Information Disclosure
Monthly
Refcount leak in the Linux kernel's fbdev Open Firmware display timing subsystem (of_get_display_timings()) affects kernel versions from 3.9 through multiple stable branches, allowing a local low-privileged user to trigger resource exhaustion that degrades system availability. The flaw lies in error-path handling where of_parse_phandle() increments a device_node refcount into native_mode, but the goto target 'entryfail' at lines 184 and 192 never calls of_node_put(native_mode), leaving the refcount permanently elevated. No active exploitation has been identified - EPSS of 0.02% (7th percentile) and absence from CISA KEV confirm this as a maintenance-class kernel fix rather than an emergency threat.
Recursive glock deadlock in the Linux kernel GFS2 cluster filesystem driver allows a locally authenticated user to cause a kernel thread hang and denial of service. In gfs2_fiemap(), the inode glock is held while calling iomap_fiemap(); if the userspace fiemap output buffer is memory-mapped to the same GFS2 inode, a page fault during buffer writes triggers a second attempt to acquire the already-held glock, producing a deadlock. No public exploit or CISA KEV listing exists; EPSS is 0.02% (7th percentile), consistent with the niche GFS2 deployment footprint and the specific trigger conditions required.
Spectre-BHB (Branch History Buffer) software mitigation was absent in the Linux kernel arm64 subsystem for systems running the HiSilicon TSV110 processor, leaving those systems exposed to branch prediction side-channel attacks capable of leaking sensitive kernel memory contents across privilege boundaries. The root cause was the kernel lacking the TSV110 MIDR (Main ID Register) entry in its processor-specific mitigation table, meaning the software workaround was never applied on that hardware. No public exploit has been identified at time of analysis, and EPSS probability sits at a low 0.02% (7th percentile), though the real-world confidentiality risk on Huawei/HiSilicon arm64 deployments is meaningful given the class of attack.
NULL pointer dereference in the Linux kernel's fsl-imx8mq-usb PHY driver crashes systems built on NXP i.MX8MQ SoC when the driver is unloaded or the device is removed. The driver's probe function omits the required platform_set_drvdata() call, leaving the driver data pointer unset; when remove() subsequently dereferences it, a kernel panic results. Exploitation is limited to local, low-privilege users on specialized embedded hardware; EPSS at 0.02% (4th percentile) and absence from CISA KEV confirm no public exploit or in-the-wild exploitation at time of analysis.
Denial of service in Linux kernel media cx88 driver allows local authenticated attackers to exhaust system resources by triggering a missing DMA unmapping in the snd_cx88_hw_params() error path. The vulnerability causes resource leaks when audio hardware parameter initialization fails, potentially rendering the audio subsystem unavailable. CVSS 5.5 reflects local attack vector with low complexity; EPSS 0.02% indicates minimal real-world exploitation probability despite vendor-released patches across multiple kernel versions.
A use-after-free condition in the libertas USB wireless driver allows local attackers with user privileges to cause a denial of service by triggering a kernel warning and potential crash through rapid firmware loading or repeated usb_tx_block() calls while a USB request is still active. The vulnerability stems from insufficient synchronization of USB URB submissions, enabling concurrent requests on the same URB without enforcing completion of prior transmissions.
Denial of service via kernel warning in MPTCP path manager occurs when combining endpoint removal with fullmesh and flag-setting operations through netlink in the Linux kernel. A local attacker with low privileges can trigger a WARNING in net/mptcp/pm_kernel.c:1074 by sending a crafted sequence of netlink commands, causing the system to emit a kernel warning and potentially become unstable. No known public exploit code exists, but the low CVSS (5.5) and minimal EPSS (0.03%) indicate this is a local DoS with limited real-world impact.
Kernel panic via SError interrupt in Linux kernel media driver (chips-media wave5) when device enters autosuspend during video decoding operations. Local authenticated attackers can trigger a denial of service by queuing buffers to the wave5 video decoder while autosuspend timeout occurs, causing the CPU to access suspended hardware and generate an unrecoverable asynchronous SError, crashing the system. No privilege escalation or code execution; impact limited to availability.
Memory leak in the tw9906 media driver's probe function allows local authenticated attackers to cause denial of service through memory exhaustion. The vulnerability occurs in tw9906_probe() when an error path fails to free memory allocated by v4l2_ctrl_handler_init() and v4l2_ctrl_new_std(), potentially leading to kernel memory depletion on repeated device probe attempts. Vendor-released patches are available across multiple stable kernel branches.
Denial of service in Linux kernel KCM (kernel connection multiplexer) subsystem when processing messages with zero-fragment skbs in frag_list after partial sendmsg failures. A local authenticated attacker can trigger a kernel warning and potentially crash the system by sending a malformed message that fails during data copy, leaving an empty skb in the fragment list. The vulnerability requires local access and low-level socket manipulation, affecting systems running vulnerable Linux kernel versions prior to patching.
Memory leak in the Linux kernel's TI K3 SoC info driver (soc/ti/k3-socinfo) fails to release an allocated mmio regmap, causing denial of service through resource exhaustion on probe failures and driver unbind. Local attackers with low privileges can trigger probe deferral or driver unbind to exhaust kernel memory, affecting systems running vulnerable Linux kernel versions. The vulnerability has a low EPSS score (0.02%) but enables practical local DoS against systems where low-privilege users can control driver lifecycle.
Linux kernel x86 architecture fails to validate IMA measurement list memory bounds during kexec boot with restricted memory parameters, causing kernel panic when the carried-over IMA buffer falls outside truncated RAM. Authenticated local users with kexec privileges can trigger a denial of service. The fix adds a sanity check to validate the previous kernel's IMA kexec buffer against actual memory bounds before restoration, aligning x86 behavior with other architectures.
Availability failure in the Linux kernel's iris media driver for Qualcomm SM8750 (Snapdragon 8 Elite) causes video codec sessions to crash during bring-up due to two missing platform data entries. The absent get_vpu_buffer_size field prevents internal VPU buffer allocation, while the missing max_core_mbps entry causes incomplete capability checks and v4l2-compliance failures for the encoder. No public exploit exists and EPSS is 0.02% (4th percentile), consistent with the niche hardware dependency; this is a functional defect with availability impact rather than a traditional exploitable security weakness.
Denial of service in the Linux kernel team network driver arises when a slave interface is moved to a different network namespace and then deleted, causing team_port_del() to fire a spurious NETDEV_CHANGEMTU event during slave unregistration that prompts inetdev_init() to acquire an unreleased reference on the device. This reference leak prevents the device from completing unregistration, hanging the kernel with 'unregister_netdevice: waiting for [device] to become free.' The bug is confined to local authenticated access and no public exploit exists (EPSS 0.02%, 4th percentile); however, the Linux kernel's ubiquitous deployment makes patch application broadly relevant. Upstream stable fixes are confirmed available in Linux 6.18.16, 6.19.6, and 7.0.
Memory leak in the Linux kernel's radio-keene USB FM transmitter driver (radio-keene.c) leaves a v4l2 control handler unfreed when either v4l2_device_register() or video_register_device() fails during device probe. Affected kernel versions range from the commit introducing the flaw (1bf20c3a0c616f44359c573b533d06bae960ee45) through multiple stable branches, with fixed versions confirmed across 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0. No public exploit has been identified at time of analysis, and EPSS at 0.02% (7th percentile) confirms negligible real-world exploitation probability.
Kernel panic in the Linux kernel's chips-media wave5 VPU driver stems from an incorrect device cleanup order during module removal or autosuspend, allowing a powered-down hardware state to be accessed by a still-running worker thread. Systems with chips-media wave5 VPU hardware running video encoding workloads are vulnerable to a local denial-of-service via synchronous external abort (bus error). No public exploit exists and no active exploitation is confirmed; EPSS is 0.02% (5th percentile), reflecting the niche hardware requirement.
Denial-of-service through an invalid spinlock context in the Linux kernel's sh_tmu (SH Timer Unit) clocksource/clockevent driver triggers a lockdep violation and system hang on PREEMPT_RT-enabled builds running on Renesas SH/ARM platforms. The driver invokes pm_runtime_*() and clk_*() functions while holding a raw spinlock required by the clockevent framework; on PREEMPT_RT kernels, these PM and clock management calls acquire regular spinlocks that can sleep, making the combined locking sequence illegal. No public exploit code exists and exploitation probability is negligible (EPSS 0.02%), but the impact on affected hardware is a full system availability loss. Patches are confirmed available across all active stable branches.
Memory leak in the Linux kernel's staging rtl8723bs Wi-Fi driver degrades system availability for hosts running affected kernel versions with Realtek RTL8723BS hardware. The flaw occurs in the BSS scanning code path where cfg80211_inform_bss_frame() can return NULL on failure, but the previously allocated 'buf' buffer is not released, causing unbounded kernel memory loss over time. With EPSS at 0.02% (7th percentile), no CISA KEV listing, and no public exploit code, this is a low-urgency memory management defect patched across all active stable kernel branches.
Memory leak in the Linux kernel io_uring zero-copy receive (zcrx) subsystem allows a local low-privileged attacker to exhaust kernel memory via repeated DMA mapping failures on PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA systems, causing denial of service. The root cause is a sgtable (scatter-gather table) resource that is initialized but never freed when io_populate_area_dma() fails, because the error path's cleanup guard (!is_mapped) incorrectly skips deallocation. No public exploit exists and EPSS is 0.02% (4th percentile), reflecting the narrow hardware-specific trigger condition.
URB (USB Request Block) leak in the Linux kernel pvrusb2 media driver causes a denial-of-service condition on systems with Hauppauge WinTV-PVR USB2 capture devices. The pvr2_send_request_ex() function fails to unlink and await the write URB before returning on read URB submission failure, leaving the URB in an active state; subsequent driver calls trigger a 'URB submitted while active' kernel warning that destabilizes the USB subsystem. No public exploit exists and EPSS is 0.02% (7th percentile), but vendor-released patches are available across all major stable kernel branches.
Uninitialized read bytes in the Linux kernel IPMI IPMB driver expose systems to a local denial-of-service condition. The IPMB subsystem does not use i2c reads by design, but when an i2c read is triggered through the event handler, an uninitialized value is returned from the underlying bus driver, potentially causing kernel instability or a crash on affected server hardware. No public exploit exists and EPSS is 0.02% (7th percentile), indicating low real-world exploitation probability despite patches being available across multiple stable branches.
Denial of service in the Linux kernel AMD IOMMU subsystem allows a local low-privileged user to crash or stall IOMMU completion waits on systems with AMD hardware and IOMMU enabled. The root cause is a race condition where cmd_sem_val was incremented outside the IOMMU spinlock, permitting CMD_COMPL_WAIT commands to queue out of order and breaking the ordering invariant in wait_on_sem() under concurrent TLB invalidations. No public exploit or active exploitation has been identified; EPSS stands at 0.02% (4th percentile), reflecting negligible real-world exploitation probability at time of analysis.
