Information Disclosure
Monthly
A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in macrozheng mall-swarm up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPSwings WooCommerce Ultimate Points And Rewards woocommerce-ultimate-points-and-rewards allows Retrieve. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The AI Engine plugin for WordPress is vulnerable to PHP Object Injection via PHAR Deserialization in all versions up to, and including, 3.1.8 via deserialization of untrusted input in the. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable. No vendor patch available.
The Comment Edit Core - Simple Comment Editing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.0 via the 'ajax_get_comment' function. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notification' post meta registration. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Frappe Learning is a learning system that helps users structure their content. Rated low severity (CVSS 1.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vendor patch available.
DuckDB is a SQL database management system. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Wasmtime is a runtime for WebAssembly. Rated low severity (CVSS 1.8). No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: media: iris: fix module removal if firmware download failed Fix remove if firmware failed to load: qcom-iris aa00000.video-codec:. No vendor patch available.
Timing side-channel in the Linux kernel's SCTP subsystem allows remote attackers to defeat message-authentication (MAC) integrity by measuring non-constant-time byte-by-byte MAC comparisons, enabling forgery of authenticated SCTP data. The flaw affects the in-kernel SCTP implementation across multiple stable kernel series and was resolved by switching to a constant-time comparison helper. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.07%), consistent with the high attack complexity of a practical network timing attack.
Local privilege-adjacent memory corruption in the Linux kernel's listmount() mount-enumeration syscall arises because the code invoked path_put() while still holding the namespace semaphore; if that call drops the final reference to a path, cleanup runs under the held lock and can trigger a use-after-free or deadlock. Any local user able to call listmount() is affected on vulnerable stable kernels, and while EPSS is very low (0.03%) with no public exploit identified at time of analysis, the NVD-assigned CVSS of 7.8 reflects full CIA impact from local exploitation. The fix relocates the reference drop to outside the lock across three stable-branch commits.
Local memory corruption in the Linux kernel's resource-limit syscall (prlimit64) stems from unsafe locking in the sys_prlimit64()->do_prlimit() path, where task_lock(tsk->group_leader) can operate on an already-freed or concurrently-changed task_struct. When a low-privileged local user targets another process that exits, execs, or performs a multithreaded exec, the kernel may take the wrong lock or dereference freed memory, enabling a use-after-free race. No public exploit is identified at time of analysis and EPSS exploitation probability is very low (0.03%), but the CVSS 3.1 score of 7.8 reflects high confidentiality, integrity, and availability impact via local access.
In the Linux kernel, the following vulnerability has been resolved: Squashfs: reject negative file sizes in squashfs_read_inode() Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs.
Out-of-bounds buffer over-read in the Linux kernel ext4 filesystem driver allows disclosure of adjacent kernel memory or a system crash when a maliciously crafted ext4 superblock is mounted. The flaw lives in parse_apply_sb_mount_options(), which trusted the s_mount_opts field to be NUL-terminated (a guarantee normally provided only by tune2fs); a non-terminated string causes the parser to read past the buffer. There is no public exploit identified at time of analysis, and EPSS rates practical exploitation as very low (0.07%), consistent with a local-only, mount-triggered issue rather than a remote mass-exploitation candidate.
In the Linux kernel, the following vulnerability has been resolved: media: mc: Clear minor number before put device The device minor should not be cleared after the device is released. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: fs: quota: create dedicated workqueue for quota_release_work There is a kernel panic due to WARN_ONCE when panic_on_warn is set.
In the Linux kernel, the following vulnerability has been resolved: mount: handle NULL values in mnt_ns_release() When calling in listmount() mnt_ns_release() may be passed a NULL pointer. No vendor patch available.
Filesystem corruption and denial of service in the Linux kernel's ext4 extended-attribute (EA) inode handling allows a local attacker who can mount a crafted or corrupted ext4 image to trigger a reference-count underflow in ext4_xattr_inode_update_ref(). Because the code previously read an EA inode refcount that was already <= 0 and still applied the change (typically -1), it proceeded on a bogus negative value, spawning EXT4-fs errors and orphan/cleanup churn. No public exploit identified at time of analysis, and the EPSS score is very low (0.07%), consistent with a corruption-triggered fault rather than a readily weaponized remote flaw.
In the Linux kernel, the following vulnerability has been resolved: net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx_read_raw_eeprom Syzbot reported read of uninitialized. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: pwm: berlin: Fix wrong register in suspend/resume The 'enable' register should be BERLIN_PWM_EN rather than BERLIN_PWM_ENABLE,.
Denial of service in the Linux kernel's SCTP stack (net/sctp) allows a NULL-pointer dereference in the sctp_sf_do_5_1D_ce() COOKIE ECHO state-machine handler, crashing the kernel. When processing an incoming SCTP association setup, if the peer adaptation indication is zero and the authkey ulpevent allocation returns NULL, the uninitialized ai_ev pointer is passed to sctp_ulpevent_free() and dereferenced, panicking the system. The issue affects hosts actively using SCTP; there is no public exploit identified at time of analysis and EPSS risk is low (0.07%).
