Linux
Monthly
Memory corruption in the Linux kernel IPv4 receive path lets a local attacker who can inject a packet with malformed checksum metadata (an out-of-range skb checksum_start) into the host IPv4 stack cause skb_checksum_help to write into and corrupt the network header, yielding high-integrity and high-confidentiality impact with a changed security scope (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 9.3). The flaw is realistically reachable by an unprivileged process inside a sandbox, container, or guest VM that can supply attacker-controlled checksum metadata to the host kernel, making multi-tenant and sandboxed environments the primary exposure; single-tenant systems with no untrusted local or sandboxed workloads are materially less exposed. Exploitation requires local access only (no remote network path indicated), and intelligence available at the time of analysis shows no confirmed active exploitation (no CISA KEV) - though linked references to sandbox-escape research (pwn.ai's 'Pwnescape' and Vercel's $1M sandbox challenge findings) indicate the underlying primitive is being actively studied.
Null pointer dereference in FreeRDP versions 2.0.0 through 3.31.x allows a malicious RDP server to crash Linux clients that have serial-port redirection enabled. The attacker sends IRP_MJ_READ or IRP_MJ_WRITE requests either before the serial channel is created or after it is closed, causing CommReadFile or CommWriteFile to dereference a null handle and terminate the client. This is an availability-only issue (CVSS 4.0 score 7.1, no confidentiality or integrity impact) that requires the victim to initiate a connection to the attacker-controlled server and have serial redirection active; no public exploit code has been identified at time of analysis.
A crafted DOS (MBR) extended-partition image can trigger a 32-bit integer overflow in util-linux's libblkid partition parser before version 2.41.4, causing the library to report a bogus partition that overlaps the master boot record. An unprivileged local attacker only needs to get a malicious disk image or removable medium in front of a probing path - such as automatic udev/udisks inspection of an inserted USB device, or any tool, VM, or forensic pipeline that scans attacker-supplied images - and no public exploit code or confirmed active exploitation has been identified at time of analysis. The realistic impact is limited: libblkid's reported partition metadata is falsified (an integrity issue), while actual disk modification or availability loss would require a separate downstream consumer to trust and act on that incorrect metadata, so the practical risk is modest despite a higher CVSS base score in some feeds.
Local privilege escalation in the SUID-root mount(8) utility shipped with util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, where the attacker-controlled LIBMOUNT_FORCE_MOUNT2 environment variable is read with getenv() and can force the legacy, non-atomic multi-step bind-mount path. On hosts whose /etc/fstab contains a bind mount authorized for unprivileged use via the user or users option and hardened with nosuid, noexec, or nodev, a local low-privileged user can win a timing race between the initial bind mount and the follow-up remount that applies those protective flags, briefly exposing an unprotected mount from which a SUID binary can be executed to obtain root. Exploitation is conditional (it requires that specific non-default fstab configuration) and non-deterministic because it depends on a race window; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV). Vendor-released patches are available in util-linux 2.41.5 and 2.42.2.
Local privilege escalation to root in util-linux's libmount affects versions 2.17 through 2.41.6 and 2.42 through 2.42.3, and also 2.42.4 when the legacy mount(2) path is used without /proc available. A local, low-privileged user who is already authorized by an /etc/fstab entry carrying the user or users option can exploit a time-of-check/time-of-use race: libmount validates the fstab target path and then the mount operation re-resolves that pathname, so an attacker who controls a writable ancestor directory can use renameat2(RENAME_EXCHANGE) to swap a path component and redirect the authorized mount to a root-owned location such as /etc/sudoers.d, gaining root. Exploitation is local only, requires the attacker to already hold an fstab mount authorization plus a writable ancestor on the configured target, and depends on winning the race (assessed AC:H), so it is non-deterministic; patched code paths using the new mount API (2.41.5 / 2.42.2 and later) or 2.42.4 with /proc present are not affected, and no public exploit identified at time of analysis.
Local privilege escalation in util-linux's SUID mount utility affects versions 2.39 through 2.41.4 and 2.42 through 2.42.1: a local, already-authorized low-privileged user can win a narrow timing race in the post-mount hook and redirect a privileged chmod()/lchown() onto a root-owned path, potentially obtaining root privileges. Exploitation requires a non-default /etc/fstab entry that combines the 'user' or 'users' mount option with an X-mount.mode, X-mount.owner, or X-mount.group option, plus write access to a writable ancestor directory of the mount target; the race itself is difficult (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released fixes in 2.41.5 and 2.42.2.
Local privilege escalation in the Microsoft MANA network driver for the Linux kernel lets an authenticated low-privilege user on the host raise privileges to kernel/root level by winning a time-of-check time-of-use race in the driver (CWE-367). The attack is strictly local (AV:L) and high-complexity (AC:H) because the race must be won, and it only applies where the MANA driver is present and loaded - in practice Azure-hosted or MANA-capable Linux systems that use it as the primary network path. A vendor-released patch is available per the Microsoft advisory; no public exploit identified at time of analysis, and there is no confirmed active exploitation (not listed in CISA KEV).
Command injection in the VNote note-taking application before version 4.3.0 lets an attacker-controlled note filename execute arbitrary commands as the victim user on Linux and macOS, but only when the victim opens that note and has configured an external program whose arguments are command-capable, such as vim/gvim's -c option. The root cause is SessionConfig::ExternalProgram::fetchCommand, which wraps the note path in double quotes and hands the whole string to QProcess::start(const QString&), so a double quote inside a POSIX filename terminates the quoted path and appends attacker-chosen arguments to the configured program. The vendor fixed the issue in 4.3.0; no public exploit identified at time of analysis, and the CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.0) reflects full impact on confidentiality, integrity and availability once the narrow exploitation prerequisites are met.
Unauthenticated remote attackers can tamper with token state and disrupt service availability in NVIDIA AIStore for Linux by sending crafted token-revocation lists to a token-revocation endpoint that performs no authentication check (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Because the vector shows PR:N and UI:N, no credentials, privileges, or user interaction are needed - any network-reachable deployment of the affected endpoint is directly exploitable, with the only practical limiting factor being firewall or segmentation controls around the AIStore management/control interface. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the missing authentication control (CWE-306) is the defect itself, so the issue should be treated as a genuine high-priority exposure rather than an inflated score.
Missing authorization in the NVIDIA AIStore ETL management API lets remote, unauthenticated attackers read ETL job information and issue start or stop operations against existing extract-transform-load pipelines by sending crafted GET or POST requests to an AIStore proxy (CVE-2026-65172, CVSS 8.6, CWE-862). Per the assessed vector (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:L), no credentials or user interaction are required; the practical constraint is network reachability to a proxy that exposes the ETL management API in Linux or Kubernetes deployments. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the immediate risk is driven by exposure of the proxy API rather than by observed attack activity.
Unauthenticated remote attackers can abuse NVIDIA AIStore's experimental HT backend to perform server-side request forgery by supplying a crafted 'original URL' value, causing the AIStore server to issue requests to attacker-chosen destinations and disclose information reachable from the server's network position. The flaw carries a CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), reflecting no authentication or user interaction requirement and a scope change, with impact confined to confidentiality - integrity and availability are unaffected. There is no public exploit identified at time of analysis, and the practical risk is gated almost entirely on whether the experimental HT backend has been enabled on a network-exposed deployment, since that component is not part of the default AIStore configuration and is only reachable in non-standard setups.
Path traversal in the NVIDIA AIStore for Linux dSort archive extraction component allows a remote attacker to write files outside the intended extraction directory by submitting a dSort job that references an archive (e.g., tar/zip) whose member names contain crafted traversal sequences, yielding arbitrary file creation or overwrite and potentially code execution, information disclosure, data tampering, and denial of service. The vulnerability carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) per the assessed vector, indicating remote reachability and no authentication requirement, but a high attack-complexity rating that reflects the difficulty of reliably crafting the malicious archive and triggering the flaw. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis; the practical gating factor is network access to the AIStore dSort/API endpoint, which in typical deployments is confined to a trusted ML/training cluster or private network rather than being internet-facing. Because the dSort job-submission path is the attack surface, exposure is primarily amplified where AIStore's API is reachable from untrusted networks, and no user interaction is required.
Unauthenticated path traversal in the target-side object rename handler of NVIDIA AIStore on Linux allows a remote attacker who can reach a target (storage) node directly to write files outside the intended storage directory by supplying a crafted rename destination, resulting in arbitrary file creation or overwrite. NVIDIA rates the issue CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-22), with downstream consequences that could include code execution, privilege escalation, information disclosure, data tampering, and denial of service depending on what the overwritten path controls. Exploitation is constrained rather than trivial: the attacker needs network reachability to a target node - not merely the front-end proxy - and must build a traversal payload the rename handler accepts, so exposure is greatest in flat cluster networks or environments where target ports are directly reachable; no public exploit code and no CISA KEV entry were identified at time of analysis.
Omarchy 4 before 4.0.1 stages files from third-party themes without filtering executable content, so installing a theme from an untrusted Git repository and applying it with omarchy-theme-set lets the theme author run code as the victim user: Hyprland loads a theme's hyprland.lua and gum_env.lua at login, Neovim loads neovim.lua at startup, terminal configs (alacritty.toml, foot.ini, ghostty.conf, kitty.conf) name the program the terminal launches, and vscode.json installs an arbitrary VS Code extension. The CVSS 7.1 rating is tempered by the deliberate user action required - a user must choose to install and apply an attacker-supplied theme (UI:R, no credentials needed, PR:N) - and by the confinement of the resulting code to the victim's own privileges rather than root, which places real-world urgency at moderate-to-low rather than drop-everything. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; the vendor shipped a fix in the v4.0.1 release, and users who only apply bundled or self-authored themes are not exposed.
Privilege escalation in MariaDB Server (10.6.1 up to 10.6.28, 10.11.x before 10.11.19, 11.4.x before 11.4.13, 11.8.x before 11.8.9, 12.3.x before 12.3.3, and 13.0.x before 13.0.2) allows an authenticated database user holding the FILE privilege to plant a /run/mysqld/wsrep-new-cluster file when secure-file-priv permits writes into that runtime directory, which the packaged mariadb.service systemd unit subsequently consumes as an EnvironmentFile. On the next administrator-triggered restart of mariadb.service, attacker-controlled environment values are injected into the mariadbd process, escalating from the database user context onto the host/systemd layer (scope change) with full confidentiality, integrity, and availability impact. The vendor rates this 8.4 while our independent assessment uses CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H, reflecting that exploitation requires a high, non-default privilege and a restart gate; no public exploit code has been identified at time of analysis, and patched releases are already available.
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 lets a remote peer stall outbound mail delivery by accepting a TCP/TLS connection and then sending nothing. Socket timeouts are applied in the form the Windows stack accepts but Linux refuses, and the server's HTTPS clients (MTA-STS, DANE TLSA, OAuth2, ACME) read without a deadline, so an attacker can pin worker threads indefinitely and stop delivery, ManageSieve, and metrics service for everyone else. The MTA-STS policy fetch is enabled by default and is performed during outbound delivery to mta-sts.<recipient domain>, so anyone who can make the server deliver mail to a domain they control - for example as the envelope sender of a message that bounces - can hold delivery threads until outbound mail stops; Windows builds are not affected at all. Per the authoritative assessment the vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), i.e. unauthenticated with no user interaction, but impact is bounded to availability only; no public exploit identified at time of analysis, and the fix ships in release 6.3.6.
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 on Linux allows an attacker who already has code execution as the unprivileged hmailserver service account to run arbitrary code as root via the live-update apply helper (hmailserver-update). The vulnerability requires the live-update path unit to be active, which is the default for the project's .deb and .rpm packages and applies to AppImage installations run under that unit, but does not affect non-Linux builds. No public exploit code has been identified at time of analysis, and the vendor has released version 6.3.6 to address the issue.
Local privilege escalation in Splunk Enterprise on Linux (versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15) allows an attacker who can already run commands as the OS account running Splunk Enterprise to inject operating-system commands into installation content that a subsequent root-privileged Linux package upgrade will execute as root. The flaw is conditional: the attacker must modify the installation and then a privileged package upgrade must occur, so there is no at-will escalation. No public exploit or confirmed active exploitation was identified at time of analysis.
A use-after-free and RCU-safety defect in the Linux kernel's IPsec/xfrm transport-mode packet reinjection path can crash or corrupt the kernel, and is reachable by a local low-privilege attacker (CVSS PR:L) who can also trigger network device unregistration. The flaw was introduced when xfrm_trans_reinject() was converted from a tasklet to a workqueue (commit 4f4920669d21), so finish callbacks such as ip6_rcv_finish() now run in process context without an RCU read-side critical section, and queued skbs may hold non-refcounted dst entries whose skb->dev is not kept alive while deferred. Our independent assessment scores this CVSS 3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (availability-only, high attack complexity), and there is no public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile) and no CISA KEV listing exists.
Use-after-free of GUP-pinned zerocopy page buffers in the Linux kernel's IPsec ESP out-of-place output path lets a local, authenticated user (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) who can send MSG_ZEROCOPY traffic over an ESP transform corrupt memory, potentially achieving privilege escalation (C:H/I:H/A:H), while the same code path simultaneously leaks an x->xfrag page per packet. Exploitation requires a host with IPsec ESP configured where esp->inplace == false and where the transmitted skb carries SKBFL_MANAGED_FRAG_REFS, so hosts without ESP or without zerocopy sends on that path do not reach the vulnerable frag mutation. No public exploit has been identified at time of analysis, the issue is not in CISA KEV, and the EPSS score is low (0.17%, 6th percentile), consistent with a moderate-priority local issue; vendor-released patches exist in 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, and 7.3-rc4.
A use-after-free race in the Linux kernel's RDMA/siw (SoftiWARP) driver lets a local, low-privileged user who can issue RDMA verbs operations corrupt kernel memory and potentially escalate privileges or crash the system. The bug is reachable when siw_qp_modify() fails inside siw_accept() and the QP's state_lock is released before the error path clears qp->cep, opening a window in which a concurrent ibv_modify_qp() transition to ERROR frees the same cep object. Exploitation requires the siw module to be loaded and a narrow race to be won, so practical risk is limited to environments using software RDMA; no public exploit code has been identified, EPSS is low (0.17%, 6th percentile), and the issue is not listed in CISA KEV, while vendor patches are available for all supported stable branches.
