Information Disclosure
Monthly
Information disclosure in Microsoft Edge (Chromium-based) stems from an origin validation error, allowing a network-based attacker to read sensitive data. The vulnerability requires user interaction (e.g., visiting a malicious website) to trigger a cross-origin leak, potentially exposing data across different security contexts. A patch is available via Microsoft's update guide; no active exploitation or public exploit has been reported at this time.
Use-after-free in the Linux kernel's net/sched cls_api when handling TC_ACT_CONSUMED in tcf_qevent_handle can allow remote code execution. The flaw is triggered if a RED qdisc is configured with a qevent early_drop and a tc filter using connection tracking (act_ct) with defragmentation enabled while receiving out-of-order fragments. No active exploitation or public PoC exists; EPSS score 0.17% indicates low exploitation probability despite a CVSS 9.8 base score.
Userspace ACL isolation is defeated in Zephyr RTOS v2.0.0 through v4.4.0 on SMP builds due to a missing spinlock in thread_idx_alloc(), allowing two concurrently executing user-mode threads to receive the same permission-index (tidx) and subsequently alias each other's ACL bit across every kernel object. Any kernel object access grant intended exclusively for one thread is silently extended to the aliasing thread, nullifying the CONFIG_USERSPACE isolation model. No public exploit or active exploitation (CISA KEV) is known at time of analysis, and SSVC marks automatable: no, but the technical impact is assessed as total, warranting prioritized patching for affected SMP deployments.
Local privilege escalation in the Linux kernel's QAT driver allows a low-privileged local attacker to achieve full system compromise by exploiting a legacy character device interface with IOCTLs. The unused /dev/qat_adf_ctl device node increases attack surface and has been the subject of multiple bug reports. With an EPSS score of 0.24%, active exploitation is unlikely, and no public exploit code is known; the vulnerability is addressed by removing the entire character device and IOCTL infrastructure.
Out-of-bounds array read and missing initialization flaw in the Linux kernel's drm/hyperv virtual display driver affect Linux VMs running under Microsoft Hyper-V. A SYNTHVID_RESOLUTION_RESPONSE message carrying resolution_count exceeding 64 causes the guest kernel driver to walk past the end of the 64-entry supported_resolution[] array, potentially disclosing adjacent guest kernel heap memory to the Hyper-V host. A separate missing-initialization defect in the WIN10-to-WIN8 protocol fallback path leaves screen dimension fields at zero, causing drm_internal_framebuffer_create() to reject every userspace framebuffer with -EINVAL and effectively disabling virtual display. No public exploit exists and EPSS is 0.21%; exploitation of the OOB read requires host-level control over Hyper-V VMBus messaging.
State-counter underflow in the Linux kernel's mlx5e (NVIDIA/Mellanox ConnectX) IPsec offload driver lets the eswitch mode-block reference counter (esw->offloads.num_block_mode) be decremented without a matching increment when a temporary acquire-flow security association is installed. The affected code is the mlx5e_xfrm_add_state() acquire-SA path, which skips hardware offload but still falls through to the common success label that unconditionally calls mlx5_eswitch_unblock_mode(). Fixed upstream in the stable kernel series; no public exploit identified at time of analysis and EPSS probability is low (0.21%).
Local privilege escalation in the Linux kernel's ARM FFA firmware interface allows an unprivileged local attacker to achieve arbitrary code execution by triggering an out-of-bounds write when processing PARTITION_INFO_GET descriptors. The kernel fails to validate firmware-supplied indices, enabling a heap buffer overflow that can corrupt memory. Patches are available, no public exploit exists, and EPSS indicates low exploitation probability (0.21%).
Heap-based information disclosure and denial of service in the Linux kernel's mac80211 WiFi subsystem can be triggered by adjacent network attackers. The vulnerability arises from incorrect pointer usage during MLE defragmentation, potentially leading to kernel heap memory over-read and exposure of sensitive data, as well as system crashes. Affected kernels from version 6.9 are vulnerable until patched; no public exploit is known and EPSS indicates a low exploitation probability (0.21%).
Use-after-free vulnerability in the Linux kernel's ACPI NFIT driver allows a local attacker with low privileges to trigger a Machine Check Exception, leading to a dangling pointer dereference that can cause memory corruption, privilege escalation, or denial of service. Affected are kernel versions from commit a61fe6f7902ec (4.6-rc1) up
Improper handling of SPI chip select and bus locking in the Linux kernel's ad_sigma_delta IIO ADC driver allows a local attacker with low privileges to leave the SPI bus in an inconsistent state. This can cause denial of service through bus contention and potential data corruption. Affected kernels include versions before specific stable patches (e.g., 6.14, 7.2-rc1), with no known active exploitation but a low EPSS score indicating minor real-world risk.
The user asks for a comprehensive JSON analysis of CVE-2026-64485. I need to synthesize data from the provided sources. Let's examine the input carefully. CVE ID: CVE-2026-64485 Description: In the Linux kernel, ALSA: compress: Fix task creation error unwind. It details a resource leak when snd_compr_task_new() allocates driver task, and if subsequent steps fail, task_free() callback is not called, leaking driver resources. Also, an error in file descriptor allocation may not be reported correctly, leading to incorrect success reporting. CVSS: 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE: N/A EPSS: 0.21% (11th percentile) Patch: Available from vendor Reported by: Linux CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* Tags: Information Disclosure, Linux ENISA EUVD ID: EUVD-2026-48829 Affected versions (EUVD): a list of commit hashes and kernel versions. The patch refs are three git.kernel.org links. Now, I need to generate all fields as plain text strings. I'll go through each field requirement. product_name: "Linux kernel" (or "Linux Kernel"? The requirement: 1-3 words ONLY. The CVE is in the Linux kernel, specifically the ALSA compress subsystem. So "Linux Kernel" is appropriate. summary: Must be an original synthesis, 2-3 sentences. Not copying description. Start with specific impact verb and product. So: "Local privilege escalation in the Linux kernel's ALSA compress driver subsystem allows a local authenticated attacker to trigger a resource leak and potentially escalate privileges due to improper cleanup when creating an audio compress task. The vulnerability affects Linux kernels with the snd-compress module (versions as specified), and can lead to memory leaks and denial of service or arbitrary code execution. Although no public exploit is identified at time of analysis, the issue is addressed in upstream patches." I'll incorporate that the vulnerability leads to resource leak and eventually could lead to other issues. But the description doesn't explicitly men
Local privilege escalation in the Linux kernel’s cs35l41_hda audio driver allows a low-privileged user to corrupt kernel memory and execute arbitrary code. The flaw arises when firmware autostart is disabled and a firmware load work item is queued, then
Local privilege escalation to root via a use-after-free race condition in the Linux kernel's binder driver allows a low-privileged attacker to exploit a flaw in binder_thread_release() when a thread exit races with a parallel process death. The vulnerability affects Linux kernel versions since commit 7a4408c6bd3e and can lead to full system compromise. EPSS exploitation probability is low (0.22%), and no public exploit or active exploitation is known at time of analysis.
Local privilege escalation in the Linux kernel's binder driver allows a low-privileged attacker to execute arbitrary code with kernel rights. The vulnerability arises from a race condition in binder_free_transaction() where a freed target process can still be accessed, leading to a use-after-free. No active exploitation or public exploit code is currently known, and vendor patches are available across multiple stable kernel branches.
Elevation of privilege in the Linux kernel's tcpci_rt1711h USB Type-C port controller driver allows a local attacker with low privileges to potentially achieve full system compromise. The driver fails to unregister the TCPCI port when an interrupt request or alert enable step fails during device probe, leaving a stale resource that can be exploited for code execution. No active exploitation or public exploit code is known; EPSS probability is low (0.21%).
Memory-safety out-of-bounds read in the virtio-rng driver of the Linux kernel allows a malicious or buggy hypervisor to leak adjacent slab memory into the guest’s hardware random number stream, potentially exposing kernel heap data. The flaw triggers automatically at device probe without guest user interaction, and while no active exploitation has been observed, the fix is a hardening priority for confidential computing environments. The EPSS score (0.22%) suggests low near-term exploitation likelihood.
Use-after-free in the Linux kernel's 6LoWPAN NHC handler may allow network-adjacent attackers to execute arbitrary code or trigger denial of service by sending a malformed packet. Affects kernels with 6LoWPAN support from commit 92aa7c65d295 up to the patched versions. No active exploitation or public exploit code is known; EPSS probability is low at 0.22%.
Out-of-bounds slab read in the Linux kernel TIPC (Transparent Inter-Process Communication) protocol lets a malicious TIPC neighbour trigger a heap over-read by sending a single crafted broadcast PROTOCOL/STATE_MSG carrying a Gap ACK blocks record. Affecting kernels 5.8 through the fixed stable releases, the broadcast path (tipc_bcast_sync_rcv → tipc_link_advance_transmq) fails to bound the Gap ACK record against the actual message data size, so kmemdup() copies up to 1024 bytes past a ~704-byte skb, corrupting/leaking adjacent slab memory and crashing the host (KASAN slab-out-of-bounds). No public exploit is identified at time of analysis and EPSS is low (0.22%), consistent with a niche, non-default kernel subsystem.
Out-of-bounds read in the Linux kernel's CIFS client during SMB2 message validation allows an unauthenticated remote attacker acting as a malicious server to leak kernel memory and crash the client before session authentication. The vulnerability, which affects the smb2_check_message() function, can be triggered during NEGOTIATE or SESSION_SETUP exchanges. No active exploitation has been reported, and the EPSS probability is low (0.22%).
Out-of-bounds read and integer underflow in the Linux kernel staging driver rtl8723bs (Realtek RTL8723BS SDIO Wi-Fi chipset) allows an adjacent network attacker to trigger kernel memory disclosure or crash via crafted 802.11 WEP authentication frames. Two distinct bugs in OnAuth() can be triggered without authentication: a length underflow that causes crc32_le() to read far beyond the frame buffer when the Privacy bit is set on a short frame, and a fixed 128-byte memcmp in the seq=3 path that ignores the actual IE length field. No public exploit code exists and EPSS is 0.26%, reflecting the combination of adjacent-network requirement, deprecated WEP protocol dependency, and niche SDIO chipset driver.
Out-of-bounds read in the Linux kernel's rtl8723bs staging driver allows adjacent network attackers to read sensitive kernel memory and cause denial of service via a malicious association response. Exploitation requires a rogue access point sending crafted IE data. Patches are available, and no active exploitation or public exploit has been reported.
