Information Disclosure
Monthly
Out-of-bounds array read in the Linux kernel's AMD ACP SoundWire SOF audio driver exposes kernel memory to local attackers on systems equipped with AMD SoundWire hardware. The flaw in create_sdw_dailinks() allows iteration past the end of the allocated sof_dais array when all entries are initialized, lacking any bounds guard on the loop termination condition. No active exploitation is recorded (EPSS 0.17%, 6th percentile; no CISA KEV entry), and patches are available across multiple Linux stable branches.
Lockless directory traversal in the Linux kernel configfs subsystem allows a low-privileged local user to race concurrent lseek() operations against directory iteration, corrupting or dereferencing freed cursor objects in kernel memory. Affecting all Linux kernels from version 2.6.27 through multiple long-term stable branches (fixed in 7.1.5, 6.18.40, 6.12.97, 6.6.145, 6.1.178, 5.15.212, and 5.10.261), successful exploitation could yield full kernel privilege escalation with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and EPSS sits at 0.18% (7th percentile), indicating low near-term exploitation probability.
Use-after-free in the Linux kernel iommufd subsystem allows a local low-privileged attacker on IOMMU-enabled systems to corrupt kernel memory by triggering dmabuf invalidation callbacks against already-destroyed page structures during detach. Affected configurations include virtualization hosts using VFIO or vDPA device passthrough where the iommufd framework is active. The CVSS S:C (Changed Scope) rating reflects the potential for cross-workload impact in multi-tenant environments; no public exploit identified at time of analysis, and EPSS at 0.15% (5th percentile) indicates negligible observed exploitation activity.
Use-after-free in the Linux kernel mt76 MediaTek WiFi driver allows a local low-privileged attacker to dereference freed memory during concurrent TX datapath operations, potentially achieving full kernel compromise (C:H/I:H/A:H). The flaw exists in mt76_put_vif_phy_link(), where kfree() is called on an offchannel link structure immediately after rcu_assign_pointer(NULL) - without synchronizing against in-flight RCU readers in the TX softirq path (mt7996_mac_write_txwi) that already hold the pointer. No public exploit is identified at time of analysis, and EPSS of 0.17% (6th percentile) confirms very low current exploitation activity despite a CVSS score of 7.8.
Token resource leak in the Linux kernel mt7996 WiFi driver (mt76 subsystem) allows an adjacent unauthenticated attacker to exhaust TX tokens by repeatedly triggering failed link_conf or link_sta lookups in mt7996_tx_prepare_skb(), potentially degrading or crashing WiFi functionality on affected devices. The provided CVSS 8.8 score with C:H/I:H/A:H is notably high for what the description characterizes as a resource management bug; the actual impact most closely aligns with denial-of-service through token exhaustion, not direct confidentiality or integrity compromise. No public exploit code exists and EPSS sits at 0.17% (6th percentile), indicating minimal current exploitation interest. Patches are available in Linux 6.18.40, 7.1.5, and 7.2-rc1.
Invalid pointer dereference in the Linux kernel btrfs delayed reference processing loop (`__btrfs_run_delayed_refs()`) allows a local attacker with access to a btrfs-mounted volume to crash the kernel, causing a denial of service. The defect was introduced by a refactoring commit (0110a4c43451) that inadvertently removed safety guards which reset an internal pointer to NULL when `btrfs_select_ref_head()` returns `ERR_PTR(-EAGAIN)`, causing a subsequent `spin_lock()` call on the error code value treated as a pointer address. No public exploit code has been identified and EPSS probability is 0.18% (7th percentile), though patches are available across all active stable kernel branches.
Resource leak in the Linux kernel NFS server (NFSD) allows connected NFS clients to cause a denial-of-service condition by sending FREE_STATEID for an admin-revoked parallel NFS (pNFS) layout stateid. The kernel function nfsd4_drop_revoked_stid() lacks handling for the SC_TYPE_LAYOUT case, causing the stateid to remain allocated in the IDR tree and on the per-client list indefinitely rather than being properly unhashed and freed. No public exploit exists and EPSS is 0.17% (6th percentile), but the unauthenticated network vector and availability impact score of 7.5 warrant attention on NFS servers with pNFS layouts enabled. Vendor-released patches are available in stable kernel branches.
Incorrect file-handle hashing in the Linux kernel's lockd (NLM) server causes NLMv4 lock-state lookups to fail intermittently. When a client presents an NFS file handle shorter than LOCKD_FH_HASH_SIZE (32 bytes), file_hash() digests stale bytes left in the argument buffer from a prior request, so the same wire handle hashes into different nlm_files[] buckets across calls and nlm_lookup_file() misses existing lock records. This is a functional-correctness and reliability defect introduced by commit 3de744ee4e45 during the xdrgen NLMv4 TEST conversion; a vendor patch is available, EPSS is low (0.15%), and there is no public exploit identified at time of analysis and no CISA KEV listing.
Unsafe destructor execution in the Linux kernel BPF subsystem allows a local attacker with BPF program loading privileges to trigger memory corruption by causing map value cleanup routines to run from NMI (Non-Maskable Interrupt) context. The flaw affects array and hashtab BPF maps containing special fields such as referenced kptrs, uptr, timer, workqueue, and graph roots - destructors for these types are not NMI-safe, yet tracing BPF programs can invoke map update or delete operations from that context. No active exploitation has been identified (not in CISA KEV); EPSS is 0.17% (7th percentile), consistent with a locally-exploitable kernel flaw requiring specialized capabilities.
Use-after-free in the Linux kernel VDUSE (vDPA Device in Userspace) subsystem allows a local low-privileged user to corrupt kernel memory and escalate privileges to full kernel control. The flaw exists in vduse_dev_open(), which releases vduse_lock after an IDR lookup but before acquiring dev->lock, creating a race window where a concurrent VDUSE_DESTROY_DEV ioctl can remove and free the same struct vduse_dev object - causing the open path to later dereference freed memory. No public exploit code and no CISA KEV listing are identified at time of analysis, and EPSS sits at 0.17% (7th percentile), indicating low current exploitation probability despite a high CVSS score of 8.8.
Local memory corruption in the Linux kernel's vhost-net driver arises from mishandling of zerocopy TX completion: vhost_zerocopy_complete() treats every ubuf_info callback as a finished vhost descriptor, so when the networking stack clones a zerocopy skb (e.g. batman-adv fragmentation via skb_split/skb_zerocopy_clone, or veth forwarding via skb_copy_ubufs) and a backend reset frees the vhost_net_ubuf_ref, a later delayed completion dereferences the freed ubufs pointer - a slab use-after-free confirmed by KASAN. It affects virtualization hosts running vhost-net with zerocopy TX, and a successful trigger yields kernel memory corruption (crash and potential privilege escalation). There is no public exploit identified at time of analysis, EPSS is low (0.17%), and a vendor patch is available across multiple stable branches.
Incorrect IRQ-to-ring mapping in the Linux kernel's vdpa/octeon_ep driver mishandles interrupt routing on Marvell OCTEON EP devices that expose non-contiguous or non-zero-based IRQ numbers, causing the interrupt handler to index the wrong virtqueue ring. Only systems with OCTEON EP hardware using the vDPA data path are affected, and the fix ships in stable kernels 6.18.40, 7.1.5, and 7.2-rc1. There is no public exploit identified at time of analysis, EPSS is very low (0.17%, 6th percentile), and the published 10.0 CVSS vector is inconsistent with the local, hardware-specific nature of the flaw.
Out-of-bounds write in the Linux kernel's vfio/qat driver allows a local low-privileged user with access to the Intel QuickAssist Technology virtual function migration interface to corrupt kernel memory through a race condition. The root cause is a Time-of-Check Time-of-Use flaw in qat_vf_resume_write(), where two concurrent writers can both pass the filp->f_pos boundary check before the lock is held, causing the second writer to copy data past the end of the migration-state buffer once the first writer has already advanced the file position. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% at the 6th percentile reflects low current exploitation probability; vendor-released patches are available in stable kernel series 6.12.97, 6.18.40, and 7.1.5.
Out-of-bounds memory access in the Linux kernel BPF cgroup storage subsystem exposes multiple stable kernel branches to local privilege escalation, stemming from an incomplete fix for predecessor commit abad3d0bad72. A local attacker with CAP_BPF privilege can construct a tail call chain using a storage-less intermediate BPF program as a bridge between two cgroup-storage-using programs (A→B(no storage)→C(storage)), bypassing cookie validation and causing runtime cgroup local storage in the callee to operate on the original caller's context, triggering an out-of-bounds kernel memory access with C:H/I:H/A:H impact. EPSS is low at 0.17% (7th percentile) and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Use-after-free in the Linux kernel Bluetooth HCI core subsystem allows a local attacker with low privileges to corrupt kernel memory and potentially escalate privileges or crash the system. The hci_unregister_dev() function fails to quiesce cmd_timer and ncmd_timer delayed work items before freeing the hci_dev structure, creating a race window where timer callbacks dereference stale memory including the hdev->reset function pointer. EPSS is very low at 0.17% (6th percentile), no active exploitation has been confirmed, and patched versions are available across multiple Linux stable kernel branches.
Out-of-bounds memory read in the Linux kernel Bluetooth HCI subsystem enables a malformed or malicious Bluetooth controller response to the Read Local Codec Capabilities command to cause the kernel to copy one byte beyond the HCI response payload into the codec list. All kernel versions from 5.16 onward that include Bluetooth codec capability support are affected, and fixed stable releases are available across the 6.1, 6.6, 6.12, 6.18, and 7.1 branches. No public exploit has been identified, and the 7th-percentile EPSS score of 0.17% indicates negligible opportunistic exploitation risk at this time.
Incorrect UAR index release in the Linux kernel RDMA/mlx5 driver allows a local attacker with low privileges to corrupt kernel-level resource tracking structures, potentially enabling privilege escalation, information disclosure, or denial-of-service via kernel crash. All kernel versions from 4.16 through the fixed stable releases (6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5) are affected on systems equipped with Mellanox/NVIDIA ConnectX RDMA hardware. No public exploit code or active exploitation has been identified; EPSS stands at 0.17% (7th percentile), indicating very low current exploitation probability.
Out-of-bounds read in the Linux kernel's ASoC hdac_hdmi HDMI audio codec driver allows a local attacker with low privileges to expose sensitive kernel memory or crash the kernel by writing a crafted out-of-range enum value to the ALSA control interface. The flaw exists in hdac_hdmi_set_pin_port_mux(), which indexes the texts array using the attacker-supplied value before the bounds-checking helper snd_soc_dapm_put_enum_double() has a chance to reject it. Patches are confirmed available across seven stable kernel branches; with an EPSS of 0.17% and no CISA KEV listing, no active exploitation has been identified at time of analysis.
Missing input validation in the Linux kernel's ASoC Meson AIU audio driver allows a local low-privileged attacker to supply out-of-range enum values to HDMI and internal codec mux put callbacks, triggering snd_soc_enum_item_to_val() on unvalidated input and resulting in out-of-bounds kernel memory access. Systems running Linux 5.7 through pre-7.1.5 on Amlogic Meson SoC hardware are affected, with potential for high confidentiality impact (kernel memory disclosure), limited integrity impact, and kernel crash (availability). No public exploit code exists and exploitation probability is very low (EPSS 0.15%, 5th percentile), but the local attack vector and low privilege requirement mean any user with ALSA device access on affected hardware is a potential threat actor.
Input validation bypass in the Linux kernel's FSL audmix ASoC driver allows a local low-privileged user to write out-of-range enum values to ALSA mixer controls, triggering out-of-bounds memory access in kernel space with potential for privilege escalation or kernel memory disclosure. Specifically, fsl_audmix_put_mix_clk_src() uses an unvalidated value in a BIT() shift operation, and fsl_audmix_put_out_src() uses it to index the prms transition table, both before any bounds check is performed. No public exploit exists and EPSS is extremely low (0.18%, 7th percentile), but the CVSS score of 7.8 reflects the high kernel-level impact if exploited on hardware where the driver is active.
Out-of-bounds array read in the Linux kernel's ASoC Tegra audio driver (tegra210_ahub) allows a local attacker with low privileges to disclose kernel memory contents or trigger a kernel panic on NVIDIA Tegra 210-based systems. The flaw in tegra_ahub_put_value_enum() accesses e->values[item[0]] before validating that item[0] falls within the valid enum range, making the existing bounds check ineffective. Patches are confirmed across multiple stable kernel branches; no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Linux kernel's IPv4 Forwarding Information Base (FIB) subsystem enables a local low-privileged attacker to corrupt kernel memory, potentially escalating to root. The flaw manifests in fib_leaf_notify() when network device driver callbacks - mlxsw, rocker, and nsim - invoke refcount_inc() on a dying fib_info object under RCU, violating reference-counting safety and triggering the 'addition on 0; use-after-free' kernel warning confirmed by syzbot. Patches are available in Linux 7.1.5 stable and 7.2-rc1; no public exploit or CISA KEV listing has been identified at time of analysis.
