Information Disclosure
Monthly
Zephyr RTOS versions 3.7.0 through 4.4.1 expose a remotely triggerable NULL pointer dereference in the UpdateHub OTA firmware-update agent that crashes and resets any affected device. The probe handler parses CoAP-delivered JSON metadata into a fixed nested-array struct but validates only the outer array length, leaving the inner sha256sum pointer NULL when the server returns an empty inner object array; a subsequent strlen() on that NULL pointer produces a fatal CPU fault. A malicious or compromised UpdateHub server - or a network man-in-the-middle when DTLS is disabled - can trigger this unconditionally. No public exploit is identified at time of analysis; a vendor patch is available in version 4.4.2.
Arbitrary file read in CyberPanel 2.4.3's file manager allows authenticated panel users to escape their home-directory sandbox by uploading a crafted ZIP archive containing symbolic links that target arbitrary filesystem paths. The application extracts ZIP contents without validating whether entries are symlinks, causing those links to persist on disk and remain accessible through the web interface, enabling retrieval of sensitive files such as /etc/shadow or SSH private keys. A publicly available exploit exists and a vendor patch is available at commit eca0c3c; no CISA KEV listing has been identified, but the low authentication barrier makes this a credible privilege escalation vector on any multi-tenant CyberPanel instance.
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged user achieve arbitrary host command execution by storing a malicious Git branch value and triggering a deployment. The branch fields (customGitBranch, branch, gitlabBranch, bitbucketBranch, giteaBranch) were left without server-side validation because the earlier fix for CVE-2026-45628 was incomplete, so attacker-controlled input flows unescaped into shell-based git clone commands. No public exploit has been identified at time of analysis, but the flaw carries a CVSS of 9.9 and is fixed in 0.29.13.
Use-after-free in the OP-TEE OS Trusted Application loader (all versions through 4.10.0) allows an attacker who controls a signed Trusted Application to corrupt S-EL1 secure-world kernel memory. By setting TA_FLAG_CONCURRENT in the TA's signed header - a flag reserved exclusively for pseudo-TAs - an adversary can force two concurrent sessions to share a context without locking, triggering a race on uctx->vm_info.regions that frees vm_region nodes still referenced by live mappings. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the high CVSS 4.0 score of 8.4 and confirmed patch availability underscore its seriousness in TEE-dependent deployments.
Malicious code injection into the use-reducer-async GitHub repository (a small React useReducer-with-async-actions helper by dai-shi) turned developer workstations into remote-code-execution targets during npm install. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07 UTC the default branch carried attacker-planted commits (da72edb through df07d57) that added src/install.js, wired it into the postinstall hook, fetched an attacker-hosted second-stage payload over TLS-verification-disabled HTTPS, and eval'd it with require available. The malicious version was never published to npm and the commits were force-pushed away, but any local clone, fork, or direct-SHA checkout still triggers the payload on install; there is no CISA KEV listing and no public exploit identified at time of analysis for the reconstructable payload itself.
Symlink escape in tar-rs versions 0.4.11 through 0.4.46 exposes arbitrary host filesystem files when a privileged process archives an attacker-controlled directory using the Builder::append_dir_all() function. The function resolves symbolic links during recursive directory traversal without verifying that resolved target paths remain within the specified source root, causing out-of-bounds files to be silently captured into the archive as regular file entries and disclosed to the attacker. A publicly available proof-of-concept exists; the CVE is not listed in CISA KEV, but low attack complexity combined with high confidentiality impact makes this a meaningful risk for affected Rust-based archiving pipelines.
Insufficient source identity validation in Red Hat Multicluster Global Hub's manager component allows a network-adjacent attacker who has compromised a managed hub to impersonate any other hub on the shared Kafka status bus. By presenting a legitimately obtained Kafka client certificate from the compromised hub while falsifying the CloudEvent source field, the attacker can overwrite or delete compliance records, inventory data, and cluster health telemetry belonging to sibling hubs in the shared database. No public exploit has been identified at time of analysis, but the scope-changed CVSS vector (S:C) reflects that the integrity impact extends beyond the initially compromised hub to the entire multi-hub management plane.
Supply-chain compromise of the use-context-selector React library (npm package dai-shi/use-context-selector) planted attacker-controlled malicious code that runs during `npm install`. Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34 UTC the GitHub default branch carried malicious commits (9d8481a through 6f2dae0) that added `src/install.js`, wired it into the `postinstall` hook, fetched a second-stage JavaScript payload from an attacker HTTPS endpoint with TLS verification disabled, and evaluated it with `require` available - but only on developer workstations (execution was deliberately skipped on CI and cloud/serverless). The commits were force-pushed out and the package was never published to npm, so there is no public exploit or CISA KEV entry, but any local clone, fork, or direct-SHA checkout retaining those commits will still execute the code on `npm install` today.
Insufficiently protected credentials in the Zyxel WAH7601 4G LTE mobile Wi-Fi router expose sensitive embedded data to unauthenticated remote attackers. All firmware versions through 20072026 are affected, and the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial remote exploitation requiring no privileges or user interaction. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the unauthenticated network-accessible nature of the flaw warrants prompt patching.
Arbitrary file read on the Jenkins controller affects Jenkins through LTS 2.555.3, where an authenticated attacker holding Item/Configure permission can exfiltrate any file readable by the Jenkins process user by uploading a crafted tar archive containing a symlink. This is an incomplete-fix bypass of CVE-2026-33001: the prior patch validated where a symlink is placed during extraction but not where it points, so a link staged inside the workspace can still resolve to paths outside it. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but it directly exposes secrets/master.key, credentials.xml, and other sensitive configuration.
Use-after-free in the Linux kernel's GPU host1x subsystem (`host1x_bo_clear_cached_mappings`) exposes local low-privileged users to potential kernel heap corruption leading to privilege escalation, memory disclosure, or system crash. The flaw occurs because `__host1x_bo_unpin()` frees the mapping object, yet the caller continues dereferencing `mapping` instead of the surviving `cache` local variable. Patches are confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, 7.2-rc4); no public exploit or active exploitation is identified at time of analysis, and EPSS sits at an extremely low 0.16% (6th percentile).
Use-after-free in the Linux kernel's IPsec transmit path (xfrm) occurs when validate_xmit_xfrm() processes a GSO segment list and async crypto offload steals the final segment via -EINPROGRESS, leaving the list head's ->prev pointing at a segment now owned (and potentially freed) by the crypto engine. validate_xmit_skb_list() then writes through that stale tail pointer, corrupting freed memory; the practical impact is kernel memory corruption and likely crash on systems using IPsec with asynchronous crypto. No public exploit identified at time of analysis, EPSS is low (0.16%), and it is not listed in CISA KEV, so this is a patch-and-move-on issue rather than an active-exploitation emergency.
Linux kernel's IB/mad subsystem exposes unauthenticated adjacent-network attackers to a kernel availability and integrity impact through premature RMPP reassembly state allocation. Systems with InfiniBand hardware running Linux 2.6.13 through multiple active stable branches are vulnerable: an attacker on the InfiniBand fabric can send unsolicited RMPP DATA responses routed to a kernel RMPP agent via crafted high TID bits, causing the kernel to allocate or extend RMPP receive state without any validated corresponding send request. EPSS exploitation probability is very low (0.16%, 6th percentile), no public exploit or CISA KEV listing exists, but the availability impact is rated High, making this a meaningful risk in HPC and data-center InfiniBand environments.
Remote memory access corruption in the Linux kernel's RDMA/irdma subsystem allows a local user with RDMA device access to trigger an invalid CQP (Control Queue Pair) command carrying a zero-initialized mkey by invoking rereg_mr on special QP/CQ/SRQ buffer registrations that were never intended for re-registration. Affected systems include Intel RDMA-capable hardware environments running Linux 6.6.x through 6.6.147, 6.7, and related stable branches prior to the fix commits. No public exploit code has been identified at time of analysis, and EPSS is very low at 0.16% (6th percentile), indicating limited exploitation interest despite the 7.8 CVSS score.
Race condition in the Linux kernel RDMA/siw (Software iWARP) subsystem exposes partially-constructed Queue Pair (QP) objects to concurrent lookups during QP creation. Affected kernels from 5.3 onward allow a local, low-privileged user on systems with the siw driver loaded to trigger a QPN lookup that resolves to a QP whose queues, CQ pointers, state, and device list entry have not yet been initialized. This can result in kernel memory corruption, information disclosure, or system availability loss - all three impact dimensions confirmed by the CVSS C:H/I:H/A:H rating. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.16% at the 5th percentile.
Use-after-free in the Linux kernel cfg80211 WiFi subsystem exposes systems with wireless adapters to potential kernel memory corruption via a race condition between scheduled scan result processing and WiFi device unregistration. All Linux kernel versions from approximately 3.0 (commit 807f8a8c) through stable releases prior to 6.6.148, 6.12.101, 6.18.42, and 7.1.6 are affected wherever cfg80211-based WiFi drivers are in use. No public exploit has been identified at time of analysis, and EPSS at 0.16% (6th percentile) reflects low current exploitation probability despite the kernel-level C:H/I:H/A:H impact potential.
Use-after-free race condition in the Linux kernel mac80211 MLO (Multi-Link Operation) link removal path allows an adjacent-network attacker to trigger kernel memory corruption on WiFi 7-capable systems. The flaw exists because sta_remove_link() immediately frees the percpu RX stats buffer while deferring only the link container to RCU, leaving the kernel's fast RX path able to dereference the freed percpu block via a stale link_sta pointer. No public exploit code exists and EPSS is 0.17% (6th percentile), consistent with the kernel commit description's own characterization of the race window as 'hard to win in practice,' though a successful exploit would carry full kernel-level impact.
A race condition in the Linux kernel's cfg80211 wifi subsystem exposes systems to kernel memory corruption by a local, low-privilege user. The flaw exists between the NETLINK_URELEASE notification path and the NETDEV_GOING_DOWN cancellation path for the wireless device autodisconnect work item: because the work is a plain work_struct, it can be re-queued after cancellation and outlive the wdev structure it references, since synchronize_net() does not drain work queued by in-flight RCU readers. Upstream fix commits are available on kernel.org stable trees, and no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds memory writes in the Linux kernel's ARM Firmware Framework for Armv8-A (FF-A) driver expose local low-privilege users to kernel memory corruption on affected ARM platforms. Two distinct write-past-end defects exist in ffa_setup_and_transmit(): one triggered when the FFA protocol version is below 1.2 due to a struct size mismatch causing writes beyond allocated memory, and another from missing size validation before writing constituents. Upstream kernel patches are available across multiple stable branches (6.18.42, 7.1.6, 7.2-rc4); no public exploit or active exploitation has been identified at time of analysis, and EPSS probability is very low at 0.17%.
Incorrect offset calculation in the Linux kernel's arm_ffa firmware subsystem exposes local privilege escalation on systems using the Arm Firmware Framework for Armv8-A (FF-A). The flaw uses a hardcoded sizeof(struct ffa_mem_region) instead of the descriptor's ep_mem_offset field to locate the endpoint memory access array, violating the FF-A specification. A local user with low privileges could exploit this memory misinterpretation to achieve high confidentiality, integrity, and availability impact; no public exploit or active exploitation (KEV) has been identified at time of analysis.
Use-after-free in the Linux kernel BPF subsystem allows a local low-privileged attacker to corrupt or access freed kernel memory through a race condition in socket cloning. The flaw exists in sk_clone() where a shallow copy via sock_copy() leaves newsk->sk_bpf_storage pointing to the parent socket's BPF local storage; if an early bailout occurs before bpf_sk_storage_clone() runs, subsequent freeing of the cloned socket destroys the parent's storage, triggering a UAF. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and EPSS sits at 0.16% (6th percentile), indicating low current exploitation probability.
Use-after-free in the Linux kernel's PPP-over-L2TP subsystem exposes a race condition between softirq RX processing and socket teardown, reachable by an unprivileged local user and capable of yielding full kernel memory corruption and privilege escalation. The pppol2tp_recv() function runs under rcu_read_lock() but dereferences an internal struct channel that close() can free with a plain kfree() when the channel was bound via PPPIOCGCHAN without a subsequent PPPIOCCONNECT, bypassing all RCU grace-period fences. Patches are available across multiple stable kernel branches; no public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV.
Use-after-free race condition in the Linux kernel AF_IUCV HiperSockets receive path allows a network-adjacent unauthenticated attacker to dereference freed kernel memory, potentially achieving kernel code execution and full system compromise. The flaw exclusively affects IBM z/Architecture (mainframe) systems running Linux under z/VM with the AF_IUCV subsystem active, making the exploitable population extremely narrow. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), consistent with the niche deployment context; patched stable kernel releases are available across multiple branches.
