Information Disclosure
Monthly
Privilege escalation via token disclosure affects QuantumNous New API, an open-source LLM gateway and AI asset management platform, in all versions prior to 1.0.0-rc.7. The admin user-list and user-lookup endpoints (e.g. GET /api/user/) serialize the full User model with only Omit("password"), so User.AccessToken is returned in the access_token field, letting an authenticated administrator harvest the root user's bearer token and pivot to root-only system-configuration APIs. No public exploit identified at time of analysis and it is not in CISA KEV; the fix is confirmed in release 1.0.0-rc.7 (GHSA-6x2c-phff-wx57).
Memory corruption in the kernel-mode driver component of BeyondTrust Endpoint Privilege Management for Windows (all versions prior to 26.1.2) allows a low-privileged local user to trigger an out-of-bounds read, potentially disclosing kernel memory contents or corrupting system state. The flaw is rooted in insufficient input validation within a Ring 0 component - the most privileged execution layer on Windows - amplifying the potential impact of what would otherwise be a constrained user-level action. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fix in version 26.1.2.
Privilege escalation in Dell ObjectScale versions prior to 4.3.0.1 is enabled by an Uncontrolled Search Path Element (CWE-427), allowing a low-privileged local attacker to plant a malicious binary or shared library in a directory that the application resolves before the legitimate path, resulting in code execution under a higher-privileged context. The CVSS 3.1 score of 7.3 reflects full confidentiality, integrity, and availability impact, though the attack is constrained to local access and requires user interaction to trigger the vulnerable operation. Dell has released a fix in version 4.3.0.1 per advisory DSA-2026-328; no public exploit code has been identified at time of analysis.
Redirect URI prefix-matching in Medplum's unauthenticated external IdP callback (GET /auth/external) allows an attacker who can forge or intercept the OAuth state parameter to redirect Medplum authorization codes and login tokens to an attacker-controlled endpoint. All deployments of npm/@medplum/core at version 5.1.5 and below where a ClientApplication has an external identityProvider configured are affected; the fix was released in v5.1.6. Publicly available exploit code exists in the GHSA-m44r-7c5h-m6mj advisory - including curl-based reproduction steps - and because the attacker can inject their own PKCE challenge into the forged state, stolen codes can be redeemed for a full access token without the victim's knowledge, constituting a complete account takeover.
LDAP filter injection in Roundcube Webmail arises from unescaped substitution variables (`%u`, `%fu`, `%d`) embedded directly into LDAP `search_filter` configuration strings, affecting all 1.6.x releases before 1.6.18 and 1.7.x releases before 1.7.3. An authenticated user whose login credentials contain crafted LDAP metacharacters can manipulate server-side directory queries, potentially disclosing LDAP directory contents or escalating privileges by subverting group membership lookups. No active exploitation has been identified at time of analysis (SSVC: Exploitation none), though the low attack complexity and network accessibility warrant prompt patching for any LDAP-backed deployment.
Remote content blocking evasion in Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3 lets a crafted SVG image with an unclosed url() in a FuncIRI attribute slip past the remote-image blocker, so external resources load when a victim views a malicious email. This exposes the recipient's IP, mail-client fingerprint, and email-open telemetry to the sender, and per the advisory may aid further information disclosure or privilege escalation. It has a vendor patch and no public exploit identified at time of analysis; EPSS is low (0.31%) and CISA SSVC rates exploitation as none.
IMAP command injection in Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3 enables authenticated remote attackers to disclose information or escalate privileges by exploiting a desynchronization between mail search operations and LITERAL+ byte-count handling. The flaw was reported by Zach Hanley of Horizon3.ai and is classified as CWE-77 (Command Injection), with the vendor releasing patched versions 1.6.18 and 1.7.3 on 2026-08-09. No public exploit code or CISA KEV listing has been identified at time of analysis, though the C:H/I:H CVSS impact and the researcher's track record for producing working exploits elevate the urgency of patching.
Roundcube Webmail's built-in CSS proxy failed to validate responses from external CSS sources, enabling XSS or information disclosure via browser MIME sniffing in versions before 1.6.18 and 1.7.x before 1.7.3. The CVSS 3.1 score of 7.2 with Changed scope reflects that successful exploitation compromises the victim's browser session within the webmail origin. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept exploit has been identified at the time of analysis.
Credential exposure in Logsign SIEM (versions 6.4.97 up to but not including 6.4.114) allows a high-privilege authenticated user to retrieve embedded sensitive data such as stored integration or log-source credentials. The issue was reported by Turkey's national CERT (TR-CERT, advisory TR-26-0847) and carries a vendor CVSS of 9.0; a fixed release (6.4.114) is available and no public exploit has been identified at time of analysis. Because a SIEM aggregates credentials for many connected systems, recovered secrets can enable pivoting well beyond the SIEM itself.
Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets an attacker reconstruct the KEM shared secret and decrypt all protected ciphertext once they obtain only 16 bytes of the private key. The flaw lives in pqc.py, where any post-quantum KEM decapsulation failure silently falls back to a 'simulation mode' that derives a deterministic secret from those 16 key bytes plus attacker-visible encapsulated-key data, rather than raising an error. Reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break out of the IsolatedPluginExecutor and run arbitrary OS commands. The restricted exec() environment still leaks live Python type objects, so an attacker walks the class hierarchy to reach system primitives despite the intended sandbox. Rated CVSS 4.0 9.3 (critical) and reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run without any isolation because the default process-isolation mode silently fails to enforce its sandbox restrictions. An attacker able to supply or influence a plugin gains unrestricted filesystem, network, subprocess, and full Python-module access equivalent to arbitrary code execution. Reported by VulnCheck with a vendor patch available; no public exploit code or CISA KEV listing is identified at time of analysis (CVSS 4.0 base 9.3).
Hardcoded PostgreSQL credentials embedded in openssl_encrypt standalone server configuration files expose backend databases to unauthorized access in all versions before 1.4.0. Network-adjacent attackers who obtain the well-known static credentials - trivially available from the distributed software package or public advisory - can authenticate directly to the PostgreSQL instance and retrieve sensitive stored data without any legitimate account. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the CWE-798 root cause makes exploitation mechanically trivial for any attacker within network reach of the database port.
Weak cryptographic key derivation in the openssl_encrypt Python library (all versions before 1.4.0) stems from its key-normalization routines invoking HKDF with no salt and a static info parameter, making derived keys deterministic for identical inputs. This reduces effective entropy and weakens resistance to multi-target (batch) attacks, letting an adversary who collects ciphertexts or derived-key material amortize cryptanalytic effort across many victims. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and a vendor patch is available in 1.4.0.
Weak key derivation in openssl_encrypt versions prior to 1.4.0 enables accelerated offline password cracking against files encrypted by the library. The jahlives/openssl_encrypt PHP library implements PBKDF2 in a non-standard construction - using iterations=1 per inner call within an outer application loop - a design whose formal security properties have not been analyzed and whose brute-force resistance is materially lower than a correctly parameterized PBKDF2 implementation. No public exploit code has been identified at time of analysis, and the library has not been listed in CISA KEV; exploitation is bounded to attackers who have already obtained the encrypted artifacts.
Audit-trail corruption and a security-control race condition in the Python library openssl_encrypt (by jahlives) before version 1.4.0 undermine its module-hiding defenses. The restore_hidden_modules() function logs module counts after clearing them, so it always records zero restored modules and produces misleading audit logs (CWE-117), while a separate time-of-check/time-of-use race between module hiding and import-hook installation lets a concurrent thread re-import modules that were meant to be blocked. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis and it is not on CISA KEV.
CORS misconfiguration in the openssl_encrypt pip package (versions before 1.4.0) enables any website to issue fully credentialed cross-origin API requests on behalf of authenticated users, exposing sensitive API responses to attacker-controlled origins. Both standalone server components - key-server and telemetry-server - ship with the maximally permissive combination of allow_origins=["*"] and allow_credentials=True as their default configuration, propagated through docker-compose.yml and .env.example. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is known at time of analysis, though the attack pattern is a well-understood, low-complexity web exploit.
Information disclosure in the openssl-encrypt Python pip package (jahlives/openssl_encrypt, all versions before 1.4.0) allows any unauthenticated network caller to extract sensitive database infrastructure details by hitting the /ready health-check endpoint. The endpoint returns raw Python exception strings - including database hostnames, IP addresses, port numbers, driver version, and potentially credentials embedded in connection strings - whenever a database error is triggered. No public exploit code has been identified at time of analysis, but the attack requires only a standard HTTP client and no special conditions against default deployments.
Secret disclosure affects the openssl_encrypt Python library (all versions before 1.4.0), where PublicKeyBundle.from_dict() constructs key bundles from untrusted serialized data without validating the embedded self-signature, and to_identity() then promotes that unverified bundle into a usable Identity. An application that deserializes an attacker-supplied bundle and encrypts to it - without an intervening verify_signature() call - will encrypt secrets to an attacker-controlled public key, allowing the attacker to decrypt them. Reported by VulnCheck and fixed in 1.4.0; no public exploit has been identified at time of analysis.
Cryptographically weak PRNG use in openssl_encrypt before 1.4.0 exposes steganographic pixel selection to full state-recovery attacks. The library's steganography module seeds Python's Mersenne Twister with only 64 bits of SHA-256 hash material derived from the user password, then uses it to select pixel positions for hidden data - a design flaw captured by CWE-338. Any attacker who knows or can brute-force the steganography password can deterministically reconstruct the PRNG sequence and enumerate every pixel carrying concealed data, breaking steganographic confidentiality entirely. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the MT state-recovery technique is well-documented and requires no novel research.
Password exposure in openssl_encrypt before version 1.4.0 allows any local system user to capture plaintext encryption and keystore passwords by reading process argument listings. When operators pass credentials via the --password or -p CLI flags, those values appear verbatim in /proc/[pid]/cmdline and ps aux output on Linux/Unix multi-user systems. No public exploit is identified at time of analysis, though exploitation requires only standard POSIX utilities universally available on Linux; the CVSS 4.0 vector's AV:N designation appears miscalibrated - actual attack surface is local, meaningfully limiting real-world risk.
openssl_encrypt (pip, versions <= 1.4.7) unconditionally prints a derived hardware pepper as a hex string to stdout/stderr when the 'hsm fido2-test' or 'hsm onlykey-test' diagnostic commands are invoked, with output potentially persisting in CI build logs, terminal scrollback buffers, or session recordings. A secondary exposure exists where a related plugin component logged raw prf_data values outside the library's secret-redaction pathway. No public exploit has been identified and no CISA KEV listing exists; critically, the vendor description explicitly states the leaked pepper is derived from a random per-invocation test salt and is salt-bound, meaning it cannot be used to decrypt real files, substantially constraining actual impact despite the elevated CVSS 4.0 score of 8.7.
Unthrottled brute-force against SiYuan's Publish Service Basic Auth allows remote unauthenticated attackers to enumerate passwords against named publish-viewer accounts and gain read access to published notes and notebooks. All SiYuan releases before 3.7.4 are affected wherever the Publish Service is enabled and network-accessible on its default TCP port 6808. No public exploit code has been identified at time of analysis, but the attack is trivially automatable using any standard HTTP client given the complete absence of rate limiting, per-account lockout, or exponential backoff in the vulnerable code path.
Cross-site WebSocket hijacking in SiYuan before 3.7.4 lets a remote unauthenticated attacker weaponize the victim's running SiYuan instance as a network proxy to arbitrary attacker-chosen targets. The /ws/network/proxy endpoint explicitly disables WebSocket origin validation by setting CheckOrigin to unconditionally return true, allowing malicious webpages to open unauthorized WebSocket connections through the victim's browser and issue proxy commands to the SiYuan kernel. No public exploit is confirmed in CISA KEV, but SSVC flags a POC exists; the CVSS 4.0 score is 7.1 and EPSS is 0.10%, indicating limited observed exploitation at time of analysis.
Unauthenticated information disclosure in SiYuan before 3.7.4 exposes Go net/http/pprof debug endpoints (heap, goroutine, and related dumps) to any remote client whenever the application is not started with --mode set exactly to prod. Because non-prod is the effective default, attackers can query /debug/pprof/heap to scrape live process memory and recover secrets such as the AccessAuthCode and configured AI provider API keys. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis.
