Intel

Symlink-based file clobbering in the Linux kernel's intel-speed-select daemon allows a local low-privileged user to redirect root-process writes to an attacker-chosen file by pre-positioning a symlink at the daemon's fixed /tmp pidfile path. Affected systems are those running Linux 5.18 through unpatched 6.x and 7.x branches on Intel Speed Select Technology hardware with the daemon active. No public exploit is identified at time of analysis and EPSS is low (0.17%, 7th percentile), but the attack is mechanically simple and requires only a local shell account.

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") added an iounmap(dev->msix_base) on the error path of msix_capability_init() to release the MSI-X region when msix_setup_interrupts() fails. When msix_setup_interrupts() fails, the call chain is: msix_setup_interrupts() -> __msix_setup_interrupts() struct pci_dev *dev __free(free_msi_irqs) = __dev; ... return ret; // __free cleanup fires on error The __free(free_msi_irqs) cleanup calls pci_free_msi_irqs(), which already handles the unmap: void pci_free_msi_irqs(struct pci_dev *dev) { pci_msi_teardown_msi_irqs(dev); if (dev->msix_base) { iounmap(dev->msix_base); // already unmapped here dev->msix_base = NULL; // and set to NULL } } So dev->msix_base is unmapped and set to NULL before msix_setup_interrupts() returns to msix_capability_init(). The "goto out_unmap" introduced by commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") then calls iounmap() a second time on a NULL pointer. This was reproduced on Intel Emerald Rapids (192 CPUs) while running tools/testing/selftests/kexec/test_kexec_jump.sh: WARNING: CPU#44 at iounmap+0x2a/0xe0 RIP: 0010:iounmap+0x2a/0xe0 RDI: 0000000000000000 Call Trace: msix_capability_init+0x317/0x3f0 __pci_enable_msix_range+0x21d/0x2c0 pci_alloc_irq_vectors_affinity+0xa9/0x130 nvme_setup_io_queues+0x2a8/0x420 [nvme] nvme_reset_work+0x151/0x340 [nvme] ... RDI=0 confirms iounmap() is called with NULL. Restore the original "goto out_disable" and leave the unmap to the existing __free(free_msi_irqs) cleanup.

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix memory leak in exec_queue_set_hang_replay_state() The q->replay_state is blindly overwritten, which can potentially leak memory that was previously allocated by vmemdup_user(). Return an error if q->replay_state is not empty. Discovered using AI-assisted static analysis confirmed by Intel Product Security. (cherry picked from commit f6b6cc1118bdbc4265fa8b3bdf8565b26f13e56e)

Incorrect TLB flush address targeting in the Linux kernel's zap_pte_range memory management function exposes systems running kernel versions prior to 7.1.9 and 7.2 to local privilege escalation and information disclosure, particularly on AMD systems with EFER.TCE enabled and Intel systems using INVPCID. A low-privileged local attacker can exploit a race where the kernel flushes the wrong virtual address after freeing a page table, leaving stale CPU paging-structure-cache entries that can be speculatively accessed or cause the freed table to be reused with potentially attacker-controlled data. No public exploit code or active exploitation (CISA KEV) has been confirmed at time of analysis, and the 0.20% EPSS score reflects the complexity of reliable exploitation.

In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/tpmi: use cleanup helpers in mem_write() In mem_write(), the temporary array returned by parse_int_array_user() must be released on all exit paths. Convert the array variable to use cleanup.h scope-based cleanup so it is freed automatically on return. This also moves the array declaration next to parse_int_array_user() as required by cleanup.h usage guidelines.

Server-side request forgery and local file read in the OpenSearch Security Analytics plugin exposes authenticated users with low privileges as a vector for internal network reconnaissance and credential theft. The flaw resides in the threat intelligence feed parser, which fails to validate URL parameters submitted to the threat intel source configuration endpoint, allowing a crafted request to redirect server-side HTTP fetches to internal resources - including cloud metadata endpoints. Patch is confirmed available per Amazon's security bulletin AWS-2026-079; no public exploit code has been identified at time of analysis.

Kernel information disclosure and local denial of service affect Zephyr RTOS on Intel ALH-equipped hardware through an unvalidated stream_id parameter in the Intel ALH digital-audio-interface driver. A local user-mode thread holding explicit ALH device-object access can invoke the dai_get_properties_copy() syscall with an arbitrary stream_id, triggering an out-of-bounds read from the fixed 64-entry alh_handshake_map[] array and leaking one byte of kernel memory per call, along with a computed FIFO register address that can expose kernel address-space layout. No public exploit has been identified at time of analysis; exploitation is constrained to systems built with CONFIG_USERSPACE and where device-object access has been deliberately granted to untrusted threads.

Transient execution information disclosure in Intel processors allows a Ring 0 (kernel or hypervisor level) adversary to leak sensitive data across security boundaries into a subsequent system context. The flaw stems from incorrect data forwarding during speculative execution, a class of hardware-level side-channel vulnerability similar to Spectre-class attacks, requiring local access with high privileges and high attack complexity. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, successful exploitation enables high-confidentiality-impact cross-boundary data exposure, threatening hypervisor isolation guarantees critical in virtualized and cloud environments.

Firmware improper input validation in Intel Xeon processors enables a highly privileged local adversary operating within System Management Mode (SMM) or startup code context to alter the integrity of subsequent system components. The CVSS 4.0 vector confirms local-only access (AV:L), high complexity (AC:H), presence-required attack conditions (AT:P), and a high-privilege prerequisite (PR:H), with zero confidentiality or availability impact - only downstream integrity degradation (SI:H). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, placing real-world exploitation risk firmly in the advanced persistent threat category rather than opportunistic attack.

Incomplete cleanup (CWE-459) in UEFI firmware for select Intel reference platforms allows a high-privileged local system software adversary to read sensitive residual data that was not properly purged from firmware memory or registers, resulting in high confidentiality impact on the subsequent system layer. The vulnerability requires specific attack conditions (AT:P) and is scoped to Intel reference platforms identified in advisory INTEL-SA-01437. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Privilege escalation in Intel(R) Transfer Learning Tool before version v0.7 stems from a protection mechanism failure (CWE-693) within the Ring 3 user application layer, enabling unauthenticated remote attackers to elevate privileges under specific attack conditions. The flaw affects confidentiality, integrity, and availability at a low severity each, with no subsequent system-level impact confirmed. No public exploit code or CISA KEV listing exists at time of analysis, and Intel has published advisory INTEL-SA-01499 addressing this issue.

