Information Disclosure
Monthly
Kernel memory exhaustion in the Linux net/smc subsystem enables remote denial-of-service against servers using SMC listen sockets. A TOCTOU race between smc_listen_out() and listener socket close allows an unauthenticated remote attacker to enqueue child socket objects onto a dead listener - each leaking a smc_sock, clcsock, and unreleased reference - by flooding TCP connections during the server's close() window. Patches are confirmed available across multiple stable kernel branches (5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2+); no public exploit code or CISA KEV listing has been identified at time of analysis.
Thunderbolt networking driver (tbnet) in the Linux kernel crashes the XDomain control channel due to an incorrect teardown ordering introduced since the driver was added in Linux 4.15, requiring a physical power cycle of the Thunderbolt controller to recover. Systems running Linux 4.15 through the pre-patch stable branches with active Thunderbolt peer-to-peer networking links (XDomain) are affected when a privileged user or process tears down the network interface. No public exploit exists and EPSS is 0.21% (12th percentile), consistent with a niche-deployment, privilege-required availability issue rather than opportunistic network attack; the NVD CVSS 8.8 with C:H/I:H appears overstated relative to the actual described impact.
Use-after-free in the Linux kernel's s390/ism driver allows a local attacker on IBM Z (s390) hardware to access freed kernel data structures during device teardown, potentially achieving privilege escalation or kernel memory corruption. The race condition arises because ISM interrupt handlers can remain active concurrently with ism_dev_exit(), reading the already-freed sba and ieq structures before free_irq() drains them. No public exploit code or CISA KEV listing exists at time of analysis; EPSS sits at 0.21% (11th percentile), consistent with its narrow hardware prerequisite.
Use-after-free in the Linux kernel's SCTP (Stream Control Transmission Protocol) subsystem allows a remote peer to trigger a dangling transport-pointer dereference on the control chunk queue. The flaw arises because sctp_make_heartbeat_ack() caches a destination transport in chunk->transport without holding a reference; when src_out_of_asoc_ok keeps a HEARTBEAT ACK queued and the peer transport is later torn down, the queued chunk retains a stale pointer that is dereferenced on eventual transmission. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is low at 0.22% (13th percentile). A vendor patch is available in multiple stable trees.
Use-after-free race condition in the Linux kernel at91sam9_wdt watchdog driver allows a local attacker with low privileges on affected AT91 SAM9 SoC hardware to corrupt freed memory, potentially achieving kernel-level code execution. The flaw arises because at91_ping() rearms a kernel timer from within its own callback, while timer_delete() neither waits for an in-flight callback to finish nor prevents rearming - leaving a window during probe failure or driver removal where the timer accesses devm-allocated memory that has already been freed. No public exploit has been identified at time of analysis, and EPSS probability is very low (0.21%, 11th percentile), consistent with the hardware-specific and timing-dependent nature of this race.
Memory exhaustion in the Linux kernel's ax88179_178a USB Ethernet driver allows socket buffers to leak on every failed TX linearization attempt under memory pressure. Systems with ASIX AX88179 or AX88178A USB-to-Ethernet adapters loaded with scatter-gather (NETIF_F_SG) enabled are affected: when skb_linearize() fails inside ax88179_tx_fixup(), the function returns NULL without freeing the original skb, and the caller usbnet_start_xmit() never releases it because its local skb pointer is now NULL. No public exploit has been identified and EPSS probability is negligible (0.21%, 12th percentile); the practical risk is gradual kernel memory exhaustion on systems continuously operating under low-memory, high-TX-load conditions with the specific USB hardware connected.
Race condition in the Linux kernel virtual terminal subsystem exposes a use-after-free condition when kbd_keycode() reads vc->port.tty without holding a reference, while con_shutdown() concurrently clears that pointer under a separate lock. Affected versions span every maintained stable series from 5.10 through 7.x; patches are available across all branches. No public exploit code exists and EPSS is very low at 0.22% (13th percentile), but the CVSS 7.8 local score reflects real kernel memory corruption potential that could enable privilege escalation.
Incorrect TLB flush address targeting in the Linux kernel's zap_pte_range memory management function exposes systems running kernel versions prior to 7.1.9 and 7.2 to local privilege escalation and information disclosure, particularly on AMD systems with EFER.TCE enabled and Intel systems using INVPCID. A low-privileged local attacker can exploit a race where the kernel flushes the wrong virtual address after freeing a page table, leaving stale CPU paging-structure-cache entries that can be speculatively accessed or cause the freed table to be reused with potentially attacker-controlled data. No public exploit code or active exploitation (CISA KEV) has been confirmed at time of analysis, and the 0.20% EPSS score reflects the complexity of reliable exploitation.
Out-of-bounds write in the Linux kernel IPVS estimator subsystem allows a low-privileged local attacker to corrupt kernel memory through a race condition between network namespace teardown and IPVS kthread initialization. When ipvs->enable is cleared while kthread 0 is mid-way through its calculation phase, ip_vs_enqueue_estimator() writes past the ticks and tick_len arrays using zero-initialized limits, producing high-impact memory corruption on affected kernels from the 6.6.x through 7.1.x stable series. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) reflects very low near-term exploitation probability despite the high CVSS 3.1 base score of 7.8.
Race condition in the Linux kernel's AF_PACKET TX_RING send path allows a low-privileged local user to trigger kernel heap memory corruption by racing a concurrent netdevice reconfiguration. The tpacket_snd() function reads dev->hard_header_len independently at two points - for SKB headroom allocation and for header construction in tpacket_fill_skb() - so a device reconfiguration between those two reads can cause the reserved headroom to be smaller than what is later pushed, or make copylen minus hard_header_len negative. With a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and patches available across multiple stable kernel branches, this is a patching priority for multi-tenant Linux environments; no public exploit or CISA KEV listing has been identified at time of analysis.
Race condition in the Linux kernel AF_PACKET socket subsystem allows a local low-privileged attacker to dereference stale or NULL ring storage, resulting in kernel memory corruption with full confidentiality, integrity, and availability impact. The flaw arises because packet_set_ring() previously published the tpacket receive mode outside the sk_receive_queue.lock section used for ring state updates, enabling packet_poll() and packet_recvmsg() to run pressure-clearing paths against already-freed ring structures. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS places current exploitation probability at 0.21%.
Kernel memory disclosure in the Linux kernel's generic XDP receive path allows leaking of adjacent kernel memory - including skb_shared_info contents and a raw kernel pointer from skb_shinfo(skb)->frags[0] - into userspace when an attached XDP program shrinks a packet's fragment area. The flaw stems from bpf_prog_run_generic_xdp() updating skb->data_len without adjusting skb->len, leaving skb_headlen() larger than the real linear area so datagram copies read past the linear tail. No public exploit is identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the issue is not CISA KEV-listed, so risk is confined to systems running generic XDP programs that adjust fragments.
Stack exhaustion in Linux kernel net/sched allows a local low-privileged attacker with CAP_NET_ADMIN to crash or potentially compromise the kernel by constructing an excessively deep qdisc hierarchy. The create-and-graft code path lacked depth enforcement, permitting hierarchies that trigger unbounded recursion in qdisc tree walkers, overflowing the kernel stack. No public exploit code exists and EPSS is 0.21% (12th percentile), but the CVSS 7.8 High rating and C:H/I:H/A:H impact vector indicate vendor assessment of a privilege escalation potential beyond simple denial-of-service. Patch-confirmed fixes are available across multiple stable kernel branches.
Kernel memory corruption in the Linux inet fragment (inet_frag) subsystem arises from a race in inet_frag_create(), which arms the fragment-queue timer before publishing the queue into the fqdir rhashtable. When a network namespace has a fragment timeout of zero or negative, the timer can fire on an unpublished queue, mark it complete, and drop an anticipated hash reference that is never restored, leaving a stale hash node and a use-after-free-style reference imbalance. No public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.21%, 11th percentile), and exploitation depends on a non-default namespace configuration rather than default deployments.
Use-after-free in the Linux kernel's mac802154 (IEEE 802.15.4) subsystem allows a local low-privileged attacker to dereference freed netdev memory, potentially achieving kernel memory corruption and privilege escalation. The race window opens when mac802154_beacon_worker() drops the RCU read lock while still holding references to sdata and wpan_dev, and a concurrent interface teardown via mac802154_stop_beacons_locked() frees those structures before the worker completes. EPSS is very low at 0.21% (11th percentile) and no active exploitation or public exploit code has been identified at time of analysis; practical exploitation is limited by mac802154 hardware availability and the race condition timing requirement.
Use-after-free in the Linux kernel netfilter ebt_nflog subsystem allows a local attacker with low privileges to trigger kernel memory corruption by racing ebtables NFLOG rule execution against nfnetlink_log module teardown. Affected kernels from version 4.12 through multiple stable branches (pre-patch) fail to acquire a module reference on the nfnetlink_log backend before invoking nfulnl_log_packet(), unlike the xt_NFLOG and nft_log frontends. KASAN-confirmed heap use-after-free at instance_lookup_get_rcu can result in full kernel compromise (C:H/I:H/A:H). No public exploit identified at time of analysis; EPSS at 0.22% (13th percentile) reflects low near-term exploitation probability.
Use-after-free race condition in the Linux kernel's IPv4 routing subsystem allows a local low-privileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw is in fib_nhc_update_mtu(), which traverses the PMTU nexthop exception (FNHE) table without proper serialization against concurrent FNHE eviction, creating a window where freed memory is accessed after a completed RCU grace period. No public exploit code has been identified at time of analysis, and an EPSS of 0.22% (13th percentile) reflects very low near-term exploitation probability despite the 7.8 CVSS score.
TX DMA buffer mismanagement in the Linux kernel's Qualcomm GENI serial driver (qcom-geni) allows a local low-privileged user to hang the system indefinitely and potentially corrupt kernel memory on affected Qualcomm hardware. The driver's DMA-mode uart_ops lacks a flush_buffer callback, enabling in-flight DMA transfers to underflow the transmit kfifo and re-submit page-sized transfers indefinitely; a concurrent flaw in the stop path unmaps the DMA buffer while the serial engine is still reading it. No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile), but the user-triggerable hang and DMA use-after-unmap represent a real availability and potential integrity risk on affected Qualcomm platforms.
Use-after-free race condition in the Linux kernel's amba-pl011 serial driver allows a local unprivileged user on ARM-based hardware to corrupt kernel memory, potentially escalating to full system compromise. The RS485 hrtimers embedded in the devm-managed port structure can fire after the port is freed, and the IRQ handler can arm a timer immediately before teardown, creating the race window. No public exploit exists and EPSS is 0.21% (11th percentile), but kernel-level use-after-free primitives are well-understood exploitation targets and patched stable releases are available.
Race condition in the Linux kernel fastrpc driver allows a local low-privileged attacker on Qualcomm DSP-equipped systems to trigger a use-after-free condition by issuing concurrent munmap ioctls, potentially achieving kernel memory corruption and privilege escalation. The flaw exists in `fastrpc_req_munmap_impl()` where the internal buffer list is updated only after the DSP unmap completes, leaving a window in which a concurrent thread can operate on an already-unmapped entry. No public exploit or CISA KEV listing exists at time of analysis, and EPSS remains low at 0.21%, indicating limited observed exploitation activity.
Unprotected list manipulation in the Linux kernel FastRPC subsystem allows a local low-privileged attacker on Qualcomm-based systems to race a signal-interrupted DSP invoke operation against concurrent mmap/munmap operations. The missing `fl->lock` acquisition in `fastrpc_internal_invoke()` during the interrupt path creates a concurrent modification hazard on `fl->mmaps`, potentially yielding kernel memory corruption with full confidentiality, integrity, and availability impact. No public exploit has been identified and EPSS is 0.21% (11th percentile); this CVE is not listed in the CISA KEV catalog.
Unbounded kernel memory access in the Linux kernel's ALSA usx2y driver allows a local user with access to a Tascam US-X2Y USB audio device's hwdep node to read from and write to arbitrary kernel memory pages via a crafted mmap() call with an out-of-bounds page offset. The snd_usb_usx2y module has carried this flaw since Linux 2.6.12; no Linux capability check (CAP_SYS_ADMIN, etc.) is required - only DAC permission to the hwdep character node after completing a mandatory FPGA image upload sequence. The exploit primitive is sufficient for local privilege escalation, but real-world risk is tightly bounded by the requirement for a physically attached Tascam US-X2Y device; no public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.21% (12th percentile) reflects this narrow hardware prerequisite accurately.