Concurrent use-after-free-adjacent race condition in the Linux kernel's FIB rules subsystem allows a local low-privileged user to trigger a kernel refcount complaint - and potentially a system crash or memory corruption - by racing a FIB rules dump against the teardown of a dying fib_rule object. Affected versions span multiple long-term stable branches from 4.12 onward through 7.x series kernels prior to the backported fix commits. No public exploit has been identified at time of analysis, and the EPSS score of 0.18% (7th percentile) reflects low exploitation probability; exploitation is not confirmed in the CISA KEV catalog.
Incorrect teardown ordering in the Linux kernel's netkit queue lease subsystem allows a local attacker with low privileges to trigger a race window where live NAPI polling consumes net_iov entries whose DMA addresses have already been cleared, causing the physical NIC to DMA to a stale or zero address. Affected kernel versions span from the introducing commit 5602ad61ebee through the 7.1 stable series, with fixes landing in 7.1.5 and 7.2-rc1. No public exploit code exists and EPSS probability stands at 0.15%, but the S:C scope change in the CVSS vector signals that successful exploitation can corrupt memory beyond the vulnerable process boundary, potentially enabling privilege escalation.
Privilege escalation in the Linux kernel's TIPCv2 generic netlink interface exposes mutating operations - including TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and bearer enable/disable - to any local unprivileged process. The legacy TIPCv1 netlink API already enforces CAP_NET_ADMIN via netlink_net_capable(), but TIPCv2's generic netlink handlers omit the GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM flags, creating an enforcement gap. A QEMU/KASAN reproducer running as uid/gid 65534 with zero effective capabilities confirmed the flaw: an attacker can alter network identity, inject or flush cryptographic key material, and disrupt bearer connectivity. No public exploit has been identified and EPSS is very low (0.21%), but the primitives are straightforward for any local user.
TIPC connection send-side denial of service in the Linux kernel allows a remote TIPC peer to permanently wedge a connection by sending a crafted CONN_ACK message with an inflated acknowledgment count. When the peer-supplied count exceeds the unsigned 16-bit snt_unacked counter in tipc_sk_conn_proto_rcv(), integer underflow wraps the counter to a near-maximum value, causing tsk_conn_cong() to report congestion indefinitely and blocking all further transmits on that connection. This affects Linux kernels from the commit that introduced TIPC connection ack handling (around 4.7) through multiple stable branches prior to the backported fixes. No public exploit has been identified and EPSS is 0.21% (12th percentile), indicating low opportunistic risk despite the AV:N CVSS rating.
Unbounded kernel memory exhaustion in the Linux kernel TIPC subsystem allows a malicious peer node to cause a denial-of-service condition by sending PUBLICATION messages with inverted service-range bounds (lower > upper). Kernels from version 4.17 onward accept these malformed bindings in the name-distribution network receive path - unlike the local bind path, which enforces ordering via tipc_uaddr_valid() - causing service_range rbtree entries and associated publication structures to be permanently leaked with no per-peer cap, for the lifetime of the namespace. No public exploit or CISA KEV listing exists, and EPSS is very low (0.21%, 11th percentile), but the attack is mechanically straightforward for any attacker already operating as a TIPC peer.
Improper error-path cleanup in the Linux kernel's Marvell OcteonTX crypto hardware-accelerator driver (crypto/marvell/octeontx) mishandles DMA unmapping: on a mapping failure the sg_cleanup loop indexes list[i] instead of list[j], leaking successfully mapped scatter-gather entries while repeatedly unmapping the already-failed one. Only systems with Marvell OcteonTX crypto hardware and this driver loaded are affected. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile) and the issue is not in CISA KEV.
Resource-leak and repeated-unmap defect in the Linux kernel's Cavium/Marvell CPT cryptographic accelerator driver (crypto/cavium/cpt) mishandles its DMA error-cleanup path, using the outer loop index (list[i]) instead of the inner index (list[j]) so that successfully mapped scatter-gather entries leak while the single failed entry is unmapped repeatedly. It affects only systems running the cavium CPT driver against OcteonTX CPT hardware, is reachable solely when a DMA mapping failure occurs during request setup, and is a local reliability/resource-management bug rather than a remotely exploitable code-execution flaw. No public exploit identified at time of analysis; EPSS is 0.18% (7th percentile) and it is not in CISA KEV.
Corrupted DMA length assignments in the Linux kernel's iommu/dma-iommu subsystem allow a local attacker with low privileges to trigger memory corruption through the PCI Peer-to-Peer DMA (P2PDMA) code path, potentially achieving confidentiality, integrity, and availability impact across scope boundaries. The flaw stems from a variable typo in iommu_dma_map_sg() where multi-segment P2PDMA scatterlists receive the head segment's length for all entries, corrupting DMA mappings and leading to out-of-bounds memory operations. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.19% (9th percentile) reflects low observed exploitation probability.
Missing authorization on the handshake genl family's DONE downcall in Linux kernel 6.4 and later allows a local low-privileged process to forge TLS handshake completion signals to the kernel's TLS infrastructure. Any unprivileged user that can observe or guess a valid sockfd associated with an in-flight handshake request can submit a crafted DONE message - either with STATUS=0 to make the kernel consumer accept a session as if TLS authentication succeeded, or with a non-zero status to abort a legitimate handshake before the trusted agent tlshd can report its real result. No public exploit has been identified at time of analysis, and EPSS is very low (0.17%), but patches are confirmed across multiple stable branches.
Local denial-of-service / kernel-warning condition in the Linux kernel TCP stack allows a race during failed connection setup to trip a socket-lock assertion when eBPF sock_ops callbacks are in use. When a listener has a BPF sock_ops program with BPF_SOCK_OPS_STATE_CB_FLAG attached, a child socket that fails setup in tcp_v4/v6_syn_recv_sock() is force-closed without its socket lock held, causing tcp_done() -> tcp_set_state() -> tcp_call_bpf() to fire sock_owned_by_me() and emit a WARNING. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and the issue is not in CISA KEV; the headline CVSS 9.8 is inconsistent with the actual local, privilege- and race-dependent nature of the bug.
Memory corruption in the Linux kernel network scheduler (net/sched/sch_codel) allows a privileged local user to trigger a wild/dangling pointer dereference by mis-accounting queue length during the CoDel peek operation. When CoDel drops packets during peek it calls qdisc_tree_reduce_backlog before re-incrementing qlen; if qlen momentarily hits zero while peek still returns an skb, the parent qdisc's qlen_notify prematurely deactivates the class, corrupting scheduler state (demonstrated as a KASAN wild-memory-access in qfq_deactivate_agg when qfq parents a codel child). No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and this is not in CISA KEV.
Race condition in the Linux kernel's KCM (Kernel Connection Multiplexor) subsystem exposes systems to potential privilege escalation, memory corruption, and information disclosure when KCM sockets are in active use on multi-CPU systems. The kcm_attach() and kcm_unattach() functions modify live TCP socket callback pointers (sk_data_ready, sk_write_space) via plain stores rather than WRITE_ONCE(), violating the kernel's memory visibility contract and allowing a concurrent CPU to invoke a KCM handler against a mismatched sk_user_data pointer. No active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.19% (9th percentile), but vendor-supplied patches are available across all active stable kernel branches.
Netfilter's nf_dup_netdev component in the Linux kernel exposes a race condition in nft_dup and nft_fwd expressions where the absence of Bottom Half disabling during skb transmission permits CPU migration, causing imbalanced decrementation of xmit recursion counters. A locally authenticated low-privilege user who can influence netfilter packet processing paths may exploit this counter imbalance to escalate privileges or destabilize the kernel. No public exploit code has been identified at time of analysis, and EPSS probability sits at a low 0.19%, indicating limited current exploitation interest despite the high CVSS base score.
Missing access_ok bounds validation in the Linux kernel's BPF uprobe_multi subsystem exposes systems running affected kernel versions to local privilege escalation, kernel memory disclosure, and system crash. Low-privileged local users on systems within the vulnerable commit range - spanning Linux 6.6 and related stable branches - can submit crafted user-space pointers via uprobe_multi BPF configuration that the kernel reads using __get_user without prior bounds verification. No public exploit identified at time of analysis, and EPSS of 0.19% at the 9th percentile reflects low current exploitation activity, but the full C:H/I:H/A:H CVSS impact triad warrants prompt kernel patching on multi-tenant and shared-access systems.
Use-after-free in the Linux kernel's BPF sockmap UDP receive path allows a local low-privileged attacker to corrupt kernel heap memory, enabling potential privilege escalation, kernel memory disclosure, or system crash. The race condition in udp_bpf_recvmsg() allows concurrent threads to access a sk_msg structure after it has been freed, because a prior refactor removed the lock_sock() serialization that TCP and AF_UNIX sockets retain. Discovered by Google's syzbot automated fuzzer on Google Compute Engine; no public exploit beyond that reproduction harness and no CISA KEV listing exist at time of analysis.
Denial of service (and potential memory corruption) in the Linux kernel's TIPC networking subsystem arises from a use-after-free in tipc_l2_send_msg(); when a TIPC L2 bearer is disabled, tipc_disable_l2_media() runs synchronize_net() while b->media_ptr still references the underlying net_device, letting concurrent RCU readers keep sending on a device that is subsequently freed. Syzbot reproduced the slab-use-after-free via ipvlan_hard_header(). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.18%, 7th percentile), consistent with a race-condition kernel bug rather than a mass-exploited flaw.
Use-after-free race condition in the Linux kernel RDMA/bnxt_re driver allows a local attacker with low privileges to write data to a freed kernel memory page, potentially enabling privilege escalation or kernel crash. The vulnerability affects systems running the Broadcom NetXtreme-E RDMA driver across multiple stable kernel branches, with confirmed fixes in kernel versions 7.1.5, 6.18.40, and 7.2-rc1. No public exploit code has been identified and EPSS probability sits at 0.20% (10th percentile), reflecting the narrow hardware prerequisite that sharply limits the exposed population.
Use-after-free race condition in the Linux kernel's RDMA bnxt_re driver allows a local low-privileged user to corrupt kernel memory by triggering a Notification Queue (NQ) interrupt that writes to a freed CQ toggle page during Completion Queue teardown. Systems running Linux kernel versions prior to 7.1.5 or 7.2-rc1 with Broadcom NetXtreme-E/C RDMA-capable adapters are affected. No public exploit or active exploitation has been identified; EPSS remains at 0.15% (5th percentile), reflecting low real-world exploitation probability at time of analysis.
Kernel memory corruption in the Linux RDMA bnxt_re (Broadcom NetXtreme) driver allows a local low-privileged user to trigger undefined hardware behavior by submitting WQE (Work Queue Entry) mode values that exceed the 64K hardware maximum or are zero, with no bounds validation applied. The CVSS vector (AV:L/AC:L/PR:L/S:C/C:H/I:H/A:H, score 8.8) reflects that a local unprivileged process interacting with RDMA verbs can cause a scoped kernel-level impact, including potential memory corruption or system crash. No public exploit has been identified at time of analysis, and EPSS at 0.15% (5th percentile) indicates very low observed exploitation probability, but the scope change to kernel space makes this a meaningful risk in environments deploying Broadcom RDMA adapters.
Improper error handling in the Linux kernel's RDMA/bnxt_re driver (Broadcom NetXtreme RoCE) causes bnxt_qplib_alloc_dpi() to report success even when the underlying ioremap() call fails, leaving callers to operate on an unmapped/invalid Doorbell Page Index resource. Affected kernels are 6.5 and later on systems using the bnxt_re driver with Broadcom RDMA-capable NICs. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is very low (0.15%), so the practical risk is confined to local DoS/robustness rather than remote compromise, despite the high assigned CVSS of 9.2.
Improper resource handling in the Linux kernel's RDMA bnxt_re driver (Broadcom NetXtreme RoCE) allows a local user with access to the uverbs interface to trigger a race and an error-path resource leak by repeatedly requesting write-combining (WC) mmap pages for the same ucontext. The driver historically supported only one WC page per ucontext without a serializing lock, so concurrent or repeated requests could race and, on mmap-insert failure, leak the mapped Doorbell page index. The published CVSS is 9.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), but this reflects the Linux CNA's conservative scoring convention; EPSS is 0.21% (11th percentile), it is not on CISA KEV, and no public exploit identified at time of analysis.
Race condition in the Linux kernel's RDMA/irdma (Intel Ethernet RDMA) driver arises from a legacy waitqueue-plus-flag synchronization pattern that lacked memory barriers around the request_done flag; maintainers resolved it by switching to a completion primitive. Kernels from 5.14 onward that load the irdma module are affected, but the defect is a local concurrency bug in a specific hardware driver, not the remote unauthenticated code execution its CVSS 9.8 rating implies. No public exploit identified at time of analysis, EPSS is low (0.16%, 6th percentile), and it is not in CISA KEV.