Intel Software Guard Extensions Data Center Attestation Primitives (SGX DCAP), operating at Ring 0 kernel privilege level, omits security-relevant information during attestation operations, enabling a privileged local attacker under high-complexity conditions to cause denial of service and high-integrity data alteration on downstream systems relying on attestation output. The SI:H subsequent-system integrity impact is the critical concern: systems that consume SGX attestation results - cloud orchestrators, confidential VM managers, or trust brokers - may accept manipulated evidence, undermining the core trust guarantees of confidential computing infrastructure. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H and AC:H prerequisites substantially constrain the realistic attacker pool.

Privilege escalation in Intel Processors operating within Ring 0 environments - kernel, hypervisor, and bare-metal OS - allows an authorized attacker already holding high-privilege access to cross isolation boundaries and achieve high confidentiality and integrity impact on subsequent systems such as hypervisors or co-located virtual machines. The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:H/SC:H/SI:H) confirms the attack is local, high-complexity, and gated behind existing privileged access plus special internal knowledge of processor internals, significantly limiting the exploitable population. No public exploit code and no CISA KEV listing exist at time of analysis, making current real-world risk primarily theoretical but relevant to hardened multi-tenant and virtualized datacenter environments.

Deserialization of untrusted data in Intel Extension for PyTorch (IPEX) versions before 2.8.0 enables local privilege escalation when a victim user opens a maliciously crafted serialized artifact within an IPEX-dependent application. The vulnerability operates at Ring 3 (user-space) and yields low confidentiality, integrity, and availability impact with no subsequent system-level compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Privilege escalation in Intel Performance Counter Monitor (PCM) before version tag 202604 allows a local authenticated attacker to gain elevated privileges via an untrusted search path (CWE-426) within Ring 3 user-space applications. The attack requires high complexity and passive interaction from a privileged user, producing full high-impact confidentiality, integrity, and availability compromise of the vulnerable system. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Insufficient access control granularity in a subsystem of Intel Xeon 6 Scalable processors with Trust Domain Extensions (TDX) enables cross-domain information disclosure. The flaw, classified under CWE-1220, allows an authenticated local adversary with specialized knowledge of processor internals to leak confidential data belonging to a co-resident trust domain or protected virtual machine, while leaving integrity and availability of all systems untouched. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the CVSS 4.0 scope-change pattern (VC:N/SC:H) signals a meaningful cross-trust-domain confidentiality risk specifically in confidential computing deployments.

Privilege escalation in Intel Xeon 6 processors arises from improper handling of overlapping protected memory ranges when Intel Trust Domain Extensions (TDX) operate within System Management Mode (SMM). An adversary who has already achieved SMM-level access and combines that foothold with a high-complexity, knowledge-intensive attack can break the isolation guarantees that TDX is designed to enforce, achieving unauthorized reads and writes of confidential memory. No public exploit code and no CISA KEV listing are associated with this issue at time of analysis, but the high confidentiality and integrity impact to the vulnerable system makes it significant for confidential-computing deployments.

Insufficient data authenticity verification within Intel Trust Domain Extensions (Intel TDX) at Ring 0 (hypervisor privilege level) enables information disclosure under a high-complexity, locally-mounted attack. A system software adversary already holding hypervisor-level privileges can exploit CWE-345 conditions to expose sensitive Trust Domain memory contents, achieving high confidentiality impact on the vulnerable system with limited integrity effects on both the vulnerable and subsequent systems. No public exploit code exists and this vulnerability has not been listed in CISA KEV, with the vendor-confirmed CVSS 4.0 score of 5.6 (Medium) accurately reflecting the constrained attack profile.

Privilege escalation in Intel Workload Services Framework software affects the Ring 3 user-application layer, where a protection mechanism failure (CWE-693) allows an unprivileged process to gain elevated privileges when a concurrently active privileged user provides passive interaction. The attack is local, requires attack prerequisites to be met (AT:P per CVSS 4.0), and achieves full compromise of the vulnerable system's confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis; this is a vendor-disclosed advisory via INTEL-SA-01467.

Integer overflow in Intel Slim Bootloader UEFI firmware exposes systems to limited information disclosure and denial of service. Exploitation requires local, authenticated access with active user interaction, yielding only low-impact confidentiality and availability consequences with no integrity impact. No active exploitation has been identified; the CVSS 4.0 score of 2.4 reflects the constrained exploitation conditions and limited blast radius.

Improper input validation in the vLLM Hardware Plugin for Intel Gaudi software (versions before 0.16.0) allows a locally authenticated user to cause a denial of service, crashing or degrading availability of the affected system. The vulnerability operates within Ring 3 (user application space) and requires only low-privilege local access with no user interaction, making it viable for insider threat or compromised-account scenarios. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis; Intel has released a fix in version 0.16.0.

Out-of-bounds write (CWE-787) in Intel Slim Bootloader firmware enables a denial of service condition on the local system. Exploitation requires a privileged local account and the presence of specific attack preconditions (AT:P per CVSS 4.0), and impact is confined to low availability on the vulnerable system with no confidentiality or integrity consequences. Intel disclosed this issue through advisory INTEL-SA-01475 with a CVSS 4.0 base score of 1.8; no public exploit code exists and no CISA KEV listing has been identified at time of analysis.

Kernel-mode stack overflow in Intel PROSet/Wireless WiFi Software for Windows allows adjacent unauthenticated attackers to crash affected systems, resulting in a full system denial of service. The flaw resides in Ring 0 (kernel privilege level) WiFi driver code, meaning a successful exploit triggers a kernel panic or Blue Screen of Death rather than a user-space crash. No public exploit or CISA KEV listing has been identified at time of analysis, and no exact patched version is confirmed in the available reference data - the Intel advisory INTEL-SA-01468 should be consulted directly.