Use-after-free in the Linux kernel perf/core subsystem allows a local low-privileged user to dereference freed kernel memory by racing CPU hot-unplug against perf event group management. When a sibling event is detached via DETACH_GROUP during CPU hotplug, its group_leader pointer is not reset; if the leader is subsequently freed while the sibling's file descriptor remains open, a PERF_IOC_FLAG_GROUP ioctl on the sibling follows the stale pointer into freed memory, potentially enabling kernel crash or privilege escalation to root. No public exploit has been identified at time of analysis and EPSS is low at 0.21% (11th percentile), but the local exploit path with full C:H/I:H/A:H impact warrants prompt patching, particularly on systems permitting unprivileged perf_event_open access.
Use-after-free in the Linux kernel's ring-buffer tracing subsystem exposes non-consuming reader iterators to dangling memory when subbuffer order changes occur while resizing is disabled. The vulnerable function ring_buffer_subbuf_order_set() frees buffer pages without checking the resize_disabled flag, leaving rb_advance_iter() holding stale references to freed memory. Exploitation requires local low-privilege access; no public exploit or CISA KEV listing exists, but vendor patches are available across multiple stable kernel branches.
Race condition in the Linux kernel's mm/huge_memory subsystem allows local low-privilege users to trigger misidentification of the huge zero folio as an ordinary Transparent Huge Page (THP), potentially leading to memory corruption, incorrect folio splitting, and privilege escalation. Affected kernels spanning multiple stable branches from at least 4.19 onward are vulnerable when !CONFIG_PERSISTENT_HUGE_ZERO_FOLIO is in effect, with patched versions available for 6.12, 6.18, 7.1, and 7.2 stable series. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog; EPSS places exploitation probability at the 11th percentile.
Use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local attacker to trigger kernel memory corruption via a refcount underflow in smc_rx_splice(). The flaw arises because pages are handed to splice_to_pipe() before page and socket references are taken, so entries dropped by smc_rx_spd_release() are released without a matching reference, and multi-page splices pair one sock_hold() with multiple sock_put() calls. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.21% (12th percentile), consistent with limited real-world weaponization at this time.
Use-after-free in the Linux kernel's IPv6 stack allows a local low-privileged user to corrupt kernel memory with full high/integrity/availability impact. The race condition exists in in6_dev_get(), where dev->ip6_ptr is read under RCU and its refcount is then unconditionally incremented - device teardown can zero the pointer and drop the final reference between those two operations, resurrecting a freed inet6_dev object. No public exploit identified at time of analysis, though a proof-of-concept reproducer was confirmed functional on the unpatched v7.2-rc3 kernel by OpenAI Security Research and validated by Trail of Bits.
Use-after-free and double-free memory corruption in the Linux kernel's net/dibs network subsystem allows an adjacent network attacker to trigger kernel memory corruption via a race condition between the dibs device interrupt handler and device teardown. The UAF arises because an active interrupt handler can continue accessing dmb_clientid_arr after dibs_dev_del() releases it; a separate double-free path exists when dibs_dev_add() fails during dibs_lo_dev_probe(). No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile), indicating low exploitation likelihood despite the high CVSS score.
Local privilege-relevant kernel memory corruption in the Linux kernel's net/x25 subsystem arises because X.25 socket timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket. The x25_heartbeat_expiry() handler rearms unconditionally and can reinstall sk->sk_timer after __x25_destroy_socket() passes its cancel point, letting a subsequent expiry dereference the kmalloc-2k socket object already freed by close() - a use-after-free confirmed by KASAN. Exploitation requires the ability to create AF_X25 sockets on a host with X.25 support loaded; no active exploitation and no public exploit code have been identified, and EPSS probability is low (0.21%).
Linux kernel zero-copy networking in zerocopy_fill_skb_from_devmem() permits improper mixing of net_iov (device memory) and page-backed fragments within a single socket buffer (skb), causing type confusion and memory corruption in downstream kernel networking code. Affected are kernels from introducing commit bd61848900bff5 across the 6.18.x and 7.x stable series until the respective patch commits were applied. No public exploit or active exploitation is confirmed at time of analysis (EPSS 0.21%, no CISA KEV listing), but the local CVSS 7.8 score reflects credible kernel-level memory corruption risk for systems where devmem TCP zero-copy is configured and in use.
Reception stall denial-of-service in the Linux kernel's ntb_netdev driver allows remote unauthenticated attackers to progressively exhaust the NTB network interface's RX queue by triggering repeated memory allocation failures during packet reception, ultimately halting all inbound packet delivery while the interface remains administratively up. Systems with NTB-capable PCIe hardware (Non-Transparent Bridge interconnects) running affected kernel versions are at risk; standard Linux deployments without this hardware are entirely unaffected. No public exploit has been identified at time of analysis, and EPSS sits at the 10th percentile, consistent with the specialized hardware prerequisite; upstream stable commits confirming the fix are publicly available.
Memory exhaustion in the Linux kernel's netfilter bridge subsystem allows network-adjacent unauthenticated attackers to cause denial of service by sending non-IP Ethernet frames through a bridge host configured with nftables conntrack zone set rules. The root cause is that nf_ct_bridge_pre() overwrites skb->_nfct with IP_CT_UNTRACKED for non-IPv4/non-IPv6 EtherTypes without releasing the existing conntrack template reference, leaking slab memory indefinitely until the host exhausts kernel memory. No public exploit exists and EPSS is 0.22% (13th percentile), indicating low real-world exploitation likelihood despite the High availability impact rating; risk is further bounded by the requirement for a specific non-default nftables configuration.
Unbounded kernel memory exhaustion in the Linux kernel's traffic control connection tracking action (act_ct) allows unauthenticated remote attackers to leak one sk_buff plus its data buffer per malformed IP packet on systems with a clsact TC chain configured with 'action ct'. The defect in tcf_ct_act() causes error paths from header sanity checks to return TC_ACT_CONSUMED - signaling ownership transfer - while the sk_buff is still owned by the caller and never freed, resulting in progressive kernel memory exhaustion. No public exploit has been identified at time of analysis; EPSS is low at 0.21% (percentile 11%), and the vulnerability is not in CISA KEV.
Improper initialization ordering in the Linux kernel's dibs (Direct Internal Buffer Sharing) subsystem leaves dibs->lock uninitialized during early ISM device probe, so a GID-event interrupt arriving between ism_dev_init()/request_irq() and dibs_dev_add() causes ism_handle_irq() to acquire an uninitialized spinlock. This affects s390 systems using ISM/SMC-D devices and can lead to undefined locking behavior and kernel instability. EPSS is low (0.21%), no public exploit is identified, and the issue is a robustness/race fix rather than a remotely triggerable flaw despite the input's 9.8 rating.
Memory corruption in the Linux kernel's XDP (eXpress Data Path) broadcast-redirect path allows corruption of kernel skb_shared_info metadata when cloned XDP frames are converted back into socket buffers. xdpf_clone() packs broadcast copies into a single page with frame_sz set to PAGE_SIZE, but the existing bounds check fails to account for the shared-info tailroom, so a source frame from a larger allocation can extend into the clone's required shared-info area; build_skb_around() then writes skb_shared_info over live packet bytes. The issue is fixed and carries a vendor CVSS of 9.8, but with a low EPSS of 0.21% (12th percentile) and no public exploit identified at time of analysis, real-world risk is far narrower than the base score implies because a non-default XDP broadcast-redirect configuration is required.
Use-after-free in the Linux kernel VXLAN driver allows a local, low-privileged user to corrupt kernel memory, potentially escalating to full kernel compromise. The flaw exists in vxlan_changelink(), which arms age_timer without checking whether the device is up via netif_running(); when the device is subsequently deleted, free_netdev() releases the vxlan_dev struct - including the embedded timer - while that timer remains queued on a timer_base. Because the rtnl operations are netns-scoped, an unprivileged user can trigger the entire sequence inside a new user and network namespace without elevated system privileges. No public exploit or CISA KEV entry is identified at time of analysis; EPSS of 0.22% (13th percentile) reflects low current exploitation activity, though the local-user-namespace reachability makes this a meaningful local privilege escalation risk on any Linux system permitting user namespace creation.
Use-after-free memory corruption in the Linux kernel vsock/virtio subsystem arises from a race condition between virtqueue worker threads and VM suspend/resume cycles. Worker threads (RX, TX, event) read their virtqueue pointer before acquiring the protective mutex and checking the run flag; a worker delayed across a freeze/restore transition retains a dangling pointer to a freed queue while the restoration installs replacement queues. No public exploit has been identified and EPSS probability is low at 0.21%, though successful exploitation could yield full kernel-level memory corruption with high confidentiality, integrity, and availability impact.
Use-after-free in the Linux kernel vsock/virtio RX worker allows a local low-privileged user to trigger memory corruption during device teardown, potentially achieving privilege escalation or kernel panic. The race condition exists because the RX worker's common exit path continues to refill the virtqueue even after rx_run is cleared and virtqueues have been deleted via virtio_vsock_vqs_del(). KASAN-confirmed slab-use-after-free in virtqueue_add_sgs is the direct manifestation. No public exploit or CISA KEV listing at time of analysis; EPSS of 0.22% (13th percentile) reflects low near-term exploitation probability.
Kernel memory disclosure and crash in the Linux kernel's veth driver arises from broken skb length accounting after an XDP program adjusts packet fragments; veth_xdp_rcv_skb() updates skb->data_len but leaves skb->len holding the stale fragment contribution, so skb_headlen() overstates the linear area. On the UDP receive path this caused __skb_datagram_iter() to copy 1024 bytes past the real linear tail into userspace - leaking skb_shared_info contents including nr_frags, xdp_frags_size, and a kernel pointer from frags[0] - while displacing and truncating real packet data. A related path via bpf_xdp_pull_data() leaves the skb non-linear and trips SKB_LINEAR_ASSERT(), crashing the kernel. There is no public exploit identified at time of analysis, and EPSS risk is low (0.21%).
Improper handling of the receive-side message iterator in the Linux kernel's kernel-TLS (kTLS) subsystem lets a remote TLS peer cause recvmsg() to write decrypted bytes into the wrong offsets of a receiver's user-space iovec buffers. When the optimistic TLS 1.3 zero-copy path maps user pages and then falls back to a kernel skb, the iterator is left advanced, so bytes are written a second time past the length recvmsg() reports. Exploitation requires the receiver to have enabled the TLS_RX_EXPECT_NO_PAD socket option; there is no public exploit identified at time of analysis and EPSS is low (0.21%).
Use-after-free race condition in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem allows a local attacker with low-privilege network administration access to corrupt kernel memory, achieving high impact across confidentiality, integrity, and availability. The flaw exists across multiple stable kernel branches from 5.10 through 7.1.x and is triggered by concurrent execution of TIPC bearer teardown against the link supervision timer or receive path. No public exploit or active exploitation has been confirmed; EPSS stands at 0.22% (13th percentile), and patched versions are available across all affected stable series.
Use-after-free in the Linux kernel CIFS/SMB client (cifs_try_adding_channels()) lets a race between SMB multichannel channel setup and an interface-list refresh free an 'iface' object that is then written to via weight_fulfilled, corrupting freed kernel memory. It affects systems that mount SMB shares with multichannel across many stable branches (6.1.x through 6.18.x and 7.x, fixed in 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2). This is a resolved upstream bug with a vendor patch available; there is no public exploit identified at time of analysis and EPSS is low (0.21%).
Race conditions in the Linux kernel KVM/SVM subsystem allow local attackers with low privileges to corrupt the SEV mirror VM list or trigger incorrect reference counting in the hypervisor. Two distinct concurrency flaws exist: sev_migrate_from() modifies the owner's mirror_vms list without holding the owner lock, enabling list corruption when concurrent COPY or destroy operations race with a migration; and sev_vm_destroy() can read a stale enc_context_owner pointer after it changes via a concurrent KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM ioctl, causing kvm_put_kvm() to be called on the wrong VM struct. No public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.21% (11th percentile) reflects the narrow exploitation conditions required.
Use-after-free in the Linux kernel's eventfs subsystem allows a local low-privileged user to corrupt kernel memory by triggering unsafe iterator advancement after recursive child removal in eventfs_remove_rec(). Affected stable branches span Linux 6.6.18 through pre-6.6.152, 6.7.6 through pre-6.8, and related ranges; patched versions (6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2) are available via upstream kernel.org stable commits. No public exploit has been identified at time of analysis and EPSS is very low at 0.21% (11th percentile), though successful exploitation could yield local privilege escalation to root.