Memory corruption in the Linux kernel TCP stack allows a race between closing a listening socket and processing an in-flight TCP Fast Open (TFO) connection request to trigger a refcount underflow and double-free of the request socket, originally caught by syzbot. The flaw sits in tcp_conn_request(), which redundantly calls reqsk_fastopen_remove() after inet_child_forget()/tcp_disconnect() has already released the request socket, corrupting the listener's refcount. There is no public exploit identified at time of analysis and EPSS is very low (0.07%), but as a remotely reachable kernel use-after-free it warrants patching on IPv4/IPv6 servers that accept TFO connections.
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix debug checking for np-guests using huge mappings When running with transparent huge pages and CONFIG_NVHE_EL2_DEBUG. No vendor patch available.
Resource exhaustion in the Linux kernel's BPF subsystem allows gradual, unbounded kernel memory consumption (kmalloc-256 slab) leading to denial of service on hosts using the bpf_redirect_neigh() helper on the collect-metadata vxlan datapath. The __bpf_redirect_neigh_v4/v6 code called skb_dst_set() to attach a new dst entry without first releasing the metadata_dst that vxlan had already attached, leaking one dst object per redirected packet. The condition was observed in production on Cilium egress-gateway deployments, where decapsulated Pod traffic is forwarded via bpf_redirect_neigh(); EPSS is low (0.07%) and there is no public exploit identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP When running as an SNP or TDX guest under KVM, force the. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: ext4: verify orphan file size is not too big In principle orphan file can be arbitrarily large.
IBM QRadar SIEM 7.5 through 7.5.0 UP14 stores user credentials in configuration files in source control which can be read by an authenticated user. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Evervault is a payment security solution. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
sudo-rs is a memory safe implementation of sudo and su written in Rust. Rated low severity (CVSS 3.8). No vendor patch available.
IBM OpenPages 9.0 and 9.1 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points used by the user interface of OpenPages. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was reported in the Lenovo Scanner pro application during an internal security assessment that, under certain circumstances, could allow an attacker on the same logical network to. Rated medium severity (CVSS 6.0), this vulnerability is no authentication required. No vendor patch available.
CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format. Rated low severity (CVSS 3.7). Public exploit code available.
Mintty is a terminal emulator for Cygwin, MSYS, and WSL. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2507.1, a low-privileged user that does. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A maliciously crafted DWG file, when parsed through Autodesk 3ds Max, can force a Use-After-Free vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
N-central < 2025.4 can generate sessionIDs for unauthenticated users4. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 83.2% and no vendor patch available.
Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryption_helper.dart file. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. No vendor patch available.
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. No vendor patch available.
N-able N-central remote monitoring and management platform versions before 2025.4 contain multiple XML External Entity injection vulnerabilities. Attackers can exploit these to read sensitive files from the RMM server, including configuration files containing credentials for all managed endpoints.
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the user account by performing an arbitrary number of authentication attempts with different c
In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Fix bootlog initialization ordering As soon as we queue MHI buffers to receive the bootlog from the device, we could be. No vendor patch available.
Memory-safety fault in the Linux kernel's kTLS (kernel TLS) receive path allows use-after-free on socket buffers and stray writes into userspace memory after recv() has returned when async record decryption is used and an atomic skb clone allocation fails. Affected systems are those whose applications enable in-kernel TLS with asynchronous decryption; an attacker able to induce memory pressure while TLS records are inflight can corrupt kernel/user memory or leak data. Tagged as Information Disclosure, EPSS is negligible (0.03%), no public exploit is identified, and the issue is fixed upstream and shipped by distributions (Ubuntu USN-8125-1/USN-8126-1).
In the Linux kernel, the following vulnerability has been resolved: idpf: cleanup remaining SKBs in PTP flows When the driver requests Tx timestamp value, one of the first steps is to clone SKB using. No vendor patch available.
Missing memory-barrier ordering in the x86 memory-management code of the Linux kernel allows stale TLB entries to persist after an address-space switch, because switch_mm_irqs_off() can fail to observe a recent tlb_gen update from flush_tlb_mm_range(). On affected x86 SMP systems a local, low-privileged process could read or corrupt memory mappings it should no longer have access to, mapping to the CVSS 7.8 high/high/high impact. No public exploit identified at time of analysis, and the EPSS score is negligible (0.03%, 10th percentile), indicating this is a subtle correctness/race fix rather than an actively-targeted flaw.
Unbounded network device headroom growth in the Linux kernel's IPv6 tunnel driver (net/ip6_tunnel) lets the dev->needed_headroom value increase perpetually because, unlike its IPv4 counterpart, it lacked a ceiling. The fix ports the IPv4 headroom-growth limit (commit 5ae1e9922bbd) to the IPv6 path, capping repeated headroom adjustments. There is no public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.07%), so this is a stability/robustness hardening fix rather than an actively weaponized flaw.
Memory corruption in the Linux kernel's accel/qaic driver (Qualcomm Cloud AI 100 accelerator) allows a local user to trigger a general protection fault by submitting a DMA transfer request with a zero length, or when the device requests continuation (QAIC_TRANS_DMA_XFER_CONT) after all bytes have already been transferred. In these cases find_and_map_user_pages() returns 0 without allocating the scatter-gather table, and encode_addr_size_pairs() then dereferences the unallocated sgt, faulting the kernel. EPSS is very low (0.03%) and there is no public exploit identified at time of analysis, but distro patches (Ubuntu USN-8125-1/8126-1) are already shipping.
