnerability does not appear in the CISA KEV catalog.
NULL pointer dereference in the Linux kernel's iwlwifi MLD (Multi-Link Device) Wi-Fi driver allows a local low-privileged user to crash the kernel, resulting in a denial-of-service condition. The flaw resides in `iwl_mld_remove_link`, where the `link->fw_id` field is read before the `link` pointer is validated for NULL, enabling a kernel panic on affected systems with Intel wireless hardware. No public exploit code exists and the vulnerability is not listed in CISA KEV; patches are available in stable kernel releases 6.18.34, 7.0.11, and 7.1.
Persistent denial of service in Loytec LIP-ME201C and related building automation controllers through version 8.4.16 allows unauthenticated remote attackers to cause CPU exhaustion via a crafted SNMP GETNEXT request with a large OID component. This vulnerability, tracked as CVE-2026-55731 and assigned CVSS 4.0 base score 6.6, has an EPSS exploitation probability of 0.32% and is not known to be actively exploited at analysis time.
Denial of service in Zephyr RTOS versions before 4.5.0 occurs when mounting a crafted ext2 filesystem with zero values in superblock fields s_blocks_per_group or s_inodes_per_group. An attacker with physical access via removable media can trigger a division-by-zero fault on ARM Cortex-M targets, causing a system crash. No other impact beyond availability; no active exploitation or public exploit is known.
Directory traversal in the Nexter Blocks WordPress plugin (all versions through 5.0.0) allows authenticated attackers holding only subscriber-level accounts to delete arbitrary JavaScript and CSS files on the server by manipulating the unsanitized 'plus_name' parameter. Successful exploitation can destroy plugin and theme asset files, causing denial of service or permanent visual breakage of affected WordPress sites. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low authentication bar (subscriber-level) meaningfully elevates real-world risk for multi-tenant or open-registration WordPress deployments.
Red Hat Certificate System (RHCS) 9 is susceptible to a resource exhaustion denial-of-service condition triggered by unauthenticated remote attackers flooding its TLS-exposed HTTP endpoint. Repeated requests cause the underlying Java process to exhaust available heap memory, resulting in an Out of Memory crash that takes the certificate authority service offline. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this a realistic threat to any internet- or intranet-exposed RHCS deployment.
Unthrottled resource allocation in BizimHesap Online Pre-Accounting Software allows authenticated low-privileged network attackers to exhaust system resources, causing a denial of service condition. All versions through 17072026 are confirmed affected. Reported by Turkey's National Cyber Incident Response Center (USOM), no public exploit code or active exploitation has been identified at time of analysis. The vulnerability carries a CVSS 4.3 score, reflecting a low-availability-impact DoS limited to authenticated users.
Format string vulnerability in GNU nano's multi-buffer error message handling allows a local low-privileged attacker to cause stack information disclosure, denial of service via crash, or potentially achieve arbitrary memory writes. The flaw (CWE-134) is triggered when a user opens multiple files at startup, one of which carries a specially crafted name containing printf format specifiers and another triggers an ALERT-level error - causing nano to misinterpret the filename as a format string. Reported by Red Hat and scoped to RHEL 6 through 10 and OpenShift Container Platform 4, no public exploit or CISA KEV listing exists at time of analysis.
Grafana OSS exposes an unauthenticated or low-privilege denial-of-service path through its alertmanager templates test endpoint, which executes Go templates with no memory limits. Mass-execution of requests to `/api/alertmanager/grafana/config/api/v1/templates/test` in a short window exhausts heap memory, crashing the Grafana process entirely. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the anonymous-access exploitation path and low privilege bar make this a realistic availability risk for internet-exposed Grafana instances.
Incorrect NSEC owner computation in the mod-onlinesign module of Knot DNS can cause overly broad authenticated denial intervals, allowing downstream validating resolvers that use aggressive negative caching to synthesize negative answers for legitimate names, resulting in resolver-side denial of service. This issue affects versions before 3.4.10 and 3.5.x before 3.5.4, and is exploitable by a low-privileged authenticated user. No active exploitation or public proof-of-concept code is currently known.