Kernel memory corruption in the Linux networking stack lets a local actor trigger a slab use-after-free in the packet-processing path (fib_rules_lookup) via a TOCTOU race in enqueue_to_backlog(). The flaw affects the per-CPU backlog flushing during device unregistration/network-namespace teardown, where a lockless transmitter such as veth_xmit can queue a packet that escapes flush_all_backlogs() and is later dereferenced after free. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and it is not on CISA KEV, so this is a defect fixed upstream rather than an actively-exploited threat.
Use-after-free in the Linux kernel's ksmbd in-kernel SMB server allows a low-privileged authenticated SMB client to dereference freed kernel memory, potentially achieving arbitrary kernel-level code execution or sensitive information disclosure. The race condition exists between `same_client_has_lease()` releasing `ci->m_lock` without holding a reference on the returned `opinfo` pointer and a concurrent SMB CLOSE operation freeing that same object. Affected kernels span the 5.15 through 7.1 stable series; patches are confirmed available across all branches. No public exploit code or CISA KEV listing has been identified at time of analysis, and an EPSS of 0.18% (8th percentile) indicates no currently observed widespread exploitation.
Kernel-level use-after-free in the Linux 9p RDMA transport (net/9p, trans_rdma.c) arises from a race on the unsynchronized rdma->state field, where recv_done() in softirq context and p9_cm_event_handler() mutate state without the req_lock that rdma_request() relies on. Concurrent teardown can silently overwrite a FLUSHING transition with CLOSING, corrupting the connection state machine and freeing RDMA request objects still in use - enabling denial of service and potential local privilege escalation on systems mounting 9p over RDMA. No public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and the flaw is not in CISA KEV.
Use-after-free in the Linux kernel staging nvec driver's nvec_rx_completed() function exposes Tegra-based systems to potential kernel memory corruption. The flaw arises from a TOCTOU race: nvec_msg_free() releases a message pool slot atomically, but the immediately following read of nvec->rx->data[0] occurs after that release - allowing a concurrent nvec_msg_alloc() to reclaim and overwrite the same slot. No public exploit has been identified at time of analysis, and the very low EPSS score (0.18%, 8th percentile) reflects the niche Tegra hardware prerequisite and staging driver context. Fixed commits are available across multiple stable kernel branches.
Kernel panic in Linux CoreSight platform driver exposes ARM systems to local denial-of-service via a NULL pointer dereference on the error cleanup path. The counter tracking output and input connections is incremented before confirming that the backing allocation succeeded; when devm_krealloc_array() or devm_kmalloc() returns ENOMEM, the cleanup routine coresight_release_platform_data() walks the inflated counter and dereferences the resulting NULL or uninitialized garbage pointer, panicking instead of returning gracefully. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), and the absence of KEV listing reflects low observed exploitation. Vendor-released patches are available in Linux 7.1.5 (stable) and 7.2-rc1 (mainline).
Double-decrement of the descriptor_busy reference counter in the Linux kernel's GPIB driver re-introduces a use-after-free condition that a prior security patch (commit d1857f8296dc) was specifically designed to prevent. Affected kernels include the 6.18.22-6.18.39 range and Linux 7.0, with patched releases available at 6.18.40, 7.1.5, and 7.2-rc1. Exploitation requires a local low-privilege account and access to GPIB device nodes; no public exploit code has been identified at time of analysis, and the EPSS score of 0.19% reflects negligible observed exploitation activity.
Improper error handling in the Linux kernel's ntfs3 filesystem driver leaves an inode in an inconsistent state after a failed rename, where a WARN_ON was previously hit instead of properly marking the inode bad. The fix replaces that WARN_ON with a _ntfs_bad_inode() call so the kernel stops operating on the corrupted inode. The recorded CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) is inconsistent with the actual change, which is a local filesystem-driver robustness fix; EPSS is 0.20% (10th percentile) and there is no public exploit identified at time of analysis and no CISA KEV listing.
Memory corruption in the Linux kernel's xprtrdma (RPC-over-RDMA / NFS-over-RDMA) transport arises from a use-after-free in request-slot lifetime management: the RPC Reply handler could drop the rl_kref refcount to zero and return an rpcrdma_req to its free pool while the RDMA HCA was still DMA-reading from that request's send buffer, specifically when a Send carried only pre-registered buffers (sc_unmap_count == 0). This affects Linux systems using RPC-over-RDMA transport (introduced around 5.3) and is fixed by decoupling req recycling from RPC completion. EPSS is low (0.21%, 12th percentile) and there is no public exploit identified at time of analysis; the auto-assigned 9.8 CVSS overstates real-world risk for a race-condition kernel bug on a niche transport.
Use-after-free memory corruption in the Linux kernel's NFSv4 client fixes a race in file-lock list traversal, where nfs_delegation_claim_locks, nfs4_locku_done, and nfs4_lock_done manipulated the inode file-lock list without holding nfsi->rwsem, allowing the list to change under iteration during delegation recall and lock reclaim. The fix serializes traversal under nfsi->rwsem and relocates locks_lock_inode_wait into _nfs4_proc_setlk. This is a locally-triggered kernel race affecting NFSv4 client mounts; no public exploit identified at time of analysis, EPSS is low (0.21%), and it is not on CISA KEV.
Uninitialized kernel memory read in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3) allows a low-privileged local user to potentially leak sensitive kernel memory contents via a crafted or specially structured NTFS file. The flaw manifests in ni_seek_data_or_hole() when run_lookup() fails to locate the target VCN in runs[0], causing attr_data_get_block_locked() to exit prematurely without initializing the lcn variable - a KMSAN-confirmed uninit-value read triggered through the ntfs_llseek/vfs_llseek call chain. No public exploit exists at time of analysis (EPSS 0.20%, 10th percentile) and this is not listed in CISA KEV, indicating low active exploitation risk despite the CVSS 7.1 base score.
Reference-count (kref) underflow in the Linux kernel xprtrdma subsystem permits use-after-free when RDMA_CM_EVENT_ADDR_CHANGE is delivered before RDMA_CM_EVENT_ESTABLISHED during NFS-over-RDMA connection setup. An attacker on the same RDMA fabric who can induce an address-change event during the narrow pre-ESTABLISHED window may corrupt freed kernel memory, potentially leading to privilege escalation, arbitrary kernel code execution, or system crash. No public exploit exists and EPSS of 0.21% (11th percentile) reflects low automated exploitation probability; active exploitation has not been confirmed and no CISA KEV listing is present.
Out-of-bounds read and receive-buffer leak in the Linux kernel's RPC-over-RDMA client transport (xprtrdma) let a malicious or malfunctioning RDMA peer send a short or malformed reply that is misclassified as a backchannel call. The flaw causes the kernel to read up to 20 bytes of stale DMA buffer contents past the wire payload and to orphan a persistently DMA-mapped receive buffer, progressively draining the Receive queue until the peer's Sends draw RNR NAKs. No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.21%); despite the NVD-assigned 9.8 CVSS, the real-world impact is bounded to limited information exposure and connection-level denial of service on systems actually using RPC/RDMA.
Resource exhaustion in the Linux kernel's xprtrdma (RDMA transport for NFS/RPC) subsystem allows a malicious or compromised RDMA peer to trigger unbounded Receive Work Request allocation, causing denial of service on affected systems. The flaw exists in rpcrdma_reply_handler(), where the credit clamp is bypassed for replies matching no pending request (unknown XID), and rpcrdma_post_recvs() then allocates WRs past re_max_requests without bound. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), reflecting the niche RDMA deployment context. Patches are available across multiple stable kernel branches.
Receive queue exhaustion in the Linux kernel's xprtrdma subsystem allows a remote RPC/RDMA peer to stall NFS-over-RDMA client transports by sending a sustained stream of malformed replies. Each reply that is shorter than the fixed RPC/RDMA transport header or carries an unrecognized protocol version drains one posted Receive Work Request without replacement, because two early-exit paths in rpcrdma_reply_handler() return without calling rpcrdma_post_recvs(). Once the queue empties, the transport stalls until reconnect - a targeted denial-of-service with no public exploit or CISA KEV listing and a very low EPSS score of 0.21% (12th percentile).
Use-after-free and reference-count imbalance in the Linux kernel's IPsec (xfrm) asynchronous resumption path allows a device UAF and refcnt leak when packets are processed through tunnel interfaces such as VTI. During async crypto resumption, xfrm_rcv_cb can reassign skb->dev to a tunnel device without taking a reference, so the later decrement frees the tunnel netdevice while the original device leaks (observable as 'unregister_netdevice: waiting for vti1 to become free. Usage count = -2'). The upstream fix stashes the original skb->dev and extends RCU protection over xfrm_rcv_cb and transport_finish. There is no public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile).
Race condition in the Linux kernel AppArmor unix socket mediation subsystem exposes systems with peer path-based AppArmor rules to a use-after-free scenario, enabling a local low-privileged user to potentially escalate privileges and achieve full compromise of confidentiality, integrity, and availability. The flaw involves accessing a peer unix socket's path (`peer_path`) outside the kernel socket state lock, creating a window for concurrent execution of `unix_release_sock()` to free the referenced path while AppArmor reads it. No public exploit code exists and the EPSS score sits at a low 0.17% (7th percentile), but the NVD-assigned CVSS scope change (S:C) reflects that successful exploitation could reach kernel-level components beyond the attacking process.
Reference count leak in the Linux kernel AppArmor security module allows a local low-privileged user to trigger use-after-free conditions via a bug in update_sk_ctx() socket context management, potentially achieving privilege escalation with high confidentiality, integrity, and availability impact. The fix, backported across stable branches (6.18.40, 7.1.5, 7.2-rc1), corrects the unconditional plabel reference put in the caller by adding a compensating reference acquisition. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation probability.
AppArmor's aa_change_profile() in the Linux kernel dereferences a potentially NULL or ERR_PTR label value before the existing IS_ERR_OR_NULL() guard is reached, allowing a local low-privilege attacker to trigger a kernel crash or kernel memory disclosure. Affected are kernel versions from the introducing commit e00b02bb6ac2a1893227ce8014b649028d6425d2 through multiple stable branches, with vendor-released patches confirmed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 7.1.5, and 7.2-rc1. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) reflects minimal current exploitation interest.
Resource leak in Linux kernel AppArmor's aa_label_alloc() function exposes local attackers with low privileges to potential privilege escalation. When proxy allocation fails during label creation, the error path bypasses aa_label_free(), leaving the security identifier (secid) and other label resources unreleased. No public exploit has been identified at time of analysis, and EPSS at 0.18% (8th percentile) reflects low near-term exploitation probability, though the C:H/I:H/A:H CVSS impact ratings signal meaningful consequence if exploited.
Kernel page fault in Linux kernel AppArmor's file auditing path allows a local low-privileged user to crash the system or leak kernel memory via the audit log. The regression was introduced by commit 4a134723f9f1, which left the *name pointer uninitialized when path->dentry is the aa_null sentinel, then passed it to audit_log_untrustedstring() where strlen() dereferences an invalid address. No public exploit code exists and EPSS probability is 0.17% (7th percentile), but patched stable releases 6.18.40, 7.1.5, and 7.2-rc1 are confirmed available.
Double-free kernel memory corruption in the Linux DRM/i915 Intel graphics driver allows a local low-privileged user to potentially escalate privileges or crash the system. The flaw resides in the CRTC color blob pointer cleanup path: after dropping blob references, the pointers are not nulled, so a subsequent failure in the atomic commit path (e.g., -EDEADLK from DP tunnel state lookup) can trigger a second call to intel_crtc_free_hw_state() on the same already-freed state. No public exploit code exists and EPSS is 0.21%, but the CVSS 7.8 local score reflects the full C/I/A impact if kernel heap corruption is reliably weaponized. Vendor patches are available for stable branches.
Use-after-free and double-free memory corruption in the Linux kernel's amdkfd DRM subsystem exposes systems with AMD GPUs to local privilege escalation. The flaw resides in kfd_criu_resume_svm(), where cleanup logic frees struct criu_svm_metadata objects without unlinking them from the list, leaving dangling pointers; a second AMDKFD_IOC_CRIU_OP ioctl from the same process then walks and double-frees those freed objects. Exploitation is reachable by any unprivileged user with render group membership via /dev/kfd - no additional capabilities required. No public exploit identified at time of analysis, and EPSS sits at 0.21% (12th percentile), consistent with a local-access kernel bug without weaponized tooling.
Uninitialized kernel memory exposure in Linux kernel's flow_dissector subsystem allows a local low-privileged attacker to leak kernel memory contents by exploiting a missing device-type check in __skb_flow_dissect(). Affected are Linux kernel versions from 4.2 through stable branches prior to 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. An attacker who can create TUN devices and configure TC qdiscs reads 12 bytes of uninitialized skb memory through the flow dissector's Ethernet address extraction path, which then propagates into rhashtable lookups - a condition confirmed reported via KMSAN. No public exploit identified at time of analysis.