Resource exhaustion in the Linux kernel's NVMe-oF Fibre Channel target driver (nvmet-fc) stems from a reference-counting error in Link Service request handling: when multiple asynchronous LS commands are in flight from __nvmet_fc_send_ls_req, each takes a tgtport reference but only a single put-work item is queued, leaking the surplus references. Systems acting as NVMe-over-Fabrics FC targets are affected, and the leaked references prevent proper teardown of the target port, degrading availability over time. This is a defensive kernel hardening fix with no public exploit identified at time of analysis and a very low EPSS (0.05%).
Local information disclosure and potential use-after-free in the Linux kernel networking stack stems from unprotected reads of the destination cache device pointer (dst->dev) in sk_setup_caps() and related IPv4/IPv6 forwarding paths. Affected builds accessed dst->dev without RCU protection, allowing a concurrent update to free the device while another CPU dereferenced it. There is no public exploit identified at time of analysis, EPSS probability is negligible (0.03%), and the issue is not in CISA KEV; the upstream fix switches these call sites to the RCU-safe dst_dev_rcu()/dst_dev_net_rcu() helpers.
Local privilege-relevant memory corruption in the Linux kernel eBPF verifier arises because check_alu_op() validated the signed 16-bit instruction offset with 'insn->off > 1', which silently accepts negative values such as -1 instead of only 0 and 1. A local user able to load BPF programs can submit malformed ALU instructions (BPF_DIV/BPF_MOD) that bypass verifier bounds, undermining the safety guarantees the verifier is meant to enforce. No public exploit identified at time of analysis; EPSS is negligible (0.03%), and Ubuntu has shipped fixes.
Use-after-free in the Linux kernel's SMC (Shared Memory Communications) protocol handler smc_clc_prfx_match() lets a remote peer potentially trigger memory corruption during connection establishment. The flaw stems from dereferencing a destination cache device pointer (sk_dst_get(sk)->dev) outside RCU/RTNL protection in the listen path, so the dst entry can be freed concurrently. There is no public exploit identified at time of analysis and the EPSS probability is negligible (0.03%); notably the function's return value is unused by its caller, further limiting practical impact.
Denial-of-service in the Linux kernel ext4 filesystem driver allows a local attacker to trigger a kernel BUG_ON (panic) by inducing a victim to mount and access a specially crafted, corrupted ext4 image. The flaw stems from an inode that illegally carries both the INLINE_DATA and EXTENTS flags, which causes extent-tree validation to be skipped and an integer underflow during hole-size calculation in ext4_es_cache_extent(). Discovered via the syzbot fuzzer, it carries a low EPSS score (0.07%, 21st percentile), is not on the CISA KEV list, and has no public exploit identified at time of analysis, though a syzbot reproducer effectively exists.
Improper resource cleanup in the Linux kernel's Intel Xe DRM driver (drm/xe/guc) lets a local user trigger a memory-management fault when destroying a GPU exec queue after the GuC firmware has already been stopped - for example during a forced driver unbind. Because the driver waits for a GuC response that can never arrive, exec queue resources are never freed, leaving the GuC ID manager and VRAM manager in an unclean state and producing kernel WARNING/ERROR traces. The upstream fix (cherry-picked from commit 9b42321a02c5) releases the resources directly when the GuC is not running; EPSS is very low (0.03%) and there is no public exploit identified at time of analysis.
Local resource-leak and kernel-warning condition in the Linux kernel's NXP i.MX8-ISI mem2mem (m2m) media driver (imx8-isi) lets a local user with access to the V4L2 video device leave an ISI channel permanently allocated by terminating a streaming application uncleanly (e.g. Ctrl+C), because imbalanced streamon/streamoff calls prevent the m2m usage_count from reaching zero. On i.MX95-class hardware, streaming with an input line width greater than 2K additionally trips a WARN_ON() in mxc_isi_channel_chain(). This carries a low EPSS (0.03%, 10th percentile), is not on CISA KEV, and has no public exploit identified at time of analysis; a vendor fix is available.
In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix using smp_processor_id() in preemptible code warnings Syzbot reported the following warning: BUG: using. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Stop dl_server before CPU goes offline IBM CI tool reported kernel warning[1] when running a CPU removal operation. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: xen/events: Return -EEXIST for bound VIRQs Change find_virq() to return -EEXIST when a VIRQ is bound to a different CPU than the.
Denial-of-service and potential kernel information disclosure in the Linux kernel IPv6 stack arises from a use-after-free in ip6_output(), where the network device destination (dst) could be freed while still referenced during packet transmission. The fix wraps ip6_output() in an RCU read-side critical section and uses dst_dev_rcu() so the device pointer stays valid, removing now-redundant rcu_read_lock/unlock pairs from ip6_finish_output2(). No public exploit identified at time of analysis; EPSS is very low (0.03%) and the flaw is not in CISA KEV, but the CVSS 8.1 rating reflects the memory-safety impact of a UAF in the packet output path.
In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() The drv->sram_reg pointer could be set to.
Denial of service (and potential information disclosure) in the Linux kernel's Intel VT-d IOMMU debugfs interface allows a privileged local user to crash the host by reading the domain translation dump. When a device's context entry uses a legacy-mode translation type other than 00b/01b, the SSPTPTR field is uninitialized or zero, and the debugfs code walks it as a valid page-table pointer, producing a general-protection fault on a non-canonical address. No public exploit identified at time of analysis; EPSS is negligible (0.03%) and this is not in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640.