Unbounded Server Action payload processing in Next.js App Router exhausts server memory when the affected Server Action uses the Edge runtime, enabling remote denial of service without authentication. Any Next.js application on npm/next versions 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 that exposes at least one Server Action on the Edge runtime is vulnerable. An attacker can send arbitrarily large HTTP request bodies to trigger runaway memory allocation, potentially crashing the process or degrading service for all users. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
Resource exhaustion in Dompdf v3.1.5 allows remote attackers to crash the PHP process by submitting a crafted HTML document containing a high-entropy PNG image encoded in Base64 at dimensions of 30,000x30,000 pixels. The attack bypasses Dompdf's dimension validation by exploiting the gap between the early-stage dimension check and the unbounded memory allocation during the rendering phase, forcing ~1.2 GB of uncompressed bitmap allocation that triggers a PHP Fatal Error or OS-level OOM kill. Publicly available exploit code exists (full PoC published in the GHSA advisory); no confirmed active exploitation in CISA KEV at time of analysis.
Uncontrolled resource consumption in dompdf's BMP image processing pipeline allows any unauthenticated attacker who can submit HTML to a dompdf-powered endpoint to exhaust server memory and stall PHP-FPM worker pools with a 169-byte HTTP request. The library trusts attacker-controlled BMP header dimensions without bounding width × height, causing PHP's GD extension to allocate a full native pixel canvas - bypassing PHP's memory_limit entirely because GD allocates through its own native allocator. A publicly available, verified proof-of-concept demonstrates ~12× memory amplification (34 MB control vs ~412 MB attack peak RSS) from identically-sized requests, making this a high-impact, low-effort denial-of-service primitive. No active exploitation confirmed in CISA KEV at time of analysis.
Resource exhaustion in Netty's HttpContentEncoder allows unauthenticated remote attackers to crash JVM-based servers via HTTP/1.1 pipelining. The per-channel acceptEncodingQueue accumulates attacker-controlled Accept-Encoding header values on the I/O thread without any bound, and is only drained when the application emits a non-1xx response - meaning a client pipelining requests faster than the server responds can inflate heap usage without limit. Vendor-released patches are available in 4.1.136.Final and 4.2.16.Final; no public exploit or CISA KEV listing is present at time of analysis.
Excessive CPU consumption in MongoDB Server's awaitable hello command exhaust mode allows unauthenticated remote clients to degrade server availability without any credentials. A specific parameter combination triggers a server-side response loop that bypasses normal throttling mechanisms, meaning even a small number of malicious connections can measurably impair database availability. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.9 with VA:L reflects a real but bounded availability impact.
MongoDB's mongod daemon can be crashed by any authenticated user holding only read-only privileges, dropping database service for every connected client until an operator restarts the process. The root cause is CWE-617 (Reachable Assertion) inside the aggregation framework's engine selection logic - a state the codebase assumed unreachable that a crafted combination of aggregation options can actually trigger. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the PR:L attack vector makes this a reliable insider-threat and post-compromise availability weapon against any network-reachable MongoDB deployment.
MongoDB Server terminates abnormally during outbound TLS handshake when a remote peer delivers a malformed OCSP response, producing a denial-of-service condition against the database process itself. OCSP stapling validation is enabled by default for all outgoing TLS connections, meaning no operator misconfiguration is required to expose this attack surface - any MongoDB server initiating TLS connections is potentially reachable. No public exploit code exists and no CISA KEV listing is present at time of analysis, but the default-enabled feature combined with the adjacent-network attack vector makes this a credible operational risk for MongoDB clusters traversing partially trusted or shared network segments.
Elgg's ImageService processes avatar uploads without validating source image dimensions prior to resizing, allowing authenticated users to trigger out-of-memory (OOM) conditions on the hosting server. All Elgg releases before 7.0.0 are affected; the fix introduced in 7.0.0 enforces hard limits on image height, width, and total resolution before any GD library resize operation is invoked. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the technique is conceptually trivial for any authenticated user with avatar upload access.
Missing authorization in Caliptra Core Runtime Firmware 2.1.0 exposes three mailbox command handlers - INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, and EXTERNAL_MAILBOX_CMD - to abuse by a privileged local attacker operating in subsystem mode. By supplying mailbox commands containing unverified AXI bus addresses, an attacker can crash the Caliptra Root of Trust firmware, causing a denial of service against the hardware security enclave. The vendor notes that security impact beyond availability is integration-specific, meaning depending on how the SoC integrates Caliptra, subsequent-system integrity (SI:L per CVSS 4.0) may also be affected. No public exploit is identified at time of analysis.