Privilege escalation in Intel(R) oneCCL Bindings for PyTorch before v2.8.0 stems from a protection mechanism failure (CWE-693) in Ring 3 user application space, enabling a local adversary - operating in conjunction with a high-privilege user through passive interaction - to escalate privileges with full confidentiality, integrity, and availability impact on the vulnerable system. The CVSS 4.0 score of 5.4 reflects meaningful exploitation constraints: specific attack requirements must be present (AT:P), high privileges are already required (PR:H), and passive interaction from a privileged user is needed (UI:P). No public exploit code or CISA KEV active exploitation listing has been identified at time of analysis.

Use-after-free in the kernel-mode (Ring 0) driver component of Intel PROSet/Wireless WiFi Software for Windows enables a local denial-of-service condition by crashing the affected system. The flaw resides in the most privileged execution ring on x86/x64, meaning a successful trigger causes a kernel panic (BSOD) with no containment boundary below the OS. No active exploitation has been confirmed by CISA KEV, no public exploit code has been identified at time of analysis, and the combination of local-only access with high attack complexity substantially constrains real-world risk.

Kernel-mode denial of service in Intel PROSet/Wireless WiFi Software for Windows allows an adjacent unauthenticated attacker to crash the target system by triggering an improper buffer restriction in the Ring 0 (kernel-level) WiFi driver component. The vulnerability carries a CVSS 4.0 score of 8.3, requires no authentication or user interaction, and is confined to adjacent-network attackers. Intel has acknowledged the issue via security advisory INTEL-SA-01468; no public exploit code exists and no CISA KEV listing has been identified at time of analysis.

Privilege escalation in Intel AI Reference Models before v3.4.1 stems from a protection mechanism failure (CWE-693) within Ring 3 user-space applications, allowing unprivileged software to gain elevated access when a privileged user is passively present under specific deployment conditions. The vulnerability carries full confidentiality, integrity, and availability impact on the vulnerable system, though scope is contained with no subsequent-system impact. No public exploit has been identified at time of analysis; Intel has issued a fix in version v3.4.1 per advisory INTEL-SA-01432.

Heap-based buffer overflow in Intel Open Volume Kernel Library (Open VKL) before version 2.0.2 allows a local authenticated attacker with low privileges to cause denial of service against applications consuming the library. Operating entirely in Ring 3 (user space), the flaw requires no user interaction and carries low attack complexity, making it straightforward to trigger for any local account on an affected system. No public exploit code and no active exploitation have been identified; Intel has released version 2.0.2 as the corrective fix per advisory INTEL-SA-01459.

Privilege escalation affects Intel's LLM Library for PyTorch operating within Ring 3 (user application space) due to a protection mechanism failure (CWE-693). An adversary with access to an unprivileged software context, combined with the presence of a privileged user and passive user interaction, can exploit this flaw locally to gain elevated privileges with high impact on confidentiality, integrity, and availability. No public exploit code or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 5.4 reflects the restrictive local access and high-privilege prerequisites that limit real-world exploitability.

Privilege escalation in Intel Neural Compressor software before v3.7 stems from improper input validation within Ring 3 (user application space), allowing a locally authenticated low-privileged user to elevate privileges on the affected host. The CVSS 4.0 vector confirms local access with low complexity, no special attack requirements, and no user interaction needed - meaning exploitation is straightforward once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to the vulnerable system with no lateral scope change.

Denial of service via a TOCTOU race condition in the Intel NPU Driver for Windows affects all current versions operating at Ring 1 (device driver layer). An authenticated local attacker with low privileges can exploit a window between the driver's resource state check and its use, resulting in high availability impact and low integrity impact to the vulnerable system. No active exploitation has been confirmed, and the high attack complexity plus specific attack prerequisites substantially limit opportunistic exploitation.

Privilege escalation in Intel Neural Compressor software before v3.6 stems from a protection mechanism failure (CWE-693) within the Ring 3 user-application layer. A local attacker operating with high privileges, in conjunction with specific attack requirements and passive user interaction, can exploit this flaw to elevate privileges with high confidentiality, integrity, and availability impact on the vulnerable system. Intel has issued advisory INTEL-SA-01454 and released v3.6 as the remediated version; no public exploit code or active exploitation has been identified at time of analysis.

Privilege escalation in Intel AI Containers before v0.4.0 exposes a protection mechanism failure (CWE-693) within the Ring 3 user application layer, enabling a local attacker already holding high privileges to further escalate privileges with full confidentiality, integrity, and availability impact on the vulnerable system. Exploitation requires passive user interaction and specific attack conditions (AT:P), substantially limiting the realistic attack population to multi-tenant AI container deployments where privileged users must be constrained. No public exploit code has been identified and this vulnerability does not appear in CISA KEV at time of analysis.

Privilege escalation in the Alias Checking Trusted Module (ACTM) firmware for certain Intel Xeon processors allows a local privileged attacker to escalate to System Management Mode (SMM) execution, achieving high confidentiality and integrity impact across both the directly compromised system and subsequent systems such as co-hosted hypervisors or tenant workloads. The attack requires high-complexity local technique combined with pre-existing privileged user access, placing it firmly in the advanced persistent threat actor category. No public exploit has been identified at time of analysis, and Intel has published advisory INTEL-SA-01439 to address this firmware flaw.

Local privilege escalation in Intel PROSet/Wireless WiFi Software for Windows allows unprivileged local code execution by exploiting improper authentication within the device driver layer. An attacker with only local access and no required privileges can bypass authentication checks in the Ring-2 driver tier, ultimately achieving code execution that results in high confidentiality impact on the broader host system alongside low integrity and availability impacts. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows allows local unprivileged code operating within the Ring 2 privileged process boundary to elevate access rights due to improper privilege management (CWE-269), yielding high availability impact and limited confidentiality and integrity exposure on both the vulnerable and subsequent systems. The attack is constrained to local access and requires high complexity, but no prior authentication or user interaction is needed from the attacker. Intel has published advisory INTEL-SA-01468 to address this flaw; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Out-of-bounds write in Intel PROSet/Wireless WiFi Software for Windows (Ring 2: Device Drivers) enables a denial-of-service condition exploitable from adjacent network position without authentication. The memory corruption flaw in the Windows WiFi driver stack can be triggered with passive user interaction, causing high availability impact to the vulnerable system and a residual low availability impact to subsequently connected systems. No public exploit code has been identified at time of analysis, and Intel has published advisory INTEL-SA-01422 addressing this issue.