Memory corruption in the Linux kernel's eventfs subsystem allows a local low-privileged user to trigger a use-after-free condition via a race between SRCU inode freeing and concurrent list iteration. The root cause is an unsafe union of ei->list with the RCU head, combined with absent memory barriers around the is_freed flag, permitting a racing reader to dereference a pointer that has been overwritten by the RCU freelist mechanism. No public exploit code exists and the CVE is absent from CISA KEV; EPSS of 0.20% (10th percentile) confirms negligible observed exploitation activity, placing real-world risk well below what the 7.8 CVSS score implies.
Use-after-free in the Linux kernel's thermal/hwmon subsystem exposes local attackers to potential kernel memory corruption across a wide range of stable kernel branches. The flaw was introduced by a cosmetic code-style cleanup commit (030a48b0f6ce) that inadvertently removed a valid guard from the error path of thermal_add_hwmon_sysfs(), allowing a freed object to be referenced when the function fails. Patches are backported across six stable kernel series (5.15, 6.1, 6.6, 6.12, 6.18, 7.1, and 7.2); EPSS is low at 0.21% and no active exploitation has been identified.
Out-of-bounds read in the Linux kernel ptp_ocp driver exposes kernel memory and risks availability on systems equipped with OCP PTP time-synchronization hardware. The ptp: ocp driver reads a fixed 13-byte EEPROM board ID field without enforcing a NUL terminator before passing it to devlink_info_version_fixed_put(), causing the function to scan beyond the field boundary as a C string. An attacker with local, low-privilege access on an affected host could trigger this over-read by querying devlink device info, potentially leaking adjacent kernel memory (C:H) or inducing a kernel fault (A:H). No public exploit exists and EPSS is 0.21% (12th percentile), indicating low real-world exploitation activity; however, patches are available across multiple stable kernel branches.
Out-of-bounds memory read in the Linux kernel's IPv6 stack exposes up to 8 bytes of adjacent kernel memory per crafted Router Advertisement. The flaw in `rt6_route_rcv()` permits a link-local attacker to send a Route Information option with an RFC 4191-invalid prefix_len/length combination, causing `ipv6_addr_prefix()` to read beyond the option boundary and install the overread bytes as a route prefix visible to unprivileged userspace via `ip -6 route show`. No public exploit has been identified at time of analysis and EPSS is 0.22% (13th percentile), though the attack requires no authentication and only link adjacency.
Kernel-memory corruption in the Linux IPv6-in-IPv6 tunnel driver (ip6_tunnel) lets a remote attacker corrupt skb_shared_info by abusing stale socket control-block metadata during ICMPv6 error handling. Affected systems are Linux hosts terminating an ip6ip6 tunnel where an outer ICMPv6 error carrying a Home Address Option is reflected back through icmpv6_send(); a malformed inner destination-options header then drives an out-of-bounds Home Address Option lookup/swap past the quoted packet. Despite the assigned CVSS of 9.8, EPSS is low (0.22%, 13th percentile), there is no public exploit identified at time of analysis, and there is no CISA KEV listing.
Incorrect idmap context in Linux kernel fscrypt allows a low-privileged local user on an idmapped-mount filesystem to bypass ownership checks when setting fscrypt encryption policies via FSCRYPT_IOC_SET_POLICY, and simultaneously causes legitimate directory owners to be wrongly denied access with EACCES. The flaw affects ext4, f2fs, and other fscrypt-capable filesystems mounted with idmapped-mount configurations - a setup common in container runtimes and rootless Kubernetes node deployments from kernel 5.12 onward. No public exploit is identified at time of analysis, and EPSS of 0.14% (3rd percentile) reflects minimal observed exploitation interest.
Use-after-free in the Linux kernel's PSI (Pressure Stall Information) scheduler subsystem exposes local low-privilege users to potential memory corruption and privilege escalation on affected kernel versions. The race condition between psi_schedule_rtpoll_work(), called locklessly from the scheduler hotpath, and psi_trigger_destroy() allows the rtpoll_timer to be re-armed after the cgroup group has been freed, causing poll_timer_fn() to execute on deallocated memory. Vendor-released patches are available across stable branches 6.1.183, 6.6.152, 6.12.104, 7.1.9, 7.2, and 6.18.45; no public exploit has been identified and EPSS is 0.21%.
The IMA (Integrity Measurement Architecture) subsystem in the Linux kernel fails to invalidate action cache flags (IMA_DONE_MASK) when files are truncated, because the file_truncate and path_truncate LSM hooks were not instantiated in IMA's hook logic. Authenticated local users who can truncate a file covered by an active IMA policy can exploit this gap - causing the kernel to skip re-measurement, re-auditing, and re-appraisal on the next file access, effectively bypassing IMA integrity enforcement for that file. No public exploit has been identified, the vulnerability is absent from CISA KEV, and the EPSS score of 0.21% (11th percentile) reflects very low observed exploitation probability despite the assigned CVSS score of 8.1.
Memory corruption in the Linux kernel page cache (mm/filemap) arises when a race condition in __filemap_add_folio() stores a folio at an incorrect, intermediate rounded-down index after a concurrent thread resolves a conflict during the split-a-conflict retry loop. Affecting large-folio-capable kernels (6.15 onward), the flaw manifested in production as rare SIGILLs and SIGSEGVs with executable text landing a page away from its correct location, and tripped a !folio_contains() assertion under CONFIG_DEBUG_VM. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and it is not listed in CISA KEV; the upstream fix restores the original xas.xa_index before each retry.
Use-after-free race condition in the Linux kernel BPF sockmap subsystem allows a local attacker with access to a sockmap-configured TCP socket to corrupt kernel memory, with high impact on confidentiality, integrity, and availability. The flaw exists in tcp_bpf_send_verdict(), where a local pointer copy of psock->sk_redir is made without incrementing the socket reference count before the source socket lock is released, enabling a concurrent sendmsg() thread to free the socket object while the first thread still holds the stale raw pointer. The vulnerability is confirmed by a full KASAN slab-use-after-free trace; no public exploit identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects low current exploitation probability despite the high CVSS base score.
Denial of service (and potential memory corruption) in the Linux kernel SCTP stack arises because __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport, leaving a dangling pointer once the original transport is RCU-freed via an ASCONF Delete-IP peer removal. A subsequent SACK that reneges the TSN clears tsn_gap_acked, and the next SACK dereferences the freed transport in sctp_check_transmitted(), producing a KASAN-confirmed slab-use-after-free. The issue affects hosts actively using SCTP with dynamic address reconfiguration; it carries a published CVSS of 9.8 but low EPSS (0.22%, 13th percentile), and no public exploit has been identified at time of analysis.
Use-after-free and NULL-pointer dereference in the Linux kernel's SCTP stack allow a remote SCTP peer to corrupt kernel memory or crash the host by triggering association-restart handling that leaves the cached ASCONF chunk pointer (addip_last_asconf) dangling. A delayed authenticated ASCONF-ACK then reaches sctp_sf_do_asconf_ack() and operates on freed memory, causing a second release, while clearing the pointer exposes a companion NULL dereference via a racing T4 timer callback. There is no public exploit identified and EPSS is low (0.22%), consistent with a race-condition kernel bug rather than a turnkey remote exploit despite the 9.8 input score.
A remotely triggerable use-after-free in the Linux kernel's SCTP stack (net/sctp) lets an authenticated SCTP peer read freed transport memory in sctp_outq_select_transport(). By sending an ASCONF chunk that both adds a peer transport and then removes it via a wildcard DEL-IP, the newly added transport is freed while asoc->new_transport still points to it; a later HEARTBEAT and address-replacement sequence dereferences the dangling pointer. There is no public exploit identified at time of analysis, EPSS is low (0.22%), and the flaw is not in CISA KEV, though a reliable private reproducer is described.
PHP Object Injection in the WS Form LITE contact form plugin for WordPress (all versions through 1.10.80) lets unauthenticated attackers instantiate arbitrary PHP objects by supplying serialized data in form-submission meta values, which the plugin deserializes without validation. The plugin ships no exploitable POP (property-oriented programming) chain of its own, so on a default install the injection has no direct impact; real damage - arbitrary file deletion, sensitive-data disclosure, or code execution - occurs only when a separate plugin or theme on the same site provides a usable gadget chain. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the headline 9.8 rating overstates practical risk for isolated installs.
Kernel memory disclosure in the Linux bnxt_re RDMA driver (Broadcom NetXtreme RDMA) exposes 4092 bytes of stale kernel data to local users holding InfiniBand device access. The bnxt_re_alloc_ucontext() function allocates the user context shared page with __get_free_page(GFP_KERNEL), which does not zero memory, then maps the page into userspace - leaving all bytes beyond the 4-byte AVID write at offset 0x10 uninitialized and fully readable by the calling process. Exploitation requires only a single mmap() call after IB_USER_VERBS_CMD_GET_CONTEXT, making it trivially scriptable; no public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects low observed exploitation activity.
Symlink escape in NLTK's CorpusReader.open() allows local attackers to read arbitrary files outside the designated corpus root, affecting all versions before 3.9.4. Path boundary validation is performed lexically on the string representation of a path rather than on the resolved filesystem target, so an attacker with write access to the corpus directory can plant a symlink that passes the check yet redirects reads to sensitive files anywhere the host process can access. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.9.4.
Session cookie forgery in Punk before 0.18 (a Perl web framework by LNATION) lets remote unauthenticated attackers mint valid session cookies whenever an application declares a session without a secret. Because the cookie reader and write-back both default the HMAC-SHA256 key to an empty string, cookies are signed and verified with a zero-length key, so anyone who knows the cookie format can offline-forge a session carrying any user identifier or role. No public exploit has been identified at time of analysis, and EPSS is low (0.20%, 10th percentile), but the CVSS base score is 9.1 and exploitation is trivial once the misconfiguration exists.
TLS hostname verification is silently bypassed in Netty's OpenSSL client path, allowing a network man-in-the-middle attacker to intercept encrypted communications by presenting a certificate issued for a different hostname. Affected are applications using io.netty:netty-handler versions 4.2.0.Final through 4.2.16.Final or any 4.1.x through 4.1.136.Final, specifically when the SslProvider.OPENSSL client path is configured with a plain X509TrustManager and running on Java 25 or later, where Unsafe-based trust-manager wrapping is unavailable. No public exploit code has been identified at time of analysis, but the confidentiality impact is high for any affected deployment that transmits sensitive data over TLS.
Unauthorized access to restricted video content in WWBN AVideo (through commit 9c39d8c8) is enabled by a fundamental design flaw in the platform's token subsystem: getToken() produces tokens with no binding to user identity or intended purpose, and the Gallery plugin endpoint (plugin/Gallery/view/sections.php) distributes these tokens freely to unauthenticated visitors. Because the tokens carry no scope constraint, they are accepted as valid authorization across unrelated subsystems including the HLS streaming endpoint (view/hls.php), allowing any remote unauthenticated party to retrieve private video content. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a trivially simple, two-step attack requiring no special tools.
Denial-of-service in Tie::Hash::Regex before 2.0.0 for Perl allows unauthenticated remote attackers to crash any application that performs hash lookups with externally supplied strings. The FETCH, EXISTS, and DELETE methods compiled caller-provided keys as bare regex patterns without an eval guard, causing the Perl process to die on any syntactically invalid pattern such as an unmatched bracket. No public exploit code has been identified, and EPSS sits at just 0.24% (15th percentile), consistent with a niche library with narrow deployment; however, the impact on any affected application is immediate process termination.
Cross-origin RRDP URL confusion in FORT Validator through 1.6.7 allows a delegated Certificate Authority sharing the same Trust Anchor Locator to silently poison the validator's download cache, causing the victim CA's Validated ROA Payloads and signed objects to be purged from FORT's routing origin validation output. The resulting VRP gaps - triggered passively by the victim's own routine publication cycle - can enable BGP route hijacking or loss of network reachability for the affected IP prefixes. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 7.2 with high integrity impact on subsequent routing infrastructure reflects serious operational risk for networks relying on FORT for RPKI-based origin validation.
Access control bypass in Combodo iTop prior to 3.2.3 allows authenticated low-privileged users to read data outside their assigned silos via crafted OQL queries. The iTop silo isolation mechanism - which restricts users to specific data partitions - fails to apply visibility filters to classes joined in OQL but not explicitly listed in the SELECT clause, enabling cross-silo confidential data disclosure. No public exploit code or CISA KEV listing exists at time of analysis; the vendor has released a confirmed fix in version 3.2.3.