A use-after-free in the Linux kernel's RDMA/rxe (Soft-RoCE) memory-region re-registration path lets a local attacker who can reach the RDMA user-verbs character device corrupt kernel memory and potentially achieve privilege escalation, scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The bug is reachable only when rxe_rereg_user_mr() is called with both IB_MR_REREG_PD and IB_MR_REREG_ACCESS set while supplying an access bit outside RXE_ACCESS_SUPPORTED_MR, causing the protection domain to be reassigned without the core's use-count being rolled back and leading to a protection domain (and a memory window still referencing it) being freed while in use. Exploitation is realistically narrow: the rdma_rxe module must be loaded and an rxe device configured (not a default configuration), the attacker needs local device access, and an existing memory window must reference the PD; no public exploit code was identified at time of analysis and EPSS is low at 0.16% (4th percentile).
Out-of-bounds read and write in the Linux kernel's RDMA Soft-RoCE (rxe) driver (CVE-2026-98365) lets an unauthenticated peer on an already-established RDMA queue pair send a crafted RDMA-Write or RDMA-Read RETH whose iova+length wraps to zero, bypassing the mr_check_range() bounds check and causing a kernel oops (and possible memory corruption) in rxe_mr_copy_xarray(). No public exploit code was identified at time of analysis and EPSS is low at 0.17% (5th percentile), but realistic exposure is gated by configuration: the rdma_rxe module must be loaded and the host must expose Soft-RoCE on a reachable interface, which is not the default Linux setup. Vendor-released patches are available in stable kernels 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
A race-condition use-after-free in the Linux kernel's xfrm (IPsec) bundle-creation path allows a local attacker with low privileges to trigger a stale net_device pointer dereference, yielding kernel memory corruption with high confidentiality, integrity, and availability impact. The flaw is reachable when an IPv6 UDP send traverses xfrm_lookup_with_ifid()/bundle creation while a concurrent RTM_DELLINK tears down the underlying net_device - a capability typically obtained by an unprivileged user inside a user+network namespace on kernels that permit unprivileged namespaces. Exploitation is local-only and probabilistic (it depends on winning an inherent timing race and on xfrm/IPsec policies being active), so realistic risk is below the vendor CVSS of 7.8; EPSS is low at 0.15% (4th percentile), no public exploit code was identified at time of analysis, and the issue is not in CISA KEV.
Local privilege escalation and data-corruption primitive in the Linux kernel's RDMA/rxe (Soft-RoCE) software-RDMA driver: a missing HMM_PFN_WRITE permission test in the on-demand-paging (ODP) write path lets an unprivileged local user who can register an ODP memory region over a PROT_READ file mapping direct incoming RDMA traffic (RDMA WRITE, RDMA READ responses, SEND payloads, atomics) through kmap into read-only page-cache pages without ever triggering copy-on-write, overwriting files the attacker only holds O_RDONLY - classically /etc/passwd or a setuid binary - in the same primitive class as Dirty COW and CVE-2022-2590. The flaw was introduced by commit 0b261d7c1cd3 ("RDMA/rxe: Break endless pagefault loop for RO pages"), which stripped the access-permission test from rxe_check_pagefault() and left only HMM_PFN_VALID, affecting kernels built from that baseline (reported as Linux 6.16 onward) until the stable fixes. Exploitation is bounded by configuration: the rxe/Soft-RoCE module is not loaded by default on typical servers, and the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) confirms a local, authenticated attacker with low complexity but no network reach; EPSS is low at 0.16% (5th percentile), and no public exploit code or CISA KEV entry has been identified at time of analysis. Vendor patches are available.
A use-after-free in the Linux kernel's Soft-RoCE (rdma_rxe) driver allows a local user who can open the RDMA uverbs interface and issue ATTACH_MCAST on a UD queue pair to trigger freeing of a published multicast-group object while it is still reachable from the driver's mcg_tree, giving high confidentiality, integrity and availability impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The race is only reachable when the backing Ethernet multicast programming step, rxe_mcast_add(), fails mid-operation (for example -ENODEV after the backing netdev is removed, or a propagated dev_mc_add() error), which is why the attack complexity is High and the practical priority is low. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.18% (7th percentile), and vendor patches are available in mainline and multiple stable branches.
Local users with low privileges can drive the Linux kernel into a race condition in the RDMA/core helper ib_get_eth_speed(), which calls a net_device's ethtool callback after that device has already completed NETDEV_UNREGISTER and ndo_uninit during teardown, corrupting or crashing the kernel. Exposure is narrow: the host must have an active RDMA device bound to an Ethernet (RoCE) or InfiniBand link layer and that device must be unregistering while an asynchronous RDMA port query is in flight, so exploitation requires winning a tight timing window (upstream CVSS 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; the independent assessment keeps the same AV:L/AC:H/PR:L vector but rates confidentiality and integrity as low and availability as high). Vendor-released patches exist for stable branches 6.1.189, 6.6.158, 6.12.112, 6.18.54 and 7.2.8 (plus 7.3-rc4); no public exploit code or confirmed active exploitation is known, and EPSS is only 0.17% (5th percentile).
A teardown race in the Linux kernel's iSER target (ib_isert) frees the isert_conn and iscsit_conn structures while a deferred control PDU completion is still queued on isert_comp_wq, so isert_put_cmd() later dereferences freed memory - a slab use-after-free (KASAN splat) rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because it can in principle lead to kernel code execution, data disclosure, or a crash. Exposure is limited to hosts that run the LIO iSER target with the ib_isert module loaded and export an iSER/RDMA transport over an InfiniBand or RoCE fabric; the CVSS vector shows no authentication prerequisite (PR:N), but the attacker must win a narrow race between connection teardown and the workqueue handler, a window so tight that the reporter needed an injected msleep(200) to reproduce it reliably. No public exploit code and no CISA KEV entry are associated with this issue, EPSS is only 0.16% (5th percentile), and vendor-released stable patches are available.
An out-of-bounds read in the Linux kernel's legacy libipw 802.11 stack allows an unauthenticated attacker within wireless range to make affected systems walk roughly 64 KiB past the end of a received management frame buffer. Only machines using the legacy Intel PRO/Wireless ipw2100 or ipw2200 drivers are exposed, because those receive paths validate just the generic 24-byte three-address management header while libipw_process_probe_response() and libipw_network_init() assume the full 36-byte beacon/probe-response prefix; the length arithmetic then underflows and is truncated to 65524. The resulting flaw yields limited information disclosure (C:L) and a high availability impact via kernel crash (A:H) against adjacent-network attackers, though it is sharply constrained by the obsolete hardware requirement. Risk signals are low: EPSS is only 0.17% (6th percentile), there is no CISA KEV listing, and no public exploit has been identified at time of analysis.
Out-of-bounds reads in the Linux kernel's legacy libipw 802.11 management-frame parser, reachable through the ipw2100 and ipw2200 wireless drivers, let an unauthenticated attacker within wireless range crash the kernel by injecting a crafted association response that is shorter than the fixed 30-byte prefix. The root cause is an unsigned integer underflow: stats->len (u16) minus sizeof(*frame) (size_t) is evaluated in size_t and wraps, so the truncated u16 length handed to libipw_parse_info_param becomes a value near 64 KiB and the information-element parser walks well past the receive buffer. Exploitation requires the obsolete Intel PRO/Wireless 2100 or 2200BG hardware and driver stack to be present and processing association responses, so the realistic outcome is a denial-of-service kernel crash with only limited disclosure potential; no public exploit code has been identified at time of analysis, no KEV entry exists, and EPSS is a low 0.17% (6th percentile), while vendor-released patches are available in the 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4 kernels.
A use-after-free in the Linux kernel's cfg80211 wireless configuration subsystem can be triggered locally when a network interface is taken down while a scan is still running, causing cfg80211 to free a scan request that the Wi-Fi driver still believes it owns. Successful exploitation corrupts kernel memory reachable at scan completion (scan_done()), yielding high confidentiality, integrity, and availability impact, though the attacker must already hold local privileges sufficient to manage the wireless interface (CVSS PR:L) and must win a narrow asynchronous-cancellation race (assessed AC:H, versus the vendor's AC:L). There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.17% (6th percentile).
Kernel instability in the Linux wireless stack (cfg80211) lets an attacker-controlled rogue AP or Wi-Fi device within radio range drive a client into an assertion failure inside the BSS rbtree handling, resulting in a WARN_ON that becomes a full system crash when panic_on_warn is enabled. Only systems running the in-tree cfg80211/mac80211 code are affected, and exploitation requires an adjacent attacker plus a victim client actively associated to the malicious device; the malformed BSS type change does not occur in normal operation, so real-world exposure is limited to deliberate rogue-device scenarios. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); EPSS is low at 0.18% (7th percentile), and our independent assessment scores this 5.3 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) rather than the inflated 8.8 base score, reflecting availability-only impact with high attack complexity and adjacent access requirements.
A stale virtual interface entry in the Linux kernel's mac80211 WiFi stack can drive the kernel into a BUG() at net/wireless/core.h:141 (wiphy_to_rdev) and crash or corrupt memory when a network namespace holding a wiphy is destroyed and the wiphy's migration back to init_ns fails on a memory-allocation error. Kernels with mac80211 loaded are affected from the 2.6.32-era lineage carrying commit 463d018323851a608eef52a9427b0585005c647f, with local exploitation requiring namespace-administration privileges (PR:L) plus a racy, largely attacker-uncontrollable allocation failure (AC:H) - CVSS 3.1 base 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), though independent assessment downgrades confidentiality and integrity to LOW while retaining HIGH availability impact. No public exploit code has been identified at time of analysis, the CVE is not in CISA KEV, and EPSS is only 0.18% (7th percentile), so the effective real-world priority is LOW despite the HIGH base score; vendor-released patches exist in 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
Network namespace teardown in the Linux kernel's cfg80211 wireless configuration subsystem can leave a wiphy (wireless device) pointing at a freed network namespace when the interface migration back to the initial namespace fails, producing a kernel mode fault (reported at address 0x30 via genlmsg_multicast_netns / nl80211_notify_wiphy / wiphy_unregister) and crashing the host. The independent assessment rates this availability-only (C:N/I:N/A:H) with AV:L/PR:L, meaning a local attacker with low privileges - CAP_NET_ADMIN or access to an unprivileged user namespace that permits netns creation - is required, and the attack is complicated because it depends on a memory allocation failure occurring at exactly the right moment. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is 0.17% (6th percentile), consistent with a low-priority defensive fix rather than an imminent threat.
A memory-corruption bug in the Linux kernel's PXA DMA engine driver (pxad) causes the software descriptor counter nb_desc to be double-counted, leading to out-of-bounds indexing and freeing of descriptors that were never allocated. Only systems running the Marvell PXA dmaengine driver (CONFIG_PXA_DMA / pxad) and built with gcc 15.1 or clang 22.1 or newer are affected, because the kzalloc_flex() conversion of pxad_alloc_desc() only updates the __counted_by counter when __builtin_counted_by_ref() is available. The flaw requires local access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and a low-privileged user able to trigger DMA descriptor allocation through a consuming client; EPSS is low at 0.16% (5th percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
An out-of-bounds write in the Linux kernel's siw (Soft-iWARP) RDMA driver lets a connected iWARP peer corrupt kernel memory by delivering an extended DDP/RDMAP header split across more than one TCP receive callback; the miscalculated copy length (hdrlen - MIN_DDP_HDR instead of the number of missing bytes) pushes the destination past the header, overwrites the receive state including fpdu_part_rcvd, and a later callback reuses that corrupted value as a copy offset. The upstream CVSS 3.1 vector scores this 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates it AV:N/AC:H (8.1) because exploitation requires the siw driver to be loaded - it is not enabled in default Linux configurations - and requires the attacker to control TCP segmentation so the header spans multiple callbacks; no authentication is needed once an RDMA session exists. Exploitation status: no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and the issue is not listed in CISA KEV, though a vendor patch is available for the stable branches.
Use-after-free in the Linux kernel netfilter flowtable datapath allows a local, authenticated low-privileged user to potentially execute code, corrupt memory, or disclose information by winning a race condition against the RCU grace period. Affected are unpatched kernels in the 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 7.2.x, 7.3-rc, and 6.18.x ranges before their respective fixes; systems without a configured netfilter flowtable offload are not exposed. No public exploit code has been identified at time of analysis, and the EPSS score is 0.22% (11th percentile), indicating low predicted exploitation activity; vendor patches are available.
Memory corruption in the Linux kernel's SMB/CIFS client (cifs.ko) allows a local user with write access to a mounted share to trigger out-of-bounds writes and a massive heap/stack overflow by creating a native symlink whose absolute target lacks an NT drive prefix. Affected code ships in mainline Linux from 6.15.6 onward and is patched in 6.16, with stable backports in 7.2.8 and 7.3-rc4 per EUVD; exploitation requires a Linux client to have mounted a share using default settings (symlinkroot unset) and an attacker able to place a crafted symlink on that share, matching the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector. Impact is high confidentiality, integrity and availability loss through kernel memory corruption, though EPSS is only 0.16% (5th percentile) and no public exploit code has been identified at time of analysis - no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Improper runlist locking in the Linux kernel's NTFS driver allows a local attacker who can perform file and attribute operations on a mounted NTFS volume to race the cluster-freeing and runlist-truncation paths, potentially corrupting runlist and on-disk mapping-pair state and achieving high confidentiality and integrity impact inside the kernel (NVD score 7.8; our independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, i.e. local-only with a timing-dependent trigger). The flaw is that ntfs_non_resident_attr_shrink() calls runlist helpers that require the runlist write lock without holding it, and ntfs_attr_map_cluster() can merge a newly allocated run before a mapping-pairs update that may fail, with the rollback path itself able to fail and force the volume into an error state. EPSS is low at 0.16% (5th percentile), no public exploit code and no confirmed active exploitation have been identified at time of analysis, and the affected NTFS driver is not enabled or mounted by default on most Linux servers, which materially limits real-world exposure.