Improper error-path cleanup in the Linux kernel's cpsw_new (TI Common Platform Switch) network driver can trigger an attempt to unregister a net device that was never successfully registered, causing a kernel crash or panic and resulting in local denial of service. Systems running affected kernel versions on Texas Instruments SoC hardware - including BeagleBone and AM335x/AM437x platforms - are at risk when the CPSW driver encounters a failure during the first MAC's netdev registration. No public exploit identified at time of analysis and EPSS exploitation probability is extremely low at 0.02% (4th percentile), consistent with its hardware-specific, error-path nature.
Memory leak in Linux kernel tw9903 media driver probe function allows local authenticated attackers to cause denial of service through repeated device initialization failures. The v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() allocations are not freed in one error path of tw9903_probe(), enabling exhaustion of kernel memory. CVSS 5.5 (local, low complexity, requires low privileges). EPSS score of 0.02% indicates minimal exploitation probability.
Local denial of service in Linux kernel ring-buffer tracing code allows authenticated local users to crash the system by triggering invalid memory access through malformed event length fields. The vulnerability exists in rb_read_data_buffer(), which validates possibly corrupted ring buffers at boot but fails to verify event lengths are within acceptable ranges before calculating buffer offsets. EPSS exploitation probability is very low at 0.02%, and no public exploit code or active exploitation has been identified.
Denial of service in Linux kernel minix filesystem implementation allows local authenticated users to crash the system via crafted minix superblock structures due to missing validation of s_log_zone_size and other superblock fields in the minix_check_superblock() function.
Kernel lockup in the Qualcomm Q6ASM (Audio Stream Manager) driver allows a local low-privileged user to trigger a system hang by racing audio stream closure against in-flight DSP responses. Affected Linux kernel versions spanning from the initial commit (1da177e4c3f4) up to the stable fixes in 6.19.6 and 7.0 are vulnerable. A prior partial fix (commit a354f030dbce) attempted to suppress post-close DSP response handling but failed to prevent processing, leaving the lockup reachable. No public exploit code exists and no active exploitation has been confirmed - EPSS sits at 0.02% (5th percentile), consistent with a niche hardware-dependent kernel DoS.
Memory leak in Linux kernel fbdev vt8500lcdfb driver allows local authenticated users to cause denial of service via unfreed DMA-allocated buffer on error path. The vulnerability exists in the framebuffer initialization code where dma_alloc_coherent() allocation for fbi->fb.screen_buffer is not properly freed if an error occurs during probe, leading to memory exhaustion on repeated device initialization attempts. Local privilege required; no remote or unauthenticated attack vector.
Denial of service in Linux kernel APEI/GHES ARM processor error handling allows local authenticated attackers to trigger kernel oops by crafting malformed ARM Processor Error records with incomplete or oversized section data, causing out-of-bounds memory dereference. CVSS 5.5 (local, low complexity, authenticated, availability impact only) with EPSS 0.02% indicates low real-world exploitation probability despite public patch availability.
Missing input validation in the Linux kernel's amdgpu DRM driver allows a local user with low privileges to trigger GPU faults by supplying invalid user queue sizes. The driver fails to enforce two hardware requirements - that queue sizes be a power-of-two and at least AMDGPU_GPU_PAGE_SIZE - enabling crafted queue configurations that cause availability loss (GPU faults or unexpected GPU subsystem behavior). No public exploit is identified at time of analysis, and EPSS at 0.02% (4th percentile) reflects very low real-world exploitation probability. Patches are available in kernel stable branches 6.18.16, 6.19.6, and 7.0.
Reference count leak in the Linux kernel's NFS server daemon (nfsd) subsystem allows a local low-privileged user on a system running NFSv4 to exhaust kernel file object resources, resulting in denial of service. The vulnerability lies in nfsd_get_dir_deleg(), which fails to release the nfs4_file reference before early return paths. No public exploit exists and the EPSS score of 0.02% (5th percentile) reflects very low real-world exploitation probability; there is no CISA KEV listing.
Resource reference leak in the Linux kernel's dm-multipath (dm mpath) subsystem allows a local low-privileged user to trigger an availability impact against systems using multipath SCSI storage. Specifically, the `parse_path()` function fails to call `dm_put_device()` when `scsi_dh_attached_handler_name()` returns -ENOMEM during path parsing, leaving a dangling device reference that is never released. No public exploit exists and EPSS probability is 0.02%, placing this firmly in the low-exploitation-likelihood tier, but enterprise Linux systems with SAN-backed multipath storage are in scope. Vendor-released patches are available in Linux 6.19.6 and the 7.0 stable branch.
System hang vulnerability in the AMD DCN35 display engine driver allows a local low-privilege user to trigger an unrecoverable kernel hang by initiating a TMDS display disable event on affected AMD hardware. The hang arises because the PHY FSM transition from TX_EN to PLL_ON is non-atomic, leaving the Output Timing Generator stuck and blocking DCHVM IOMMU invalidation acknowledgments - a condition that can arise under normal display reconfiguration. No public exploit code exists and EPSS is 0.02% (5th percentile), indicating no meaningful exploitation interest; the CISA KEV does not list this vulnerability.
Error handling flaws in the Linux kernel's V4L2 async media subsystem allow a local low-privileged attacker to crash the kernel, causing a denial of service. Two bugs exist in the post-match processing path: an async connection is double-removed from the sub-device's connection list when v4l2_async_match_notify() fails mid-way, and the connection's sd pointer is dereferenced in the unbind error path before it is initialized - a NULL pointer dereference. No public exploit or active exploitation has been identified; EPSS at 0.02% (5th percentile) confirms very low current exploitation probability and this vulnerability is not listed in CISA KEV.
Kernel worker crash (BUG_ON oops) in the Linux kernel Ceph filesystem driver occurs when fscrypt encryption is enabled and GFP_NOWAIT bounce buffer allocations fail during writeback batch processing. A local user with write access to an fscrypt-encrypted Ceph mount can trigger this under memory pressure, causing the writeback loop to pass a stale page array pointer to ceph_allocate_page_array(), firing its BUG_ON assertion and crashing the worker. No public exploit is identified; EPSS of 0.02% (4th percentile) and absence from CISA KEV confirm negligible real-world exploitation activity.
Resource leak in the Linux kernel cx25821 media driver allows a local low-privileged user on a system with CX25821 video capture hardware to degrade system availability by exhausting kernel I/O memory regions. The flaw exists in cx25821_dev_setup() where a call to release_mem_region() is missing on the ioremap() failure path, leaving a memory region claimed by cx25821_get_resources() permanently unreleased. No public exploit code exists and EPSS sits at 0.02% (7th percentile), confirming this as a low-exploitation-risk maintenance fix rather than an active threat; patches are available across all active stable kernel branches.
Division by zero in the Linux kernel's CCS (Camera Control Set) media driver can be triggered by a local authenticated user, causing a kernel crash and denial of service. The flaw exists in scaler configuration logic where the MAX_M calculation divides by the MIN_X_OUTPUT_SIZE limit register value without first validating it is non-zero. Affected systems must have a CCS-compatible camera device attached and the ccs media driver loaded; no public exploit or active exploitation (CISA KEV) has been identified, and EPSS sits at 0.02%, reflecting very low real-world exploitation probability.
GPIO sysfs teardown in the Linux kernel fails to drop the final sysfs attribute reference when a GPIO controller is unbound while pins remain exported, leaving stale /sys/class/gpio entries and causing a kernel availability impact on affected systems. Kernels from commit 1cd53df733c21ae0d344a2dec941a3e2a06fefd9 through the fix are affected, with patched stable releases at 6.18.16, 6.19.6, and 7.0; Red Hat and SUSE downstream kernels incorporating the affected range are similarly impacted. No public exploit exists and the EPSS score is 0.02% (4th percentile), making this primarily a stability concern for embedded Linux deployments actively using the GPIO sysfs interface.
Runtime PM reference leak in the Linux kernel's Intel IPU6 PCI driver causes a local denial-of-service condition on systems with compatible Intel Image Processing Unit hardware. Low-privileged local users on affected kernel versions can trigger unbalanced runtime power management reference counts when the ipu6_pci_probe() function traverses error paths without calling pm_runtime_put_sync(), leaving the device in a corrupted power management state. No public exploit exists and the EPSS score of 0.02% (5th percentile) reflects negligible real-world exploitation interest; no active exploitation has been confirmed.
Improper error handling in the Linux kernel's io_uring zero-copy receive (zcrx) subsystem causes a premature release of the zcrx context when closing a queue, leading to a local denial-of-service (kernel crash). Affected kernels include Linux 6.15 series; the root cause is that queue closure does not guarantee immediate termination of all associated page pools, and the code incorrectly released the zcrx ctx directly rather than delegating cleanup to the reference-counting mechanism. No public exploit exists and no active exploitation has been identified at time of analysis; EPSS is 0.02% (5th percentile), consistent with the low real-world exploitation risk.
Integer underflow in the Linux kernel's EFI/CPER firmware error logging function (cper_print_fw_err) allows local authenticated attackers to trigger denial of service via memory dump of unmapped regions, disclose kernel memory contents, or cause system crash when processing malformed EFI firmware error records with invalid offsets. The vulnerability stems from insufficient validation of error record length before subtracting an offset, causing integer wraparound that permits dumping of arbitrary kernel memory regions.
Kernel panic occurs in Linux kernel USB gadget driver (dwc3) when vbus_draw function executes PMIC power-supply APIs from atomic context, causing sleep operations in non-sleepable context. The vulnerability affects Linux kernel versions prior to 5.13 and various stable series (6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0) and is resolved by deferring vbus_draw operations to workqueue context. Local authenticated users with privilege level PR:L can trigger denial of service by invoking affected USB gadget functionality, with EPSS exploitation probability at 0.02% percentile indicating extremely low practical risk despite moderate CVSS severity.
Denial of service via kernel panic in the DRM buddy allocator when rounded allocation sizes exceed available memory. Local authenticated attackers can trigger a BUG_ON() crash by requesting contiguous or large-aligned GPU memory allocations that, after power-of-two or block-size rounding, exceed the total VRAM size. Example: a 9GB contiguous allocation request on 10GB VRAM rounds to 16GB, causing immediate kernel panic. No authentication bypass or privilege escalation; requires local access and appropriate user permissions to invoke DRM allocator.
Denial of service via incomplete xattr cleanup in the Linux kernel OCFS2 filesystem causes memory corruption when processing reflinked files with extended attributes. A local user with standard privileges can trigger this vulnerability through crafted xattr operations, resulting in system crashes or data integrity issues. The flaw affects Linux kernel versions from 2.6.32 through multiple recent releases (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 6.19), with vendor-released patches available for supported stable branches.