Improper authentication (CWE-287) in Intel's Trust Domain Extensions (TDX) module allows a Ring-0 system software adversary with high privileges to breach Trust Domain isolation boundaries, enabling information disclosure and privilege escalation. Affects select Intel platforms running TDX with a high-complexity, locally-executed attack path - no user interaction required. No public exploit identified at time of analysis, but the confidential-computing trust model is fundamentally undermined if exploited: an adversary with hypervisor-level access could read or modify memory intended to be protected from exactly that privilege tier.

Denial of service in Intel PROSet/Wireless WiFi Software for Windows stems from a null pointer dereference (CWE-476) in the Ring 2 device driver layer, allowing an adjacent unauthenticated attacker to crash the affected system with no user interaction required. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VA:H) confirms low-complexity exploitation from the same network segment, resulting in high availability impact to the vulnerable system and residual low availability impact to subsequent systems. No public exploit code or CISA KEV entry has been identified at time of analysis, though the absence of authentication and interaction requirements makes this trivially triggerable by any adjacent network adversary.

Denial of service in Intel PROSet/Wireless WiFi Software for Windows stems from improper buffer restrictions (CWE-119) in the Ring 2 device driver layer, exploitable by an adjacent network attacker without authentication or user interaction. An attacker within Wi-Fi range or on the same network segment can trigger a driver-level crash by sending crafted wireless input, resulting in high availability impact on the target system and low availability impact on subsequent systems, with no confidentiality or integrity consequences. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.

Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows exposes local systems to code execution by unprivileged attackers via a Ring 2 (device driver layer) improper access control flaw. Any local process with no privileges required and no user interaction can leverage the driver's failure to enforce access boundaries to achieve local code execution, with follow-on high confidentiality impact on the broader system - consistent with a kernel-level scope change. No public exploit identified at time of analysis, and no CISA KEV listing; however, the low complexity and zero-privilege requirement make this a credible post-compromise escalation vector for threat actors with any form of local code execution already established.

Null pointer dereference in Intel PROSet/Wireless WiFi Software for Windows at the Ring 2 device driver layer enables denial of service by an unauthenticated adjacent-network attacker. Disclosed by Intel in advisory INTEL-SA-01422, the flaw affects all currently indexed versions of the software and can be triggered at low complexity with no user interaction or special attack prerequisites. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Out-of-bounds read in the Intel Neural Processing Unit (NPU) Driver across all versions exposes systems to local denial of service via a low-privilege authenticated attacker operating in Ring 3 (user application space). The CVSS 4.0 score of 6.9 reflects high availability impact with a local, low-complexity, no-interaction attack path, alongside minor integrity degradation. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.

Denial of service in the Intel NPU Driver firmware (all versions) is achievable by any local authenticated low-privileged user through an improper conditions check (CWE-754) in the Ring 1 device driver layer. The flaw allows an unprivileged software process operating under an authenticated user context to trigger a high-availability-impact disruption - likely a driver crash or system hang - with no attack requirements and no user interaction beyond the attacker's own actions. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low complexity and minimal privilege bar make it straightforward to exploit on any affected Intel Core Ultra system where the NPU driver is loaded.

Uncontrolled resource consumption in the Intel PROSet/Wireless WiFi Software for Windows device driver (Ring 2) enables a local denial-of-service condition triggerable by an unprivileged process. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) confirms a low-complexity, local-access scenario requiring no authentication and no user interaction, with high availability impact on the vulnerable system and a secondary low availability impact on the subsequent system. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Out-of-bounds read in the kernel-mode (Ring 0) component of Intel PROSet/Wireless WiFi Software for Windows enables a denial-of-service condition against affected Windows hosts. An unauthenticated attacker with adjacent network access and the ability to satisfy specific attack requirements can trigger a kernel-level crash, resulting in high availability impact to both the vulnerable system and any subsequent system processes. No public exploit code has been identified at time of analysis, and this CVE has not been listed in the CISA Known Exploited Vulnerabilities catalog.

Denial of service in Intel PROSet/Wireless WiFi Software affects the Ring 2 device driver layer, where an improper conditions check (CWE-754) can be triggered by an adjacent, unauthenticated attacker with no user interaction required. The vulnerability collapses wireless availability on the affected host and, per the CVSS 4.0 vector, cascades to subsequent system availability as well, meaning dependent network-connected services may also be disrupted. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Denial of service in Intel TDX (Trust Domain Extensions) modules at Ring 0 can be triggered by a system software adversary who already holds kernel-level privileges, causing an uncaught exception that crashes Trust Domain availability. Exploitation is constrained to local access with high attack complexity and specific attack prerequisites, meaning only highly privileged, sophisticated actors in TDX-enabled environments are realistic threat actors. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the impact is limited strictly to availability - no confidentiality or integrity compromise is possible through this vector.

Denial of service in Intel(R) NPU Driver affects all versions via an improper conditions check (CWE-754) reachable from Ring 3 (user applications). A locally authenticated, low-privileged user can trigger the flaw without any special attack prerequisites or user interaction, resulting in high availability impact to the vulnerable system. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the low complexity of exploitation combined with the growing deployment of NPU-equipped Intel platforms warrants prompt patching.

Privilege escalation in Intel TDX Guest software before version 0.3.1 stems from an incorrect comparison (CWE-697) within Ring 3 user application space, exploitable by a local attacker who already holds high system privileges. Impact is limited - low confidentiality, integrity, and availability degradation on the vulnerable guest system with no subsequent system impact - aligning with the CVSS 4.0 score of 4.6. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Intel has released a fix at version 0.3.1 via advisory INTEL-SA-01462.