Unauthenticated denial-of-service in Progress Telerik UI for ASP.NET AJAX (all versions prior to 2026.2.708) is possible because the internal LayoutBuilder control parses client-submitted XML without disabling DTD processing, exposing recursive XML entity expansion (CWE-776, 'Billion Laughs'). Any network-reachable attacker can send a crafted HTTP request containing a self-referencing DTD payload to cause exponential memory and CPU exhaustion on the server-side process. No public exploit code or CISA KEV entry has been identified at time of analysis, but the low attack complexity and absence of authentication make this a straightforward DoS primitive once the target endpoint is located.
Remote unauthenticated termination of Unbound 1.22.0 through 1.25.1 is possible via a crafted DNS-over-QUIC (DoQ) connection that exploits a signed-to-unsigned integer conversion error when Unbound mishandles the NGTCP2_ERR_STREAM_DATA_BLOCKED error condition. The flaw propagates an implicit conversion of the C literal `-1` to a 64-bit unsigned integer (0xFFFFFFFFFFFFFFFF), which exceeds the 62-bit QUIC varint ceiling and triggers a libngtcp2 assertion that aborts the entire resolver process. Exploitation is deterministic - a single QUIC connection with one crafted transport parameter and one DNS query is sufficient - though the attack surface is constrained to deployments compiled with assertions enabled and DoQ actively configured. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Denial of service in NLnet Labs Unbound 1.10.0 through 1.25.1 allows a remote attacker controlling any delegated DNS zone to crash the resolver daemon via a NULL pointer dereference. The vulnerable path is activated only when both the serve-expired feature and a response-ip or RPZ CNAME redirect rule are configured simultaneously; the serve-expired-client-timeout callback's two-pass CNAME alias loop resets alias_rrset on the second pass without resetting partial_rep, causing an eventual null dereference and process crash. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the network-accessible attack surface makes it a meaningful availability risk for any resolver running these co-configured features.
Use-after-free in NLnet Labs Unbound 1.15.0 through 1.25.1 crashes the DNS daemon via a dangling pointer to a freed TLS server name string in the DNS-over-TLS forwarding path. A remote attacker with knowledge of the target resolver's configuration can trigger the crash by sustaining query pressure against the configured DoT zone while inducing a transient upstream connection failure, causing denial of service. No public exploit code exists and this vulnerability has not been confirmed as actively exploited, but the network-accessible attack surface (PR:N) makes it relevant to operators running internet-facing recursive resolvers with DoT forwarding.
Denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 causes server termination when DNS-over-QUIC (DoQ) is enabled and the resolver operates under high concurrency. Unbound incorrectly passes realtime clock values to libngtcp2 where monotonic timestamps are required; under load, the resulting assertion failure in libngtcp2 abruptly kills the Unbound process. No public exploit code exists and no active exploitation has been reported, but the self-termination of a DNS resolver constitutes a severe availability impact for any infrastructure depending on it.
Heap buffer overflow in Red Hat Directory Server (389-ds-base) exposes LDAP services to remote unauthenticated denial of service or potential arbitrary memory write via malformed DN input. When a Distinguished Name containing a legacy-quoted value is processed, the server fails to close the associated heap allocation, permitting a subsequent operation to reference the same memory pointer - a classic heap confusion primitive. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, though the network-accessible unauthenticated attack surface warrants prompt patching for any externally reachable Directory Server deployment.
Denial-of-service via ReDoS in Open Mercato affects all versions prior to 0.6.4, allowing an authenticated administrator who can create custom-field regex rules to introduce catastrophic backtracking patterns that block the Node.js event loop when a crafted input string is submitted. The vulnerability affects the custom-field validation pipeline across server-side (packages/core, packages/shared) and client-side (packages/ui CrudForm) components, with confirmed exposure at the PUT /api/customers/companies endpoint. No active exploitation is recorded in CISA KEV, but a proof-of-concept was submitted as part of the CERT-PL disclosure and is referenced in the public patch PR.