Resource leak in Linux kernel xfrm (IPsec) subsystem allows local authenticated users to exhaust kernel memory and trigger denial of service by preventing proper cleanup of IPsec hardware offload device references during network device unregistration. The vulnerability affects XFRM state management when IPsec hardware offloading is configured, particularly when the hardware offload capability (NETIF_F_HW_ESP) is disabled after state creation but before device removal.
Resource leak in the Linux kernel's hwmon nct7363 hardware monitor driver allows a local, low-privileged user to cause a denial-of-service condition through repeated reference exhaustion. The vulnerability resides in nct7363_present_pwm_fanin, which calls of_parse_phandle_with_args() but never releases the acquired device node reference via of_node_put(), violating the kernel's reference-counting contract for device tree nodes. Exploitation requires physical or local authenticated access to a system equipped with NCT7363 hardware and the driver loaded; no public exploit exists and no active exploitation is confirmed (EPSS: 0.02%, 4th percentile).
Use-after-free in the Linux kernel's md/bitmap subsystem triggers a General Protection Fault (GPF) in write_page() during MD array resize operations, resulting in a kernel crash and denial of service. Affected are systems using Software RAID (md) with bitmap support across a wide range of stable kernel series from 3.5 through 7.0, with patches backported to 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, and 6.19.6. No public exploit code exists and the EPSS score of 0.02% (7th percentile) indicates very low exploitation probability; however, Red Hat has issued a formal advisory (RHSA-2026:19568), confirming vendor acknowledgment.
Memory leak in the Linux kernel's tegra-video media driver causes local denial-of-service on NVIDIA Tegra-based systems. The `__tegra_channel_try_format()` function fails to free a V4L2 subdev state object on two error paths after `v4l2_subdev_call()` fails, leaking kernel memory on each invocation. A local authenticated attacker with access to a Tegra video capture device can repeatedly trigger the error paths to exhaust kernel memory, degrading or crashing the system. No public exploit exists and EPSS is 0.02% (7th percentile), consistent with a niche, hardware-specific availability issue.
Hard-lock denial of service in the Linux kernel's Intel VT-d IOMMU subsystem affects systems running PCIe passthrough configurations (QEMU, DPDK) without scalable mode enabled. When a PCIe endpoint's link drops - through surprise removal, link fault, or process termination - the kernel enters an indefinite wait inside qi_submit_sync() attempting an ATS invalidation that the disconnected device can never acknowledge. The existing partial fix (commit 4fc82cd907ac) guards this path only when Intel IOMMU scalable mode is active, leaving non-scalable-mode deployments unprotected. No public exploit identified at time of analysis and EPSS is 0.02%, but the impact is a complete host freeze with no recovery path short of power cycling.
NULL pointer dereferences in the Linux kernel's Apple SMC (System Management Controller) MFD driver expose Apple-hardware systems to local denial-of-service. The struct apple_smc mutex was never initialized in apple_smc_probe(), causing occasional crashes when sub-device probe() functions call apple_smc_read() and attempt to acquire the uninitialized lock. Only local, low-privileged users on Apple hardware running an affected kernel can trigger this condition. No public exploit code exists and no active exploitation has been reported; EPSS sits at 0.02% (4th percentile), consistent with a narrow hardware-specific attack surface.
Memory leak in the Linux kernel's octeontx2-af CGX driver causes kernel resource exhaustion on systems using Marvell OcteonTX2 network hardware. The rx_fc_pfvf_bmap and tx_fc_pfvf_bmap bitmaps allocated during cgx_lmac_init() are never freed in cgx_lmac_exit(), meaning each unbind/rebind cycle of the driver leaks 16 bytes of kernel memory, detectable via kmemleak. No public exploit is identified at time of analysis, and with an EPSS of 0.02% (7th percentile), real-world exploitation risk is negligible; this is a correctness and stability issue rather than an active security threat.
Memory leak in the Linux kernel's MMIO mux driver (mux/mmio subsystem) causes kernel memory exhaustion under local access conditions. The mmio regmap allocated during device probe is never released on probe failure paths or driver unbind, resulting in cumulative memory loss that can degrade availability. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.02% (4th percentile) reflects minimal real-world exploitation interest, consistent with the local-only attack vector and narrow hardware dependency.
Local denial-of-service in the Linux kernel's iris media driver (Qualcomm video codec) results from a regression introduced by commit ad699fa78b59241c9d71a8cafb51525f3dab04d4, now reverted. When a media session enters IRIS_INST_ERROR state and userspace subsequently calls stop_streaming for cleanup, the erroneous check skipped the handler entirely - preventing videobuf2 (vb2) buffer returns and leaving firmware in an inconsistent, non-recoverable state. Affected are systems running the iris V4L2 driver on Qualcomm hardware; no public exploit identified at time of analysis and EPSS is 0.02% (percentile 4%), indicating minimal real-world exploitation activity.
Incorrect DMA buffer cleanup in the Linux kernel's fsl_ucc_hdlc WAN driver (used on Freescale/NXP QorIQ embedded platforms) causes a double-free of coherent DMA memory, resulting in a kernel panic and system crash. The driver allocates rx_buffer and tx_buffer as a single contiguous DMA region in uhdlc_init() but mistakenly calls dma_free_coherent() twice - once per buffer pointer - in uhdlc_memclean(), corrupting the DMA allocator state. Any authenticated local user or kernel path that triggers interface teardown on affected hardware can cause a complete availability loss. No public exploit identified at time of analysis, and EPSS at 0.02% (7th percentile) reflects near-zero opportunistic exploitation probability given the narrow hardware scope.
Deadlock in the Linux Kernel PCI/IOV SR-IOV subsystem allows a local low-privileged user to trigger a kernel hang via a recursive mutex acquisition, resulting in a complete denial of service on the affected host. The root cause is commit 05703271c3cd, which added pci_rescan_remove_lock around SR-IOV enable/disable operations without accounting for the re-entrant path where sriov_del_vfs() is invoked from within pci_stop_and_remove_bus_device_locked(), which already holds the same lock. No public exploit has been identified at time of analysis, and EPSS probability is negligible at 0.02%, consistent with the local-only attack vector.
Denial of service in the Linux kernel's iris media driver results from improper error-path handling during internal buffer allocation. When DMA allocation via dma_alloc_attrs() fails, a partially initialized buffer that was prematurely added to the internal buffers->list remains in that list, leading to inconsistent kernel state and potential resource leaks or NULL-pointer dereferences on subsequent access. Affected systems running Linux 6.15 through pre-patch versions of 6.18 and 6.19 with the iris media subsystem active are at risk; no public exploit has been identified and EPSS is 0.02%, indicating low exploitation probability at time of analysis.
Memory exhaustion in the Linux kernel's iris gen1 media driver allows a local low-privileged user to progressively consume kernel memory until session close, causing a denial of service. The iris driver fails to destroy internal firmware-managed buffers upon receiving the firmware release response, with the leak compounding across video resolution changes as each change allocates new buffers without reclaiming the prior set. No public exploit exists and EPSS sits at the 4th percentile, indicating negligible opportunistic exploitation risk; impact is limited to availability on systems with iris-compatible media hardware.
Resource leak in the Linux kernel cx23885 media driver's ALSA interface causes local denial of service on systems with Conexant 23885 PCI TV tuner hardware. The `snd_cx23885_hw_params()` function fails to call `cx23885_alsa_dma_unmap()` in its error path, leaving DMA resources allocated by `cx23885_alsa_dma_map()` unreleased. A low-privileged local attacker on an affected system can repeatedly trigger the error path to exhaust DMA resources, crashing the kernel subsystem. No public exploit exists and EPSS is 0.02% (7th percentile), reflecting extremely low real-world exploitation probability.
Hard-lockup in Linux kernel IOMMU/VT-d subsystem when flushing device IOTLB during PCIe link-down events affects systems using scalable mode with PASID support. Local authenticated attackers can trigger denial of service by causing PCIe device disconnection followed by resource cleanup operations, such as releasing VFIO group file descriptors, which deadlock the system while attempting ATS invalidation on inaccessible devices. Patch available across multiple stable kernel series.
Linux kernel page fault in ima_restore_measurement_list() when the second-stage kernel is booted via kexec with memory-limiting command lines such as 'mem=<size>' allows local authenticated users to cause a denial of service by triggering an out-of-bounds memory access. The vulnerability occurs on x86_64 architectures when the IMA measurement buffer from the previous kernel falls outside the addressable RAM of the new kernel, resulting in a kernel panic during early IMA restoration.
A circular locking dependency in the Linux kernel's ntfs3 filesystem driver allows local authenticated attackers with low privileges to cause a denial of service (system hang or crash) by triggering simultaneous operations that deadlock between the MFT run lock and bitmap read-write lock. The vulnerability affects kernel versions prior to 6.18.16, 6.19.6, and 7.0, and requires local access with user-level privileges to exploit.
Use-after-free vulnerability in the Linux kernel rpmsg subsystem allows local attackers with low privileges to cause denial of service by exploiting a race condition between driver_override_show() and driver_override_store() functions. The show function reads the driver_override string without holding the device_lock while the store function modifies and frees it under lock, creating a window for memory corruption. The vulnerability requires local access and non-default timing conditions (AC:H), limiting real-world exploitation probability to 0.02% per EPSS scoring.
Memory leak in rtw88 WiFi driver allows local authenticated attackers to cause denial of service via supported band allocation failure. The rtw_set_supported_band() function in the rtl8821ce WiFi driver failed to free allocated memory in error paths during hardware registration, enabling a local privilege escalation attack that exhausts kernel memory. EPSS exploitation probability is very low (0.02%), indicating this is a hardening fix rather than a critical vulnerability.
Resource leak in Linux kernel's most_register_interface() function allows local attackers with low privileges to cause denial of service through memory exhaustion. The vulnerability occurs when most_register_interface() fails during early initialization stages, returning error codes without properly releasing allocated device resources via put_device(). Patch versions 6.12.75, 6.18.16, 6.19.6, and 7.0 address this issue.
Memory leak in hfsplus filesystem driver causes denial of service when superblock setup fails during mount operations. The vulnerability affects Linux kernels when hfsplus is mounted and the setup_bdev_super() function fails after superblock allocation but before hfsplus_fill_super() completes, leaving filesystem-specific data unfreed. Local authenticated users can trigger this condition to exhaust kernel memory and crash the system.
HCL DFXAnalytics exposes detailed stack traces in application responses due to improper error handling, allowing authenticated remote attackers with low privileges to gain insights into the application's internal structure, code logic, and environment configurations. The vulnerability requires high attack complexity and produces limited confidentiality impact, resulting in a CVSS score of 3.1. No active exploitation or public exploit code has been identified at the time of analysis.
HCL DFXAnalytics transmits sensitive data over the network without encryption, allowing network-positioned attackers to intercept and read confidential information. The vulnerability requires high attack complexity (likely man-in-the-middle positioning) but affects all versions of the product when unencrypted channels are in use. No active exploitation has been reported, and the low CVSS score (3.7) reflects limited confidentiality impact with no integrity or availability compromise.