Use-after-free in the Linux kernel's Bluetooth MGMT subsystem allows a local attacker with low-privilege Bluetooth Management socket access to corrupt kernel heap memory and potentially escalate privileges to root. The flaw exists in MGMT_OP_LOAD_CONN_PARAM handling, where a borrowed hci_conn_params pointer stored in a queued work item can be freed by a subsequent LOAD_CONN_PARAM call before hci_cmd_sync_work executes the callback - a race-driven use-after-free confirmed by KASAN. No public exploit or active exploitation has been identified at time of analysis; patches are available across stable kernel series 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4.
Use-after-free in the Linux kernel Bluetooth HCI synchronization layer (hci_sync) allows adjacent, unauthenticated attackers to corrupt kernel memory, potentially achieving full system compromise. The root cause is that RCU-protected conn_hash lookup results were dereferenced outside RCU critical sections without holding a reference count, permitting concurrent deletion to free the connection object while it is still in use. With a CVSS score of 8.8 (AV:A), exploitation requires only Bluetooth adjacency and no privileges; however, the EPSS score of 0.17% (6th percentile) and absence from CISA KEV indicate no confirmed active exploitation or public weaponized exploit at time of analysis.
Use-after-free in the Linux kernel's Bluetooth management subsystem allows a local low-privileged attacker to corrupt kernel memory during unpair_device or disconnect_sync operations, potentially achieving full kernel compromise (High C/I/A). The flaw stems from dereferencing RCU-protected hci_conn pointers outside proper critical sections, enabling a concurrent free of the structure while it is still in use. Vendor-released patches are available across multiple stable branches (6.6.148, 6.12.101, 7.1.6, 6.18.42); no public exploit code is identified at time of analysis, and EPSS of 0.17% indicates low immediate exploitation probability.
Use-after-free and data race conditions in the Linux kernel Bluetooth management subsystem allow a local low-privileged attacker to corrupt kernel memory, potentially escalating privileges to root. Affected kernels fail to properly hold reference counts on hci_conn objects stored in mgmt_pending_cmd structures and fail to acquire hdev->lock before accessing conn->state, enabling RCU-protected pointers to be dereferenced after the underlying memory has been freed. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects low observed exploitation pressure despite the high CVSS score.
Missing mutex protection in the Linux kernel's Bluetooth HCI synchronization layer creates a race condition when hci_conn_params_lookup is called without holding hdev->lock, enabling unsafe concurrent list iteration and parameter access at kernel level. All Linux kernel builds spanning commit c530569adc19b5f0c62955de41f067bad34e3fe0 up to the respective fix commits are affected when the Bluetooth subsystem is active. An adjacent, unauthenticated attacker within Bluetooth radio range could exploit this race window to achieve kernel-level memory corruption, information disclosure, or potentially arbitrary code execution. No public exploit or active exploitation (CISA KEV) has been identified; EPSS at 0.15% (5th percentile) reflects low current weaponization despite the elevated CVSS base score.
Use-after-free in the Linux kernel Bluetooth hci_qca driver allows an attacker within Bluetooth radio range to corrupt kernel heap memory by inducing a Qualcomm Atheros QCA controller to report a zero-length memory dump. Systems running unpatched kernels prior to 6.6.148, 6.12.101, 6.18.42, or 7.1.6 with QCA Bluetooth hardware are exposed, with potential impact spanning kernel information disclosure, memory corruption, and denial of service. No public exploit code has been identified at time of analysis, and EPSS probability is very low at 0.17% (6th percentile), indicating no evidence of active or widespread exploitation.
Race condition in the Linux kernel's CAN raw socket subsystem allows a local low-privileged user to trigger concurrent read-modify-write operations on the raw flags bitfield, potentially leading to kernel memory corruption and local privilege escalation. Introduced by commit 890e5198a6e5, which consolidated separate integer flags into a single bitfield in struct raw_sock without adequate locking in raw_setsockopt(), any concurrent call path can race to produce inconsistent flag state. No public exploit code has been identified and EPSS sits at the 11th percentile, indicating low current exploitation probability despite the high CVSS base score.
Incorrect checksum computation in the Linux kernel's s390 (IBM Z mainframe) architecture code causes csum_partial() to read from memory address zero instead of the intended source buffer on machines lacking the vector (VX) facility. Affects s390 systems running the buggy kernel builds; the practical effect is corrupted checksums and potential leakage of kernel memory contents near address zero into computed checksums. Rated CVSS 9.8 by automated scoring, but this is a local architecture-specific correctness bug with no public exploit identified at time of analysis and a low EPSS (0.18%, 7th percentile).
Race conditions in the Linux kernel's drm/xe Virtual Function CCS state management expose Intel Xe GPU SR-IOV environments to local privilege escalation, information disclosure, and memory corruption. The driver's buffer object move operations improperly sequence CCS batch buffer attach and detach relative to in-flight copy jobs, creating two distinct timing windows where a VF migration event can observe partially-copied or already-torn-down CCS metadata. No CISA KEV listing or public proof-of-concept exists at time of analysis, and EPSS of 0.18% (8th percentile) reflects negligible observed exploitation activity; the primary exposure surface is cloud and VDI infrastructure using Intel Xe GPUs with SR-IOV enabled.
Use-after-free in the Linux kernel's Intel Xe discrete GPU driver (DRM/xe) allows a local unprivileged user to access freed kernel memory via a dangling pointer in the GuC execution queue scheduler. The scheduler retains a pointer to an exec queue's name string (`q->name`) that is freed when the exec queue is destroyed, while scheduler fence timelines can still dereference it. Affected kernel versions span the 6.12, 6.15, and 6.16 stable series; no active exploitation has been identified (EPSS: 0.16%, not in CISA KEV), though the impact is rated High (CVSS 7.8) due to full kernel memory read/write/crash potential.
Use-after-free in the Linux kernel's in-kernel SMB server (ksmbd) allows the async oplock/lease break notification worker to operate on a freed ksmbd_conn object when connection teardown races with a pending break notification. Affected kernels span the 6.6.x through 6.18 stable series (fixed in 6.6.148, 6.12.101, 6.14, 6.18.42 and related patch releases); the fix pins a real conn reference for the queued work item. Rated CVSS 9.8 by the automated feed, but this is a timing-dependent race with no public exploit identified at time of analysis and a low EPSS score (0.17%, 6th percentile).
Use-after-free in the Linux kernel's AMD XDNA accelerator driver (amdxdna) exposes systems with AMD NPU hardware to local privilege escalation, kernel memory corruption, or system crash. The flaw exists in the job scheduler path: amdxdna_cmd_submit() stores a raw pointer to the submitting process's mm_struct in job->mm without calling mmgrab() to hold a structural reference, while aie2_sched_job_run() later dereferences that pointer from the DRM worker thread - after the originating process may have exited and freed the mm_struct. No public exploit code has been identified at time of analysis, and the EPSS score of 0.17% (7th percentile) is consistent with specialized hardware prerequisites and no active exploitation campaign.
Memory exhaustion in the Linux kernel TCP stack allows remote network-reachable attackers to trigger a reference leak in tcp_tw_bucket structures when PSP (Packet Security Protocol) policy lookup fails during packet processing in both IPv4 and IPv6 receive paths. TIME_WAIT socket references are not released on this failure path, causing a gradual accumulation of unreclaimable kernel memory. The CVSS score of 7.5 (High) reflects the network accessibility and potential for denial-of-service via memory exhaustion, though EPSS at 0.21% (11th percentile) and the absence from CISA KEV indicate no public exploit or confirmed active exploitation at time of analysis.
Use-after-free race condition in the Linux kernel's TC act_tunnel_key subsystem allows a local low-privileged attacker to corrupt kernel heap memory, potentially escalating privileges or crashing the system. The flaw exists in tunnel_key_release_params(), which synchronously frees metadata_dst via dst_release() while concurrent RCU readers in tunnel_key_act() may still hold the old params pointer and attempt dst_clone() on the already-dead reference. A proof-of-concept was developed by Trend Micro ZDI (zdi-disclosures@trendmicro.com) and verified by kernel maintainers with KASAN confirming slab-use-after-free; no public exploit is available beyond that researcher-held POC, and no KEV listing exists at time of analysis.
Use-after-free race condition in Linux kernel USB core sysfs allows a local low-privileged user to trigger concurrent memory access on freed BOS descriptor data, potentially leading to kernel memory corruption, privilege escalation, or system crash. The vulnerability arises in bos_descriptors_read() within the USB sysfs subsystem, where udev->bos is accessed without a lock while usb_reset_and_verify_device() - called by numerous drivers across the kernel - can free that same memory simultaneously. No public exploit code exists and the vulnerability is not listed in CISA KEV; the EPSS score of 0.17% confirms low observed exploitation probability at time of analysis.
Reference count underflow in the Linux kernel's USB MUSB OMAP2430 driver exposes systems built on Texas Instruments OMAP2430 SoCs to potential use-after-free conditions in kernel memory, with theoretical impact spanning privilege escalation and system crash. The flaw in omap2430_probe() calls of_node_put() on a borrowed platform device OF node that was never reference-counted by the probe function, leaving pdev->dev.of_node with an unbalanced count that can trigger premature freeing. No public exploit exists and EPSS exploitation probability stands at 0.20% (10th percentile), consistent with the extremely narrow hardware attack surface; this vulnerability is not listed in CISA KEV.
Race condition in the Linux kernel's dummy_hcd USB gadget driver corrupts a shared kernel request object's function pointer mid-callback, enabling a local low-privilege attacker on a multi-CPU system to redirect kernel execution and achieve privilege escalation. The vulnerable component is the FIFO fast-path in dummy_queue(), which reuses a single shared fifo_req before its completion callback has returned, allowing a concurrent CPU to overwrite the req->complete pointer while dummy_timer is actively invoking it - causing a general protection fault or page fault in kernel context. A syzkaller reproducer is documented (extid faf3a6cf579fc65591ca), but no public exploit or CISA KEV listing exists; EPSS sits at 0.18%, indicating very low observed exploitation activity.
FireWire network driver in the Linux kernel contains a linked-list boundary confusion flaw in `fwnet_frag_new()` that mishandles fragment reassembly at list edges, potentially enabling kernel memory corruption by adjacent-network attackers. Systems with the `firewire-net` module loaded are exposed to unauthenticated attackers sharing the same IEEE 1394 bus who can send crafted fragmented datagrams to trigger the defect. No public exploit exists and EPSS sits at 0.18% (7th percentile), but the CVSS 8.8 vector reflects high potential impact if type confusion against the list head leads to arbitrary kernel memory access.
Out-of-bounds read in the Linux kernel's TAS2781 ASoC audio driver firmware parser exposes systems with TAS2781 audio hardware to kernel memory disclosure and availability loss. The parser invokes strlen() on variable-length description strings read directly from a firmware image without first verifying a NUL terminator exists within the buffer, allowing a malformed firmware blob to drive pointer arithmetic past the allocated buffer boundary before downstream size checks execute. Patches have been released across multiple stable kernel branches (6.12.101, 6.6.148, 6.18.42, 7.1.6, 7.2-rc5); no public exploit or CISA KEV listing exists at time of analysis, and an EPSS score of 0.18% at the 7th percentile reflects minimal observed exploitation interest.
Out-of-bounds read in the Linux kernel's SMB/CIFS client DFS referral parser (parse_dfs_referrals) affects systems that mount SMB shares using DFS. A malicious or compromised SMB server can return a referral response whose PathConsumed value exceeds the search name length, causing later DFS path parsing to advance past the end of the buffer and leak adjacent kernel memory or crash the client. Tagged as Information Disclosure with a 9.1 CVSS; EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis.
Out-of-bounds read in the Linux kernel hwmon OCC (On-Chip Controller) driver exposes adjacent kernel memory and risks system availability on IBM POWER hardware running affected kernel versions. The poll response parser uses a static backing-array capacity as its parse boundary rather than the data_length field embedded in the firmware response, allowing a truncated OCC reply to cause the parser to read block headers or extents outside the valid response window. Vendor-released patches are available across multiple stable branches; no public exploit or CISA KEV listing exists at the time of analysis.
Race condition in the Linux kernel net/packet subsystem allows a local low-privileged attacker to re-register a fanout protocol hook after its associated network device has been unregistered, potentially corrupting kernel state and achieving privilege escalation. Affected systems are those running unpatched kernel versions prior to the stable-branch fixes across the 6.6, 6.12, 6.18, 7.1, and 7.2 release trees. No public exploit code and no CISA KEV listing exist at time of analysis, and the EPSS score of 0.21% (11th percentile) reflects low current exploitation activity.
Use-after-free in the Linux kernel RDS (Reliable Datagram Sockets) subsystem allows a local user with the ability to create unprivileged network namespaces to trigger memory corruption leading to privilege escalation. The flaw stems from rds_find_bound() performing socket lookups in a global hash table without accounting for network namespace boundaries, enabling a cross-namespace message delivery race condition where a freed rds_connection object is subsequently dereferenced. Two dangerous dereference sites have been KASAN-confirmed, including a function pointer call-through that constitutes a potential code execution primitive. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Use-after-free in the Linux kernel AMD IOMMU driver allows a local low-privileged attacker on multi-CPU AMD systems to corrupt kernel memory by exploiting a logical race in `iommu_completion_wait()`. The `need_sync` flag was read locklessly, enabling a CPU to return without waiting for hardware IOMMU command completion while another CPU's page-table pages are freed - leaving the IOMMU walking stale, potentially freed memory. No public exploit exists and EPSS is 0.20% (10th percentile), but successful exploitation on AMD virtualization infrastructure could cross IOMMU isolation boundaries affecting co-tenant VMs.