Privilege escalation in Intel TDX Guest software before version 0.3.1 stems from an incorrect calculation (CWE-682) within Ring 3 user application code, enabling a local, high-privilege adversary to elevate privileges within a Trust Domain. The CVSS 4.0 vector confirms local access with high privileges required and low C/I/A impact on the vulnerable system, with no subsequent-system (host/hypervisor) impact. No public exploit exists and the vulnerability is absent from CISA KEV, placing real-world risk squarely in multi-tenant confidential computing scenarios where intra-guest privilege containment is a security objective.

Privilege escalation in Intel processor microcode stems from improper handling of overlap between protected memory ranges at the Ring 0 hypervisor privilege level, tracked as CVE-2026-20760 and EUVD-2026-56489. Exploitation requires local, low-privilege access to a system running an affected Intel processor, allowing an authorized adversary to escalate privileges or disrupt hypervisor availability without user interaction. Intel has published advisory INTEL-SA-01441 covering this issue; no active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, though the hypervisor-level attack surface warrants priority treatment in virtualized environments.

Information disclosure in Intel PROSet/Wireless WiFi Software at Ring 0 (kernel level) exposes sensitive system data to privileged local adversaries who bypass improper authentication controls within the kernel driver. Affected systems include any platform running Intel PROSet/Wireless WiFi Software, with the exact version range deferred to Intel Security Advisory INTEL-SA-01468. No active exploitation has been confirmed (not listed in CISA KEV), no public exploit code has been identified, and the CVSS 4.0 base score of 6.7 reflects the significant mitigation offered by the high-privilege local access prerequisite.

Out-of-bounds read in Intel PROSet/Wireless WiFi Software at the Ring 2 device driver layer allows adjacent network attackers without authentication to escalate privileges on affected Windows systems. The flaw, tracked under CWE-125, can be triggered by a low-complexity attack from the same WiFi segment or Layer 2 broadcast domain, requiring no user interaction, and yields High availability impact alongside Low confidentiality and integrity exposure. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the unauthenticated adjacent attack surface is meaningful for enterprise mobile workforces on untrusted networks.

Denial of service in Intel PROSet/Wireless WiFi Software device drivers (Ring 2) allows an unauthenticated adjacent-network attacker to crash or disable the wireless subsystem on affected systems. The flaw stems from an improper conditions check (CWE-754) within the WiFi driver stack, meaning edge-case or malformed network input is not handled safely, leading to complete availability loss of the vulnerable system. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low-complexity, zero-privilege attack vector makes this straightforward to trigger from WiFi range.

Out-of-bounds write in Intel PROSet/Wireless WiFi Software for Windows device drivers (Ring 2) allows adjacent network attackers to trigger a denial of service condition without authentication or user interaction. Unauthenticated attackers on the same network segment can exploit this CWE-787 buffer overflow flaw with low complexity, causing high availability impact to the affected Windows system and low residual availability impact on subsequent systems. No public exploit code and no CISA KEV listing exist at time of analysis.

Improper access control in Intel PROSet/Wireless WiFi Software device drivers (Ring 2) allows a local unprivileged process to cause a denial of service affecting both the wireless subsystem and, to a lesser extent, downstream system integrity. Affected systems running Intel wireless drivers are exposed to any unprivileged local code - no authentication, no elevated privileges, and no user interaction are required. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.

Denial-of-service in Intel PROSet/Wireless WiFi Software for Windows (Ring 2 device driver layer) allows an unauthenticated adjacent-network attacker to crash or disable the wireless driver with no user interaction. The flaw stems from an improper conditions check (CWE-754) in the driver, yielding complete loss of wireless availability on the affected system and minor downstream availability impact on subsequently connected systems. No public exploit or CISA KEV listing exists at time of analysis, and Intel has published an advisory at INTEL-SA-01422.

Local privilege escalation and code execution in Intel PROSet/Wireless WiFi Software for Windows arises from an information disclosure flaw (CWE-200) within the Ring 2 device driver layer, exploitable by an unprivileged local user without authentication or user interaction. The vulnerable system itself suffers only low confidentiality impact, but a scope change into the driver subsystem produces high subsequent-system confidentiality impact alongside low integrity and availability impacts - consistent with a privilege escalation chain from user space into driver-controlled memory. No public exploit has been identified at time of analysis and the vulnerability has not been listed in the CISA KEV catalog.

Intel Active Management Technology (Intel AMT) and Intel Standard Manageability firmware contain an improper initialization flaw (CWE-665) that enables confidentiality compromise by a locally privileged system software adversary. The vulnerability arises when firmware fails to properly initialize memory or state, allowing residual data to be read by a subsequent privileged operation under specific attack conditions (AT:P per CVSS 4.0). No CISA KEV listing exists and no public proof-of-concept has been identified; Intel reported this through their own security advisory program (INTEL-SA-01427) and the CVSS 4.0 base score of 5.6 reflects the constrained local, high-privilege exploitation prerequisites.

Improper buffer restrictions in the Intel NPU Driver (Ring 3: User Applications) expose all driver versions to a denial-of-service condition triggerable by a local, low-privileged authenticated user. The CVSS 4.0 vector confirms local-only access (AV:L/PR:L) with high availability impact (VA:H) and a minor integrity side-effect (VI:L), but no confidentiality loss. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, which tempers real-world urgency despite the potentially system-disrupting availability impact.

Privilege escalation in Intel Extension for TensorFlow software before version 2.15.0.3 stems from a protection mechanism failure (CWE-693) operating at Ring 3 - the CPU user-application privilege boundary. A system software adversary holding high privileges can exploit this failure under specific local attack conditions with passive user interaction to achieve full confidentiality, integrity, and availability compromise of the vulnerable system. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.

Intel PROSet/Wireless WiFi Software for Windows contains a null pointer dereference in Ring 0 (kernel space) that an adjacent, unauthenticated attacker can exploit to crash the target system, resulting in a denial of service. The flaw resides in the WiFi kernel driver, meaning a successful trigger causes a kernel panic (BSOD on Windows) with high availability impact on both the vulnerable component and the broader system. No public exploit code has been identified at time of analysis, and no KEV listing exists, but the adjacent-network attack vector and zero-privilege requirement make this relevant for any environment where untrusted parties share a wireless segment with Intel WiFi-equipped Windows endpoints.