Keylime verifier uses a hardcoded challenge nonce instead of cryptographically random values for TPM quote attestation, allowing local attackers with root access on enrolled machines to capture valid quotes and replay them to bypass detection after system compromise. The vulnerability affects only push-model deployments and requires root privileges on the monitored endpoint; exploitation enables information disclosure and system integrity evasion with CVSS 6.3 severity.
Wildcard TLS certificate validation in Eclipse Vert.x allows remote attackers to bypass Server Name Indication (SNI) hostname verification by presenting arbitrary subdomains matching wildcard patterns, potentially disclosing sensitive server configuration and enabling certificate reuse across unintended service endpoints. The vulnerability affects Vert.x versions using unbounded SNI cache mechanisms without proper hostname validation constraints, and is fixed by implementing bounded LRU caching with proper synchronization and hostname matching enforcement.
Data race conditions in the Linux kernel Bluetooth subsystem allow local authenticated attackers to cause denial of service by triggering concurrent access to hdev->req_status without proper synchronization. The vulnerability exists in the HCI synchronous command processing path where __hci_cmd_sync_sk() and multiple other functions access the same variable across different workqueues without holding locks, potentially causing memory corruption or system hangs.
Data corruption in Linux kernel btrfs filesystem log replay allows local authenticated attackers to cause files to retain incorrect sizes after crash recovery. When a file is truncated to zero bytes, fssynced, and then a hardlink is created, the file incorrectly retains its pre-truncation size after a power failure and log replay, resulting in data integrity violation with availability impact.
Denial of service in Linux kernel tiny SRCU (Synchronize-RCU) subsystem allows local authenticated attackers to trigger a system hang or crash by invoking call_srcu() while holding scheduler locks, causing a circular lock dependency and potential deadlock. The vulnerability affects kernel versions before 6.19.14 and 7.0, with EPSS score of 0.02% indicating low real-world exploitation probability despite moderate CVSS severity.
Linux kernel shadow stack implementation fails to check for errors from mmap_read_lock_killable() in shstk_pop_sigframe(), allowing a local authenticated attacker to trigger a denial of service by causing the function to proceed with a failed lock acquisition. The vulnerability affects multiple stable kernel versions prior to patched releases 6.18.24, 6.19.14, and 7.0, with EPSS exploitation probability of 0.02% suggesting low real-world exploit likelihood despite the availability of a vendor patch.
Denial of service in Linux kernel xfrm (IPsec transform) subsystem allows local authenticated attackers to trigger a kernel panic via improper netlink message size calculation when handling XFRM_MSG_GETAE requests for states with interface ID set. The xfrm_aevent_msgsize() function fails to account for XFRMA_IF_ID attribute space, causing build_aevent() to exceed buffer bounds and hit a BUG_ON assertion, resulting in kernel crash. EPSS exploitation probability is very low at 0.02% despite the local attack vector, suggesting limited real-world impact.
Memory leak in the Linux kernel's Direct Rendering Manager (DRM) vc4 driver allows local authenticated attackers to exhaust kernel memory and trigger a denial of service condition. The vulnerability stems from a missing kfree() call in vc4_free_hang_state() that fails to release a separately allocated BO (buffer object) array, enabling persistent memory exhaustion through repeated hang state operations.
Memory leak in the Linux kernel's vc4 DRM driver allows local authenticated attackers to cause denial of service via memory exhaustion in hang state error handling. The vc4_save_hang_state() function fails to free allocated kernel_state memory on early return paths, enabling a local user with limited privileges to trigger repeated memory leaks and degrade system availability.
Denial of service in Linux kernel lapbether driver allows local authenticated attackers to crash the system by triggering a device type change that violates the ARPHRD_ETHER requirement when transmitting data. The vulnerability exists in the lapbeth_data_transmit() function which assumes the underlying device type remains Ethernet; a local user with low privileges can manipulate the bonding driver to change the device type, causing the kernel to reach an unhandled state and crash. EPSS score of 0.02% indicates low real-world exploitation probability despite the vulnerability being patched across multiple kernel versions.
Memory leak in the Airoha QDMA RX packet processing function allows local authenticated attackers to cause a denial of service through resource exhaustion. The vulnerability occurs when page pool fragments fail to properly return to the pool during error handling in airoha_qdma_rx_process(), allowing an attacker with local access and low privileges to exhaust kernel memory and crash the system. EPSS exploitation probability is extremely low at 0.02%, reflecting the local-only attack vector and privilege requirement.
Denial of service via NULL pointer dereference in the NFC s3fwrn5 driver's UART receive handler allows local authenticated attackers to crash the system. The vulnerability exists in s3fwrn82_uart_read() which consumes bytes from the serial device before allocating a fresh receive buffer; if memory allocation fails after bytes are already consumed, the function incorrectly reports success while leaving the receive buffer NULL, causing a NULL dereference on the next skb_put_u8() call. This affects Linux kernel versions 5.11 and later, with patches available for stable branches 6.6.136, 6.12.83, 6.18.24, 6.19.14, and 7.0.
The AF_XDP socket subsystem (xsk) in the Linux kernel fails to validate that a network device's MTU fits within the usable UMEM frame space at bind time, allowing a local low-privileged user to trigger a kernel denial of service. Usable frame space - chunk size minus headroom and tailroom - can fall below a standard 1500-byte MTU when 2k chunks are used, a gap that became exploitable once tailroom subtraction was introduced. The kernel also omits validation of hardware zero-copy capabilities via net_device::xdp_zc_max_segs. No public exploit has been identified and EPSS is 0.02% (5th percentile), indicating low immediate exploitation risk.
Reference count leak in the Linux kernel's xfrm IPsec subsystem allows a local low-privileged attacker to exhaust kernel memory, resulting in denial of service. The defect resides in xfrm_migrate_policy_find(), where xfrm_pol_hold_rcu() is called twice - once implicitly by the lookup path (which already returns a held reference) and once redundantly - creating a refcount imbalance that prevents memory reclamation. Discovered by the Linux Verification Center using Syzkaller fuzzing; no public exploit identified at time of analysis, and EPSS is very low at 0.02% (5th percentile), indicating minimal observed exploitation activity.
Uninitialized kernel memory is leaked to userspace through the xfrm_user subsystem's build_mapping() function in the Linux Kernel, where a one-byte compiler padding hole in struct xfrm_usersa_id after the proto field is never zeroed before the structure is copied across the kernel/userspace boundary. Authenticated local users with access to XFRM netlink interfaces can read this stale padding byte, potentially extracting kernel stack or heap fragments usable as an information disclosure primitive. No public exploit exists and EPSS is 0.02% (5th percentile), indicating negligible real-world exploitation probability at this time.
Linux kernel PF_KEY IPSEC key management exports leak uninitialized kernel memory via SADB_ACQUIRE, SADB_X_NAT_T_NEW_MAPPING, and SADB_X_MIGRATE messages, allowing local authenticated users to disclose sensitive kernel memory. EPSS score of 0.02% (percentile 5%) indicates minimal real-world exploitation despite patch availability. The 4-byte information leak per message could enable ASLR bypass and kernel address disclosure attacks.
Kernel heap memory disclosure in Linux netfilter's nfnetlink_log subsystem exposes four bytes of stale kernel memory to unprivileged local userspace processes when NFLOG batch mode is active. The flaw exists in __nfulnl_send(), which appends an NLMSG_DONE terminator using nlmsg_put() - a helper that zero-pads alignment bytes but does not initialize the nfgenmsg payload itself - resulting in uninitialized kernel heap data transmitted to any userspace NFLOG consumer. No public exploit code exists and no active exploitation has been confirmed; however, CVSS vector AV:L/AC:L/PR:L signals that low-privileged local users can reliably trigger the leak without any special conditions beyond NFLOG batching being in use.
Denial-of-service via off-by-one allocation in the Linux kernel txgbe network driver allows a local low-privileged user to crash the kernel on systems hosting Wangxun 10GbE NICs. The driver allocates property_entry struct lists without reserving the mandatory null-terminator sentinel slot, meaning kernel subsystems iterating over the list read beyond allocated memory bounds. No active exploitation has been identified and EPSS is extremely low (0.02%, 5th percentile), but patches are available across multiple stable kernel branches including 6.6.136, 6.12.83, 6.18.24, 6.19.14, and 7.0.
Incorrect GENERIC_CMD register field masks in the Linux kernel's IPA (IP Accelerator) network driver for IPA v5.0+ hardware trigger a kernel WARN when a 'stop' command is sent to the MPSS (Modem Processor SubSystem) remoteproc while IPA is active. This availability-only vulnerability (CVSS C:N/I:N/A:H) affects authenticated local users on systems with Qualcomm IPA v5.0+ silicon. No public exploit exists and no KEV listing is present; with an EPSS of 0.02% this is a low-urgency stability fix rather than an active threat.
Local denial-of-service in the Linux kernel's AEAD crypto socket interface (`algif_aead`) allows a low-privileged local user to crash the kernel by submitting a decryption request where the minimum receive buffer size check fails to account for the authentication tag length. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms this is a locally exploitable, high-availability-impact issue with no confidentiality or integrity risk. Patches have been released across multiple Linux LTS stable branches (5.10.254, 5.15.204, 6.1.170, 6.6.136, 6.12.83, 6.18.24, 6.19.14, 7.0) and Ubuntu has issued multiple USN advisories (USN-8277-1 through USN-8281-1). No public exploit code has been identified and EPSS is 0.02%, indicating no public exploitation activity.
Zabbix Agent 2 allows remote attackers with high privileges to inject malicious Oracle TNS connection strings via the 'service' parameter, enabling credential theft from saved database sessions. The vulnerability requires network access and high-level privileges but can lead to disclosure of Oracle database credentials if they are stored in named sessions. CVSS 5.1 reflects the requirement for authenticated attacker access (PR:H), though the impact to stored credentials is significant.
Missing authorization in All-in-One WP Migration Unlimited Extension for WordPress versions up to 2.83 allows authenticated subscribers to create scheduled export jobs without capability verification, enabling attackers to exfiltrate full site backups by redirecting notifications to attacker-controlled email addresses and leveraging exposed backup filenames for download. This results in complete site data disclosure including sensitive information accessible to low-privilege authenticated users.
Paramiko through version 4.0.0 before commit a448945 accepts SHA-1-based RSA signatures (ssh-rsa algorithm) in host key verification and authentication contexts, violating modern cryptographic standards and enabling signature forgery attacks. The vulnerability affects SSH clients and servers using Paramiko for key exchange and authentication, allowing remote attackers on the same network segment to potentially forge host keys or perform man-in-the-middle attacks by exploiting the deprecated SHA-1 hash algorithm. No public exploit code has been identified at time of analysis, though the issue is cryptographically fundamental and OSTIF security audit documentation exists.