Race condition in the Linux kernel's TIPC UDP bearer implementation allows a local low-privileged attacker to corrupt an RCU-protected peer list, triggering a kernel BUG and enabling potential privilege escalation to full system compromise. The flaw exists in the TIPC subsystem where tipc_udp_rcast_add() (running from a softirq) and cleanup_bearer() (running from a workqueue) both mutate ub->rcast.list without synchronization, and critically, TIPCv2 generic-netlink ops lack GENL_ADMIN_PERM, allowing the race to be triggered from an unprivileged user namespace. No public exploit is identified at time of analysis, and EPSS probability is very low at 0.15% (5th percentile).
Element size miscalculation in the Linux kernel's accel/ethosu driver (Arm Ethos-U NPU) allows a local low-privileged user on hardware-equipped systems to bypass command stream validation and trigger out-of-bounds kernel memory access. Two discrete arithmetic errors - an entirely missing element size multiplier in the NHWC format path, and a shifted bitfield decode for OFM precision (bits 1:2 vs. the correct IFM bits 2:3) - cause the validator to underestimate buffer sizes for 16-, 32-, and 64-bit element widths. No public exploit code has been identified at time of analysis, and the EPSS score of 0.15% (5th percentile) reflects minimal observed exploitation activity; upstream fixes are available in Linux 7.1.6 and 7.2-rc5.
Linux Kernel's MCTP I3C driver leaves a dangling notifier and leaked bus objects when mctp_i3c_mod_init() encounters an error during i3c_driver_register(). Systems running Linux 6.7 through the unpatched stable branches are affected when the mctp_i3c module is loaded under specific failure conditions. No public exploit code has been identified and EPSS is 0.17%, but the theoretical impact includes kernel memory corruption via the stale notifier pointer if a subsequent I3C bus event fires against the freed module memory.
Memory corruption in the Linux kernel's AMT (Automatic Multicast Tunneling) driver stems from multiple receive and transmit paths caching skb-head pointers (ip_hdr, ipv6_hdr, eth_hdr, and AMT message headers) that are then invalidated by pull/reallocation helpers, leaving dangling pointers that are dereferenced as a use-after-free of the freed skb head. Systems acting as AMT gateways or relays that process attacker-supplied tunneled multicast packets are affected across kernels from 5.16 up to the fixed stable releases. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile), but the flaw is a network-reachable kernel UAF that could enable denial of service or, potentially, code execution.
Authentication bypass in the Linux kernel SCTP stack allows the AUTH requirement to be silently skipped: sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL. On endpoints configured to require SCTP AUTH, a remote peer can get COOKIE-ECHO (and associated control chunks) processed without the mandated authentication, either by omitting the preceding AUTH chunk or by exploiting a receive-path skb_clone() failure. The fix rechecks sctp_auth_recv_cid() and drops the chunk when authentication is required. No public exploit identified at time of analysis; EPSS is low (0.20%).
Kernel panic (denial of service) in the Linux kernel vmxnet3 driver affects VMware-hosted Linux guests receiving Geneve-encapsulated network traffic. The vmxnet3_get_hdr_len() function contains unguarded BUG_ON() assertions that assume hardware completion descriptor flags always describe outer headers; when the VMware VMXNET3 hardware signals inner-header processing of a Geneve tunnel packet via the VMXNET3_RCD_HDR_INNER_SHIFT bit, these assertions fire against the wrong protocol fields, crashing the kernel. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (6th percentile), reflecting very low current exploitation interest despite the elevated CVSS 7.5 base score.
Incomplete error-path cleanup in the Linux kernel's Intel Xe DRM GPU driver leaks kernel SVM and pagemap resources during GPU VM creation failures on systems equipped with Intel Xe-architecture hardware. The flaw, introduced when commit 9e9787414882 made xe_svm_init() unconditional without updating the matching teardown calls on the drm_gpuvm_resv_object_alloc() failure path, affects both fault-mode and non-fault-mode VMs running kernels between the introducing commit and the three stable-branch fixes. No public exploit code exists and no active exploitation is confirmed; EPSS sits at the 6th percentile, reflecting appropriately low short-term weaponization likelihood.
LoongArch BPF JIT in the Linux kernel incorrectly sign-extends results of signed ALU32 division and modulo operations (off=1), leaving bits 63:32 set in JIT-compiled code while the verifier and interpreter model those bits as zero. This JIT-verifier semantic divergence affects low-privileged local users on LoongArch systems who can load BPF programs, and may be leveraged via crafted eBPF programs to violate verifier-enforced memory safety invariants, potentially enabling privilege escalation. EPSS is low at 0.19% (9th percentile), no public exploit is confirmed at time of analysis, and patches are available in Linux 7.1.6 and upstream commit dacd348b8a99.
QRTR (Qualcomm IPC Router) socket namespace isolation is completely absent in the Linux kernel, allowing a local user with low privileges to cross network namespace boundaries by invoking unshare(CLONE_NEWUSER | CLONE_NEWNET) and opening an AF_QIPCRTR socket in the resulting namespace. The attacker can then send QRTR datagrams - including control-plane messages such as QRTR_TYPE_NEW_SERVER - to QRTR services in the host or initial namespace, where those messages are indistinguishable from legitimate traffic because they appear to originate from node id 1. No public exploit has been identified at time of analysis, and EPSS probability is low at 0.20%, but the CVSS 8.8 score with scope change reflects the complete breakdown of the kernel's namespace isolation guarantee for QRTR IPC.
Use-after-free in the Linux kernel's RDS TCP subsystem allows a local low-privileged attacker to corrupt kernel memory during network namespace teardown, potentially achieving full privilege escalation to root. The flaw exists across multiple stable kernel branches (6.12.x before 6.12.101, 6.18.x before 6.18.42, 7.1.x before 7.1.6), with exploitation limited to systems where the RDS TCP module is loaded - a non-default configuration primarily found in Oracle RAC and HPC environments. Kernel patches have been merged across all affected stable branches; no public exploit exists and EPSS sits at 0.17%, indicating low current exploitation probability.
Kernel panic via buffer overrun in the Linux kernel's drop_monitor subsystem when reporting packet drop events on 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS. The size calculation functions net_dm_packet_report_size() and net_dm_hw_packet_report_size() under-budget SKB allocation by up to 4 bytes, failing to account for the alignment padding that nla_put_u64_64bit() inserts on affected architectures, resulting in skb_over_panic() and a full kernel crash. No public exploit is known, and EPSS at 0.20% (10th percentile) reflects low exploitation probability consistent with the architecture-specific trigger condition.
Use-after-free in the Linux kernel's BPF sockmap subsystem allows a local low-privileged attacker to corrupt kernel slab memory via a race condition in tcp_bpf_sendmsg(), potentially escalating privileges to root. The vulnerability arises because the error path in tcp_bpf_sendmsg() uses a stale msg_tx pointer to decide whether to free a shared cork object - a decision that becomes unsafe once a second thread has already freed it during the window when the socket lock is released by sk_stream_wait_memory(). No public exploit has been identified at time of analysis and EPSS is 0.18%, though KASAN telemetry in the disclosure confirms the bug was reproduced by the reporter.
Use-after-free in the Linux kernel tracing subsystem exposes kernel memory to corruption when event trigger data is freed asynchronously by a kthread while a concurrent tracepoint handler still holds a reference. Affected are Linux 6.19 and kernel versions containing commit 61d445af0a7c but lacking the fixes at b9c8a1400a3b or 79097812153b. A local attacker with sufficient privilege to configure kernel tracing triggers could exploit this race condition to achieve kernel memory corruption, potentially enabling privilege escalation. No public exploit has been identified at time of analysis, and EPSS of 0.16% (6th percentile) reflects minimal exploitation activity despite the high CVSS score.
Use-after-free in the Linux kernel's drm/xe Intel Xe GPU driver allows a local low-privileged user to trigger kernel memory corruption with potential for full system compromise (C:H/I:H/A:H). The bug arises because an imported dma-buf buffer object (BO) is created with its reservation object (resv) pointing to the exporter's dma_buf->resv before the importer acquires a reference on that dma-buf - leaving a window in which the exporter can be freed while the TTM workqueue asynchronously accesses the now-dangling pointer. Vendor-released patches are available for Linux 6.12.103, 6.18.42, and 7.1.6; no public exploit has been identified at time of analysis.
Use-after-free via refcount underflow in the Linux kernel's DRM Imagination (PowerVR) GPU driver allows a local low-privileged user to corrupt kernel memory during GPU context teardown. The drm_sched_entity_fini() function is called twice on the same scheduling entity - once via pvr_context_kill_queues and again via pvr_context_destroy_queues - triggering a refcount_t underflow exposed by commit fd177135f0e6 which added GPU entity time accounting. No public exploit identified at time of analysis, and EPSS at 0.17% (6th percentile) reflects low exploitation probability; exploitation requires hardware with an Imagination/PowerVR GPU.
Incorrect pointer arithmetic in the Linux kernel's drm/imagination (PowerVR GPU) driver exposes kernel memory to local users and can trigger availability failures. The `pvr_set_uobj_array()` function swaps the stride increments for the kernel and userspace pointers when copying object arrays, so with a larger userspace stride the kernel reads and forwards data from wrong kernel addresses (confidentiality breach), and with a smaller stride it writes copies at wrong userspace offsets (potential crash or memory corruption). Exploitation requires local, low-privileged access to a system running an affected kernel with an Imagination Technologies PowerVR GPU; no public exploit has been identified at time of analysis and EPSS is low at 0.18%.
Bounds validation is absent in the AMD KFD CRIU restore path of the Linux kernel, exposing local low-privilege users on AMD GPU systems to kernel memory disclosure and availability loss. The drm/amdkfd subsystem accepts user-controlled queue type and mqd_size values during CRIU restore without range checking, allowing crafted inputs to drive out-of-bounds kernel memory access. No public exploit has been identified, and vendor-released patches are confirmed in Linux 6.18.42 and 7.1.6.
Out-of-bounds read in the Linux kernel drm/virtio driver allows a malicious virtio-gpu backend to leak adjacent guest kernel memory by returning a crafted EDID response with an inflated size and extension block count. Guests running Linux 5.0 through multiple unpatched stable branches are affected wherever virtio-gpu is in use, covering the majority of QEMU/KVM-based cloud VM deployments. No public exploit code is identified at time of analysis, and EPSS at 0.21% (11th percentile) reflects the high-privilege prerequisite of backend control, though the risk is material in adversarial multi-tenant cloud environments.
Use-after-unlock memory corruption in the Linux kernel's DRM/AMDGPU driver allows local low-privileged users on systems with AMD GPUs to read or corrupt kernel memory via the `amdgpu_vm_get_task_info_pasid()` function. The defect stems from a lock lifetime design flaw: a `vm` pointer obtained under XArray lock is dereferenced after `xa_unlock_irqrestore` releases that lock, leaving the pointer unprotected against concurrent modification. No public exploit code has been identified and EPSS is very low (0.20%, 10th percentile), but the CVSS-rated impact is High across Confidentiality, Integrity, and Availability, and vendor patches are available across multiple stable branches.
GPU Shared Virtual Memory (SVM) page mapping in the Linux kernel's drm/gpusvm subsystem leaks device mappings when a partial page-acquisition operation fails mid-sequence, leaving IOMMU-level mappings orphaned and unrecoverable through the normal cleanup path. Local users with GPU access on affected kernels - ranging from the introduction of drm/gpusvm through Linux 6.18 and 7.1 stable series - can trigger the condition by causing a later page in a batch to fail with -EOPNOTSUPP when ctx->allow_mixed is false, bypassing device_unmap() in __drm_gpusvm_unmap_pages(). No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, though NVD assigns a CVSS of 8.8 due to potential changed-scope impact on GPU/IOMMU mappings.
Double-free and use-after-free conditions in the Linux kernel's drm/amd/display subsystem expose systems with AMD GPU hardware to potential privilege escalation or kernel crash. The flaw resides in dm_update_crtc_state(), where the skip_modeset path releases a display stream reference without nullifying the pointer, leaving it dangling for a second release if a subsequent error - such as a color management failure - triggers the fail label. Patches are confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4); no public exploit exists and EPSS sits at 0.17% (6th percentile), but the kernel-level memory corruption class demands prioritized patching on AMD GPU deployments.