Out-of-bounds read in the Linux kernel's staging rtl8723bs Wi-Fi driver can be triggered by a malicious Access Point sending a crafted Beacon frame, allowing an adjacent attacker to read sensitive kernel memory and potentially crash the system. Affected kernels from version 4.12 onwards that include the rtl8723bs driver; vendor patches are available.
Out-of-bounds reads in the Linux kernel's rtl8723bs staging WiFi driver allow an attacker-controlled access point to leak kernel memory or crash affected systems by sending beacon or probe-response frames with a truncated final information element. Two IE-parsing loops in issue_assocreq() and join_cmd_hdl() dereference pIE->length without first verifying that at least sizeof(*pIE) bytes remain in the buffer, so a one-byte stub IE at the end of AP-supplied data reads one byte past the buffer end. No public exploit has been identified at time of analysis, and EPSS sits at 0.22%, consistent with the adjacent-network attack vector and niche driver footprint.
Out-of-bounds reads in the Linux kernel's rtl8723bs staging WiFi driver allow an adjacent unauthenticated attacker to leak kernel memory or crash the system by sending crafted 802.11 management frames containing malformed WPA, WAPI, or WPS Information Elements. Three IE parsing functions - rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - lack bounds validation before reading multi-byte header fields and OUI comparisons, exposing raw kernel buffer contents to an adversary within WiFi range. No public exploit or active exploitation has been identified; vendor-released patches are available across all supported stable branches.
Use-after-free in the Linux kernel's ksmbd (SMB server) allows authenticated remote attackers to trigger memory corruption, potentially leading to arbitrary code execution or denial of service. The flaw occurs when an SMB2_CLOSE on a locked file is followed by an SMB2_CANCEL, causing a freed file_lock to be re-accessed. A patch is available for affected kernel versions, and while no active exploitation is confirmed, a proof-of-concept exists; EPSS indicates low exploitation likelihood.
Uninitialized memory read in the Linux kernel's PF_KEY IPComp implementation allows local unprivileged users to disclose kernel memory or cause a denial of service. The vulnerability arises from a missing initialization of the alg_key_len field in the xfrm_algo structure when adding IPComp security associations, leading to an out-of-bounds slab read during XFRM state migration. Affected are all Linux kernels since version 2.6.21, with patches backported to multiple stable series.
A data race condition in the Linux kernel's audit subsystem allows local attackers to cause denial of service and minimal integrity impact by exploiting unsynchronized reads of the audit queue length. The flaw affects kernel versions from 4.10 through the unpatched stable series, triggered when concurrent readers and writers access the queue without proper locking,
Use-after-free in the Linux kernel's Bluetooth L2CAP subsystem can be triggered by an adjacent attacker, potentially leading to arbitrary code execution or kernel memory corruption. The flaw occurs when a channel timeout callback races with connection teardown, allowing a freed connection object to be accessed. Patched kernels are available; no active exploitation is confirmed, but the vulnerability is remotely exploitable within Bluetooth range without authentication or user interaction.
A denial-of-service flaw in the Linux kernel's NTB EPF driver can cause a kernel panic or system crash when the interrupt handler calls pci_irq_vector() in hardirq context. An attacker with local access to a system using this specialized hardware driver could trigger the issue. At the time of analysis, no public exploit or active exploitation has been reported, and EPSS indicates low exploitation probability (0.21%).
Use-after-free memory corruption in the Linux kernel's NXP i.MX8 ISI (Image Sensing Interface) media driver is triggered during module removal (rmmod of imx8_isi), confirmed by KASAN slab-use-after-free reports. The root cause is an incorrect teardown order in mxc_isi_remove(): the crossbar cleanup frees media entity pads before the V4L2 cleanup has finished removing media links that reference those same pads, resulting in a dangling pointer dereference in __media_entity_remove_link(). No public exploit has been identified at time of analysis, and with EPSS at 0.21% (11th percentile), real-world weaponization appears unlikely despite the CVSS 7.8 score.
A race condition in the Linux kernel's shrinker subsystem can cause use-after-free or double-free memory errors during memory cgroup creation and teardown. Local attackers with low privileges may exploit this to escalate privileges to kernel level, leading to full system compromise (confidentiality, integrity, and availability impact). Patches are available in multiple stable kernel branches; no active exploitation is reported (CISA KEV not listed), and the EPSS exploitation probability is low (0.21%).
Remote denial-of-service in Linux kernel netfilter allows unauthenticated attackers to crash the system by sending crafted network packets containing unreadable socket buffer fragments (e.g., from devmem TCP). Affected components include xt_u32, nfnetlink_queue, and nfnetlink_log, which mishandle the error return from sk
Memory corruption in the Linux kernel's netfilter ebtables module can occur from an uninitialized pointer free during chainstack array cleanup. The flaw is triggered only under rare, non-default conditions—a sparse CPU possible mask and a failed memory allocation—making real-world exploitation extremely unlikely. No active exploitation or public exploit is known.
Information disclosure and denial of service in the Linux kernel's netfilter ebtables subsystem allows a local attacker with low privileges to leak kernel memory or cause a system crash. The vulnerability arises from a missing null-termination check on module names before passing them to request_module(), potentially exposing uninitialized kernel memory. No public exploit or active exploitation has been identified, and the EPSS score indicates a low probability of widespread exploitation.
Stack buffer over-read in the Linux kernel's netfilter ebtables module allows a local attacker with low privileges to read kernel stack data and potentially crash the system. When updating ebtables counters, a 32-byte user-supplied table name is passed without NUL-termination to a kernel function that uses it in a module autoload request, causing vsnprintf to read beyond the stack buffer. No active exploitation or public exploit code is known, and EPSS indicates a low exploitation probability (0.22%).
Insufficient validation in the Linux kernel's netfilter flowtable hardware offload for IPIP tunnels could allow a remote attacker to cause information disclosure or denial of service. The flaw exists because the kernel would attempt to enqueue hardware offload work for IPIP tunnels despite no driver supporting it, leading to an unspecified impact when the unsupported configuration is processed. The issue is fixed by adding an early check to skip unsupported offload setup. No public exploit code is
Out-of-bounds memory read in the Linux kernel's btnxpuart Bluetooth driver exposes kernel memory to a malicious or compromised NXP Bluetooth UART controller. The vulnerability exists in nxp_recv_fw_req_v3(), which handles firmware download requests during v3 controller initialization: when the controller supplies a crafted 32-bit offset or 16-bit length value that pushes past the end of the firmware image, the driver reads arbitrary kernel memory and transmits it back to the controller over UART. The parallel v1 path (nxp_recv_fw_req_v1()) already contained the equivalent bounds check; the v3 path lacked it. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.21% (11th percentile), consistent with the narrow local/hardware attack surface.
Local privilege escalation in the Linux kernel's SMB client witness notification handler allows a low-privileged attacker to exploit a use-after-free condition. Affected are Linux kernel versions 5.11 and later that have the CIFS witness feature enabled. Successful exploitation can lead to arbitrary code execution with elevated privileges, fully compromising the system.
Use-after-free vulnerability in the Linux kernel's ksmbd SMB server allows remote attackers to execute arbitrary code. All kernel versions with ksmbd enabled from early commits up to the patched releases are affected, and the issue can be triggered by concurrent QUERY_DIRECTORY requests on the same file handle. A fix is available via multiple stable kernel branches, no active exploitation is reported in KEV, and EPSS indicates a low probability of widespread exploitation (0.21%).
Use-after-free in Linux kernel’s ksmbd SMB server occurs during deferred byte-range lock cancellation, allowing an authenticated attacker to potentially execute arbitrary code or crash the system. The vulnerability affects ksmbd versions prior to the released fixes (6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, 7.2-rc1). No active exploitation has been confirmed (no CISA KEV listing), and EPSS indicates a low probability of widespread exploitation.
Unauthorized information disclosure in Linux kernel's ksmbd module allows remote unauthenticated attackers to copy arbitrary file contents on SMB shares by exploiting a missing access check on the FSCTL_DUPLICATE_EXTENTS_TO_FILE operation. Attackers with only attribute access to a source file can read its contents without requiring the FILE_READ_DATA permission. No public exploit or active exploitation has been identified, though the vulnerability is patchable via kernel updates.
Unauthorized file modification in the Linux kernel's ksmbd SMB server allows remote attackers to modify file data and attributes by exploiting a credential confusion in SMB2 SET_INFO handlers. The vulnerability arises because the VFS operations used after permission checks run with the ksmbd worker credentials rather than the opener's credentials, effectively bypassing ownership and permission restrictions. No public exploit is known and EPSS is low (0.21%), but the network-accessible, low-complexity nature makes critical
Unauthorized read/write of Alternate Data Streams in Linux ksmbd allows remote attackers to access or modify file extended attributes. The vulnerability, present in Linux kernel versions with ksmbd up to before patches 6.18.39, 6.12.96, 7.1.4
Memory corruption in the Linux kernel's ksmbd SMB server allows authenticated remote code execution. A race condition in byte-range lock ownership tracking can lead to use-after-free when SMB3 multichannel is enabled, enabling an attacker with low privileges to escalate to full system compromise. No public exploit or active exploitation is known, and EPSS indicates low exploitation probability.
Double-free memory corruption in the Linux kernel SMB client when processing SMB2 QUERY_DIRECTORY responses. A remote attacker acting as a malicious SMB server can trigger the issue during directory enumeration, potentially leading to arbitrary code execution or denial of service on any unpatched Linux system that mounts an attacker-controlled share. The vulnerability is not known to be actively exploited, but patches are available across multiple stable kernel branches.
Double free in the Linux kernel's SMB client due to improper cleanup of response buffers when a reply error is replayed. An attacker controlling an SMB server can trigger memory corruption, potentially leading to code execution or a system crash, when a vulnerable client connects and processes a crafted response. Patches are available in multiple stable kernel branches, but no active exploitation or public exploit has been reported.
Double-free vulnerability in the Linux kernel's SMB client (cifs) allows remote code execution via crafted SMB2_ioctl replies. An attacker hosting a malicious SMB server can trigger a replay path memory double-free, leading to full system compromise. No active exploitation or public exploit has been identified at this time; EPSS score is low (0.21%).