Refcount leak in the Linux kernel's fbdev Open Firmware display timing subsystem (of_get_display_timings()) affects kernel versions from 3.9 through multiple stable branches, allowing a local low-privileged user to trigger resource exhaustion that degrades system availability. The flaw lies in error-path handling where of_parse_phandle() increments a device_node refcount into native_mode, but the goto target 'entryfail' at lines 184 and 192 never calls of_node_put(native_mode), leaving the refcount permanently elevated. No active exploitation has been identified - EPSS of 0.02% (7th percentile) and absence from CISA KEV confirm this as a maintenance-class kernel fix rather than an emergency threat.
Recursive glock deadlock in the Linux kernel GFS2 cluster filesystem driver allows a locally authenticated user to cause a kernel thread hang and denial of service. In gfs2_fiemap(), the inode glock is held while calling iomap_fiemap(); if the userspace fiemap output buffer is memory-mapped to the same GFS2 inode, a page fault during buffer writes triggers a second attempt to acquire the already-held glock, producing a deadlock. No public exploit or CISA KEV listing exists; EPSS is 0.02% (7th percentile), consistent with the niche GFS2 deployment footprint and the specific trigger conditions required.
Spectre-BHB (Branch History Buffer) software mitigation was absent in the Linux kernel arm64 subsystem for systems running the HiSilicon TSV110 processor, leaving those systems exposed to branch prediction side-channel attacks capable of leaking sensitive kernel memory contents across privilege boundaries. The root cause was the kernel lacking the TSV110 MIDR (Main ID Register) entry in its processor-specific mitigation table, meaning the software workaround was never applied on that hardware. No public exploit has been identified at time of analysis, and EPSS probability sits at a low 0.02% (7th percentile), though the real-world confidentiality risk on Huawei/HiSilicon arm64 deployments is meaningful given the class of attack.
NULL pointer dereference in the Linux kernel's fsl-imx8mq-usb PHY driver crashes systems built on NXP i.MX8MQ SoC when the driver is unloaded or the device is removed. The driver's probe function omits the required platform_set_drvdata() call, leaving the driver data pointer unset; when remove() subsequently dereferences it, a kernel panic results. Exploitation is limited to local, low-privilege users on specialized embedded hardware; EPSS at 0.02% (4th percentile) and absence from CISA KEV confirm no public exploit or in-the-wild exploitation at time of analysis.
Denial of service in Linux kernel media cx88 driver allows local authenticated attackers to exhaust system resources by triggering a missing DMA unmapping in the snd_cx88_hw_params() error path. The vulnerability causes resource leaks when audio hardware parameter initialization fails, potentially rendering the audio subsystem unavailable. CVSS 5.5 reflects local attack vector with low complexity; EPSS 0.02% indicates minimal real-world exploitation probability despite vendor-released patches across multiple kernel versions.
A use-after-free condition in the libertas USB wireless driver allows local attackers with user privileges to cause a denial of service by triggering a kernel warning and potential crash through rapid firmware loading or repeated usb_tx_block() calls while a USB request is still active. The vulnerability stems from insufficient synchronization of USB URB submissions, enabling concurrent requests on the same URB without enforcing completion of prior transmissions.
Denial of service via kernel warning in MPTCP path manager occurs when combining endpoint removal with fullmesh and flag-setting operations through netlink in the Linux kernel. A local attacker with low privileges can trigger a WARNING in net/mptcp/pm_kernel.c:1074 by sending a crafted sequence of netlink commands, causing the system to emit a kernel warning and potentially become unstable. No known public exploit code exists, but the low CVSS (5.5) and minimal EPSS (0.03%) indicate this is a local DoS with limited real-world impact.
Kernel panic via SError interrupt in Linux kernel media driver (chips-media wave5) when device enters autosuspend during video decoding operations. Local authenticated attackers can trigger a denial of service by queuing buffers to the wave5 video decoder while autosuspend timeout occurs, causing the CPU to access suspended hardware and generate an unrecoverable asynchronous SError, crashing the system. No privilege escalation or code execution; impact limited to availability.
Memory leak in the tw9906 media driver's probe function allows local authenticated attackers to cause denial of service through memory exhaustion. The vulnerability occurs in tw9906_probe() when an error path fails to free memory allocated by v4l2_ctrl_handler_init() and v4l2_ctrl_new_std(), potentially leading to kernel memory depletion on repeated device probe attempts. Vendor-released patches are available across multiple stable kernel branches.
Denial of service in Linux kernel KCM (kernel connection multiplexer) subsystem when processing messages with zero-fragment skbs in frag_list after partial sendmsg failures. A local authenticated attacker can trigger a kernel warning and potentially crash the system by sending a malformed message that fails during data copy, leaving an empty skb in the fragment list. The vulnerability requires local access and low-level socket manipulation, affecting systems running vulnerable Linux kernel versions prior to patching.
Memory leak in the Linux kernel's TI K3 SoC info driver (soc/ti/k3-socinfo) fails to release an allocated mmio regmap, causing denial of service through resource exhaustion on probe failures and driver unbind. Local attackers with low privileges can trigger probe deferral or driver unbind to exhaust kernel memory, affecting systems running vulnerable Linux kernel versions. The vulnerability has a low EPSS score (0.02%) but enables practical local DoS against systems where low-privilege users can control driver lifecycle.
Linux kernel x86 architecture fails to validate IMA measurement list memory bounds during kexec boot with restricted memory parameters, causing kernel panic when the carried-over IMA buffer falls outside truncated RAM. Authenticated local users with kexec privileges can trigger a denial of service. The fix adds a sanity check to validate the previous kernel's IMA kexec buffer against actual memory bounds before restoration, aligning x86 behavior with other architectures.
Availability failure in the Linux kernel's iris media driver for Qualcomm SM8750 (Snapdragon 8 Elite) causes video codec sessions to crash during bring-up due to two missing platform data entries. The absent get_vpu_buffer_size field prevents internal VPU buffer allocation, while the missing max_core_mbps entry causes incomplete capability checks and v4l2-compliance failures for the encoder. No public exploit exists and EPSS is 0.02% (4th percentile), consistent with the niche hardware dependency; this is a functional defect with availability impact rather than a traditional exploitable security weakness.
Denial of service in the Linux kernel team network driver arises when a slave interface is moved to a different network namespace and then deleted, causing team_port_del() to fire a spurious NETDEV_CHANGEMTU event during slave unregistration that prompts inetdev_init() to acquire an unreleased reference on the device. This reference leak prevents the device from completing unregistration, hanging the kernel with 'unregister_netdevice: waiting for [device] to become free.' The bug is confined to local authenticated access and no public exploit exists (EPSS 0.02%, 4th percentile); however, the Linux kernel's ubiquitous deployment makes patch application broadly relevant. Upstream stable fixes are confirmed available in Linux 6.18.16, 6.19.6, and 7.0.
Memory leak in the Linux kernel's radio-keene USB FM transmitter driver (radio-keene.c) leaves a v4l2 control handler unfreed when either v4l2_device_register() or video_register_device() fails during device probe. Affected kernel versions range from the commit introducing the flaw (1bf20c3a0c616f44359c573b533d06bae960ee45) through multiple stable branches, with fixed versions confirmed across 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0. No public exploit has been identified at time of analysis, and EPSS at 0.02% (7th percentile) confirms negligible real-world exploitation probability.
Kernel panic in the Linux kernel's chips-media wave5 VPU driver stems from an incorrect device cleanup order during module removal or autosuspend, allowing a powered-down hardware state to be accessed by a still-running worker thread. Systems with chips-media wave5 VPU hardware running video encoding workloads are vulnerable to a local denial-of-service via synchronous external abort (bus error). No public exploit exists and no active exploitation is confirmed; EPSS is 0.02% (5th percentile), reflecting the niche hardware requirement.
Denial-of-service through an invalid spinlock context in the Linux kernel's sh_tmu (SH Timer Unit) clocksource/clockevent driver triggers a lockdep violation and system hang on PREEMPT_RT-enabled builds running on Renesas SH/ARM platforms. The driver invokes pm_runtime_*() and clk_*() functions while holding a raw spinlock required by the clockevent framework; on PREEMPT_RT kernels, these PM and clock management calls acquire regular spinlocks that can sleep, making the combined locking sequence illegal. No public exploit code exists and exploitation probability is negligible (EPSS 0.02%), but the impact on affected hardware is a full system availability loss. Patches are confirmed available across all active stable branches.
Memory leak in the Linux kernel's staging rtl8723bs Wi-Fi driver degrades system availability for hosts running affected kernel versions with Realtek RTL8723BS hardware. The flaw occurs in the BSS scanning code path where cfg80211_inform_bss_frame() can return NULL on failure, but the previously allocated 'buf' buffer is not released, causing unbounded kernel memory loss over time. With EPSS at 0.02% (7th percentile), no CISA KEV listing, and no public exploit code, this is a low-urgency memory management defect patched across all active stable kernel branches.
Memory leak in the Linux kernel io_uring zero-copy receive (zcrx) subsystem allows a local low-privileged attacker to exhaust kernel memory via repeated DMA mapping failures on PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA systems, causing denial of service. The root cause is a sgtable (scatter-gather table) resource that is initialized but never freed when io_populate_area_dma() fails, because the error path's cleanup guard (!is_mapped) incorrectly skips deallocation. No public exploit exists and EPSS is 0.02% (4th percentile), reflecting the narrow hardware-specific trigger condition.
URB (USB Request Block) leak in the Linux kernel pvrusb2 media driver causes a denial-of-service condition on systems with Hauppauge WinTV-PVR USB2 capture devices. The pvr2_send_request_ex() function fails to unlink and await the write URB before returning on read URB submission failure, leaving the URB in an active state; subsequent driver calls trigger a 'URB submitted while active' kernel warning that destabilizes the USB subsystem. No public exploit exists and EPSS is 0.02% (7th percentile), but vendor-released patches are available across all major stable kernel branches.
Uninitialized read bytes in the Linux kernel IPMI IPMB driver expose systems to a local denial-of-service condition. The IPMB subsystem does not use i2c reads by design, but when an i2c read is triggered through the event handler, an uninitialized value is returned from the underlying bus driver, potentially causing kernel instability or a crash on affected server hardware. No public exploit exists and EPSS is 0.02% (7th percentile), indicating low real-world exploitation probability despite patches being available across multiple stable branches.
Denial of service in the Linux kernel AMD IOMMU subsystem allows a local low-privileged user to crash or stall IOMMU completion waits on systems with AMD hardware and IOMMU enabled. The root cause is a race condition where cmd_sem_val was incremented outside the IOMMU spinlock, permitting CMD_COMPL_WAIT commands to queue out of order and breaking the ordering invariant in wait_on_sem() under concurrent TLB invalidations. No public exploit or active exploitation has been identified; EPSS stands at 0.02% (4th percentile), reflecting negligible real-world exploitation probability at time of analysis.