In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: avoid soft lockup when mprotect to large memory area When calling mprotect() to a large hugetlb memory area in our.
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix bootup splat with separate_gpu_drm modparam The drm_gem_for_each_gpuvm_bo() call from lookup_vma() accesses. No vendor patch available.
Local denial of service in the Linux kernel's LoongArch BPF JIT allows a low-privileged local user with BPF tracing capability to crash the system by attaching a trampoline (fentry/fexit) program to a function whose arguments include a struct passed by value. On LoongArch the trampoline code never implemented struct-by-value handling, so the generated code dereferences an invalid address and triggers a kernel oops with subsequent RCU stalls. This is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is 0.03% (10th percentile), consistent with a niche, architecture-specific crash rather than a widely weaponized flaw.
In the Linux kernel, the following vulnerability has been resolved: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix potential deadlock while nr_requests grown Allocate and free sched_tags while queue is freezed can deadlock[1], this is. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure When devm_add_action_or_reset() fails, it calls the passed. No vendor patch available.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: bpf: dont report verifier bug for missing bpf_scc_visit on speculative path Syzbot generated a program that triggers a. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT snd_pcm_group_lock_irq() acquires a spinlock_t and. No vendor patch available.
Memory corruption in the Linux kernel Bluetooth Isochronous (ISO) channel subsystem allows a use-after-free when iso_conn_free() runs without conn->sk being cleared to NULL, mirroring a previously fixed SCO flaw. An attacker within Bluetooth range able to establish or tear down ISO connections can trigger the dangling-pointer condition to corrupt kernel memory, potentially escalating privileges or crashing the host. It carries a CVSS 8.0 (high) score; no public exploit has been identified and EPSS is very low (0.03%), indicating no observed exploitation activity.
Denial-of-service race condition in the Linux kernel's rtl8150 USB-to-Ethernet driver allows a kernel WARNING and double URB submission when the ndo_set_rx_mode path (rtl8150_set_multicast) improperly wakes the TX queue before an in-flight transmit URB completes, colliding with rtl8150_start_xmit. It affects systems using an RTL8150-based USB Ethernet adapter and was surfaced by syzbot fuzzing; no public exploit identified at time of analysis and EPSS is low (0.07%). The supplied 8.8 CVSS (AV:A/C:H/I:H/A:H) appears substantially inflated for what is fundamentally a local driver race with availability impact.
Local denial of service and potential information disclosure in the Linux kernel's SMC (Shared Memory Communications) subsystem arises because smc_clc_prfx_set() dereferences sk_dst_get(sk)->dev during connect() without holding RCU or RTNL, creating a use-after-free window on the destination cache entry. A local user opening an AF_SMC socket can trigger the freed dst->dev access, risking a kernel crash or leaked memory. No public exploit identified at time of analysis, EPSS is negligible (0.03%), and it is not on CISA KEV; the upstream fix switches to __sk_dst_get()/dst_dev_rcu() under rcu_read_lock().
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to truncate first page in error path of f2fs_truncate() syzbot reports a bug as below: loop0: detected capacity change.
In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - request reserved interrupt for virtual function The device interrupt vector 3 is an error interrupt for. No vendor patch available.
Use-after-free in the Linux kernel IPv6 stack's ip6_xmit() transmit path allows attackers to corrupt or read freed kernel memory when a destination cache (dst) entry and its associated network device are released concurrently during packet transmission. The fix converts the device dereference to an RCU-protected access via dst_dev_rcu(), closing a race window that could yield information disclosure or memory corruption. No public exploit has been identified at the time of analysis; EPSS exploitation probability is negligible (0.03%, 10th percentile).
Use-after-free in the Linux kernel's MPTCP (Multipath TCP) subsystem allows potential kernel memory corruption during active connection establishment. The flaw lives in mptcp_active_enable(), reached via subflow_finish_connect()/sk_rx_dst_set(), where the destination cache is dereferenced (sk_dst_get(sk)->dev) outside RCU protection, permitting a freed dst/device pointer to be accessed. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), indicating negligible observed exploitation despite the 8.1 CVSS.
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback In create_sdw_dailink() check that sof_end->codec_info->add_sidecar. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling The cpu_latency_qos_add/remove/update_request interfaces lack. No vendor patch available.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: hwrng: ks-sa - fix division by zero in ks_sa_rng_init Fix division by zero in ks_sa_rng_init caused by missing clock pointer.
In the Linux kernel, the following vulnerability has been resolved: sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC The referenced commit introduced exception handlers.
In the Linux kernel, the following vulnerability has been resolved: blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx In __blk_mq_update_nr_hw_queues() the return value.
Local memory-safety mishandling in the Linux kernel's SPARC (UltraSPARC III) copy_from_user/copy_to_user routines causes these functions to return impossibly large "bytes not copied" values when a user-space access faults, because the %o2 register masking was performed after the bulk copy loop instead of before the exception handlers ran. Downstream consumers such as __copy_from_iter propagate the bogus count, which was observed triggering a BUG_ON in ext4 with large folios enabled, and can lead to kernel state corruption, information disclosure of uninitialized memory, or denial of service. No public exploit is identified at time of analysis (EPSS 0.09%, not in CISA KEV); the flaw is limited to legacy SPARC hardware.
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error When running perf_fuzzer on PTL, sometimes the below "unchecked MSR access. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640.