Double-free memory corruption in the Linux kernel's SMB client (cifs) affects the SMB2_flush() replay path across many stable branches prior to 6.6.145, 6.12.96, 6.18.39 and 7.1.4. When a mounted client receives a replayable flush response and the subsequent retry fails before cifs_send_recv() installs a replacement response, flush_exit frees the stale response buffer a second time, corrupting kernel slab memory and typically crashing the client. No public exploit is identified at time of analysis (EPSS 0.21%, 11th percentile) and it is not in CISA KEV; exploitation requires a malicious or man-in-the-middle SMB server plus a replay/retry timing race, making it primarily a denial-of-service concern despite the 9.8 rating.
Double-free in the Linux kernel SMB client's SMB2_open() replay handler allows remote attackers to corrupt memory by inducing a user to mount a malicious SMB share. The flaw affects unpatched kernel versions with the cifs module loaded and can lead to arbitrary code execution, information disclosure, or denial of service. No active exploitation has been reported (not in CISA KEV), and EPSS score is 0.21%, indicating low exploitation probability; official kernel patches are available.
Out-of-bounds read in the Linux kernel's SMB/CIFS client POSIX SID parser allows a malicious or MITM SMB server to cause kernel memory disclosure and denial of service on connecting clients. The `posix_info_sid_size()` helper reads `sid[1]` (the SubAuthorityCount byte) after validating only one remaining byte, permitting a truncated server-supplied POSIX SID to trigger a one-byte OOB read - leaking a byte of kernel heap context (C:L) and risking a crash (A:H). No public exploit code exists and EPSS is 0.22%, but the vulnerability is client-facing and triggered entirely from the server side without client-side privilege. Patches are available across all maintained stable branches.
Improper mode masking in the Linux kernel SMB client when the modefromsid mount option is used allows a remote attacker to cause denial of service and limited integrity impact via a crafted SMB response. The vulnerability arises because parse_dacl() fails to mask server-provided mode bits to 07777, potentially setting unexpected permission bits on files. No public exploit is identified at time of analysis.
Privilege escalation in the Linux kernel /proc filesystem allows a local attacker to bypass ptrace access restrictions when reading symbolic links in /proc/[pid]/fd/. By racing the task lookup and access check, an unauthenticated local user can gain unauthorized read and write access to sensitive file descriptors of other processes, potentially leading to full system compromise. The vulnerability affects a wide range of kernel versions and has a patch released by the Linux kernel project.
Local privilege escalation in the Linux kernel's pcc-cpufreq driver allows a low-privileged user to gain full root privileges. The vulnerability is a use-after-free and double-free flaw when evaluating ACPI _OSC negotiation, affecting all kernel versions from 2.6.34 until the fixed stable releases (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1). No active exploitation or public exploit has been identified, and EPSS indicates a low probability of widespread exploitation.
Memory disclosure in the Linux kernel's SLUB allocator allows local attackers to read uninitialized kernel memory when specific slab debugging options are enabled. The issue occurs when red zoning is active without store_user tracking, causing krealloc() to violate the __GFP_ZERO contract and return partially zeroed allocations. This can leak sensitive data, with an EPSS probability of 0.21% and no known active exploitation, though a vendor patch is available.
Use-after-free in the Linux kernel HID appleir driver allows a local attacker to corrupt kernel memory during device removal, potentially achieving privilege escalation. The race condition exists between the key_up_timer callback (armed by appleir_raw_event() on each keydown/key-repeat) and hid_hw_stop(), which frees the underlying input_dev before the timer is drained. A second race window, where a USB URB completion during hid_hw_stop() can re-arm the timer via mod_timer(), means a simple teardown reorder is insufficient — the fix introduces a spinlock-gated 'removing' flag combined with timer_shutdown_sync() to permanently disable further callbacks. No public exploit has been identified at time of analysis, and EPSS is 0.22% (13th percentile).
An out-of-bounds memory access in the Linux kernel's BPF devmap broadcast redirect for XDP frames, introduced in version 5.14, can be triggered by remote unauthenticated attackers sending specially crafted fragmented network packets. This could lead to kernel memory corruption and arbitrary code execution. Though CVSS rates this as critical (9.8), no public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.21%).
Arbitrary code execution in the Linux kernel's BPF BTF parser allows local privilege escalation. Malformed BTF data can cause an integer overflow in the repeated field count calculation, bypassing a capacity check and leading to a heap buffer overflow. With low EPSS score (0.21%), widespread exploitation is currently unlikely, but unprivileged local users who can load BPF programs are at risk of complete system compromise.
Use-after-free and memory leak in the Linux kernel's EHCI and FOTG210 USB isochronous submit paths expose systems running kernel versions from 2.6.15 through 7.1.3 to local kernel memory corruption by a low-privileged user. When an isochronous URB submission fails before the staged schedule handoff - either because the host controller becomes inaccessible or usb_hcd_link_urb_to_ep() returns an error - the ehci_iso_sched allocation is not freed and urb->hcpriv retains a dangling pointer, creating a UAF condition. No public exploit exists and the EPSS score is 0.21% (12th percentile), but vendor-released patches across multiple stable branches are available and should be applied to eliminate the risk.
Use-after-free in the Linux kernel's USB ldusb driver allows a local unprivileged user to corrupt kernel memory by racing disconnect() against release() on a connected USB device. The root cause is that mutex_unlock() is documented as non-atomic and may access the mutex object after it logically releases the lock, creating a window where the driver data structure can be freed while still in use. No public exploit has been identified at time of analysis, and EPSS is low (0.22%), but the C:H/I:H/A:H CVSS impact vector reflects the potential for full kernel privilege escalation if successfully triggered.
Slab out-of-bounds read in the Linux kernel usbio USB driver (drivers/usb/misc/usbio) leaks adjacent kernel heap memory to local unprivileged processes via the i2c subsystem. The flaw lies in usbio_bulk_msg(), which validates the device-supplied payload length against the TX buffer size rather than the smaller RX buffer size, allowing a malicious USB device with mismatched endpoint wMaxPacketSize values to drive memcpy() past the end of the rxbuf slab object. Over-read kernel heap bytes propagate through the i2c layer to userspace via i2c-dev, and under KASAN-enabled kernels the bug is reported as a slab-out-of-bounds crash. No public exploit has been identified at time of analysis; the bug was found by code review and confirmed with a userspace AddressSanitizer model and a USB raw-gadget plus dummy_hcd kernel reproducer.
Use-after-free in the Linux kernel's USB Type-C UCSI CCG driver allows a local attacker with low privileges to corrupt kernel memory, potentially achieving arbitrary kernel code execution. The flaw exists in the module teardown path of the Cypress CCG UCSI driver: ucsi_ccg_remove() calls ucsi_destroy() - which kfree()s the ucsi object - before calling free_irq(), leaving a window in which the threaded IRQ handler ccg_irq_handler() can access the freed ucsi struct via ucsi_notify_common(). No public exploit code exists and the bug was discovered by static analysis; EPSS is 0.22% (13th percentile), reflecting no observed in-the-wild activity.
Heap-based out-of-bounds read in the Linux kernel's nvmet discovery log page handler allows unauthenticated remote attackers to leak kernel memory or crash the host. Any system acting as an NVMe over Fabrics target with a discovery service exposed via TCP, RDMA, or FC is vulnerable. No active exploitation or public exploit code is reported at this time, and EPSS probability is low (0.25%), but the impact and ease of exploitation make remediation urgent for affected storage targets.
Out-of-bounds heap read in the Linux kernel's nvmet-auth module allows pre-authentication remote attackers to read up to 526 bytes of heap memory beyond a crafted DHCHAP_REPLY message. By sending an NVMe-oF authentication reply with a small transfer length but inflated hash and DH value length fields, an unauthenticated attacker can extract sensitive data or cause a denial-of-service. Patches are available in upstream stable kernels.
We are tasked with synthesizing data from multiple sources about CVE-2026-64318 into a comprehensive analysis, returning a JSON object with specified fields. Let's carefully parse the provided information. CVE-2026-64318: In the Linux kernel, a vulnerability in the AIX partition handling. The description: "aix_partition() reads the physical volume descriptor... pp_count is unvalidated, so a crafted AIX image with pp_count > 1016 drives an out-of-bounds read... bound the scan to array size." From description: - Product: Linux kernel, specifically the partition handling for AIX disks (block/partitions/aix.c). So product_name: "Linux Kernel". - CVSS Score: 7.1, Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - CWE: N/A - EPSS: 0.22% (percentile 13%) - Patch: Available from vendor - Tags: Linux, IBM, Information Disclosure - KEV status: not mentioned (likely not KEV). POC? Not mentioned. So no active exploitation or public exploit identified from data. - CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (but note: Linux kernel is typically "o:linux:linux_kernel", but given as "a" application? The data says "cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*". We'll use it as is, but product_name Linux kernel is correct.) - Affected versions: We have a list of git commit ranges and patches. We can extract the fix versions: mention specific stable versions patched: 7.1.4, 6.18.39, 5.15.212, 5.10.261, 7.2-rc1, 6.6.145, 6.12.96, 6.1.178, and the initial commit from 3.11. So the vulnerability was introduced long ago (Linux 3.11) and fixed in multiple stable branches. The description mentions "Linux 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 < ..." which is the commit that fixed it? Possibly the fix commit. The EUVD entries give commit ranges where the vulnerability exists. We'll synthesize: Affected: Linux kernel versions from 3.11 up to before the fix in the 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1, 7.2 series. So we can say "Linux kernel versions prior to the patched releases: 5.10.261, 5.1
Information disclosure in the Linux kernel's isofs filesystem driver allows a local attacker to leak up to 255 bytes of kernel heap memory to userspace by mounting a crafted ISO 9660 image. Because
Information disclosure in the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver can expose cryptographic key material via debug logs when CONFIG_DYNAMIC_DEBUG is enabled. A local attacker with low privileges could capture hex dumps of keys from kernel ring buffer, leading to full compromise of confidentiality, integrity, and availability. Patches are available in multiple stable kernel branches; no active exploitation or public exploit code has been identified.
Denial of service in the Linux kernel's pcrypt crypto template allows remote unauthenticated attackers to crash the system by triggering a faulty fallback path. When the parallel execution via padata fails (e.g., due to resource pressure), the pcrypt module does not restore the original callback, leading to unsafe execution of the parallel-only completion routine and kernel memory corruption. The vulnerability has a low EPSS score (0.22%, 13th percentile), no public exploit or active exploitation, and patches are available in multiple stable kernel series.