Local use-after-free in the Linux kernel's virt_wifi virtual wireless driver (CVE-2026-98311) lets a low-privileged local attacker with network-admin capability corrupt kernel memory, causing a crash and potentially enabling code execution in kernel context. virt_wifi_newlink() propagates the lower device's operstate before the new netdevice is registered, so a dormant lower device queues the still-uninitialized netdev on the linkwatch event list; if registration later fails - attacker-controllable by supplying an interface name such as 'bad/name' - free_netdev() releases the object and the subsequent linkwatch_fire_event() dereferences freed memory. Exposure is narrow: exploitation is strictly local, requires CAP_NET_ADMIN (attainable via user namespaces on some distributions) plus the rarely deployed virt_wifi module, no public exploit code has been identified, CISA KEV does not list this issue, and EPSS is only 0.22% (11th percentile).
A race condition in the Linux kernel's mxl862xx DSA driver for MaxLinear MxL862xx Ethernet switches allows a stats-polling delayed work item to execute against already-freed dsa_port structures, yielding a use-after-free with high confidentiality, integrity and availability impact. The flaw is reachable only by an authenticated, highly privileged local actor (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H per independent assessment) who can drive a teardown path - switch unregister, driver shutdown, driver unbind, or a failed dsa_register_switch() during probe - and simultaneously win a narrow timing race, since the WORK_STOPPED flag test is not atomic with cancel_delayed_work_sync(). Exploitation additionally requires kernel builds compiled with the mxl862xx driver and actual MaxLinear MxL862xx switch silicon present and bound, so practical exposure is limited; there is no public exploit identified at time of analysis, EPSS is a low 0.16% (5th percentile), and the issue is not in CISA KEV.
A possible kernel deadlock in the Linux kernel's Bluetooth RFCOMM listener teardown path can be reached by an unauthenticated attacker within Bluetooth radio range (AV:A, PR:N per the vector) who races a new incoming RFCOMM connection against the cleanup of a listening socket. Triggering requires Bluetooth to be enabled on the target, a live application listening on an RFCOMM channel, proximity, and a narrow timing window (AC:H); the condition was reported by lockdep as a POSSIBLE lock-order inversion between a child socket lock and rfcomm_mutex, not a confirmed and reliably reproducible crash, and the assessed impact is availability only (C:N/I:N/A:H). No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is very low at 0.18% (7th percentile); vendors have released fixes.
Use-after-free in the Linux kernel's KVM PowerPC Book3S HV nested-virtualization path (kvmhv_emulate_tlbie_all_lpid) lets a local attacker who controls an L1 guest corrupt host kernel memory by racing a tlbie-driven nested-guest free against a vCPU iterating the nested-guest IDR, yielding high confidentiality and integrity impact on the host (assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H; the vendor/NVD vector lists the same impacts with AC:L for 8.8). Exploitation is timing-dependent and limited to PowerPC Book3S HV hosts running KVM with nested virtualization enabled and exercised; there is no public exploit code identified at time of analysis and EPSS is low (0.18%, 7th percentile), so risk is serious but narrow. Vendor fixes are released in Linux 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4 (EUVD-2026-93211).
Memory corruption and scope-changing host impact in the Linux kernel's PowerPC IOMMU TCE handling affect ppc64 systems where a local low-privileged actor can invoke multi-page TCE hypercalls such as H_STUFF_TCE or H_PUT_TCE_INDIRECT with npages greater than 1. The flaw is in iommu_tce_check_ioba(), which used a hardcoded page count of 1 instead of the caller-supplied npages, so the intended bounds check can be bypassed and the TCE table capacity may be exceeded, yielding the assessed full confidentiality, integrity, and availability impact on the host under a scope-changing vector. No public exploit identified at time of analysis, no CISA KEV entry was provided, and EPSS is low at 0.18% (7th percentile); vendor patches are available.
Local privilege escalation in the Linux kernel futex subsystem (CVE-2026-98281) lets an existing local user with the ability to execute binaries corrupt or manipulate the per-mm private futex hash, potentially leading to full compromise of confidentiality, integrity and availability on the affected host. The flaw stems from the kernel failing to allocate the private futex hash when the mm is shared across a vfork() (or other CLONE_VM) boundary, so private futex waiters can exist before that hash is initialized; the fix closes this ordering window. Exploitation requires an authenticated local account (CVSS PR:L) and reliable triggering of the ordering condition, which our assessment rates as high attack complexity despite the vendor's base vector (AV:L/AC:H versus the published AC:L). There is no public exploit identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at roughly 0.17% (6th percentile), indicating a genuine but non-urgent local-privilege-class kernel flaw rather than an internet-facing emergency.
A race condition in the Linux kernel networking stack (sock_gettstamp()) allows a local, authenticated unprivileged user to trigger a slab-use-after-free in the UDP receive path by issuing a SIOCGSTAMPNS_NEW socket-timestamp ioctl on a UDP socket concurrently with a bind() on that same socket. Because sock_enable_timestamp() modifies sk->sk_flags with non-atomic bit operations while the SIOCGSTAMPNS_NEW path does not hold the socket lock, the concurrent read-modify-write can silently drop the SOCK_RCU_FREE bit that udp_lib_get_port() had just set, causing sk_destruct() to free the socket immediately instead of after an RCU grace period while lockless receive lookups still hold a pointer to it. Exploitation is local-only and requires winning a narrow timing window (our assessment rates it AV:L/AC:H/PR:L, versus the vendor-published CVSS 3.1 score of 7.8 with AC:L), EPSS is low at 0.18% (7th percentile), there is no KEV listing and no public exploit identified at time of analysis, and vendor-released patches exist for the affected stable branches.
Kernel memory corruption in the Linux CIFS/SMB client (cifs.ko) allows a malicious or compromised SMB server to have a channel and its primary server structure freed while the client still dereferences them, producing a use-after-free that crashes the kernel and can expose or corrupt freed memory. Exposure is limited to clients that mount a share from an attacker-controlled server with SMB multichannel in use: the vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) indicates no client-side credentials are required, but the victim must initiate the mount and the bug depends on a race/teardown timing window, so the net real-world risk is lower than the 8.1 base score suggests. No public exploit code is identified at time of analysis, EPSS is 0.18% (6th percentile), and vendor-released patches exist for the affected stable branches.
Use-after-free in the Linux kernel's POSIX CPU-timer cleanup path during exec() can corrupt kernel memory and, under the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), potentially lead to local privilege escalation or arbitrary code execution in kernel context. The flaw exists in kernels from Linux 5.7 onward and is triggered when a non-leader thread that has armed a CLOCK_THREAD_CPUTIME_ID timer calls execve(), the exec later fails after bprm->point_of_no_return, and the task is forced into do_exit() before begin_new_exec() reaches posix_cpu_timers_exit(), freeing a k_itimer whose node is still queued in an rbtree. Exploitation requires local code execution as an unprivileged user and winning a narrow timing race around a failing exec path, so it is not remotely reachable; EPSS is low (0.18%, 6th percentile) and no public exploit has been identified at time of analysis, while vendor-released patches exist in 6.6.158, 6.12.112, 6.18.54 and 7.2.8.
Use-after-free in the Linux kernel's POSIX CPU timer subsystem lets a local low-privileged user free a timer that is still queued on the expiry handler's private firing list, corrupting kernel memory and opening the door to privilege escalation or denial of service on kernels built from commit bf635681c906 onward (roughly 6.13 until the referenced stable fixes). Exploitation needs only the standard timer_create/timer_settime/timer_delete calls available to ordinary users, but it is gated by a narrow concurrency window that must be won (assessed CVSS:3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), which keeps real-world risk modest. No public exploit code or confirmed active exploitation is known and EPSS is 0.17% (6th percentile), while vendor patches are available.
A protocol-version negotiation mismatch during RDS-over-RDMA connection setup in the Linux kernel deadlocks the kernel by making an RDMA-CM event handler wait on itself, permanently stalling the RDS connection workqueues and causing denial of service. Only hosts with the RDS stack loaded and bound to an RDMA transport (InfiniBand, RoCE, or iWARP) that expose a reachable RDMA-CM listener are affected; unauthenticated peers able to establish an RDMA-CM connection - typically from the same RDMA fabric or subnet (assessed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - can trigger it by negotiating a protocol version older than RDS_PROTOCOL_COMPAT_VERSION. Impact is availability-only (C:N/I:N/A:H); EPSS is low at 0.18% (7th percentile), no public exploit code has been identified at time of analysis, and vendor patches are available for the affected stable branches.
Use-after-free write in the Linux kernel's signal delivery path lets a local, unprivileged user corrupt a freed POSIX timer sigqueue and potentially escalate privileges on the host. The race triggers when a non-leader thread calls execve() while a blocked SIGEV_THREAD_ID timer signal aimed at the old thread-group leader's TID is being flushed, so the kernel can re-queue the sigqueue onto a task::pending list that release_task()/exit_signals() is concurrently tearing down and then dereference the freed timer via a later tgkill(). Affected builds are those carrying the change that moved the sigqueue flush out of the sighand-locked region (EUVD lists Linux 6.15 era onward); exploitation requires local access and winning a timing/memory-ordering race, no public exploit code has been identified at time of analysis, the CVE is not listed in CISA KEV, and EPSS is 0.17% (6th percentile), so the practical concern is a HIGH-severity (7.8 base, C:H/I:H/A:H) local privilege-escalation primitive rather than mass exploitation.
Incorrect page-frame/offset bookkeeping in the Linux kernel's swiotlb bounce-buffer code (swiotlb_bounce) can place DMA copies one page away from the intended location whenever a non-zero tlb_offset, produced by partial syncs through dma_sync_single_range_for_cpu()/for_device(), crosses a page boundary. Affected are kernels with swiotlb bounce buffering plus meaningful highmem (typically 32-bit or large-memory builds); because the offset and the page frame are taken from mismatched values, DMA_FROM_DEVICE can overwrite the wrong page while leaving the intended page stale, and DMA_TO_DEVICE can feed data from a page the mapping may not cover, and a lowmem-recorded slot can even be adjusted into highmem and then passed to phys_to_virt(). The assessed vector is local, PR:L (authenticated local access), with AC:H reflecting that the flaw is dormant for aligned full-buffer DMA and needs a DMA pattern that produces a page-crossing offset, so although confidentiality, integrity and availability impact are all rated High, reliable targeted exploitation is difficult; no public exploit code has been identified at time of analysis and EPSS is low at 0.18% (6th percentile), with no CISA KEV listing.
A race-condition use-after-free in the Linux kernel's RDMA user-space connection manager (ucma) allows a local user who can open /dev/infiniband/rdma_cm to corrupt kernel memory and potentially escalate privileges. Two concurrent JOIN_MCAST calls for the same multicast address, combined with a forced copy_to_user() failure, can leave a queued RoCE work item dereferencing a ucma_multicast structure that another thread has already freed, because ucma_process_join() dropped ctx->mutex after a successful join and reacquired it only on error. No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA KEV: not listed), EPSS is a low 0.18% (7th percentile), and real-world risk is limited by the requirement for local RDMA/RoCE configuration plus a narrow timing window - so despite the 7.8 base score this is a LOW-priority issue in practice.
Refcount initialization ordering in the Linux kernel's RDMA iWARP port-mapper (iwpm) subsystem allows a local, low-privileged attacker to trigger a kref "addition on 0" race that can lead to premature object release and kernel memory corruption, rated 7.0 High (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Only systems that actually load and use the RDMA stack with iWARP port-mapper netlink traffic are exposed - the iwpm subsystem is not active on default desktop or server installs without InfiniBand/RDMA hardware or the software RDMA drivers (rxe, siw). Exploitation requires local code execution plus winning a narrow timing window on an SMP system, and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is 0.22% (11th percentile).
A race condition in the Linux kernel's Open vSwitch conntrack label handling lets a local user trigger a read of a reallocated-and-freed conntrack extension block, which can leak kernel memory or corrupt state in the OVS datapath. ovs_ct_get_conn_labels() added a label extension even to already-confirmed conntrack entries, so a lockless reader on another CPU could dereference storage that was freed underneath it; the fix restricts extension insertion to unconfirmed conntracks and makes a label operation on a label-less confirmed conntrack fail instead. The flaw exists in kernels carrying the OVS conntrack labels feature (introduced around Linux 4.3) and is fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4. Exploitation is local and authenticated (CVSS:3.1/AV:L/AC:H/PR:L/UI:N per the independent assessment), requires OVS with connection tracking and labels actively configured, and depends on winning a narrow timing window; EPSS is 0.18% (7th percentile) and there is no CISA KEV entry or public exploit identified at time of analysis.
Local use-after-free in the Linux kernel's dma-buf/dma-fence subsystem lets a low-privileged local user with access to a fence-exposing interface (DRM/GPU, sync_file, or other DMA-buf consumers) read freed kernel memory when a fence's timeline or driver name string is retrieved concurrently with the fence being signaled. The regression was introduced by an earlier NULL-pointer dereference fix that replaced the signaled-bit check with an ops-pointer check, which is insufficient because many dma_fence implementations never clear the ops pointer on free and thus lose the RCU protection that keeps the returned string alive. Impact is a kernel crash (denial of service) or disclosure of freed heap contents; exploitation requires local device access and winning a narrow race, and no public exploit has been identified at time of analysis (EPSS 0.16%, 5th percentile; no CISA KEV listing).
Out-of-bounds memory reads in the Linux kernel's IPv6 XFRM local path allow a locally authenticated attacker who can trigger specific XFRM/IPsec routing conditions to miscast a TCP request socket as a full IPv6 socket, disclosing kernel heap memory. The flaw affects Linux 3.2 and later and is triggered only when IPv6 XFRM tunnel routes are configured, an IPv6 TCP service emits SYN-ACKs, and rerouting selects a lower-MTU tunnel so the local PMTU or local error callback runs while the skb is still owned by a TCP_NEW_SYN_RECV request_sock. It requires local access with low privileges (CVSS vector PR:L, AV:L); there is no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and CISA KEV does not list it. Vendor patches are available, and the timing-dependent, non-default XFRM configuration substantially narrows the realistic attack surface below what the raw 7.8 score suggests.
A use-after-free write in the Linux kernel's lan743x Ethernet driver (Microchip LAN7430/LAN7431) lets a packet that spans more than one RX buffer trigger a kernel memory corruption through a stale skb pointer in the checksum-success path of lan743x_rx_process_buffer(), with the flawed write landing on freed fragment skb metadata. According to the vendor description this multi-buffer condition only arises transiently after an operator performs a live MTU increase, because existing ring entries retain their old, smaller buffer size until they are replenished; the vulnerable driver must be present and the host must be using that specific Microchip hardware. Vendor patches are available in the stable trees (6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4), EPSS is low at 0.18% (7th percentile), and no public exploit code or CISA KEV activity was identified at time of analysis; our independent assessment rates real-world priority LOW despite the vendor-supplied 8.1 CVSS because exploitation is gated on hardware, a concurrent operator-initiated MTU change, and a short-lived window.