A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in macrozheng mall-swarm up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPSwings WooCommerce Ultimate Points And Rewards woocommerce-ultimate-points-and-rewards allows Retrieve. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The AI Engine plugin for WordPress is vulnerable to PHP Object Injection via PHAR Deserialization in all versions up to, and including, 3.1.8 via deserialization of untrusted input in the. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable. No vendor patch available.
The Comment Edit Core - Simple Comment Editing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.0 via the 'ajax_get_comment' function. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notification' post meta registration. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Frappe Learning is a learning system that helps users structure their content. Rated low severity (CVSS 1.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vendor patch available.
DuckDB is a SQL database management system. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Wasmtime is a runtime for WebAssembly. Rated low severity (CVSS 1.8). No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: media: iris: fix module removal if firmware download failed Fix remove if firmware failed to load: qcom-iris aa00000.video-codec:. No vendor patch available.
Timing side-channel in the Linux kernel's SCTP subsystem allows remote attackers to defeat message-authentication (MAC) integrity by measuring non-constant-time byte-by-byte MAC comparisons, enabling forgery of authenticated SCTP data. The flaw affects the in-kernel SCTP implementation across multiple stable kernel series and was resolved by switching to a constant-time comparison helper. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.07%), consistent with the high attack complexity of a practical network timing attack.
Local privilege-adjacent memory corruption in the Linux kernel's listmount() mount-enumeration syscall arises because the code invoked path_put() while still holding the namespace semaphore; if that call drops the final reference to a path, cleanup runs under the held lock and can trigger a use-after-free or deadlock. Any local user able to call listmount() is affected on vulnerable stable kernels, and while EPSS is very low (0.03%) with no public exploit identified at time of analysis, the NVD-assigned CVSS of 7.8 reflects full CIA impact from local exploitation. The fix relocates the reference drop to outside the lock across three stable-branch commits.
Local memory corruption in the Linux kernel's resource-limit syscall (prlimit64) stems from unsafe locking in the sys_prlimit64()->do_prlimit() path, where task_lock(tsk->group_leader) can operate on an already-freed or concurrently-changed task_struct. When a low-privileged local user targets another process that exits, execs, or performs a multithreaded exec, the kernel may take the wrong lock or dereference freed memory, enabling a use-after-free race. No public exploit is identified at time of analysis and EPSS exploitation probability is very low (0.03%), but the CVSS 3.1 score of 7.8 reflects high confidentiality, integrity, and availability impact via local access.
In the Linux kernel, the following vulnerability has been resolved: Squashfs: reject negative file sizes in squashfs_read_inode() Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs.
Out-of-bounds buffer over-read in the Linux kernel ext4 filesystem driver allows disclosure of adjacent kernel memory or a system crash when a maliciously crafted ext4 superblock is mounted. The flaw lives in parse_apply_sb_mount_options(), which trusted the s_mount_opts field to be NUL-terminated (a guarantee normally provided only by tune2fs); a non-terminated string causes the parser to read past the buffer. There is no public exploit identified at time of analysis, and EPSS rates practical exploitation as very low (0.07%), consistent with a local-only, mount-triggered issue rather than a remote mass-exploitation candidate.
In the Linux kernel, the following vulnerability has been resolved: media: mc: Clear minor number before put device The device minor should not be cleared after the device is released. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: fs: quota: create dedicated workqueue for quota_release_work There is a kernel panic due to WARN_ONCE when panic_on_warn is set.
In the Linux kernel, the following vulnerability has been resolved: mount: handle NULL values in mnt_ns_release() When calling in listmount() mnt_ns_release() may be passed a NULL pointer. No vendor patch available.
Filesystem corruption and denial of service in the Linux kernel's ext4 extended-attribute (EA) inode handling allows a local attacker who can mount a crafted or corrupted ext4 image to trigger a reference-count underflow in ext4_xattr_inode_update_ref(). Because the code previously read an EA inode refcount that was already <= 0 and still applied the change (typically -1), it proceeded on a bogus negative value, spawning EXT4-fs errors and orphan/cleanup churn. No public exploit identified at time of analysis, and the EPSS score is very low (0.07%), consistent with a corruption-triggered fault rather than a readily weaponized remote flaw.
In the Linux kernel, the following vulnerability has been resolved: net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx_read_raw_eeprom Syzbot reported read of uninitialized. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: pwm: berlin: Fix wrong register in suspend/resume The 'enable' register should be BERLIN_PWM_EN rather than BERLIN_PWM_ENABLE,.
Denial of service in the Linux kernel's SCTP stack (net/sctp) allows a NULL-pointer dereference in the sctp_sf_do_5_1D_ce() COOKIE ECHO state-machine handler, crashing the kernel. When processing an incoming SCTP association setup, if the peer adaptation indication is zero and the authkey ulpevent allocation returns NULL, the uninitialized ai_ev pointer is passed to sctp_ulpevent_free() and dereferenced, panicking the system. The issue affects hosts actively using SCTP; there is no public exploit identified at time of analysis and EPSS risk is low (0.07%).