Improper packet-header validation in the Linux kernel's netfilter flowtable IP6IP6 tunnel fast path was corrected by switching nf_flow_ip6_tunnel_proto() from skb_header_pointer() to pskb_may_pull(), guaranteeing the outer IPv6 header is actually present in the skb before the offload path dereferences it. The flaw affects hosts using netfilter flowtable hardware/software offload with IP6IP6 tunnel encapsulation, where a malformed encapsulated packet could be processed against a header not fully pulled into the linear buffer. No public exploit identified at time of analysis; not listed in CISA KEV, and EPSS is low (0.20%, 10th percentile).
Reference count and barrier leaks in the Linux kernel md/raid1 write dispatch path leave writes_pending and barrier accounting permanently imbalanced on certain write failure conditions, producing a high availability impact - potential system hang or crash - on any Linux host running software RAID-1 from kernel 5.17 through pre-7.1.5. The vulnerability is fixed in stable trees at 7.1.5 and 7.2-rc1 via two upstream commits. No active exploitation has been confirmed (no CISA KEV listing), no public exploit code exists, and an EPSS score of 0.20% at the 10th percentile indicates very low current real-world exploitation probability.
Reference accounting defects in the Linux kernel's md/raid10 driver allow writes_pending and barrier references to permanently leak on discard operation failure paths, leading to an unrecoverable hang of the RAID10 array. raid10_make_request() acquires these references before entering raid10_handle_discard(), but multiple failure exits in that function bypass the corresponding release calls md_write_end() and allow_barrier(), causing write accounting and resync barriers to become permanently imbalanced. With no confirmed active exploitation (no CISA KEV listing), an EPSS of 0.16% at the 6th percentile, and no public exploit identified at time of analysis, this is a targeted kernel-configuration issue whose impact is confined to systems explicitly running md/raid10 with discard enabled.
Improper memory-barrier handling in the Linux kernel's netfilter ipset subsystem affects hash-type sets, where lockless RCU readers used the relaxed test_bit() operation instead of test_bit_acquire(), allowing readers running concurrently with add/delete/garbage-collection to observe stale or improperly ordered bit state. The flaw was fixed upstream and backported to stable trees; there is no public exploit identified at time of analysis and it is not in CISA KEV, and the EPSS score is very low (0.21%). Despite an automated NVD CVSS of 9.8, the defect is a memory-ordering race in a kernel packet-filtering path rather than a straightforward remote code execution primitive.
Incorrect RCU (Read-Copy-Update) operation ordering in the Linux kernel's netfilter ipset subsystem allows a local attacker with low privileges to trigger a use-after-free condition in kernel memory, potentially leading to privilege escalation or system crash. The flaw exists because kfree_rcu() was called before rcu_assign_pointer() in the comment extension handling path - scheduling memory for freeing before the pointer update is visible to all CPUs, creating a race window. With a CVSS score of 7.8 and an EPSS of 0.22% (13th percentile), this is assessed as a serious local privilege escalation with low likelihood of opportunistic exploitation. No public exploit has been identified and CISA KEV status is not confirmed.
Privilege escalation in the Linux kernel's netfilter ipset subsystem stems from a race condition between the garbage collector (GC) and set destruction logic, where `queue_delayed_work()` is called unconditionally inside the GC callback while `cancel_delayed_work_sync()` is called during set teardown, allowing the GC to run against freed memory. Affected kernel versions span from 5.4.24 through mainline prior to the fix commits, with patches backported to stable series 6.12.97 and 6.18.40. No public exploit code exists and the CVE is not listed in CISA KEV, but the CVSS 7.8 local-privilege-escalation impact reflects the potential for kernel heap corruption reachable by low-privileged local users.
Type confusion in the Linux kernel's IPv6 In-situ OAM (IOAM) lightweight-tunnel code lets a crafted IOAM route trigger an invalid cast in rt6_get_cookie(), which reads struct rt6_info fields out of a dummy dst_entry that was only ever a bare struct dst_entry embedded in ioam6_lwt. This CWE-843-class flaw affects kernels from 6.16 up to the fixed releases and can produce an invalid pointer access when the aliased sernum/reset_ts field reaches zero. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and the issue is not in CISA KEV, so it reads as a memory-safety/DoS-grade bug rather than a broadly weaponized RCE despite the 9.8 NVD score.
Use-after-free and effective program array corruption in the Linux kernel's BPF cgroup subsystem allow a local attacker with BPF attachment privileges to escalate to root via kernel memory corruption. The flaw in replace_effective_prog() and purge_effective_progs() miscalculates array slot positions when BPF_F_PREORDER programs are present in a cgroup hierarchy, causing purge_effective_progs() to zero the wrong slot and call bpf_prog_put() while a stale reference to the freed program remains in the array. With CVSS 7.8, EPSS at 0.18% (7th percentile), and no CISA KEV listing or public exploit identified at time of analysis, real-world risk is modulated by the non-default precondition of BPF_F_PREORDER cgroup program usage.
Stack type confusion in the Linux kernel BPF verifier allows a local attacker to bypass non-scalar pointer spill validation and treat a live kernel pointer slot as an ordinary scalar stack read. Affected are Linux 7.1 stable series prior to commit 0f9278b22cda and mainline prior to 3a354149bcea, with fixes confirmed in Linux 7.1.5 and 7.2-rc1. Successful exploitation permits full kernel memory read and write access, enabling local privilege escalation; no public exploit code or active exploitation has been identified at time of analysis.
Resource exhaustion in the Linux kernel ice driver allows accumulated CTRL VSI memory leaks during VF resets on Intel E800-series adapters with FDIR filters active, ultimately degrading host availability after repeated VF lifecycle operations. Affected kernel versions span from the introducing commit (da62c5ff9dcd) through all stable branches prior to the fix commits, with patched releases confirmed at 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. No public exploit tool exists and EPSS is a negligible 0.21% (12th percentile), placing this squarely in the patch-when-convenient tier for most deployments - with the exception of high-density SR-IOV virtualization hosts running frequent VF resets, where the cumulative leak poses a realistic availability risk.
Out-of-bounds kernel memory write in the Linux kernel BPF conntrack kfuncs allows a local attacker with BPF access to corrupt memory outside the verifier-enforced boundary. The BPF verifier constrains accessible memory using the caller-supplied opts__sz argument, but the conntrack wrapper functions unconditionally write to opts->error on failure regardless of whether that field falls within the verified range - enabling a write beyond the checked region when opts__sz is deliberately undersized. No public exploit has been identified and EPSS probability is very low (0.20%, 10th percentile), but the CVSS 8.8 score with scope change reflects kernel memory corruption potential and privilege escalation risk for deployments where unprivileged BPF is enabled.
Use-after-free in the Linux kernel's in-kernel SMB server (ksmbd) lets a remote client that opens an SMB connection race two concurrent SMB2 NEGOTIATE requests to trigger a slab UAF read of the shared conn->preauth_info structure (kmalloc-96). The response send path smb3_preauth_hash_rsp() reads and dereferences conn->preauth_info->Preauth_HashValue without holding conn_lock, so one worker can free the object on the failing-negotiate path while another reads it - a window a bare NULL check cannot close. Exploitation is pre-authentication over the network but requires ksmbd to be actively serving shares plus precise timing; EPSS is low (0.21%, 12th percentile), it is not on CISA KEV, and no public exploit identified at time of analysis.
Incorrect IPv4 FIB route resolution in the Linux kernel causes error routes (e.g. 'unreachable') in the merged local/main routing table to be silently overwritten by matching routes in the default table. This occurs specifically when CONFIG_IP_MULTIPLE_TABLES is compiled in but no routing rules have been added, so fib_lookup() fails to bail out after the first table lookup. The result is that traffic which should be blocked/dropped is instead routed, undermining routing-based access-control expectations; no public exploit identified at time of analysis and EPSS probability is low (0.22%).
Indefinite kernel task hang in the Linux kernel's md/raid5 subsystem exposes any system running software RAID5 to a local availability attack via a data race between break_stripe_batch_list() and raid5_make_request(). The race corrupts the R5_Overlap flag on stripe device state without issuing the corresponding wake_up_bit() call, permanently blocking a kernel task on wait_on_bit() with no recovery path short of reboot. EPSS probability is very low at 0.18% and no public exploit has been identified, but the structural impact on active RAID5 arrays under sustained concurrent I/O workloads is a genuine availability concern.
Netfilter connection-count logic in the Linux kernel falsely drops legitimate TCP connections on systems using xt_connlimit or nft_connlimit in soft-limiting mode, across multiple stable branches from 5.10.248 through 6.18.39. The regression, introduced by commit 69894e5b4c5e, causes the active connection count to drop to zero when a new connection reuses a TIME_WAIT socket, after which xt_connlimit misinterprets the zeroed count and rejects valid sessions. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the condition can be triggered by ordinary connection-cycling traffic without authentication.
Verdict-type confusion in the Linux kernel's netfilter nft_compat layer allows a local low-privileged attacker to bypass firewall rules and destabilize packet processing on systems running ebtables emulation. The nft_compat code fails to reject non-bridge xtables targets in NFPROTO_BRIDGE context, permitting a fallback to NFPROTO_UNSPEC that was already blocked in the legacy ebtables path since commit 11ff7288beb2; the nft_compat layer simply missed that guard. No public exploit is identified at time of analysis, and EPSS sits at a low 0.21%, though patched kernel versions are available across all active stable branches.
Out-of-bounds heap read in the Linux kernel ASoC SDCA subsystem allows a local attacker with low privileges to read past the end of a kernel heap buffer by writing an out-of-range enumeration index to the ge_put_enum_double() ALSA control handler. Affected kernels from commit 812ff1baa764 through pre-7.1.5 are vulnerable; the existing bounds check in snd_soc_dapm_put_enum_double() runs only after the unsafe read, providing no protection. No public exploit code has been identified and no active exploitation is confirmed; EPSS of 0.20% (10th percentile) reflects low near-term exploitation probability.
Guest memory corruption in the Linux kernel's s390 (IBM Z) memory-management code, where mishandling of the _PAGE_UNUSED software PTE bit causes in-use KVM guest pages to be discarded as if unused. On s390 KVM hosts running kernels before 7.1.5 (and 7.2-rc series before the fix), the bit set by KVM on unmapped guest pages was not cleared by all PTE-setting paths, so a page returned to use could later be silently dropped - corrupting guest state. There is no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and it is not in CISA KEV.
Use-after-free in the Linux kernel mxl862xx DSA driver exposes systems running MaxLinear MXL862xx Ethernet switches to local privilege escalation via kernel heap corruption. The race condition between the MDIO CRC error work handler and driver teardown allows freed dsa_port objects to be dereferenced if a CRC error is scheduled during the narrow window between MXL862XX_FLAG_WORK_STOPPED being set and dsa_unregister_switch() completing. EPSS is 0.20% (10th percentile) with no CISA KEV listing, reflecting niche hardware dependency and low broad exploitation interest.
Incorrect bounds validation in the Linux kernel's octeontx2-af driver allows a local attacker with low privileges to trigger a kernel-level flaw by issuing a crafted devlink command that sets NIX maximum LFs before any PF/VF assignment, bypassing the faulty assignment-check condition. Systems running Marvell OcteonTX2 SoC hardware with the octeontx2-af driver loaded are affected across multiple stable kernel branches originating from commit dd7842878633453e38d6a4927593dd28b9d8ab91. EPSS exploitation probability is very low at 0.21% (11th percentile), no public exploit code has been identified, and this vulnerability is not listed in the CISA KEV catalog.
Permanent network connectivity loss on Marvell MPIC platforms (Armada 370/XP/38x) results from the mvneta driver failing to re-enable its per-CPU interrupt after a suspend/resume cycle when a NAPI poll was in-flight at suspend time. The race leaves the MPIC per-CPU interrupt masked indefinitely post-resume: the NIC generates interrupts that the CPU never receives, causing a complete outage until reboot. No public exploit exists (EPSS 0.22%, 13th percentile) and the vulnerability is absent from CISA KEV; patches have been released across eight Linux stable branches.
Double-free memory corruption in the Linux kernel's sungem (Sun GEM) Ethernet driver probe error path allows local attackers to trigger kernel heap corruption on systems equipped with Sun GEM hardware. gem_init_one() incorrectly delegates cleanup to gem_remove_one() on register_netdev() failure - which frees DMA blocks, MMIO mappings, PCI regions, and the net_device struct - then falls through to its own cleanup labels that attempt to release the same already-freed resources. No public exploit or active exploitation is identified at time of analysis; EPSS is 0.22% (13th percentile), consistent with the extreme obsolescence of the affected hardware.
Use-after-free in the Linux kernel's UDP tunnel NIC device sync workqueue allows a local low-privileged attacker to corrupt kernel memory during concurrent device operations, potentially achieving full kernel compromise. The flaw stems from a race condition between the workqueue subsystem's internal pending bit and the driver-level work_pending flag in udp_tunnel_nic_device_sync_work(), causing udp_tunnel_nic_unregister() to free the structure while a second work item is still queued and active. No public exploit identified at time of analysis, but patched versions are available across all active stable kernel branches.