A write use-after-free in the Linux kernel's XFRM (IPsec) state framework allows a local attacker who can add and delete xfrm states to corrupt freed slab memory, which in turn spawns a read use-after-free during state lookup. The defect is an incomplete fix: commit 14acf9652e56 switched the bydst/bysrc/byseq/byspi hash lists to hlist_del_init_rcu() but missed state_cache and state_cache_input, so a second __xfrm_state_delete() on the same state writes through the LIST_POISON2 pprev value instead of becoming a harmless no-op. Exploitation requires low privileges (CVSS PR:L, AV:L) - realistically the ability to manipulate xfrm state, normally gated by CAP_NET_ADMIN, which unprivileged users can obtain inside a user plus network namespace - and the attacker must win a timing-dependent delete/delete race (AC:H), so this is a real but not urgent kernel memory-corruption bug rather than a mass-exploitation priority: no public exploit identified at time of analysis, EPSS 0.21% (10th percentile), and no CISA KEV listing.
Use-after-free in the Linux kernel's IPsec/xfrm receive path (xfrm_input) can be triggered by a local attacker with low privileges on hosts that run IPsec with VTI tunnels or XFRM interfaces configured. The receive callbacks for VTI and XFRM interfaces - as well as the XFRM_MAX_DEPTH error path - call secpath_reset(), which can drop the last reference to an xfrm_state that xfrm_input() subsequently dereferences when selecting transport_finish() or reporting the drop-callback protocol; if that state is concurrently deleted, the freed object is accessed, yielding memory corruption with high confidentiality and integrity impact. Successful exploitation requires winning a race between secpath_reset() and concurrent xfrm_state teardown, so the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (note the high attack-complexity, which differs from the NVD-published AC:L value); EPSS is low at 0.21% (10th percentile), there is no KEV listing, and no public exploit identified at time of analysis.
A missing hardware memory-ordering barrier in the Linux kernel's MIPS EYEQ support lets a local, authenticated user crash the kernel on Mobileye EyeQ5 / MIPS I6500 systems. On I6500 cores the lld/scd (LL/SC) instructions provide no ordering guarantees, so arch_cmpxchg() - documented and relied upon as fully ordered - can be reordered and read freed or uninitialized memory, producing a kernel paging fault and oops (observed in anon_pipe_read while stressing an anonymous pipe, whose mutex uses cmpxchg). Exploitation requires CONFIG_EYEQ hardware, local access, and winning a timing/race window; there is no network vector and no impact on x86, ARM, or other MIPS configurations. The fix commit is public and includes a userspace reproducer (pipe_race.c), so publicly available exploit code exists, but no confirmed active exploitation (not in CISA KEV); EPSS is 0.15% (4th percentile), and the observed outcome is a kernel oops rather than a controlled compromise.
Incorrect DMA mmap handling in the Linux kernel's IB/hfi1 Omni-Path driver (PIO_CRED case) lets a local, authenticated user with access to the HFI character device crash the kernel with a corrupted page-table oops or, once only the offset arithmetic is corrected, permanently stall send-PIO transfers. Kernels from 6.3 onward that include the hfi1 driver are affected, but the fault is intermittent-it appears only when the hardware send-context index reaches 64 or 128-and requires Intel Omni-Path 100 hardware plus the PSM2 path to invoke hfi1_file_mmap(). No public exploit code was identified at time of analysis, EPSS is low (0.18%, 6th percentile), and vendor-released fixes exist in 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4; given the local-only vector, mandatory specialized hardware and intermittency, overall risk is assessed as moderate rather than high-priority.
Stale sysfs attributes left behind by the Linux kernel's w83791d hwmon driver after unbind can expose freed memory to local users, because the normal remove path deletes only the w83791d_group but not the optional w83791d_group_fanpwm45 group created when the fan/pwm 4-5 pins are not used as GPIO. Callbacks on those leftover files dereference devm-allocated driver data that is released after unbind, creating a use-after-free condition. The flaw is local-only and highly conditional (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0): it requires a system physically equipped with the Winbond W83791D sensor chip, the fan/pwm 4-5 pins not configured as GPIO, and a driver unbind through the normal teardown path, and exploitation further depends on winning a race against the devm free. There is no public exploit identified at time of analysis, EPSS is low at 0.22% (11th percentile), and vendor patches are available in the stable trees.
A slab use-after-free read in the Linux kernel's drm/msm driver (Qualcomm Adreno GPUs) allows a local, low-privileged user with access to the DRM device node to leak or corrupt freed kernel memory. The flaw arises because msm_ringbuffer_destroy() and msm_gem_vm_free() call drm_sched_fini() and then free objects that still embed a drm_gpu_scheduler with plain kfree(), while a signalled fence exported to userspace (submit out-fence or VM_BIND fence via sync_file/drm_syncobj) still points at that embedded scheduler; an unprivileged SYNC_IOC_FILE_INFO call then reaches drm_sched_fence_get_timeline_name() and dereferences the freed slab. Rated CVSS 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) with EPSS of only 0.21% (10th percentile) and no public exploit identified at time of analysis; the issue is confined to systems where the msm driver is built and loaded, and is fixed by freeing these scheduler-containing objects with kfree_rcu().
Use-after-free in the Linux kernel's CIFS/SMB client can be triggered when the cifs_demultiplex_thread exits while a reconnect work item is still queued on cifsiod_wq, allowing smb2_reconnect_server() to read a server structure that clean_demultiplex_info() has already freed with kfree_sensitive(). The bug is reached unauthenticated per the vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R), but it requires an active CIFS/SMB mount to an attacker-controlled or repeatedly failing SMB server plus a narrow race at connection teardown, which is why the assessed impact is LOW in practice even though the published base score is 7.5. EPSS is 0.21% (10th percentile), no public exploit has been identified at time of analysis, and vendor fixes exist in the 6.6.158, 6.12.112, 6.18.54 and 7.2.8 stable releases.
Kernel memory corruption and crash in the Linux kernel's SMB/CIFS client (cifs.ko) arises from a missing list-head initialization in TCP_Server_Info.rlist combined with a race in cifs_signal_cifsd_for_reconnect(). Because rlist is allocated with kzalloc, its ->next and ->prev pointers are NULL rather than self-referential, so list_empty() always returns false and list_add() dereferences a NULL ->prev; concurrently, multiple cifsd threads can add the same server's rlist node twice, corrupting the list. Only systems actively using the kernel SMB/CIFS client with a mounted share and a reconnect event are affected; the authoritative assessment scores this CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H, i.e. unauthenticated but requiring user interaction and a hard-to-win timing race, with impact limited to a kernel crash (denial of service) rather than code execution or data theft. EPSS is low at 0.18% (6th percentile), and no public exploit has been identified at time of analysis.
A use-after-free race in the Linux kernel CIFS/SMB client (cifs_try_adding_channels()) allows a malicious or compromised SMB3 multichannel server to corrupt kernel memory on any client that mounts a share with multichannel enabled, primarily causing a kernel crash (high availability impact) and, secondarily, limited disclosure of freed memory contents. The client's interface iteration caches the next ses->iface_list entry under iface_lock, then drops that lock for the full duration of cifs_ses_add_channel(); a concurrent SMB3_request_interfaces()/parse_server_interfaces() refresh can mark interfaces inactive and kfree() that cached entry before the iterator advances, after which the loop dereferences freed memory. Reaching the window requires the client to have established an SMB3 multichannel session against an attacker-influenced server (CVSS vector PR:N but UI:R, AC:H), and no public exploit code has been identified at time of analysis; EPSS is 0.21% (10th percentile), so exploitation is opportunistic rather than broadly observed.
Use-after-free and out-of-bounds pointer handling in the Linux kernel CIFS/SMB client (cifs.ko) lets a malicious or man-in-the-middle SMB server corrupt kernel memory on a connecting client by returning crafted encrypted compound PDUs. The defect sits in receive_encrypted_standard(), where a stale next_buffer pointer retained on error paths and unvalidated NextCommand/next_cmd offsets taken from pre-decryption length can lead to use-after-free and reads beyond the reassembly buffer, affecting confidentiality, integrity and availability of the host. Exploitation requires the victim to act as an SMB client and mount or connect to an attacker-controlled share, with SMB3 encryption/sealing negotiated and attacker-controlled server responses; no public exploit has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and vendor-released patches exist for the affected stable trees.
Kernel slab memory disclosure in the Linux kernel's SMB/CIFS client (cifs.ko) occurs when a malicious or compromised SMB3 server returns a short reply to a snapshot-enumeration ioctl (FSCTL_SRV_ENUMERATE_SNAPSHOTS), causing smb3_enum_snapshots() to set ret_data_len to sizeof(struct smb_snapshot_array) (12 bytes) without validating the server's actual reply length; the subsequent copy_to_user() then reads past the end of the server-sized retbuf and exposes adjacent kernel heap contents to the requesting user-space process. Only Linux systems acting as SMB clients are affected, and exploitation requires the victim to connect outbound to the attacker-controlled server and actively trigger snapshot enumeration (UI:R) while running a kernel with the vulnerable cifs client code, so unauthenticated remote attackers cannot reach an idle host. There is no public proof-of-concept and no evidence of active exploitation at time of analysis; EPSS is 0.21% (11th percentile), and patches are available in stable releases 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
Use-after-free in the Linux kernel's drm/ttm graphics memory manager (a regression introduced by commit b2ed01e7ad3d, present in roughly 7.0.10 through 7.1 and in stable backports such as Ubuntu 7.0.0-31) allows a locally authenticated user with an active GPU workload to crash the kernel minutes to hours after a swapout event. Because ttm_bo_swapout_cb() skips the bulk_move bookkeeping on successful swapout, a swapped-out resource stays on its buffer object's bulk_move range and on the manager LRU while being unevictable; when it is later freed or the BO leaves the bulk_move, ttm_resource_del_bulk_move() skips it due to its unevictable guard, leaving a dangling cursor that the next ttm_lru_bulk_move_tail() or ttm_resource_add_bulk_move() dereferences. Exploitation requires local presence, an affected AMD/drm-ttm system, and timing-dependent hibernation or memory-pressure conditions (the reporter observed crashes in only 5 of 18 hibernation cycles), and no public exploit code has been identified at time of analysis; EPSS is 0.20% (9th percentile), signalling low near-term exploitation likelihood.
Remote code execution in Mitel MiVoice Office 400 is possible when an authenticated high-privilege user uploads a malicious shared object through the Music on Hold configuration page instead of a valid WAV file, because the application fails to validate file type before loading it. This is a CWE-434 unrestricted file upload issue affecting the web portal on TCP 443; the independent assessment maps it as CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. No public exploit code or confirmed KEV exploitation was identified in the provided intelligence, and exploitation is constrained by the need for administrative credentials to reach the vulnerable upload feature.
Terminal escape-sequence injection in colmux, the multi-host aggregation front-end shipped with collectl before 4.3.20.2, lets an attacker who already holds an unprivileged local account on a monitored host embed crafted ANSI/VT100 control sequences - delivered via a fake process name (argv[0]) in the host's collected process data - into the terminal of an operator running colmux and viewing that host. Because colmux renders remote data without neutralizing escape, meta, or control characters (CWE-150), the injected sequences can rewrite displayed output or invoke terminal-emulator features, giving high integrity and confidentiality impact on the operator's session (CVSS 3.1 7.7, AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N). Exploitation is constrained by stacked prerequisites: attacker foothold on a monitored node, an operator actively viewing that host in colmux, and a terminal emulator that still honors the more dangerous escape sequences, which many modern emulators disable by default; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV.
Out-of-bounds write in the NVIDIA Virtual GPU Manager (vGPU plugin) lets an unprivileged user inside an assigned guest VM corrupt host-side memory by sending a specially crafted RPC call across the virtualization channel, resulting in privilege escalation, data tampering, and denial of service on the host. Rated CVSS 7.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H), the bug is only reachable in vGPU/VDI/cloud-GPU deployments where the host runs the vGPU plugin and has at least one guest assigned; it is not a network-facing flaw and does not affect standard bare-metal Linux GPU driver installs, and no public exploit code has been identified at time of analysis. Real-world risk is therefore defined by the attack surface rather than by mass exploitability, since a successful attack requires an attacker to already hold an unprivileged local account inside a hosted guest VM.
Incorrect resource transfer between spheres in the NVIDIA vGPU Virtual GPU Manager for Linux allows a locally positioned, low-privileged attacker to break an internal resource-handling boundary and gain high-integrity impact - code execution, privilege escalation, data tampering, information disclosure, or denial of service on the host running the vGPU Manager. This affects virtualization/vGPU deployments on Linux (the manager component on the hypervisor host), not standard desktop GPU drivers, and the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) confirms the attacker must already hold local low-privileged access to a context served by that manager, such as a guest VM or a local account on the host; there is no network or unauthenticated path. It is a genuine local privilege-escalation class issue rather than a remotely triggerable one, and no public exploit was identified at time of analysis.
An out-of-bounds write in the kernel-mode layer of NVIDIA vGPU Virtual GPU Manager for Linux lets a local attacker with low privileges corrupt kernel memory, which the vendor rates as potentially leading to code execution, denial of service, privilege escalation, information disclosure, and data tampering (CVSS 3.1 base 7.8, HIGH). The attack is strictly local - vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - so it is not remotely exploitable and requires only an authenticated low-privileged context or a tenant/guest that can reach the host kernel module; the risk is highest in multi-tenant VDI and cloud-GPU deployments where local access is comparatively easy to obtain. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so there is no evidence of confirmed active exploitation.
Local privilege escalation, code execution, denial of service, and information disclosure affect Linux hosts running NVIDIA vGPU Virtual GPU Manager because of an out-of-bounds read in the kernel-mode layer that services vGPU requests. A low-privileged local account or existing code-execution context (CVSS PR:L) is required, and no user interaction is needed, but the flaw is not remotely reachable and only impacts hosts with the vGPU Manager component installed. No public exploit or proof-of-concept has been identified at time of analysis, and EPSS data was not provided; the independent assessment rates this as a moderate, locally-scoped risk.