Race condition in the chips-media Wave5 video encoder driver of the Linux kernel corrupts the V4L2 M2M ready queue linked list, enabling local privilege escalation. The IRQ handler returns a source buffer to userspace via v4l2_m2m_buf_done before removing it from the ready queue; if userspace re-queues that buffer before start_encode cleans up the index, __list_add creates a self-referential loop that __list_del cannot resolve, poisoning kernel list pointers. A low-privileged local user on a system with Wave5 hardware can trigger kernel memory corruption, leading to a crash or potential escalation to root. No public exploit has been identified at time of analysis, and EPSS at 0.20% reflects very low near-term weaponization probability.
Buffer management failures in the Linux kernel msi2500 USB SDR driver allow a local low-privileged user to cause kernel memory corruption through improperly handled start_streaming() error paths. Five distinct failure paths in msi2500_start_streaming() - including USB disconnection, mutex interruption, USB ADC setup failure, isoc initialization failure, and CMD_START_STREAMING failure - neglect to return queued vb2 buffers to the framework before returning errors, and the worst path leaves submitted isochronous URBs with no consumer. Patched stable releases are available (6.6.148, 6.12.101, 6.18.42, 7.1.6), no public exploit exists, and EPSS is 0.18% (7th percentile), indicating low current exploitation probability.
Buffer leakage in the Linux kernel's pwc (Philips WebCam) driver allows a local low-privileged user to corrupt kernel memory state when start_streaming() fails along two specific error paths: USB device disconnection (-ENODEV) and signal-interrupted mutex acquisition (-ERESTARTSYS). The vb2 videobuf2 framework transfers buffer ownership to the driver before invoking start_streaming(), but the pwc driver's error paths failed to return those buffers via vb2_buffer_done(), triggering WARN_ON(owned_by_drv_count) and leaving kernel buffers in an unreturned, leaked state. No public exploit or CISA KEV entry exists; EPSS is 0.21% (11th percentile), reflecting minimal active exploitation interest, though the CVSS C:H/I:H/A:H scoring reflects the potential severity of kernel-level memory corruption.
Buffer leak in the Linux kernel's rtl2832_sdr media driver allows a local low-privileged user with access to an RTL2832-based SDR device to trigger kernel memory corruption by causing start_streaming() to fail, leaving vb2 framework buffers unreturned and firing WARN_ON(owned_by_drv_count). Affected are Linux kernels from 3.15 through multiple stable branches prior to 6.6.148, 6.12.101, 6.18.42, and 7.1.6. No public exploit has been identified at time of analysis and EPSS is 0.21% (11th percentile), but the kernel-level memory corruption potential under C:H/I:H/A:H CVSS rating indicates a realistic local privilege escalation risk for systems with SDR hardware attached.
Improper error-path cleanup in the Linux kernel STM32 DCMI driver leaves a V4L2 async notifier registered against kernel structures that may be freed or reused after a failed probe, creating a use-after-free condition. Systems running a vulnerable kernel with STM32 DCMI hardware where reset_control_assert() or reset_control_deassert() returns an error during driver initialization are susceptible to kernel memory corruption or crashes. No public exploit has been identified and EPSS sits at the 11th percentile, but CVSS rates the impact as High across confidentiality, integrity, and availability when the specific failure condition is met.
Buffer leak in the Linux kernel's sun4i-csi camera driver (Allwinner SoC Camera Sensor Interface) allows a local attacker with low-privilege access to the V4L2 camera interface to exhaust kernel memory by repeatedly triggering start_streaming() failure with an unsupported CSI format. The vb2 framework hands buffers to the driver before calling start_streaming(); when that call returns -EINVAL on the early format-validation path, those buffers are never returned via vb2_buffer_done(), leaking kernel memory and triggering WARN_ON(owned_by_drv_count). No public exploit exists and EPSS stands at 0.21% (11th percentile), indicating negligible real-world exploitation interest; the NVD-assigned C:H/I:H/A:H impact appears overstated relative to the actual error-path memory leak primitive.
Unvalidated HEVC active reference counts in the Linux kernel's V4L2 common control path allow a local low-privileged user to trigger out-of-bounds kernel memory access on systems equipped with stateless HEVC hardware decoders. Affected kernels from the introduction of stateless HEVC support (approximately 5.14) through to the patch commits fail to check that num_active_dpb_entries values fall within valid bounds before driver-specific code (Cedrus, Hantro, etc.) consumes them. No active exploitation is confirmed - EPSS stands at 0.21% (11th percentile) and the vulnerability is not listed in CISA KEV - but patched stable releases are available across all maintained kernel branches.
Memory corruption in the Linux kernel's vivid virtual video driver arises from missing vb2_is_busy() guards when toggling CROP, COMPOSE, and SCALE capability controls, exploitable by local low-privileged users in the window between VIDIOC_REQBUFS and VIDIOC_STREAMON ioctls. The affected vivid_update_format_cap/out() functions can overwrite video queue format parameters on an already-allocated buffer queue, yielding kernel-level corruption with high confidentiality, integrity, and availability impact as reflected in the CVSS 7.8 score. No public exploit identified at time of analysis; EPSS is 0.21% (11th percentile), though the issue was surfaced by the syzbot automated kernel fuzzer and confirmed by upstream maintainers.
Use-after-free in the Linux kernel ALSA MIDI sequencer subsystem enables local privilege escalation by any unprivileged user with access to /dev/snd/seq, requiring no capabilities or queue ownership. The flaw stems from a race window during queue deletion where a concurrent thread can re-open a queue timer after it has been closed but before the queue is freed, leaving a stale callback pointer that the global timer subsequently dereferences on the next tick. No public exploit has been identified and EPSS is 0.21% (11th percentile), but the attack surface is broad given how widely ALSA seq is deployed across Linux desktop and development systems.
Use-after-free in the Linux kernel ALSA timer subsystem allows a local low-privileged attacker to corrupt kernel memory by exploiting a race condition during master-slave timer instance teardown. When a master timer closes, slave callback draining is skipped, causing the slave struct to be freed while its callback executes in parallel - a classic UAF primitive with potential for local privilege escalation. EPSS is low at 0.21% (11th percentile), no KEV listing exists, and no public exploit code has been identified at time of analysis, but patched stable kernel releases are available.
Use-after-free in the Linux kernel ALSA timer subsystem allows a local unprivileged user to corrupt kernel memory and potentially escalate privileges. The flaw resides in the userspace-driven timer (utimer) path: the in-flight callback state is tracked by a single bit that cannot represent two concurrent callbacks, so racing two TRIGGER ioctls against the same utimer frees the instance while a second callback is still executing against that memory. The vulnerability is reachable by any user who can open /dev/snd/timer, including via sequencer queue timers bound to a utimer; no public exploit code has been identified and EPSS probability is low at 0.21%.
Use-after-free in the Linux kernel's ath6kl WiFi driver exposes systems with Atheros WiFi hardware to potential kernel memory corruption via a timer-callback race condition. The vulnerable `aggr_reset_state()` function calls non-synchronous `timer_delete()`, leaving a window in which the `aggr_timeout` callback continues accessing `aggr_conn->rx_tid[]` and `aggr_conn->stat[]` after those structures are freed by `aggr_module_destroy()`. Vendor-released patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.42, 7.1.6, 7.2-rc5), no public exploit has been identified, and EPSS stands at 0.18%, reflecting low observed exploitation activity.
Double-free memory corruption in the Linux kernel's brcmfmac Broadcom WiFi PCIe driver exposes systems running kernel 5.2 and later to potential kernel heap corruption when a bus_reset event is sequentially followed by device removal. The flaw in brcmf_pcie_release_scratchbuffers() allows dma_free_coherent() to be called twice on the same DMA allocation because freed pointer fields are not NULLed - unlike the sibling release_ringbuffers() function which correctly NULLs its pointers. No public exploit code exists and EPSS exploitation probability is very low (0.21%, 11th percentile), though the high CVSS score (8.8) reflects the theoretical severity of kernel-level memory corruption if the double-free is successfully weaponized.
Use-after-free in the Linux kernel Bluetooth HCI sync subsystem allows a local low-privileged attacker to corrupt kernel memory, with potential for privilege escalation and full system compromise. The flaw is a race condition between the hci_sync async command work (holding hdev->req_lock) and Bluetooth management socket operations (add_uuid/remove_uuid, which operate under hdev->lock), enabling concurrent unsafe UUID list access confirmed by KASAN. No public exploit code exists and EPSS is 0.20% (10th percentile), but the high C/I/A CVSS impact reflects the severity of kernel-level memory corruption if the race is won.
Mutex unlock imbalance in the Linux kernel's Nitro Security Module (NSM) ioctl handler allows a local process to corrupt kernel locking state by supplying an invalid user pointer to NSM_IOCTL_RAW. The `nsm_dev_ioctl()` function's pre-lock `copy_from_user()` failure path incorrectly reaches the shared `out` label, which unconditionally calls `mutex_unlock()` on a mutex that was never acquired - triggering a bad-unlock-balance condition confirmed by Lockdep. Systems running AWS Nitro Enclaves on affected kernel versions are exposed; no public weaponized exploit exists but a functional PoC triggering the Lockdep warning is documented in the upstream commit itself, and EPSS sits at 0.20% (10th percentile), indicating no widespread exploitation observed to date.
Use-after-unload code execution in the Linux kernel's NSM (Nitro Security Module) misc device allows a local attacker with low privileges to call into freed kernel module text, potentially achieving full kernel compromise. The NSM driver fails to set nsm_dev_fops.owner to THIS_MODULE, meaning misc_open() never increments the module reference count when /dev/nsm is opened. When the nsm module is subsequently unloaded while a file descriptor remains open, a later ioctl through that descriptor jumps into unmapped or reallocated memory. No public exploit code or CISA KEV listing exists, and EPSS sits at 0.20% (10th percentile), reflecting limited real-world exploitation risk at this time.
Use-after-free in the Linux kernel tracing subsystem's enable_event trigger mechanism allows a local attacker to dereference freed module memory by racing module unloading against an active tracepoint trigger. Affected kernel versions span from commit 61d445af0a7c70018111919e47beaaee15653f2f up to the fix commits on stable branches; patched releases 7.1.6 and 7.2-rc5 are available. No public exploit is identified and EPSS is 0.19% (9th percentile), but the CVSS-rated impact is full compromise of confidentiality, integrity, and availability at the kernel level.
Kernel panic and unauthorized physical memory access are possible on arm64 Linux systems when huge_ptep_get() receives an unaligned virtual address during contiguous huge page table walks. On arm64 platforms configured with 16K page size - where CONT_PTES differs from CONT_PMDS - the kernel's find_num_contig() routine misidentifies a contpmd block as a contpte block, iterates past the valid PTE table boundary, and dereferences a garbage linear-map pointer, either crashing the kernel or touching physical memory not owned by the calling process. No active exploitation (KEV) or public proof-of-concept has been identified; EPSS is 0.20% at the 10th percentile, reflecting very low real-world exploitation probability.
Use-after-free in the Linux kernel's MPTCP (Multipath TCP) subflow teardown path allows a stale skb->sk pointer to survive after a subflow socket is freed, leading to a kernel warning in inet_sock_destruct() and a use-after-free in mptcp_backlog_purge(). The flaw affects Linux 6.19 and is fixed in 7.1.6 and 7.2-rc5; it is a race condition between subflow close and concurrent softirq RX backlog processing. There is no public exploit identified at time of analysis, and EPSS estimates exploitation probability at just 0.19% (9th percentile).
Memory corruption in the Linux kernel's mm/page_vma_mapped subsystem allows a local low-privileged attacker to trigger kernel memory corruption, potentially leading to privilege escalation or system crash. The flaw stems from incomplete handling of device-private PMD entries in the rmap walk code: when PVMW_MIGRATION is set, the caller incorrectly interprets a device-private PMD entry as a migration entry, producing undefined behavior. No public exploit has been identified at time of analysis, and EPSS at 0.20% (10th percentile) indicates low current exploitation interest, but the high CVSS 7.8 with full C/I/A impact reflects the severity of kernel memory corruption.
Use-after-free in the Linux kernel SCTP subsystem exposes a race condition during network namespace teardown, enabling a local low-privileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw stems from a lifecycle misalignment between per-net SCTP sysctl registration and the SCTP control socket: an open sysctl file descriptor targeting a network namespace can survive into teardown, causing proc_sctp_do_auth() to dereference an already-freed control socket. No public exploit has been identified at time of analysis; EPSS is 0.21% (11th percentile), consistent with the timing complexity required for successful exploitation.
Improper resource teardown in the Linux kernel's SCTP subsystem leaves per-net UDP tunnel sockets installed when a network namespace is destroyed, creating a use-after-free/dangling-socket condition once the control socket is released. The flaw affects systems where SCTP UDP encapsulation (net.sctp.udp_port) has been enabled inside a namespace before that namespace exits. There is no public exploit identified at time of analysis, EPSS is low (0.20%), and the issue is not in CISA KEV; the fix has already been merged to multiple stable trees. Note: the supplied 9.8/AV:N CVSS is inconsistent with the local, namespace-scoped nature of the actual defect.