Cross-tenant document content corruption in PDFio before 1.6.5 allows low-privileged network attackers to silently overwrite one caller's PDF dictionary string values with another caller's data in multi-threaded or pooled-request environments. The defect is in `pdfioDictSetStringf`, which stored a raw pointer to a stack-local formatted string buffer in the document dictionary rather than heap-allocating a copy, leaving the dictionary referencing reclaimed stack memory after the function returned. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patch v1.6.5 is confirmed available.
Information disclosure in Esri Portal for ArcGIS versions 11.5 through 12.0 allows remote unauthenticated attackers to extract sensitive data reflected in HTTP response bodies via crafted requests. The vulnerability (CWE-200) requires no authentication or user interaction per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, meaning any internet-exposed Portal instance in the affected version range is potentially reachable without credentials. No public exploit or KEV listing exists at time of analysis, and SSVC classifies exploitation as none with partial technical impact, indicating limited observed threat activity despite the high confidentiality impact scored by NVD.
Sensitive information reflection in Esri Portal for ArcGIS versions 11.1 through 12.0 exposes confidential content in HTTP response bodies to remote, unauthenticated attackers under specific, difficult-to-reproduce conditions. The vulnerability stems from improper information exposure (CWE-200), where a crafted request can cause the server to echo sensitive data back in its response. No active exploitation has been confirmed, and EPSS probability is low at 0.33%, though CVSS rates confidentiality impact as high given the potential sensitivity of reflected data.
Remote code execution in Xorbits Inference (Xinference) 2.5.0 and earlier lets a remote attacker run arbitrary OS commands in the server process by abusing an unsafe eval() in the Llama3 tool-call parser. Any request to the OpenAI-compatible /v1/chat/completions endpoint with a tools field triggers evaluation of model-generated Python, so an attacker who steers the model's output via a crafted prompt achieves full server compromise; because authentication is disabled in the default deployment, the vendor advisory rates this exploitable by an unauthenticated remote attacker. This is fixed in 2.7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
DNS rebinding against Microsoft UFO's Linux MCP server (all versions prior to 3.0.8) enables an attacker-controlled web page to bypass localhost binding protections and reach the local /mcp endpoint via the victim's browser. Because the FastMCP streamable HTTP server bound to localhost:8010 performed no Host, Origin, or Sec-Fetch-Site header validation, a browser performing a DNS rebind could enumerate available tool schemas via tools/list and invoke execute_command with a valid UFO_MCP_API_KEY, resulting in arbitrary file reads or OS command execution as the victim's local user. No public exploit code has been identified at time of analysis, though the DNS rebinding technique is well-documented and the commit-confirmed patch validates the described attack path.
NTLM credential exposure in Git for Windows before 2.55.0.windows.4 allows a malicious remote Git server to capture Windows authentication material by advertising a crafted bundle URI during clone or fetch operations. When transfer.bundleuri is enabled, non-HTTP(S) URIs including bare UNC paths are treated as local filesystem paths, causing Windows to initiate an outbound SMB connection to an attacker-controlled host and expose NTLM hashes. No public exploit code has been identified at time of analysis and no CISA KEV listing is present, but the technique maps directly onto well-documented NTLM capture and relay attack patterns.
Unauthenticated access to inline images in Combodo iTop prior to version 3.2.3 is protected by a 24-bit secret generated with PHP's non-cryptographic mt_rand(), yielding only ~16.7 million possible values and making brute-force enumeration feasible for any network-reachable attacker. The commit diff confirms the secret was stored as a 6-character hex string (sprintf('%06x', mt_rand(0, 0xFFFFFF))), and a secondary timing side-channel existed because the comparison used != instead of constant-time hash_equals(). No active exploitation is confirmed in CISA KEV, and no public POC has been identified at time of analysis.
User enumeration in Combodo iTop prior to version 3.2.3 allows remote unauthenticated attackers to identify valid accounts by observing distinct error responses in the forgot-password mechanism. The application returned different messages depending on account state - external authentication, fixed password, missing email - making it possible to distinguish valid usernames from invalid ones without any credentials. No public exploit code has been identified at time of analysis, and the issue is resolved in iTop 3.2.3 per the vendor's GitHub Security Advisory GHSA-888g-gv33-xwwx.
Code injection in the AWS Athena Federated Query Neptune connector (versions 2024.15.1 through 2026.28.1) allows a low-privileged user with query access to Neptune via Athena to reach into and read properties of the AWS Lambda function that provides the connector's compute. Because Lambda environment properties commonly hold configuration and credential material, this exposes the underlying execution context to an authenticated attacker. No public exploit identified at time of analysis; the flaw was reported internally by Amazon (AMZN) and carries a CVSS 4.0 base score of 9.4.
Stack exhaustion denial-of-service in Unleash's OpenAPI validation middleware allows unauthenticated network attackers to terminate the Node.js server process by submitting a roughly 10 KB JSON payload nested thousands of levels deep to any OpenAPI-validated endpoint. Versions prior to 7.5.2, 7.6.5, and 8.0.2 are affected; the shared error-formatting path in src/lib/error/bad-data-error.ts calls JSON.stringify on raw request values without catching the resulting RangeError, which propagates uncaught and kills the process. No public exploit code has been identified at time of analysis, though the attack is trivially reproducible from the advisory description alone, and replaying the request sustains the outage indefinitely.
Credential leakage in Bluewave Labs Checkmate versions 3.3.0 through 3.9.1 exposes HTTP Authorization secrets to unauthenticated remote visitors when the global showURL setting is enabled. The unauthenticated GET /api/v1/status-page/:url endpoint returns complete monitor objects from statusPageController.ts, including the secret field consumed by HttpProvider.ts as a bearer or basic-auth credential against monitored upstream services. Although the frontend component BaseStatusPage.tsx intentionally omits this value from the UI, the raw JSON API response delivers it in full, allowing any visitor to harvest credentials and pivot attacks against monitored infrastructure. No public exploit code has been identified at time of analysis, and the issue is fixed in v3.9.2.
Unprivileged task memory disclosure in FreeRTOS-Kernel before 11.3.1 enables a low-privileged task to read privileged kernel memory by exploiting missing type validation in the xQueueAddToSet() function (CWE-843). Exploitation is constrained to deployments using MPU-enabled ports with the queue sets feature active, but on affected configurations the CVSS 4.0 score of 8.2 reflects high confidentiality impact across both the vulnerable system and subsequent (privileged) system contexts. No public exploit code or CISA KEV listing exists; Amazon (AWS), who reported the issue, has released a fix in version 11.3.1.
Use-after-free in FreeRTOS-Kernel's secure context cleanup handler (versions 10.2.0 through 11.3.0) allows a local low-privileged user to corrupt or crash TrustZone secure-world memory by invoking the SVC handler for secure context deallocation without privilege verification. The missing privilege check permits normal-world code to trigger deallocation of already-freed secure-world memory regions, producing high integrity and availability impact on the secure execution environment - a severe outcome in security-sensitive embedded deployments. No public exploit has been identified at time of analysis; vendor-released patch V11.3.1 is available via Amazon's security bulletin and the FreeRTOS GitHub repository.
Use-after-free in the Linux kernel's route4 (cls_route) traffic classifier fastmap cache allows a local attacker with CAP_NET_ADMIN to read freed kernel heap memory by racing filter deletion against fastmap cache population, potentially escalating to full kernel compromise. Affected versions span Linux 3.18 through current stable branches; the kernel security team backported fixes to eight LTS/stable lines (5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2). No public exploit identified at time of analysis; EPSS of 0.17% (6th percentile) reflects minimal current exploitation activity, though the theoretical impact is severe given the kernel-level UAF primitive.
Kernel-level use-after-free in the Linux IPv6 policy-routing (fib6 rules) subsystem allows a suppressed route to leak a released rt6_info back to rt6_lookup() callers, so a subsequent dst_release() operates on freed memory. The flaw affects systems using IPv6 FIB rules with route suppression and realistically manifests as a kernel crash (denial of service) and potential memory corruption. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile); a vendor patch is available across stable trees.
Out-of-bounds host memory access in the Linux kernel vhost subsystem results from a stale metadata cache that is not invalidated when vring addresses or sizes are reconfigured via VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM while a virtqueue is live. Systems running KVM/QEMU virtualization with vhost and a device IOTLB attached - spanning kernel versions from 4.11 through unpatched stable series - are affected, with the scope change (S:C) in the CVSS vector indicating potential read/write access to host memory beyond the vhost subsystem boundary. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (6th percentile), consistent with a complex kernel-internal flaw not yet commoditized.
Out-of-bounds read and one-byte out-of-bounds write in mod_auth_openidc's state-cookie parser (all versions prior to 2.4.19.4) allow unauthenticated remote attackers to crash Apache worker processes by sending a malformed Cookie header. The root cause is a loop termination condition in src/state.c that checked whether a pointer was NULL — a condition that could never fire since the pointer is only ever incremented — rather than checking for the string terminator, causing state-prefixed cookie tokens lacking '=' to scan and write past the end of the token buffer. No CISA KEV listing or confirmed public exploit exists at time of analysis, but the CVSS AV:N/AC:L/PR:N profile and the fully transparent fix commit make this trivially automatable for denial-of-service once widely known.
Symlink escape in Infinite Image Browsing (zanllp/infinite-image-browsing) allows remote attackers to read arbitrary files from the host filesystem by placing a symbolic link inside a scanned image directory, which satisfies a string-based path containment check that does not resolve symlinks. The flaw is exploitable only in network-exposed Stable Diffusion WebUI deployments where access control is active - those started with share, ngrok, listen, or server_name options, or with IIB_ACCESS_CONTROL=enable. No public exploit or CISA KEV listing has been identified at time of analysis; an upstream fix is available as commit 4057a624 (PR #969), but no specifically tagged patched release has been confirmed.
Cleartext exposure of Wi-Fi credentials in DJI consumer and prosumer drones lets an attacker within Bluetooth range recover the drone's Wi-Fi SSID, PSK, and trusted-client UUID by passively sniffing unencrypted DUML-over-BLE messages exchanged during a normal DJI Fly connection or QuickTransfer handoff. This affects a broad range of current DJI models (Neo, Flip, Air 3/3S, Avata 2/360, Mavic 3 family, Mavic 4 Pro, and Mini 2 through Mini 5 Pro) below specific firmware versions. Recovered credentials grant the attacker access to the drone's internal Wi-Fi network and the ability to decrypt the operator's Wi-Fi traffic; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Sensitive OAuth configuration data is exposed to unauthenticated remote actors in Apache CloudStack's OAuth authentication plugin when the OAuth provider listing endpoint is queried. Affected versions span two release branches: 4.19.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0. Despite a CVSS score of 7.5 reflecting unauthenticated network access and high confidentiality impact, EPSS sits at just 0.17% (7th percentile), and no public exploit code or CISA KEV listing has been identified at time of analysis, suggesting limited active exploitation to date.
Cleartext storage of sensitive information in Apache CloudStack's AsyncJob database records exposes credentials and operation-sensitive data to any party with read access to the underlying database. All CloudStack deployments from version 4.0.0 through 4.22.1.0 are affected across both the 4.x stable and 4.21/4.22 release lines. No public exploit code has been identified and EPSS sits at the 1st percentile, but the NVD-assigned confidentiality impact of HIGH reflects that AsyncJob records may capture sensitive payloads - such as API secrets or passwords - passed through asynchronous operations, stored durably in cleartext rather than encrypted at rest.
Unauthorized LDAP configuration disclosure in Apache CloudStack exposes LDAP server details - including bind credentials and hostnames - to any authenticated user via the listLdapConfigurations API, which is accessible to all default CloudStack roles. Affected versions span 4.2.0.0 through 4.22.1.0, a broad range suggesting long-standing exposure in enterprise and cloud provider deployments. No public exploit code has been identified at time of analysis, but the low barrier of a valid account and the downstream risk of harvested LDAP bind credentials elevate practical severity beyond the EPSS score suggests.
Sensitive information exposure in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration allows unauthenticated remote attackers to access high-confidentiality data across two affected version ranges. The flaw is network-reachable with no authentication or user interaction required (CVSS AV:N/AC:L/PR:N/UI:N), making it a genuine High-severity finding for any CloudStack deployment with OAuth2 or Google OAuth enabled. EPSS sits at 0.17% (7th percentile) and no CISA KEV listing exists, suggesting no public exploitation activity at time of analysis; however, the low attack complexity and zero privilege requirement keep real-world risk elevated for affected configurations.
Improper output encoding in the Apache CloudStack management UI's Instance Reset Password feature allows injection of unescaped output that can expose sensitive data or manipulate the interface. It affects Apache CloudStack 4.15.1.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0, an open-source IaaS cloud orchestration platform. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile); vendor-released patches exist in 4.20.3.1 and 4.22.1.1.