Arbitrary code execution in CompuGroup Medical CGM ISIS MED 2510.1.0.20 is achievable when a local attacker plants a crafted DLL in a path searched by the application (CWE-427: Uncontrolled Search Path Element). Despite the description labeling this a 'remote' attack, the NVD CVSS vector is AV:L/UI:R, consistent with classic DLL hijacking - delivery of the malicious DLL may occur remotely (phishing, network share), but exploitation is local and requires the victim to launch the application. A proof-of-concept is publicly available per SSVC data and the researcher's GitHub repository, though no CISA KEV listing confirms active exploitation.
Information disclosure in the Mahara ePortfolio platform before 25.04.5 and 26.04.0 allows remote attackers to retrieve backed-up content belonging to a different Text block/section by crafting a request in a specific way. The flaw (CWE-200) exposes stored draft or historical text that should be isolated per section, potentially leaking other users' or other pages' content. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Silent OAuth 1.0a-to-1.0 protocol downgrade in the Perl module Net::OAuth::Client (versions before 0.32) lets a service provider strip the anti-session-fixation protection an application explicitly requested. When an app configures a callback (selecting 1.0a) but the provider's request-token response omits oauth_callback_confirmed, get_request_token silently reverts to OAuth 1.0, which drops the oauth_verifier from the access-token exchange with no exception or warning, re-exposing the app to OAuth session fixation. No public exploit identified at time of analysis; EPSS is low (0.21%) and this is not in CISA KEV, but the fix is vendor-confirmed in release 0.32.
OpenTofu's provider cache installer in all versions before 1.11.7 (and 1.10.x before 1.10.10) writes provider package contents to arbitrary filesystem locations when a malicious symlink is pre-positioned inside the .terraform/providers directory, allowing files controlled by the attacker to be placed anywhere the OpenTofu process has write permission. If an attacker can control the contents of a working directory — for instance through a malicious git repository, shared filesystem, or coerced developer workflow — they can include a crafted symlink pointing to a sensitive path outside the working tree, and a subsequent `tofu init` will follow that symlink and overwrite its target with attacker-supplied provider package content. No public exploit has been identified at time of analysis and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog; vendor-released patches for both active release branches are available.
Information disclosure and authorization bypass in Scriban (the .NET text templating engine) before 7.0.0 lets attackers retrieve previously authorized include-template content from earlier renders. Because TemplateContext.Reset() clears output, globals, cultures, and source files but never clears the CachedTemplates dictionary, applications that pool a TemplateContext across requests and use a request-, tenant-, or user-dependent ITemplateLoader will serve a stale cached template to a later, less-privileged render without re-invoking TemplateLoader.Load(). A vendor patch exists (7.0.0) and a working proof-of-concept is published in the GHSA advisory, but there is no public exploit identified as used in active attacks.
Unthrottled API-token brute force in SiYuan kernel before 3.7.4 lets an unauthenticated remote attacker repeatedly guess the Conf.Api.Token because the CheckAuth() middleware bypasses the app's CAPTCHA/lockout controls (NeedCaptcha/WrongAuthCount). Reported by VulnCheck and fixed in 3.7.4, a successful guess yields full RoleAdministrator access, permitting arbitrary file operations and SQL queries. There is no public exploit identified at time of analysis and it is not in CISA KEV, though the CVSS 4.0 base score is 9.3.
Unauthenticated information disclosure in CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 exposes media attachment metadata - including titles, file types, sizes, and direct URLs - from any configured folder, including those never published to a gallery. The missing authorization checks on REST API endpoints mean any external party can enumerate private document libraries without credentials. A publicly available exploit exists per WPScan, though EPSS sits at just 0.17% (7th percentile), suggesting limited observed exploitation activity at time of analysis.
Server-side template injection in siyuan's attribute-view Template calculation feature (versions 3.7.0-beta.1 through 3.7.3) allows any local OS user to read the siyuan process's environment variables and conduct DNS lookups from the server's network position. The vulnerability exists because the Sprig template function map is used unmodified, reintroducing env, expandenv, and getHostByName functions that were specifically removed in a prior remediation (CVE-2024-55660). Because the siyuan kernel binds to 127.0.0.1 with no per-UID access control, a separate unprivileged OS account sharing the same host can exploit this without any application-level credentials. No public exploit has been identified at time of analysis; vendor-released patch v3.7.4 is available.
Authentication brute-force leading to full admin takeover affects SiYuan, a self-hosted personal knowledge-management/note-taking application, in versions before v3.7.4. The HTTP Basic Authentication branch of the CheckAuth() middleware - which protects almost the entire /api/* surface - validates the workspace access code without enforcing the CAPTCHA/lockout controls or the failure counter that guard the normal cookie/session login, letting unauthenticated remote attackers make unlimited automated guesses to recover the admin access code and gain RoleAdministrator control of the kernel. A non-constant-time comparison of the access code adds a secondary timing side channel. No public exploit identified at time of analysis, but the flaw is trivially scriptable.
Unauthenticated brute-force of per-notebook publish passwords is possible in SiYuan before 3.7.4 due to the complete absence of rate limiting or CAPTCHA on the authFilePublishAccess endpoint. Any network-reachable SiYuan instance with the notebook publishing feature enabled and at least one password-protected published notebook is exposed to automated credential guessing, potentially disclosing the notebook's full contents to an unauthorized party. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS 4.0 score of 8.7 reflects the trivially low exploitation barrier once a suitable target is identified.
Key-based authorization bypass in @fastify/jwt before 10.2.2 permits any low-privileged authenticated user holding a token signed by the application's global secret to access routes explicitly restricted to a separate per-request key, silently crossing a cryptographic trust boundary. Applications implementing multi-domain JWT authorization - for example, separating user and admin token verification keys - are specifically at risk, as the plugin's option merge incorrectly applies the global key last, overriding the developer-supplied per-request key. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the fix is available in version 10.2.2 and the attack path is mechanically straightforward for any authenticated user.
Password reset link poisoning in the Perl module Dancer2::Plugin::Auth::Extensible (all versions through 0.713) lets an unauthenticated remote attacker trigger a genuine reset email whose link points to an attacker-chosen host, enabling account takeover. Because the reset link's authority is built from the untrusted request Host header (or X-Forwarded-Host under behind_proxy), a victim who clicks hands a valid reset code to the attacker's server. There is no public exploit identified at time of analysis; EPSS is low (0.28%, 21st percentile) and CISA SSVC lists exploitation as none, but the flaw is marked automatable with total technical impact.
Use-after-free in the Linux kernel Thunderbolt XDomain subsystem enables a physically adjacent attacker with a malicious Thunderbolt device to corrupt kernel memory, potentially achieving code execution at kernel privilege level. The flaw stems from a race condition introduced when commit 559c1e1e0134 moved tb_xdp_handle_request() to the system workqueue, breaking the serialization with the disconnect path and creating a window where queue_delayed_work() can fire on a freed xdomain object. No public exploit has been identified and EPSS (0.16%, 5th percentile) confirms very low near-term exploitation probability, though the kernel-level impact makes this relevant for organizations operating Thunderbolt-enabled endpoints in adversarial physical environments.
Deadlock and use-after-free conditions in the Linux kernel's IDXD character device driver expose local low-privileged users on Intel DSA-equipped systems to potential kernel memory corruption or denial of service. The vulnerability resides in `idxd_cdev_open()`, where error cleanup paths call `put_device(fdev)` while still holding `wq->wq_lock`, causing `idxd_file_dev_release()` to deadlock on synchronous reentry; a secondary fallthrough defect then allows `idxd_xa_pasid_remove(ctx)` and `kfree(ctx)` to operate on memory already freed by that release callback. No public exploit has been identified at time of analysis, and an EPSS score of 0.16% (6th percentile) reflects the low observed exploitation probability consistent with the specialized hardware prerequisite.
Out-of-bounds kernel memory read and incomplete invalidation affect the Linux kernel's ARM SMMUv3 iommufd nested-virtualization path (arm_vsmmu_vsid_to_sid), where a guest virtual Stream ID is mapped to a single physical Stream ID from master->streams[0]. On ARM64 hosts using nested SMMUv3 with iommufd vDEVICE, assigning a device that has zero streams turns master->streams into a ZERO_SIZE_PTR that is read out of bounds, while a device with multiple streams leaves the other streams' ATC/IOTLB entries unreachable by guest invalidations. There is no public exploit identified at time of analysis, and EPSS is very low (0.15%, 5th percentile), consistent with a niche subsystem rather than broad exploitability despite the 9.3 CVSS.
Deadlock in the Linux kernel btrfs zoned filesystem causes an unrecoverable filesystem hang on hosts using zoned block devices (SMR HDDs or ZNS SSDs). The writeback path in btree_writepages() holds zoned_meta_io_lock while the tree-log block group fallback path waits for a transaction commit, while the concurrent transaction commit path blocks on that same lock - a classic ABBA deadlock resulting in complete filesystem unavailability. No public exploit exists and EPSS is 0.16% (5th percentile), reflecting a niche-deployment reliability issue rather than a broad security threat; the condition can be triggered by normal I/O stress and was confirmed reproducible via fstests generic/475.
Out-of-bounds kernel memory read in the Linux netfilter SIP connection-tracking helper (nf_conntrack_sip) lets remote attackers crash or leak memory from any host doing SIP NAT rewriting. When sip_help_tcp() NAT-rewrites a SIP message, the per-message size delta is stored in a signed 16-bit variable; a single message with a long Contact list can grow by more than S16_MAX (while still under the 65535 enlarge_skb limit), wrapping the counter so datalen underflows to a huge unsigned value and ct_sip_get_header() reads past the linearized skb tail (KASAN use-after-free). Tagged Information Disclosure; no public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile).
Local privilege escalation and host memory corruption in the Linux kernel's KVM arm64 virtual GIC (vgic) LPI handling allows a malicious guest to trigger a use-after-free by racing LPI release against re-registration. Affecting arm64 KVM hosts (introduced by the LPI refcounting rework, present through Linux 6.17), a guest that issues an ITS DISCARD while an LPI is still referenced and then re-maps the same INTID via MAPTI can cause the kernel to erase a newly registered LPI from the xarray or leak an orphaned structure. There is no public exploit identified at time of analysis and EPSS is low (0.14%), but the scope-changing guest-to-host impact makes this a meaningful host-integrity issue.
Use-after-free in the Linux kernel's nf_tables netfilter subsystem exposes local attackers with low-privilege accounts to potential kernel-level privilege escalation by exploiting a race condition in nft_object lifecycle management across network namespaces. The nft_object rhltable was implemented as a global structure, meaning that as one network namespace tears down its objects via nft_rcv_nl_event(), another namespace can still resolve pointers to those objects through the shared lookup table - and since nft_obj_destroy() frees memory immediately, a concurrent lookup dereferences freed memory. No active exploitation has been identified (not in CISA KEV) and EPSS sits at 0.16% (5th percentile), though the vulnerability's kernel-level impact warrants patching on multi-tenant and containerized Linux hosts.
Uninitialized memory access in the Linux kernel's netfilter xt_hashlimit module allows local users with netfilter rule configuration privileges to read uninitialized kernel memory and potentially corrupt rate-limiting state. The flaw exists in the .checkentry validation path, which failed to detect when XT_HASHLIMIT_RATE_MATCH mode is applied across multiple rules sharing the same hashtable, leaving the burst field in the dsthash_ent union uninitialized. No public exploit or CISA KEV listing exists at time of analysis; an EPSS score of 0.16% reflects low near-term exploitation probability.
Use-after-free in the Linux kernel's RDS/TCP subsystem allows a local authenticated attacker to read freed kernel memory via a race condition in `rds_tcp_laddr_check()`, potentially enabling privilege escalation. The flaw is triggered through the `bind()` syscall when the RCU read lock is incorrectly released between a `dev_get_by_index_rcu()` lookup and a subsequent `ipv6_chk_addr()` call, creating a window for concurrent interface deletion to free the `net_device` struct. No public exploit is identified at time of analysis, and EPSS of 0.16% (5th percentile) indicates low near-term exploitation probability despite the CVSS 7.8 High rating.
Use-after-free in the Linux kernel's IPv6 nexthop routing subsystem allows a local low-privileged attacker to corrupt kernel memory by racing nexthop replace operations against concurrent IPv6 route deletion. The functions fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list under RTNL serialization without holding nh->lock, while IPv6 route add/delete operations mutate that same list under nh->lock without RTNL, creating a window where a freed fib6_info struct is read. No public exploit is confirmed in CISA KEV and EPSS is a low 0.14%, but KASAN stack traces embedded in the advisory (tasks 'exploit/142' and 'exploit/143') confirm the race was reproducibly triggered, and the vendor has released fix commits to the stable kernel trees.