Use-after-free and missing forward security in the loongson-rng crypto driver of the Linux kernel allow a local, low-privilege attacker to corrupt memory and potentially execute arbitrary code, compromise system integrity, or read sensitive information. Affected systems are primarily Loongson-based machines running kernels between v6.18 and the respective fix versions; the driver itself is unused by any in‑kernel consumer and is being removed entirely rather than patched. No active exploitation or public exploit code is known, and the EPSS exploitation probability is low (0.21%).
Use-after-free and list corruption in the Linux kernel's Intel QuickAssist Technology (QAT) crypto driver allows a local low-privileged attacker to trigger kernel memory corruption by racing concurrent service registration and device lifecycle operations. The crypto/qat subsystem's service_table linked list is guarded by service_lock only during insertions and deletions, but seven device-state functions iterate the list unprotected, enabling a concurrent adf_service_register() or adf_service_unregister() call to mutate the list mid-traversal. Exploiting this race can result in kernel crash, arbitrary kernel memory read, or local privilege escalation to root. No public exploit code has been identified and EPSS stands at 0.21% (11th percentile), but the impact class is high for systems running QAT-capable Intel hardware.
Out-of-bounds slab read in the Linux kernel tracing subsystem allows a local attacker with access to the trace event filter interface to leak kernel slab memory or crash the kernel. The flaw exists because `regex_match_glob()` ignores the bounded length passed by filter predicate functions and calls the NUL-terminated-string-only `glob_match()`, which scans past the end of non-NUL-terminated dynamic string fields - exemplified by XFS namespace tracepoints whose dynamic char arrays are copied without a trailing NUL. EPSS is 0.22% (13th percentile); no public exploit code exists and the vulnerability is not listed in CISA KEV.
Unauthorized file truncation in the Linux kernel's NFSv4 client allows local attackers to bypass write permission checks when opening a file with O_RDONLY|O_TRUNC. By exploiting a missing MAY_WRITE permission mask during cached delegated opens, an attacker without write access can truncate files, causing data loss. No public exploit or active exploitation has been identified, and EPSS indicates a 0.22% exploitation probability.
We are tasked to synthesize a comprehensive analysis for CVE-2026-64293. Need to output JSON. Given data: - CVE ID: CVE-2026-64293 - Description: long description about iommufd veventq read bug with sizeof(hdr) vs sizeof(*hdr). On 32-bit, under-counts header size, leading to buffer overflow past user-supplied buffer. - CVSS: 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CWE: N/A (but we can infer CWE-131: Incorrect Calculation of Buffer Size? Or maybe CWE-682: Incorrect Calculation? Not given.) - EPSS: 0.21% (percentile 11%) — low exploitation probability. - Patch: Available from vendor. - Reported by: Linux (likely Linux kernel) - CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (all versions) - Tags: Linux, Information Disclosure (though the vulnerability is actually a buffer overflow, but tags say Information Disclosure; perhaps they are generic tags, not precise) - ENISA EUVD ID: EUVD-2026-49005 - Affected versions (EUVD): weird entries: "Linux patch: 7.1.4", "Linux 6.15", "Linux patch: 0", "Linux patch: 7.2-rc1", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <be93d186ae88a92e7aa77e122d4e661fa57b1e39", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <0cdbb97a4dbd69abdd2ab998b4fbc7803d4b0b72", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <04a177f91160ee18da98f5689482cf0f589ec869", "Linux patch: 6.18.39" - Looks like commit ranges and patch references. Need to interpret. - References: three kernel git commits, NVD link, vuldb link. Analysis: Product name: Linux kernel (specifically iommufd subsystem). So product_name: "Linux Kernel". Summary: Must not copy description, write original synthesis. Buffer overflow in Linux kernel's iommufd subsystem, specifically in veventq read path due to sizeof(hdr) using pointer size instead of structure size, leading to potential memory corruption on 32-bit systems. Allowing local attackers with low privileges to gain elevated privileges or cause system compromise. CVSS 7.8 indicates local vector, low complexity, high im
Privilege escalation in the Linux kernel's KVM on ARM64 with pKVM allows a host with root privileges to corrupt hypervisor memory via an out-of-bounds list register index, potentially leading to full hypervisor compromise. The vulnerability arises from missing bounds clamping of the used_lrs field when copying vGIC state from host to hyp, enabling a malicious host to read or write beyond the implemented list registers. A patch is available across several stable kernel branches; the EPSS score is low (0.21%) and no public exploit or active exploitation is known at time of analysis.
Privilege escalation in the Linux kernel's
Incomplete dirty-page tracking in KVM's VMX fastpath userspace exit handling can lead to data corruption or availability loss in virtual machines. A local attacker with low privileges and the ability to run a KVM guest can trigger missed guest memory dirty markings, causing integrity and availability impacts on the host. No active exploitation is known, but vendor patches are available.
Persistent denial-of-service condition in the Linux kernel's svcrdma transport occurs when a remote disconnect causes server worker threads to hang indefinitely during transport shutdown, pinning resources and preventing normal teardown. Attackers can trigger this without authentication, leading to resource exhaustion and complete service unavailability for NFS-over-RDMA. No active exploitation is known, and the EPSS exploitation probability is low (0.20%).
An integer truncation vulnerability in the Linux kernel's FPGA DFL-AFU driver allows a local attacker with low privileges to trigger memory corruption by sending a crafted DMA map ioctl. The issue arises from a missing upper bound check on a 64-bit length parameter from userspace, leading to an undersized pin of memory pages and potential out-of-bounds access. This can result in privilege escalation to root, impacting systems with the dfl-afu module loaded. No active exploitation or public exploit code has been identified at time of analysis.
Local privilege escalation in the Linux kernel's I2C subsystem allows a low-privileged local attacker to compromise system integrity, confidentiality, and availability via a race condition during I2C adapter deregistration. The vulnerability affects kernel versions from 2.6.31 up to unpatched releases, with fixes available in stable trees 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1. No public exploit code or active exploitation is currently reported, and EPSS indicates a low exploitation probability (0.21%).
Out-of-bounds read and write in the Linux kernel's synaptics-rmi4 F3A GPIO driver allows local low-privileged users to leak adjacent kernel slab memory to userspace or perform a controlled heap write via the evdev ioctl interface. The root cause is a size mismatch: gpio_key_map is allocated for at most 6 entries while input->keycodemax is set to the full device-reported gpio_count (up to 127), causing the input core's EVIOCGKEYCODE and EVIOCSKEYCODE ioctls to index past the allocation. No public exploit has been identified at time of analysis; EPSS is 0.22%.
Touch event indexing in the Linux kernel mms114 driver misaligns reads for MMS134S and MMS136 controllers, which pack events at 6-byte intervals while the driver iterates at 8-byte struct offsets. On systems physically equipped with these MELFAS touch controllers, a locally privileged attacker can trigger multi-touch input processing that causes the driver to read kernel memory from incorrect offsets, potentially exposing sensitive data or corrupting kernel state. No public exploit or active exploitation has been identified; EPSS stands at 0.21%, reflecting negligible widespread exploitation risk at time of analysis.
Host memory disclosure to a remote RDMA peer in the Linux kernel's RDMA/rtrs-srv (RTRS server) transport allows a connected peer to read beyond a mapped chunk buffer. When answering an RTRS READ, rdma_write_sg() set the outbound RDMA-Write source-SGE length directly from the attacker-controlled wire descriptor field desc[0].len, which was only rejected when zero, and used the PD-wide local_dma_lkey rather than the chunk's own MR, so the verbs layer never constrained the transfer to max_chunk_size. A peer advertising a length larger than the chunk can force the posted RDMA write to read past the chunk into adjacent host memory (disclosed back to the peer under passthrough/no-IOMMU configs) or trigger a translation fault that aborts the connection. No public exploit identified at time of analysis and EPSS is low (0.21%).
A use-after-free in the FUSE subsystem of the Linux kernel allows a local attacker with permission to mount a FUSE filesystem to escalate privileges or crash the system. The vulnerability exists in fuse_ref_folio() due to improper request locking, and affects kernel versions from 2.6.35 through unpatched longterm branches. Patches are available, and no active exploitation or public exploit code has been identified.
Local privilege escalation in the Linux kernel FUSE subsystem allows a low-privileged attacker to corrupt kernel memory
Local privilege escalation in the Linux kernel's fuse-uring subsystem allows a local attacker to trigger a use-after-free condition by racing with the async stop queues function, potentially resulting in arbitrary code execution and complete system compromise. The vulnerability affects Linux kernel versions 6.14 through 6.18.x (patched in 6.18.39, 7.1.4,
A race condition in the Linux kernel's fuse-uring subsystem allows a local user to achieve privilege escalation and full system compromise. The vulnerability, triggered by concurrent operations on the queue->stopped flag outside of locking, leads to a use-after
Use-after-free in the Linux kernel’s fuse-uring subsystem allows a local authenticated attacker to escalate privileges. The race condition occurs when a malicious userspace sends a commit SQE before the kernel completes the memcpy of request data, triggering a freed fuse_req to be reused. CVSS base score is 7.8 but EPSS probability is low (0.21%), and no public exploit or active exploitation has been reported.
Memory exposure and denial of service in the Linux kernel SMB client allows remote attackers to read kernel memory or crash the system via crafted SMB2 responses. The vulnerability exists in versions prior to the patched releases, affecting all systems mounting SMB shares from untrusted servers. No authentication or user interaction is required, and while no active exploitation is reported, the high CVSS score reflects the serious confidentiality and availability impact.
HTTP request smuggling in libsoup (GNOME's HTTP client/server library) enables network-accessible attackers to inject hidden requests into backend streams by exploiting a parsing differential between libsoup's permissive chunked transfer encoding parser and strict RFC 9112-compliant frontend proxies. All libsoup versions are affected as tracked under CPE cpe:2.3:a:gnome:libsoup, with confirmed vendor impact across Red Hat Enterprise Linux 6.0 through 10.0. No public exploit code or active exploitation has been identified at time of analysis; SSVC classifies exploitation as none with non-automatable, partial technical impact.
Apache Thrift C++ library's THeaderTransport::readString() fails to properly validate info-header length, allowing an out-of-bounds read. An attacker sending a specially crafted Thrift message can trigger this to read beyond the buffer, potentially leaking sensitive memory contents. Remote unauthenticated exploitation is possible against any service using vulnerable bindings, and the issue is fixed in version 0.24.0.
Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU resources via crafted requests that trigger quadratic-time processing in the receive transport. No active exploitation or public exploit is known at
Information disclosure in Microsoft Edge (Chromium-based) stems from an origin validation error, allowing a network-based attacker to read sensitive data. The vulnerability requires user interaction (e.g., visiting a malicious website) to trigger a cross-origin leak, potentially exposing data across different security contexts. A patch is available via Microsoft's update guide; no active exploitation or public exploit has been reported at this time.
Use-after-free in the Linux kernel's net/sched cls_api when handling TC_ACT_CONSUMED in tcf_qevent_handle can allow remote code execution. The flaw is triggered if a RED qdisc is configured with a qevent early_drop and a tc filter using connection tracking (act_ct) with defragmentation enabled while receiving out-of-order fragments. No active exploitation or public PoC exists; EPSS score 0.17% indicates low exploitation probability despite a CVSS 9.8 base score.
Userspace ACL isolation is defeated in Zephyr RTOS v2.0.0 through v4.4.0 on SMP builds due to a missing spinlock in thread_idx_alloc(), allowing two concurrently executing user-mode threads to receive the same permission-index (tidx) and subsequently alias each other's ACL bit across every kernel object. Any kernel object access grant intended exclusively for one thread is silently extended to the aliasing thread, nullifying the CONFIG_USERSPACE isolation model. No public exploit or active exploitation (CISA KEV) is known at time of analysis, and SSVC marks automatable: no, but the technical impact is assessed as total, warranting prioritized patching for affected SMP deployments.
Local privilege escalation in the Linux kernel's QAT driver allows a low-privileged local attacker to achieve full system compromise by exploiting a legacy character device interface with IOCTLs. The unused /dev/qat_adf_ctl device node increases attack surface and has been the subject of multiple bug reports. With an EPSS score of 0.24%, active exploitation is unlikely, and no public exploit code is known; the vulnerability is addressed by removing the entire character device and IOCTL infrastructure.
Out-of-bounds array read and missing initialization flaw in the Linux kernel's drm/hyperv virtual display driver affect Linux VMs running under Microsoft Hyper-V. A SYNTHVID_RESOLUTION_RESPONSE message carrying resolution_count exceeding 64 causes the guest kernel driver to walk past the end of the 64-entry supported_resolution[] array, potentially disclosing adjacent guest kernel heap memory to the Hyper-V host. A separate missing-initialization defect in the WIN10-to-WIN8 protocol fallback path leaves screen dimension fields at zero, causing drm_internal_framebuffer_create() to reject every userspace framebuffer with -EINVAL and effectively disabling virtual display. No public exploit exists and EPSS is 0.21%; exploitation of the OOB read requires host-level control over Hyper-V VMBus messaging.
State-counter underflow in the Linux kernel's mlx5e (NVIDIA/Mellanox ConnectX) IPsec offload driver lets the eswitch mode-block reference counter (esw->offloads.num_block_mode) be decremented without a matching increment when a temporary acquire-flow security association is installed. The affected code is the mlx5e_xfrm_add_state() acquire-SA path, which skips hardware offload but still falls through to the common success label that unconditionally calls mlx5_eswitch_unblock_mode(). Fixed upstream in the stable kernel series; no public exploit identified at time of analysis and EPSS probability is low (0.21%).
Local privilege escalation in the Linux kernel's ARM FFA firmware interface allows an unprivileged local attacker to achieve arbitrary code execution by triggering an out-of-bounds write when processing PARTITION_INFO_GET descriptors. The kernel fails to validate firmware-supplied indices, enabling a heap buffer overflow that can corrupt memory. Patches are available, no public exploit exists, and EPSS indicates low exploitation probability (0.21%).
Heap-based information disclosure and denial of service in the Linux kernel's mac80211 WiFi subsystem can be triggered by adjacent network attackers. The vulnerability arises from incorrect pointer usage during MLE defragmentation, potentially leading to kernel heap memory over-read and exposure of sensitive data, as well as system crashes. Affected kernels from version 6.9 are vulnerable until patched; no public exploit is known and EPSS indicates a low exploitation probability (0.21%).
Use-after-free vulnerability in the Linux kernel's ACPI NFIT driver allows a local attacker with low privileges to trigger a Machine Check Exception, leading to a dangling pointer dereference that can cause memory corruption, privilege escalation, or denial of service. Affected are kernel versions from commit a61fe6f7902ec (4.6-rc1) up
Improper handling of SPI chip select and bus locking in the Linux kernel's ad_sigma_delta IIO ADC driver allows a local attacker with low privileges to leave the SPI bus in an inconsistent state. This can cause denial of service through bus contention and potential data corruption. Affected kernels include versions before specific stable patches (e.g., 6.14, 7.2-rc1), with no known active exploitation but a low EPSS score indicating minor real-world risk.
The user asks for a comprehensive JSON analysis of CVE-2026-64485. I need to synthesize data from the provided sources. Let's examine the input carefully. CVE ID: CVE-2026-64485 Description: In the Linux kernel, ALSA: compress: Fix task creation error unwind. It details a resource leak when snd_compr_task_new() allocates driver task, and if subsequent steps fail, task_free() callback is not called, leaking driver resources. Also, an error in file descriptor allocation may not be reported correctly, leading to incorrect success reporting. CVSS: 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE: N/A EPSS: 0.21% (11th percentile) Patch: Available from vendor Reported by: Linux CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* Tags: Information Disclosure, Linux ENISA EUVD ID: EUVD-2026-48829 Affected versions (EUVD): a list of commit hashes and kernel versions. The patch refs are three git.kernel.org links. Now, I need to generate all fields as plain text strings. I'll go through each field requirement. product_name: "Linux kernel" (or "Linux Kernel"? The requirement: 1-3 words ONLY. The CVE is in the Linux kernel, specifically the ALSA compress subsystem. So "Linux Kernel" is appropriate. summary: Must be an original synthesis, 2-3 sentences. Not copying description. Start with specific impact verb and product. So: "Local privilege escalation in the Linux kernel's ALSA compress driver subsystem allows a local authenticated attacker to trigger a resource leak and potentially escalate privileges due to improper cleanup when creating an audio compress task. The vulnerability affects Linux kernels with the snd-compress module (versions as specified), and can lead to memory leaks and denial of service or arbitrary code execution. Although no public exploit is identified at time of analysis, the issue is addressed in upstream patches." I'll incorporate that the vulnerability leads to resource leak and eventually could lead to other issues. But the description doesn't explicitly men
Local privilege escalation in the Linux kernel’s cs35l41_hda audio driver allows a low-privileged user to corrupt kernel memory and execute arbitrary code. The flaw arises when firmware autostart is disabled and a firmware load work item is queued, then
Local privilege escalation to root via a use-after-free race condition in the Linux kernel's binder driver allows a low-privileged attacker to exploit a flaw in binder_thread_release() when a thread exit races with a parallel process death. The vulnerability affects Linux kernel versions since commit 7a4408c6bd3e and can lead to full system compromise. EPSS exploitation probability is low (0.22%), and no public exploit or active exploitation is known at time of analysis.
Local privilege escalation in the Linux kernel's binder driver allows a low-privileged attacker to execute arbitrary code with kernel rights. The vulnerability arises from a race condition in binder_free_transaction() where a freed target process can still be accessed, leading to a use-after-free. No active exploitation or public exploit code is currently known, and vendor patches are available across multiple stable kernel branches.
Elevation of privilege in the Linux kernel's tcpci_rt1711h USB Type-C port controller driver allows a local attacker with low privileges to potentially achieve full system compromise. The driver fails to unregister the TCPCI port when an interrupt request or alert enable step fails during device probe, leaving a stale resource that can be exploited for code execution. No active exploitation or public exploit code is known; EPSS probability is low (0.21%).
Memory-safety out-of-bounds read in the virtio-rng driver of the Linux kernel allows a malicious or buggy hypervisor to leak adjacent slab memory into the guest’s hardware random number stream, potentially exposing kernel heap data. The flaw triggers automatically at device probe without guest user interaction, and while no active exploitation has been observed, the fix is a hardening priority for confidential computing environments. The EPSS score (0.22%) suggests low near-term exploitation likelihood.
Use-after-free in the Linux kernel's 6LoWPAN NHC handler may allow network-adjacent attackers to execute arbitrary code or trigger denial of service by sending a malformed packet. Affects kernels with 6LoWPAN support from commit 92aa7c65d295 up to the patched versions. No active exploitation or public exploit code is known; EPSS probability is low at 0.22%.
Out-of-bounds slab read in the Linux kernel TIPC (Transparent Inter-Process Communication) protocol lets a malicious TIPC neighbour trigger a heap over-read by sending a single crafted broadcast PROTOCOL/STATE_MSG carrying a Gap ACK blocks record. Affecting kernels 5.8 through the fixed stable releases, the broadcast path (tipc_bcast_sync_rcv → tipc_link_advance_transmq) fails to bound the Gap ACK record against the actual message data size, so kmemdup() copies up to 1024 bytes past a ~704-byte skb, corrupting/leaking adjacent slab memory and crashing the host (KASAN slab-out-of-bounds). No public exploit is identified at time of analysis and EPSS is low (0.22%), consistent with a niche, non-default kernel subsystem.
Out-of-bounds read in the Linux kernel's CIFS client during SMB2 message validation allows an unauthenticated remote attacker acting as a malicious server to leak kernel memory and crash the client before session authentication. The vulnerability, which affects the smb2_check_message() function, can be triggered during NEGOTIATE or SESSION_SETUP exchanges. No active exploitation has been reported, and the EPSS probability is low (0.22%).
Out-of-bounds read and integer underflow in the Linux kernel staging driver rtl8723bs (Realtek RTL8723BS SDIO Wi-Fi chipset) allows an adjacent network attacker to trigger kernel memory disclosure or crash via crafted 802.11 WEP authentication frames. Two distinct bugs in OnAuth() can be triggered without authentication: a length underflow that causes crc32_le() to read far beyond the frame buffer when the Privacy bit is set on a short frame, and a fixed 128-byte memcmp in the seq=3 path that ignores the actual IE length field. No public exploit code exists and EPSS is 0.26%, reflecting the combination of adjacent-network requirement, deprecated WEP protocol dependency, and niche SDIO chipset driver.
Out-of-bounds read in the Linux kernel's rtl8723bs staging driver allows adjacent network attackers to read sensitive kernel memory and cause denial of service via a malicious association response. Exploitation requires a rogue access point sending crafted IE data. Patches are available, and no active exploitation or public exploit has been reported.