Improper access control within Ring 3 (user application space) of Intel processors permits privilege escalation from authenticated local user-level access to higher system privilege levels, with high confidentiality and integrity impact on the vulnerable system. Exploitation demands local access, low-privilege authentication, high attack complexity, and specialized internal knowledge of Intel processor microarchitecture internals - substantially narrowing the realistic attacker population. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, consistent with a threat relevant primarily to sophisticated, targeted adversaries.

Denial of service via improper input validation in Intel Active Management Technology (AMT) and Intel Standard Manageability firmware allows unauthenticated network-adjacent attackers to disrupt the out-of-band management interface. The CVSS 4.0 AT:P designation confirms that specific prerequisites - namely AMT being provisioned and network-accessible - must independently exist before exploitation is possible. No public exploit has been identified at time of analysis, and Intel has disclosed the issue under advisory INTEL-SA-01427.

Privilege escalation in Intel Xeon processor firmware stems from an always-incorrect control flow implementation (CWE-670) that allows a privileged system software adversary to escalate privileges under high-complexity local attack conditions. Exploitation yields subsequent-system impacts - high confidentiality and high integrity compromise - while leaving the vulnerable system itself unimpacted, consistent with a scope change into a higher-privilege domain such as an OS kernel or hypervisor. No active exploitation is confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.

Sensitive data insertion into log files in Intel Active Management Technology (AMT) and Intel Standard Manageability exposes confidential information to privileged network adversaries. The flaw is classified under CWE-532 and carries a CVSS 4.0 score of 5.9, with high confidentiality impact but no integrity or availability consequences. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the network-accessible attack vector and high confidentiality impact make patching a priority for organizations relying on Intel vPro out-of-band management infrastructure.

Hardware logic race conditions in 3rd Gen Intel Xeon Scalable Processors expose server environments to local denial of service. The flaw resides within Ring 3 (user-space) processor logic, where a low-privileged authenticated local user can exploit the race condition - provided they possess specialized internal knowledge of processor timing - to crash or destabilize the affected system. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS 4.0 score of 6.8 reflects the high availability impact across both the vulnerable system and any subsequent workloads sharing the hardware.

Insecure sensitive data storage in the Intel Trust Domain Extensions (TDX) module exposes confidential memory to privileged local adversaries on affected Intel platforms. The flaw, classified under CWE-922, allows a Ring-0 system software attacker - such as a compromised or malicious hypervisor or host OS kernel - to read data that should be protected within a Trust Domain, breaking TDX's core confidential computing isolation guarantee. No public exploit has been identified at time of analysis, and exploitation demands high privilege, high complexity, and specific attack prerequisites, materially constraining real-world risk despite the high confidentiality impact rating.

Protection mechanism failure in Intel Data Center Attestation Primitives (Intel DCAP) enables unauthenticated network-based attackers with specialized internal knowledge to undermine the integrity of the attestation system and expose confidential data from downstream systems relying on SGX enclave verification. The vulnerability (CWE-693) is particularly impactful in confidential computing environments where DCAP serves as the trust anchor for SGX workload isolation. No public exploit has been identified at time of analysis, and Intel has published advisory INTEL-SA-01449 addressing this issue.

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmu_destroy_caches() destroys pte_list_desc_cache and mmu_page_header_cache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor module is unloaded while kvm.ko remains loaded. If creation of pte_list_desc_cache fails during a subsequent vendor module load, its assignment sets pte_list_desc_cache to NULL and the error path calls mmu_destroy_caches(). mmu_page_header_cache still points to the cache destroyed during the preceding vendor module unload. Passing that stale pointer to kmem_cache_destroy() causes a slab use-after-free. Reproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y, CONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m. A one-shot test hook forces pte_list_desc_cache to NULL on the second invocation of kvm_mmu_vendor_module_init(): 1. Load kvm.ko and kvm-intel.ko, creating both caches. 2. Unload only kvm_intel, leaving kvm.ko loaded. 3. Reload kvm_intel and force initialization through the -ENOMEM path. KASAN reports: BUG: KASAN: slab-use-after-free in kvm_mmu_vendor_module_init+0x5b/0x170 [kvm] ... kmem_cache_destroy+0x21/0x1d0 kvm_mmu_vendor_module_init+0x5b/0x170 [kvm] ... Allocated by task 16817: __kmem_cache_create_args+0x12c/0x3b0 __kmem_cache_create.constprop.0+0xb6/0xf0 [kvm] kvm_mmu_vendor_module_init+0x13b/0x170 [kvm] ... Freed by task 16820: kmem_cache_destroy+0x117/0x1d0 kvm_mmu_vendor_module_exit+0x21/0x30 [kvm] Clear both pointers immediately after destroying their caches so that the stored state reflects the caches' lifetime and repeated cleanup is safe. With the fix applied, the same injected vendor module reload fails with -ENOMEM as expected and produces no KASAN report.