Improper error-path cleanup in the Linux kernel's cpsw_new (TI Common Platform Switch) network driver can trigger an attempt to unregister a net device that was never successfully registered, causing a kernel crash or panic and resulting in local denial of service. Systems running affected kernel versions on Texas Instruments SoC hardware - including BeagleBone and AM335x/AM437x platforms - are at risk when the CPSW driver encounters a failure during the first MAC's netdev registration. No public exploit identified at time of analysis and EPSS exploitation probability is extremely low at 0.02% (4th percentile), consistent with its hardware-specific, error-path nature.
Memory leak in Linux kernel tw9903 media driver probe function allows local authenticated attackers to cause denial of service through repeated device initialization failures. The v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() allocations are not freed in one error path of tw9903_probe(), enabling exhaustion of kernel memory. CVSS 5.5 (local, low complexity, requires low privileges). EPSS score of 0.02% indicates minimal exploitation probability.
Local denial of service in Linux kernel ring-buffer tracing code allows authenticated local users to crash the system by triggering invalid memory access through malformed event length fields. The vulnerability exists in rb_read_data_buffer(), which validates possibly corrupted ring buffers at boot but fails to verify event lengths are within acceptable ranges before calculating buffer offsets. EPSS exploitation probability is very low at 0.02%, and no public exploit code or active exploitation has been identified.
Denial of service in Linux kernel minix filesystem implementation allows local authenticated users to crash the system via crafted minix superblock structures due to missing validation of s_log_zone_size and other superblock fields in the minix_check_superblock() function.
Kernel lockup in the Qualcomm Q6ASM (Audio Stream Manager) driver allows a local low-privileged user to trigger a system hang by racing audio stream closure against in-flight DSP responses. Affected Linux kernel versions spanning from the initial commit (1da177e4c3f4) up to the stable fixes in 6.19.6 and 7.0 are vulnerable. A prior partial fix (commit a354f030dbce) attempted to suppress post-close DSP response handling but failed to prevent processing, leaving the lockup reachable. No public exploit code exists and no active exploitation has been confirmed - EPSS sits at 0.02% (5th percentile), consistent with a niche hardware-dependent kernel DoS.
Memory leak in Linux kernel fbdev vt8500lcdfb driver allows local authenticated users to cause denial of service via unfreed DMA-allocated buffer on error path. The vulnerability exists in the framebuffer initialization code where dma_alloc_coherent() allocation for fbi->fb.screen_buffer is not properly freed if an error occurs during probe, leading to memory exhaustion on repeated device initialization attempts. Local privilege required; no remote or unauthenticated attack vector.
Denial of service in Linux kernel APEI/GHES ARM processor error handling allows local authenticated attackers to trigger kernel oops by crafting malformed ARM Processor Error records with incomplete or oversized section data, causing out-of-bounds memory dereference. CVSS 5.5 (local, low complexity, authenticated, availability impact only) with EPSS 0.02% indicates low real-world exploitation probability despite public patch availability.
Missing input validation in the Linux kernel's amdgpu DRM driver allows a local user with low privileges to trigger GPU faults by supplying invalid user queue sizes. The driver fails to enforce two hardware requirements - that queue sizes be a power-of-two and at least AMDGPU_GPU_PAGE_SIZE - enabling crafted queue configurations that cause availability loss (GPU faults or unexpected GPU subsystem behavior). No public exploit is identified at time of analysis, and EPSS at 0.02% (4th percentile) reflects very low real-world exploitation probability. Patches are available in kernel stable branches 6.18.16, 6.19.6, and 7.0.
Reference count leak in the Linux kernel's NFS server daemon (nfsd) subsystem allows a local low-privileged user on a system running NFSv4 to exhaust kernel file object resources, resulting in denial of service. The vulnerability lies in nfsd_get_dir_deleg(), which fails to release the nfs4_file reference before early return paths. No public exploit exists and the EPSS score of 0.02% (5th percentile) reflects very low real-world exploitation probability; there is no CISA KEV listing.
Resource reference leak in the Linux kernel's dm-multipath (dm mpath) subsystem allows a local low-privileged user to trigger an availability impact against systems using multipath SCSI storage. Specifically, the `parse_path()` function fails to call `dm_put_device()` when `scsi_dh_attached_handler_name()` returns -ENOMEM during path parsing, leaving a dangling device reference that is never released. No public exploit exists and EPSS probability is 0.02%, placing this firmly in the low-exploitation-likelihood tier, but enterprise Linux systems with SAN-backed multipath storage are in scope. Vendor-released patches are available in Linux 6.19.6 and the 7.0 stable branch.
System hang vulnerability in the AMD DCN35 display engine driver allows a local low-privilege user to trigger an unrecoverable kernel hang by initiating a TMDS display disable event on affected AMD hardware. The hang arises because the PHY FSM transition from TX_EN to PLL_ON is non-atomic, leaving the Output Timing Generator stuck and blocking DCHVM IOMMU invalidation acknowledgments - a condition that can arise under normal display reconfiguration. No public exploit code exists and EPSS is 0.02% (5th percentile), indicating no meaningful exploitation interest; the CISA KEV does not list this vulnerability.
Error handling flaws in the Linux kernel's V4L2 async media subsystem allow a local low-privileged attacker to crash the kernel, causing a denial of service. Two bugs exist in the post-match processing path: an async connection is double-removed from the sub-device's connection list when v4l2_async_match_notify() fails mid-way, and the connection's sd pointer is dereferenced in the unbind error path before it is initialized - a NULL pointer dereference. No public exploit or active exploitation has been identified; EPSS at 0.02% (5th percentile) confirms very low current exploitation probability and this vulnerability is not listed in CISA KEV.
Kernel worker crash (BUG_ON oops) in the Linux kernel Ceph filesystem driver occurs when fscrypt encryption is enabled and GFP_NOWAIT bounce buffer allocations fail during writeback batch processing. A local user with write access to an fscrypt-encrypted Ceph mount can trigger this under memory pressure, causing the writeback loop to pass a stale page array pointer to ceph_allocate_page_array(), firing its BUG_ON assertion and crashing the worker. No public exploit is identified; EPSS of 0.02% (4th percentile) and absence from CISA KEV confirm negligible real-world exploitation activity.
Resource leak in the Linux kernel cx25821 media driver allows a local low-privileged user on a system with CX25821 video capture hardware to degrade system availability by exhausting kernel I/O memory regions. The flaw exists in cx25821_dev_setup() where a call to release_mem_region() is missing on the ioremap() failure path, leaving a memory region claimed by cx25821_get_resources() permanently unreleased. No public exploit code exists and EPSS sits at 0.02% (7th percentile), confirming this as a low-exploitation-risk maintenance fix rather than an active threat; patches are available across all active stable kernel branches.
Division by zero in the Linux kernel's CCS (Camera Control Set) media driver can be triggered by a local authenticated user, causing a kernel crash and denial of service. The flaw exists in scaler configuration logic where the MAX_M calculation divides by the MIN_X_OUTPUT_SIZE limit register value without first validating it is non-zero. Affected systems must have a CCS-compatible camera device attached and the ccs media driver loaded; no public exploit or active exploitation (CISA KEV) has been identified, and EPSS sits at 0.02%, reflecting very low real-world exploitation probability.
GPIO sysfs teardown in the Linux kernel fails to drop the final sysfs attribute reference when a GPIO controller is unbound while pins remain exported, leaving stale /sys/class/gpio entries and causing a kernel availability impact on affected systems. Kernels from commit 1cd53df733c21ae0d344a2dec941a3e2a06fefd9 through the fix are affected, with patched stable releases at 6.18.16, 6.19.6, and 7.0; Red Hat and SUSE downstream kernels incorporating the affected range are similarly impacted. No public exploit exists and the EPSS score is 0.02% (4th percentile), making this primarily a stability concern for embedded Linux deployments actively using the GPIO sysfs interface.
Runtime PM reference leak in the Linux kernel's Intel IPU6 PCI driver causes a local denial-of-service condition on systems with compatible Intel Image Processing Unit hardware. Low-privileged local users on affected kernel versions can trigger unbalanced runtime power management reference counts when the ipu6_pci_probe() function traverses error paths without calling pm_runtime_put_sync(), leaving the device in a corrupted power management state. No public exploit exists and the EPSS score of 0.02% (5th percentile) reflects negligible real-world exploitation interest; no active exploitation has been confirmed.
Improper error handling in the Linux kernel's io_uring zero-copy receive (zcrx) subsystem causes a premature release of the zcrx context when closing a queue, leading to a local denial-of-service (kernel crash). Affected kernels include Linux 6.15 series; the root cause is that queue closure does not guarantee immediate termination of all associated page pools, and the code incorrectly released the zcrx ctx directly rather than delegating cleanup to the reference-counting mechanism. No public exploit exists and no active exploitation has been identified at time of analysis; EPSS is 0.02% (5th percentile), consistent with the low real-world exploitation risk.
Integer underflow in the Linux kernel's EFI/CPER firmware error logging function (cper_print_fw_err) allows local authenticated attackers to trigger denial of service via memory dump of unmapped regions, disclose kernel memory contents, or cause system crash when processing malformed EFI firmware error records with invalid offsets. The vulnerability stems from insufficient validation of error record length before subtracting an offset, causing integer wraparound that permits dumping of arbitrary kernel memory regions.
Kernel panic occurs in Linux kernel USB gadget driver (dwc3) when vbus_draw function executes PMIC power-supply APIs from atomic context, causing sleep operations in non-sleepable context. The vulnerability affects Linux kernel versions prior to 5.13 and various stable series (6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0) and is resolved by deferring vbus_draw operations to workqueue context. Local authenticated users with privilege level PR:L can trigger denial of service by invoking affected USB gadget functionality, with EPSS exploitation probability at 0.02% percentile indicating extremely low practical risk despite moderate CVSS severity.
Denial of service via kernel panic in the DRM buddy allocator when rounded allocation sizes exceed available memory. Local authenticated attackers can trigger a BUG_ON() crash by requesting contiguous or large-aligned GPU memory allocations that, after power-of-two or block-size rounding, exceed the total VRAM size. Example: a 9GB contiguous allocation request on 10GB VRAM rounds to 16GB, causing immediate kernel panic. No authentication bypass or privilege escalation; requires local access and appropriate user permissions to invoke DRM allocator.
Denial of service via incomplete xattr cleanup in the Linux kernel OCFS2 filesystem causes memory corruption when processing reflinked files with extended attributes. A local user with standard privileges can trigger this vulnerability through crafted xattr operations, resulting in system crashes or data integrity issues. The flaw affects Linux kernel versions from 2.6.32 through multiple recent releases (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 6.19), with vendor-released patches available for supported stable branches.