Local privilege escalation in NVIDIA vGPU Virtual GPU Manager for Linux stems from an out-of-bounds read in firmware (CWE-125) that a low-privileged local attacker can trigger with no user interaction and low complexity. The CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impact on vGPU/VDI/cloud-GPU hosts that use the affected Linux Virtual GPU Manager. No public exploit was identified at time of analysis, and exploitation requires an existing local foothold; it is not remotely exploitable despite the RCE tag.
Local attackers with low privileges on a Linux host running NVIDIA vGPU Virtual GPU Manager can trigger an out-of-bounds read in the kernel-mode layer, potentially leading to code execution, privilege escalation, denial of service, information disclosure, and data tampering. The flaw is not remotely reachable and affects only virtualization, VDI, or cloud-GPU hosts that run the vGPU Manager. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in NVIDIA vGPU Virtual GPU Manager for Linux allows a local authenticated attacker with low privileges to potentially achieve code execution, denial of service, or information disclosure. The vulnerability resides in the kernel-mode driver and affects both the vGPU Manager and guest driver components. No public exploit code has been identified, and the flaw is not known to be actively exploited. Integrity impact is assessed as low, but confidentiality and availability impacts are high, making this a significant risk in multi-tenant vGPU deployments.
An out-of-bounds read in the kernel-mode layer of the NVIDIA vGPU Virtual GPU Manager for Linux lets a local attacker who can already reach the vGPU kernel interface trigger memory reads past the bounds of an allocated buffer, potentially yielding information disclosure, data tampering, privilege escalation, denial of service, or kernel code execution. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is only reachable by an authenticated local principal - a low-privileged user or a guest context on the hypervisor - and not by an unauthenticated remote network attacker. Exposure is limited to hosts that actually deploy NVIDIA vGPU on Linux (VDI and cloud-GPU virtualization platforms), where the highest-impact scenario is a multi-tenant deployment in which the over-read crosses tenant isolation boundaries; no public exploit code or CISA KEV entry was identified at time of analysis, so this is a genuine but not emergency-grade issue warranting scheduled patching.
An out-of-bounds write in the NVIDIA Virtual GPU Manager (vGPU plugin) for Linux allows a user who already holds a low-privileged account inside a guest VM to corrupt host-side memory by sending a crafted RPC message whose performance-state list size parameters are invalid, potentially yielding code execution, privilege escalation, data tampering, denial of service, or information disclosure across the virtualization boundary. The defect is locally triggered (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and requires no user interaction, but it is only reachable on hosts actually running the vGPU Manager for multi-tenant vGPU/VDI/cloud-GPU workloads - single-tenant systems without vGPU virtualization are not exposed through this guest-to-host path. No public exploit has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); exploitability is constrained by the need for prior guest authentication and the presence of the vGPU component, making this a contained but genuine virtualization-trust-boundary flaw rather than a broad remote threat.
Out-of-bounds read (CWE-125) in the kernel-mode layer of NVIDIA's vGPU Virtual GPU Manager for Windows and Linux allows a low-privileged process inside a guest VM to force the host-side vGPU driver to read past the end of an allocated buffer (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), primarily exposing host memory contents and creating crash and denial-of-service risk, with code execution and privilege escalation described by the vendor only as possible rather than demonstrated. The issue is reachable only on hosts actively running vGPU configurations such as VDI or cloud GPU hosting where an attacker already holds a foothold inside a guest; bare-metal and non-vGPU installations are not affected, and no user interaction or network reach is required. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no fixed driver version appears in the available intelligence, so defenders should treat patch confirmation through NVIDIA's advisory as the priority action.
An out-of-bounds write in the kernel-mode layer of the NVIDIA vGPU Virtual GPU Manager for Windows and Linux allows a local attacker holding low privileges to corrupt kernel memory and potentially achieve code execution, privilege escalation, denial of service, information disclosure, and data tampering (CVSS 3.1 base 7.8). The flaw is local-only (AV:L) and requires an existing low-privileged foothold (PR:L) with no user interaction (UI:N); there is no public exploit identified at time of analysis and the package is not listed in CISA KEV. Although the numeric score is High, practical risk is assessed as MODERATE because exploitation demands local code execution on a host that specifically runs the vGPU manager - a component found in vGPU/VDI and cloud-GPU deployments rather than ordinary consumer driver installs.
Missing authorization in the NVIDIA vGPU GPU kernel driver lets a low-privileged user inside a guest VM reach privileged host GPU resources on Windows and Linux hosts, giving up to code execution, privilege escalation, data tampering, denial of service, and information disclosure on the hypervisor-side GPU stack. Exploitation requires local code execution within a guest (CVSS AV:L, PR:L, UI:N) in a vGPU deployment, so it is a realistic escalation primitive for tenants of shared-GPU, VDI, and cloud desktops rather than an internet-facing issue. No public exploit identified at time of analysis; risk is operator-context-dependent, but the high CIA impact and easy automation make prioritization relevant wherever untrusted tenants share vGPU capacity. Authentication requirements are confirmed as low-privileged/authenticated (CVSS vector PR:L).
Local privilege escalation, code execution, denial of service, information disclosure, and data tampering are possible in NVIDIA GPU Display Driver for Linux due to a use-after-free in the open-source kernel module's event-delivery path. An authenticated local user with access to NVIDIA GPU device nodes can race asynchronous event delivery against file close (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), though the high attack complexity makes success non-deterministic and typically requires repeated attempts; no public exploit has been identified at time of analysis. Risk is concentrated on Linux hosts using the affected open-source kernel module, particularly multi-tenant vGPU, VDI, and cloud GPU deployments.
Local privilege escalation in the NVIDIA GPU Display Driver for Linux kernel-mode layer allows an already-present local user or code-execution foothold (PR:L) to write to memory that should be read-only because memory permissions are not preserved, potentially achieving code execution and elevated privileges on affected GeForce, RTX/Quadro/NVS, and Tesla systems, including vGPU Guest Driver deployments. Exploitation requires local access and high attack complexity, with no remote or unauthenticated network path; no public exploit was identified at time of analysis and the CVE is not listed in CISA KEV. The vendor-supplied CVSS vector uses AV:P while our independent assessment uses AV:L, so the physical-access requirement should be confirmed against NVIDIA bulletin 5861.
Denial of service and kernel memory disclosure in the NVIDIA GPU Display Driver for Windows and Linux let a local, low-privileged user who already holds an interactive session on the host force the kernel-mode component to dereference an untrusted pointer, crashing the driver or leaking kernel memory. The flaw is scored CVSS 3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) - a local-only, low-complexity attack requiring low-privilege authenticated access with no user interaction, delivering high confidentiality and availability impact but no integrity or write primitive, so it cannot by itself be chained into privilege escalation or code execution. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing); the most exposed deployments are multi-user, VDI, and cloud-GPU hosts where untrusted users share a GPU, since the attacker must first obtain code execution or an interactive session on the GPU host.
Authenticated low-privileged local users can bypass cryptographic signature verification in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux when the system is under memory pressure, leading to data tampering and denial of service. The flaw affects GeForce, RTX/Quadro/NVS, and Tesla driver branches on Linux; no public exploit code has been identified at time of analysis. Our assessment rates this as a genuine but bounded-priority local issue because the attacker must reliably induce a low-memory kernel state at the moment of verification, making exploitation opportunistic rather than dependable.
Local privilege escalation in NVIDIA GPU Display Driver for Windows and Linux can be achieved by an unprivileged local user through the open-source kernel module's DMA-BUF import path, where importing a read-only buffer from another device's DMA-BUF exporter improperly preserves memory access permissions. Successful exploitation can result in code execution, privilege escalation, denial of service, information disclosure, and data tampering, with CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data.
Local privilege escalation and kernel-level code execution in the NVIDIA GPU Display Driver for Windows and Linux, where the kernel-mode layer follows an error-handling path that operates on an improperly initialized resource (CWE-908). The flaw is reachable by an authenticated, low-privileged local user (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) on any host where the affected driver is installed and loaded, granting full confidentiality, integrity, and availability impact within the kernel-mode driver's scope. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); risk is concentrated on shared multi-tenant GPU hosts such as VDI, cloud GPU instances, and vGPU guests where untrusted local users coexist with the driver, and success may be probabilistic because the attacker must reliably trigger the failing error path.
Memory corruption in the Linux kernel IPv4 receive path lets a local attacker who can inject a packet with malformed checksum metadata (an out-of-range skb checksum_start) into the host IPv4 stack cause skb_checksum_help to write into and corrupt the network header, yielding high-integrity and high-confidentiality impact with a changed security scope (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 9.3). The flaw is realistically reachable by an unprivileged process inside a sandbox, container, or guest VM that can supply attacker-controlled checksum metadata to the host kernel, making multi-tenant and sandboxed environments the primary exposure; single-tenant systems with no untrusted local or sandboxed workloads are materially less exposed. Exploitation requires local access only (no remote network path indicated), and intelligence available at the time of analysis shows no confirmed active exploitation (no CISA KEV) - though linked references to sandbox-escape research (pwn.ai's 'Pwnescape' and Vercel's $1M sandbox challenge findings) indicate the underlying primitive is being actively studied.
Null pointer dereference in FreeRDP versions 2.0.0 through 3.31.x allows a malicious RDP server to crash Linux clients that have serial-port redirection enabled. The attacker sends IRP_MJ_READ or IRP_MJ_WRITE requests either before the serial channel is created or after it is closed, causing CommReadFile or CommWriteFile to dereference a null handle and terminate the client. This is an availability-only issue (CVSS 4.0 score 7.1, no confidentiality or integrity impact) that requires the victim to initiate a connection to the attacker-controlled server and have serial redirection active; no public exploit code has been identified at time of analysis.
A crafted DOS (MBR) extended-partition image can trigger a 32-bit integer overflow in util-linux's libblkid partition parser before version 2.41.4, causing the library to report a bogus partition that overlaps the master boot record. An unprivileged local attacker only needs to get a malicious disk image or removable medium in front of a probing path - such as automatic udev/udisks inspection of an inserted USB device, or any tool, VM, or forensic pipeline that scans attacker-supplied images - and no public exploit code or confirmed active exploitation has been identified at time of analysis. The realistic impact is limited: libblkid's reported partition metadata is falsified (an integrity issue), while actual disk modification or availability loss would require a separate downstream consumer to trust and act on that incorrect metadata, so the practical risk is modest despite a higher CVSS base score in some feeds.
Local privilege escalation in the SUID-root mount(8) utility shipped with util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, where the attacker-controlled LIBMOUNT_FORCE_MOUNT2 environment variable is read with getenv() and can force the legacy, non-atomic multi-step bind-mount path. On hosts whose /etc/fstab contains a bind mount authorized for unprivileged use via the user or users option and hardened with nosuid, noexec, or nodev, a local low-privileged user can win a timing race between the initial bind mount and the follow-up remount that applies those protective flags, briefly exposing an unprotected mount from which a SUID binary can be executed to obtain root. Exploitation is conditional (it requires that specific non-default fstab configuration) and non-deterministic because it depends on a race window; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV). Vendor-released patches are available in util-linux 2.41.5 and 2.42.2.
Local privilege escalation to root in util-linux's libmount affects versions 2.17 through 2.41.6 and 2.42 through 2.42.3, and also 2.42.4 when the legacy mount(2) path is used without /proc available. A local, low-privileged user who is already authorized by an /etc/fstab entry carrying the user or users option can exploit a time-of-check/time-of-use race: libmount validates the fstab target path and then the mount operation re-resolves that pathname, so an attacker who controls a writable ancestor directory can use renameat2(RENAME_EXCHANGE) to swap a path component and redirect the authorized mount to a root-owned location such as /etc/sudoers.d, gaining root. Exploitation is local only, requires the attacker to already hold an fstab mount authorization plus a writable ancestor on the configured target, and depends on winning the race (assessed AC:H), so it is non-deterministic; patched code paths using the new mount API (2.41.5 / 2.42.2 and later) or 2.42.4 with /proc present are not affected, and no public exploit identified at time of analysis.
Local privilege escalation in util-linux's SUID mount utility affects versions 2.39 through 2.41.4 and 2.42 through 2.42.1: a local, already-authorized low-privileged user can win a narrow timing race in the post-mount hook and redirect a privileged chmod()/lchown() onto a root-owned path, potentially obtaining root privileges. Exploitation requires a non-default /etc/fstab entry that combines the 'user' or 'users' mount option with an X-mount.mode, X-mount.owner, or X-mount.group option, plus write access to a writable ancestor directory of the mount target; the race itself is difficult (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released fixes in 2.41.5 and 2.42.2.
Local privilege escalation in the Microsoft MANA network driver for the Linux kernel lets an authenticated low-privilege user on the host raise privileges to kernel/root level by winning a time-of-check time-of-use race in the driver (CWE-367). The attack is strictly local (AV:L) and high-complexity (AC:H) because the race must be won, and it only applies where the MANA driver is present and loaded - in practice Azure-hosted or MANA-capable Linux systems that use it as the primary network path. A vendor-released patch is available per the Microsoft advisory; no public exploit identified at time of analysis, and there is no confirmed active exploitation (not listed in CISA KEV).
Command injection in the VNote note-taking application before version 4.3.0 lets an attacker-controlled note filename execute arbitrary commands as the victim user on Linux and macOS, but only when the victim opens that note and has configured an external program whose arguments are command-capable, such as vim/gvim's -c option. The root cause is SessionConfig::ExternalProgram::fetchCommand, which wraps the note path in double quotes and hands the whole string to QProcess::start(const QString&), so a double quote inside a POSIX filename terminates the quoted path and appends attacker-chosen arguments to the configured program. The vendor fixed the issue in 4.3.0; no public exploit identified at time of analysis, and the CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.0) reflects full impact on confidentiality, integrity and availability once the narrow exploitation prerequisites are met.
Unauthenticated remote attackers can tamper with token state and disrupt service availability in NVIDIA AIStore for Linux by sending crafted token-revocation lists to a token-revocation endpoint that performs no authentication check (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Because the vector shows PR:N and UI:N, no credentials, privileges, or user interaction are needed - any network-reachable deployment of the affected endpoint is directly exploitable, with the only practical limiting factor being firewall or segmentation controls around the AIStore management/control interface. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the missing authentication control (CWE-306) is the defect itself, so the issue should be treated as a genuine high-priority exposure rather than an inflated score.