Memory corruption in the Linux kernel TCP stack allows a race between closing a listening socket and processing an in-flight TCP Fast Open (TFO) connection request to trigger a refcount underflow and double-free of the request socket, originally caught by syzbot. The flaw sits in tcp_conn_request(), which redundantly calls reqsk_fastopen_remove() after inet_child_forget()/tcp_disconnect() has already released the request socket, corrupting the listener's refcount. There is no public exploit identified at time of analysis and EPSS is very low (0.07%), but as a remotely reachable kernel use-after-free it warrants patching on IPv4/IPv6 servers that accept TFO connections.
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix debug checking for np-guests using huge mappings When running with transparent huge pages and CONFIG_NVHE_EL2_DEBUG. No vendor patch available.
Resource exhaustion in the Linux kernel's BPF subsystem allows gradual, unbounded kernel memory consumption (kmalloc-256 slab) leading to denial of service on hosts using the bpf_redirect_neigh() helper on the collect-metadata vxlan datapath. The __bpf_redirect_neigh_v4/v6 code called skb_dst_set() to attach a new dst entry without first releasing the metadata_dst that vxlan had already attached, leaking one dst object per redirected packet. The condition was observed in production on Cilium egress-gateway deployments, where decapsulated Pod traffic is forwarded via bpf_redirect_neigh(); EPSS is low (0.07%) and there is no public exploit identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP When running as an SNP or TDX guest under KVM, force the. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: ext4: verify orphan file size is not too big In principle orphan file can be arbitrarily large.
IBM QRadar SIEM 7.5 through 7.5.0 UP14 stores user credentials in configuration files in source control which can be read by an authenticated user. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Evervault is a payment security solution. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
sudo-rs is a memory safe implementation of sudo and su written in Rust. Rated low severity (CVSS 3.8). No vendor patch available.
IBM OpenPages 9.0 and 9.1 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points used by the user interface of OpenPages. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was reported in the Lenovo Scanner pro application during an internal security assessment that, under certain circumstances, could allow an attacker on the same logical network to. Rated medium severity (CVSS 6.0), this vulnerability is no authentication required. No vendor patch available.
CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format. Rated low severity (CVSS 3.7). Public exploit code available.
Mintty is a terminal emulator for Cygwin, MSYS, and WSL. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2507.1, a low-privileged user that does. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A maliciously crafted DWG file, when parsed through Autodesk 3ds Max, can force a Use-After-Free vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
N-central < 2025.4 can generate sessionIDs for unauthenticated users4. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 83.2% and no vendor patch available.
Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryption_helper.dart file. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. No vendor patch available.
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. No vendor patch available.
N-able N-central remote monitoring and management platform versions before 2025.4 contain multiple XML External Entity injection vulnerabilities. Attackers can exploit these to read sensitive files from the RMM server, including configuration files containing credentials for all managed endpoints.
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the user account by performing an arbitrary number of authentication attempts with different c
In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Fix bootlog initialization ordering As soon as we queue MHI buffers to receive the bootlog from the device, we could be. No vendor patch available.
Memory-safety fault in the Linux kernel's kTLS (kernel TLS) receive path allows use-after-free on socket buffers and stray writes into userspace memory after recv() has returned when async record decryption is used and an atomic skb clone allocation fails. Affected systems are those whose applications enable in-kernel TLS with asynchronous decryption; an attacker able to induce memory pressure while TLS records are inflight can corrupt kernel/user memory or leak data. Tagged as Information Disclosure, EPSS is negligible (0.03%), no public exploit is identified, and the issue is fixed upstream and shipped by distributions (Ubuntu USN-8125-1/USN-8126-1).
In the Linux kernel, the following vulnerability has been resolved: idpf: cleanup remaining SKBs in PTP flows When the driver requests Tx timestamp value, one of the first steps is to clone SKB using. No vendor patch available.
Missing memory-barrier ordering in the x86 memory-management code of the Linux kernel allows stale TLB entries to persist after an address-space switch, because switch_mm_irqs_off() can fail to observe a recent tlb_gen update from flush_tlb_mm_range(). On affected x86 SMP systems a local, low-privileged process could read or corrupt memory mappings it should no longer have access to, mapping to the CVSS 7.8 high/high/high impact. No public exploit identified at time of analysis, and the EPSS score is negligible (0.03%, 10th percentile), indicating this is a subtle correctness/race fix rather than an actively-targeted flaw.
Unbounded network device headroom growth in the Linux kernel's IPv6 tunnel driver (net/ip6_tunnel) lets the dev->needed_headroom value increase perpetually because, unlike its IPv4 counterpart, it lacked a ceiling. The fix ports the IPv4 headroom-growth limit (commit 5ae1e9922bbd) to the IPv6 path, capping repeated headroom adjustments. There is no public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.07%), so this is a stability/robustness hardening fix rather than an actively weaponized flaw.
Memory corruption in the Linux kernel's accel/qaic driver (Qualcomm Cloud AI 100 accelerator) allows a local user to trigger a general protection fault by submitting a DMA transfer request with a zero length, or when the device requests continuation (QAIC_TRANS_DMA_XFER_CONT) after all bytes have already been transferred. In these cases find_and_map_user_pages() returns 0 without allocating the scatter-gather table, and encode_addr_size_pairs() then dereferences the unallocated sgt, faulting the kernel. EPSS is very low (0.03%) and there is no public exploit identified at time of analysis, but distro patches (Ubuntu USN-8125-1/8126-1) are already shipping.