Resource leak in Linux kernel xfrm (IPsec) subsystem allows local authenticated users to exhaust kernel memory and trigger denial of service by preventing proper cleanup of IPsec hardware offload device references during network device unregistration. The vulnerability affects XFRM state management when IPsec hardware offloading is configured, particularly when the hardware offload capability (NETIF_F_HW_ESP) is disabled after state creation but before device removal.
Resource leak in the Linux kernel's hwmon nct7363 hardware monitor driver allows a local, low-privileged user to cause a denial-of-service condition through repeated reference exhaustion. The vulnerability resides in nct7363_present_pwm_fanin, which calls of_parse_phandle_with_args() but never releases the acquired device node reference via of_node_put(), violating the kernel's reference-counting contract for device tree nodes. Exploitation requires physical or local authenticated access to a system equipped with NCT7363 hardware and the driver loaded; no public exploit exists and no active exploitation is confirmed (EPSS: 0.02%, 4th percentile).
Use-after-free in the Linux kernel's md/bitmap subsystem triggers a General Protection Fault (GPF) in write_page() during MD array resize operations, resulting in a kernel crash and denial of service. Affected are systems using Software RAID (md) with bitmap support across a wide range of stable kernel series from 3.5 through 7.0, with patches backported to 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, and 6.19.6. No public exploit code exists and the EPSS score of 0.02% (7th percentile) indicates very low exploitation probability; however, Red Hat has issued a formal advisory (RHSA-2026:19568), confirming vendor acknowledgment.
Memory leak in the Linux kernel's tegra-video media driver causes local denial-of-service on NVIDIA Tegra-based systems. The `__tegra_channel_try_format()` function fails to free a V4L2 subdev state object on two error paths after `v4l2_subdev_call()` fails, leaking kernel memory on each invocation. A local authenticated attacker with access to a Tegra video capture device can repeatedly trigger the error paths to exhaust kernel memory, degrading or crashing the system. No public exploit exists and EPSS is 0.02% (7th percentile), consistent with a niche, hardware-specific availability issue.
Hard-lock denial of service in the Linux kernel's Intel VT-d IOMMU subsystem affects systems running PCIe passthrough configurations (QEMU, DPDK) without scalable mode enabled. When a PCIe endpoint's link drops - through surprise removal, link fault, or process termination - the kernel enters an indefinite wait inside qi_submit_sync() attempting an ATS invalidation that the disconnected device can never acknowledge. The existing partial fix (commit 4fc82cd907ac) guards this path only when Intel IOMMU scalable mode is active, leaving non-scalable-mode deployments unprotected. No public exploit identified at time of analysis and EPSS is 0.02%, but the impact is a complete host freeze with no recovery path short of power cycling.
NULL pointer dereferences in the Linux kernel's Apple SMC (System Management Controller) MFD driver expose Apple-hardware systems to local denial-of-service. The struct apple_smc mutex was never initialized in apple_smc_probe(), causing occasional crashes when sub-device probe() functions call apple_smc_read() and attempt to acquire the uninitialized lock. Only local, low-privileged users on Apple hardware running an affected kernel can trigger this condition. No public exploit code exists and no active exploitation has been reported; EPSS sits at 0.02% (4th percentile), consistent with a narrow hardware-specific attack surface.
Memory leak in the Linux kernel's octeontx2-af CGX driver causes kernel resource exhaustion on systems using Marvell OcteonTX2 network hardware. The rx_fc_pfvf_bmap and tx_fc_pfvf_bmap bitmaps allocated during cgx_lmac_init() are never freed in cgx_lmac_exit(), meaning each unbind/rebind cycle of the driver leaks 16 bytes of kernel memory, detectable via kmemleak. No public exploit is identified at time of analysis, and with an EPSS of 0.02% (7th percentile), real-world exploitation risk is negligible; this is a correctness and stability issue rather than an active security threat.
Memory leak in the Linux kernel's MMIO mux driver (mux/mmio subsystem) causes kernel memory exhaustion under local access conditions. The mmio regmap allocated during device probe is never released on probe failure paths or driver unbind, resulting in cumulative memory loss that can degrade availability. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.02% (4th percentile) reflects minimal real-world exploitation interest, consistent with the local-only attack vector and narrow hardware dependency.
Local denial-of-service in the Linux kernel's iris media driver (Qualcomm video codec) results from a regression introduced by commit ad699fa78b59241c9d71a8cafb51525f3dab04d4, now reverted. When a media session enters IRIS_INST_ERROR state and userspace subsequently calls stop_streaming for cleanup, the erroneous check skipped the handler entirely - preventing videobuf2 (vb2) buffer returns and leaving firmware in an inconsistent, non-recoverable state. Affected are systems running the iris V4L2 driver on Qualcomm hardware; no public exploit identified at time of analysis and EPSS is 0.02% (percentile 4%), indicating minimal real-world exploitation activity.
Incorrect DMA buffer cleanup in the Linux kernel's fsl_ucc_hdlc WAN driver (used on Freescale/NXP QorIQ embedded platforms) causes a double-free of coherent DMA memory, resulting in a kernel panic and system crash. The driver allocates rx_buffer and tx_buffer as a single contiguous DMA region in uhdlc_init() but mistakenly calls dma_free_coherent() twice - once per buffer pointer - in uhdlc_memclean(), corrupting the DMA allocator state. Any authenticated local user or kernel path that triggers interface teardown on affected hardware can cause a complete availability loss. No public exploit identified at time of analysis, and EPSS at 0.02% (7th percentile) reflects near-zero opportunistic exploitation probability given the narrow hardware scope.
Deadlock in the Linux Kernel PCI/IOV SR-IOV subsystem allows a local low-privileged user to trigger a kernel hang via a recursive mutex acquisition, resulting in a complete denial of service on the affected host. The root cause is commit 05703271c3cd, which added pci_rescan_remove_lock around SR-IOV enable/disable operations without accounting for the re-entrant path where sriov_del_vfs() is invoked from within pci_stop_and_remove_bus_device_locked(), which already holds the same lock. No public exploit has been identified at time of analysis, and EPSS probability is negligible at 0.02%, consistent with the local-only attack vector.
Denial of service in the Linux kernel's iris media driver results from improper error-path handling during internal buffer allocation. When DMA allocation via dma_alloc_attrs() fails, a partially initialized buffer that was prematurely added to the internal buffers->list remains in that list, leading to inconsistent kernel state and potential resource leaks or NULL-pointer dereferences on subsequent access. Affected systems running Linux 6.15 through pre-patch versions of 6.18 and 6.19 with the iris media subsystem active are at risk; no public exploit has been identified and EPSS is 0.02%, indicating low exploitation probability at time of analysis.
Memory exhaustion in the Linux kernel's iris gen1 media driver allows a local low-privileged user to progressively consume kernel memory until session close, causing a denial of service. The iris driver fails to destroy internal firmware-managed buffers upon receiving the firmware release response, with the leak compounding across video resolution changes as each change allocates new buffers without reclaiming the prior set. No public exploit exists and EPSS sits at the 4th percentile, indicating negligible opportunistic exploitation risk; impact is limited to availability on systems with iris-compatible media hardware.
Resource leak in the Linux kernel cx23885 media driver's ALSA interface causes local denial of service on systems with Conexant 23885 PCI TV tuner hardware. The `snd_cx23885_hw_params()` function fails to call `cx23885_alsa_dma_unmap()` in its error path, leaving DMA resources allocated by `cx23885_alsa_dma_map()` unreleased. A low-privileged local attacker on an affected system can repeatedly trigger the error path to exhaust DMA resources, crashing the kernel subsystem. No public exploit exists and EPSS is 0.02% (7th percentile), reflecting extremely low real-world exploitation probability.
Hard-lockup in Linux kernel IOMMU/VT-d subsystem when flushing device IOTLB during PCIe link-down events affects systems using scalable mode with PASID support. Local authenticated attackers can trigger denial of service by causing PCIe device disconnection followed by resource cleanup operations, such as releasing VFIO group file descriptors, which deadlock the system while attempting ATS invalidation on inaccessible devices. Patch available across multiple stable kernel series.
Linux kernel page fault in ima_restore_measurement_list() when the second-stage kernel is booted via kexec with memory-limiting command lines such as 'mem=<size>' allows local authenticated users to cause a denial of service by triggering an out-of-bounds memory access. The vulnerability occurs on x86_64 architectures when the IMA measurement buffer from the previous kernel falls outside the addressable RAM of the new kernel, resulting in a kernel panic during early IMA restoration.
A circular locking dependency in the Linux kernel's ntfs3 filesystem driver allows local authenticated attackers with low privileges to cause a denial of service (system hang or crash) by triggering simultaneous operations that deadlock between the MFT run lock and bitmap read-write lock. The vulnerability affects kernel versions prior to 6.18.16, 6.19.6, and 7.0, and requires local access with user-level privileges to exploit.
Use-after-free vulnerability in the Linux kernel rpmsg subsystem allows local attackers with low privileges to cause denial of service by exploiting a race condition between driver_override_show() and driver_override_store() functions. The show function reads the driver_override string without holding the device_lock while the store function modifies and frees it under lock, creating a window for memory corruption. The vulnerability requires local access and non-default timing conditions (AC:H), limiting real-world exploitation probability to 0.02% per EPSS scoring.
Memory leak in rtw88 WiFi driver allows local authenticated attackers to cause denial of service via supported band allocation failure. The rtw_set_supported_band() function in the rtl8821ce WiFi driver failed to free allocated memory in error paths during hardware registration, enabling a local privilege escalation attack that exhausts kernel memory. EPSS exploitation probability is very low (0.02%), indicating this is a hardening fix rather than a critical vulnerability.
Resource leak in Linux kernel's most_register_interface() function allows local attackers with low privileges to cause denial of service through memory exhaustion. The vulnerability occurs when most_register_interface() fails during early initialization stages, returning error codes without properly releasing allocated device resources via put_device(). Patch versions 6.12.75, 6.18.16, 6.19.6, and 7.0 address this issue.
Memory leak in hfsplus filesystem driver causes denial of service when superblock setup fails during mount operations. The vulnerability affects Linux kernels when hfsplus is mounted and the setup_bdev_super() function fails after superblock allocation but before hfsplus_fill_super() completes, leaving filesystem-specific data unfreed. Local authenticated users can trigger this condition to exhaust kernel memory and crash the system.
HCL DFXAnalytics exposes detailed stack traces in application responses due to improper error handling, allowing authenticated remote attackers with low privileges to gain insights into the application's internal structure, code logic, and environment configurations. The vulnerability requires high attack complexity and produces limited confidentiality impact, resulting in a CVSS score of 3.1. No active exploitation or public exploit code has been identified at the time of analysis.
HCL DFXAnalytics transmits sensitive data over the network without encryption, allowing network-positioned attackers to intercept and read confidential information. The vulnerability requires high attack complexity (likely man-in-the-middle positioning) but affects all versions of the product when unencrypted channels are in use. No active exploitation has been reported, and the low CVSS score (3.7) reflects limited confidentiality impact with no integrity or availability compromise.