Out-of-bounds read in the Linux kernel's staging rtl8723bs Wi-Fi driver can be triggered by a malicious Access Point sending a crafted Beacon frame, allowing an adjacent attacker to read sensitive kernel memory and potentially crash the system. Affected kernels from version 4.12 onwards that include the rtl8723bs driver; vendor patches are available.
Out-of-bounds reads in the Linux kernel's rtl8723bs staging WiFi driver allow an attacker-controlled access point to leak kernel memory or crash affected systems by sending beacon or probe-response frames with a truncated final information element. Two IE-parsing loops in issue_assocreq() and join_cmd_hdl() dereference pIE->length without first verifying that at least sizeof(*pIE) bytes remain in the buffer, so a one-byte stub IE at the end of AP-supplied data reads one byte past the buffer end. No public exploit has been identified at time of analysis, and EPSS sits at 0.22%, consistent with the adjacent-network attack vector and niche driver footprint.
Out-of-bounds reads in the Linux kernel's rtl8723bs staging WiFi driver allow an adjacent unauthenticated attacker to leak kernel memory or crash the system by sending crafted 802.11 management frames containing malformed WPA, WAPI, or WPS Information Elements. Three IE parsing functions - rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - lack bounds validation before reading multi-byte header fields and OUI comparisons, exposing raw kernel buffer contents to an adversary within WiFi range. No public exploit or active exploitation has been identified; vendor-released patches are available across all supported stable branches.
Use-after-free in the Linux kernel's ksmbd (SMB server) allows authenticated remote attackers to trigger memory corruption, potentially leading to arbitrary code execution or denial of service. The flaw occurs when an SMB2_CLOSE on a locked file is followed by an SMB2_CANCEL, causing a freed file_lock to be re-accessed. A patch is available for affected kernel versions, and while no active exploitation is confirmed, a proof-of-concept exists; EPSS indicates low exploitation likelihood.
Uninitialized memory read in the Linux kernel's PF_KEY IPComp implementation allows local unprivileged users to disclose kernel memory or cause a denial of service. The vulnerability arises from a missing initialization of the alg_key_len field in the xfrm_algo structure when adding IPComp security associations, leading to an out-of-bounds slab read during XFRM state migration. Affected are all Linux kernels since version 2.6.21, with patches backported to multiple stable series.
A data race condition in the Linux kernel's audit subsystem allows local attackers to cause denial of service and minimal integrity impact by exploiting unsynchronized reads of the audit queue length. The flaw affects kernel versions from 4.10 through the unpatched stable series, triggered when concurrent readers and writers access the queue without proper locking,
Use-after-free in the Linux kernel's Bluetooth L2CAP subsystem can be triggered by an adjacent attacker, potentially leading to arbitrary code execution or kernel memory corruption. The flaw occurs when a channel timeout callback races with connection teardown, allowing a freed connection object to be accessed. Patched kernels are available; no active exploitation is confirmed, but the vulnerability is remotely exploitable within Bluetooth range without authentication or user interaction.
A denial-of-service flaw in the Linux kernel's NTB EPF driver can cause a kernel panic or system crash when the interrupt handler calls pci_irq_vector() in hardirq context. An attacker with local access to a system using this specialized hardware driver could trigger the issue. At the time of analysis, no public exploit or active exploitation has been reported, and EPSS indicates low exploitation probability (0.21%).
Use-after-free memory corruption in the Linux kernel's NXP i.MX8 ISI (Image Sensing Interface) media driver is triggered during module removal (rmmod of imx8_isi), confirmed by KASAN slab-use-after-free reports. The root cause is an incorrect teardown order in mxc_isi_remove(): the crossbar cleanup frees media entity pads before the V4L2 cleanup has finished removing media links that reference those same pads, resulting in a dangling pointer dereference in __media_entity_remove_link(). No public exploit has been identified at time of analysis, and with EPSS at 0.21% (11th percentile), real-world weaponization appears unlikely despite the CVSS 7.8 score.
A race condition in the Linux kernel's shrinker subsystem can cause use-after-free or double-free memory errors during memory cgroup creation and teardown. Local attackers with low privileges may exploit this to escalate privileges to kernel level, leading to full system compromise (confidentiality, integrity, and availability impact). Patches are available in multiple stable kernel branches; no active exploitation is reported (CISA KEV not listed), and the EPSS exploitation probability is low (0.21%).
Remote denial-of-service in Linux kernel netfilter allows unauthenticated attackers to crash the system by sending crafted network packets containing unreadable socket buffer fragments (e.g., from devmem TCP). Affected components include xt_u32, nfnetlink_queue, and nfnetlink_log, which mishandle the error return from sk
Memory corruption in the Linux kernel's netfilter ebtables module can occur from an uninitialized pointer free during chainstack array cleanup. The flaw is triggered only under rare, non-default conditions—a sparse CPU possible mask and a failed memory allocation—making real-world exploitation extremely unlikely. No active exploitation or public exploit is known.
Information disclosure and denial of service in the Linux kernel's netfilter ebtables subsystem allows a local attacker with low privileges to leak kernel memory or cause a system crash. The vulnerability arises from a missing null-termination check on module names before passing them to request_module(), potentially exposing uninitialized kernel memory. No public exploit or active exploitation has been identified, and the EPSS score indicates a low probability of widespread exploitation.
Stack buffer over-read in the Linux kernel's netfilter ebtables module allows a local attacker with low privileges to read kernel stack data and potentially crash the system. When updating ebtables counters, a 32-byte user-supplied table name is passed without NUL-termination to a kernel function that uses it in a module autoload request, causing vsnprintf to read beyond the stack buffer. No active exploitation or public exploit code is known, and EPSS indicates a low exploitation probability (0.22%).
Insufficient validation in the Linux kernel's netfilter flowtable hardware offload for IPIP tunnels could allow a remote attacker to cause information disclosure or denial of service. The flaw exists because the kernel would attempt to enqueue hardware offload work for IPIP tunnels despite no driver supporting it, leading to an unspecified impact when the unsupported configuration is processed. The issue is fixed by adding an early check to skip unsupported offload setup. No public exploit code is
Out-of-bounds memory read in the Linux kernel's btnxpuart Bluetooth driver exposes kernel memory to a malicious or compromised NXP Bluetooth UART controller. The vulnerability exists in nxp_recv_fw_req_v3(), which handles firmware download requests during v3 controller initialization: when the controller supplies a crafted 32-bit offset or 16-bit length value that pushes past the end of the firmware image, the driver reads arbitrary kernel memory and transmits it back to the controller over UART. The parallel v1 path (nxp_recv_fw_req_v1()) already contained the equivalent bounds check; the v3 path lacked it. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.21% (11th percentile), consistent with the narrow local/hardware attack surface.
Local privilege escalation in the Linux kernel's SMB client witness notification handler allows a low-privileged attacker to exploit a use-after-free condition. Affected are Linux kernel versions 5.11 and later that have the CIFS witness feature enabled. Successful exploitation can lead to arbitrary code execution with elevated privileges, fully compromising the system.
Use-after-free vulnerability in the Linux kernel's ksmbd SMB server allows remote attackers to execute arbitrary code. All kernel versions with ksmbd enabled from early commits up to the patched releases are affected, and the issue can be triggered by concurrent QUERY_DIRECTORY requests on the same file handle. A fix is available via multiple stable kernel branches, no active exploitation is reported in KEV, and EPSS indicates a low probability of widespread exploitation (0.21%).
Use-after-free in Linux kernel’s ksmbd SMB server occurs during deferred byte-range lock cancellation, allowing an authenticated attacker to potentially execute arbitrary code or crash the system. The vulnerability affects ksmbd versions prior to the released fixes (6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, 7.2-rc1). No active exploitation has been confirmed (no CISA KEV listing), and EPSS indicates a low probability of widespread exploitation.
Unauthorized information disclosure in Linux kernel's ksmbd module allows remote unauthenticated attackers to copy arbitrary file contents on SMB shares by exploiting a missing access check on the FSCTL_DUPLICATE_EXTENTS_TO_FILE operation. Attackers with only attribute access to a source file can read its contents without requiring the FILE_READ_DATA permission. No public exploit or active exploitation has been identified, though the vulnerability is patchable via kernel updates.
Unauthorized file modification in the Linux kernel's ksmbd SMB server allows remote attackers to modify file data and attributes by exploiting a credential confusion in SMB2 SET_INFO handlers. The vulnerability arises because the VFS operations used after permission checks run with the ksmbd worker credentials rather than the opener's credentials, effectively bypassing ownership and permission restrictions. No public exploit is known and EPSS is low (0.21%), but the network-accessible, low-complexity nature makes critical
Unauthorized read/write of Alternate Data Streams in Linux ksmbd allows remote attackers to access or modify file extended attributes. The vulnerability, present in Linux kernel versions with ksmbd up to before patches 6.18.39, 6.12.96, 7.1.4
Memory corruption in the Linux kernel's ksmbd SMB server allows authenticated remote code execution. A race condition in byte-range lock ownership tracking can lead to use-after-free when SMB3 multichannel is enabled, enabling an attacker with low privileges to escalate to full system compromise. No public exploit or active exploitation is known, and EPSS indicates low exploitation probability.
Double-free memory corruption in the Linux kernel SMB client when processing SMB2 QUERY_DIRECTORY responses. A remote attacker acting as a malicious SMB server can trigger the issue during directory enumeration, potentially leading to arbitrary code execution or denial of service on any unpatched Linux system that mounts an attacker-controlled share. The vulnerability is not known to be actively exploited, but patches are available across multiple stable kernel branches.
Double free in the Linux kernel's SMB client due to improper cleanup of response buffers when a reply error is replayed. An attacker controlling an SMB server can trigger memory corruption, potentially leading to code execution or a system crash, when a vulnerable client connects and processes a crafted response. Patches are available in multiple stable kernel branches, but no active exploitation or public exploit has been reported.
Double-free vulnerability in the Linux kernel's SMB client (cifs) allows remote code execution via crafted SMB2_ioctl replies. An attacker hosting a malicious SMB server can trigger a replay path memory double-free, leading to full system compromise. No active exploitation or public exploit has been identified at this time; EPSS score is low (0.21%).