Use-after-free race condition in the Linux kernel nexthop subsystem (net/ipv4/nexthop.c) allows a local attacker with low-privilege access to trigger slab-use-after-free in kernel memory, potentially achieving full kernel code execution with scope change across the system. The race occurs between nh_rt_cache_flush() walking nh->f6i_list without holding nh->lock and concurrent IPv6 route add/delete operations freeing fib6_info entries under nh->lock - confirmed by an in-kernel KASAN trace naming the task 'exploit/146'. This CVE carries a CVSS 3.1 score of 8.8 (S:C, C:H/I:H/A:H) but EPSS of 0.14% (4th percentile) and no CISA KEV listing indicate no confirmed active exploitation at time of analysis.
Stale kernel memory leaks to userspace through an off-by-two bounds error in the Linux kernel's libiscsi subsystem, specifically in `iscsi_scsi_cmd_rsp()`. Systems running an iSCSI initiator (libiscsi loaded) that connect to a malicious or compromised iSCSI target are exposed: the target crafts a SCSI Response PDU where the data segment length equals the declared sense length, causing a `memcpy()` to read two bytes past the received buffer boundary into stale `conn->data` contents, which are then returned to userspace in the SCSI sense buffer. No public exploit exists and EPSS stands at 0.16% (5th percentile); exploitation requires adversary control of an iSCSI target the victim connects to, making this a concern primarily for enterprise iSCSI storage environments rather than general internet-facing systems.
Un-rate-limited ICMP and NDISC Redirect packet storms are possible in the Linux kernel when peer entry allocation fails inside `inet_getpeer_v4()` or `inet_getpeer_v6()`, affecting all kernels from 2.6.39 through the fixed stable releases. A remote unauthenticated attacker who can trigger peer table exhaustion against a Linux system acting as a network forwarder can cause the kernel to emit unbounded ICMP/NDISC Redirect messages, producing severe network availability degradation. No public exploit or proof-of-concept is identified at time of analysis, and EPSS sits at 0.17%, but the no-authentication CVSS profile warrants prompt patching on any Linux routing infrastructure.
Use-after-free in the Linux kernel's forcedeth Ethernet driver allows a local user to trigger kernel memory corruption during device removal. The driver's nv_remove() function frees per-CPU txrx_stats before unregister_netdev() completes, leaving the ndo_get_stats64 statistics path, NAPI polling, xmit data path, and nv_close()/drain all capable of accessing the already-freed structure. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and no public exploit identified at time of analysis, the immediate risk is narrow but the potential for local privilege escalation on systems with NVIDIA nForce-era hardware warrants prompt patching.
A double-free memory-corruption defect in the Linux kernel's rtase Realtek automotive Ethernet driver allows the same multi-fragment socket buffer to be freed twice when the transmit path hits a DMA mapping failure. It affects hosts running the rtase driver (Realtek multi-gigabit/automotive NICs) on kernel 6.12 and related stable trees, and can lead to kernel memory corruption and denial of service. No public exploit has been identified at time of analysis; EPSS is low (0.17%, 7th percentile) and the CVE is not on CISA KEV.
Use-after-free in the Linux kernel Bluetooth ISO subsystem allows a physically adjacent, unauthenticated attacker to corrupt kernel heap memory, potentially enabling privilege escalation or a denial-of-service crash. The defect exists in `iso_sock_disconn()`, where clearing `conn->hcon = NULL` omits the required `conn->hcon->iso_data = NULL` reset, leaving a dangling pointer that `iso_conn_free()` later dereferences. Patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.44, 7.1.8); no confirmed active exploitation is on record despite the high CVSS score, consistent with the very low EPSS of 0.17% and the specialized Bluetooth ISO attack surface.
Use-After-Free in the Linux kernel's Bluetooth L2CAP LE connection response handler exposes systems with Bluetooth enabled to potential kernel-level memory corruption by an adjacent, unauthenticated attacker. The flaw in `l2cap_le_connect_rsp()` stems from missing reference-count protection on a channel object, allowing a concurrent remote-disconnect-triggered `l2cap_chan_del()` to free the object between lookup and lock - a pattern already fixed in the BR/EDR counterpart but overlooked here. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.17%, and no public exploit code has been identified, though the kernel-level UAF impact class is inherently severe if triggered.
Missing socket lock in the Linux kernel Bluetooth ISO subsystem exposes a race condition in iso_sock_getname that allows a low-privileged adjacent attacker to trigger a use-after-free or null-pointer dereference via concurrent connection teardown. Systems running affected kernel versions with Bluetooth ISO (Isochronous) sockets enabled are vulnerable to kernel crashes or memory disclosure. No public exploit code exists and EPSS probability is 0.17%, but the CVSS 8.0 score reflects the potential for high-impact memory corruption if the race is won.
Race condition in the Linux kernel Bluetooth ISO subsystem allows an adjacent, unauthenticated attacker to trigger a NULL pointer dereference or memory corruption by sending crafted Bluetooth LE ISO connection events targeting a socket concurrently transitioning out of LISTEN or CONNECT state. Affected kernels span the 6.8.9 through pre-6.9 range, with backported fixes confirmed for stable releases 6.18.44 and 7.1.8. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), though the kernel-level impact and Bluetooth-adjacent unauthenticated access vector justify the vendor's 8.8 CVSS rating.
Use-after-free race condition in the Linux kernel's Bluetooth ISO subsystem allows an unauthenticated attacker within Bluetooth adjacency range to corrupt kernel memory by exploiting concurrent socket teardown in iso_conn_ready(), potentially leading to privilege escalation or system crash on affected hosts. The flaw - present since the introduction of Bluetooth 5.2 ISO channel support in Linux 5.15 - arises because conn->sk is dereferenced without holding a lock or refcount, enabling a concurrent iso_sock_release() call to free the socket before iso_conn_ready() completes its dereference. No public exploit or CISA KEV entry exists at time of analysis, and the EPSS score of 0.17% (6th percentile) reflects very low near-term exploitation probability despite the High CVSS score.
Concurrent deadlock and use-after-free (UAF) vulnerabilities in the Linux kernel's Bluetooth ISO socket layer allow adjacent-network attackers to corrupt kernel memory via race conditions in `iso_sock_timeout()`. Affected systems must be within Bluetooth radio range; no authentication is required. No public exploit code and no CISA KEV listing have been identified - EPSS of 0.17% (6th percentile) reflects low current exploitation probability despite the high CVSS score of 8.8.
Use-after-free via reference counting race in the Linux kernel's Bluetooth ISO (LE Audio) subsystem allows an adjacent, unauthenticated attacker to potentially achieve kernel-level code execution or information disclosure. The race arises between concurrent execution of iso_conn_del() and iso_chan_del() in separate kernel tasks, resulting in a double-put of the iso_conn object and subsequent memory corruption. Affected stable branches span Linux 6.11.11 through pre-6.13 series; upstream patches are available in Linux 6.18.44, 7.1.8, and 7.2-rc6. No public exploit code exists and no active exploitation has been confirmed, consistent with a very low EPSS score of 0.17%.
Use-after-free race condition in the Linux kernel Bluetooth ISO subsystem allows an adjacent, unauthenticated attacker to trigger kernel memory corruption with full confidentiality, integrity, and availability impact. The flaw resides in the hci_conn::iso_data field, which is read and modified across concurrent kernel tasks without lock or RCU protection - allowing a kfree() in one task to race against a kref_get_unless_zero() in another, yielding a dangling pointer dereference. No public exploit code has been identified and EPSS exploitation probability is 0.15% (5th percentile), but kernel UAF primitives are well-understood by skilled attackers and the Bluetooth adjacency requirement is the primary limiting factor for mass exploitation.
Use-after-free (UAF) in the Linux kernel Bluetooth HCI connection subsystem exposes adjacent-network attackers to potential kernel memory corruption via a race condition in abort_conn_sync(). The hci_conn object can be freed while the hci_sync task is still executing against it, because no reference count is held across the async operation - a classic lifetime management failure in kernel concurrent code. No public exploit has been identified and EPSS sits at only 0.17% (6th percentile), but the CVSS 8.8 score reflects the theoretical full-system impact if the race is successfully won. The vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at time of analysis.
Use-after-free in the Linux kernel Bluetooth HCI synchronization subsystem (hci_sync) creates a theoretical kernel memory corruption risk via a race condition in the hci_connect_big_sync() callback. The conn (connection) struct can be freed while the hci_sync asynchronous task is still executing, potentially allowing an adjacent, unauthenticated attacker within Bluetooth range to trigger a dangling pointer dereference in kernel context. No public exploit identified at time of analysis and EPSS stands at 0.15% (5th percentile), but patches are available across multiple Linux stable branches and should be applied as routine maintenance.
Use-after-free in the Linux kernel Bluetooth hci_sync subsystem exposes local users with low privileges to potential kernel heap corruption via a race condition in `hci_connect_pa_sync()`. The `conn` connection object can be freed by one code path while the asynchronous hci_sync callback is still executing, allowing a local attacker on affected 6.12.x, 6.14.x, and 6.15.x kernel branches to corrupt kernel memory and potentially achieve full privilege escalation. No public exploit code has been identified, and EPSS of 0.15% (5th percentile) confirms very low exploitation probability at this time - no confirmed active exploitation (not in CISA KEV).
Use-after-free in the Linux kernel's Bluetooth HCI synchronization subsystem allows an adjacent-network attacker with low privileges to pass freed hci_conn pointers to hci_conn_valid(), where kmalloc may have reallocated that memory to unrelated objects. Affected Linux kernel versions across multiple stable branches expose systems with active Bluetooth to potential kernel memory corruption, yielding full confidentiality, integrity, and availability impact at the kernel level. No public exploit code has been identified and CISA KEV does not list this CVE; however, the HIGH CVSS score and kernel-level CIA:H/H/H impact justify prompt patching on any Bluetooth-enabled Linux host.
Local privilege escalation in the Linux kernel's octeontx2-af driver (Marvell OcteonTX2 hardware) allows a low-privileged Virtual Function (VF) tenant to overwrite the Physical Function's (PF) shared CGX hardware PKIND configuration, corrupting HiGig2 or EDSA packet parsing state and achieving high confidentiality, integrity, and availability impact across the PF boundary. The vulnerability arises because VF NIX LF allocation did not check whether the LMAC was already configured with a privileged PKIND before resetting it. No public exploit code has been identified and EPSS is 0.15% (5th percentile), indicating very low exploitation probability, though the changed-scope CVSS vector reflects genuine cross-tenant hardware corruption potential in SR-IOV deployments.
Deadlock in the Linux kernel qede NIC driver's recovery path permanently wedges the rtnetlink control plane of any affected host when a TX timeout fires on a QLogic/Cavium FastLinQ interface with VXLAN or GENEVE tunnel ports configured. Systems in this state remain pingable but every subsequent caller of rtnl_lock - including ip, sshd, ovs-vswitchd, IPv6 addrconf, and lldpad - blocks indefinitely, denying all network management access until reboot. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the impact on unpatched datacenter hosts in tunnel-overlay environments is severe and patch adoption should be prioritized.
Use-after-free memory corruption in the Linux kernel's ksmbd SMB server subsystem exposes systems running the in-kernel file-sharing daemon to potential kernel-level compromise by an authenticated remote attacker. Affected are Linux kernel versions beginning at commit 8510a043d334ecdf83d4604782f288db6bf21d60 (ksmbd introduction) through multiple stable branches, with vendor-released patches confirmed in 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. No public exploit code has been identified and EPSS stands at 0.17% (6th percentile), indicating no observed mass exploitation at time of analysis despite the CVSS 8.8 severity rating.
Session-binding authentication weakness in the Linux kernel's ksmbd in-kernel SMB3 server allows different SMB clients to be treated as identical because ClientGUID values were compared with strncmp(), which halts at the first embedded NUL byte. An attacker able to reach an exposed ksmbd share could exploit this to bind to another client's authenticated SMB3 multichannel session or bypass FSCTL_VALIDATE_NEGOTIATE_INFO integrity checks, exposing high confidentiality and integrity impact per the CVSS 9.1 rating. There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), indicating no observed exploitation activity.