Zephyr RTOS versions 3.7.0 through 4.4.1 expose a remotely triggerable NULL pointer dereference in the UpdateHub OTA firmware-update agent that crashes and resets any affected device. The probe handler parses CoAP-delivered JSON metadata into a fixed nested-array struct but validates only the outer array length, leaving the inner sha256sum pointer NULL when the server returns an empty inner object array; a subsequent strlen() on that NULL pointer produces a fatal CPU fault. A malicious or compromised UpdateHub server - or a network man-in-the-middle when DTLS is disabled - can trigger this unconditionally. No public exploit is identified at time of analysis; a vendor patch is available in version 4.4.2.
Arbitrary file read in CyberPanel 2.4.3's file manager allows authenticated panel users to escape their home-directory sandbox by uploading a crafted ZIP archive containing symbolic links that target arbitrary filesystem paths. The application extracts ZIP contents without validating whether entries are symlinks, causing those links to persist on disk and remain accessible through the web interface, enabling retrieval of sensitive files such as /etc/shadow or SSH private keys. A publicly available exploit exists and a vendor patch is available at commit eca0c3c; no CISA KEV listing has been identified, but the low authentication barrier makes this a credible privilege escalation vector on any multi-tenant CyberPanel instance.
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged user achieve arbitrary host command execution by storing a malicious Git branch value and triggering a deployment. The branch fields (customGitBranch, branch, gitlabBranch, bitbucketBranch, giteaBranch) were left without server-side validation because the earlier fix for CVE-2026-45628 was incomplete, so attacker-controlled input flows unescaped into shell-based git clone commands. No public exploit has been identified at time of analysis, but the flaw carries a CVSS of 9.9 and is fixed in 0.29.13.
Use-after-free in the OP-TEE OS Trusted Application loader (all versions through 4.10.0) allows an attacker who controls a signed Trusted Application to corrupt S-EL1 secure-world kernel memory. By setting TA_FLAG_CONCURRENT in the TA's signed header - a flag reserved exclusively for pseudo-TAs - an adversary can force two concurrent sessions to share a context without locking, triggering a race on uctx->vm_info.regions that frees vm_region nodes still referenced by live mappings. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the high CVSS 4.0 score of 8.4 and confirmed patch availability underscore its seriousness in TEE-dependent deployments.
Malicious code injection into the use-reducer-async GitHub repository (a small React useReducer-with-async-actions helper by dai-shi) turned developer workstations into remote-code-execution targets during npm install. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07 UTC the default branch carried attacker-planted commits (da72edb through df07d57) that added src/install.js, wired it into the postinstall hook, fetched an attacker-hosted second-stage payload over TLS-verification-disabled HTTPS, and eval'd it with require available. The malicious version was never published to npm and the commits were force-pushed away, but any local clone, fork, or direct-SHA checkout still triggers the payload on install; there is no CISA KEV listing and no public exploit identified at time of analysis for the reconstructable payload itself.
Symlink escape in tar-rs versions 0.4.11 through 0.4.46 exposes arbitrary host filesystem files when a privileged process archives an attacker-controlled directory using the Builder::append_dir_all() function. The function resolves symbolic links during recursive directory traversal without verifying that resolved target paths remain within the specified source root, causing out-of-bounds files to be silently captured into the archive as regular file entries and disclosed to the attacker. A publicly available proof-of-concept exists; the CVE is not listed in CISA KEV, but low attack complexity combined with high confidentiality impact makes this a meaningful risk for affected Rust-based archiving pipelines.
Insufficient source identity validation in Red Hat Multicluster Global Hub's manager component allows a network-adjacent attacker who has compromised a managed hub to impersonate any other hub on the shared Kafka status bus. By presenting a legitimately obtained Kafka client certificate from the compromised hub while falsifying the CloudEvent source field, the attacker can overwrite or delete compliance records, inventory data, and cluster health telemetry belonging to sibling hubs in the shared database. No public exploit has been identified at time of analysis, but the scope-changed CVSS vector (S:C) reflects that the integrity impact extends beyond the initially compromised hub to the entire multi-hub management plane.
Supply-chain compromise of the use-context-selector React library (npm package dai-shi/use-context-selector) planted attacker-controlled malicious code that runs during `npm install`. Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34 UTC the GitHub default branch carried malicious commits (9d8481a through 6f2dae0) that added `src/install.js`, wired it into the `postinstall` hook, fetched a second-stage JavaScript payload from an attacker HTTPS endpoint with TLS verification disabled, and evaluated it with `require` available - but only on developer workstations (execution was deliberately skipped on CI and cloud/serverless). The commits were force-pushed out and the package was never published to npm, so there is no public exploit or CISA KEV entry, but any local clone, fork, or direct-SHA checkout retaining those commits will still execute the code on `npm install` today.
Insufficiently protected credentials in the Zyxel WAH7601 4G LTE mobile Wi-Fi router expose sensitive embedded data to unauthenticated remote attackers. All firmware versions through 20072026 are affected, and the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial remote exploitation requiring no privileges or user interaction. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the unauthenticated network-accessible nature of the flaw warrants prompt patching.
Arbitrary file read on the Jenkins controller affects Jenkins through LTS 2.555.3, where an authenticated attacker holding Item/Configure permission can exfiltrate any file readable by the Jenkins process user by uploading a crafted tar archive containing a symlink. This is an incomplete-fix bypass of CVE-2026-33001: the prior patch validated where a symlink is placed during extraction but not where it points, so a link staged inside the workspace can still resolve to paths outside it. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but it directly exposes secrets/master.key, credentials.xml, and other sensitive configuration.
Use-after-free in the Linux kernel's GPU host1x subsystem (`host1x_bo_clear_cached_mappings`) exposes local low-privileged users to potential kernel heap corruption leading to privilege escalation, memory disclosure, or system crash. The flaw occurs because `__host1x_bo_unpin()` frees the mapping object, yet the caller continues dereferencing `mapping` instead of the surviving `cache` local variable. Patches are confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, 7.2-rc4); no public exploit or active exploitation is identified at time of analysis, and EPSS sits at an extremely low 0.16% (6th percentile).
Use-after-free in the Linux kernel's IPsec transmit path (xfrm) occurs when validate_xmit_xfrm() processes a GSO segment list and async crypto offload steals the final segment via -EINPROGRESS, leaving the list head's ->prev pointing at a segment now owned (and potentially freed) by the crypto engine. validate_xmit_skb_list() then writes through that stale tail pointer, corrupting freed memory; the practical impact is kernel memory corruption and likely crash on systems using IPsec with asynchronous crypto. No public exploit identified at time of analysis, EPSS is low (0.16%), and it is not listed in CISA KEV, so this is a patch-and-move-on issue rather than an active-exploitation emergency.
Linux kernel's IB/mad subsystem exposes unauthenticated adjacent-network attackers to a kernel availability and integrity impact through premature RMPP reassembly state allocation. Systems with InfiniBand hardware running Linux 2.6.13 through multiple active stable branches are vulnerable: an attacker on the InfiniBand fabric can send unsolicited RMPP DATA responses routed to a kernel RMPP agent via crafted high TID bits, causing the kernel to allocate or extend RMPP receive state without any validated corresponding send request. EPSS exploitation probability is very low (0.16%, 6th percentile), no public exploit or CISA KEV listing exists, but the availability impact is rated High, making this a meaningful risk in HPC and data-center InfiniBand environments.
Remote memory access corruption in the Linux kernel's RDMA/irdma subsystem allows a local user with RDMA device access to trigger an invalid CQP (Control Queue Pair) command carrying a zero-initialized mkey by invoking rereg_mr on special QP/CQ/SRQ buffer registrations that were never intended for re-registration. Affected systems include Intel RDMA-capable hardware environments running Linux 6.6.x through 6.6.147, 6.7, and related stable branches prior to the fix commits. No public exploit code has been identified at time of analysis, and EPSS is very low at 0.16% (6th percentile), indicating limited exploitation interest despite the 7.8 CVSS score.
Race condition in the Linux kernel RDMA/siw (Software iWARP) subsystem exposes partially-constructed Queue Pair (QP) objects to concurrent lookups during QP creation. Affected kernels from 5.3 onward allow a local, low-privileged user on systems with the siw driver loaded to trigger a QPN lookup that resolves to a QP whose queues, CQ pointers, state, and device list entry have not yet been initialized. This can result in kernel memory corruption, information disclosure, or system availability loss - all three impact dimensions confirmed by the CVSS C:H/I:H/A:H rating. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.16% at the 5th percentile.
Use-after-free in the Linux kernel cfg80211 WiFi subsystem exposes systems with wireless adapters to potential kernel memory corruption via a race condition between scheduled scan result processing and WiFi device unregistration. All Linux kernel versions from approximately 3.0 (commit 807f8a8c) through stable releases prior to 6.6.148, 6.12.101, 6.18.42, and 7.1.6 are affected wherever cfg80211-based WiFi drivers are in use. No public exploit has been identified at time of analysis, and EPSS at 0.16% (6th percentile) reflects low current exploitation probability despite the kernel-level C:H/I:H/A:H impact potential.
Use-after-free race condition in the Linux kernel mac80211 MLO (Multi-Link Operation) link removal path allows an adjacent-network attacker to trigger kernel memory corruption on WiFi 7-capable systems. The flaw exists because sta_remove_link() immediately frees the percpu RX stats buffer while deferring only the link container to RCU, leaving the kernel's fast RX path able to dereference the freed percpu block via a stale link_sta pointer. No public exploit code exists and EPSS is 0.17% (6th percentile), consistent with the kernel commit description's own characterization of the race window as 'hard to win in practice,' though a successful exploit would carry full kernel-level impact.
A race condition in the Linux kernel's cfg80211 wifi subsystem exposes systems to kernel memory corruption by a local, low-privilege user. The flaw exists between the NETLINK_URELEASE notification path and the NETDEV_GOING_DOWN cancellation path for the wireless device autodisconnect work item: because the work is a plain work_struct, it can be re-queued after cancellation and outlive the wdev structure it references, since synchronize_net() does not drain work queued by in-flight RCU readers. Upstream fix commits are available on kernel.org stable trees, and no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds memory writes in the Linux kernel's ARM Firmware Framework for Armv8-A (FF-A) driver expose local low-privilege users to kernel memory corruption on affected ARM platforms. Two distinct write-past-end defects exist in ffa_setup_and_transmit(): one triggered when the FFA protocol version is below 1.2 due to a struct size mismatch causing writes beyond allocated memory, and another from missing size validation before writing constituents. Upstream kernel patches are available across multiple stable branches (6.18.42, 7.1.6, 7.2-rc4); no public exploit or active exploitation has been identified at time of analysis, and EPSS probability is very low at 0.17%.
Incorrect offset calculation in the Linux kernel's arm_ffa firmware subsystem exposes local privilege escalation on systems using the Arm Firmware Framework for Armv8-A (FF-A). The flaw uses a hardcoded sizeof(struct ffa_mem_region) instead of the descriptor's ep_mem_offset field to locate the endpoint memory access array, violating the FF-A specification. A local user with low privileges could exploit this memory misinterpretation to achieve high confidentiality, integrity, and availability impact; no public exploit or active exploitation (KEV) has been identified at time of analysis.
Use-after-free in the Linux kernel BPF subsystem allows a local low-privileged attacker to corrupt or access freed kernel memory through a race condition in socket cloning. The flaw exists in sk_clone() where a shallow copy via sock_copy() leaves newsk->sk_bpf_storage pointing to the parent socket's BPF local storage; if an early bailout occurs before bpf_sk_storage_clone() runs, subsequent freeing of the cloned socket destroys the parent's storage, triggering a UAF. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and EPSS sits at 0.16% (6th percentile), indicating low current exploitation probability.
Use-after-free in the Linux kernel's PPP-over-L2TP subsystem exposes a race condition between softirq RX processing and socket teardown, reachable by an unprivileged local user and capable of yielding full kernel memory corruption and privilege escalation. The pppol2tp_recv() function runs under rcu_read_lock() but dereferences an internal struct channel that close() can free with a plain kfree() when the channel was bound via PPPIOCGCHAN without a subsequent PPPIOCCONNECT, bypassing all RCU grace-period fences. Patches are available across multiple stable kernel branches; no public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV.
Use-after-free race condition in the Linux kernel AF_IUCV HiperSockets receive path allows a network-adjacent unauthenticated attacker to dereference freed kernel memory, potentially achieving kernel code execution and full system compromise. The flaw exclusively affects IBM z/Architecture (mainframe) systems running Linux under z/VM with the AF_IUCV subsystem active, making the exploitable population extremely narrow. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), consistent with the niche deployment context; patched stable kernel releases are available across multiple branches.