Resource exhaustion in the Linux kernel's NVMe-oF Fibre Channel target driver (nvmet-fc) stems from a reference-counting error in Link Service request handling: when multiple asynchronous LS commands are in flight from __nvmet_fc_send_ls_req, each takes a tgtport reference but only a single put-work item is queued, leaking the surplus references. Systems acting as NVMe-over-Fabrics FC targets are affected, and the leaked references prevent proper teardown of the target port, degrading availability over time. This is a defensive kernel hardening fix with no public exploit identified at time of analysis and a very low EPSS (0.05%).
Local information disclosure and potential use-after-free in the Linux kernel networking stack stems from unprotected reads of the destination cache device pointer (dst->dev) in sk_setup_caps() and related IPv4/IPv6 forwarding paths. Affected builds accessed dst->dev without RCU protection, allowing a concurrent update to free the device while another CPU dereferenced it. There is no public exploit identified at time of analysis, EPSS probability is negligible (0.03%), and the issue is not in CISA KEV; the upstream fix switches these call sites to the RCU-safe dst_dev_rcu()/dst_dev_net_rcu() helpers.
Local privilege-relevant memory corruption in the Linux kernel eBPF verifier arises because check_alu_op() validated the signed 16-bit instruction offset with 'insn->off > 1', which silently accepts negative values such as -1 instead of only 0 and 1. A local user able to load BPF programs can submit malformed ALU instructions (BPF_DIV/BPF_MOD) that bypass verifier bounds, undermining the safety guarantees the verifier is meant to enforce. No public exploit identified at time of analysis; EPSS is negligible (0.03%), and Ubuntu has shipped fixes.
Use-after-free in the Linux kernel's SMC (Shared Memory Communications) protocol handler smc_clc_prfx_match() lets a remote peer potentially trigger memory corruption during connection establishment. The flaw stems from dereferencing a destination cache device pointer (sk_dst_get(sk)->dev) outside RCU/RTNL protection in the listen path, so the dst entry can be freed concurrently. There is no public exploit identified at time of analysis and the EPSS probability is negligible (0.03%); notably the function's return value is unused by its caller, further limiting practical impact.
Denial-of-service in the Linux kernel ext4 filesystem driver allows a local attacker to trigger a kernel BUG_ON (panic) by inducing a victim to mount and access a specially crafted, corrupted ext4 image. The flaw stems from an inode that illegally carries both the INLINE_DATA and EXTENTS flags, which causes extent-tree validation to be skipped and an integer underflow during hole-size calculation in ext4_es_cache_extent(). Discovered via the syzbot fuzzer, it carries a low EPSS score (0.07%, 21st percentile), is not on the CISA KEV list, and has no public exploit identified at time of analysis, though a syzbot reproducer effectively exists.
Improper resource cleanup in the Linux kernel's Intel Xe DRM driver (drm/xe/guc) lets a local user trigger a memory-management fault when destroying a GPU exec queue after the GuC firmware has already been stopped - for example during a forced driver unbind. Because the driver waits for a GuC response that can never arrive, exec queue resources are never freed, leaving the GuC ID manager and VRAM manager in an unclean state and producing kernel WARNING/ERROR traces. The upstream fix (cherry-picked from commit 9b42321a02c5) releases the resources directly when the GuC is not running; EPSS is very low (0.03%) and there is no public exploit identified at time of analysis.
Local resource-leak and kernel-warning condition in the Linux kernel's NXP i.MX8-ISI mem2mem (m2m) media driver (imx8-isi) lets a local user with access to the V4L2 video device leave an ISI channel permanently allocated by terminating a streaming application uncleanly (e.g. Ctrl+C), because imbalanced streamon/streamoff calls prevent the m2m usage_count from reaching zero. On i.MX95-class hardware, streaming with an input line width greater than 2K additionally trips a WARN_ON() in mxc_isi_channel_chain(). This carries a low EPSS (0.03%, 10th percentile), is not on CISA KEV, and has no public exploit identified at time of analysis; a vendor fix is available.
In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix using smp_processor_id() in preemptible code warnings Syzbot reported the following warning: BUG: using. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Stop dl_server before CPU goes offline IBM CI tool reported kernel warning[1] when running a CPU removal operation. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: xen/events: Return -EEXIST for bound VIRQs Change find_virq() to return -EEXIST when a VIRQ is bound to a different CPU than the.
Denial-of-service and potential kernel information disclosure in the Linux kernel IPv6 stack arises from a use-after-free in ip6_output(), where the network device destination (dst) could be freed while still referenced during packet transmission. The fix wraps ip6_output() in an RCU read-side critical section and uses dst_dev_rcu() so the device pointer stays valid, removing now-redundant rcu_read_lock/unlock pairs from ip6_finish_output2(). No public exploit identified at time of analysis; EPSS is very low (0.03%) and the flaw is not in CISA KEV, but the CVSS 8.1 rating reflects the memory-safety impact of a UAF in the packet output path.
In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() The drv->sram_reg pointer could be set to.
Denial of service (and potential information disclosure) in the Linux kernel's Intel VT-d IOMMU debugfs interface allows a privileged local user to crash the host by reading the domain translation dump. When a device's context entry uses a legacy-mode translation type other than 00b/01b, the SSPTPTR field is uninitialized or zero, and the debugfs code walks it as a valid page-table pointer, producing a general-protection fault on a non-canonical address. No public exploit identified at time of analysis; EPSS is negligible (0.03%) and this is not in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640.