Use-after-free in the Linux kernel's IOMMUFD subsystem (iommu/iommufd) exposes systems running VFIO device passthrough to kernel memory corruption by a local low-privileged attacker, with a scope change that may cross security boundaries into the hypervisor layer. The flaw, present since Linux 6.11, stems from a race between IOPF group acceptance by the fault handler and concurrent device detach operations, leaving IOMMUFD's deliver list holding references to memory already freed by the generic pending list cleanup path. No public exploit or active exploitation has been identified at time of analysis - EPSS stands at 0.17% (6th percentile) and the vulnerability is absent from CISA KEV - though the CVSS 3.1 score of 8.8 reflects the severity of potential impact in affected virtualization environments.
List corruption in the Linux kernel's hugetlb memory management subsystem (`mm/hugetlb`) allows a local low-privileged attacker to trigger kernel memory corruption, potentially achieving privilege escalation or host crash. The flaw was confirmed as causing real-world KVM host panics in dense virtualization environments where QEMU and SPDK/DPDK vhost-user processes share a hugetlbfs MAP_SHARED mapping; with CONFIG_DEBUG_LIST disabled, the corruption silently embeds a kernel stack address into an active cache list, setting up a use-after-free. No public exploit has been identified at time of analysis; EPSS is 0.17% and the vulnerability is not in CISA KEV, but fixed stable kernel releases are available across all active branches.
KVM on AMD SVM-enabled hosts fails to update x2APIC MSR intercepts when AVIC is inhibited while a nested guest (L2) is running, allowing an L1 guest with root-level privileges to directly access the host's APIC state, send arbitrary interrupts, and crash the host kernel. Affected Linux kernels from 6.0 through multiple stable branches expose the host to interrupt manipulation, task priority changes, and denial-of-service. A functional proof-of-concept demonstrating both spurious interrupt injection and wakeup handler corruption is embedded in the CVE description itself; this vulnerability is not currently listed in the CISA KEV catalog and carries a 0.17% EPSS score consistent with its narrow but severe exploitation conditions.
KVM s390 PCI subsystem in the Linux kernel allows a local low-privileged user to corrupt hypervisor resources by repeatedly calling the adapter interrupt forwarding ioctl for the same zPCI device without prior unregistration. The vulnerability affects IBM Z (s390) systems running Linux KVM with PCI passthrough from commit 3c5a1b6f onwards (Linux 6.0+), with patched stable releases available. No public exploit exists and EPSS sits at 0.17% (6th percentile), reflecting the niche architecture and local-access prerequisite, but the CVSS Scope:Changed designation signals the flaw can cross the guest-to-hypervisor boundary, elevating its priority on affected IBM Z KVM deployments.
Use-after-free in the Linux kernel's dibs loopback subsystem allows a local low-privileged attacker to corrupt kernel memory during concurrent DMB node attach, detach, and unregister operations. The vulnerability arises from a race window between hash table lookup under dmb_ht_lock and the subsequent refcount operation performed after the lock is dropped, enabling a concurrent unregister path to free the node before the refcount transition completes. With a CVSS score of 7.8 and C:H/I:H/A:H impact metrics, successful exploitation can lead to privilege escalation or kernel crash; however, no public exploit is identified at time of analysis and EPSS at 0.17% reflects low current exploitation probability.
Use-after-free in the Linux kernel audit subsystem's `audit_del_rule()` function exposes systems from kernel 4.3 onward to local privilege escalation. The flaw stems from incorrect RCU ordering: fsnotify mark resources tied to `e->rule.exe` are freed before the rule is unlinked from RCU-visible filter lists, creating a window where concurrent `audit_filter()` and `audit_filter_rules()` readers dereference already-freed memory. Patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Linux kernel Bluetooth management subsystem allows a local low-privileged user to corrupt kernel heap memory by racing MGMT_OP_SET_LOCAL_NAME against MGMT_OP_REMOVE_UUID on systems with a powered BR/EDR-capable Bluetooth controller. The race exploits a missing lock acquisition in pending_eir_or_class() and the omission of MGMT_OP_SET_LOCAL_NAME from EIR-serialization logic, enabling a freed pending command entry to be read during EIR reconstruction. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), but the kernel UAF primitive and confirmed 7.8 CVSS score make patching a clear priority for Bluetooth-enabled systems.
Use-after-free in the Linux kernel Bluetooth management subsystem allows a low-privileged local attacker to corrupt kernel heap memory and achieve privilege escalation to root. Kernels from approximately 2.6.39 through unpatched revisions of the 6.6.x, 6.12.x, 6.18.x, and 7.1.x stable series are vulnerable when Bluetooth hardware is present and the mgmt interface is accessible. No public exploit has been identified at time of analysis, and EPSS at 0.20% (10th percentile) reflects limited current exploitation probability, though UAF primitives in the Linux kernel are historically weaponized following public disclosure.
Use-after-free in the Linux kernel Bluetooth hci_sync subsystem exposes kernel heap memory to corruption via a race condition between advertising instance teardown and HCI command synchronization. Systems running affected kernel versions (from commit cba6b758711cab946c787f7c15be92cc749b8e1f across 5.15.x, 6.12.x, 6.18.x stable branches) with active Bluetooth LE extended advertising are vulnerable to exploitation by attackers within Bluetooth radio range. The kernel-level UAF can yield arbitrary code execution in kernel context with full C/I/A impact; no public exploit has been identified and EPSS sits at the 6th percentile, indicating purely theoretical exploitation risk at this time.
Uninitialized memory read and session hijack in the Linux kernel Bluetooth HIDP subsystem exposes systems with active Bluetooth HID sessions to kernel memory disclosure and forced session termination from an unauthenticated adjacent attacker. The functions hidp_recv_ctrl_frame() and hidp_recv_intr_frame() dereference skb->data[0] before validating that the received L2CAP SDU is at least one byte long, allowing a connected peer to feed an empty frame and cause the kernel to consume a stale tailroom byte - or, via a crafted HCI ACL packet, a fully attacker-controlled byte interpreted as a synthetic HIDP transaction code. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Bluetooth HIDP in the Linux kernel exposes an uninitialized-memory read and a peer-controlled out-of-bounds byte access in hidp_session_run() when processing numbered HID report responses. Systems running Linux with active Bluetooth HID sessions are vulnerable to a malicious adjacent Bluetooth peer leveraging this to disclose kernel memory contents (rated C:H, enabling potential KASLR bypass) or manipulate HIDIOCGFEATURE report completion with attacker-controlled data. No public exploit has been identified, EPSS is 0.17% (6th percentile), and this vulnerability is not listed in CISA KEV.
Use-after-free in the Linux kernel's AFS (Andrew File System) subsystem exposes systems running the kafs module to kernel memory corruption exploitable by local low-privileged users, potentially enabling privilege escalation to root. The race condition in afs_make_call() allows the afs_call structure to be freed by an arriving async server response while the sending function - having transferred its reference rather than retaining one - continues to access the freed memory. EPSS is 0.17% (6th percentile), no CISA KEV listing exists, and upstream fix commits are publicly available on stable kernel trees.
Use-after-free in the Linux kernel ALSA timer subsystem allows an unprivileged local user to corrupt kernel heap memory and escalate privileges to root. The flaw stems from snd_timer_close_locked() setting SNDRV_TIMER_IFLG_DEAD but never clearing it after close completes; when snd_seq_timer_open() retries on the same instance after a forced failure, snd_timer_instance_free() frees an object still referenced across multiple kernel data structures. With CVSS 7.8 and a detailed exploitation path described directly in the upstream kernel commit, this is a credible local privilege escalation on desktop and workstation Linux systems, despite a low EPSS score of 0.17% (6th percentile) and no current CISA KEV listing. No public exploit code has been identified at time of analysis.
Missing bounds enforcement in the Linux kernel ALSA USB audio driver's implicit-feedback path allows a physically-connected malicious USB device to inject oversized sync packets that propagate un-clamped into the playback endpoint queue. The un-clamped frame count - potentially exceeding ep->maxframesize - can drive packet transfers beyond hardware frame limits, risking kernel memory corruption with high confidentiality, integrity, and availability impact. No public exploit has been identified and EPSS is 0.17% (6th percentile), but patches are confirmed across multiple stable kernel branches including 6.6.151, 6.12.103, 7.1.8, and 6.18.44.
Use-after-free in the Linux kernel's FOU (Foo-over-UDP) tunnel subsystem allows a local attacker with low privileges to corrupt kernel memory by exploiting a race condition in fou_create(). The struct fou object is published via sk_user_data before being committed to the per-network-namespace port list; when fou_add_to_port_list() subsequently fails on port-0 requests, the error path frees the object while concurrent RCU readers can still dereference it through fou_from_sock(). Two stable-branch upstream commits (a28d8903, b14361ac) provide the fix; no public exploit has been identified at time of analysis, and EPSS sits at the 5th percentile.
A DMA mapping resource leak in the Linux kernel's igbvf driver (Intel 82576 SR-IOV virtual function NIC) occurs on the TX buffer-mapping error path: an off-by-one in the dma_error cleanup loop leaks exactly one DMA mapping (the packet head) whenever a fragment mapping fails after the head was successfully mapped. The bug traces to a 2010 fix for an endless loop and affects a wide range of stable kernels until patched (fixes landed in 6.6.151, 6.12.103, 6.18.44, 7.1.8 and 7.2-rc6). There is no public exploit identified at time of analysis, EPSS is very low (0.17%), and the practical impact is memory/DMA resource exhaustion rather than the remote code execution suggested by the assigned 9.8 score.
Kernel-level use-after-free in the Linux SMC (Shared Memory Communications) subsystem allows a race between socket close and link group termination to write to freed memory. The flaw lives in the net/smc driver where __smc_lgr_terminate() releases conns_lock after locating a connection in lgr->conns_all but before calling sock_hold(), so a concurrent close can free the embedded socket first. Fixed across multiple stable trees; EPSS is low (0.17%), there is no public exploit identified at time of analysis, and it is not on CISA KEV.
Use-after-free in the Linux kernel netfilter ipset subsystem enables local kernel memory corruption with potential for privilege escalation. During an ipset hash resize (`mtype_resize()`), comment pointers are shallow-copied via `memcpy()` rather than deep-copied, causing both old and new table entries to share the same `ip_set_comment_rcu` pointer; an `xt_SET --add-set --exist` packet hitting the old entry during this window calls `ip_set_init_comment()`, freeing the shared pointer and leaving the new table entry with a dangling reference that is later dereferenced in `strlen()` during backlog replay. Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6), no public exploit has been identified, and EPSS sits at 0.17% (6th percentile), indicating very low observed exploitation pressure at time of analysis.
Use-after-free race condition in the Linux Kernel TIPC subsystem allows a low-privileged attacker to trigger stale-pointer dereference during socket poll trace operations, potentially leading to kernel memory corruption and privilege escalation. The flaw arises because tipc_poll() invokes trace_tipc_sk_poll() without holding the socket lock, enabling tipc_list_dump() to walk live queue members while a concurrent thread dequeues and frees socket buffers (skbs). Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8); no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Linux kernel wifi/mac80211 subsystem allows an adjacent network attacker to trigger kernel memory corruption during Block Acknowledgment session teardown. ieee80211_stop_tx_ba_cb() hands tid_tx to kfree_rcu() and then reads tid_tx->ndp after dropping sta->lock without RCU read-side protection, creating a window where the RCU softirq callback can free the object before the read completes. The vulnerability carries a CVSS 8.8 score (AV:A) but EPSS sits at the 5th percentile with no KEV listing, reflecting the race-condition exploitation complexity; no public exploit has been identified at time of analysis.
Use-after-free and out-of-bounds read in the Linux kernel mwifiex WiFi driver (CVSS 8.8, AV:A) allow an unauthenticated attacker on an adjacent WiFi segment to trigger kernel memory corruption by sending crafted A-MSDU frames containing TDLS payloads. Affected kernel versions span from the commit introducing A-MSDU TDLS handling (circa Linux 4.5, commit 776f742040ca) through all stable branches prior to the fixes in 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the flaw is remotely selectable by the sender through control over A-MSDU subframe layout, making TDLS-capable mwifiex deployments meaningfully exposed from the local wireless segment.
Use-after-free in the Linux kernel's Transparent Huge Page split path exposes systems to kernel memory corruption, potential privilege escalation, or denial of service via a race condition in __folio_split(). Any local low-privilege user on affected kernels prior to the stable fixes in versions 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6 may trigger this by racing a concurrent final iput() against the shmem THP split unlock sequence. No public exploit or PoC has been identified, and the EPSS score of 0.17% (6th percentile) reflects minimal real-world exploitation activity at time of analysis.