Kernel memory exhaustion in the Linux net/smc subsystem enables remote denial-of-service against servers using SMC listen sockets. A TOCTOU race between smc_listen_out() and listener socket close allows an unauthenticated remote attacker to enqueue child socket objects onto a dead listener - each leaking a smc_sock, clcsock, and unreleased reference - by flooding TCP connections during the server's close() window. Patches are confirmed available across multiple stable kernel branches (5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2+); no public exploit code or CISA KEV listing has been identified at time of analysis.
Thunderbolt networking driver (tbnet) in the Linux kernel crashes the XDomain control channel due to an incorrect teardown ordering introduced since the driver was added in Linux 4.15, requiring a physical power cycle of the Thunderbolt controller to recover. Systems running Linux 4.15 through the pre-patch stable branches with active Thunderbolt peer-to-peer networking links (XDomain) are affected when a privileged user or process tears down the network interface. No public exploit exists and EPSS is 0.21% (12th percentile), consistent with a niche-deployment, privilege-required availability issue rather than opportunistic network attack; the NVD CVSS 8.8 with C:H/I:H appears overstated relative to the actual described impact.
Use-after-free in the Linux kernel's s390/ism driver allows a local attacker on IBM Z (s390) hardware to access freed kernel data structures during device teardown, potentially achieving privilege escalation or kernel memory corruption. The race condition arises because ISM interrupt handlers can remain active concurrently with ism_dev_exit(), reading the already-freed sba and ieq structures before free_irq() drains them. No public exploit code or CISA KEV listing exists at time of analysis; EPSS sits at 0.21% (11th percentile), consistent with its narrow hardware prerequisite.
Use-after-free in the Linux kernel's SCTP (Stream Control Transmission Protocol) subsystem allows a remote peer to trigger a dangling transport-pointer dereference on the control chunk queue. The flaw arises because sctp_make_heartbeat_ack() caches a destination transport in chunk->transport without holding a reference; when src_out_of_asoc_ok keeps a HEARTBEAT ACK queued and the peer transport is later torn down, the queued chunk retains a stale pointer that is dereferenced on eventual transmission. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is low at 0.22% (13th percentile). A vendor patch is available in multiple stable trees.
Use-after-free race condition in the Linux kernel at91sam9_wdt watchdog driver allows a local attacker with low privileges on affected AT91 SAM9 SoC hardware to corrupt freed memory, potentially achieving kernel-level code execution. The flaw arises because at91_ping() rearms a kernel timer from within its own callback, while timer_delete() neither waits for an in-flight callback to finish nor prevents rearming - leaving a window during probe failure or driver removal where the timer accesses devm-allocated memory that has already been freed. No public exploit has been identified at time of analysis, and EPSS probability is very low (0.21%, 11th percentile), consistent with the hardware-specific and timing-dependent nature of this race.
Memory exhaustion in the Linux kernel's ax88179_178a USB Ethernet driver allows socket buffers to leak on every failed TX linearization attempt under memory pressure. Systems with ASIX AX88179 or AX88178A USB-to-Ethernet adapters loaded with scatter-gather (NETIF_F_SG) enabled are affected: when skb_linearize() fails inside ax88179_tx_fixup(), the function returns NULL without freeing the original skb, and the caller usbnet_start_xmit() never releases it because its local skb pointer is now NULL. No public exploit has been identified and EPSS probability is negligible (0.21%, 12th percentile); the practical risk is gradual kernel memory exhaustion on systems continuously operating under low-memory, high-TX-load conditions with the specific USB hardware connected.
Race condition in the Linux kernel virtual terminal subsystem exposes a use-after-free condition when kbd_keycode() reads vc->port.tty without holding a reference, while con_shutdown() concurrently clears that pointer under a separate lock. Affected versions span every maintained stable series from 5.10 through 7.x; patches are available across all branches. No public exploit code exists and EPSS is very low at 0.22% (13th percentile), but the CVSS 7.8 local score reflects real kernel memory corruption potential that could enable privilege escalation.
Incorrect TLB flush address targeting in the Linux kernel's zap_pte_range memory management function exposes systems running kernel versions prior to 7.1.9 and 7.2 to local privilege escalation and information disclosure, particularly on AMD systems with EFER.TCE enabled and Intel systems using INVPCID. A low-privileged local attacker can exploit a race where the kernel flushes the wrong virtual address after freeing a page table, leaving stale CPU paging-structure-cache entries that can be speculatively accessed or cause the freed table to be reused with potentially attacker-controlled data. No public exploit code or active exploitation (CISA KEV) has been confirmed at time of analysis, and the 0.20% EPSS score reflects the complexity of reliable exploitation.
Out-of-bounds write in the Linux kernel IPVS estimator subsystem allows a low-privileged local attacker to corrupt kernel memory through a race condition between network namespace teardown and IPVS kthread initialization. When ipvs->enable is cleared while kthread 0 is mid-way through its calculation phase, ip_vs_enqueue_estimator() writes past the ticks and tick_len arrays using zero-initialized limits, producing high-impact memory corruption on affected kernels from the 6.6.x through 7.1.x stable series. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) reflects very low near-term exploitation probability despite the high CVSS 3.1 base score of 7.8.
Race condition in the Linux kernel's AF_PACKET TX_RING send path allows a low-privileged local user to trigger kernel heap memory corruption by racing a concurrent netdevice reconfiguration. The tpacket_snd() function reads dev->hard_header_len independently at two points - for SKB headroom allocation and for header construction in tpacket_fill_skb() - so a device reconfiguration between those two reads can cause the reserved headroom to be smaller than what is later pushed, or make copylen minus hard_header_len negative. With a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and patches available across multiple stable kernel branches, this is a patching priority for multi-tenant Linux environments; no public exploit or CISA KEV listing has been identified at time of analysis.
Race condition in the Linux kernel AF_PACKET socket subsystem allows a local low-privileged attacker to dereference stale or NULL ring storage, resulting in kernel memory corruption with full confidentiality, integrity, and availability impact. The flaw arises because packet_set_ring() previously published the tpacket receive mode outside the sk_receive_queue.lock section used for ring state updates, enabling packet_poll() and packet_recvmsg() to run pressure-clearing paths against already-freed ring structures. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS places current exploitation probability at 0.21%.
Kernel memory disclosure in the Linux kernel's generic XDP receive path allows leaking of adjacent kernel memory - including skb_shared_info contents and a raw kernel pointer from skb_shinfo(skb)->frags[0] - into userspace when an attached XDP program shrinks a packet's fragment area. The flaw stems from bpf_prog_run_generic_xdp() updating skb->data_len without adjusting skb->len, leaving skb_headlen() larger than the real linear area so datagram copies read past the linear tail. No public exploit is identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the issue is not CISA KEV-listed, so risk is confined to systems running generic XDP programs that adjust fragments.
Stack exhaustion in Linux kernel net/sched allows a local low-privileged attacker with CAP_NET_ADMIN to crash or potentially compromise the kernel by constructing an excessively deep qdisc hierarchy. The create-and-graft code path lacked depth enforcement, permitting hierarchies that trigger unbounded recursion in qdisc tree walkers, overflowing the kernel stack. No public exploit code exists and EPSS is 0.21% (12th percentile), but the CVSS 7.8 High rating and C:H/I:H/A:H impact vector indicate vendor assessment of a privilege escalation potential beyond simple denial-of-service. Patch-confirmed fixes are available across multiple stable kernel branches.
Kernel memory corruption in the Linux inet fragment (inet_frag) subsystem arises from a race in inet_frag_create(), which arms the fragment-queue timer before publishing the queue into the fqdir rhashtable. When a network namespace has a fragment timeout of zero or negative, the timer can fire on an unpublished queue, mark it complete, and drop an anticipated hash reference that is never restored, leaving a stale hash node and a use-after-free-style reference imbalance. No public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.21%, 11th percentile), and exploitation depends on a non-default namespace configuration rather than default deployments.
Use-after-free in the Linux kernel's mac802154 (IEEE 802.15.4) subsystem allows a local low-privileged attacker to dereference freed netdev memory, potentially achieving kernel memory corruption and privilege escalation. The race window opens when mac802154_beacon_worker() drops the RCU read lock while still holding references to sdata and wpan_dev, and a concurrent interface teardown via mac802154_stop_beacons_locked() frees those structures before the worker completes. EPSS is very low at 0.21% (11th percentile) and no active exploitation or public exploit code has been identified at time of analysis; practical exploitation is limited by mac802154 hardware availability and the race condition timing requirement.
Use-after-free in the Linux kernel netfilter ebt_nflog subsystem allows a local attacker with low privileges to trigger kernel memory corruption by racing ebtables NFLOG rule execution against nfnetlink_log module teardown. Affected kernels from version 4.12 through multiple stable branches (pre-patch) fail to acquire a module reference on the nfnetlink_log backend before invoking nfulnl_log_packet(), unlike the xt_NFLOG and nft_log frontends. KASAN-confirmed heap use-after-free at instance_lookup_get_rcu can result in full kernel compromise (C:H/I:H/A:H). No public exploit identified at time of analysis; EPSS at 0.22% (13th percentile) reflects low near-term exploitation probability.
Use-after-free race condition in the Linux kernel's IPv4 routing subsystem allows a local low-privileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw is in fib_nhc_update_mtu(), which traverses the PMTU nexthop exception (FNHE) table without proper serialization against concurrent FNHE eviction, creating a window where freed memory is accessed after a completed RCU grace period. No public exploit code has been identified at time of analysis, and an EPSS of 0.22% (13th percentile) reflects very low near-term exploitation probability despite the 7.8 CVSS score.
TX DMA buffer mismanagement in the Linux kernel's Qualcomm GENI serial driver (qcom-geni) allows a local low-privileged user to hang the system indefinitely and potentially corrupt kernel memory on affected Qualcomm hardware. The driver's DMA-mode uart_ops lacks a flush_buffer callback, enabling in-flight DMA transfers to underflow the transmit kfifo and re-submit page-sized transfers indefinitely; a concurrent flaw in the stop path unmaps the DMA buffer while the serial engine is still reading it. No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile), but the user-triggerable hang and DMA use-after-unmap represent a real availability and potential integrity risk on affected Qualcomm platforms.
Use-after-free race condition in the Linux kernel's amba-pl011 serial driver allows a local unprivileged user on ARM-based hardware to corrupt kernel memory, potentially escalating to full system compromise. The RS485 hrtimers embedded in the devm-managed port structure can fire after the port is freed, and the IRQ handler can arm a timer immediately before teardown, creating the race window. No public exploit exists and EPSS is 0.21% (11th percentile), but kernel-level use-after-free primitives are well-understood exploitation targets and patched stable releases are available.
Race condition in the Linux kernel fastrpc driver allows a local low-privileged attacker on Qualcomm DSP-equipped systems to trigger a use-after-free condition by issuing concurrent munmap ioctls, potentially achieving kernel memory corruption and privilege escalation. The flaw exists in `fastrpc_req_munmap_impl()` where the internal buffer list is updated only after the DSP unmap completes, leaving a window in which a concurrent thread can operate on an already-unmapped entry. No public exploit or CISA KEV listing exists at time of analysis, and EPSS remains low at 0.21%, indicating limited observed exploitation activity.
Unprotected list manipulation in the Linux kernel FastRPC subsystem allows a local low-privileged attacker on Qualcomm-based systems to race a signal-interrupted DSP invoke operation against concurrent mmap/munmap operations. The missing `fl->lock` acquisition in `fastrpc_internal_invoke()` during the interrupt path creates a concurrent modification hazard on `fl->mmaps`, potentially yielding kernel memory corruption with full confidentiality, integrity, and availability impact. No public exploit has been identified and EPSS is 0.21% (11th percentile); this CVE is not listed in the CISA KEV catalog.
Unbounded kernel memory access in the Linux kernel's ALSA usx2y driver allows a local user with access to a Tascam US-X2Y USB audio device's hwdep node to read from and write to arbitrary kernel memory pages via a crafted mmap() call with an out-of-bounds page offset. The snd_usb_usx2y module has carried this flaw since Linux 2.6.12; no Linux capability check (CAP_SYS_ADMIN, etc.) is required - only DAC permission to the hwdep character node after completing a mandatory FPGA image upload sequence. The exploit primitive is sufficient for local privilege escalation, but real-world risk is tightly bounded by the requirement for a physically attached Tascam US-X2Y device; no public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.21% (12th percentile) reflects this narrow hardware prerequisite accurately.