Use-after-free in the Linux kernel's Bluetooth MGMT subsystem allows a local attacker with low-privilege Bluetooth Management socket access to corrupt kernel heap memory and potentially escalate privileges to root. The flaw exists in MGMT_OP_LOAD_CONN_PARAM handling, where a borrowed hci_conn_params pointer stored in a queued work item can be freed by a subsequent LOAD_CONN_PARAM call before hci_cmd_sync_work executes the callback - a race-driven use-after-free confirmed by KASAN. No public exploit or active exploitation has been identified at time of analysis; patches are available across stable kernel series 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4.
Use-after-free in the Linux kernel Bluetooth HCI synchronization layer (hci_sync) allows adjacent, unauthenticated attackers to corrupt kernel memory, potentially achieving full system compromise. The root cause is that RCU-protected conn_hash lookup results were dereferenced outside RCU critical sections without holding a reference count, permitting concurrent deletion to free the connection object while it is still in use. With a CVSS score of 8.8 (AV:A), exploitation requires only Bluetooth adjacency and no privileges; however, the EPSS score of 0.17% (6th percentile) and absence from CISA KEV indicate no confirmed active exploitation or public weaponized exploit at time of analysis.
Use-after-free in the Linux kernel's Bluetooth management subsystem allows a local low-privileged attacker to corrupt kernel memory during unpair_device or disconnect_sync operations, potentially achieving full kernel compromise (High C/I/A). The flaw stems from dereferencing RCU-protected hci_conn pointers outside proper critical sections, enabling a concurrent free of the structure while it is still in use. Vendor-released patches are available across multiple stable branches (6.6.148, 6.12.101, 7.1.6, 6.18.42); no public exploit code is identified at time of analysis, and EPSS of 0.17% indicates low immediate exploitation probability.
Use-after-free and data race conditions in the Linux kernel Bluetooth management subsystem allow a local low-privileged attacker to corrupt kernel memory, potentially escalating privileges to root. Affected kernels fail to properly hold reference counts on hci_conn objects stored in mgmt_pending_cmd structures and fail to acquire hdev->lock before accessing conn->state, enabling RCU-protected pointers to be dereferenced after the underlying memory has been freed. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects low observed exploitation pressure despite the high CVSS score.
Missing mutex protection in the Linux kernel's Bluetooth HCI synchronization layer creates a race condition when hci_conn_params_lookup is called without holding hdev->lock, enabling unsafe concurrent list iteration and parameter access at kernel level. All Linux kernel builds spanning commit c530569adc19b5f0c62955de41f067bad34e3fe0 up to the respective fix commits are affected when the Bluetooth subsystem is active. An adjacent, unauthenticated attacker within Bluetooth radio range could exploit this race window to achieve kernel-level memory corruption, information disclosure, or potentially arbitrary code execution. No public exploit or active exploitation (CISA KEV) has been identified; EPSS at 0.15% (5th percentile) reflects low current weaponization despite the elevated CVSS base score.
Use-after-free in the Linux kernel Bluetooth hci_qca driver allows an attacker within Bluetooth radio range to corrupt kernel heap memory by inducing a Qualcomm Atheros QCA controller to report a zero-length memory dump. Systems running unpatched kernels prior to 6.6.148, 6.12.101, 6.18.42, or 7.1.6 with QCA Bluetooth hardware are exposed, with potential impact spanning kernel information disclosure, memory corruption, and denial of service. No public exploit code has been identified at time of analysis, and EPSS probability is very low at 0.17% (6th percentile), indicating no evidence of active or widespread exploitation.
Race condition in the Linux kernel's CAN raw socket subsystem allows a local low-privileged user to trigger concurrent read-modify-write operations on the raw flags bitfield, potentially leading to kernel memory corruption and local privilege escalation. Introduced by commit 890e5198a6e5, which consolidated separate integer flags into a single bitfield in struct raw_sock without adequate locking in raw_setsockopt(), any concurrent call path can race to produce inconsistent flag state. No public exploit code has been identified and EPSS sits at the 11th percentile, indicating low current exploitation probability despite the high CVSS base score.
Incorrect checksum computation in the Linux kernel's s390 (IBM Z mainframe) architecture code causes csum_partial() to read from memory address zero instead of the intended source buffer on machines lacking the vector (VX) facility. Affects s390 systems running the buggy kernel builds; the practical effect is corrupted checksums and potential leakage of kernel memory contents near address zero into computed checksums. Rated CVSS 9.8 by automated scoring, but this is a local architecture-specific correctness bug with no public exploit identified at time of analysis and a low EPSS (0.18%, 7th percentile).
Race conditions in the Linux kernel's drm/xe Virtual Function CCS state management expose Intel Xe GPU SR-IOV environments to local privilege escalation, information disclosure, and memory corruption. The driver's buffer object move operations improperly sequence CCS batch buffer attach and detach relative to in-flight copy jobs, creating two distinct timing windows where a VF migration event can observe partially-copied or already-torn-down CCS metadata. No CISA KEV listing or public proof-of-concept exists at time of analysis, and EPSS of 0.18% (8th percentile) reflects negligible observed exploitation activity; the primary exposure surface is cloud and VDI infrastructure using Intel Xe GPUs with SR-IOV enabled.
Use-after-free in the Linux kernel's Intel Xe discrete GPU driver (DRM/xe) allows a local unprivileged user to access freed kernel memory via a dangling pointer in the GuC execution queue scheduler. The scheduler retains a pointer to an exec queue's name string (`q->name`) that is freed when the exec queue is destroyed, while scheduler fence timelines can still dereference it. Affected kernel versions span the 6.12, 6.15, and 6.16 stable series; no active exploitation has been identified (EPSS: 0.16%, not in CISA KEV), though the impact is rated High (CVSS 7.8) due to full kernel memory read/write/crash potential.
Use-after-free in the Linux kernel's in-kernel SMB server (ksmbd) allows the async oplock/lease break notification worker to operate on a freed ksmbd_conn object when connection teardown races with a pending break notification. Affected kernels span the 6.6.x through 6.18 stable series (fixed in 6.6.148, 6.12.101, 6.14, 6.18.42 and related patch releases); the fix pins a real conn reference for the queued work item. Rated CVSS 9.8 by the automated feed, but this is a timing-dependent race with no public exploit identified at time of analysis and a low EPSS score (0.17%, 6th percentile).
Use-after-free in the Linux kernel's AMD XDNA accelerator driver (amdxdna) exposes systems with AMD NPU hardware to local privilege escalation, kernel memory corruption, or system crash. The flaw exists in the job scheduler path: amdxdna_cmd_submit() stores a raw pointer to the submitting process's mm_struct in job->mm without calling mmgrab() to hold a structural reference, while aie2_sched_job_run() later dereferences that pointer from the DRM worker thread - after the originating process may have exited and freed the mm_struct. No public exploit code has been identified at time of analysis, and the EPSS score of 0.17% (7th percentile) is consistent with specialized hardware prerequisites and no active exploitation campaign.
Memory exhaustion in the Linux kernel TCP stack allows remote network-reachable attackers to trigger a reference leak in tcp_tw_bucket structures when PSP (Packet Security Protocol) policy lookup fails during packet processing in both IPv4 and IPv6 receive paths. TIME_WAIT socket references are not released on this failure path, causing a gradual accumulation of unreclaimable kernel memory. The CVSS score of 7.5 (High) reflects the network accessibility and potential for denial-of-service via memory exhaustion, though EPSS at 0.21% (11th percentile) and the absence from CISA KEV indicate no public exploit or confirmed active exploitation at time of analysis.
Use-after-free race condition in the Linux kernel's TC act_tunnel_key subsystem allows a local low-privileged attacker to corrupt kernel heap memory, potentially escalating privileges or crashing the system. The flaw exists in tunnel_key_release_params(), which synchronously frees metadata_dst via dst_release() while concurrent RCU readers in tunnel_key_act() may still hold the old params pointer and attempt dst_clone() on the already-dead reference. A proof-of-concept was developed by Trend Micro ZDI (zdi-disclosures@trendmicro.com) and verified by kernel maintainers with KASAN confirming slab-use-after-free; no public exploit is available beyond that researcher-held POC, and no KEV listing exists at time of analysis.
Use-after-free race condition in Linux kernel USB core sysfs allows a local low-privileged user to trigger concurrent memory access on freed BOS descriptor data, potentially leading to kernel memory corruption, privilege escalation, or system crash. The vulnerability arises in bos_descriptors_read() within the USB sysfs subsystem, where udev->bos is accessed without a lock while usb_reset_and_verify_device() - called by numerous drivers across the kernel - can free that same memory simultaneously. No public exploit code exists and the vulnerability is not listed in CISA KEV; the EPSS score of 0.17% confirms low observed exploitation probability at time of analysis.
Reference count underflow in the Linux kernel's USB MUSB OMAP2430 driver exposes systems built on Texas Instruments OMAP2430 SoCs to potential use-after-free conditions in kernel memory, with theoretical impact spanning privilege escalation and system crash. The flaw in omap2430_probe() calls of_node_put() on a borrowed platform device OF node that was never reference-counted by the probe function, leaving pdev->dev.of_node with an unbalanced count that can trigger premature freeing. No public exploit exists and EPSS exploitation probability stands at 0.20% (10th percentile), consistent with the extremely narrow hardware attack surface; this vulnerability is not listed in CISA KEV.
Race condition in the Linux kernel's dummy_hcd USB gadget driver corrupts a shared kernel request object's function pointer mid-callback, enabling a local low-privilege attacker on a multi-CPU system to redirect kernel execution and achieve privilege escalation. The vulnerable component is the FIFO fast-path in dummy_queue(), which reuses a single shared fifo_req before its completion callback has returned, allowing a concurrent CPU to overwrite the req->complete pointer while dummy_timer is actively invoking it - causing a general protection fault or page fault in kernel context. A syzkaller reproducer is documented (extid faf3a6cf579fc65591ca), but no public exploit or CISA KEV listing exists; EPSS sits at 0.18%, indicating very low observed exploitation activity.
FireWire network driver in the Linux kernel contains a linked-list boundary confusion flaw in `fwnet_frag_new()` that mishandles fragment reassembly at list edges, potentially enabling kernel memory corruption by adjacent-network attackers. Systems with the `firewire-net` module loaded are exposed to unauthenticated attackers sharing the same IEEE 1394 bus who can send crafted fragmented datagrams to trigger the defect. No public exploit exists and EPSS sits at 0.18% (7th percentile), but the CVSS 8.8 vector reflects high potential impact if type confusion against the list head leads to arbitrary kernel memory access.
Out-of-bounds read in the Linux kernel's TAS2781 ASoC audio driver firmware parser exposes systems with TAS2781 audio hardware to kernel memory disclosure and availability loss. The parser invokes strlen() on variable-length description strings read directly from a firmware image without first verifying a NUL terminator exists within the buffer, allowing a malformed firmware blob to drive pointer arithmetic past the allocated buffer boundary before downstream size checks execute. Patches have been released across multiple stable kernel branches (6.12.101, 6.6.148, 6.18.42, 7.1.6, 7.2-rc5); no public exploit or CISA KEV listing exists at time of analysis, and an EPSS score of 0.18% at the 7th percentile reflects minimal observed exploitation interest.
Out-of-bounds read in the Linux kernel's SMB/CIFS client DFS referral parser (parse_dfs_referrals) affects systems that mount SMB shares using DFS. A malicious or compromised SMB server can return a referral response whose PathConsumed value exceeds the search name length, causing later DFS path parsing to advance past the end of the buffer and leak adjacent kernel memory or crash the client. Tagged as Information Disclosure with a 9.1 CVSS; EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis.
Out-of-bounds read in the Linux kernel hwmon OCC (On-Chip Controller) driver exposes adjacent kernel memory and risks system availability on IBM POWER hardware running affected kernel versions. The poll response parser uses a static backing-array capacity as its parse boundary rather than the data_length field embedded in the firmware response, allowing a truncated OCC reply to cause the parser to read block headers or extents outside the valid response window. Vendor-released patches are available across multiple stable branches; no public exploit or CISA KEV listing exists at the time of analysis.
Race condition in the Linux kernel net/packet subsystem allows a local low-privileged attacker to re-register a fanout protocol hook after its associated network device has been unregistered, potentially corrupting kernel state and achieving privilege escalation. Affected systems are those running unpatched kernel versions prior to the stable-branch fixes across the 6.6, 6.12, 6.18, 7.1, and 7.2 release trees. No public exploit code and no CISA KEV listing exist at time of analysis, and the EPSS score of 0.21% (11th percentile) reflects low current exploitation activity.
Use-after-free in the Linux kernel RDS (Reliable Datagram Sockets) subsystem allows a local user with the ability to create unprivileged network namespaces to trigger memory corruption leading to privilege escalation. The flaw stems from rds_find_bound() performing socket lookups in a global hash table without accounting for network namespace boundaries, enabling a cross-namespace message delivery race condition where a freed rds_connection object is subsequently dereferenced. Two dangerous dereference sites have been KASAN-confirmed, including a function pointer call-through that constitutes a potential code execution primitive. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Use-after-free in the Linux kernel AMD IOMMU driver allows a local low-privileged attacker on multi-CPU AMD systems to corrupt kernel memory by exploiting a logical race in `iommu_completion_wait()`. The `need_sync` flag was read locklessly, enabling a CPU to return without waiting for hardware IOMMU command completion while another CPU's page-table pages are freed - leaving the IOMMU walking stale, potentially freed memory. No public exploit exists and EPSS is 0.20% (10th percentile), but successful exploitation on AMD virtualization infrastructure could cross IOMMU isolation boundaries affecting co-tenant VMs.