Out-of-bounds array read in the Linux kernel's AMD ACP SoundWire SOF audio driver exposes kernel memory to local attackers on systems equipped with AMD SoundWire hardware. The flaw in create_sdw_dailinks() allows iteration past the end of the allocated sof_dais array when all entries are initialized, lacking any bounds guard on the loop termination condition. No active exploitation is recorded (EPSS 0.17%, 6th percentile; no CISA KEV entry), and patches are available across multiple Linux stable branches.
Lockless directory traversal in the Linux kernel configfs subsystem allows a low-privileged local user to race concurrent lseek() operations against directory iteration, corrupting or dereferencing freed cursor objects in kernel memory. Affecting all Linux kernels from version 2.6.27 through multiple long-term stable branches (fixed in 7.1.5, 6.18.40, 6.12.97, 6.6.145, 6.1.178, 5.15.212, and 5.10.261), successful exploitation could yield full kernel privilege escalation with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and EPSS sits at 0.18% (7th percentile), indicating low near-term exploitation probability.
Use-after-free in the Linux kernel iommufd subsystem allows a local low-privileged attacker on IOMMU-enabled systems to corrupt kernel memory by triggering dmabuf invalidation callbacks against already-destroyed page structures during detach. Affected configurations include virtualization hosts using VFIO or vDPA device passthrough where the iommufd framework is active. The CVSS S:C (Changed Scope) rating reflects the potential for cross-workload impact in multi-tenant environments; no public exploit identified at time of analysis, and EPSS at 0.15% (5th percentile) indicates negligible observed exploitation activity.
Use-after-free in the Linux kernel mt76 MediaTek WiFi driver allows a local low-privileged attacker to dereference freed memory during concurrent TX datapath operations, potentially achieving full kernel compromise (C:H/I:H/A:H). The flaw exists in mt76_put_vif_phy_link(), where kfree() is called on an offchannel link structure immediately after rcu_assign_pointer(NULL) - without synchronizing against in-flight RCU readers in the TX softirq path (mt7996_mac_write_txwi) that already hold the pointer. No public exploit is identified at time of analysis, and EPSS of 0.17% (6th percentile) confirms very low current exploitation activity despite a CVSS score of 7.8.
Token resource leak in the Linux kernel mt7996 WiFi driver (mt76 subsystem) allows an adjacent unauthenticated attacker to exhaust TX tokens by repeatedly triggering failed link_conf or link_sta lookups in mt7996_tx_prepare_skb(), potentially degrading or crashing WiFi functionality on affected devices. The provided CVSS 8.8 score with C:H/I:H/A:H is notably high for what the description characterizes as a resource management bug; the actual impact most closely aligns with denial-of-service through token exhaustion, not direct confidentiality or integrity compromise. No public exploit code exists and EPSS sits at 0.17% (6th percentile), indicating minimal current exploitation interest. Patches are available in Linux 6.18.40, 7.1.5, and 7.2-rc1.
Invalid pointer dereference in the Linux kernel btrfs delayed reference processing loop (`__btrfs_run_delayed_refs()`) allows a local attacker with access to a btrfs-mounted volume to crash the kernel, causing a denial of service. The defect was introduced by a refactoring commit (0110a4c43451) that inadvertently removed safety guards which reset an internal pointer to NULL when `btrfs_select_ref_head()` returns `ERR_PTR(-EAGAIN)`, causing a subsequent `spin_lock()` call on the error code value treated as a pointer address. No public exploit code has been identified and EPSS probability is 0.18% (7th percentile), though patches are available across all active stable kernel branches.
Resource leak in the Linux kernel NFS server (NFSD) allows connected NFS clients to cause a denial-of-service condition by sending FREE_STATEID for an admin-revoked parallel NFS (pNFS) layout stateid. The kernel function nfsd4_drop_revoked_stid() lacks handling for the SC_TYPE_LAYOUT case, causing the stateid to remain allocated in the IDR tree and on the per-client list indefinitely rather than being properly unhashed and freed. No public exploit exists and EPSS is 0.17% (6th percentile), but the unauthenticated network vector and availability impact score of 7.5 warrant attention on NFS servers with pNFS layouts enabled. Vendor-released patches are available in stable kernel branches.
Incorrect file-handle hashing in the Linux kernel's lockd (NLM) server causes NLMv4 lock-state lookups to fail intermittently. When a client presents an NFS file handle shorter than LOCKD_FH_HASH_SIZE (32 bytes), file_hash() digests stale bytes left in the argument buffer from a prior request, so the same wire handle hashes into different nlm_files[] buckets across calls and nlm_lookup_file() misses existing lock records. This is a functional-correctness and reliability defect introduced by commit 3de744ee4e45 during the xdrgen NLMv4 TEST conversion; a vendor patch is available, EPSS is low (0.15%), and there is no public exploit identified at time of analysis and no CISA KEV listing.
Unsafe destructor execution in the Linux kernel BPF subsystem allows a local attacker with BPF program loading privileges to trigger memory corruption by causing map value cleanup routines to run from NMI (Non-Maskable Interrupt) context. The flaw affects array and hashtab BPF maps containing special fields such as referenced kptrs, uptr, timer, workqueue, and graph roots - destructors for these types are not NMI-safe, yet tracing BPF programs can invoke map update or delete operations from that context. No active exploitation has been identified (not in CISA KEV); EPSS is 0.17% (7th percentile), consistent with a locally-exploitable kernel flaw requiring specialized capabilities.
Use-after-free in the Linux kernel VDUSE (vDPA Device in Userspace) subsystem allows a local low-privileged user to corrupt kernel memory and escalate privileges to full kernel control. The flaw exists in vduse_dev_open(), which releases vduse_lock after an IDR lookup but before acquiring dev->lock, creating a race window where a concurrent VDUSE_DESTROY_DEV ioctl can remove and free the same struct vduse_dev object - causing the open path to later dereference freed memory. No public exploit code and no CISA KEV listing are identified at time of analysis, and EPSS sits at 0.17% (7th percentile), indicating low current exploitation probability despite a high CVSS score of 8.8.
Local memory corruption in the Linux kernel's vhost-net driver arises from mishandling of zerocopy TX completion: vhost_zerocopy_complete() treats every ubuf_info callback as a finished vhost descriptor, so when the networking stack clones a zerocopy skb (e.g. batman-adv fragmentation via skb_split/skb_zerocopy_clone, or veth forwarding via skb_copy_ubufs) and a backend reset frees the vhost_net_ubuf_ref, a later delayed completion dereferences the freed ubufs pointer - a slab use-after-free confirmed by KASAN. It affects virtualization hosts running vhost-net with zerocopy TX, and a successful trigger yields kernel memory corruption (crash and potential privilege escalation). There is no public exploit identified at time of analysis, EPSS is low (0.17%), and a vendor patch is available across multiple stable branches.
Incorrect IRQ-to-ring mapping in the Linux kernel's vdpa/octeon_ep driver mishandles interrupt routing on Marvell OCTEON EP devices that expose non-contiguous or non-zero-based IRQ numbers, causing the interrupt handler to index the wrong virtqueue ring. Only systems with OCTEON EP hardware using the vDPA data path are affected, and the fix ships in stable kernels 6.18.40, 7.1.5, and 7.2-rc1. There is no public exploit identified at time of analysis, EPSS is very low (0.17%, 6th percentile), and the published 10.0 CVSS vector is inconsistent with the local, hardware-specific nature of the flaw.
Out-of-bounds write in the Linux kernel's vfio/qat driver allows a local low-privileged user with access to the Intel QuickAssist Technology virtual function migration interface to corrupt kernel memory through a race condition. The root cause is a Time-of-Check Time-of-Use flaw in qat_vf_resume_write(), where two concurrent writers can both pass the filp->f_pos boundary check before the lock is held, causing the second writer to copy data past the end of the migration-state buffer once the first writer has already advanced the file position. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% at the 6th percentile reflects low current exploitation probability; vendor-released patches are available in stable kernel series 6.12.97, 6.18.40, and 7.1.5.
Out-of-bounds memory access in the Linux kernel BPF cgroup storage subsystem exposes multiple stable kernel branches to local privilege escalation, stemming from an incomplete fix for predecessor commit abad3d0bad72. A local attacker with CAP_BPF privilege can construct a tail call chain using a storage-less intermediate BPF program as a bridge between two cgroup-storage-using programs (A→B(no storage)→C(storage)), bypassing cookie validation and causing runtime cgroup local storage in the callee to operate on the original caller's context, triggering an out-of-bounds kernel memory access with C:H/I:H/A:H impact. EPSS is low at 0.17% (7th percentile) and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Use-after-free in the Linux kernel Bluetooth HCI core subsystem allows a local attacker with low privileges to corrupt kernel memory and potentially escalate privileges or crash the system. The hci_unregister_dev() function fails to quiesce cmd_timer and ncmd_timer delayed work items before freeing the hci_dev structure, creating a race window where timer callbacks dereference stale memory including the hdev->reset function pointer. EPSS is very low at 0.17% (6th percentile), no active exploitation has been confirmed, and patched versions are available across multiple Linux stable kernel branches.
Out-of-bounds memory read in the Linux kernel Bluetooth HCI subsystem enables a malformed or malicious Bluetooth controller response to the Read Local Codec Capabilities command to cause the kernel to copy one byte beyond the HCI response payload into the codec list. All kernel versions from 5.16 onward that include Bluetooth codec capability support are affected, and fixed stable releases are available across the 6.1, 6.6, 6.12, 6.18, and 7.1 branches. No public exploit has been identified, and the 7th-percentile EPSS score of 0.17% indicates negligible opportunistic exploitation risk at this time.
Incorrect UAR index release in the Linux kernel RDMA/mlx5 driver allows a local attacker with low privileges to corrupt kernel-level resource tracking structures, potentially enabling privilege escalation, information disclosure, or denial-of-service via kernel crash. All kernel versions from 4.16 through the fixed stable releases (6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5) are affected on systems equipped with Mellanox/NVIDIA ConnectX RDMA hardware. No public exploit code or active exploitation has been identified; EPSS stands at 0.17% (7th percentile), indicating very low current exploitation probability.
Out-of-bounds read in the Linux kernel's ASoC hdac_hdmi HDMI audio codec driver allows a local attacker with low privileges to expose sensitive kernel memory or crash the kernel by writing a crafted out-of-range enum value to the ALSA control interface. The flaw exists in hdac_hdmi_set_pin_port_mux(), which indexes the texts array using the attacker-supplied value before the bounds-checking helper snd_soc_dapm_put_enum_double() has a chance to reject it. Patches are confirmed available across seven stable kernel branches; with an EPSS of 0.17% and no CISA KEV listing, no active exploitation has been identified at time of analysis.
Missing input validation in the Linux kernel's ASoC Meson AIU audio driver allows a local low-privileged attacker to supply out-of-range enum values to HDMI and internal codec mux put callbacks, triggering snd_soc_enum_item_to_val() on unvalidated input and resulting in out-of-bounds kernel memory access. Systems running Linux 5.7 through pre-7.1.5 on Amlogic Meson SoC hardware are affected, with potential for high confidentiality impact (kernel memory disclosure), limited integrity impact, and kernel crash (availability). No public exploit code exists and exploitation probability is very low (EPSS 0.15%, 5th percentile), but the local attack vector and low privilege requirement mean any user with ALSA device access on affected hardware is a potential threat actor.
Input validation bypass in the Linux kernel's FSL audmix ASoC driver allows a local low-privileged user to write out-of-range enum values to ALSA mixer controls, triggering out-of-bounds memory access in kernel space with potential for privilege escalation or kernel memory disclosure. Specifically, fsl_audmix_put_mix_clk_src() uses an unvalidated value in a BIT() shift operation, and fsl_audmix_put_out_src() uses it to index the prms transition table, both before any bounds check is performed. No public exploit exists and EPSS is extremely low (0.18%, 7th percentile), but the CVSS score of 7.8 reflects the high kernel-level impact if exploited on hardware where the driver is active.
Out-of-bounds array read in the Linux kernel's ASoC Tegra audio driver (tegra210_ahub) allows a local attacker with low privileges to disclose kernel memory contents or trigger a kernel panic on NVIDIA Tegra 210-based systems. The flaw in tegra_ahub_put_value_enum() accesses e->values[item[0]] before validating that item[0] falls within the valid enum range, making the existing bounds check ineffective. Patches are confirmed across multiple stable kernel branches; no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Linux kernel's IPv4 Forwarding Information Base (FIB) subsystem enables a local low-privileged attacker to corrupt kernel memory, potentially escalating to root. The flaw manifests in fib_leaf_notify() when network device driver callbacks - mlxsw, rocker, and nsim - invoke refcount_inc() on a dying fib_info object under RCU, violating reference-counting safety and triggering the 'addition on 0; use-after-free' kernel warning confirmed by syzbot. Patches are available in Linux 7.1.5 stable and 7.2-rc1; no public exploit or CISA KEV listing has been identified at time of analysis.