Privilege escalation via token disclosure affects QuantumNous New API, an open-source LLM gateway and AI asset management platform, in all versions prior to 1.0.0-rc.7. The admin user-list and user-lookup endpoints (e.g. GET /api/user/) serialize the full User model with only Omit("password"), so User.AccessToken is returned in the access_token field, letting an authenticated administrator harvest the root user's bearer token and pivot to root-only system-configuration APIs. No public exploit identified at time of analysis and it is not in CISA KEV; the fix is confirmed in release 1.0.0-rc.7 (GHSA-6x2c-phff-wx57).
Memory corruption in the kernel-mode driver component of BeyondTrust Endpoint Privilege Management for Windows (all versions prior to 26.1.2) allows a low-privileged local user to trigger an out-of-bounds read, potentially disclosing kernel memory contents or corrupting system state. The flaw is rooted in insufficient input validation within a Ring 0 component - the most privileged execution layer on Windows - amplifying the potential impact of what would otherwise be a constrained user-level action. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fix in version 26.1.2.
Privilege escalation in Dell ObjectScale versions prior to 4.3.0.1 is enabled by an Uncontrolled Search Path Element (CWE-427), allowing a low-privileged local attacker to plant a malicious binary or shared library in a directory that the application resolves before the legitimate path, resulting in code execution under a higher-privileged context. The CVSS 3.1 score of 7.3 reflects full confidentiality, integrity, and availability impact, though the attack is constrained to local access and requires user interaction to trigger the vulnerable operation. Dell has released a fix in version 4.3.0.1 per advisory DSA-2026-328; no public exploit code has been identified at time of analysis.
Redirect URI prefix-matching in Medplum's unauthenticated external IdP callback (GET /auth/external) allows an attacker who can forge or intercept the OAuth state parameter to redirect Medplum authorization codes and login tokens to an attacker-controlled endpoint. All deployments of npm/@medplum/core at version 5.1.5 and below where a ClientApplication has an external identityProvider configured are affected; the fix was released in v5.1.6. Publicly available exploit code exists in the GHSA-m44r-7c5h-m6mj advisory - including curl-based reproduction steps - and because the attacker can inject their own PKCE challenge into the forged state, stolen codes can be redeemed for a full access token without the victim's knowledge, constituting a complete account takeover.
LDAP filter injection in Roundcube Webmail arises from unescaped substitution variables (`%u`, `%fu`, `%d`) embedded directly into LDAP `search_filter` configuration strings, affecting all 1.6.x releases before 1.6.18 and 1.7.x releases before 1.7.3. An authenticated user whose login credentials contain crafted LDAP metacharacters can manipulate server-side directory queries, potentially disclosing LDAP directory contents or escalating privileges by subverting group membership lookups. No active exploitation has been identified at time of analysis (SSVC: Exploitation none), though the low attack complexity and network accessibility warrant prompt patching for any LDAP-backed deployment.
Remote content blocking evasion in Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3 lets a crafted SVG image with an unclosed url() in a FuncIRI attribute slip past the remote-image blocker, so external resources load when a victim views a malicious email. This exposes the recipient's IP, mail-client fingerprint, and email-open telemetry to the sender, and per the advisory may aid further information disclosure or privilege escalation. It has a vendor patch and no public exploit identified at time of analysis; EPSS is low (0.31%) and CISA SSVC rates exploitation as none.
IMAP command injection in Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3 enables authenticated remote attackers to disclose information or escalate privileges by exploiting a desynchronization between mail search operations and LITERAL+ byte-count handling. The flaw was reported by Zach Hanley of Horizon3.ai and is classified as CWE-77 (Command Injection), with the vendor releasing patched versions 1.6.18 and 1.7.3 on 2026-08-09. No public exploit code or CISA KEV listing has been identified at time of analysis, though the C:H/I:H CVSS impact and the researcher's track record for producing working exploits elevate the urgency of patching.
Roundcube Webmail's built-in CSS proxy failed to validate responses from external CSS sources, enabling XSS or information disclosure via browser MIME sniffing in versions before 1.6.18 and 1.7.x before 1.7.3. The CVSS 3.1 score of 7.2 with Changed scope reflects that successful exploitation compromises the victim's browser session within the webmail origin. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept exploit has been identified at the time of analysis.
Credential exposure in Logsign SIEM (versions 6.4.97 up to but not including 6.4.114) allows a high-privilege authenticated user to retrieve embedded sensitive data such as stored integration or log-source credentials. The issue was reported by Turkey's national CERT (TR-CERT, advisory TR-26-0847) and carries a vendor CVSS of 9.0; a fixed release (6.4.114) is available and no public exploit has been identified at time of analysis. Because a SIEM aggregates credentials for many connected systems, recovered secrets can enable pivoting well beyond the SIEM itself.
Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets an attacker reconstruct the KEM shared secret and decrypt all protected ciphertext once they obtain only 16 bytes of the private key. The flaw lives in pqc.py, where any post-quantum KEM decapsulation failure silently falls back to a 'simulation mode' that derives a deterministic secret from those 16 key bytes plus attacker-visible encapsulated-key data, rather than raising an error. Reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break out of the IsolatedPluginExecutor and run arbitrary OS commands. The restricted exec() environment still leaks live Python type objects, so an attacker walks the class hierarchy to reach system primitives despite the intended sandbox. Rated CVSS 4.0 9.3 (critical) and reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run without any isolation because the default process-isolation mode silently fails to enforce its sandbox restrictions. An attacker able to supply or influence a plugin gains unrestricted filesystem, network, subprocess, and full Python-module access equivalent to arbitrary code execution. Reported by VulnCheck with a vendor patch available; no public exploit code or CISA KEV listing is identified at time of analysis (CVSS 4.0 base 9.3).
Hardcoded PostgreSQL credentials embedded in openssl_encrypt standalone server configuration files expose backend databases to unauthorized access in all versions before 1.4.0. Network-adjacent attackers who obtain the well-known static credentials - trivially available from the distributed software package or public advisory - can authenticate directly to the PostgreSQL instance and retrieve sensitive stored data without any legitimate account. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the CWE-798 root cause makes exploitation mechanically trivial for any attacker within network reach of the database port.
Weak cryptographic key derivation in the openssl_encrypt Python library (all versions before 1.4.0) stems from its key-normalization routines invoking HKDF with no salt and a static info parameter, making derived keys deterministic for identical inputs. This reduces effective entropy and weakens resistance to multi-target (batch) attacks, letting an adversary who collects ciphertexts or derived-key material amortize cryptanalytic effort across many victims. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and a vendor patch is available in 1.4.0.
Weak key derivation in openssl_encrypt versions prior to 1.4.0 enables accelerated offline password cracking against files encrypted by the library. The jahlives/openssl_encrypt PHP library implements PBKDF2 in a non-standard construction - using iterations=1 per inner call within an outer application loop - a design whose formal security properties have not been analyzed and whose brute-force resistance is materially lower than a correctly parameterized PBKDF2 implementation. No public exploit code has been identified at time of analysis, and the library has not been listed in CISA KEV; exploitation is bounded to attackers who have already obtained the encrypted artifacts.
Audit-trail corruption and a security-control race condition in the Python library openssl_encrypt (by jahlives) before version 1.4.0 undermine its module-hiding defenses. The restore_hidden_modules() function logs module counts after clearing them, so it always records zero restored modules and produces misleading audit logs (CWE-117), while a separate time-of-check/time-of-use race between module hiding and import-hook installation lets a concurrent thread re-import modules that were meant to be blocked. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis and it is not on CISA KEV.
CORS misconfiguration in the openssl_encrypt pip package (versions before 1.4.0) enables any website to issue fully credentialed cross-origin API requests on behalf of authenticated users, exposing sensitive API responses to attacker-controlled origins. Both standalone server components - key-server and telemetry-server - ship with the maximally permissive combination of allow_origins=["*"] and allow_credentials=True as their default configuration, propagated through docker-compose.yml and .env.example. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is known at time of analysis, though the attack pattern is a well-understood, low-complexity web exploit.
Information disclosure in the openssl-encrypt Python pip package (jahlives/openssl_encrypt, all versions before 1.4.0) allows any unauthenticated network caller to extract sensitive database infrastructure details by hitting the /ready health-check endpoint. The endpoint returns raw Python exception strings - including database hostnames, IP addresses, port numbers, driver version, and potentially credentials embedded in connection strings - whenever a database error is triggered. No public exploit code has been identified at time of analysis, but the attack requires only a standard HTTP client and no special conditions against default deployments.
Secret disclosure affects the openssl_encrypt Python library (all versions before 1.4.0), where PublicKeyBundle.from_dict() constructs key bundles from untrusted serialized data without validating the embedded self-signature, and to_identity() then promotes that unverified bundle into a usable Identity. An application that deserializes an attacker-supplied bundle and encrypts to it - without an intervening verify_signature() call - will encrypt secrets to an attacker-controlled public key, allowing the attacker to decrypt them. Reported by VulnCheck and fixed in 1.4.0; no public exploit has been identified at time of analysis.
Cryptographically weak PRNG use in openssl_encrypt before 1.4.0 exposes steganographic pixel selection to full state-recovery attacks. The library's steganography module seeds Python's Mersenne Twister with only 64 bits of SHA-256 hash material derived from the user password, then uses it to select pixel positions for hidden data - a design flaw captured by CWE-338. Any attacker who knows or can brute-force the steganography password can deterministically reconstruct the PRNG sequence and enumerate every pixel carrying concealed data, breaking steganographic confidentiality entirely. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the MT state-recovery technique is well-documented and requires no novel research.
Password exposure in openssl_encrypt before version 1.4.0 allows any local system user to capture plaintext encryption and keystore passwords by reading process argument listings. When operators pass credentials via the --password or -p CLI flags, those values appear verbatim in /proc/[pid]/cmdline and ps aux output on Linux/Unix multi-user systems. No public exploit is identified at time of analysis, though exploitation requires only standard POSIX utilities universally available on Linux; the CVSS 4.0 vector's AV:N designation appears miscalibrated - actual attack surface is local, meaningfully limiting real-world risk.
openssl_encrypt (pip, versions <= 1.4.7) unconditionally prints a derived hardware pepper as a hex string to stdout/stderr when the 'hsm fido2-test' or 'hsm onlykey-test' diagnostic commands are invoked, with output potentially persisting in CI build logs, terminal scrollback buffers, or session recordings. A secondary exposure exists where a related plugin component logged raw prf_data values outside the library's secret-redaction pathway. No public exploit has been identified and no CISA KEV listing exists; critically, the vendor description explicitly states the leaked pepper is derived from a random per-invocation test salt and is salt-bound, meaning it cannot be used to decrypt real files, substantially constraining actual impact despite the elevated CVSS 4.0 score of 8.7.
Unthrottled brute-force against SiYuan's Publish Service Basic Auth allows remote unauthenticated attackers to enumerate passwords against named publish-viewer accounts and gain read access to published notes and notebooks. All SiYuan releases before 3.7.4 are affected wherever the Publish Service is enabled and network-accessible on its default TCP port 6808. No public exploit code has been identified at time of analysis, but the attack is trivially automatable using any standard HTTP client given the complete absence of rate limiting, per-account lockout, or exponential backoff in the vulnerable code path.
Cross-site WebSocket hijacking in SiYuan before 3.7.4 lets a remote unauthenticated attacker weaponize the victim's running SiYuan instance as a network proxy to arbitrary attacker-chosen targets. The /ws/network/proxy endpoint explicitly disables WebSocket origin validation by setting CheckOrigin to unconditionally return true, allowing malicious webpages to open unauthorized WebSocket connections through the victim's browser and issue proxy commands to the SiYuan kernel. No public exploit is confirmed in CISA KEV, but SSVC flags a POC exists; the CVSS 4.0 score is 7.1 and EPSS is 0.10%, indicating limited observed exploitation at time of analysis.
Unauthenticated information disclosure in SiYuan before 3.7.4 exposes Go net/http/pprof debug endpoints (heap, goroutine, and related dumps) to any remote client whenever the application is not started with --mode set exactly to prod. Because non-prod is the effective default, attackers can query /debug/pprof/heap to scrape live process memory and recover secrets such as the AccessAuthCode and configured AI provider API keys. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis.