Missing authorization in the NVIDIA AIStore ETL management API lets remote, unauthenticated attackers read ETL job information and issue start or stop operations against existing extract-transform-load pipelines by sending crafted GET or POST requests to an AIStore proxy (CVE-2026-65172, CVSS 8.6, CWE-862). Per the assessed vector (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:L), no credentials or user interaction are required; the practical constraint is network reachability to a proxy that exposes the ETL management API in Linux or Kubernetes deployments. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the immediate risk is driven by exposure of the proxy API rather than by observed attack activity.
Unauthenticated remote attackers can abuse NVIDIA AIStore's experimental HT backend to perform server-side request forgery by supplying a crafted 'original URL' value, causing the AIStore server to issue requests to attacker-chosen destinations and disclose information reachable from the server's network position. The flaw carries a CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), reflecting no authentication or user interaction requirement and a scope change, with impact confined to confidentiality - integrity and availability are unaffected. There is no public exploit identified at time of analysis, and the practical risk is gated almost entirely on whether the experimental HT backend has been enabled on a network-exposed deployment, since that component is not part of the default AIStore configuration and is only reachable in non-standard setups.
Path traversal in the NVIDIA AIStore for Linux dSort archive extraction component allows a remote attacker to write files outside the intended extraction directory by submitting a dSort job that references an archive (e.g., tar/zip) whose member names contain crafted traversal sequences, yielding arbitrary file creation or overwrite and potentially code execution, information disclosure, data tampering, and denial of service. The vulnerability carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) per the assessed vector, indicating remote reachability and no authentication requirement, but a high attack-complexity rating that reflects the difficulty of reliably crafting the malicious archive and triggering the flaw. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis; the practical gating factor is network access to the AIStore dSort/API endpoint, which in typical deployments is confined to a trusted ML/training cluster or private network rather than being internet-facing. Because the dSort job-submission path is the attack surface, exposure is primarily amplified where AIStore's API is reachable from untrusted networks, and no user interaction is required.
Unauthenticated path traversal in the target-side object rename handler of NVIDIA AIStore on Linux allows a remote attacker who can reach a target (storage) node directly to write files outside the intended storage directory by supplying a crafted rename destination, resulting in arbitrary file creation or overwrite. NVIDIA rates the issue CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-22), with downstream consequences that could include code execution, privilege escalation, information disclosure, data tampering, and denial of service depending on what the overwritten path controls. Exploitation is constrained rather than trivial: the attacker needs network reachability to a target node - not merely the front-end proxy - and must build a traversal payload the rename handler accepts, so exposure is greatest in flat cluster networks or environments where target ports are directly reachable; no public exploit code and no CISA KEV entry were identified at time of analysis.
Omarchy 4 before 4.0.1 stages files from third-party themes without filtering executable content, so installing a theme from an untrusted Git repository and applying it with omarchy-theme-set lets the theme author run code as the victim user: Hyprland loads a theme's hyprland.lua and gum_env.lua at login, Neovim loads neovim.lua at startup, terminal configs (alacritty.toml, foot.ini, ghostty.conf, kitty.conf) name the program the terminal launches, and vscode.json installs an arbitrary VS Code extension. The CVSS 7.1 rating is tempered by the deliberate user action required - a user must choose to install and apply an attacker-supplied theme (UI:R, no credentials needed, PR:N) - and by the confinement of the resulting code to the victim's own privileges rather than root, which places real-world urgency at moderate-to-low rather than drop-everything. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; the vendor shipped a fix in the v4.0.1 release, and users who only apply bundled or self-authored themes are not exposed.
Privilege escalation in MariaDB Server (10.6.1 up to 10.6.28, 10.11.x before 10.11.19, 11.4.x before 11.4.13, 11.8.x before 11.8.9, 12.3.x before 12.3.3, and 13.0.x before 13.0.2) allows an authenticated database user holding the FILE privilege to plant a /run/mysqld/wsrep-new-cluster file when secure-file-priv permits writes into that runtime directory, which the packaged mariadb.service systemd unit subsequently consumes as an EnvironmentFile. On the next administrator-triggered restart of mariadb.service, attacker-controlled environment values are injected into the mariadbd process, escalating from the database user context onto the host/systemd layer (scope change) with full confidentiality, integrity, and availability impact. The vendor rates this 8.4 while our independent assessment uses CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H, reflecting that exploitation requires a high, non-default privilege and a restart gate; no public exploit code has been identified at time of analysis, and patched releases are already available.
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 lets a remote peer stall outbound mail delivery by accepting a TCP/TLS connection and then sending nothing. Socket timeouts are applied in the form the Windows stack accepts but Linux refuses, and the server's HTTPS clients (MTA-STS, DANE TLSA, OAuth2, ACME) read without a deadline, so an attacker can pin worker threads indefinitely and stop delivery, ManageSieve, and metrics service for everyone else. The MTA-STS policy fetch is enabled by default and is performed during outbound delivery to mta-sts.<recipient domain>, so anyone who can make the server deliver mail to a domain they control - for example as the envelope sender of a message that bounces - can hold delivery threads until outbound mail stops; Windows builds are not affected at all. Per the authoritative assessment the vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), i.e. unauthenticated with no user interaction, but impact is bounded to availability only; no public exploit identified at time of analysis, and the fix ships in release 6.3.6.
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 on Linux allows an attacker who already has code execution as the unprivileged hmailserver service account to run arbitrary code as root via the live-update apply helper (hmailserver-update). The vulnerability requires the live-update path unit to be active, which is the default for the project's .deb and .rpm packages and applies to AppImage installations run under that unit, but does not affect non-Linux builds. No public exploit code has been identified at time of analysis, and the vendor has released version 6.3.6 to address the issue.
Local privilege escalation in Splunk Enterprise on Linux (versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15) allows an attacker who can already run commands as the OS account running Splunk Enterprise to inject operating-system commands into installation content that a subsequent root-privileged Linux package upgrade will execute as root. The flaw is conditional: the attacker must modify the installation and then a privileged package upgrade must occur, so there is no at-will escalation. No public exploit or confirmed active exploitation was identified at time of analysis.
A use-after-free and RCU-safety defect in the Linux kernel's IPsec/xfrm transport-mode packet reinjection path can crash or corrupt the kernel, and is reachable by a local low-privilege attacker (CVSS PR:L) who can also trigger network device unregistration. The flaw was introduced when xfrm_trans_reinject() was converted from a tasklet to a workqueue (commit 4f4920669d21), so finish callbacks such as ip6_rcv_finish() now run in process context without an RCU read-side critical section, and queued skbs may hold non-refcounted dst entries whose skb->dev is not kept alive while deferred. Our independent assessment scores this CVSS 3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (availability-only, high attack complexity), and there is no public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile) and no CISA KEV listing exists.
Use-after-free of GUP-pinned zerocopy page buffers in the Linux kernel's IPsec ESP out-of-place output path lets a local, authenticated user (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) who can send MSG_ZEROCOPY traffic over an ESP transform corrupt memory, potentially achieving privilege escalation (C:H/I:H/A:H), while the same code path simultaneously leaks an x->xfrag page per packet. Exploitation requires a host with IPsec ESP configured where esp->inplace == false and where the transmitted skb carries SKBFL_MANAGED_FRAG_REFS, so hosts without ESP or without zerocopy sends on that path do not reach the vulnerable frag mutation. No public exploit has been identified at time of analysis, the issue is not in CISA KEV, and the EPSS score is low (0.17%, 6th percentile), consistent with a moderate-priority local issue; vendor-released patches exist in 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, and 7.3-rc4.
A use-after-free race in the Linux kernel's RDMA/siw (SoftiWARP) driver lets a local, low-privileged user who can issue RDMA verbs operations corrupt kernel memory and potentially escalate privileges or crash the system. The bug is reachable when siw_qp_modify() fails inside siw_accept() and the QP's state_lock is released before the error path clears qp->cep, opening a window in which a concurrent ibv_modify_qp() transition to ERROR frees the same cep object. Exploitation requires the siw module to be loaded and a narrow race to be won, so practical risk is limited to environments using software RDMA; no public exploit code has been identified, EPSS is low (0.17%, 6th percentile), and the issue is not listed in CISA KEV, while vendor patches are available for all supported stable branches.
A use-after-free in the Linux kernel's RDMA/rxe (Soft-RoCE) memory-region re-registration path lets a local attacker who can reach the RDMA user-verbs character device corrupt kernel memory and potentially achieve privilege escalation, scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The bug is reachable only when rxe_rereg_user_mr() is called with both IB_MR_REREG_PD and IB_MR_REREG_ACCESS set while supplying an access bit outside RXE_ACCESS_SUPPORTED_MR, causing the protection domain to be reassigned without the core's use-count being rolled back and leading to a protection domain (and a memory window still referencing it) being freed while in use. Exploitation is realistically narrow: the rdma_rxe module must be loaded and an rxe device configured (not a default configuration), the attacker needs local device access, and an existing memory window must reference the PD; no public exploit code was identified at time of analysis and EPSS is low at 0.16% (4th percentile).
Out-of-bounds read and write in the Linux kernel's RDMA Soft-RoCE (rxe) driver (CVE-2026-98365) lets an unauthenticated peer on an already-established RDMA queue pair send a crafted RDMA-Write or RDMA-Read RETH whose iova+length wraps to zero, bypassing the mr_check_range() bounds check and causing a kernel oops (and possible memory corruption) in rxe_mr_copy_xarray(). No public exploit code was identified at time of analysis and EPSS is low at 0.17% (5th percentile), but realistic exposure is gated by configuration: the rdma_rxe module must be loaded and the host must expose Soft-RoCE on a reachable interface, which is not the default Linux setup. Vendor-released patches are available in stable kernels 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
A race-condition use-after-free in the Linux kernel's xfrm (IPsec) bundle-creation path allows a local attacker with low privileges to trigger a stale net_device pointer dereference, yielding kernel memory corruption with high confidentiality, integrity, and availability impact. The flaw is reachable when an IPv6 UDP send traverses xfrm_lookup_with_ifid()/bundle creation while a concurrent RTM_DELLINK tears down the underlying net_device - a capability typically obtained by an unprivileged user inside a user+network namespace on kernels that permit unprivileged namespaces. Exploitation is local-only and probabilistic (it depends on winning an inherent timing race and on xfrm/IPsec policies being active), so realistic risk is below the vendor CVSS of 7.8; EPSS is low at 0.15% (4th percentile), no public exploit code was identified at time of analysis, and the issue is not in CISA KEV.
Local privilege escalation and data-corruption primitive in the Linux kernel's RDMA/rxe (Soft-RoCE) software-RDMA driver: a missing HMM_PFN_WRITE permission test in the on-demand-paging (ODP) write path lets an unprivileged local user who can register an ODP memory region over a PROT_READ file mapping direct incoming RDMA traffic (RDMA WRITE, RDMA READ responses, SEND payloads, atomics) through kmap into read-only page-cache pages without ever triggering copy-on-write, overwriting files the attacker only holds O_RDONLY - classically /etc/passwd or a setuid binary - in the same primitive class as Dirty COW and CVE-2022-2590. The flaw was introduced by commit 0b261d7c1cd3 ("RDMA/rxe: Break endless pagefault loop for RO pages"), which stripped the access-permission test from rxe_check_pagefault() and left only HMM_PFN_VALID, affecting kernels built from that baseline (reported as Linux 6.16 onward) until the stable fixes. Exploitation is bounded by configuration: the rxe/Soft-RoCE module is not loaded by default on typical servers, and the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) confirms a local, authenticated attacker with low complexity but no network reach; EPSS is low at 0.16% (5th percentile), and no public exploit code or CISA KEV entry has been identified at time of analysis. Vendor patches are available.
A use-after-free in the Linux kernel's Soft-RoCE (rdma_rxe) driver allows a local user who can open the RDMA uverbs interface and issue ATTACH_MCAST on a UD queue pair to trigger freeing of a published multicast-group object while it is still reachable from the driver's mcg_tree, giving high confidentiality, integrity and availability impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The race is only reachable when the backing Ethernet multicast programming step, rxe_mcast_add(), fails mid-operation (for example -ENODEV after the backing netdev is removed, or a propagated dev_mc_add() error), which is why the attack complexity is High and the practical priority is low. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.18% (7th percentile), and vendor patches are available in mainline and multiple stable branches.
Local users with low privileges can drive the Linux kernel into a race condition in the RDMA/core helper ib_get_eth_speed(), which calls a net_device's ethtool callback after that device has already completed NETDEV_UNREGISTER and ndo_uninit during teardown, corrupting or crashing the kernel. Exposure is narrow: the host must have an active RDMA device bound to an Ethernet (RoCE) or InfiniBand link layer and that device must be unregistering while an asynchronous RDMA port query is in flight, so exploitation requires winning a tight timing window (upstream CVSS 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; the independent assessment keeps the same AV:L/AC:H/PR:L vector but rates confidentiality and integrity as low and availability as high). Vendor-released patches exist for stable branches 6.1.189, 6.6.158, 6.12.112, 6.18.54 and 7.2.8 (plus 7.3-rc4); no public exploit code or confirmed active exploitation is known, and EPSS is only 0.17% (5th percentile).
A teardown race in the Linux kernel's iSER target (ib_isert) frees the isert_conn and iscsit_conn structures while a deferred control PDU completion is still queued on isert_comp_wq, so isert_put_cmd() later dereferences freed memory - a slab use-after-free (KASAN splat) rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because it can in principle lead to kernel code execution, data disclosure, or a crash. Exposure is limited to hosts that run the LIO iSER target with the ib_isert module loaded and export an iSER/RDMA transport over an InfiniBand or RoCE fabric; the CVSS vector shows no authentication prerequisite (PR:N), but the attacker must win a narrow race between connection teardown and the workqueue handler, a window so tight that the reporter needed an injected msleep(200) to reproduce it reliably. No public exploit code and no CISA KEV entry are associated with this issue, EPSS is only 0.16% (5th percentile), and vendor-released stable patches are available.