Concurrent use-after-free-adjacent race condition in the Linux kernel's FIB rules subsystem allows a local low-privileged user to trigger a kernel refcount complaint - and potentially a system crash or memory corruption - by racing a FIB rules dump against the teardown of a dying fib_rule object. Affected versions span multiple long-term stable branches from 4.12 onward through 7.x series kernels prior to the backported fix commits. No public exploit has been identified at time of analysis, and the EPSS score of 0.18% (7th percentile) reflects low exploitation probability; exploitation is not confirmed in the CISA KEV catalog.
Incorrect teardown ordering in the Linux kernel's netkit queue lease subsystem allows a local attacker with low privileges to trigger a race window where live NAPI polling consumes net_iov entries whose DMA addresses have already been cleared, causing the physical NIC to DMA to a stale or zero address. Affected kernel versions span from the introducing commit 5602ad61ebee through the 7.1 stable series, with fixes landing in 7.1.5 and 7.2-rc1. No public exploit code exists and EPSS probability stands at 0.15%, but the S:C scope change in the CVSS vector signals that successful exploitation can corrupt memory beyond the vulnerable process boundary, potentially enabling privilege escalation.
Privilege escalation in the Linux kernel's TIPCv2 generic netlink interface exposes mutating operations - including TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and bearer enable/disable - to any local unprivileged process. The legacy TIPCv1 netlink API already enforces CAP_NET_ADMIN via netlink_net_capable(), but TIPCv2's generic netlink handlers omit the GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM flags, creating an enforcement gap. A QEMU/KASAN reproducer running as uid/gid 65534 with zero effective capabilities confirmed the flaw: an attacker can alter network identity, inject or flush cryptographic key material, and disrupt bearer connectivity. No public exploit has been identified and EPSS is very low (0.21%), but the primitives are straightforward for any local user.
TIPC connection send-side denial of service in the Linux kernel allows a remote TIPC peer to permanently wedge a connection by sending a crafted CONN_ACK message with an inflated acknowledgment count. When the peer-supplied count exceeds the unsigned 16-bit snt_unacked counter in tipc_sk_conn_proto_rcv(), integer underflow wraps the counter to a near-maximum value, causing tsk_conn_cong() to report congestion indefinitely and blocking all further transmits on that connection. This affects Linux kernels from the commit that introduced TIPC connection ack handling (around 4.7) through multiple stable branches prior to the backported fixes. No public exploit has been identified and EPSS is 0.21% (12th percentile), indicating low opportunistic risk despite the AV:N CVSS rating.
Unbounded kernel memory exhaustion in the Linux kernel TIPC subsystem allows a malicious peer node to cause a denial-of-service condition by sending PUBLICATION messages with inverted service-range bounds (lower > upper). Kernels from version 4.17 onward accept these malformed bindings in the name-distribution network receive path - unlike the local bind path, which enforces ordering via tipc_uaddr_valid() - causing service_range rbtree entries and associated publication structures to be permanently leaked with no per-peer cap, for the lifetime of the namespace. No public exploit or CISA KEV listing exists, and EPSS is very low (0.21%, 11th percentile), but the attack is mechanically straightforward for any attacker already operating as a TIPC peer.
Improper error-path cleanup in the Linux kernel's Marvell OcteonTX crypto hardware-accelerator driver (crypto/marvell/octeontx) mishandles DMA unmapping: on a mapping failure the sg_cleanup loop indexes list[i] instead of list[j], leaking successfully mapped scatter-gather entries while repeatedly unmapping the already-failed one. Only systems with Marvell OcteonTX crypto hardware and this driver loaded are affected. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile) and the issue is not in CISA KEV.
Resource-leak and repeated-unmap defect in the Linux kernel's Cavium/Marvell CPT cryptographic accelerator driver (crypto/cavium/cpt) mishandles its DMA error-cleanup path, using the outer loop index (list[i]) instead of the inner index (list[j]) so that successfully mapped scatter-gather entries leak while the single failed entry is unmapped repeatedly. It affects only systems running the cavium CPT driver against OcteonTX CPT hardware, is reachable solely when a DMA mapping failure occurs during request setup, and is a local reliability/resource-management bug rather than a remotely exploitable code-execution flaw. No public exploit identified at time of analysis; EPSS is 0.18% (7th percentile) and it is not in CISA KEV.
Corrupted DMA length assignments in the Linux kernel's iommu/dma-iommu subsystem allow a local attacker with low privileges to trigger memory corruption through the PCI Peer-to-Peer DMA (P2PDMA) code path, potentially achieving confidentiality, integrity, and availability impact across scope boundaries. The flaw stems from a variable typo in iommu_dma_map_sg() where multi-segment P2PDMA scatterlists receive the head segment's length for all entries, corrupting DMA mappings and leading to out-of-bounds memory operations. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.19% (9th percentile) reflects low observed exploitation probability.
Missing authorization on the handshake genl family's DONE downcall in Linux kernel 6.4 and later allows a local low-privileged process to forge TLS handshake completion signals to the kernel's TLS infrastructure. Any unprivileged user that can observe or guess a valid sockfd associated with an in-flight handshake request can submit a crafted DONE message - either with STATUS=0 to make the kernel consumer accept a session as if TLS authentication succeeded, or with a non-zero status to abort a legitimate handshake before the trusted agent tlshd can report its real result. No public exploit has been identified at time of analysis, and EPSS is very low (0.17%), but patches are confirmed across multiple stable branches.
Local denial-of-service / kernel-warning condition in the Linux kernel TCP stack allows a race during failed connection setup to trip a socket-lock assertion when eBPF sock_ops callbacks are in use. When a listener has a BPF sock_ops program with BPF_SOCK_OPS_STATE_CB_FLAG attached, a child socket that fails setup in tcp_v4/v6_syn_recv_sock() is force-closed without its socket lock held, causing tcp_done() -> tcp_set_state() -> tcp_call_bpf() to fire sock_owned_by_me() and emit a WARNING. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and the issue is not in CISA KEV; the headline CVSS 9.8 is inconsistent with the actual local, privilege- and race-dependent nature of the bug.
Memory corruption in the Linux kernel network scheduler (net/sched/sch_codel) allows a privileged local user to trigger a wild/dangling pointer dereference by mis-accounting queue length during the CoDel peek operation. When CoDel drops packets during peek it calls qdisc_tree_reduce_backlog before re-incrementing qlen; if qlen momentarily hits zero while peek still returns an skb, the parent qdisc's qlen_notify prematurely deactivates the class, corrupting scheduler state (demonstrated as a KASAN wild-memory-access in qfq_deactivate_agg when qfq parents a codel child). No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and this is not in CISA KEV.
Race condition in the Linux kernel's KCM (Kernel Connection Multiplexor) subsystem exposes systems to potential privilege escalation, memory corruption, and information disclosure when KCM sockets are in active use on multi-CPU systems. The kcm_attach() and kcm_unattach() functions modify live TCP socket callback pointers (sk_data_ready, sk_write_space) via plain stores rather than WRITE_ONCE(), violating the kernel's memory visibility contract and allowing a concurrent CPU to invoke a KCM handler against a mismatched sk_user_data pointer. No active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.19% (9th percentile), but vendor-supplied patches are available across all active stable kernel branches.
Netfilter's nf_dup_netdev component in the Linux kernel exposes a race condition in nft_dup and nft_fwd expressions where the absence of Bottom Half disabling during skb transmission permits CPU migration, causing imbalanced decrementation of xmit recursion counters. A locally authenticated low-privilege user who can influence netfilter packet processing paths may exploit this counter imbalance to escalate privileges or destabilize the kernel. No public exploit code has been identified at time of analysis, and EPSS probability sits at a low 0.19%, indicating limited current exploitation interest despite the high CVSS base score.
Missing access_ok bounds validation in the Linux kernel's BPF uprobe_multi subsystem exposes systems running affected kernel versions to local privilege escalation, kernel memory disclosure, and system crash. Low-privileged local users on systems within the vulnerable commit range - spanning Linux 6.6 and related stable branches - can submit crafted user-space pointers via uprobe_multi BPF configuration that the kernel reads using __get_user without prior bounds verification. No public exploit identified at time of analysis, and EPSS of 0.19% at the 9th percentile reflects low current exploitation activity, but the full C:H/I:H/A:H CVSS impact triad warrants prompt kernel patching on multi-tenant and shared-access systems.
Use-after-free in the Linux kernel's BPF sockmap UDP receive path allows a local low-privileged attacker to corrupt kernel heap memory, enabling potential privilege escalation, kernel memory disclosure, or system crash. The race condition in udp_bpf_recvmsg() allows concurrent threads to access a sk_msg structure after it has been freed, because a prior refactor removed the lock_sock() serialization that TCP and AF_UNIX sockets retain. Discovered by Google's syzbot automated fuzzer on Google Compute Engine; no public exploit beyond that reproduction harness and no CISA KEV listing exist at time of analysis.
Denial of service (and potential memory corruption) in the Linux kernel's TIPC networking subsystem arises from a use-after-free in tipc_l2_send_msg(); when a TIPC L2 bearer is disabled, tipc_disable_l2_media() runs synchronize_net() while b->media_ptr still references the underlying net_device, letting concurrent RCU readers keep sending on a device that is subsequently freed. Syzbot reproduced the slab-use-after-free via ipvlan_hard_header(). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.18%, 7th percentile), consistent with a race-condition kernel bug rather than a mass-exploited flaw.
Use-after-free race condition in the Linux kernel RDMA/bnxt_re driver allows a local attacker with low privileges to write data to a freed kernel memory page, potentially enabling privilege escalation or kernel crash. The vulnerability affects systems running the Broadcom NetXtreme-E RDMA driver across multiple stable kernel branches, with confirmed fixes in kernel versions 7.1.5, 6.18.40, and 7.2-rc1. No public exploit code has been identified and EPSS probability sits at 0.20% (10th percentile), reflecting the narrow hardware prerequisite that sharply limits the exposed population.
Use-after-free race condition in the Linux kernel's RDMA bnxt_re driver allows a local low-privileged user to corrupt kernel memory by triggering a Notification Queue (NQ) interrupt that writes to a freed CQ toggle page during Completion Queue teardown. Systems running Linux kernel versions prior to 7.1.5 or 7.2-rc1 with Broadcom NetXtreme-E/C RDMA-capable adapters are affected. No public exploit or active exploitation has been identified; EPSS remains at 0.15% (5th percentile), reflecting low real-world exploitation probability at time of analysis.
Kernel memory corruption in the Linux RDMA bnxt_re (Broadcom NetXtreme) driver allows a local low-privileged user to trigger undefined hardware behavior by submitting WQE (Work Queue Entry) mode values that exceed the 64K hardware maximum or are zero, with no bounds validation applied. The CVSS vector (AV:L/AC:L/PR:L/S:C/C:H/I:H/A:H, score 8.8) reflects that a local unprivileged process interacting with RDMA verbs can cause a scoped kernel-level impact, including potential memory corruption or system crash. No public exploit has been identified at time of analysis, and EPSS at 0.15% (5th percentile) indicates very low observed exploitation probability, but the scope change to kernel space makes this a meaningful risk in environments deploying Broadcom RDMA adapters.
Improper error handling in the Linux kernel's RDMA/bnxt_re driver (Broadcom NetXtreme RoCE) causes bnxt_qplib_alloc_dpi() to report success even when the underlying ioremap() call fails, leaving callers to operate on an unmapped/invalid Doorbell Page Index resource. Affected kernels are 6.5 and later on systems using the bnxt_re driver with Broadcom RDMA-capable NICs. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is very low (0.15%), so the practical risk is confined to local DoS/robustness rather than remote compromise, despite the high assigned CVSS of 9.2.
Improper resource handling in the Linux kernel's RDMA bnxt_re driver (Broadcom NetXtreme RoCE) allows a local user with access to the uverbs interface to trigger a race and an error-path resource leak by repeatedly requesting write-combining (WC) mmap pages for the same ucontext. The driver historically supported only one WC page per ucontext without a serializing lock, so concurrent or repeated requests could race and, on mmap-insert failure, leak the mapped Doorbell page index. The published CVSS is 9.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), but this reflects the Linux CNA's conservative scoring convention; EPSS is 0.21% (11th percentile), it is not on CISA KEV, and no public exploit identified at time of analysis.
Race condition in the Linux kernel's RDMA/irdma (Intel Ethernet RDMA) driver arises from a legacy waitqueue-plus-flag synchronization pattern that lacked memory barriers around the request_done flag; maintainers resolved it by switching to a completion primitive. Kernels from 5.14 onward that load the irdma module are affected, but the defect is a local concurrency bug in a specific hardware driver, not the remote unauthenticated code execution its CVSS 9.8 rating implies. No public exploit identified at time of analysis, EPSS is low (0.16%, 6th percentile), and it is not in CISA KEV.