Double-free memory corruption in the Linux kernel's SMB client (cifs) affects the SMB2_flush() replay path across many stable branches prior to 6.6.145, 6.12.96, 6.18.39 and 7.1.4. When a mounted client receives a replayable flush response and the subsequent retry fails before cifs_send_recv() installs a replacement response, flush_exit frees the stale response buffer a second time, corrupting kernel slab memory and typically crashing the client. No public exploit is identified at time of analysis (EPSS 0.21%, 11th percentile) and it is not in CISA KEV; exploitation requires a malicious or man-in-the-middle SMB server plus a replay/retry timing race, making it primarily a denial-of-service concern despite the 9.8 rating.
Double-free in the Linux kernel SMB client's SMB2_open() replay handler allows remote attackers to corrupt memory by inducing a user to mount a malicious SMB share. The flaw affects unpatched kernel versions with the cifs module loaded and can lead to arbitrary code execution, information disclosure, or denial of service. No active exploitation has been reported (not in CISA KEV), and EPSS score is 0.21%, indicating low exploitation probability; official kernel patches are available.
Out-of-bounds read in the Linux kernel's SMB/CIFS client POSIX SID parser allows a malicious or MITM SMB server to cause kernel memory disclosure and denial of service on connecting clients. The `posix_info_sid_size()` helper reads `sid[1]` (the SubAuthorityCount byte) after validating only one remaining byte, permitting a truncated server-supplied POSIX SID to trigger a one-byte OOB read - leaking a byte of kernel heap context (C:L) and risking a crash (A:H). No public exploit code exists and EPSS is 0.22%, but the vulnerability is client-facing and triggered entirely from the server side without client-side privilege. Patches are available across all maintained stable branches.
Improper mode masking in the Linux kernel SMB client when the modefromsid mount option is used allows a remote attacker to cause denial of service and limited integrity impact via a crafted SMB response. The vulnerability arises because parse_dacl() fails to mask server-provided mode bits to 07777, potentially setting unexpected permission bits on files. No public exploit is identified at time of analysis.
Privilege escalation in the Linux kernel /proc filesystem allows a local attacker to bypass ptrace access restrictions when reading symbolic links in /proc/[pid]/fd/. By racing the task lookup and access check, an unauthenticated local user can gain unauthorized read and write access to sensitive file descriptors of other processes, potentially leading to full system compromise. The vulnerability affects a wide range of kernel versions and has a patch released by the Linux kernel project.
Local privilege escalation in the Linux kernel's pcc-cpufreq driver allows a low-privileged user to gain full root privileges. The vulnerability is a use-after-free and double-free flaw when evaluating ACPI _OSC negotiation, affecting all kernel versions from 2.6.34 until the fixed stable releases (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1). No active exploitation or public exploit has been identified, and EPSS indicates a low probability of widespread exploitation.
Memory disclosure in the Linux kernel's SLUB allocator allows local attackers to read uninitialized kernel memory when specific slab debugging options are enabled. The issue occurs when red zoning is active without store_user tracking, causing krealloc() to violate the __GFP_ZERO contract and return partially zeroed allocations. This can leak sensitive data, with an EPSS probability of 0.21% and no known active exploitation, though a vendor patch is available.
Use-after-free in the Linux kernel HID appleir driver allows a local attacker to corrupt kernel memory during device removal, potentially achieving privilege escalation. The race condition exists between the key_up_timer callback (armed by appleir_raw_event() on each keydown/key-repeat) and hid_hw_stop(), which frees the underlying input_dev before the timer is drained. A second race window, where a USB URB completion during hid_hw_stop() can re-arm the timer via mod_timer(), means a simple teardown reorder is insufficient — the fix introduces a spinlock-gated 'removing' flag combined with timer_shutdown_sync() to permanently disable further callbacks. No public exploit has been identified at time of analysis, and EPSS is 0.22% (13th percentile).
An out-of-bounds memory access in the Linux kernel's BPF devmap broadcast redirect for XDP frames, introduced in version 5.14, can be triggered by remote unauthenticated attackers sending specially crafted fragmented network packets. This could lead to kernel memory corruption and arbitrary code execution. Though CVSS rates this as critical (9.8), no public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.21%).
Arbitrary code execution in the Linux kernel's BPF BTF parser allows local privilege escalation. Malformed BTF data can cause an integer overflow in the repeated field count calculation, bypassing a capacity check and leading to a heap buffer overflow. With low EPSS score (0.21%), widespread exploitation is currently unlikely, but unprivileged local users who can load BPF programs are at risk of complete system compromise.
Use-after-free and memory leak in the Linux kernel's EHCI and FOTG210 USB isochronous submit paths expose systems running kernel versions from 2.6.15 through 7.1.3 to local kernel memory corruption by a low-privileged user. When an isochronous URB submission fails before the staged schedule handoff - either because the host controller becomes inaccessible or usb_hcd_link_urb_to_ep() returns an error - the ehci_iso_sched allocation is not freed and urb->hcpriv retains a dangling pointer, creating a UAF condition. No public exploit exists and the EPSS score is 0.21% (12th percentile), but vendor-released patches across multiple stable branches are available and should be applied to eliminate the risk.
Use-after-free in the Linux kernel's USB ldusb driver allows a local unprivileged user to corrupt kernel memory by racing disconnect() against release() on a connected USB device. The root cause is that mutex_unlock() is documented as non-atomic and may access the mutex object after it logically releases the lock, creating a window where the driver data structure can be freed while still in use. No public exploit has been identified at time of analysis, and EPSS is low (0.22%), but the C:H/I:H/A:H CVSS impact vector reflects the potential for full kernel privilege escalation if successfully triggered.
Slab out-of-bounds read in the Linux kernel usbio USB driver (drivers/usb/misc/usbio) leaks adjacent kernel heap memory to local unprivileged processes via the i2c subsystem. The flaw lies in usbio_bulk_msg(), which validates the device-supplied payload length against the TX buffer size rather than the smaller RX buffer size, allowing a malicious USB device with mismatched endpoint wMaxPacketSize values to drive memcpy() past the end of the rxbuf slab object. Over-read kernel heap bytes propagate through the i2c layer to userspace via i2c-dev, and under KASAN-enabled kernels the bug is reported as a slab-out-of-bounds crash. No public exploit has been identified at time of analysis; the bug was found by code review and confirmed with a userspace AddressSanitizer model and a USB raw-gadget plus dummy_hcd kernel reproducer.
Use-after-free in the Linux kernel's USB Type-C UCSI CCG driver allows a local attacker with low privileges to corrupt kernel memory, potentially achieving arbitrary kernel code execution. The flaw exists in the module teardown path of the Cypress CCG UCSI driver: ucsi_ccg_remove() calls ucsi_destroy() - which kfree()s the ucsi object - before calling free_irq(), leaving a window in which the threaded IRQ handler ccg_irq_handler() can access the freed ucsi struct via ucsi_notify_common(). No public exploit code exists and the bug was discovered by static analysis; EPSS is 0.22% (13th percentile), reflecting no observed in-the-wild activity.
Heap-based out-of-bounds read in the Linux kernel's nvmet discovery log page handler allows unauthenticated remote attackers to leak kernel memory or crash the host. Any system acting as an NVMe over Fabrics target with a discovery service exposed via TCP, RDMA, or FC is vulnerable. No active exploitation or public exploit code is reported at this time, and EPSS probability is low (0.25%), but the impact and ease of exploitation make remediation urgent for affected storage targets.
Out-of-bounds heap read in the Linux kernel's nvmet-auth module allows pre-authentication remote attackers to read up to 526 bytes of heap memory beyond a crafted DHCHAP_REPLY message. By sending an NVMe-oF authentication reply with a small transfer length but inflated hash and DH value length fields, an unauthenticated attacker can extract sensitive data or cause a denial-of-service. Patches are available in upstream stable kernels.
We are tasked with synthesizing data from multiple sources about CVE-2026-64318 into a comprehensive analysis, returning a JSON object with specified fields. Let's carefully parse the provided information. CVE-2026-64318: In the Linux kernel, a vulnerability in the AIX partition handling. The description: "aix_partition() reads the physical volume descriptor... pp_count is unvalidated, so a crafted AIX image with pp_count > 1016 drives an out-of-bounds read... bound the scan to array size." From description: - Product: Linux kernel, specifically the partition handling for AIX disks (block/partitions/aix.c). So product_name: "Linux Kernel". - CVSS Score: 7.1, Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - CWE: N/A - EPSS: 0.22% (percentile 13%) - Patch: Available from vendor - Tags: Linux, IBM, Information Disclosure - KEV status: not mentioned (likely not KEV). POC? Not mentioned. So no active exploitation or public exploit identified from data. - CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (but note: Linux kernel is typically "o:linux:linux_kernel", but given as "a" application? The data says "cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*". We'll use it as is, but product_name Linux kernel is correct.) - Affected versions: We have a list of git commit ranges and patches. We can extract the fix versions: mention specific stable versions patched: 7.1.4, 6.18.39, 5.15.212, 5.10.261, 7.2-rc1, 6.6.145, 6.12.96, 6.1.178, and the initial commit from 3.11. So the vulnerability was introduced long ago (Linux 3.11) and fixed in multiple stable branches. The description mentions "Linux 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 < ..." which is the commit that fixed it? Possibly the fix commit. The EUVD entries give commit ranges where the vulnerability exists. We'll synthesize: Affected: Linux kernel versions from 3.11 up to before the fix in the 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1, 7.2 series. So we can say "Linux kernel versions prior to the patched releases: 5.10.261, 5.1
Information disclosure in the Linux kernel's isofs filesystem driver allows a local attacker to leak up to 255 bytes of kernel heap memory to userspace by mounting a crafted ISO 9660 image. Because
Information disclosure in the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver can expose cryptographic key material via debug logs when CONFIG_DYNAMIC_DEBUG is enabled. A local attacker with low privileges could capture hex dumps of keys from kernel ring buffer, leading to full compromise of confidentiality, integrity, and availability. Patches are available in multiple stable kernel branches; no active exploitation or public exploit code has been identified.
Denial of service in the Linux kernel's pcrypt crypto template allows remote unauthenticated attackers to crash the system by triggering a faulty fallback path. When the parallel execution via padata fails (e.g., due to resource pressure), the pcrypt module does not restore the original callback, leading to unsafe execution of the parallel-only completion routine and kernel memory corruption. The vulnerability has a low EPSS score (0.22%, 13th percentile), no public exploit or active exploitation, and patches are available in multiple stable kernel series.