In the Linux kernel, the following vulnerability has been resolved: usb: core: port: Deattach Type-C connector on component unbind connector_unbind() is the mirror of connector_bind(), but it is missing the symmetric call to typec_deattach() that connector_bind() makes via: if (port_dev->child) typec_attach(port_dev->connector, &port_dev->child->dev); When a Thunderbolt dock is unplugged, two teardown paths race: 1. The component framework calls connector_unbind() first, which sets port_dev->connector = NULL without calling typec_deattach(). This leaves port->usb2_dev/port->usb3_dev in struct typec_port pointing at the USB device that is about to be freed. 2. usb_disconnect() then calls typec_deattach(port_dev->connector, ...), but port_dev->connector is already NULL, so the call is a no-op and port->usb2_dev is never cleared. 3. Concurrently, UCSI detects a PD partner-disconnect event and calls typec_unregister_partner(), which reads port->usb2_dev (now a dangling pointer to freed memory) and passes it to typec_partner_unlink_device() -> sysfs_remove_link() -> dev_name() on the freed device, corrupting the typec/UCSI partner state. This corruption leaves the Thunderbolt tunnel in an inconsistent state on the next dock hot-plug. On affected hardware the dock's I225/igc NIC fails to enumerate: AER fires a slot reset while the igc driver is still initialising ("PCIe link lost"), and the subsequent igc_reset attempt hits igc_rd32 on an already-detached device: igc 0000:2e:00.0 eth0: PCIe link lost, device now detached igc: Failed to read reg 0x0! WARNING: CPU: 9 PID: 129 at drivers/net/ethernet/intel/igc/igc_main.c:7005 igc_rd32+0xa4/0xc0 [igc] Call Trace: igc_disable_pcie_master+0x16/0xa0 [igc] igc_reset_hw_base+0x14/0x170 [igc] igc_reset+0x63/0x110 [igc] igc_io_slot_reset+0x9e/0xd0 [igc] report_slot_reset+0x5d/0xc0 pcie_do_recovery+0x209/0x400 aer_isr_one_error_type+0x235/0x430 aer_isr+0x4e/0x80 irq_thread+0xf4/0x1f0 4. UCSI later handles the PD partner-disconnect and calls typec_unregister_partner(), which still sees the stale port->usb2_dev and tries to remove its sysfs link a second time: kernfs: can not remove 'typec', no directory WARNING: CPU: 6 PID: 55 at fs/kernfs/dir.c:1706 kernfs_remove_by_name_ns+0xe9/0xf0 Workqueue: events ucsi_handle_connector_change [typec_ucsi] Call Trace: sysfs_remove_link+0x19/0x50 typec_unregister_partner+0x6e/0x120 [typec] ucsi_unregister_partner+0x107/0x150 [typec_ucsi] ucsi_handle_connector_change+0x3ec/0x490 [typec_ucsi] process_one_work+0x18e/0x3e0 worker_thread+0x2e3/0x420 kthread+0x10a/0x230 ret_from_fork+0x121/0x140 ret_from_fork_asm+0x1a/0x30 With worse timing the same stale pointer is dereferenced after the backing memory is freed, turning the warning into a use-after-free. Fix the asymmetry: call typec_deattach() before clearing port_dev->connector, matching what connector_bind() does on the bind side. typec_partner_deattach() is already protected by port->partner_link_lock, so it serialises safely with the concurrent typec_unregister_partner() path.

In the Linux kernel, the following vulnerability has been resolved: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() dmar_latency_disable() intends to zero out only the single latency_statistic entry for the given type, but the memset size was computed as sizeof(*lstat) * DMAR_LATENCY_NUM, which clears the entire array starting from &lstat[type]. When type > 0, this writes beyond the end of the allocated array, corrupting adjacent memory. Fix by using sizeof(*lstat) to clear only the target entry.

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Add missing nospec on parallel submit slot Add missing Spectre mitigation for userspace controlled parallel submission slot. Discovered using AI-assisted static analysis confirmed by Intel Product Security. (cherry picked from commit 15b9353deff3cf72331c387780de3cf9c316b643)

Out-of-bounds kernel memory access in the Linux drm/xe Intel GPU driver allows a local low-privileged user to read sensitive kernel memory, cause a kernel panic, or potentially corrupt kernel state. The flaw exists in the BO (buffer object) prefetch path of the Intel Xe GPU subsystem, where DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC (value -1) is incorrectly used as an array index into region_to_mem_type[], accessing memory before the array's base address. Discovered via AI-assisted static analysis confirmed by Intel Product Security; no public exploit or CISA KEV listing identified at time of analysis.

In the Linux kernel, the following vulnerability has been resolved: drm/i915/vrr: require valid min/max vfreq for VRR Ensure the EDID provided min/max vfreq are valid. Most scenarios are already covered (by coincidence) through the checks in intel_vrr_is_capable() and intel_vrr_is_in_range(), but be more explicit about it. At worst, a zero min_vfreq could lead to a division by zero in intel_vrr_compute_vmax(). Discovered using AI-assisted static analysis confirmed by Intel Product Security. (cherry picked from commit 1765cf59f517b02f3b0591fe5120930d08bddeb6)

Buffer overflow in the Intel i915 HDCP subsystem of the Linux kernel allows a local, low-privileged user to corrupt kernel memory with potential privilege escalation to full system compromise. The bounds check on the `data->streams[]` array write executes after the overrun has already occurred, meaning any caller who can trigger this code path can write past the array boundary before the kernel detects the violation. Discovered via AI-assisted static analysis and confirmed by Intel Product Security; no public exploit exists and EPSS probability is 0.18%, indicating no observed exploitation at time of analysis.

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Return NULL on error in active_instance Avoid returning &node->base when node is NULL due to OOM during GFP_ATOMIC allocation. Discovered using AI-assisted static analysis confirmed by Intel Product Security. (cherry picked from commit 6029bc064f0b1bac184203a50fbaaf070fa18832)

In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: range check LFP Data Block panel_type2 While the panel_type from LFP Data Block is range checked, panel_type2 is not. Add a few helpers for range checking, and use them to not only check panel_type2, but also improve clarity and correctness in the panel type selection. Discovered using AI-assisted static analysis confirmed by Intel Product Security. v2: - Fix commit message typo (Michał) - Add is_panel_type_pnp() (Ville) (cherry picked from commit c9ebe5d2f25729d6cfbbb1235d640bf67f9275df)

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Do not leak siblings[] on proto context error After a successful BALANCE/PARALLEL_SUBMIT extension on context creation, error during processing of next user extension leaks the siblings[] array. Fix that. Discovered using AI-assisted static analysis confirmed by Intel Product Security. (cherry picked from commit aa65e0a4b51b3b54b53e4142aaa2d997aa1061ff)

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU Setting context engine slot N into I915_ENGINE_CLASS_INVALID / I915_ENGINE_CLASS_INVALID_NONE and attempting to apply I915_CONTEXT_PARAM_SSEU to the same slot N will deref NULL. Fix that. Discovered using AI-assisted static analysis confirmed by Intel Product Security. (cherry picked from commit 36eda5b5c2d40da41cc0a5403c26986237cf9e87)