An out-of-bounds read in the Linux kernel's legacy libipw 802.11 stack allows an unauthenticated attacker within wireless range to make affected systems walk roughly 64 KiB past the end of a received management frame buffer. Only machines using the legacy Intel PRO/Wireless ipw2100 or ipw2200 drivers are exposed, because those receive paths validate just the generic 24-byte three-address management header while libipw_process_probe_response() and libipw_network_init() assume the full 36-byte beacon/probe-response prefix; the length arithmetic then underflows and is truncated to 65524. The resulting flaw yields limited information disclosure (C:L) and a high availability impact via kernel crash (A:H) against adjacent-network attackers, though it is sharply constrained by the obsolete hardware requirement. Risk signals are low: EPSS is only 0.17% (6th percentile), there is no CISA KEV listing, and no public exploit has been identified at time of analysis.
Out-of-bounds reads in the Linux kernel's legacy libipw 802.11 management-frame parser, reachable through the ipw2100 and ipw2200 wireless drivers, let an unauthenticated attacker within wireless range crash the kernel by injecting a crafted association response that is shorter than the fixed 30-byte prefix. The root cause is an unsigned integer underflow: stats->len (u16) minus sizeof(*frame) (size_t) is evaluated in size_t and wraps, so the truncated u16 length handed to libipw_parse_info_param becomes a value near 64 KiB and the information-element parser walks well past the receive buffer. Exploitation requires the obsolete Intel PRO/Wireless 2100 or 2200BG hardware and driver stack to be present and processing association responses, so the realistic outcome is a denial-of-service kernel crash with only limited disclosure potential; no public exploit code has been identified at time of analysis, no KEV entry exists, and EPSS is a low 0.17% (6th percentile), while vendor-released patches are available in the 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4 kernels.
A use-after-free in the Linux kernel's cfg80211 wireless configuration subsystem can be triggered locally when a network interface is taken down while a scan is still running, causing cfg80211 to free a scan request that the Wi-Fi driver still believes it owns. Successful exploitation corrupts kernel memory reachable at scan completion (scan_done()), yielding high confidentiality, integrity, and availability impact, though the attacker must already hold local privileges sufficient to manage the wireless interface (CVSS PR:L) and must win a narrow asynchronous-cancellation race (assessed AC:H, versus the vendor's AC:L). There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.17% (6th percentile).
Kernel instability in the Linux wireless stack (cfg80211) lets an attacker-controlled rogue AP or Wi-Fi device within radio range drive a client into an assertion failure inside the BSS rbtree handling, resulting in a WARN_ON that becomes a full system crash when panic_on_warn is enabled. Only systems running the in-tree cfg80211/mac80211 code are affected, and exploitation requires an adjacent attacker plus a victim client actively associated to the malicious device; the malformed BSS type change does not occur in normal operation, so real-world exposure is limited to deliberate rogue-device scenarios. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); EPSS is low at 0.18% (7th percentile), and our independent assessment scores this 5.3 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) rather than the inflated 8.8 base score, reflecting availability-only impact with high attack complexity and adjacent access requirements.
A stale virtual interface entry in the Linux kernel's mac80211 WiFi stack can drive the kernel into a BUG() at net/wireless/core.h:141 (wiphy_to_rdev) and crash or corrupt memory when a network namespace holding a wiphy is destroyed and the wiphy's migration back to init_ns fails on a memory-allocation error. Kernels with mac80211 loaded are affected from the 2.6.32-era lineage carrying commit 463d018323851a608eef52a9427b0585005c647f, with local exploitation requiring namespace-administration privileges (PR:L) plus a racy, largely attacker-uncontrollable allocation failure (AC:H) - CVSS 3.1 base 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), though independent assessment downgrades confidentiality and integrity to LOW while retaining HIGH availability impact. No public exploit code has been identified at time of analysis, the CVE is not in CISA KEV, and EPSS is only 0.18% (7th percentile), so the effective real-world priority is LOW despite the HIGH base score; vendor-released patches exist in 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
Network namespace teardown in the Linux kernel's cfg80211 wireless configuration subsystem can leave a wiphy (wireless device) pointing at a freed network namespace when the interface migration back to the initial namespace fails, producing a kernel mode fault (reported at address 0x30 via genlmsg_multicast_netns / nl80211_notify_wiphy / wiphy_unregister) and crashing the host. The independent assessment rates this availability-only (C:N/I:N/A:H) with AV:L/PR:L, meaning a local attacker with low privileges - CAP_NET_ADMIN or access to an unprivileged user namespace that permits netns creation - is required, and the attack is complicated because it depends on a memory allocation failure occurring at exactly the right moment. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is 0.17% (6th percentile), consistent with a low-priority defensive fix rather than an imminent threat.
A memory-corruption bug in the Linux kernel's PXA DMA engine driver (pxad) causes the software descriptor counter nb_desc to be double-counted, leading to out-of-bounds indexing and freeing of descriptors that were never allocated. Only systems running the Marvell PXA dmaengine driver (CONFIG_PXA_DMA / pxad) and built with gcc 15.1 or clang 22.1 or newer are affected, because the kzalloc_flex() conversion of pxad_alloc_desc() only updates the __counted_by counter when __builtin_counted_by_ref() is available. The flaw requires local access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and a low-privileged user able to trigger DMA descriptor allocation through a consuming client; EPSS is low at 0.16% (5th percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
An out-of-bounds write in the Linux kernel's siw (Soft-iWARP) RDMA driver lets a connected iWARP peer corrupt kernel memory by delivering an extended DDP/RDMAP header split across more than one TCP receive callback; the miscalculated copy length (hdrlen - MIN_DDP_HDR instead of the number of missing bytes) pushes the destination past the header, overwrites the receive state including fpdu_part_rcvd, and a later callback reuses that corrupted value as a copy offset. The upstream CVSS 3.1 vector scores this 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates it AV:N/AC:H (8.1) because exploitation requires the siw driver to be loaded - it is not enabled in default Linux configurations - and requires the attacker to control TCP segmentation so the header spans multiple callbacks; no authentication is needed once an RDMA session exists. Exploitation status: no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and the issue is not listed in CISA KEV, though a vendor patch is available for the stable branches.
Use-after-free in the Linux kernel netfilter flowtable datapath allows a local, authenticated low-privileged user to potentially execute code, corrupt memory, or disclose information by winning a race condition against the RCU grace period. Affected are unpatched kernels in the 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 7.2.x, 7.3-rc, and 6.18.x ranges before their respective fixes; systems without a configured netfilter flowtable offload are not exposed. No public exploit code has been identified at time of analysis, and the EPSS score is 0.22% (11th percentile), indicating low predicted exploitation activity; vendor patches are available.
Memory corruption in the Linux kernel's SMB/CIFS client (cifs.ko) allows a local user with write access to a mounted share to trigger out-of-bounds writes and a massive heap/stack overflow by creating a native symlink whose absolute target lacks an NT drive prefix. Affected code ships in mainline Linux from 6.15.6 onward and is patched in 6.16, with stable backports in 7.2.8 and 7.3-rc4 per EUVD; exploitation requires a Linux client to have mounted a share using default settings (symlinkroot unset) and an attacker able to place a crafted symlink on that share, matching the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector. Impact is high confidentiality, integrity and availability loss through kernel memory corruption, though EPSS is only 0.16% (5th percentile) and no public exploit code has been identified at time of analysis - no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Improper runlist locking in the Linux kernel's NTFS driver allows a local attacker who can perform file and attribute operations on a mounted NTFS volume to race the cluster-freeing and runlist-truncation paths, potentially corrupting runlist and on-disk mapping-pair state and achieving high confidentiality and integrity impact inside the kernel (NVD score 7.8; our independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, i.e. local-only with a timing-dependent trigger). The flaw is that ntfs_non_resident_attr_shrink() calls runlist helpers that require the runlist write lock without holding it, and ntfs_attr_map_cluster() can merge a newly allocated run before a mapping-pairs update that may fail, with the rollback path itself able to fail and force the volume into an error state. EPSS is low at 0.16% (5th percentile), no public exploit code and no confirmed active exploitation have been identified at time of analysis, and the affected NTFS driver is not enabled or mounted by default on most Linux servers, which materially limits real-world exposure.
Local use-after-free in the Linux kernel's virt_wifi virtual wireless driver (CVE-2026-98311) lets a low-privileged local attacker with network-admin capability corrupt kernel memory, causing a crash and potentially enabling code execution in kernel context. virt_wifi_newlink() propagates the lower device's operstate before the new netdevice is registered, so a dormant lower device queues the still-uninitialized netdev on the linkwatch event list; if registration later fails - attacker-controllable by supplying an interface name such as 'bad/name' - free_netdev() releases the object and the subsequent linkwatch_fire_event() dereferences freed memory. Exposure is narrow: exploitation is strictly local, requires CAP_NET_ADMIN (attainable via user namespaces on some distributions) plus the rarely deployed virt_wifi module, no public exploit code has been identified, CISA KEV does not list this issue, and EPSS is only 0.22% (11th percentile).
A race condition in the Linux kernel's mxl862xx DSA driver for MaxLinear MxL862xx Ethernet switches allows a stats-polling delayed work item to execute against already-freed dsa_port structures, yielding a use-after-free with high confidentiality, integrity and availability impact. The flaw is reachable only by an authenticated, highly privileged local actor (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H per independent assessment) who can drive a teardown path - switch unregister, driver shutdown, driver unbind, or a failed dsa_register_switch() during probe - and simultaneously win a narrow timing race, since the WORK_STOPPED flag test is not atomic with cancel_delayed_work_sync(). Exploitation additionally requires kernel builds compiled with the mxl862xx driver and actual MaxLinear MxL862xx switch silicon present and bound, so practical exposure is limited; there is no public exploit identified at time of analysis, EPSS is a low 0.16% (5th percentile), and the issue is not in CISA KEV.
A possible kernel deadlock in the Linux kernel's Bluetooth RFCOMM listener teardown path can be reached by an unauthenticated attacker within Bluetooth radio range (AV:A, PR:N per the vector) who races a new incoming RFCOMM connection against the cleanup of a listening socket. Triggering requires Bluetooth to be enabled on the target, a live application listening on an RFCOMM channel, proximity, and a narrow timing window (AC:H); the condition was reported by lockdep as a POSSIBLE lock-order inversion between a child socket lock and rfcomm_mutex, not a confirmed and reliably reproducible crash, and the assessed impact is availability only (C:N/I:N/A:H). No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is very low at 0.18% (7th percentile); vendors have released fixes.
Use-after-free in the Linux kernel's KVM PowerPC Book3S HV nested-virtualization path (kvmhv_emulate_tlbie_all_lpid) lets a local attacker who controls an L1 guest corrupt host kernel memory by racing a tlbie-driven nested-guest free against a vCPU iterating the nested-guest IDR, yielding high confidentiality and integrity impact on the host (assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H; the vendor/NVD vector lists the same impacts with AC:L for 8.8). Exploitation is timing-dependent and limited to PowerPC Book3S HV hosts running KVM with nested virtualization enabled and exercised; there is no public exploit code identified at time of analysis and EPSS is low (0.18%, 7th percentile), so risk is serious but narrow. Vendor fixes are released in Linux 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4 (EUVD-2026-93211).
Memory corruption and scope-changing host impact in the Linux kernel's PowerPC IOMMU TCE handling affect ppc64 systems where a local low-privileged actor can invoke multi-page TCE hypercalls such as H_STUFF_TCE or H_PUT_TCE_INDIRECT with npages greater than 1. The flaw is in iommu_tce_check_ioba(), which used a hardcoded page count of 1 instead of the caller-supplied npages, so the intended bounds check can be bypassed and the TCE table capacity may be exceeded, yielding the assessed full confidentiality, integrity, and availability impact on the host under a scope-changing vector. No public exploit identified at time of analysis, no CISA KEV entry was provided, and EPSS is low at 0.18% (7th percentile); vendor patches are available.
Local privilege escalation in the Linux kernel futex subsystem (CVE-2026-98281) lets an existing local user with the ability to execute binaries corrupt or manipulate the per-mm private futex hash, potentially leading to full compromise of confidentiality, integrity and availability on the affected host. The flaw stems from the kernel failing to allocate the private futex hash when the mm is shared across a vfork() (or other CLONE_VM) boundary, so private futex waiters can exist before that hash is initialized; the fix closes this ordering window. Exploitation requires an authenticated local account (CVSS PR:L) and reliable triggering of the ordering condition, which our assessment rates as high attack complexity despite the vendor's base vector (AV:L/AC:H versus the published AC:L). There is no public exploit identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at roughly 0.17% (6th percentile), indicating a genuine but non-urgent local-privilege-class kernel flaw rather than an internet-facing emergency.
A race condition in the Linux kernel networking stack (sock_gettstamp()) allows a local, authenticated unprivileged user to trigger a slab-use-after-free in the UDP receive path by issuing a SIOCGSTAMPNS_NEW socket-timestamp ioctl on a UDP socket concurrently with a bind() on that same socket. Because sock_enable_timestamp() modifies sk->sk_flags with non-atomic bit operations while the SIOCGSTAMPNS_NEW path does not hold the socket lock, the concurrent read-modify-write can silently drop the SOCK_RCU_FREE bit that udp_lib_get_port() had just set, causing sk_destruct() to free the socket immediately instead of after an RCU grace period while lockless receive lookups still hold a pointer to it. Exploitation is local-only and requires winning a narrow timing window (our assessment rates it AV:L/AC:H/PR:L, versus the vendor-published CVSS 3.1 score of 7.8 with AC:L), EPSS is low at 0.18% (7th percentile), there is no KEV listing and no public exploit identified at time of analysis, and vendor-released patches exist for the affected stable branches.
Kernel memory corruption in the Linux CIFS/SMB client (cifs.ko) allows a malicious or compromised SMB server to have a channel and its primary server structure freed while the client still dereferences them, producing a use-after-free that crashes the kernel and can expose or corrupt freed memory. Exposure is limited to clients that mount a share from an attacker-controlled server with SMB multichannel in use: the vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) indicates no client-side credentials are required, but the victim must initiate the mount and the bug depends on a race/teardown timing window, so the net real-world risk is lower than the 8.1 base score suggests. No public exploit code is identified at time of analysis, EPSS is 0.18% (6th percentile), and vendor-released patches exist for the affected stable branches.