Use-after-free and missing forward security in the loongson-rng crypto driver of the Linux kernel allow a local, low-privilege attacker to corrupt memory and potentially execute arbitrary code, compromise system integrity, or read sensitive information. Affected systems are primarily Loongson-based machines running kernels between v6.18 and the respective fix versions; the driver itself is unused by any in‑kernel consumer and is being removed entirely rather than patched. No active exploitation or public exploit code is known, and the EPSS exploitation probability is low (0.21%).
Use-after-free and list corruption in the Linux kernel's Intel QuickAssist Technology (QAT) crypto driver allows a local low-privileged attacker to trigger kernel memory corruption by racing concurrent service registration and device lifecycle operations. The crypto/qat subsystem's service_table linked list is guarded by service_lock only during insertions and deletions, but seven device-state functions iterate the list unprotected, enabling a concurrent adf_service_register() or adf_service_unregister() call to mutate the list mid-traversal. Exploiting this race can result in kernel crash, arbitrary kernel memory read, or local privilege escalation to root. No public exploit code has been identified and EPSS stands at 0.21% (11th percentile), but the impact class is high for systems running QAT-capable Intel hardware.
Out-of-bounds slab read in the Linux kernel tracing subsystem allows a local attacker with access to the trace event filter interface to leak kernel slab memory or crash the kernel. The flaw exists because `regex_match_glob()` ignores the bounded length passed by filter predicate functions and calls the NUL-terminated-string-only `glob_match()`, which scans past the end of non-NUL-terminated dynamic string fields - exemplified by XFS namespace tracepoints whose dynamic char arrays are copied without a trailing NUL. EPSS is 0.22% (13th percentile); no public exploit code exists and the vulnerability is not listed in CISA KEV.
Unauthorized file truncation in the Linux kernel's NFSv4 client allows local attackers to bypass write permission checks when opening a file with O_RDONLY|O_TRUNC. By exploiting a missing MAY_WRITE permission mask during cached delegated opens, an attacker without write access can truncate files, causing data loss. No public exploit or active exploitation has been identified, and EPSS indicates a 0.22% exploitation probability.
We are tasked to synthesize a comprehensive analysis for CVE-2026-64293. Need to output JSON. Given data: - CVE ID: CVE-2026-64293 - Description: long description about iommufd veventq read bug with sizeof(hdr) vs sizeof(*hdr). On 32-bit, under-counts header size, leading to buffer overflow past user-supplied buffer. - CVSS: 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CWE: N/A (but we can infer CWE-131: Incorrect Calculation of Buffer Size? Or maybe CWE-682: Incorrect Calculation? Not given.) - EPSS: 0.21% (percentile 11%) — low exploitation probability. - Patch: Available from vendor. - Reported by: Linux (likely Linux kernel) - CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (all versions) - Tags: Linux, Information Disclosure (though the vulnerability is actually a buffer overflow, but tags say Information Disclosure; perhaps they are generic tags, not precise) - ENISA EUVD ID: EUVD-2026-49005 - Affected versions (EUVD): weird entries: "Linux patch: 7.1.4", "Linux 6.15", "Linux patch: 0", "Linux patch: 7.2-rc1", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <be93d186ae88a92e7aa77e122d4e661fa57b1e39", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <0cdbb97a4dbd69abdd2ab998b4fbc7803d4b0b72", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <04a177f91160ee18da98f5689482cf0f589ec869", "Linux patch: 6.18.39" - Looks like commit ranges and patch references. Need to interpret. - References: three kernel git commits, NVD link, vuldb link. Analysis: Product name: Linux kernel (specifically iommufd subsystem). So product_name: "Linux Kernel". Summary: Must not copy description, write original synthesis. Buffer overflow in Linux kernel's iommufd subsystem, specifically in veventq read path due to sizeof(hdr) using pointer size instead of structure size, leading to potential memory corruption on 32-bit systems. Allowing local attackers with low privileges to gain elevated privileges or cause system compromise. CVSS 7.8 indicates local vector, low complexity, high im
Privilege escalation in the Linux kernel's KVM on ARM64 with pKVM allows a host with root privileges to corrupt hypervisor memory via an out-of-bounds list register index, potentially leading to full hypervisor compromise. The vulnerability arises from missing bounds clamping of the used_lrs field when copying vGIC state from host to hyp, enabling a malicious host to read or write beyond the implemented list registers. A patch is available across several stable kernel branches; the EPSS score is low (0.21%) and no public exploit or active exploitation is known at time of analysis.
Privilege escalation in the Linux kernel's
Incomplete dirty-page tracking in KVM's VMX fastpath userspace exit handling can lead to data corruption or availability loss in virtual machines. A local attacker with low privileges and the ability to run a KVM guest can trigger missed guest memory dirty markings, causing integrity and availability impacts on the host. No active exploitation is known, but vendor patches are available.
Persistent denial-of-service condition in the Linux kernel's svcrdma transport occurs when a remote disconnect causes server worker threads to hang indefinitely during transport shutdown, pinning resources and preventing normal teardown. Attackers can trigger this without authentication, leading to resource exhaustion and complete service unavailability for NFS-over-RDMA. No active exploitation is known, and the EPSS exploitation probability is low (0.20%).
An integer truncation vulnerability in the Linux kernel's FPGA DFL-AFU driver allows a local attacker with low privileges to trigger memory corruption by sending a crafted DMA map ioctl. The issue arises from a missing upper bound check on a 64-bit length parameter from userspace, leading to an undersized pin of memory pages and potential out-of-bounds access. This can result in privilege escalation to root, impacting systems with the dfl-afu module loaded. No active exploitation or public exploit code has been identified at time of analysis.
Local privilege escalation in the Linux kernel's I2C subsystem allows a low-privileged local attacker to compromise system integrity, confidentiality, and availability via a race condition during I2C adapter deregistration. The vulnerability affects kernel versions from 2.6.31 up to unpatched releases, with fixes available in stable trees 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1. No public exploit code or active exploitation is currently reported, and EPSS indicates a low exploitation probability (0.21%).
Out-of-bounds read and write in the Linux kernel's synaptics-rmi4 F3A GPIO driver allows local low-privileged users to leak adjacent kernel slab memory to userspace or perform a controlled heap write via the evdev ioctl interface. The root cause is a size mismatch: gpio_key_map is allocated for at most 6 entries while input->keycodemax is set to the full device-reported gpio_count (up to 127), causing the input core's EVIOCGKEYCODE and EVIOCSKEYCODE ioctls to index past the allocation. No public exploit has been identified at time of analysis; EPSS is 0.22%.
Touch event indexing in the Linux kernel mms114 driver misaligns reads for MMS134S and MMS136 controllers, which pack events at 6-byte intervals while the driver iterates at 8-byte struct offsets. On systems physically equipped with these MELFAS touch controllers, a locally privileged attacker can trigger multi-touch input processing that causes the driver to read kernel memory from incorrect offsets, potentially exposing sensitive data or corrupting kernel state. No public exploit or active exploitation has been identified; EPSS stands at 0.21%, reflecting negligible widespread exploitation risk at time of analysis.
Host memory disclosure to a remote RDMA peer in the Linux kernel's RDMA/rtrs-srv (RTRS server) transport allows a connected peer to read beyond a mapped chunk buffer. When answering an RTRS READ, rdma_write_sg() set the outbound RDMA-Write source-SGE length directly from the attacker-controlled wire descriptor field desc[0].len, which was only rejected when zero, and used the PD-wide local_dma_lkey rather than the chunk's own MR, so the verbs layer never constrained the transfer to max_chunk_size. A peer advertising a length larger than the chunk can force the posted RDMA write to read past the chunk into adjacent host memory (disclosed back to the peer under passthrough/no-IOMMU configs) or trigger a translation fault that aborts the connection. No public exploit identified at time of analysis and EPSS is low (0.21%).
A use-after-free in the FUSE subsystem of the Linux kernel allows a local attacker with permission to mount a FUSE filesystem to escalate privileges or crash the system. The vulnerability exists in fuse_ref_folio() due to improper request locking, and affects kernel versions from 2.6.35 through unpatched longterm branches. Patches are available, and no active exploitation or public exploit code has been identified.
Local privilege escalation in the Linux kernel FUSE subsystem allows a low-privileged attacker to corrupt kernel memory
Local privilege escalation in the Linux kernel's fuse-uring subsystem allows a local attacker to trigger a use-after-free condition by racing with the async stop queues function, potentially resulting in arbitrary code execution and complete system compromise. The vulnerability affects Linux kernel versions 6.14 through 6.18.x (patched in 6.18.39, 7.1.4,
A race condition in the Linux kernel's fuse-uring subsystem allows a local user to achieve privilege escalation and full system compromise. The vulnerability, triggered by concurrent operations on the queue->stopped flag outside of locking, leads to a use-after
Use-after-free in the Linux kernel’s fuse-uring subsystem allows a local authenticated attacker to escalate privileges. The race condition occurs when a malicious userspace sends a commit SQE before the kernel completes the memcpy of request data, triggering a freed fuse_req to be reused. CVSS base score is 7.8 but EPSS probability is low (0.21%), and no public exploit or active exploitation has been reported.
Memory exposure and denial of service in the Linux kernel SMB client allows remote attackers to read kernel memory or crash the system via crafted SMB2 responses. The vulnerability exists in versions prior to the patched releases, affecting all systems mounting SMB shares from untrusted servers. No authentication or user interaction is required, and while no active exploitation is reported, the high CVSS score reflects the serious confidentiality and availability impact.
HTTP request smuggling in libsoup (GNOME's HTTP client/server library) enables network-accessible attackers to inject hidden requests into backend streams by exploiting a parsing differential between libsoup's permissive chunked transfer encoding parser and strict RFC 9112-compliant frontend proxies. All libsoup versions are affected as tracked under CPE cpe:2.3:a:gnome:libsoup, with confirmed vendor impact across Red Hat Enterprise Linux 6.0 through 10.0. No public exploit code or active exploitation has been identified at time of analysis; SSVC classifies exploitation as none with non-automatable, partial technical impact.
Apache Thrift C++ library's THeaderTransport::readString() fails to properly validate info-header length, allowing an out-of-bounds read. An attacker sending a specially crafted Thrift message can trigger this to read beyond the buffer, potentially leaking sensitive memory contents. Remote unauthenticated exploitation is possible against any service using vulnerable bindings, and the issue is fixed in version 0.24.0.
Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU resources via crafted requests that trigger quadratic-time processing in the receive transport. No active exploitation or public exploit is known at