Kernel memory corruption in the Linux networking stack lets a local actor trigger a slab use-after-free in the packet-processing path (fib_rules_lookup) via a TOCTOU race in enqueue_to_backlog(). The flaw affects the per-CPU backlog flushing during device unregistration/network-namespace teardown, where a lockless transmitter such as veth_xmit can queue a packet that escapes flush_all_backlogs() and is later dereferenced after free. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and it is not on CISA KEV, so this is a defect fixed upstream rather than an actively-exploited threat.
Use-after-free in the Linux kernel's ksmbd in-kernel SMB server allows a low-privileged authenticated SMB client to dereference freed kernel memory, potentially achieving arbitrary kernel-level code execution or sensitive information disclosure. The race condition exists between `same_client_has_lease()` releasing `ci->m_lock` without holding a reference on the returned `opinfo` pointer and a concurrent SMB CLOSE operation freeing that same object. Affected kernels span the 5.15 through 7.1 stable series; patches are confirmed available across all branches. No public exploit code or CISA KEV listing has been identified at time of analysis, and an EPSS of 0.18% (8th percentile) indicates no currently observed widespread exploitation.
Kernel-level use-after-free in the Linux 9p RDMA transport (net/9p, trans_rdma.c) arises from a race on the unsynchronized rdma->state field, where recv_done() in softirq context and p9_cm_event_handler() mutate state without the req_lock that rdma_request() relies on. Concurrent teardown can silently overwrite a FLUSHING transition with CLOSING, corrupting the connection state machine and freeing RDMA request objects still in use - enabling denial of service and potential local privilege escalation on systems mounting 9p over RDMA. No public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and the flaw is not in CISA KEV.
Use-after-free in the Linux kernel staging nvec driver's nvec_rx_completed() function exposes Tegra-based systems to potential kernel memory corruption. The flaw arises from a TOCTOU race: nvec_msg_free() releases a message pool slot atomically, but the immediately following read of nvec->rx->data[0] occurs after that release - allowing a concurrent nvec_msg_alloc() to reclaim and overwrite the same slot. No public exploit has been identified at time of analysis, and the very low EPSS score (0.18%, 8th percentile) reflects the niche Tegra hardware prerequisite and staging driver context. Fixed commits are available across multiple stable kernel branches.
Kernel panic in Linux CoreSight platform driver exposes ARM systems to local denial-of-service via a NULL pointer dereference on the error cleanup path. The counter tracking output and input connections is incremented before confirming that the backing allocation succeeded; when devm_krealloc_array() or devm_kmalloc() returns ENOMEM, the cleanup routine coresight_release_platform_data() walks the inflated counter and dereferences the resulting NULL or uninitialized garbage pointer, panicking instead of returning gracefully. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), and the absence of KEV listing reflects low observed exploitation. Vendor-released patches are available in Linux 7.1.5 (stable) and 7.2-rc1 (mainline).
Double-decrement of the descriptor_busy reference counter in the Linux kernel's GPIB driver re-introduces a use-after-free condition that a prior security patch (commit d1857f8296dc) was specifically designed to prevent. Affected kernels include the 6.18.22-6.18.39 range and Linux 7.0, with patched releases available at 6.18.40, 7.1.5, and 7.2-rc1. Exploitation requires a local low-privilege account and access to GPIB device nodes; no public exploit code has been identified at time of analysis, and the EPSS score of 0.19% reflects negligible observed exploitation activity.
Improper error handling in the Linux kernel's ntfs3 filesystem driver leaves an inode in an inconsistent state after a failed rename, where a WARN_ON was previously hit instead of properly marking the inode bad. The fix replaces that WARN_ON with a _ntfs_bad_inode() call so the kernel stops operating on the corrupted inode. The recorded CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) is inconsistent with the actual change, which is a local filesystem-driver robustness fix; EPSS is 0.20% (10th percentile) and there is no public exploit identified at time of analysis and no CISA KEV listing.
Memory corruption in the Linux kernel's xprtrdma (RPC-over-RDMA / NFS-over-RDMA) transport arises from a use-after-free in request-slot lifetime management: the RPC Reply handler could drop the rl_kref refcount to zero and return an rpcrdma_req to its free pool while the RDMA HCA was still DMA-reading from that request's send buffer, specifically when a Send carried only pre-registered buffers (sc_unmap_count == 0). This affects Linux systems using RPC-over-RDMA transport (introduced around 5.3) and is fixed by decoupling req recycling from RPC completion. EPSS is low (0.21%, 12th percentile) and there is no public exploit identified at time of analysis; the auto-assigned 9.8 CVSS overstates real-world risk for a race-condition kernel bug on a niche transport.
Use-after-free memory corruption in the Linux kernel's NFSv4 client fixes a race in file-lock list traversal, where nfs_delegation_claim_locks, nfs4_locku_done, and nfs4_lock_done manipulated the inode file-lock list without holding nfsi->rwsem, allowing the list to change under iteration during delegation recall and lock reclaim. The fix serializes traversal under nfsi->rwsem and relocates locks_lock_inode_wait into _nfs4_proc_setlk. This is a locally-triggered kernel race affecting NFSv4 client mounts; no public exploit identified at time of analysis, EPSS is low (0.21%), and it is not on CISA KEV.
Uninitialized kernel memory read in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3) allows a low-privileged local user to potentially leak sensitive kernel memory contents via a crafted or specially structured NTFS file. The flaw manifests in ni_seek_data_or_hole() when run_lookup() fails to locate the target VCN in runs[0], causing attr_data_get_block_locked() to exit prematurely without initializing the lcn variable - a KMSAN-confirmed uninit-value read triggered through the ntfs_llseek/vfs_llseek call chain. No public exploit exists at time of analysis (EPSS 0.20%, 10th percentile) and this is not listed in CISA KEV, indicating low active exploitation risk despite the CVSS 7.1 base score.
Reference-count (kref) underflow in the Linux kernel xprtrdma subsystem permits use-after-free when RDMA_CM_EVENT_ADDR_CHANGE is delivered before RDMA_CM_EVENT_ESTABLISHED during NFS-over-RDMA connection setup. An attacker on the same RDMA fabric who can induce an address-change event during the narrow pre-ESTABLISHED window may corrupt freed kernel memory, potentially leading to privilege escalation, arbitrary kernel code execution, or system crash. No public exploit exists and EPSS of 0.21% (11th percentile) reflects low automated exploitation probability; active exploitation has not been confirmed and no CISA KEV listing is present.
Out-of-bounds read and receive-buffer leak in the Linux kernel's RPC-over-RDMA client transport (xprtrdma) let a malicious or malfunctioning RDMA peer send a short or malformed reply that is misclassified as a backchannel call. The flaw causes the kernel to read up to 20 bytes of stale DMA buffer contents past the wire payload and to orphan a persistently DMA-mapped receive buffer, progressively draining the Receive queue until the peer's Sends draw RNR NAKs. No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.21%); despite the NVD-assigned 9.8 CVSS, the real-world impact is bounded to limited information exposure and connection-level denial of service on systems actually using RPC/RDMA.
Resource exhaustion in the Linux kernel's xprtrdma (RDMA transport for NFS/RPC) subsystem allows a malicious or compromised RDMA peer to trigger unbounded Receive Work Request allocation, causing denial of service on affected systems. The flaw exists in rpcrdma_reply_handler(), where the credit clamp is bypassed for replies matching no pending request (unknown XID), and rpcrdma_post_recvs() then allocates WRs past re_max_requests without bound. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), reflecting the niche RDMA deployment context. Patches are available across multiple stable kernel branches.
Receive queue exhaustion in the Linux kernel's xprtrdma subsystem allows a remote RPC/RDMA peer to stall NFS-over-RDMA client transports by sending a sustained stream of malformed replies. Each reply that is shorter than the fixed RPC/RDMA transport header or carries an unrecognized protocol version drains one posted Receive Work Request without replacement, because two early-exit paths in rpcrdma_reply_handler() return without calling rpcrdma_post_recvs(). Once the queue empties, the transport stalls until reconnect - a targeted denial-of-service with no public exploit or CISA KEV listing and a very low EPSS score of 0.21% (12th percentile).
Use-after-free and reference-count imbalance in the Linux kernel's IPsec (xfrm) asynchronous resumption path allows a device UAF and refcnt leak when packets are processed through tunnel interfaces such as VTI. During async crypto resumption, xfrm_rcv_cb can reassign skb->dev to a tunnel device without taking a reference, so the later decrement frees the tunnel netdevice while the original device leaks (observable as 'unregister_netdevice: waiting for vti1 to become free. Usage count = -2'). The upstream fix stashes the original skb->dev and extends RCU protection over xfrm_rcv_cb and transport_finish. There is no public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile).
Race condition in the Linux kernel AppArmor unix socket mediation subsystem exposes systems with peer path-based AppArmor rules to a use-after-free scenario, enabling a local low-privileged user to potentially escalate privileges and achieve full compromise of confidentiality, integrity, and availability. The flaw involves accessing a peer unix socket's path (`peer_path`) outside the kernel socket state lock, creating a window for concurrent execution of `unix_release_sock()` to free the referenced path while AppArmor reads it. No public exploit code exists and the EPSS score sits at a low 0.17% (7th percentile), but the NVD-assigned CVSS scope change (S:C) reflects that successful exploitation could reach kernel-level components beyond the attacking process.
Reference count leak in the Linux kernel AppArmor security module allows a local low-privileged user to trigger use-after-free conditions via a bug in update_sk_ctx() socket context management, potentially achieving privilege escalation with high confidentiality, integrity, and availability impact. The fix, backported across stable branches (6.18.40, 7.1.5, 7.2-rc1), corrects the unconditional plabel reference put in the caller by adding a compensating reference acquisition. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation probability.
AppArmor's aa_change_profile() in the Linux kernel dereferences a potentially NULL or ERR_PTR label value before the existing IS_ERR_OR_NULL() guard is reached, allowing a local low-privilege attacker to trigger a kernel crash or kernel memory disclosure. Affected are kernel versions from the introducing commit e00b02bb6ac2a1893227ce8014b649028d6425d2 through multiple stable branches, with vendor-released patches confirmed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 7.1.5, and 7.2-rc1. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) reflects minimal current exploitation interest.
Resource leak in Linux kernel AppArmor's aa_label_alloc() function exposes local attackers with low privileges to potential privilege escalation. When proxy allocation fails during label creation, the error path bypasses aa_label_free(), leaving the security identifier (secid) and other label resources unreleased. No public exploit has been identified at time of analysis, and EPSS at 0.18% (8th percentile) reflects low near-term exploitation probability, though the C:H/I:H/A:H CVSS impact ratings signal meaningful consequence if exploited.
Kernel page fault in Linux kernel AppArmor's file auditing path allows a local low-privileged user to crash the system or leak kernel memory via the audit log. The regression was introduced by commit 4a134723f9f1, which left the *name pointer uninitialized when path->dentry is the aa_null sentinel, then passed it to audit_log_untrustedstring() where strlen() dereferences an invalid address. No public exploit code exists and EPSS probability is 0.17% (7th percentile), but patched stable releases 6.18.40, 7.1.5, and 7.2-rc1 are confirmed available.
Double-free kernel memory corruption in the Linux DRM/i915 Intel graphics driver allows a local low-privileged user to potentially escalate privileges or crash the system. The flaw resides in the CRTC color blob pointer cleanup path: after dropping blob references, the pointers are not nulled, so a subsequent failure in the atomic commit path (e.g., -EDEADLK from DP tunnel state lookup) can trigger a second call to intel_crtc_free_hw_state() on the same already-freed state. No public exploit code exists and EPSS is 0.21%, but the CVSS 7.8 local score reflects the full C/I/A impact if kernel heap corruption is reliably weaponized. Vendor patches are available for stable branches.
Use-after-free and double-free memory corruption in the Linux kernel's amdkfd DRM subsystem exposes systems with AMD GPUs to local privilege escalation. The flaw resides in kfd_criu_resume_svm(), where cleanup logic frees struct criu_svm_metadata objects without unlinking them from the list, leaving dangling pointers; a second AMDKFD_IOC_CRIU_OP ioctl from the same process then walks and double-frees those freed objects. Exploitation is reachable by any unprivileged user with render group membership via /dev/kfd - no additional capabilities required. No public exploit identified at time of analysis, and EPSS sits at 0.21% (12th percentile), consistent with a local-access kernel bug without weaponized tooling.
Uninitialized kernel memory exposure in Linux kernel's flow_dissector subsystem allows a local low-privileged attacker to leak kernel memory contents by exploiting a missing device-type check in __skb_flow_dissect(). Affected are Linux kernel versions from 4.2 through stable branches prior to 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. An attacker who can create TUN devices and configure TC qdiscs reads 12 bytes of uninitialized skb memory through the flow dissector's Ethernet address extraction path, which then propagates into rhashtable lookups - a condition confirmed reported via KMSAN. No public exploit identified at time of analysis.