Use-after-free in the Linux kernel perf/core subsystem allows a local low-privileged user to dereference freed kernel memory by racing CPU hot-unplug against perf event group management. When a sibling event is detached via DETACH_GROUP during CPU hotplug, its group_leader pointer is not reset; if the leader is subsequently freed while the sibling's file descriptor remains open, a PERF_IOC_FLAG_GROUP ioctl on the sibling follows the stale pointer into freed memory, potentially enabling kernel crash or privilege escalation to root. No public exploit has been identified at time of analysis and EPSS is low at 0.21% (11th percentile), but the local exploit path with full C:H/I:H/A:H impact warrants prompt patching, particularly on systems permitting unprivileged perf_event_open access.
Use-after-free in the Linux kernel's ring-buffer tracing subsystem exposes non-consuming reader iterators to dangling memory when subbuffer order changes occur while resizing is disabled. The vulnerable function ring_buffer_subbuf_order_set() frees buffer pages without checking the resize_disabled flag, leaving rb_advance_iter() holding stale references to freed memory. Exploitation requires local low-privilege access; no public exploit or CISA KEV listing exists, but vendor patches are available across multiple stable kernel branches.
Race condition in the Linux kernel's mm/huge_memory subsystem allows local low-privilege users to trigger misidentification of the huge zero folio as an ordinary Transparent Huge Page (THP), potentially leading to memory corruption, incorrect folio splitting, and privilege escalation. Affected kernels spanning multiple stable branches from at least 4.19 onward are vulnerable when !CONFIG_PERSISTENT_HUGE_ZERO_FOLIO is in effect, with patched versions available for 6.12, 6.18, 7.1, and 7.2 stable series. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog; EPSS places exploitation probability at the 11th percentile.
Use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local attacker to trigger kernel memory corruption via a refcount underflow in smc_rx_splice(). The flaw arises because pages are handed to splice_to_pipe() before page and socket references are taken, so entries dropped by smc_rx_spd_release() are released without a matching reference, and multi-page splices pair one sock_hold() with multiple sock_put() calls. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.21% (12th percentile), consistent with limited real-world weaponization at this time.
Use-after-free in the Linux kernel's IPv6 stack allows a local low-privileged user to corrupt kernel memory with full high/integrity/availability impact. The race condition exists in in6_dev_get(), where dev->ip6_ptr is read under RCU and its refcount is then unconditionally incremented - device teardown can zero the pointer and drop the final reference between those two operations, resurrecting a freed inet6_dev object. No public exploit identified at time of analysis, though a proof-of-concept reproducer was confirmed functional on the unpatched v7.2-rc3 kernel by OpenAI Security Research and validated by Trail of Bits.
Use-after-free and double-free memory corruption in the Linux kernel's net/dibs network subsystem allows an adjacent network attacker to trigger kernel memory corruption via a race condition between the dibs device interrupt handler and device teardown. The UAF arises because an active interrupt handler can continue accessing dmb_clientid_arr after dibs_dev_del() releases it; a separate double-free path exists when dibs_dev_add() fails during dibs_lo_dev_probe(). No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile), indicating low exploitation likelihood despite the high CVSS score.
Local privilege-relevant kernel memory corruption in the Linux kernel's net/x25 subsystem arises because X.25 socket timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket. The x25_heartbeat_expiry() handler rearms unconditionally and can reinstall sk->sk_timer after __x25_destroy_socket() passes its cancel point, letting a subsequent expiry dereference the kmalloc-2k socket object already freed by close() - a use-after-free confirmed by KASAN. Exploitation requires the ability to create AF_X25 sockets on a host with X.25 support loaded; no active exploitation and no public exploit code have been identified, and EPSS probability is low (0.21%).
Linux kernel zero-copy networking in zerocopy_fill_skb_from_devmem() permits improper mixing of net_iov (device memory) and page-backed fragments within a single socket buffer (skb), causing type confusion and memory corruption in downstream kernel networking code. Affected are kernels from introducing commit bd61848900bff5 across the 6.18.x and 7.x stable series until the respective patch commits were applied. No public exploit or active exploitation is confirmed at time of analysis (EPSS 0.21%, no CISA KEV listing), but the local CVSS 7.8 score reflects credible kernel-level memory corruption risk for systems where devmem TCP zero-copy is configured and in use.
Reception stall denial-of-service in the Linux kernel's ntb_netdev driver allows remote unauthenticated attackers to progressively exhaust the NTB network interface's RX queue by triggering repeated memory allocation failures during packet reception, ultimately halting all inbound packet delivery while the interface remains administratively up. Systems with NTB-capable PCIe hardware (Non-Transparent Bridge interconnects) running affected kernel versions are at risk; standard Linux deployments without this hardware are entirely unaffected. No public exploit has been identified at time of analysis, and EPSS sits at the 10th percentile, consistent with the specialized hardware prerequisite; upstream stable commits confirming the fix are publicly available.
Memory exhaustion in the Linux kernel's netfilter bridge subsystem allows network-adjacent unauthenticated attackers to cause denial of service by sending non-IP Ethernet frames through a bridge host configured with nftables conntrack zone set rules. The root cause is that nf_ct_bridge_pre() overwrites skb->_nfct with IP_CT_UNTRACKED for non-IPv4/non-IPv6 EtherTypes without releasing the existing conntrack template reference, leaking slab memory indefinitely until the host exhausts kernel memory. No public exploit exists and EPSS is 0.22% (13th percentile), indicating low real-world exploitation likelihood despite the High availability impact rating; risk is further bounded by the requirement for a specific non-default nftables configuration.
Unbounded kernel memory exhaustion in the Linux kernel's traffic control connection tracking action (act_ct) allows unauthenticated remote attackers to leak one sk_buff plus its data buffer per malformed IP packet on systems with a clsact TC chain configured with 'action ct'. The defect in tcf_ct_act() causes error paths from header sanity checks to return TC_ACT_CONSUMED - signaling ownership transfer - while the sk_buff is still owned by the caller and never freed, resulting in progressive kernel memory exhaustion. No public exploit has been identified at time of analysis; EPSS is low at 0.21% (percentile 11%), and the vulnerability is not in CISA KEV.
Improper initialization ordering in the Linux kernel's dibs (Direct Internal Buffer Sharing) subsystem leaves dibs->lock uninitialized during early ISM device probe, so a GID-event interrupt arriving between ism_dev_init()/request_irq() and dibs_dev_add() causes ism_handle_irq() to acquire an uninitialized spinlock. This affects s390 systems using ISM/SMC-D devices and can lead to undefined locking behavior and kernel instability. EPSS is low (0.21%), no public exploit is identified, and the issue is a robustness/race fix rather than a remotely triggerable flaw despite the input's 9.8 rating.
Memory corruption in the Linux kernel's XDP (eXpress Data Path) broadcast-redirect path allows corruption of kernel skb_shared_info metadata when cloned XDP frames are converted back into socket buffers. xdpf_clone() packs broadcast copies into a single page with frame_sz set to PAGE_SIZE, but the existing bounds check fails to account for the shared-info tailroom, so a source frame from a larger allocation can extend into the clone's required shared-info area; build_skb_around() then writes skb_shared_info over live packet bytes. The issue is fixed and carries a vendor CVSS of 9.8, but with a low EPSS of 0.21% (12th percentile) and no public exploit identified at time of analysis, real-world risk is far narrower than the base score implies because a non-default XDP broadcast-redirect configuration is required.
Use-after-free in the Linux kernel VXLAN driver allows a local, low-privileged user to corrupt kernel memory, potentially escalating to full kernel compromise. The flaw exists in vxlan_changelink(), which arms age_timer without checking whether the device is up via netif_running(); when the device is subsequently deleted, free_netdev() releases the vxlan_dev struct - including the embedded timer - while that timer remains queued on a timer_base. Because the rtnl operations are netns-scoped, an unprivileged user can trigger the entire sequence inside a new user and network namespace without elevated system privileges. No public exploit or CISA KEV entry is identified at time of analysis; EPSS of 0.22% (13th percentile) reflects low current exploitation activity, though the local-user-namespace reachability makes this a meaningful local privilege escalation risk on any Linux system permitting user namespace creation.
Use-after-free memory corruption in the Linux kernel vsock/virtio subsystem arises from a race condition between virtqueue worker threads and VM suspend/resume cycles. Worker threads (RX, TX, event) read their virtqueue pointer before acquiring the protective mutex and checking the run flag; a worker delayed across a freeze/restore transition retains a dangling pointer to a freed queue while the restoration installs replacement queues. No public exploit has been identified and EPSS probability is low at 0.21%, though successful exploitation could yield full kernel-level memory corruption with high confidentiality, integrity, and availability impact.
Use-after-free in the Linux kernel vsock/virtio RX worker allows a local low-privileged user to trigger memory corruption during device teardown, potentially achieving privilege escalation or kernel panic. The race condition exists because the RX worker's common exit path continues to refill the virtqueue even after rx_run is cleared and virtqueues have been deleted via virtio_vsock_vqs_del(). KASAN-confirmed slab-use-after-free in virtqueue_add_sgs is the direct manifestation. No public exploit or CISA KEV listing at time of analysis; EPSS of 0.22% (13th percentile) reflects low near-term exploitation probability.
Kernel memory disclosure and crash in the Linux kernel's veth driver arises from broken skb length accounting after an XDP program adjusts packet fragments; veth_xdp_rcv_skb() updates skb->data_len but leaves skb->len holding the stale fragment contribution, so skb_headlen() overstates the linear area. On the UDP receive path this caused __skb_datagram_iter() to copy 1024 bytes past the real linear tail into userspace - leaking skb_shared_info contents including nr_frags, xdp_frags_size, and a kernel pointer from frags[0] - while displacing and truncating real packet data. A related path via bpf_xdp_pull_data() leaves the skb non-linear and trips SKB_LINEAR_ASSERT(), crashing the kernel. There is no public exploit identified at time of analysis, and EPSS risk is low (0.21%).
Improper handling of the receive-side message iterator in the Linux kernel's kernel-TLS (kTLS) subsystem lets a remote TLS peer cause recvmsg() to write decrypted bytes into the wrong offsets of a receiver's user-space iovec buffers. When the optimistic TLS 1.3 zero-copy path maps user pages and then falls back to a kernel skb, the iterator is left advanced, so bytes are written a second time past the length recvmsg() reports. Exploitation requires the receiver to have enabled the TLS_RX_EXPECT_NO_PAD socket option; there is no public exploit identified at time of analysis and EPSS is low (0.21%).
Use-after-free race condition in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem allows a local attacker with low-privilege network administration access to corrupt kernel memory, achieving high impact across confidentiality, integrity, and availability. The flaw exists across multiple stable kernel branches from 5.10 through 7.1.x and is triggered by concurrent execution of TIPC bearer teardown against the link supervision timer or receive path. No public exploit or active exploitation has been confirmed; EPSS stands at 0.22% (13th percentile), and patched versions are available across all affected stable series.
Use-after-free in the Linux kernel CIFS/SMB client (cifs_try_adding_channels()) lets a race between SMB multichannel channel setup and an interface-list refresh free an 'iface' object that is then written to via weight_fulfilled, corrupting freed kernel memory. It affects systems that mount SMB shares with multichannel across many stable branches (6.1.x through 6.18.x and 7.x, fixed in 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2). This is a resolved upstream bug with a vendor patch available; there is no public exploit identified at time of analysis and EPSS is low (0.21%).
Race conditions in the Linux kernel KVM/SVM subsystem allow local attackers with low privileges to corrupt the SEV mirror VM list or trigger incorrect reference counting in the hypervisor. Two distinct concurrency flaws exist: sev_migrate_from() modifies the owner's mirror_vms list without holding the owner lock, enabling list corruption when concurrent COPY or destroy operations race with a migration; and sev_vm_destroy() can read a stale enc_context_owner pointer after it changes via a concurrent KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM ioctl, causing kvm_put_kvm() to be called on the wrong VM struct. No public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.21% (11th percentile) reflects the narrow exploitation conditions required.
Use-after-free in the Linux kernel's eventfs subsystem allows a local low-privileged user to corrupt kernel memory by triggering unsafe iterator advancement after recursive child removal in eventfs_remove_rec(). Affected stable branches span Linux 6.6.18 through pre-6.6.152, 6.7.6 through pre-6.8, and related ranges; patched versions (6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2) are available via upstream kernel.org stable commits. No public exploit has been identified at time of analysis and EPSS is very low at 0.21% (11th percentile), though successful exploitation could yield local privilege escalation to root.