In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: avoid soft lockup when mprotect to large memory area When calling mprotect() to a large hugetlb memory area in our.
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix bootup splat with separate_gpu_drm modparam The drm_gem_for_each_gpuvm_bo() call from lookup_vma() accesses. No vendor patch available.
Local denial of service in the Linux kernel's LoongArch BPF JIT allows a low-privileged local user with BPF tracing capability to crash the system by attaching a trampoline (fentry/fexit) program to a function whose arguments include a struct passed by value. On LoongArch the trampoline code never implemented struct-by-value handling, so the generated code dereferences an invalid address and triggers a kernel oops with subsequent RCU stalls. This is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is 0.03% (10th percentile), consistent with a niche, architecture-specific crash rather than a widely weaponized flaw.
In the Linux kernel, the following vulnerability has been resolved: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix potential deadlock while nr_requests grown Allocate and free sched_tags while queue is freezed can deadlock[1], this is. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure When devm_add_action_or_reset() fails, it calls the passed. No vendor patch available.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: bpf: dont report verifier bug for missing bpf_scc_visit on speculative path Syzbot generated a program that triggers a. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT snd_pcm_group_lock_irq() acquires a spinlock_t and. No vendor patch available.
Memory corruption in the Linux kernel Bluetooth Isochronous (ISO) channel subsystem allows a use-after-free when iso_conn_free() runs without conn->sk being cleared to NULL, mirroring a previously fixed SCO flaw. An attacker within Bluetooth range able to establish or tear down ISO connections can trigger the dangling-pointer condition to corrupt kernel memory, potentially escalating privileges or crashing the host. It carries a CVSS 8.0 (high) score; no public exploit has been identified and EPSS is very low (0.03%), indicating no observed exploitation activity.
Denial-of-service race condition in the Linux kernel's rtl8150 USB-to-Ethernet driver allows a kernel WARNING and double URB submission when the ndo_set_rx_mode path (rtl8150_set_multicast) improperly wakes the TX queue before an in-flight transmit URB completes, colliding with rtl8150_start_xmit. It affects systems using an RTL8150-based USB Ethernet adapter and was surfaced by syzbot fuzzing; no public exploit identified at time of analysis and EPSS is low (0.07%). The supplied 8.8 CVSS (AV:A/C:H/I:H/A:H) appears substantially inflated for what is fundamentally a local driver race with availability impact.
Local denial of service and potential information disclosure in the Linux kernel's SMC (Shared Memory Communications) subsystem arises because smc_clc_prfx_set() dereferences sk_dst_get(sk)->dev during connect() without holding RCU or RTNL, creating a use-after-free window on the destination cache entry. A local user opening an AF_SMC socket can trigger the freed dst->dev access, risking a kernel crash or leaked memory. No public exploit identified at time of analysis, EPSS is negligible (0.03%), and it is not on CISA KEV; the upstream fix switches to __sk_dst_get()/dst_dev_rcu() under rcu_read_lock().
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to truncate first page in error path of f2fs_truncate() syzbot reports a bug as below: loop0: detected capacity change.
In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - request reserved interrupt for virtual function The device interrupt vector 3 is an error interrupt for. No vendor patch available.
Use-after-free in the Linux kernel IPv6 stack's ip6_xmit() transmit path allows attackers to corrupt or read freed kernel memory when a destination cache (dst) entry and its associated network device are released concurrently during packet transmission. The fix converts the device dereference to an RCU-protected access via dst_dev_rcu(), closing a race window that could yield information disclosure or memory corruption. No public exploit has been identified at the time of analysis; EPSS exploitation probability is negligible (0.03%, 10th percentile).
Use-after-free in the Linux kernel's MPTCP (Multipath TCP) subsystem allows potential kernel memory corruption during active connection establishment. The flaw lives in mptcp_active_enable(), reached via subflow_finish_connect()/sk_rx_dst_set(), where the destination cache is dereferenced (sk_dst_get(sk)->dev) outside RCU protection, permitting a freed dst/device pointer to be accessed. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), indicating negligible observed exploitation despite the 8.1 CVSS.
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback In create_sdw_dailink() check that sof_end->codec_info->add_sidecar. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling The cpu_latency_qos_add/remove/update_request interfaces lack. No vendor patch available.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: hwrng: ks-sa - fix division by zero in ks_sa_rng_init Fix division by zero in ks_sa_rng_init caused by missing clock pointer.
In the Linux kernel, the following vulnerability has been resolved: sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC The referenced commit introduced exception handlers.
In the Linux kernel, the following vulnerability has been resolved: blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx In __blk_mq_update_nr_hw_queues() the return value.
Local memory-safety mishandling in the Linux kernel's SPARC (UltraSPARC III) copy_from_user/copy_to_user routines causes these functions to return impossibly large "bytes not copied" values when a user-space access faults, because the %o2 register masking was performed after the bulk copy loop instead of before the exception handlers ran. Downstream consumers such as __copy_from_iter propagate the bogus count, which was observed triggering a BUG_ON in ext4 with large folios enabled, and can lead to kernel state corruption, information disclosure of uninitialized memory, or denial of service. No public exploit is identified at time of analysis (EPSS 0.09%, not in CISA KEV); the flaw is limited to legacy SPARC hardware.
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error When running perf_fuzzer on PTL, sometimes the below "unchecked MSR access. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640.