Arbitrary code execution in CompuGroup Medical CGM ISIS MED 2510.1.0.20 is achievable when a local attacker plants a crafted DLL in a path searched by the application (CWE-427: Uncontrolled Search Path Element). Despite the description labeling this a 'remote' attack, the NVD CVSS vector is AV:L/UI:R, consistent with classic DLL hijacking - delivery of the malicious DLL may occur remotely (phishing, network share), but exploitation is local and requires the victim to launch the application. A proof-of-concept is publicly available per SSVC data and the researcher's GitHub repository, though no CISA KEV listing confirms active exploitation.
Information disclosure in the Mahara ePortfolio platform before 25.04.5 and 26.04.0 allows remote attackers to retrieve backed-up content belonging to a different Text block/section by crafting a request in a specific way. The flaw (CWE-200) exposes stored draft or historical text that should be isolated per section, potentially leaking other users' or other pages' content. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Silent OAuth 1.0a-to-1.0 protocol downgrade in the Perl module Net::OAuth::Client (versions before 0.32) lets a service provider strip the anti-session-fixation protection an application explicitly requested. When an app configures a callback (selecting 1.0a) but the provider's request-token response omits oauth_callback_confirmed, get_request_token silently reverts to OAuth 1.0, which drops the oauth_verifier from the access-token exchange with no exception or warning, re-exposing the app to OAuth session fixation. No public exploit identified at time of analysis; EPSS is low (0.21%) and this is not in CISA KEV, but the fix is vendor-confirmed in release 0.32.
OpenTofu's provider cache installer in all versions before 1.11.7 (and 1.10.x before 1.10.10) writes provider package contents to arbitrary filesystem locations when a malicious symlink is pre-positioned inside the .terraform/providers directory, allowing files controlled by the attacker to be placed anywhere the OpenTofu process has write permission. If an attacker can control the contents of a working directory — for instance through a malicious git repository, shared filesystem, or coerced developer workflow — they can include a crafted symlink pointing to a sensitive path outside the working tree, and a subsequent `tofu init` will follow that symlink and overwrite its target with attacker-supplied provider package content. No public exploit has been identified at time of analysis and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog; vendor-released patches for both active release branches are available.
Information disclosure and authorization bypass in Scriban (the .NET text templating engine) before 7.0.0 lets attackers retrieve previously authorized include-template content from earlier renders. Because TemplateContext.Reset() clears output, globals, cultures, and source files but never clears the CachedTemplates dictionary, applications that pool a TemplateContext across requests and use a request-, tenant-, or user-dependent ITemplateLoader will serve a stale cached template to a later, less-privileged render without re-invoking TemplateLoader.Load(). A vendor patch exists (7.0.0) and a working proof-of-concept is published in the GHSA advisory, but there is no public exploit identified as used in active attacks.
Unthrottled API-token brute force in SiYuan kernel before 3.7.4 lets an unauthenticated remote attacker repeatedly guess the Conf.Api.Token because the CheckAuth() middleware bypasses the app's CAPTCHA/lockout controls (NeedCaptcha/WrongAuthCount). Reported by VulnCheck and fixed in 3.7.4, a successful guess yields full RoleAdministrator access, permitting arbitrary file operations and SQL queries. There is no public exploit identified at time of analysis and it is not in CISA KEV, though the CVSS 4.0 base score is 9.3.
Unauthenticated information disclosure in CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 exposes media attachment metadata - including titles, file types, sizes, and direct URLs - from any configured folder, including those never published to a gallery. The missing authorization checks on REST API endpoints mean any external party can enumerate private document libraries without credentials. A publicly available exploit exists per WPScan, though EPSS sits at just 0.17% (7th percentile), suggesting limited observed exploitation activity at time of analysis.
Server-side template injection in siyuan's attribute-view Template calculation feature (versions 3.7.0-beta.1 through 3.7.3) allows any local OS user to read the siyuan process's environment variables and conduct DNS lookups from the server's network position. The vulnerability exists because the Sprig template function map is used unmodified, reintroducing env, expandenv, and getHostByName functions that were specifically removed in a prior remediation (CVE-2024-55660). Because the siyuan kernel binds to 127.0.0.1 with no per-UID access control, a separate unprivileged OS account sharing the same host can exploit this without any application-level credentials. No public exploit has been identified at time of analysis; vendor-released patch v3.7.4 is available.
Authentication brute-force leading to full admin takeover affects SiYuan, a self-hosted personal knowledge-management/note-taking application, in versions before v3.7.4. The HTTP Basic Authentication branch of the CheckAuth() middleware - which protects almost the entire /api/* surface - validates the workspace access code without enforcing the CAPTCHA/lockout controls or the failure counter that guard the normal cookie/session login, letting unauthenticated remote attackers make unlimited automated guesses to recover the admin access code and gain RoleAdministrator control of the kernel. A non-constant-time comparison of the access code adds a secondary timing side channel. No public exploit identified at time of analysis, but the flaw is trivially scriptable.
Unauthenticated brute-force of per-notebook publish passwords is possible in SiYuan before 3.7.4 due to the complete absence of rate limiting or CAPTCHA on the authFilePublishAccess endpoint. Any network-reachable SiYuan instance with the notebook publishing feature enabled and at least one password-protected published notebook is exposed to automated credential guessing, potentially disclosing the notebook's full contents to an unauthorized party. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS 4.0 score of 8.7 reflects the trivially low exploitation barrier once a suitable target is identified.
Key-based authorization bypass in @fastify/jwt before 10.2.2 permits any low-privileged authenticated user holding a token signed by the application's global secret to access routes explicitly restricted to a separate per-request key, silently crossing a cryptographic trust boundary. Applications implementing multi-domain JWT authorization - for example, separating user and admin token verification keys - are specifically at risk, as the plugin's option merge incorrectly applies the global key last, overriding the developer-supplied per-request key. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the fix is available in version 10.2.2 and the attack path is mechanically straightforward for any authenticated user.
Password reset link poisoning in the Perl module Dancer2::Plugin::Auth::Extensible (all versions through 0.713) lets an unauthenticated remote attacker trigger a genuine reset email whose link points to an attacker-chosen host, enabling account takeover. Because the reset link's authority is built from the untrusted request Host header (or X-Forwarded-Host under behind_proxy), a victim who clicks hands a valid reset code to the attacker's server. There is no public exploit identified at time of analysis; EPSS is low (0.28%, 21st percentile) and CISA SSVC lists exploitation as none, but the flaw is marked automatable with total technical impact.
Use-after-free in the Linux kernel Thunderbolt XDomain subsystem enables a physically adjacent attacker with a malicious Thunderbolt device to corrupt kernel memory, potentially achieving code execution at kernel privilege level. The flaw stems from a race condition introduced when commit 559c1e1e0134 moved tb_xdp_handle_request() to the system workqueue, breaking the serialization with the disconnect path and creating a window where queue_delayed_work() can fire on a freed xdomain object. No public exploit has been identified and EPSS (0.16%, 5th percentile) confirms very low near-term exploitation probability, though the kernel-level impact makes this relevant for organizations operating Thunderbolt-enabled endpoints in adversarial physical environments.
Deadlock and use-after-free conditions in the Linux kernel's IDXD character device driver expose local low-privileged users on Intel DSA-equipped systems to potential kernel memory corruption or denial of service. The vulnerability resides in `idxd_cdev_open()`, where error cleanup paths call `put_device(fdev)` while still holding `wq->wq_lock`, causing `idxd_file_dev_release()` to deadlock on synchronous reentry; a secondary fallthrough defect then allows `idxd_xa_pasid_remove(ctx)` and `kfree(ctx)` to operate on memory already freed by that release callback. No public exploit has been identified at time of analysis, and an EPSS score of 0.16% (6th percentile) reflects the low observed exploitation probability consistent with the specialized hardware prerequisite.
Out-of-bounds kernel memory read and incomplete invalidation affect the Linux kernel's ARM SMMUv3 iommufd nested-virtualization path (arm_vsmmu_vsid_to_sid), where a guest virtual Stream ID is mapped to a single physical Stream ID from master->streams[0]. On ARM64 hosts using nested SMMUv3 with iommufd vDEVICE, assigning a device that has zero streams turns master->streams into a ZERO_SIZE_PTR that is read out of bounds, while a device with multiple streams leaves the other streams' ATC/IOTLB entries unreachable by guest invalidations. There is no public exploit identified at time of analysis, and EPSS is very low (0.15%, 5th percentile), consistent with a niche subsystem rather than broad exploitability despite the 9.3 CVSS.
Deadlock in the Linux kernel btrfs zoned filesystem causes an unrecoverable filesystem hang on hosts using zoned block devices (SMR HDDs or ZNS SSDs). The writeback path in btree_writepages() holds zoned_meta_io_lock while the tree-log block group fallback path waits for a transaction commit, while the concurrent transaction commit path blocks on that same lock - a classic ABBA deadlock resulting in complete filesystem unavailability. No public exploit exists and EPSS is 0.16% (5th percentile), reflecting a niche-deployment reliability issue rather than a broad security threat; the condition can be triggered by normal I/O stress and was confirmed reproducible via fstests generic/475.
Out-of-bounds kernel memory read in the Linux netfilter SIP connection-tracking helper (nf_conntrack_sip) lets remote attackers crash or leak memory from any host doing SIP NAT rewriting. When sip_help_tcp() NAT-rewrites a SIP message, the per-message size delta is stored in a signed 16-bit variable; a single message with a long Contact list can grow by more than S16_MAX (while still under the 65535 enlarge_skb limit), wrapping the counter so datalen underflows to a huge unsigned value and ct_sip_get_header() reads past the linearized skb tail (KASAN use-after-free). Tagged Information Disclosure; no public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile).
Local privilege escalation and host memory corruption in the Linux kernel's KVM arm64 virtual GIC (vgic) LPI handling allows a malicious guest to trigger a use-after-free by racing LPI release against re-registration. Affecting arm64 KVM hosts (introduced by the LPI refcounting rework, present through Linux 6.17), a guest that issues an ITS DISCARD while an LPI is still referenced and then re-maps the same INTID via MAPTI can cause the kernel to erase a newly registered LPI from the xarray or leak an orphaned structure. There is no public exploit identified at time of analysis and EPSS is low (0.14%), but the scope-changing guest-to-host impact makes this a meaningful host-integrity issue.
Use-after-free in the Linux kernel's nf_tables netfilter subsystem exposes local attackers with low-privilege accounts to potential kernel-level privilege escalation by exploiting a race condition in nft_object lifecycle management across network namespaces. The nft_object rhltable was implemented as a global structure, meaning that as one network namespace tears down its objects via nft_rcv_nl_event(), another namespace can still resolve pointers to those objects through the shared lookup table - and since nft_obj_destroy() frees memory immediately, a concurrent lookup dereferences freed memory. No active exploitation has been identified (not in CISA KEV) and EPSS sits at 0.16% (5th percentile), though the vulnerability's kernel-level impact warrants patching on multi-tenant and containerized Linux hosts.
Uninitialized memory access in the Linux kernel's netfilter xt_hashlimit module allows local users with netfilter rule configuration privileges to read uninitialized kernel memory and potentially corrupt rate-limiting state. The flaw exists in the .checkentry validation path, which failed to detect when XT_HASHLIMIT_RATE_MATCH mode is applied across multiple rules sharing the same hashtable, leaving the burst field in the dsthash_ent union uninitialized. No public exploit or CISA KEV listing exists at time of analysis; an EPSS score of 0.16% reflects low near-term exploitation probability.
Use-after-free in the Linux kernel's RDS/TCP subsystem allows a local authenticated attacker to read freed kernel memory via a race condition in `rds_tcp_laddr_check()`, potentially enabling privilege escalation. The flaw is triggered through the `bind()` syscall when the RCU read lock is incorrectly released between a `dev_get_by_index_rcu()` lookup and a subsequent `ipv6_chk_addr()` call, creating a window for concurrent interface deletion to free the `net_device` struct. No public exploit is identified at time of analysis, and EPSS of 0.16% (5th percentile) indicates low near-term exploitation probability despite the CVSS 7.8 High rating.
Use-after-free in the Linux kernel's IPv6 nexthop routing subsystem allows a local low-privileged attacker to corrupt kernel memory by racing nexthop replace operations against concurrent IPv6 route deletion. The functions fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list under RTNL serialization without holding nh->lock, while IPv6 route add/delete operations mutate that same list under nh->lock without RTNL, creating a window where a freed fib6_info struct is read. No public exploit is confirmed in CISA KEV and EPSS is a low 0.14%, but KASAN stack traces embedded in the advisory (tasks 'exploit/142' and 'exploit/143') confirm the race was reproducibly triggered, and the vendor has released fix commits to the stable kernel trees.