Memory corruption in the Linux kernel's eventfs subsystem allows a local low-privileged user to trigger a use-after-free condition via a race between SRCU inode freeing and concurrent list iteration. The root cause is an unsafe union of ei->list with the RCU head, combined with absent memory barriers around the is_freed flag, permitting a racing reader to dereference a pointer that has been overwritten by the RCU freelist mechanism. No public exploit code exists and the CVE is absent from CISA KEV; EPSS of 0.20% (10th percentile) confirms negligible observed exploitation activity, placing real-world risk well below what the 7.8 CVSS score implies.
Use-after-free in the Linux kernel's thermal/hwmon subsystem exposes local attackers to potential kernel memory corruption across a wide range of stable kernel branches. The flaw was introduced by a cosmetic code-style cleanup commit (030a48b0f6ce) that inadvertently removed a valid guard from the error path of thermal_add_hwmon_sysfs(), allowing a freed object to be referenced when the function fails. Patches are backported across six stable kernel series (5.15, 6.1, 6.6, 6.12, 6.18, 7.1, and 7.2); EPSS is low at 0.21% and no active exploitation has been identified.
Out-of-bounds read in the Linux kernel ptp_ocp driver exposes kernel memory and risks availability on systems equipped with OCP PTP time-synchronization hardware. The ptp: ocp driver reads a fixed 13-byte EEPROM board ID field without enforcing a NUL terminator before passing it to devlink_info_version_fixed_put(), causing the function to scan beyond the field boundary as a C string. An attacker with local, low-privilege access on an affected host could trigger this over-read by querying devlink device info, potentially leaking adjacent kernel memory (C:H) or inducing a kernel fault (A:H). No public exploit exists and EPSS is 0.21% (12th percentile), indicating low real-world exploitation activity; however, patches are available across multiple stable kernel branches.
Out-of-bounds memory read in the Linux kernel's IPv6 stack exposes up to 8 bytes of adjacent kernel memory per crafted Router Advertisement. The flaw in `rt6_route_rcv()` permits a link-local attacker to send a Route Information option with an RFC 4191-invalid prefix_len/length combination, causing `ipv6_addr_prefix()` to read beyond the option boundary and install the overread bytes as a route prefix visible to unprivileged userspace via `ip -6 route show`. No public exploit has been identified at time of analysis and EPSS is 0.22% (13th percentile), though the attack requires no authentication and only link adjacency.
Kernel-memory corruption in the Linux IPv6-in-IPv6 tunnel driver (ip6_tunnel) lets a remote attacker corrupt skb_shared_info by abusing stale socket control-block metadata during ICMPv6 error handling. Affected systems are Linux hosts terminating an ip6ip6 tunnel where an outer ICMPv6 error carrying a Home Address Option is reflected back through icmpv6_send(); a malformed inner destination-options header then drives an out-of-bounds Home Address Option lookup/swap past the quoted packet. Despite the assigned CVSS of 9.8, EPSS is low (0.22%, 13th percentile), there is no public exploit identified at time of analysis, and there is no CISA KEV listing.
Incorrect idmap context in Linux kernel fscrypt allows a low-privileged local user on an idmapped-mount filesystem to bypass ownership checks when setting fscrypt encryption policies via FSCRYPT_IOC_SET_POLICY, and simultaneously causes legitimate directory owners to be wrongly denied access with EACCES. The flaw affects ext4, f2fs, and other fscrypt-capable filesystems mounted with idmapped-mount configurations - a setup common in container runtimes and rootless Kubernetes node deployments from kernel 5.12 onward. No public exploit is identified at time of analysis, and EPSS of 0.14% (3rd percentile) reflects minimal observed exploitation interest.
Use-after-free in the Linux kernel's PSI (Pressure Stall Information) scheduler subsystem exposes local low-privilege users to potential memory corruption and privilege escalation on affected kernel versions. The race condition between psi_schedule_rtpoll_work(), called locklessly from the scheduler hotpath, and psi_trigger_destroy() allows the rtpoll_timer to be re-armed after the cgroup group has been freed, causing poll_timer_fn() to execute on deallocated memory. Vendor-released patches are available across stable branches 6.1.183, 6.6.152, 6.12.104, 7.1.9, 7.2, and 6.18.45; no public exploit has been identified and EPSS is 0.21%.
The IMA (Integrity Measurement Architecture) subsystem in the Linux kernel fails to invalidate action cache flags (IMA_DONE_MASK) when files are truncated, because the file_truncate and path_truncate LSM hooks were not instantiated in IMA's hook logic. Authenticated local users who can truncate a file covered by an active IMA policy can exploit this gap - causing the kernel to skip re-measurement, re-auditing, and re-appraisal on the next file access, effectively bypassing IMA integrity enforcement for that file. No public exploit has been identified, the vulnerability is absent from CISA KEV, and the EPSS score of 0.21% (11th percentile) reflects very low observed exploitation probability despite the assigned CVSS score of 8.1.
Memory corruption in the Linux kernel page cache (mm/filemap) arises when a race condition in __filemap_add_folio() stores a folio at an incorrect, intermediate rounded-down index after a concurrent thread resolves a conflict during the split-a-conflict retry loop. Affecting large-folio-capable kernels (6.15 onward), the flaw manifested in production as rare SIGILLs and SIGSEGVs with executable text landing a page away from its correct location, and tripped a !folio_contains() assertion under CONFIG_DEBUG_VM. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and it is not listed in CISA KEV; the upstream fix restores the original xas.xa_index before each retry.
Use-after-free race condition in the Linux kernel BPF sockmap subsystem allows a local attacker with access to a sockmap-configured TCP socket to corrupt kernel memory, with high impact on confidentiality, integrity, and availability. The flaw exists in tcp_bpf_send_verdict(), where a local pointer copy of psock->sk_redir is made without incrementing the socket reference count before the source socket lock is released, enabling a concurrent sendmsg() thread to free the socket object while the first thread still holds the stale raw pointer. The vulnerability is confirmed by a full KASAN slab-use-after-free trace; no public exploit identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects low current exploitation probability despite the high CVSS base score.
Denial of service (and potential memory corruption) in the Linux kernel SCTP stack arises because __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport, leaving a dangling pointer once the original transport is RCU-freed via an ASCONF Delete-IP peer removal. A subsequent SACK that reneges the TSN clears tsn_gap_acked, and the next SACK dereferences the freed transport in sctp_check_transmitted(), producing a KASAN-confirmed slab-use-after-free. The issue affects hosts actively using SCTP with dynamic address reconfiguration; it carries a published CVSS of 9.8 but low EPSS (0.22%, 13th percentile), and no public exploit has been identified at time of analysis.
Use-after-free and NULL-pointer dereference in the Linux kernel's SCTP stack allow a remote SCTP peer to corrupt kernel memory or crash the host by triggering association-restart handling that leaves the cached ASCONF chunk pointer (addip_last_asconf) dangling. A delayed authenticated ASCONF-ACK then reaches sctp_sf_do_asconf_ack() and operates on freed memory, causing a second release, while clearing the pointer exposes a companion NULL dereference via a racing T4 timer callback. There is no public exploit identified and EPSS is low (0.22%), consistent with a race-condition kernel bug rather than a turnkey remote exploit despite the 9.8 input score.
A remotely triggerable use-after-free in the Linux kernel's SCTP stack (net/sctp) lets an authenticated SCTP peer read freed transport memory in sctp_outq_select_transport(). By sending an ASCONF chunk that both adds a peer transport and then removes it via a wildcard DEL-IP, the newly added transport is freed while asoc->new_transport still points to it; a later HEARTBEAT and address-replacement sequence dereferences the dangling pointer. There is no public exploit identified at time of analysis, EPSS is low (0.22%), and the flaw is not in CISA KEV, though a reliable private reproducer is described.
PHP Object Injection in the WS Form LITE contact form plugin for WordPress (all versions through 1.10.80) lets unauthenticated attackers instantiate arbitrary PHP objects by supplying serialized data in form-submission meta values, which the plugin deserializes without validation. The plugin ships no exploitable POP (property-oriented programming) chain of its own, so on a default install the injection has no direct impact; real damage - arbitrary file deletion, sensitive-data disclosure, or code execution - occurs only when a separate plugin or theme on the same site provides a usable gadget chain. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the headline 9.8 rating overstates practical risk for isolated installs.
Kernel memory disclosure in the Linux bnxt_re RDMA driver (Broadcom NetXtreme RDMA) exposes 4092 bytes of stale kernel data to local users holding InfiniBand device access. The bnxt_re_alloc_ucontext() function allocates the user context shared page with __get_free_page(GFP_KERNEL), which does not zero memory, then maps the page into userspace - leaving all bytes beyond the 4-byte AVID write at offset 0x10 uninitialized and fully readable by the calling process. Exploitation requires only a single mmap() call after IB_USER_VERBS_CMD_GET_CONTEXT, making it trivially scriptable; no public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects low observed exploitation activity.
Symlink escape in NLTK's CorpusReader.open() allows local attackers to read arbitrary files outside the designated corpus root, affecting all versions before 3.9.4. Path boundary validation is performed lexically on the string representation of a path rather than on the resolved filesystem target, so an attacker with write access to the corpus directory can plant a symlink that passes the check yet redirects reads to sensitive files anywhere the host process can access. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.9.4.
Session cookie forgery in Punk before 0.18 (a Perl web framework by LNATION) lets remote unauthenticated attackers mint valid session cookies whenever an application declares a session without a secret. Because the cookie reader and write-back both default the HMAC-SHA256 key to an empty string, cookies are signed and verified with a zero-length key, so anyone who knows the cookie format can offline-forge a session carrying any user identifier or role. No public exploit has been identified at time of analysis, and EPSS is low (0.20%, 10th percentile), but the CVSS base score is 9.1 and exploitation is trivial once the misconfiguration exists.
TLS hostname verification is silently bypassed in Netty's OpenSSL client path, allowing a network man-in-the-middle attacker to intercept encrypted communications by presenting a certificate issued for a different hostname. Affected are applications using io.netty:netty-handler versions 4.2.0.Final through 4.2.16.Final or any 4.1.x through 4.1.136.Final, specifically when the SslProvider.OPENSSL client path is configured with a plain X509TrustManager and running on Java 25 or later, where Unsafe-based trust-manager wrapping is unavailable. No public exploit code has been identified at time of analysis, but the confidentiality impact is high for any affected deployment that transmits sensitive data over TLS.
Unauthorized access to restricted video content in WWBN AVideo (through commit 9c39d8c8) is enabled by a fundamental design flaw in the platform's token subsystem: getToken() produces tokens with no binding to user identity or intended purpose, and the Gallery plugin endpoint (plugin/Gallery/view/sections.php) distributes these tokens freely to unauthenticated visitors. Because the tokens carry no scope constraint, they are accepted as valid authorization across unrelated subsystems including the HLS streaming endpoint (view/hls.php), allowing any remote unauthenticated party to retrieve private video content. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a trivially simple, two-step attack requiring no special tools.
Denial-of-service in Tie::Hash::Regex before 2.0.0 for Perl allows unauthenticated remote attackers to crash any application that performs hash lookups with externally supplied strings. The FETCH, EXISTS, and DELETE methods compiled caller-provided keys as bare regex patterns without an eval guard, causing the Perl process to die on any syntactically invalid pattern such as an unmatched bracket. No public exploit code has been identified, and EPSS sits at just 0.24% (15th percentile), consistent with a niche library with narrow deployment; however, the impact on any affected application is immediate process termination.
Cross-origin RRDP URL confusion in FORT Validator through 1.6.7 allows a delegated Certificate Authority sharing the same Trust Anchor Locator to silently poison the validator's download cache, causing the victim CA's Validated ROA Payloads and signed objects to be purged from FORT's routing origin validation output. The resulting VRP gaps - triggered passively by the victim's own routine publication cycle - can enable BGP route hijacking or loss of network reachability for the affected IP prefixes. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 7.2 with high integrity impact on subsequent routing infrastructure reflects serious operational risk for networks relying on FORT for RPKI-based origin validation.
Access control bypass in Combodo iTop prior to 3.2.3 allows authenticated low-privileged users to read data outside their assigned silos via crafted OQL queries. The iTop silo isolation mechanism - which restricts users to specific data partitions - fails to apply visibility filters to classes joined in OQL but not explicitly listed in the SELECT clause, enabling cross-silo confidential data disclosure. No public exploit code or CISA KEV listing exists at time of analysis; the vendor has released a confirmed fix in version 3.2.3.
Cross-tenant document content corruption in PDFio before 1.6.5 allows low-privileged network attackers to silently overwrite one caller's PDF dictionary string values with another caller's data in multi-threaded or pooled-request environments. The defect is in `pdfioDictSetStringf`, which stored a raw pointer to a stack-local formatted string buffer in the document dictionary rather than heap-allocating a copy, leaving the dictionary referencing reclaimed stack memory after the function returned. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patch v1.6.5 is confirmed available.