Race condition in the Linux kernel's TIPC UDP bearer implementation allows a local low-privileged attacker to corrupt an RCU-protected peer list, triggering a kernel BUG and enabling potential privilege escalation to full system compromise. The flaw exists in the TIPC subsystem where tipc_udp_rcast_add() (running from a softirq) and cleanup_bearer() (running from a workqueue) both mutate ub->rcast.list without synchronization, and critically, TIPCv2 generic-netlink ops lack GENL_ADMIN_PERM, allowing the race to be triggered from an unprivileged user namespace. No public exploit is identified at time of analysis, and EPSS probability is very low at 0.15% (5th percentile).
Element size miscalculation in the Linux kernel's accel/ethosu driver (Arm Ethos-U NPU) allows a local low-privileged user on hardware-equipped systems to bypass command stream validation and trigger out-of-bounds kernel memory access. Two discrete arithmetic errors - an entirely missing element size multiplier in the NHWC format path, and a shifted bitfield decode for OFM precision (bits 1:2 vs. the correct IFM bits 2:3) - cause the validator to underestimate buffer sizes for 16-, 32-, and 64-bit element widths. No public exploit code has been identified at time of analysis, and the EPSS score of 0.15% (5th percentile) reflects minimal observed exploitation activity; upstream fixes are available in Linux 7.1.6 and 7.2-rc5.
Linux Kernel's MCTP I3C driver leaves a dangling notifier and leaked bus objects when mctp_i3c_mod_init() encounters an error during i3c_driver_register(). Systems running Linux 6.7 through the unpatched stable branches are affected when the mctp_i3c module is loaded under specific failure conditions. No public exploit code has been identified and EPSS is 0.17%, but the theoretical impact includes kernel memory corruption via the stale notifier pointer if a subsequent I3C bus event fires against the freed module memory.
Memory corruption in the Linux kernel's AMT (Automatic Multicast Tunneling) driver stems from multiple receive and transmit paths caching skb-head pointers (ip_hdr, ipv6_hdr, eth_hdr, and AMT message headers) that are then invalidated by pull/reallocation helpers, leaving dangling pointers that are dereferenced as a use-after-free of the freed skb head. Systems acting as AMT gateways or relays that process attacker-supplied tunneled multicast packets are affected across kernels from 5.16 up to the fixed stable releases. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile), but the flaw is a network-reachable kernel UAF that could enable denial of service or, potentially, code execution.
Authentication bypass in the Linux kernel SCTP stack allows the AUTH requirement to be silently skipped: sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL. On endpoints configured to require SCTP AUTH, a remote peer can get COOKIE-ECHO (and associated control chunks) processed without the mandated authentication, either by omitting the preceding AUTH chunk or by exploiting a receive-path skb_clone() failure. The fix rechecks sctp_auth_recv_cid() and drops the chunk when authentication is required. No public exploit identified at time of analysis; EPSS is low (0.20%).
Kernel panic (denial of service) in the Linux kernel vmxnet3 driver affects VMware-hosted Linux guests receiving Geneve-encapsulated network traffic. The vmxnet3_get_hdr_len() function contains unguarded BUG_ON() assertions that assume hardware completion descriptor flags always describe outer headers; when the VMware VMXNET3 hardware signals inner-header processing of a Geneve tunnel packet via the VMXNET3_RCD_HDR_INNER_SHIFT bit, these assertions fire against the wrong protocol fields, crashing the kernel. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (6th percentile), reflecting very low current exploitation interest despite the elevated CVSS 7.5 base score.
Incomplete error-path cleanup in the Linux kernel's Intel Xe DRM GPU driver leaks kernel SVM and pagemap resources during GPU VM creation failures on systems equipped with Intel Xe-architecture hardware. The flaw, introduced when commit 9e9787414882 made xe_svm_init() unconditional without updating the matching teardown calls on the drm_gpuvm_resv_object_alloc() failure path, affects both fault-mode and non-fault-mode VMs running kernels between the introducing commit and the three stable-branch fixes. No public exploit code exists and no active exploitation is confirmed; EPSS sits at the 6th percentile, reflecting appropriately low short-term weaponization likelihood.
LoongArch BPF JIT in the Linux kernel incorrectly sign-extends results of signed ALU32 division and modulo operations (off=1), leaving bits 63:32 set in JIT-compiled code while the verifier and interpreter model those bits as zero. This JIT-verifier semantic divergence affects low-privileged local users on LoongArch systems who can load BPF programs, and may be leveraged via crafted eBPF programs to violate verifier-enforced memory safety invariants, potentially enabling privilege escalation. EPSS is low at 0.19% (9th percentile), no public exploit is confirmed at time of analysis, and patches are available in Linux 7.1.6 and upstream commit dacd348b8a99.
QRTR (Qualcomm IPC Router) socket namespace isolation is completely absent in the Linux kernel, allowing a local user with low privileges to cross network namespace boundaries by invoking unshare(CLONE_NEWUSER | CLONE_NEWNET) and opening an AF_QIPCRTR socket in the resulting namespace. The attacker can then send QRTR datagrams - including control-plane messages such as QRTR_TYPE_NEW_SERVER - to QRTR services in the host or initial namespace, where those messages are indistinguishable from legitimate traffic because they appear to originate from node id 1. No public exploit has been identified at time of analysis, and EPSS probability is low at 0.20%, but the CVSS 8.8 score with scope change reflects the complete breakdown of the kernel's namespace isolation guarantee for QRTR IPC.
Use-after-free in the Linux kernel's RDS TCP subsystem allows a local low-privileged attacker to corrupt kernel memory during network namespace teardown, potentially achieving full privilege escalation to root. The flaw exists across multiple stable kernel branches (6.12.x before 6.12.101, 6.18.x before 6.18.42, 7.1.x before 7.1.6), with exploitation limited to systems where the RDS TCP module is loaded - a non-default configuration primarily found in Oracle RAC and HPC environments. Kernel patches have been merged across all affected stable branches; no public exploit exists and EPSS sits at 0.17%, indicating low current exploitation probability.
Kernel panic via buffer overrun in the Linux kernel's drop_monitor subsystem when reporting packet drop events on 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS. The size calculation functions net_dm_packet_report_size() and net_dm_hw_packet_report_size() under-budget SKB allocation by up to 4 bytes, failing to account for the alignment padding that nla_put_u64_64bit() inserts on affected architectures, resulting in skb_over_panic() and a full kernel crash. No public exploit is known, and EPSS at 0.20% (10th percentile) reflects low exploitation probability consistent with the architecture-specific trigger condition.
Use-after-free in the Linux kernel's BPF sockmap subsystem allows a local low-privileged attacker to corrupt kernel slab memory via a race condition in tcp_bpf_sendmsg(), potentially escalating privileges to root. The vulnerability arises because the error path in tcp_bpf_sendmsg() uses a stale msg_tx pointer to decide whether to free a shared cork object - a decision that becomes unsafe once a second thread has already freed it during the window when the socket lock is released by sk_stream_wait_memory(). No public exploit has been identified at time of analysis and EPSS is 0.18%, though KASAN telemetry in the disclosure confirms the bug was reproduced by the reporter.
Use-after-free in the Linux kernel tracing subsystem exposes kernel memory to corruption when event trigger data is freed asynchronously by a kthread while a concurrent tracepoint handler still holds a reference. Affected are Linux 6.19 and kernel versions containing commit 61d445af0a7c but lacking the fixes at b9c8a1400a3b or 79097812153b. A local attacker with sufficient privilege to configure kernel tracing triggers could exploit this race condition to achieve kernel memory corruption, potentially enabling privilege escalation. No public exploit has been identified at time of analysis, and EPSS of 0.16% (6th percentile) reflects minimal exploitation activity despite the high CVSS score.
Use-after-free in the Linux kernel's drm/xe Intel Xe GPU driver allows a local low-privileged user to trigger kernel memory corruption with potential for full system compromise (C:H/I:H/A:H). The bug arises because an imported dma-buf buffer object (BO) is created with its reservation object (resv) pointing to the exporter's dma_buf->resv before the importer acquires a reference on that dma-buf - leaving a window in which the exporter can be freed while the TTM workqueue asynchronously accesses the now-dangling pointer. Vendor-released patches are available for Linux 6.12.103, 6.18.42, and 7.1.6; no public exploit has been identified at time of analysis.
Use-after-free via refcount underflow in the Linux kernel's DRM Imagination (PowerVR) GPU driver allows a local low-privileged user to corrupt kernel memory during GPU context teardown. The drm_sched_entity_fini() function is called twice on the same scheduling entity - once via pvr_context_kill_queues and again via pvr_context_destroy_queues - triggering a refcount_t underflow exposed by commit fd177135f0e6 which added GPU entity time accounting. No public exploit identified at time of analysis, and EPSS at 0.17% (6th percentile) reflects low exploitation probability; exploitation requires hardware with an Imagination/PowerVR GPU.
Incorrect pointer arithmetic in the Linux kernel's drm/imagination (PowerVR GPU) driver exposes kernel memory to local users and can trigger availability failures. The `pvr_set_uobj_array()` function swaps the stride increments for the kernel and userspace pointers when copying object arrays, so with a larger userspace stride the kernel reads and forwards data from wrong kernel addresses (confidentiality breach), and with a smaller stride it writes copies at wrong userspace offsets (potential crash or memory corruption). Exploitation requires local, low-privileged access to a system running an affected kernel with an Imagination Technologies PowerVR GPU; no public exploit has been identified at time of analysis and EPSS is low at 0.18%.
Bounds validation is absent in the AMD KFD CRIU restore path of the Linux kernel, exposing local low-privilege users on AMD GPU systems to kernel memory disclosure and availability loss. The drm/amdkfd subsystem accepts user-controlled queue type and mqd_size values during CRIU restore without range checking, allowing crafted inputs to drive out-of-bounds kernel memory access. No public exploit has been identified, and vendor-released patches are confirmed in Linux 6.18.42 and 7.1.6.
Out-of-bounds read in the Linux kernel drm/virtio driver allows a malicious virtio-gpu backend to leak adjacent guest kernel memory by returning a crafted EDID response with an inflated size and extension block count. Guests running Linux 5.0 through multiple unpatched stable branches are affected wherever virtio-gpu is in use, covering the majority of QEMU/KVM-based cloud VM deployments. No public exploit code is identified at time of analysis, and EPSS at 0.21% (11th percentile) reflects the high-privilege prerequisite of backend control, though the risk is material in adversarial multi-tenant cloud environments.
Use-after-unlock memory corruption in the Linux kernel's DRM/AMDGPU driver allows local low-privileged users on systems with AMD GPUs to read or corrupt kernel memory via the `amdgpu_vm_get_task_info_pasid()` function. The defect stems from a lock lifetime design flaw: a `vm` pointer obtained under XArray lock is dereferenced after `xa_unlock_irqrestore` releases that lock, leaving the pointer unprotected against concurrent modification. No public exploit code has been identified and EPSS is very low (0.20%, 10th percentile), but the CVSS-rated impact is High across Confidentiality, Integrity, and Availability, and vendor patches are available across multiple stable branches.
GPU Shared Virtual Memory (SVM) page mapping in the Linux kernel's drm/gpusvm subsystem leaks device mappings when a partial page-acquisition operation fails mid-sequence, leaving IOMMU-level mappings orphaned and unrecoverable through the normal cleanup path. Local users with GPU access on affected kernels - ranging from the introduction of drm/gpusvm through Linux 6.18 and 7.1 stable series - can trigger the condition by causing a later page in a batch to fail with -EOPNOTSUPP when ctx->allow_mixed is false, bypassing device_unmap() in __drm_gpusvm_unmap_pages(). No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, though NVD assigns a CVSS of 8.8 due to potential changed-scope impact on GPU/IOMMU mappings.
Double-free and use-after-free conditions in the Linux kernel's drm/amd/display subsystem expose systems with AMD GPU hardware to potential privilege escalation or kernel crash. The flaw resides in dm_update_crtc_state(), where the skip_modeset path releases a display stream reference without nullifying the pointer, leaving it dangling for a second release if a subsequent error - such as a color management failure - triggers the fail label. Patches are confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4); no public exploit exists and EPSS sits at 0.17% (6th percentile), but the kernel-level memory corruption class demands prioritized patching on AMD GPU deployments.