Use-after-free race condition in the Linux kernel nexthop subsystem (net/ipv4/nexthop.c) allows a local attacker with low-privilege access to trigger slab-use-after-free in kernel memory, potentially achieving full kernel code execution with scope change across the system. The race occurs between nh_rt_cache_flush() walking nh->f6i_list without holding nh->lock and concurrent IPv6 route add/delete operations freeing fib6_info entries under nh->lock - confirmed by an in-kernel KASAN trace naming the task 'exploit/146'. This CVE carries a CVSS 3.1 score of 8.8 (S:C, C:H/I:H/A:H) but EPSS of 0.14% (4th percentile) and no CISA KEV listing indicate no confirmed active exploitation at time of analysis.
Stale kernel memory leaks to userspace through an off-by-two bounds error in the Linux kernel's libiscsi subsystem, specifically in `iscsi_scsi_cmd_rsp()`. Systems running an iSCSI initiator (libiscsi loaded) that connect to a malicious or compromised iSCSI target are exposed: the target crafts a SCSI Response PDU where the data segment length equals the declared sense length, causing a `memcpy()` to read two bytes past the received buffer boundary into stale `conn->data` contents, which are then returned to userspace in the SCSI sense buffer. No public exploit exists and EPSS stands at 0.16% (5th percentile); exploitation requires adversary control of an iSCSI target the victim connects to, making this a concern primarily for enterprise iSCSI storage environments rather than general internet-facing systems.
Un-rate-limited ICMP and NDISC Redirect packet storms are possible in the Linux kernel when peer entry allocation fails inside `inet_getpeer_v4()` or `inet_getpeer_v6()`, affecting all kernels from 2.6.39 through the fixed stable releases. A remote unauthenticated attacker who can trigger peer table exhaustion against a Linux system acting as a network forwarder can cause the kernel to emit unbounded ICMP/NDISC Redirect messages, producing severe network availability degradation. No public exploit or proof-of-concept is identified at time of analysis, and EPSS sits at 0.17%, but the no-authentication CVSS profile warrants prompt patching on any Linux routing infrastructure.
Use-after-free in the Linux kernel's forcedeth Ethernet driver allows a local user to trigger kernel memory corruption during device removal. The driver's nv_remove() function frees per-CPU txrx_stats before unregister_netdev() completes, leaving the ndo_get_stats64 statistics path, NAPI polling, xmit data path, and nv_close()/drain all capable of accessing the already-freed structure. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and no public exploit identified at time of analysis, the immediate risk is narrow but the potential for local privilege escalation on systems with NVIDIA nForce-era hardware warrants prompt patching.
A double-free memory-corruption defect in the Linux kernel's rtase Realtek automotive Ethernet driver allows the same multi-fragment socket buffer to be freed twice when the transmit path hits a DMA mapping failure. It affects hosts running the rtase driver (Realtek multi-gigabit/automotive NICs) on kernel 6.12 and related stable trees, and can lead to kernel memory corruption and denial of service. No public exploit has been identified at time of analysis; EPSS is low (0.17%, 7th percentile) and the CVE is not on CISA KEV.
Use-after-free in the Linux kernel Bluetooth ISO subsystem allows a physically adjacent, unauthenticated attacker to corrupt kernel heap memory, potentially enabling privilege escalation or a denial-of-service crash. The defect exists in `iso_sock_disconn()`, where clearing `conn->hcon = NULL` omits the required `conn->hcon->iso_data = NULL` reset, leaving a dangling pointer that `iso_conn_free()` later dereferences. Patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.44, 7.1.8); no confirmed active exploitation is on record despite the high CVSS score, consistent with the very low EPSS of 0.17% and the specialized Bluetooth ISO attack surface.
Use-After-Free in the Linux kernel's Bluetooth L2CAP LE connection response handler exposes systems with Bluetooth enabled to potential kernel-level memory corruption by an adjacent, unauthenticated attacker. The flaw in `l2cap_le_connect_rsp()` stems from missing reference-count protection on a channel object, allowing a concurrent remote-disconnect-triggered `l2cap_chan_del()` to free the object between lookup and lock - a pattern already fixed in the BR/EDR counterpart but overlooked here. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.17%, and no public exploit code has been identified, though the kernel-level UAF impact class is inherently severe if triggered.
Missing socket lock in the Linux kernel Bluetooth ISO subsystem exposes a race condition in iso_sock_getname that allows a low-privileged adjacent attacker to trigger a use-after-free or null-pointer dereference via concurrent connection teardown. Systems running affected kernel versions with Bluetooth ISO (Isochronous) sockets enabled are vulnerable to kernel crashes or memory disclosure. No public exploit code exists and EPSS probability is 0.17%, but the CVSS 8.0 score reflects the potential for high-impact memory corruption if the race is won.
Race condition in the Linux kernel Bluetooth ISO subsystem allows an adjacent, unauthenticated attacker to trigger a NULL pointer dereference or memory corruption by sending crafted Bluetooth LE ISO connection events targeting a socket concurrently transitioning out of LISTEN or CONNECT state. Affected kernels span the 6.8.9 through pre-6.9 range, with backported fixes confirmed for stable releases 6.18.44 and 7.1.8. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), though the kernel-level impact and Bluetooth-adjacent unauthenticated access vector justify the vendor's 8.8 CVSS rating.
Use-after-free race condition in the Linux kernel's Bluetooth ISO subsystem allows an unauthenticated attacker within Bluetooth adjacency range to corrupt kernel memory by exploiting concurrent socket teardown in iso_conn_ready(), potentially leading to privilege escalation or system crash on affected hosts. The flaw - present since the introduction of Bluetooth 5.2 ISO channel support in Linux 5.15 - arises because conn->sk is dereferenced without holding a lock or refcount, enabling a concurrent iso_sock_release() call to free the socket before iso_conn_ready() completes its dereference. No public exploit or CISA KEV entry exists at time of analysis, and the EPSS score of 0.17% (6th percentile) reflects very low near-term exploitation probability despite the High CVSS score.
Concurrent deadlock and use-after-free (UAF) vulnerabilities in the Linux kernel's Bluetooth ISO socket layer allow adjacent-network attackers to corrupt kernel memory via race conditions in `iso_sock_timeout()`. Affected systems must be within Bluetooth radio range; no authentication is required. No public exploit code and no CISA KEV listing have been identified - EPSS of 0.17% (6th percentile) reflects low current exploitation probability despite the high CVSS score of 8.8.
Use-after-free via reference counting race in the Linux kernel's Bluetooth ISO (LE Audio) subsystem allows an adjacent, unauthenticated attacker to potentially achieve kernel-level code execution or information disclosure. The race arises between concurrent execution of iso_conn_del() and iso_chan_del() in separate kernel tasks, resulting in a double-put of the iso_conn object and subsequent memory corruption. Affected stable branches span Linux 6.11.11 through pre-6.13 series; upstream patches are available in Linux 6.18.44, 7.1.8, and 7.2-rc6. No public exploit code exists and no active exploitation has been confirmed, consistent with a very low EPSS score of 0.17%.
Use-after-free race condition in the Linux kernel Bluetooth ISO subsystem allows an adjacent, unauthenticated attacker to trigger kernel memory corruption with full confidentiality, integrity, and availability impact. The flaw resides in the hci_conn::iso_data field, which is read and modified across concurrent kernel tasks without lock or RCU protection - allowing a kfree() in one task to race against a kref_get_unless_zero() in another, yielding a dangling pointer dereference. No public exploit code has been identified and EPSS exploitation probability is 0.15% (5th percentile), but kernel UAF primitives are well-understood by skilled attackers and the Bluetooth adjacency requirement is the primary limiting factor for mass exploitation.
Use-after-free (UAF) in the Linux kernel Bluetooth HCI connection subsystem exposes adjacent-network attackers to potential kernel memory corruption via a race condition in abort_conn_sync(). The hci_conn object can be freed while the hci_sync task is still executing against it, because no reference count is held across the async operation - a classic lifetime management failure in kernel concurrent code. No public exploit has been identified and EPSS sits at only 0.17% (6th percentile), but the CVSS 8.8 score reflects the theoretical full-system impact if the race is successfully won. The vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at time of analysis.
Use-after-free in the Linux kernel Bluetooth HCI synchronization subsystem (hci_sync) creates a theoretical kernel memory corruption risk via a race condition in the hci_connect_big_sync() callback. The conn (connection) struct can be freed while the hci_sync asynchronous task is still executing, potentially allowing an adjacent, unauthenticated attacker within Bluetooth range to trigger a dangling pointer dereference in kernel context. No public exploit identified at time of analysis and EPSS stands at 0.15% (5th percentile), but patches are available across multiple Linux stable branches and should be applied as routine maintenance.
Use-after-free in the Linux kernel Bluetooth hci_sync subsystem exposes local users with low privileges to potential kernel heap corruption via a race condition in `hci_connect_pa_sync()`. The `conn` connection object can be freed by one code path while the asynchronous hci_sync callback is still executing, allowing a local attacker on affected 6.12.x, 6.14.x, and 6.15.x kernel branches to corrupt kernel memory and potentially achieve full privilege escalation. No public exploit code has been identified, and EPSS of 0.15% (5th percentile) confirms very low exploitation probability at this time - no confirmed active exploitation (not in CISA KEV).
Use-after-free in the Linux kernel's Bluetooth HCI synchronization subsystem allows an adjacent-network attacker with low privileges to pass freed hci_conn pointers to hci_conn_valid(), where kmalloc may have reallocated that memory to unrelated objects. Affected Linux kernel versions across multiple stable branches expose systems with active Bluetooth to potential kernel memory corruption, yielding full confidentiality, integrity, and availability impact at the kernel level. No public exploit code has been identified and CISA KEV does not list this CVE; however, the HIGH CVSS score and kernel-level CIA:H/H/H impact justify prompt patching on any Bluetooth-enabled Linux host.
Local privilege escalation in the Linux kernel's octeontx2-af driver (Marvell OcteonTX2 hardware) allows a low-privileged Virtual Function (VF) tenant to overwrite the Physical Function's (PF) shared CGX hardware PKIND configuration, corrupting HiGig2 or EDSA packet parsing state and achieving high confidentiality, integrity, and availability impact across the PF boundary. The vulnerability arises because VF NIX LF allocation did not check whether the LMAC was already configured with a privileged PKIND before resetting it. No public exploit code has been identified and EPSS is 0.15% (5th percentile), indicating very low exploitation probability, though the changed-scope CVSS vector reflects genuine cross-tenant hardware corruption potential in SR-IOV deployments.
Deadlock in the Linux kernel qede NIC driver's recovery path permanently wedges the rtnetlink control plane of any affected host when a TX timeout fires on a QLogic/Cavium FastLinQ interface with VXLAN or GENEVE tunnel ports configured. Systems in this state remain pingable but every subsequent caller of rtnl_lock - including ip, sshd, ovs-vswitchd, IPv6 addrconf, and lldpad - blocks indefinitely, denying all network management access until reboot. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the impact on unpatched datacenter hosts in tunnel-overlay environments is severe and patch adoption should be prioritized.
Use-after-free memory corruption in the Linux kernel's ksmbd SMB server subsystem exposes systems running the in-kernel file-sharing daemon to potential kernel-level compromise by an authenticated remote attacker. Affected are Linux kernel versions beginning at commit 8510a043d334ecdf83d4604782f288db6bf21d60 (ksmbd introduction) through multiple stable branches, with vendor-released patches confirmed in 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. No public exploit code has been identified and EPSS stands at 0.17% (6th percentile), indicating no observed mass exploitation at time of analysis despite the CVSS 8.8 severity rating.
Session-binding authentication weakness in the Linux kernel's ksmbd in-kernel SMB3 server allows different SMB clients to be treated as identical because ClientGUID values were compared with strncmp(), which halts at the first embedded NUL byte. An attacker able to reach an exposed ksmbd share could exploit this to bind to another client's authenticated SMB3 multichannel session or bypass FSCTL_VALIDATE_NEGOTIATE_INFO integrity checks, exposing high confidentiality and integrity impact per the CVSS 9.1 rating. There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), indicating no observed exploitation activity.