Information disclosure in Esri Portal for ArcGIS versions 11.5 through 12.0 allows remote unauthenticated attackers to extract sensitive data reflected in HTTP response bodies via crafted requests. The vulnerability (CWE-200) requires no authentication or user interaction per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, meaning any internet-exposed Portal instance in the affected version range is potentially reachable without credentials. No public exploit or KEV listing exists at time of analysis, and SSVC classifies exploitation as none with partial technical impact, indicating limited observed threat activity despite the high confidentiality impact scored by NVD.
Sensitive information reflection in Esri Portal for ArcGIS versions 11.1 through 12.0 exposes confidential content in HTTP response bodies to remote, unauthenticated attackers under specific, difficult-to-reproduce conditions. The vulnerability stems from improper information exposure (CWE-200), where a crafted request can cause the server to echo sensitive data back in its response. No active exploitation has been confirmed, and EPSS probability is low at 0.33%, though CVSS rates confidentiality impact as high given the potential sensitivity of reflected data.
Remote code execution in Xorbits Inference (Xinference) 2.5.0 and earlier lets a remote attacker run arbitrary OS commands in the server process by abusing an unsafe eval() in the Llama3 tool-call parser. Any request to the OpenAI-compatible /v1/chat/completions endpoint with a tools field triggers evaluation of model-generated Python, so an attacker who steers the model's output via a crafted prompt achieves full server compromise; because authentication is disabled in the default deployment, the vendor advisory rates this exploitable by an unauthenticated remote attacker. This is fixed in 2.7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
DNS rebinding against Microsoft UFO's Linux MCP server (all versions prior to 3.0.8) enables an attacker-controlled web page to bypass localhost binding protections and reach the local /mcp endpoint via the victim's browser. Because the FastMCP streamable HTTP server bound to localhost:8010 performed no Host, Origin, or Sec-Fetch-Site header validation, a browser performing a DNS rebind could enumerate available tool schemas via tools/list and invoke execute_command with a valid UFO_MCP_API_KEY, resulting in arbitrary file reads or OS command execution as the victim's local user. No public exploit code has been identified at time of analysis, though the DNS rebinding technique is well-documented and the commit-confirmed patch validates the described attack path.
NTLM credential exposure in Git for Windows before 2.55.0.windows.4 allows a malicious remote Git server to capture Windows authentication material by advertising a crafted bundle URI during clone or fetch operations. When transfer.bundleuri is enabled, non-HTTP(S) URIs including bare UNC paths are treated as local filesystem paths, causing Windows to initiate an outbound SMB connection to an attacker-controlled host and expose NTLM hashes. No public exploit code has been identified at time of analysis and no CISA KEV listing is present, but the technique maps directly onto well-documented NTLM capture and relay attack patterns.
Unauthenticated access to inline images in Combodo iTop prior to version 3.2.3 is protected by a 24-bit secret generated with PHP's non-cryptographic mt_rand(), yielding only ~16.7 million possible values and making brute-force enumeration feasible for any network-reachable attacker. The commit diff confirms the secret was stored as a 6-character hex string (sprintf('%06x', mt_rand(0, 0xFFFFFF))), and a secondary timing side-channel existed because the comparison used != instead of constant-time hash_equals(). No active exploitation is confirmed in CISA KEV, and no public POC has been identified at time of analysis.
User enumeration in Combodo iTop prior to version 3.2.3 allows remote unauthenticated attackers to identify valid accounts by observing distinct error responses in the forgot-password mechanism. The application returned different messages depending on account state - external authentication, fixed password, missing email - making it possible to distinguish valid usernames from invalid ones without any credentials. No public exploit code has been identified at time of analysis, and the issue is resolved in iTop 3.2.3 per the vendor's GitHub Security Advisory GHSA-888g-gv33-xwwx.
Code injection in the AWS Athena Federated Query Neptune connector (versions 2024.15.1 through 2026.28.1) allows a low-privileged user with query access to Neptune via Athena to reach into and read properties of the AWS Lambda function that provides the connector's compute. Because Lambda environment properties commonly hold configuration and credential material, this exposes the underlying execution context to an authenticated attacker. No public exploit identified at time of analysis; the flaw was reported internally by Amazon (AMZN) and carries a CVSS 4.0 base score of 9.4.
Stack exhaustion denial-of-service in Unleash's OpenAPI validation middleware allows unauthenticated network attackers to terminate the Node.js server process by submitting a roughly 10 KB JSON payload nested thousands of levels deep to any OpenAPI-validated endpoint. Versions prior to 7.5.2, 7.6.5, and 8.0.2 are affected; the shared error-formatting path in src/lib/error/bad-data-error.ts calls JSON.stringify on raw request values without catching the resulting RangeError, which propagates uncaught and kills the process. No public exploit code has been identified at time of analysis, though the attack is trivially reproducible from the advisory description alone, and replaying the request sustains the outage indefinitely.
Credential leakage in Bluewave Labs Checkmate versions 3.3.0 through 3.9.1 exposes HTTP Authorization secrets to unauthenticated remote visitors when the global showURL setting is enabled. The unauthenticated GET /api/v1/status-page/:url endpoint returns complete monitor objects from statusPageController.ts, including the secret field consumed by HttpProvider.ts as a bearer or basic-auth credential against monitored upstream services. Although the frontend component BaseStatusPage.tsx intentionally omits this value from the UI, the raw JSON API response delivers it in full, allowing any visitor to harvest credentials and pivot attacks against monitored infrastructure. No public exploit code has been identified at time of analysis, and the issue is fixed in v3.9.2.
Unprivileged task memory disclosure in FreeRTOS-Kernel before 11.3.1 enables a low-privileged task to read privileged kernel memory by exploiting missing type validation in the xQueueAddToSet() function (CWE-843). Exploitation is constrained to deployments using MPU-enabled ports with the queue sets feature active, but on affected configurations the CVSS 4.0 score of 8.2 reflects high confidentiality impact across both the vulnerable system and subsequent (privileged) system contexts. No public exploit code or CISA KEV listing exists; Amazon (AWS), who reported the issue, has released a fix in version 11.3.1.
Use-after-free in FreeRTOS-Kernel's secure context cleanup handler (versions 10.2.0 through 11.3.0) allows a local low-privileged user to corrupt or crash TrustZone secure-world memory by invoking the SVC handler for secure context deallocation without privilege verification. The missing privilege check permits normal-world code to trigger deallocation of already-freed secure-world memory regions, producing high integrity and availability impact on the secure execution environment - a severe outcome in security-sensitive embedded deployments. No public exploit has been identified at time of analysis; vendor-released patch V11.3.1 is available via Amazon's security bulletin and the FreeRTOS GitHub repository.
Use-after-free in the Linux kernel's route4 (cls_route) traffic classifier fastmap cache allows a local attacker with CAP_NET_ADMIN to read freed kernel heap memory by racing filter deletion against fastmap cache population, potentially escalating to full kernel compromise. Affected versions span Linux 3.18 through current stable branches; the kernel security team backported fixes to eight LTS/stable lines (5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2). No public exploit identified at time of analysis; EPSS of 0.17% (6th percentile) reflects minimal current exploitation activity, though the theoretical impact is severe given the kernel-level UAF primitive.
Kernel-level use-after-free in the Linux IPv6 policy-routing (fib6 rules) subsystem allows a suppressed route to leak a released rt6_info back to rt6_lookup() callers, so a subsequent dst_release() operates on freed memory. The flaw affects systems using IPv6 FIB rules with route suppression and realistically manifests as a kernel crash (denial of service) and potential memory corruption. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile); a vendor patch is available across stable trees.
Out-of-bounds host memory access in the Linux kernel vhost subsystem results from a stale metadata cache that is not invalidated when vring addresses or sizes are reconfigured via VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM while a virtqueue is live. Systems running KVM/QEMU virtualization with vhost and a device IOTLB attached - spanning kernel versions from 4.11 through unpatched stable series - are affected, with the scope change (S:C) in the CVSS vector indicating potential read/write access to host memory beyond the vhost subsystem boundary. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (6th percentile), consistent with a complex kernel-internal flaw not yet commoditized.
Out-of-bounds read and one-byte out-of-bounds write in mod_auth_openidc's state-cookie parser (all versions prior to 2.4.19.4) allow unauthenticated remote attackers to crash Apache worker processes by sending a malformed Cookie header. The root cause is a loop termination condition in src/state.c that checked whether a pointer was NULL — a condition that could never fire since the pointer is only ever incremented — rather than checking for the string terminator, causing state-prefixed cookie tokens lacking '=' to scan and write past the end of the token buffer. No CISA KEV listing or confirmed public exploit exists at time of analysis, but the CVSS AV:N/AC:L/PR:N profile and the fully transparent fix commit make this trivially automatable for denial-of-service once widely known.
Symlink escape in Infinite Image Browsing (zanllp/infinite-image-browsing) allows remote attackers to read arbitrary files from the host filesystem by placing a symbolic link inside a scanned image directory, which satisfies a string-based path containment check that does not resolve symlinks. The flaw is exploitable only in network-exposed Stable Diffusion WebUI deployments where access control is active - those started with share, ngrok, listen, or server_name options, or with IIB_ACCESS_CONTROL=enable. No public exploit or CISA KEV listing has been identified at time of analysis; an upstream fix is available as commit 4057a624 (PR #969), but no specifically tagged patched release has been confirmed.
Cleartext exposure of Wi-Fi credentials in DJI consumer and prosumer drones lets an attacker within Bluetooth range recover the drone's Wi-Fi SSID, PSK, and trusted-client UUID by passively sniffing unencrypted DUML-over-BLE messages exchanged during a normal DJI Fly connection or QuickTransfer handoff. This affects a broad range of current DJI models (Neo, Flip, Air 3/3S, Avata 2/360, Mavic 3 family, Mavic 4 Pro, and Mini 2 through Mini 5 Pro) below specific firmware versions. Recovered credentials grant the attacker access to the drone's internal Wi-Fi network and the ability to decrypt the operator's Wi-Fi traffic; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Sensitive OAuth configuration data is exposed to unauthenticated remote actors in Apache CloudStack's OAuth authentication plugin when the OAuth provider listing endpoint is queried. Affected versions span two release branches: 4.19.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0. Despite a CVSS score of 7.5 reflecting unauthenticated network access and high confidentiality impact, EPSS sits at just 0.17% (7th percentile), and no public exploit code or CISA KEV listing has been identified at time of analysis, suggesting limited active exploitation to date.
Cleartext storage of sensitive information in Apache CloudStack's AsyncJob database records exposes credentials and operation-sensitive data to any party with read access to the underlying database. All CloudStack deployments from version 4.0.0 through 4.22.1.0 are affected across both the 4.x stable and 4.21/4.22 release lines. No public exploit code has been identified and EPSS sits at the 1st percentile, but the NVD-assigned confidentiality impact of HIGH reflects that AsyncJob records may capture sensitive payloads - such as API secrets or passwords - passed through asynchronous operations, stored durably in cleartext rather than encrypted at rest.
Unauthorized LDAP configuration disclosure in Apache CloudStack exposes LDAP server details - including bind credentials and hostnames - to any authenticated user via the listLdapConfigurations API, which is accessible to all default CloudStack roles. Affected versions span 4.2.0.0 through 4.22.1.0, a broad range suggesting long-standing exposure in enterprise and cloud provider deployments. No public exploit code has been identified at time of analysis, but the low barrier of a valid account and the downstream risk of harvested LDAP bind credentials elevate practical severity beyond the EPSS score suggests.
Sensitive information exposure in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration allows unauthenticated remote attackers to access high-confidentiality data across two affected version ranges. The flaw is network-reachable with no authentication or user interaction required (CVSS AV:N/AC:L/PR:N/UI:N), making it a genuine High-severity finding for any CloudStack deployment with OAuth2 or Google OAuth enabled. EPSS sits at 0.17% (7th percentile) and no CISA KEV listing exists, suggesting no public exploitation activity at time of analysis; however, the low attack complexity and zero privilege requirement keep real-world risk elevated for affected configurations.
Improper output encoding in the Apache CloudStack management UI's Instance Reset Password feature allows injection of unescaped output that can expose sensitive data or manipulate the interface. It affects Apache CloudStack 4.15.1.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0, an open-source IaaS cloud orchestration platform. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile); vendor-released patches exist in 4.20.3.1 and 4.22.1.1.