Improper packet-header validation in the Linux kernel's netfilter flowtable IP6IP6 tunnel fast path was corrected by switching nf_flow_ip6_tunnel_proto() from skb_header_pointer() to pskb_may_pull(), guaranteeing the outer IPv6 header is actually present in the skb before the offload path dereferences it. The flaw affects hosts using netfilter flowtable hardware/software offload with IP6IP6 tunnel encapsulation, where a malformed encapsulated packet could be processed against a header not fully pulled into the linear buffer. No public exploit identified at time of analysis; not listed in CISA KEV, and EPSS is low (0.20%, 10th percentile).
Reference count and barrier leaks in the Linux kernel md/raid1 write dispatch path leave writes_pending and barrier accounting permanently imbalanced on certain write failure conditions, producing a high availability impact - potential system hang or crash - on any Linux host running software RAID-1 from kernel 5.17 through pre-7.1.5. The vulnerability is fixed in stable trees at 7.1.5 and 7.2-rc1 via two upstream commits. No active exploitation has been confirmed (no CISA KEV listing), no public exploit code exists, and an EPSS score of 0.20% at the 10th percentile indicates very low current real-world exploitation probability.
Reference accounting defects in the Linux kernel's md/raid10 driver allow writes_pending and barrier references to permanently leak on discard operation failure paths, leading to an unrecoverable hang of the RAID10 array. raid10_make_request() acquires these references before entering raid10_handle_discard(), but multiple failure exits in that function bypass the corresponding release calls md_write_end() and allow_barrier(), causing write accounting and resync barriers to become permanently imbalanced. With no confirmed active exploitation (no CISA KEV listing), an EPSS of 0.16% at the 6th percentile, and no public exploit identified at time of analysis, this is a targeted kernel-configuration issue whose impact is confined to systems explicitly running md/raid10 with discard enabled.
Improper memory-barrier handling in the Linux kernel's netfilter ipset subsystem affects hash-type sets, where lockless RCU readers used the relaxed test_bit() operation instead of test_bit_acquire(), allowing readers running concurrently with add/delete/garbage-collection to observe stale or improperly ordered bit state. The flaw was fixed upstream and backported to stable trees; there is no public exploit identified at time of analysis and it is not in CISA KEV, and the EPSS score is very low (0.21%). Despite an automated NVD CVSS of 9.8, the defect is a memory-ordering race in a kernel packet-filtering path rather than a straightforward remote code execution primitive.
Incorrect RCU (Read-Copy-Update) operation ordering in the Linux kernel's netfilter ipset subsystem allows a local attacker with low privileges to trigger a use-after-free condition in kernel memory, potentially leading to privilege escalation or system crash. The flaw exists because kfree_rcu() was called before rcu_assign_pointer() in the comment extension handling path - scheduling memory for freeing before the pointer update is visible to all CPUs, creating a race window. With a CVSS score of 7.8 and an EPSS of 0.22% (13th percentile), this is assessed as a serious local privilege escalation with low likelihood of opportunistic exploitation. No public exploit has been identified and CISA KEV status is not confirmed.
Privilege escalation in the Linux kernel's netfilter ipset subsystem stems from a race condition between the garbage collector (GC) and set destruction logic, where `queue_delayed_work()` is called unconditionally inside the GC callback while `cancel_delayed_work_sync()` is called during set teardown, allowing the GC to run against freed memory. Affected kernel versions span from 5.4.24 through mainline prior to the fix commits, with patches backported to stable series 6.12.97 and 6.18.40. No public exploit code exists and the CVE is not listed in CISA KEV, but the CVSS 7.8 local-privilege-escalation impact reflects the potential for kernel heap corruption reachable by low-privileged local users.
Type confusion in the Linux kernel's IPv6 In-situ OAM (IOAM) lightweight-tunnel code lets a crafted IOAM route trigger an invalid cast in rt6_get_cookie(), which reads struct rt6_info fields out of a dummy dst_entry that was only ever a bare struct dst_entry embedded in ioam6_lwt. This CWE-843-class flaw affects kernels from 6.16 up to the fixed releases and can produce an invalid pointer access when the aliased sernum/reset_ts field reaches zero. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and the issue is not in CISA KEV, so it reads as a memory-safety/DoS-grade bug rather than a broadly weaponized RCE despite the 9.8 NVD score.
Use-after-free and effective program array corruption in the Linux kernel's BPF cgroup subsystem allow a local attacker with BPF attachment privileges to escalate to root via kernel memory corruption. The flaw in replace_effective_prog() and purge_effective_progs() miscalculates array slot positions when BPF_F_PREORDER programs are present in a cgroup hierarchy, causing purge_effective_progs() to zero the wrong slot and call bpf_prog_put() while a stale reference to the freed program remains in the array. With CVSS 7.8, EPSS at 0.18% (7th percentile), and no CISA KEV listing or public exploit identified at time of analysis, real-world risk is modulated by the non-default precondition of BPF_F_PREORDER cgroup program usage.
Stack type confusion in the Linux kernel BPF verifier allows a local attacker to bypass non-scalar pointer spill validation and treat a live kernel pointer slot as an ordinary scalar stack read. Affected are Linux 7.1 stable series prior to commit 0f9278b22cda and mainline prior to 3a354149bcea, with fixes confirmed in Linux 7.1.5 and 7.2-rc1. Successful exploitation permits full kernel memory read and write access, enabling local privilege escalation; no public exploit code or active exploitation has been identified at time of analysis.
Resource exhaustion in the Linux kernel ice driver allows accumulated CTRL VSI memory leaks during VF resets on Intel E800-series adapters with FDIR filters active, ultimately degrading host availability after repeated VF lifecycle operations. Affected kernel versions span from the introducing commit (da62c5ff9dcd) through all stable branches prior to the fix commits, with patched releases confirmed at 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. No public exploit tool exists and EPSS is a negligible 0.21% (12th percentile), placing this squarely in the patch-when-convenient tier for most deployments - with the exception of high-density SR-IOV virtualization hosts running frequent VF resets, where the cumulative leak poses a realistic availability risk.
Out-of-bounds kernel memory write in the Linux kernel BPF conntrack kfuncs allows a local attacker with BPF access to corrupt memory outside the verifier-enforced boundary. The BPF verifier constrains accessible memory using the caller-supplied opts__sz argument, but the conntrack wrapper functions unconditionally write to opts->error on failure regardless of whether that field falls within the verified range - enabling a write beyond the checked region when opts__sz is deliberately undersized. No public exploit has been identified and EPSS probability is very low (0.20%, 10th percentile), but the CVSS 8.8 score with scope change reflects kernel memory corruption potential and privilege escalation risk for deployments where unprivileged BPF is enabled.
Use-after-free in the Linux kernel's in-kernel SMB server (ksmbd) lets a remote client that opens an SMB connection race two concurrent SMB2 NEGOTIATE requests to trigger a slab UAF read of the shared conn->preauth_info structure (kmalloc-96). The response send path smb3_preauth_hash_rsp() reads and dereferences conn->preauth_info->Preauth_HashValue without holding conn_lock, so one worker can free the object on the failing-negotiate path while another reads it - a window a bare NULL check cannot close. Exploitation is pre-authentication over the network but requires ksmbd to be actively serving shares plus precise timing; EPSS is low (0.21%, 12th percentile), it is not on CISA KEV, and no public exploit identified at time of analysis.
Incorrect IPv4 FIB route resolution in the Linux kernel causes error routes (e.g. 'unreachable') in the merged local/main routing table to be silently overwritten by matching routes in the default table. This occurs specifically when CONFIG_IP_MULTIPLE_TABLES is compiled in but no routing rules have been added, so fib_lookup() fails to bail out after the first table lookup. The result is that traffic which should be blocked/dropped is instead routed, undermining routing-based access-control expectations; no public exploit identified at time of analysis and EPSS probability is low (0.22%).
Indefinite kernel task hang in the Linux kernel's md/raid5 subsystem exposes any system running software RAID5 to a local availability attack via a data race between break_stripe_batch_list() and raid5_make_request(). The race corrupts the R5_Overlap flag on stripe device state without issuing the corresponding wake_up_bit() call, permanently blocking a kernel task on wait_on_bit() with no recovery path short of reboot. EPSS probability is very low at 0.18% and no public exploit has been identified, but the structural impact on active RAID5 arrays under sustained concurrent I/O workloads is a genuine availability concern.
Netfilter connection-count logic in the Linux kernel falsely drops legitimate TCP connections on systems using xt_connlimit or nft_connlimit in soft-limiting mode, across multiple stable branches from 5.10.248 through 6.18.39. The regression, introduced by commit 69894e5b4c5e, causes the active connection count to drop to zero when a new connection reuses a TIME_WAIT socket, after which xt_connlimit misinterprets the zeroed count and rejects valid sessions. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the condition can be triggered by ordinary connection-cycling traffic without authentication.
Verdict-type confusion in the Linux kernel's netfilter nft_compat layer allows a local low-privileged attacker to bypass firewall rules and destabilize packet processing on systems running ebtables emulation. The nft_compat code fails to reject non-bridge xtables targets in NFPROTO_BRIDGE context, permitting a fallback to NFPROTO_UNSPEC that was already blocked in the legacy ebtables path since commit 11ff7288beb2; the nft_compat layer simply missed that guard. No public exploit is identified at time of analysis, and EPSS sits at a low 0.21%, though patched kernel versions are available across all active stable branches.
Out-of-bounds heap read in the Linux kernel ASoC SDCA subsystem allows a local attacker with low privileges to read past the end of a kernel heap buffer by writing an out-of-range enumeration index to the ge_put_enum_double() ALSA control handler. Affected kernels from commit 812ff1baa764 through pre-7.1.5 are vulnerable; the existing bounds check in snd_soc_dapm_put_enum_double() runs only after the unsafe read, providing no protection. No public exploit code has been identified and no active exploitation is confirmed; EPSS of 0.20% (10th percentile) reflects low near-term exploitation probability.
Guest memory corruption in the Linux kernel's s390 (IBM Z) memory-management code, where mishandling of the _PAGE_UNUSED software PTE bit causes in-use KVM guest pages to be discarded as if unused. On s390 KVM hosts running kernels before 7.1.5 (and 7.2-rc series before the fix), the bit set by KVM on unmapped guest pages was not cleared by all PTE-setting paths, so a page returned to use could later be silently dropped - corrupting guest state. There is no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and it is not in CISA KEV.
Use-after-free in the Linux kernel mxl862xx DSA driver exposes systems running MaxLinear MXL862xx Ethernet switches to local privilege escalation via kernel heap corruption. The race condition between the MDIO CRC error work handler and driver teardown allows freed dsa_port objects to be dereferenced if a CRC error is scheduled during the narrow window between MXL862XX_FLAG_WORK_STOPPED being set and dsa_unregister_switch() completing. EPSS is 0.20% (10th percentile) with no CISA KEV listing, reflecting niche hardware dependency and low broad exploitation interest.
Incorrect bounds validation in the Linux kernel's octeontx2-af driver allows a local attacker with low privileges to trigger a kernel-level flaw by issuing a crafted devlink command that sets NIX maximum LFs before any PF/VF assignment, bypassing the faulty assignment-check condition. Systems running Marvell OcteonTX2 SoC hardware with the octeontx2-af driver loaded are affected across multiple stable kernel branches originating from commit dd7842878633453e38d6a4927593dd28b9d8ab91. EPSS exploitation probability is very low at 0.21% (11th percentile), no public exploit code has been identified, and this vulnerability is not listed in the CISA KEV catalog.
Permanent network connectivity loss on Marvell MPIC platforms (Armada 370/XP/38x) results from the mvneta driver failing to re-enable its per-CPU interrupt after a suspend/resume cycle when a NAPI poll was in-flight at suspend time. The race leaves the MPIC per-CPU interrupt masked indefinitely post-resume: the NIC generates interrupts that the CPU never receives, causing a complete outage until reboot. No public exploit exists (EPSS 0.22%, 13th percentile) and the vulnerability is absent from CISA KEV; patches have been released across eight Linux stable branches.
Double-free memory corruption in the Linux kernel's sungem (Sun GEM) Ethernet driver probe error path allows local attackers to trigger kernel heap corruption on systems equipped with Sun GEM hardware. gem_init_one() incorrectly delegates cleanup to gem_remove_one() on register_netdev() failure - which frees DMA blocks, MMIO mappings, PCI regions, and the net_device struct - then falls through to its own cleanup labels that attempt to release the same already-freed resources. No public exploit or active exploitation is identified at time of analysis; EPSS is 0.22% (13th percentile), consistent with the extreme obsolescence of the affected hardware.
Use-after-free in the Linux kernel's UDP tunnel NIC device sync workqueue allows a local low-privileged attacker to corrupt kernel memory during concurrent device operations, potentially achieving full kernel compromise. The flaw stems from a race condition between the workqueue subsystem's internal pending bit and the driver-level work_pending flag in udp_tunnel_nic_device_sync_work(), causing udp_tunnel_nic_unregister() to free the structure while a second work item is still queued and active. No public exploit identified at time of analysis, but patched versions are available across all active stable kernel branches.