Race condition in the chips-media Wave5 video encoder driver of the Linux kernel corrupts the V4L2 M2M ready queue linked list, enabling local privilege escalation. The IRQ handler returns a source buffer to userspace via v4l2_m2m_buf_done before removing it from the ready queue; if userspace re-queues that buffer before start_encode cleans up the index, __list_add creates a self-referential loop that __list_del cannot resolve, poisoning kernel list pointers. A low-privileged local user on a system with Wave5 hardware can trigger kernel memory corruption, leading to a crash or potential escalation to root. No public exploit has been identified at time of analysis, and EPSS at 0.20% reflects very low near-term weaponization probability.
Buffer management failures in the Linux kernel msi2500 USB SDR driver allow a local low-privileged user to cause kernel memory corruption through improperly handled start_streaming() error paths. Five distinct failure paths in msi2500_start_streaming() - including USB disconnection, mutex interruption, USB ADC setup failure, isoc initialization failure, and CMD_START_STREAMING failure - neglect to return queued vb2 buffers to the framework before returning errors, and the worst path leaves submitted isochronous URBs with no consumer. Patched stable releases are available (6.6.148, 6.12.101, 6.18.42, 7.1.6), no public exploit exists, and EPSS is 0.18% (7th percentile), indicating low current exploitation probability.
Buffer leakage in the Linux kernel's pwc (Philips WebCam) driver allows a local low-privileged user to corrupt kernel memory state when start_streaming() fails along two specific error paths: USB device disconnection (-ENODEV) and signal-interrupted mutex acquisition (-ERESTARTSYS). The vb2 videobuf2 framework transfers buffer ownership to the driver before invoking start_streaming(), but the pwc driver's error paths failed to return those buffers via vb2_buffer_done(), triggering WARN_ON(owned_by_drv_count) and leaving kernel buffers in an unreturned, leaked state. No public exploit or CISA KEV entry exists; EPSS is 0.21% (11th percentile), reflecting minimal active exploitation interest, though the CVSS C:H/I:H/A:H scoring reflects the potential severity of kernel-level memory corruption.
Buffer leak in the Linux kernel's rtl2832_sdr media driver allows a local low-privileged user with access to an RTL2832-based SDR device to trigger kernel memory corruption by causing start_streaming() to fail, leaving vb2 framework buffers unreturned and firing WARN_ON(owned_by_drv_count). Affected are Linux kernels from 3.15 through multiple stable branches prior to 6.6.148, 6.12.101, 6.18.42, and 7.1.6. No public exploit has been identified at time of analysis and EPSS is 0.21% (11th percentile), but the kernel-level memory corruption potential under C:H/I:H/A:H CVSS rating indicates a realistic local privilege escalation risk for systems with SDR hardware attached.
Improper error-path cleanup in the Linux kernel STM32 DCMI driver leaves a V4L2 async notifier registered against kernel structures that may be freed or reused after a failed probe, creating a use-after-free condition. Systems running a vulnerable kernel with STM32 DCMI hardware where reset_control_assert() or reset_control_deassert() returns an error during driver initialization are susceptible to kernel memory corruption or crashes. No public exploit has been identified and EPSS sits at the 11th percentile, but CVSS rates the impact as High across confidentiality, integrity, and availability when the specific failure condition is met.
Buffer leak in the Linux kernel's sun4i-csi camera driver (Allwinner SoC Camera Sensor Interface) allows a local attacker with low-privilege access to the V4L2 camera interface to exhaust kernel memory by repeatedly triggering start_streaming() failure with an unsupported CSI format. The vb2 framework hands buffers to the driver before calling start_streaming(); when that call returns -EINVAL on the early format-validation path, those buffers are never returned via vb2_buffer_done(), leaking kernel memory and triggering WARN_ON(owned_by_drv_count). No public exploit exists and EPSS stands at 0.21% (11th percentile), indicating negligible real-world exploitation interest; the NVD-assigned C:H/I:H/A:H impact appears overstated relative to the actual error-path memory leak primitive.
Unvalidated HEVC active reference counts in the Linux kernel's V4L2 common control path allow a local low-privileged user to trigger out-of-bounds kernel memory access on systems equipped with stateless HEVC hardware decoders. Affected kernels from the introduction of stateless HEVC support (approximately 5.14) through to the patch commits fail to check that num_active_dpb_entries values fall within valid bounds before driver-specific code (Cedrus, Hantro, etc.) consumes them. No active exploitation is confirmed - EPSS stands at 0.21% (11th percentile) and the vulnerability is not listed in CISA KEV - but patched stable releases are available across all maintained kernel branches.
Memory corruption in the Linux kernel's vivid virtual video driver arises from missing vb2_is_busy() guards when toggling CROP, COMPOSE, and SCALE capability controls, exploitable by local low-privileged users in the window between VIDIOC_REQBUFS and VIDIOC_STREAMON ioctls. The affected vivid_update_format_cap/out() functions can overwrite video queue format parameters on an already-allocated buffer queue, yielding kernel-level corruption with high confidentiality, integrity, and availability impact as reflected in the CVSS 7.8 score. No public exploit identified at time of analysis; EPSS is 0.21% (11th percentile), though the issue was surfaced by the syzbot automated kernel fuzzer and confirmed by upstream maintainers.
Use-after-free in the Linux kernel ALSA MIDI sequencer subsystem enables local privilege escalation by any unprivileged user with access to /dev/snd/seq, requiring no capabilities or queue ownership. The flaw stems from a race window during queue deletion where a concurrent thread can re-open a queue timer after it has been closed but before the queue is freed, leaving a stale callback pointer that the global timer subsequently dereferences on the next tick. No public exploit has been identified and EPSS is 0.21% (11th percentile), but the attack surface is broad given how widely ALSA seq is deployed across Linux desktop and development systems.
Use-after-free in the Linux kernel ALSA timer subsystem allows a local low-privileged attacker to corrupt kernel memory by exploiting a race condition during master-slave timer instance teardown. When a master timer closes, slave callback draining is skipped, causing the slave struct to be freed while its callback executes in parallel - a classic UAF primitive with potential for local privilege escalation. EPSS is low at 0.21% (11th percentile), no KEV listing exists, and no public exploit code has been identified at time of analysis, but patched stable kernel releases are available.
Use-after-free in the Linux kernel ALSA timer subsystem allows a local unprivileged user to corrupt kernel memory and potentially escalate privileges. The flaw resides in the userspace-driven timer (utimer) path: the in-flight callback state is tracked by a single bit that cannot represent two concurrent callbacks, so racing two TRIGGER ioctls against the same utimer frees the instance while a second callback is still executing against that memory. The vulnerability is reachable by any user who can open /dev/snd/timer, including via sequencer queue timers bound to a utimer; no public exploit code has been identified and EPSS probability is low at 0.21%.
Use-after-free in the Linux kernel's ath6kl WiFi driver exposes systems with Atheros WiFi hardware to potential kernel memory corruption via a timer-callback race condition. The vulnerable `aggr_reset_state()` function calls non-synchronous `timer_delete()`, leaving a window in which the `aggr_timeout` callback continues accessing `aggr_conn->rx_tid[]` and `aggr_conn->stat[]` after those structures are freed by `aggr_module_destroy()`. Vendor-released patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.42, 7.1.6, 7.2-rc5), no public exploit has been identified, and EPSS stands at 0.18%, reflecting low observed exploitation activity.
Double-free memory corruption in the Linux kernel's brcmfmac Broadcom WiFi PCIe driver exposes systems running kernel 5.2 and later to potential kernel heap corruption when a bus_reset event is sequentially followed by device removal. The flaw in brcmf_pcie_release_scratchbuffers() allows dma_free_coherent() to be called twice on the same DMA allocation because freed pointer fields are not NULLed - unlike the sibling release_ringbuffers() function which correctly NULLs its pointers. No public exploit code exists and EPSS exploitation probability is very low (0.21%, 11th percentile), though the high CVSS score (8.8) reflects the theoretical severity of kernel-level memory corruption if the double-free is successfully weaponized.
Use-after-free in the Linux kernel Bluetooth HCI sync subsystem allows a local low-privileged attacker to corrupt kernel memory, with potential for privilege escalation and full system compromise. The flaw is a race condition between the hci_sync async command work (holding hdev->req_lock) and Bluetooth management socket operations (add_uuid/remove_uuid, which operate under hdev->lock), enabling concurrent unsafe UUID list access confirmed by KASAN. No public exploit code exists and EPSS is 0.20% (10th percentile), but the high C/I/A CVSS impact reflects the severity of kernel-level memory corruption if the race is won.
Mutex unlock imbalance in the Linux kernel's Nitro Security Module (NSM) ioctl handler allows a local process to corrupt kernel locking state by supplying an invalid user pointer to NSM_IOCTL_RAW. The `nsm_dev_ioctl()` function's pre-lock `copy_from_user()` failure path incorrectly reaches the shared `out` label, which unconditionally calls `mutex_unlock()` on a mutex that was never acquired - triggering a bad-unlock-balance condition confirmed by Lockdep. Systems running AWS Nitro Enclaves on affected kernel versions are exposed; no public weaponized exploit exists but a functional PoC triggering the Lockdep warning is documented in the upstream commit itself, and EPSS sits at 0.20% (10th percentile), indicating no widespread exploitation observed to date.
Use-after-unload code execution in the Linux kernel's NSM (Nitro Security Module) misc device allows a local attacker with low privileges to call into freed kernel module text, potentially achieving full kernel compromise. The NSM driver fails to set nsm_dev_fops.owner to THIS_MODULE, meaning misc_open() never increments the module reference count when /dev/nsm is opened. When the nsm module is subsequently unloaded while a file descriptor remains open, a later ioctl through that descriptor jumps into unmapped or reallocated memory. No public exploit code or CISA KEV listing exists, and EPSS sits at 0.20% (10th percentile), reflecting limited real-world exploitation risk at this time.
Use-after-free in the Linux kernel tracing subsystem's enable_event trigger mechanism allows a local attacker to dereference freed module memory by racing module unloading against an active tracepoint trigger. Affected kernel versions span from commit 61d445af0a7c70018111919e47beaaee15653f2f up to the fix commits on stable branches; patched releases 7.1.6 and 7.2-rc5 are available. No public exploit is identified and EPSS is 0.19% (9th percentile), but the CVSS-rated impact is full compromise of confidentiality, integrity, and availability at the kernel level.
Kernel panic and unauthorized physical memory access are possible on arm64 Linux systems when huge_ptep_get() receives an unaligned virtual address during contiguous huge page table walks. On arm64 platforms configured with 16K page size - where CONT_PTES differs from CONT_PMDS - the kernel's find_num_contig() routine misidentifies a contpmd block as a contpte block, iterates past the valid PTE table boundary, and dereferences a garbage linear-map pointer, either crashing the kernel or touching physical memory not owned by the calling process. No active exploitation (KEV) or public proof-of-concept has been identified; EPSS is 0.20% at the 10th percentile, reflecting very low real-world exploitation probability.
Use-after-free in the Linux kernel's MPTCP (Multipath TCP) subflow teardown path allows a stale skb->sk pointer to survive after a subflow socket is freed, leading to a kernel warning in inet_sock_destruct() and a use-after-free in mptcp_backlog_purge(). The flaw affects Linux 6.19 and is fixed in 7.1.6 and 7.2-rc5; it is a race condition between subflow close and concurrent softirq RX backlog processing. There is no public exploit identified at time of analysis, and EPSS estimates exploitation probability at just 0.19% (9th percentile).
Memory corruption in the Linux kernel's mm/page_vma_mapped subsystem allows a local low-privileged attacker to trigger kernel memory corruption, potentially leading to privilege escalation or system crash. The flaw stems from incomplete handling of device-private PMD entries in the rmap walk code: when PVMW_MIGRATION is set, the caller incorrectly interprets a device-private PMD entry as a migration entry, producing undefined behavior. No public exploit has been identified at time of analysis, and EPSS at 0.20% (10th percentile) indicates low current exploitation interest, but the high CVSS 7.8 with full C/I/A impact reflects the severity of kernel memory corruption.
Use-after-free in the Linux kernel SCTP subsystem exposes a race condition during network namespace teardown, enabling a local low-privileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw stems from a lifecycle misalignment between per-net SCTP sysctl registration and the SCTP control socket: an open sysctl file descriptor targeting a network namespace can survive into teardown, causing proc_sctp_do_auth() to dereference an already-freed control socket. No public exploit has been identified at time of analysis; EPSS is 0.21% (11th percentile), consistent with the timing complexity required for successful exploitation.
Improper resource teardown in the Linux kernel's SCTP subsystem leaves per-net UDP tunnel sockets installed when a network namespace is destroyed, creating a use-after-free/dangling-socket condition once the control socket is released. The flaw affects systems where SCTP UDP encapsulation (net.sctp.udp_port) has been enabled inside a namespace before that namespace exits. There is no public exploit identified at time of analysis, EPSS is low (0.20%), and the issue is not in CISA KEV; the fix has already been merged to multiple stable trees. Note: the supplied 9.8/AV:N CVSS is inconsistent with the local, namespace-scoped nature of the actual defect.