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix NULL deref on sched_engine alloc failure Avoid using intel_context_put() before intel_context_init() in execlists_create_virtual() as the kref_put() inside would lead to NULL deref on the IOCTL path when sched_engine allocation fails. Discovered using AI-assisted static analysis confirmed by Intel Product Security. (cherry picked from commit 4f2a12f2d50e9f48227656e4dcbd6423506be31d)

In the Linux kernel, the following vulnerability has been resolved: drm/i915/mst: limit DP MST ESI service loop The loop in intel_dp_check_mst_status() keeps servicing interrupts originating from the sink without bound. Add an upper bound to the new interrupts occurring during interrupt processing to not get stuck on potentially stuck sink devices. Use arbitrary 32 tries to clear incoming interrupts in one go. Discovered using AI-assisted static analysis confirmed by Intel Product Security. Note: The condition likely pre-dates the commit in the Fixes: tag, but this is about as far back as a backport has any chance of succeeding. Before that, the retry had a goto. (cherry picked from commit b4ea5272133059acb493cc36599071a9e852ec2e)

Out-of-bounds bitmap write in the Linux kernel's Intel ICE SR-IOV driver allows a malicious Virtual Function guest to crash the host kernel or potentially escalate privileges to the host. The vulnerable function ice_parser_profile_init unconditionally passes caller-controlled ptype values from VIRTCHNL_OP_ADD_RSS_CFG into set_bit() against a statically sized 1024-bit bitmap, permitting a value such as 0xffff to write beyond the bitmap boundary and trigger a kernel NULL pointer dereference. No public exploit code has been identified and EPSS exploitation probability is low at 0.18%, but the CVSS 8.8 score and confirmed crash reproducibility signal real urgency for SR-IOV multi-tenant environments where stable-branch patches are already available.

Unbounded retry loops in BC-FJA's JNI native entropy layer cause calling threads to hang indefinitely when Intel RDSEED or RDRAND instructions persistently fail, producing a non-interruptible thread-level denial of service in any Java FIPS application backed by bc-fips 2.1.x before 2.1.3. The affected JNI seeding routine re-issues the CPU entropy instruction without any iteration limit whenever the carry flag signals failure - a condition reproducible by hardware entropy source faults, DRBG exhaustion under heavy multi-core contention, or hypervisors that do not forward these Intel instructions to guest VMs. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the conditions are routinely present in virtualized environments where hypervisors commonly withhold RDRAND/RDSEED forwarding, making this a realistic operational risk for enterprise Java FIPS deployments in cloud or VM-based infrastructure.

In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel-hid: Protect ACPI notify handler against recursion Since commit e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on all CPUs") ACPI notify handlers like the intel-hid notify_handler() may run on multiple CPU cores racing with themselves. On convertibles and detachables (matched by DMI chassis-type 31 and 32 in dmi_auto_add_switch[]) the SW_TABLET_MODE input device is registered lazily from notify_handler() on the first tablet-mode event, via intel_hid_switches_setup(). When two such events race on different CPUs both can pass the !priv->switches check and register the priv->switches input device twice, resulting in a duplicate sysfs entry and a subsequent NULL pointer dereference. This is the same class of bug fixed by commit e075c3b13a0a ("platform/x86: intel-vbtn: Protect ACPI notify handler against recursion") for the sibling intel-vbtn driver. Protect intel-hid notify_handler() from racing with itself with a mutex to fix this.

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid WARNING in sva unbind path The Intel IOMMU driver allows SVA on devices even if they do not support PCI/PRI. Commit 39c20c4e83b9 ("iommu/vt-d: Only handle IOPF for SVA when PRI is supported") modified the SVA bind path to allow this configuration by skipping IOPF enablement when PRI is missing. However, it failed to update the unbind path. This creates an imbalance: the unbind path attempts to disable IOPF for a device that never had it enabled, triggering a WARNING in intel_iommu_disable_iopf(): WARNING: drivers/iommu/intel/iommu.c:3475 at intel_iommu_disable_iopf+0x4f/0x90d Call Trace: <TASK> blocking_domain_set_dev_pasid+0x50/0x70 iommu_detach_device_pasid+0x89/0xc0 iommu_sva_unbind_device+0x73/0x150 xe_vm_close_and_put+0x4d2/0x1200 [xe] Fix this by bypassing IOPF operations for SVA domains on non-PRI hardware in both the bind and unbind paths.

Stack-based buffer overflow in ELAN Smart-Pad Windows kernel drivers ETD.sys and ETDSMBus.sys allows a local standard-privilege user to crash the entire Windows system via a kernel bugcheck (BSOD 0xF7 DRIVER_OVERRAN_STACK_BUFFER). The vulnerability is rooted in the Intel SMBus recovery code path: ETDSMBus.sys accepts a hardware-derived report count without enforcing an upper bound and forwards it to ETD.sys, where it drives an unbounded stack buffer copy. A proof-of-concept exists (CVSS 4.0 E:P) and no confirmed patch version has been identified from available data; no active exploitation is listed in CISA KEV at time of analysis.

Remote denial of service in Thumbor's convolution filter (versions <= 7.7.7) allows an attacker to crash the Thumbor worker process with a single crafted HTTP request by passing columns=0 to the filters:convolution() URL parameter. The Python-layer input validation accepts zero via an overly permissive regex (PositiveNumber matches '0'), which propagates to a C extension that performs integer division by zero, triggering SIGFPE and killing the process on x86_64 Linux and macOS Intel. No public exploit identified at time of analysis per KEV, but a fully functional proof-of-concept is documented in the vendor's own GHSA advisory, making exploitation trivially reproducible.

Denial of service in the Linux kernel's Intel iwlwifi 'mld' Wi-Fi driver allows a firmware crash on Intel BE201/Wi-Fi 7 adapters to spiral into sustained resource exhaustion. Because iwl_mld_tx_from_txq() failed to check the in_hw_restart flag, TX frames kept being dequeued and pushed to dead firmware, each returning -EIO and being freed in a tight loop that burns CPU and churns skb allocations, causing slab fragmentation and memory pressure. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 6th percentile), and the issue is not on CISA KEV; it is a reliability/availability bug that manifests under real load, not an attacker-driven remote exploit.