Keylime verifier uses a hardcoded challenge nonce instead of cryptographically random values for TPM quote attestation, allowing local attackers with root access on enrolled machines to capture valid quotes and replay them to bypass detection after system compromise. The vulnerability affects only push-model deployments and requires root privileges on the monitored endpoint; exploitation enables information disclosure and system integrity evasion with CVSS 6.3 severity.
Wildcard TLS certificate validation in Eclipse Vert.x allows remote attackers to bypass Server Name Indication (SNI) hostname verification by presenting arbitrary subdomains matching wildcard patterns, potentially disclosing sensitive server configuration and enabling certificate reuse across unintended service endpoints. The vulnerability affects Vert.x versions using unbounded SNI cache mechanisms without proper hostname validation constraints, and is fixed by implementing bounded LRU caching with proper synchronization and hostname matching enforcement.
Data race conditions in the Linux kernel Bluetooth subsystem allow local authenticated attackers to cause denial of service by triggering concurrent access to hdev->req_status without proper synchronization. The vulnerability exists in the HCI synchronous command processing path where __hci_cmd_sync_sk() and multiple other functions access the same variable across different workqueues without holding locks, potentially causing memory corruption or system hangs.
Data corruption in Linux kernel btrfs filesystem log replay allows local authenticated attackers to cause files to retain incorrect sizes after crash recovery. When a file is truncated to zero bytes, fssynced, and then a hardlink is created, the file incorrectly retains its pre-truncation size after a power failure and log replay, resulting in data integrity violation with availability impact.
Denial of service in Linux kernel tiny SRCU (Synchronize-RCU) subsystem allows local authenticated attackers to trigger a system hang or crash by invoking call_srcu() while holding scheduler locks, causing a circular lock dependency and potential deadlock. The vulnerability affects kernel versions before 6.19.14 and 7.0, with EPSS score of 0.02% indicating low real-world exploitation probability despite moderate CVSS severity.
Linux kernel shadow stack implementation fails to check for errors from mmap_read_lock_killable() in shstk_pop_sigframe(), allowing a local authenticated attacker to trigger a denial of service by causing the function to proceed with a failed lock acquisition. The vulnerability affects multiple stable kernel versions prior to patched releases 6.18.24, 6.19.14, and 7.0, with EPSS exploitation probability of 0.02% suggesting low real-world exploit likelihood despite the availability of a vendor patch.
Denial of service in Linux kernel xfrm (IPsec transform) subsystem allows local authenticated attackers to trigger a kernel panic via improper netlink message size calculation when handling XFRM_MSG_GETAE requests for states with interface ID set. The xfrm_aevent_msgsize() function fails to account for XFRMA_IF_ID attribute space, causing build_aevent() to exceed buffer bounds and hit a BUG_ON assertion, resulting in kernel crash. EPSS exploitation probability is very low at 0.02% despite the local attack vector, suggesting limited real-world impact.
Memory leak in the Linux kernel's Direct Rendering Manager (DRM) vc4 driver allows local authenticated attackers to exhaust kernel memory and trigger a denial of service condition. The vulnerability stems from a missing kfree() call in vc4_free_hang_state() that fails to release a separately allocated BO (buffer object) array, enabling persistent memory exhaustion through repeated hang state operations.
Memory leak in the Linux kernel's vc4 DRM driver allows local authenticated attackers to cause denial of service via memory exhaustion in hang state error handling. The vc4_save_hang_state() function fails to free allocated kernel_state memory on early return paths, enabling a local user with limited privileges to trigger repeated memory leaks and degrade system availability.
Denial of service in Linux kernel lapbether driver allows local authenticated attackers to crash the system by triggering a device type change that violates the ARPHRD_ETHER requirement when transmitting data. The vulnerability exists in the lapbeth_data_transmit() function which assumes the underlying device type remains Ethernet; a local user with low privileges can manipulate the bonding driver to change the device type, causing the kernel to reach an unhandled state and crash. EPSS score of 0.02% indicates low real-world exploitation probability despite the vulnerability being patched across multiple kernel versions.
Memory leak in the Airoha QDMA RX packet processing function allows local authenticated attackers to cause a denial of service through resource exhaustion. The vulnerability occurs when page pool fragments fail to properly return to the pool during error handling in airoha_qdma_rx_process(), allowing an attacker with local access and low privileges to exhaust kernel memory and crash the system. EPSS exploitation probability is extremely low at 0.02%, reflecting the local-only attack vector and privilege requirement.
Denial of service via NULL pointer dereference in the NFC s3fwrn5 driver's UART receive handler allows local authenticated attackers to crash the system. The vulnerability exists in s3fwrn82_uart_read() which consumes bytes from the serial device before allocating a fresh receive buffer; if memory allocation fails after bytes are already consumed, the function incorrectly reports success while leaving the receive buffer NULL, causing a NULL dereference on the next skb_put_u8() call. This affects Linux kernel versions 5.11 and later, with patches available for stable branches 6.6.136, 6.12.83, 6.18.24, 6.19.14, and 7.0.
The AF_XDP socket subsystem (xsk) in the Linux kernel fails to validate that a network device's MTU fits within the usable UMEM frame space at bind time, allowing a local low-privileged user to trigger a kernel denial of service. Usable frame space - chunk size minus headroom and tailroom - can fall below a standard 1500-byte MTU when 2k chunks are used, a gap that became exploitable once tailroom subtraction was introduced. The kernel also omits validation of hardware zero-copy capabilities via net_device::xdp_zc_max_segs. No public exploit has been identified and EPSS is 0.02% (5th percentile), indicating low immediate exploitation risk.
Reference count leak in the Linux kernel's xfrm IPsec subsystem allows a local low-privileged attacker to exhaust kernel memory, resulting in denial of service. The defect resides in xfrm_migrate_policy_find(), where xfrm_pol_hold_rcu() is called twice - once implicitly by the lookup path (which already returns a held reference) and once redundantly - creating a refcount imbalance that prevents memory reclamation. Discovered by the Linux Verification Center using Syzkaller fuzzing; no public exploit identified at time of analysis, and EPSS is very low at 0.02% (5th percentile), indicating minimal observed exploitation activity.
Uninitialized kernel memory is leaked to userspace through the xfrm_user subsystem's build_mapping() function in the Linux Kernel, where a one-byte compiler padding hole in struct xfrm_usersa_id after the proto field is never zeroed before the structure is copied across the kernel/userspace boundary. Authenticated local users with access to XFRM netlink interfaces can read this stale padding byte, potentially extracting kernel stack or heap fragments usable as an information disclosure primitive. No public exploit exists and EPSS is 0.02% (5th percentile), indicating negligible real-world exploitation probability at this time.
Linux kernel PF_KEY IPSEC key management exports leak uninitialized kernel memory via SADB_ACQUIRE, SADB_X_NAT_T_NEW_MAPPING, and SADB_X_MIGRATE messages, allowing local authenticated users to disclose sensitive kernel memory. EPSS score of 0.02% (percentile 5%) indicates minimal real-world exploitation despite patch availability. The 4-byte information leak per message could enable ASLR bypass and kernel address disclosure attacks.
Kernel heap memory disclosure in Linux netfilter's nfnetlink_log subsystem exposes four bytes of stale kernel memory to unprivileged local userspace processes when NFLOG batch mode is active. The flaw exists in __nfulnl_send(), which appends an NLMSG_DONE terminator using nlmsg_put() - a helper that zero-pads alignment bytes but does not initialize the nfgenmsg payload itself - resulting in uninitialized kernel heap data transmitted to any userspace NFLOG consumer. No public exploit code exists and no active exploitation has been confirmed; however, CVSS vector AV:L/AC:L/PR:L signals that low-privileged local users can reliably trigger the leak without any special conditions beyond NFLOG batching being in use.
Denial-of-service via off-by-one allocation in the Linux kernel txgbe network driver allows a local low-privileged user to crash the kernel on systems hosting Wangxun 10GbE NICs. The driver allocates property_entry struct lists without reserving the mandatory null-terminator sentinel slot, meaning kernel subsystems iterating over the list read beyond allocated memory bounds. No active exploitation has been identified and EPSS is extremely low (0.02%, 5th percentile), but patches are available across multiple stable kernel branches including 6.6.136, 6.12.83, 6.18.24, 6.19.14, and 7.0.
Incorrect GENERIC_CMD register field masks in the Linux kernel's IPA (IP Accelerator) network driver for IPA v5.0+ hardware trigger a kernel WARN when a 'stop' command is sent to the MPSS (Modem Processor SubSystem) remoteproc while IPA is active. This availability-only vulnerability (CVSS C:N/I:N/A:H) affects authenticated local users on systems with Qualcomm IPA v5.0+ silicon. No public exploit exists and no KEV listing is present; with an EPSS of 0.02% this is a low-urgency stability fix rather than an active threat.
Local denial-of-service in the Linux kernel's AEAD crypto socket interface (`algif_aead`) allows a low-privileged local user to crash the kernel by submitting a decryption request where the minimum receive buffer size check fails to account for the authentication tag length. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms this is a locally exploitable, high-availability-impact issue with no confidentiality or integrity risk. Patches have been released across multiple Linux LTS stable branches (5.10.254, 5.15.204, 6.1.170, 6.6.136, 6.12.83, 6.18.24, 6.19.14, 7.0) and Ubuntu has issued multiple USN advisories (USN-8277-1 through USN-8281-1). No public exploit code has been identified and EPSS is 0.02%, indicating no public exploitation activity.
Zabbix Agent 2 allows remote attackers with high privileges to inject malicious Oracle TNS connection strings via the 'service' parameter, enabling credential theft from saved database sessions. The vulnerability requires network access and high-level privileges but can lead to disclosure of Oracle database credentials if they are stored in named sessions. CVSS 5.1 reflects the requirement for authenticated attacker access (PR:H), though the impact to stored credentials is significant.
Missing authorization in All-in-One WP Migration Unlimited Extension for WordPress versions up to 2.83 allows authenticated subscribers to create scheduled export jobs without capability verification, enabling attackers to exfiltrate full site backups by redirecting notifications to attacker-controlled email addresses and leveraging exposed backup filenames for download. This results in complete site data disclosure including sensitive information accessible to low-privilege authenticated users.
Paramiko through version 4.0.0 before commit a448945 accepts SHA-1-based RSA signatures (ssh-rsa algorithm) in host key verification and authentication contexts, violating modern cryptographic standards and enabling signature forgery attacks. The vulnerability affects SSH clients and servers using Paramiko for key exchange and authentication, allowing remote attackers on the same network segment to potentially forge host keys or perform man-in-the-middle attacks by exploiting the deprecated SHA-1 hash algorithm. No public exploit code has been identified at time of analysis, though the issue is cryptographically fundamental and OSTIF security audit documentation exists.