Use-after-free in the Linux kernel's IOMMUFD subsystem (iommu/iommufd) exposes systems running VFIO device passthrough to kernel memory corruption by a local low-privileged attacker, with a scope change that may cross security boundaries into the hypervisor layer. The flaw, present since Linux 6.11, stems from a race between IOPF group acceptance by the fault handler and concurrent device detach operations, leaving IOMMUFD's deliver list holding references to memory already freed by the generic pending list cleanup path. No public exploit or active exploitation has been identified at time of analysis - EPSS stands at 0.17% (6th percentile) and the vulnerability is absent from CISA KEV - though the CVSS 3.1 score of 8.8 reflects the severity of potential impact in affected virtualization environments.
List corruption in the Linux kernel's hugetlb memory management subsystem (`mm/hugetlb`) allows a local low-privileged attacker to trigger kernel memory corruption, potentially achieving privilege escalation or host crash. The flaw was confirmed as causing real-world KVM host panics in dense virtualization environments where QEMU and SPDK/DPDK vhost-user processes share a hugetlbfs MAP_SHARED mapping; with CONFIG_DEBUG_LIST disabled, the corruption silently embeds a kernel stack address into an active cache list, setting up a use-after-free. No public exploit has been identified at time of analysis; EPSS is 0.17% and the vulnerability is not in CISA KEV, but fixed stable kernel releases are available across all active branches.
KVM on AMD SVM-enabled hosts fails to update x2APIC MSR intercepts when AVIC is inhibited while a nested guest (L2) is running, allowing an L1 guest with root-level privileges to directly access the host's APIC state, send arbitrary interrupts, and crash the host kernel. Affected Linux kernels from 6.0 through multiple stable branches expose the host to interrupt manipulation, task priority changes, and denial-of-service. A functional proof-of-concept demonstrating both spurious interrupt injection and wakeup handler corruption is embedded in the CVE description itself; this vulnerability is not currently listed in the CISA KEV catalog and carries a 0.17% EPSS score consistent with its narrow but severe exploitation conditions.
KVM s390 PCI subsystem in the Linux kernel allows a local low-privileged user to corrupt hypervisor resources by repeatedly calling the adapter interrupt forwarding ioctl for the same zPCI device without prior unregistration. The vulnerability affects IBM Z (s390) systems running Linux KVM with PCI passthrough from commit 3c5a1b6f onwards (Linux 6.0+), with patched stable releases available. No public exploit exists and EPSS sits at 0.17% (6th percentile), reflecting the niche architecture and local-access prerequisite, but the CVSS Scope:Changed designation signals the flaw can cross the guest-to-hypervisor boundary, elevating its priority on affected IBM Z KVM deployments.
Use-after-free in the Linux kernel's dibs loopback subsystem allows a local low-privileged attacker to corrupt kernel memory during concurrent DMB node attach, detach, and unregister operations. The vulnerability arises from a race window between hash table lookup under dmb_ht_lock and the subsequent refcount operation performed after the lock is dropped, enabling a concurrent unregister path to free the node before the refcount transition completes. With a CVSS score of 7.8 and C:H/I:H/A:H impact metrics, successful exploitation can lead to privilege escalation or kernel crash; however, no public exploit is identified at time of analysis and EPSS at 0.17% reflects low current exploitation probability.
Use-after-free in the Linux kernel audit subsystem's `audit_del_rule()` function exposes systems from kernel 4.3 onward to local privilege escalation. The flaw stems from incorrect RCU ordering: fsnotify mark resources tied to `e->rule.exe` are freed before the rule is unlinked from RCU-visible filter lists, creating a window where concurrent `audit_filter()` and `audit_filter_rules()` readers dereference already-freed memory. Patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Linux kernel Bluetooth management subsystem allows a local low-privileged user to corrupt kernel heap memory by racing MGMT_OP_SET_LOCAL_NAME against MGMT_OP_REMOVE_UUID on systems with a powered BR/EDR-capable Bluetooth controller. The race exploits a missing lock acquisition in pending_eir_or_class() and the omission of MGMT_OP_SET_LOCAL_NAME from EIR-serialization logic, enabling a freed pending command entry to be read during EIR reconstruction. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), but the kernel UAF primitive and confirmed 7.8 CVSS score make patching a clear priority for Bluetooth-enabled systems.
Use-after-free in the Linux kernel Bluetooth management subsystem allows a low-privileged local attacker to corrupt kernel heap memory and achieve privilege escalation to root. Kernels from approximately 2.6.39 through unpatched revisions of the 6.6.x, 6.12.x, 6.18.x, and 7.1.x stable series are vulnerable when Bluetooth hardware is present and the mgmt interface is accessible. No public exploit has been identified at time of analysis, and EPSS at 0.20% (10th percentile) reflects limited current exploitation probability, though UAF primitives in the Linux kernel are historically weaponized following public disclosure.
Use-after-free in the Linux kernel Bluetooth hci_sync subsystem exposes kernel heap memory to corruption via a race condition between advertising instance teardown and HCI command synchronization. Systems running affected kernel versions (from commit cba6b758711cab946c787f7c15be92cc749b8e1f across 5.15.x, 6.12.x, 6.18.x stable branches) with active Bluetooth LE extended advertising are vulnerable to exploitation by attackers within Bluetooth radio range. The kernel-level UAF can yield arbitrary code execution in kernel context with full C/I/A impact; no public exploit has been identified and EPSS sits at the 6th percentile, indicating purely theoretical exploitation risk at this time.
Uninitialized memory read and session hijack in the Linux kernel Bluetooth HIDP subsystem exposes systems with active Bluetooth HID sessions to kernel memory disclosure and forced session termination from an unauthenticated adjacent attacker. The functions hidp_recv_ctrl_frame() and hidp_recv_intr_frame() dereference skb->data[0] before validating that the received L2CAP SDU is at least one byte long, allowing a connected peer to feed an empty frame and cause the kernel to consume a stale tailroom byte - or, via a crafted HCI ACL packet, a fully attacker-controlled byte interpreted as a synthetic HIDP transaction code. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Bluetooth HIDP in the Linux kernel exposes an uninitialized-memory read and a peer-controlled out-of-bounds byte access in hidp_session_run() when processing numbered HID report responses. Systems running Linux with active Bluetooth HID sessions are vulnerable to a malicious adjacent Bluetooth peer leveraging this to disclose kernel memory contents (rated C:H, enabling potential KASLR bypass) or manipulate HIDIOCGFEATURE report completion with attacker-controlled data. No public exploit has been identified, EPSS is 0.17% (6th percentile), and this vulnerability is not listed in CISA KEV.
Use-after-free in the Linux kernel's AFS (Andrew File System) subsystem exposes systems running the kafs module to kernel memory corruption exploitable by local low-privileged users, potentially enabling privilege escalation to root. The race condition in afs_make_call() allows the afs_call structure to be freed by an arriving async server response while the sending function - having transferred its reference rather than retaining one - continues to access the freed memory. EPSS is 0.17% (6th percentile), no CISA KEV listing exists, and upstream fix commits are publicly available on stable kernel trees.
Use-after-free in the Linux kernel ALSA timer subsystem allows an unprivileged local user to corrupt kernel heap memory and escalate privileges to root. The flaw stems from snd_timer_close_locked() setting SNDRV_TIMER_IFLG_DEAD but never clearing it after close completes; when snd_seq_timer_open() retries on the same instance after a forced failure, snd_timer_instance_free() frees an object still referenced across multiple kernel data structures. With CVSS 7.8 and a detailed exploitation path described directly in the upstream kernel commit, this is a credible local privilege escalation on desktop and workstation Linux systems, despite a low EPSS score of 0.17% (6th percentile) and no current CISA KEV listing. No public exploit code has been identified at time of analysis.
Missing bounds enforcement in the Linux kernel ALSA USB audio driver's implicit-feedback path allows a physically-connected malicious USB device to inject oversized sync packets that propagate un-clamped into the playback endpoint queue. The un-clamped frame count - potentially exceeding ep->maxframesize - can drive packet transfers beyond hardware frame limits, risking kernel memory corruption with high confidentiality, integrity, and availability impact. No public exploit has been identified and EPSS is 0.17% (6th percentile), but patches are confirmed across multiple stable kernel branches including 6.6.151, 6.12.103, 7.1.8, and 6.18.44.
Use-after-free in the Linux kernel's FOU (Foo-over-UDP) tunnel subsystem allows a local attacker with low privileges to corrupt kernel memory by exploiting a race condition in fou_create(). The struct fou object is published via sk_user_data before being committed to the per-network-namespace port list; when fou_add_to_port_list() subsequently fails on port-0 requests, the error path frees the object while concurrent RCU readers can still dereference it through fou_from_sock(). Two stable-branch upstream commits (a28d8903, b14361ac) provide the fix; no public exploit has been identified at time of analysis, and EPSS sits at the 5th percentile.
A DMA mapping resource leak in the Linux kernel's igbvf driver (Intel 82576 SR-IOV virtual function NIC) occurs on the TX buffer-mapping error path: an off-by-one in the dma_error cleanup loop leaks exactly one DMA mapping (the packet head) whenever a fragment mapping fails after the head was successfully mapped. The bug traces to a 2010 fix for an endless loop and affects a wide range of stable kernels until patched (fixes landed in 6.6.151, 6.12.103, 6.18.44, 7.1.8 and 7.2-rc6). There is no public exploit identified at time of analysis, EPSS is very low (0.17%), and the practical impact is memory/DMA resource exhaustion rather than the remote code execution suggested by the assigned 9.8 score.
Kernel-level use-after-free in the Linux SMC (Shared Memory Communications) subsystem allows a race between socket close and link group termination to write to freed memory. The flaw lives in the net/smc driver where __smc_lgr_terminate() releases conns_lock after locating a connection in lgr->conns_all but before calling sock_hold(), so a concurrent close can free the embedded socket first. Fixed across multiple stable trees; EPSS is low (0.17%), there is no public exploit identified at time of analysis, and it is not on CISA KEV.
Use-after-free in the Linux kernel netfilter ipset subsystem enables local kernel memory corruption with potential for privilege escalation. During an ipset hash resize (`mtype_resize()`), comment pointers are shallow-copied via `memcpy()` rather than deep-copied, causing both old and new table entries to share the same `ip_set_comment_rcu` pointer; an `xt_SET --add-set --exist` packet hitting the old entry during this window calls `ip_set_init_comment()`, freeing the shared pointer and leaving the new table entry with a dangling reference that is later dereferenced in `strlen()` during backlog replay. Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6), no public exploit has been identified, and EPSS sits at 0.17% (6th percentile), indicating very low observed exploitation pressure at time of analysis.
Use-after-free race condition in the Linux Kernel TIPC subsystem allows a low-privileged attacker to trigger stale-pointer dereference during socket poll trace operations, potentially leading to kernel memory corruption and privilege escalation. The flaw arises because tipc_poll() invokes trace_tipc_sk_poll() without holding the socket lock, enabling tipc_list_dump() to walk live queue members while a concurrent thread dequeues and frees socket buffers (skbs). Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8); no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Linux kernel wifi/mac80211 subsystem allows an adjacent network attacker to trigger kernel memory corruption during Block Acknowledgment session teardown. ieee80211_stop_tx_ba_cb() hands tid_tx to kfree_rcu() and then reads tid_tx->ndp after dropping sta->lock without RCU read-side protection, creating a window where the RCU softirq callback can free the object before the read completes. The vulnerability carries a CVSS 8.8 score (AV:A) but EPSS sits at the 5th percentile with no KEV listing, reflecting the race-condition exploitation complexity; no public exploit has been identified at time of analysis.
Use-after-free and out-of-bounds read in the Linux kernel mwifiex WiFi driver (CVSS 8.8, AV:A) allow an unauthenticated attacker on an adjacent WiFi segment to trigger kernel memory corruption by sending crafted A-MSDU frames containing TDLS payloads. Affected kernel versions span from the commit introducing A-MSDU TDLS handling (circa Linux 4.5, commit 776f742040ca) through all stable branches prior to the fixes in 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the flaw is remotely selectable by the sender through control over A-MSDU subframe layout, making TDLS-capable mwifiex deployments meaningfully exposed from the local wireless segment.
Use-after-free in the Linux kernel's Transparent Huge Page split path exposes systems to kernel memory corruption, potential privilege escalation, or denial of service via a race condition in __folio_split(). Any local low-privilege user on affected kernels prior to the stable fixes in versions 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6 may trigger this by racing a concurrent final iput() against the shmem THP split unlock sequence. No public exploit or PoC has been identified, and the EPSS score of 0.17% (6th percentile) reflects minimal real-world exploitation activity at time of analysis.