Use-after-free in the Linux kernel's POSIX CPU-timer cleanup path during exec() can corrupt kernel memory and, under the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), potentially lead to local privilege escalation or arbitrary code execution in kernel context. The flaw exists in kernels from Linux 5.7 onward and is triggered when a non-leader thread that has armed a CLOCK_THREAD_CPUTIME_ID timer calls execve(), the exec later fails after bprm->point_of_no_return, and the task is forced into do_exit() before begin_new_exec() reaches posix_cpu_timers_exit(), freeing a k_itimer whose node is still queued in an rbtree. Exploitation requires local code execution as an unprivileged user and winning a narrow timing race around a failing exec path, so it is not remotely reachable; EPSS is low (0.18%, 6th percentile) and no public exploit has been identified at time of analysis, while vendor-released patches exist in 6.6.158, 6.12.112, 6.18.54 and 7.2.8.
Use-after-free in the Linux kernel's POSIX CPU timer subsystem lets a local low-privileged user free a timer that is still queued on the expiry handler's private firing list, corrupting kernel memory and opening the door to privilege escalation or denial of service on kernels built from commit bf635681c906 onward (roughly 6.13 until the referenced stable fixes). Exploitation needs only the standard timer_create/timer_settime/timer_delete calls available to ordinary users, but it is gated by a narrow concurrency window that must be won (assessed CVSS:3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), which keeps real-world risk modest. No public exploit code or confirmed active exploitation is known and EPSS is 0.17% (6th percentile), while vendor patches are available.
A protocol-version negotiation mismatch during RDS-over-RDMA connection setup in the Linux kernel deadlocks the kernel by making an RDMA-CM event handler wait on itself, permanently stalling the RDS connection workqueues and causing denial of service. Only hosts with the RDS stack loaded and bound to an RDMA transport (InfiniBand, RoCE, or iWARP) that expose a reachable RDMA-CM listener are affected; unauthenticated peers able to establish an RDMA-CM connection - typically from the same RDMA fabric or subnet (assessed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - can trigger it by negotiating a protocol version older than RDS_PROTOCOL_COMPAT_VERSION. Impact is availability-only (C:N/I:N/A:H); EPSS is low at 0.18% (7th percentile), no public exploit code has been identified at time of analysis, and vendor patches are available for the affected stable branches.
Use-after-free write in the Linux kernel's signal delivery path lets a local, unprivileged user corrupt a freed POSIX timer sigqueue and potentially escalate privileges on the host. The race triggers when a non-leader thread calls execve() while a blocked SIGEV_THREAD_ID timer signal aimed at the old thread-group leader's TID is being flushed, so the kernel can re-queue the sigqueue onto a task::pending list that release_task()/exit_signals() is concurrently tearing down and then dereference the freed timer via a later tgkill(). Affected builds are those carrying the change that moved the sigqueue flush out of the sighand-locked region (EUVD lists Linux 6.15 era onward); exploitation requires local access and winning a timing/memory-ordering race, no public exploit code has been identified at time of analysis, the CVE is not listed in CISA KEV, and EPSS is 0.17% (6th percentile), so the practical concern is a HIGH-severity (7.8 base, C:H/I:H/A:H) local privilege-escalation primitive rather than mass exploitation.
Incorrect page-frame/offset bookkeeping in the Linux kernel's swiotlb bounce-buffer code (swiotlb_bounce) can place DMA copies one page away from the intended location whenever a non-zero tlb_offset, produced by partial syncs through dma_sync_single_range_for_cpu()/for_device(), crosses a page boundary. Affected are kernels with swiotlb bounce buffering plus meaningful highmem (typically 32-bit or large-memory builds); because the offset and the page frame are taken from mismatched values, DMA_FROM_DEVICE can overwrite the wrong page while leaving the intended page stale, and DMA_TO_DEVICE can feed data from a page the mapping may not cover, and a lowmem-recorded slot can even be adjusted into highmem and then passed to phys_to_virt(). The assessed vector is local, PR:L (authenticated local access), with AC:H reflecting that the flaw is dormant for aligned full-buffer DMA and needs a DMA pattern that produces a page-crossing offset, so although confidentiality, integrity and availability impact are all rated High, reliable targeted exploitation is difficult; no public exploit code has been identified at time of analysis and EPSS is low at 0.18% (6th percentile), with no CISA KEV listing.
A race-condition use-after-free in the Linux kernel's RDMA user-space connection manager (ucma) allows a local user who can open /dev/infiniband/rdma_cm to corrupt kernel memory and potentially escalate privileges. Two concurrent JOIN_MCAST calls for the same multicast address, combined with a forced copy_to_user() failure, can leave a queued RoCE work item dereferencing a ucma_multicast structure that another thread has already freed, because ucma_process_join() dropped ctx->mutex after a successful join and reacquired it only on error. No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA KEV: not listed), EPSS is a low 0.18% (7th percentile), and real-world risk is limited by the requirement for local RDMA/RoCE configuration plus a narrow timing window - so despite the 7.8 base score this is a LOW-priority issue in practice.
Refcount initialization ordering in the Linux kernel's RDMA iWARP port-mapper (iwpm) subsystem allows a local, low-privileged attacker to trigger a kref "addition on 0" race that can lead to premature object release and kernel memory corruption, rated 7.0 High (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Only systems that actually load and use the RDMA stack with iWARP port-mapper netlink traffic are exposed - the iwpm subsystem is not active on default desktop or server installs without InfiniBand/RDMA hardware or the software RDMA drivers (rxe, siw). Exploitation requires local code execution plus winning a narrow timing window on an SMP system, and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is 0.22% (11th percentile).
A race condition in the Linux kernel's Open vSwitch conntrack label handling lets a local user trigger a read of a reallocated-and-freed conntrack extension block, which can leak kernel memory or corrupt state in the OVS datapath. ovs_ct_get_conn_labels() added a label extension even to already-confirmed conntrack entries, so a lockless reader on another CPU could dereference storage that was freed underneath it; the fix restricts extension insertion to unconfirmed conntracks and makes a label operation on a label-less confirmed conntrack fail instead. The flaw exists in kernels carrying the OVS conntrack labels feature (introduced around Linux 4.3) and is fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4. Exploitation is local and authenticated (CVSS:3.1/AV:L/AC:H/PR:L/UI:N per the independent assessment), requires OVS with connection tracking and labels actively configured, and depends on winning a narrow timing window; EPSS is 0.18% (7th percentile) and there is no CISA KEV entry or public exploit identified at time of analysis.
Local use-after-free in the Linux kernel's dma-buf/dma-fence subsystem lets a low-privileged local user with access to a fence-exposing interface (DRM/GPU, sync_file, or other DMA-buf consumers) read freed kernel memory when a fence's timeline or driver name string is retrieved concurrently with the fence being signaled. The regression was introduced by an earlier NULL-pointer dereference fix that replaced the signaled-bit check with an ops-pointer check, which is insufficient because many dma_fence implementations never clear the ops pointer on free and thus lose the RCU protection that keeps the returned string alive. Impact is a kernel crash (denial of service) or disclosure of freed heap contents; exploitation requires local device access and winning a narrow race, and no public exploit has been identified at time of analysis (EPSS 0.16%, 5th percentile; no CISA KEV listing).
Out-of-bounds memory reads in the Linux kernel's IPv6 XFRM local path allow a locally authenticated attacker who can trigger specific XFRM/IPsec routing conditions to miscast a TCP request socket as a full IPv6 socket, disclosing kernel heap memory. The flaw affects Linux 3.2 and later and is triggered only when IPv6 XFRM tunnel routes are configured, an IPv6 TCP service emits SYN-ACKs, and rerouting selects a lower-MTU tunnel so the local PMTU or local error callback runs while the skb is still owned by a TCP_NEW_SYN_RECV request_sock. It requires local access with low privileges (CVSS vector PR:L, AV:L); there is no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and CISA KEV does not list it. Vendor patches are available, and the timing-dependent, non-default XFRM configuration substantially narrows the realistic attack surface below what the raw 7.8 score suggests.
A use-after-free write in the Linux kernel's lan743x Ethernet driver (Microchip LAN7430/LAN7431) lets a packet that spans more than one RX buffer trigger a kernel memory corruption through a stale skb pointer in the checksum-success path of lan743x_rx_process_buffer(), with the flawed write landing on freed fragment skb metadata. According to the vendor description this multi-buffer condition only arises transiently after an operator performs a live MTU increase, because existing ring entries retain their old, smaller buffer size until they are replenished; the vulnerable driver must be present and the host must be using that specific Microchip hardware. Vendor patches are available in the stable trees (6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4), EPSS is low at 0.18% (7th percentile), and no public exploit code or CISA KEV activity was identified at time of analysis; our independent assessment rates real-world priority LOW despite the vendor-supplied 8.1 CVSS because exploitation is gated on hardware, a concurrent operator-initiated MTU change, and a short-lived window.
A write use-after-free in the Linux kernel's XFRM (IPsec) state framework allows a local attacker who can add and delete xfrm states to corrupt freed slab memory, which in turn spawns a read use-after-free during state lookup. The defect is an incomplete fix: commit 14acf9652e56 switched the bydst/bysrc/byseq/byspi hash lists to hlist_del_init_rcu() but missed state_cache and state_cache_input, so a second __xfrm_state_delete() on the same state writes through the LIST_POISON2 pprev value instead of becoming a harmless no-op. Exploitation requires low privileges (CVSS PR:L, AV:L) - realistically the ability to manipulate xfrm state, normally gated by CAP_NET_ADMIN, which unprivileged users can obtain inside a user plus network namespace - and the attacker must win a timing-dependent delete/delete race (AC:H), so this is a real but not urgent kernel memory-corruption bug rather than a mass-exploitation priority: no public exploit identified at time of analysis, EPSS 0.21% (10th percentile), and no CISA KEV listing.
Use-after-free in the Linux kernel's IPsec/xfrm receive path (xfrm_input) can be triggered by a local attacker with low privileges on hosts that run IPsec with VTI tunnels or XFRM interfaces configured. The receive callbacks for VTI and XFRM interfaces - as well as the XFRM_MAX_DEPTH error path - call secpath_reset(), which can drop the last reference to an xfrm_state that xfrm_input() subsequently dereferences when selecting transport_finish() or reporting the drop-callback protocol; if that state is concurrently deleted, the freed object is accessed, yielding memory corruption with high confidentiality and integrity impact. Successful exploitation requires winning a race between secpath_reset() and concurrent xfrm_state teardown, so the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (note the high attack-complexity, which differs from the NVD-published AC:L value); EPSS is low at 0.21% (10th percentile), there is no KEV listing, and no public exploit identified at time of analysis.
A missing hardware memory-ordering barrier in the Linux kernel's MIPS EYEQ support lets a local, authenticated user crash the kernel on Mobileye EyeQ5 / MIPS I6500 systems. On I6500 cores the lld/scd (LL/SC) instructions provide no ordering guarantees, so arch_cmpxchg() - documented and relied upon as fully ordered - can be reordered and read freed or uninitialized memory, producing a kernel paging fault and oops (observed in anon_pipe_read while stressing an anonymous pipe, whose mutex uses cmpxchg). Exploitation requires CONFIG_EYEQ hardware, local access, and winning a timing/race window; there is no network vector and no impact on x86, ARM, or other MIPS configurations. The fix commit is public and includes a userspace reproducer (pipe_race.c), so publicly available exploit code exists, but no confirmed active exploitation (not in CISA KEV); EPSS is 0.15% (4th percentile), and the observed outcome is a kernel oops rather than a controlled compromise.
Incorrect DMA mmap handling in the Linux kernel's IB/hfi1 Omni-Path driver (PIO_CRED case) lets a local, authenticated user with access to the HFI character device crash the kernel with a corrupted page-table oops or, once only the offset arithmetic is corrected, permanently stall send-PIO transfers. Kernels from 6.3 onward that include the hfi1 driver are affected, but the fault is intermittent-it appears only when the hardware send-context index reaches 64 or 128-and requires Intel Omni-Path 100 hardware plus the PSM2 path to invoke hfi1_file_mmap(). No public exploit code was identified at time of analysis, EPSS is low (0.18%, 6th percentile), and vendor-released fixes exist in 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4; given the local-only vector, mandatory specialized hardware and intermittency, overall risk is assessed as moderate rather than high-priority.
Stale sysfs attributes left behind by the Linux kernel's w83791d hwmon driver after unbind can expose freed memory to local users, because the normal remove path deletes only the w83791d_group but not the optional w83791d_group_fanpwm45 group created when the fan/pwm 4-5 pins are not used as GPIO. Callbacks on those leftover files dereference devm-allocated driver data that is released after unbind, creating a use-after-free condition. The flaw is local-only and highly conditional (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0): it requires a system physically equipped with the Winbond W83791D sensor chip, the fan/pwm 4-5 pins not configured as GPIO, and a driver unbind through the normal teardown path, and exploitation further depends on winning a race against the devm free. There is no public exploit identified at time of analysis, EPSS is low at 0.22% (11th percentile), and vendor patches are available in the stable trees.
A slab use-after-free read in the Linux kernel's drm/msm driver (Qualcomm Adreno GPUs) allows a local, low-privileged user with access to the DRM device node to leak or corrupt freed kernel memory. The flaw arises because msm_ringbuffer_destroy() and msm_gem_vm_free() call drm_sched_fini() and then free objects that still embed a drm_gpu_scheduler with plain kfree(), while a signalled fence exported to userspace (submit out-fence or VM_BIND fence via sync_file/drm_syncobj) still points at that embedded scheduler; an unprivileged SYNC_IOC_FILE_INFO call then reaches drm_sched_fence_get_timeline_name() and dereferences the freed slab. Rated CVSS 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) with EPSS of only 0.21% (10th percentile) and no public exploit identified at time of analysis; the issue is confined to systems where the msm driver is built and loaded, and is fixed by freeing these scheduler-containing objects with kfree_rcu().
Use-after-free in the Linux kernel's CIFS/SMB client can be triggered when the cifs_demultiplex_thread exits while a reconnect work item is still queued on cifsiod_wq, allowing smb2_reconnect_server() to read a server structure that clean_demultiplex_info() has already freed with kfree_sensitive(). The bug is reached unauthenticated per the vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R), but it requires an active CIFS/SMB mount to an attacker-controlled or repeatedly failing SMB server plus a narrow race at connection teardown, which is why the assessed impact is LOW in practice even though the published base score is 7.5. EPSS is 0.21% (10th percentile), no public exploit has been identified at time of analysis, and vendor fixes exist in the 6.6.158, 6.12.112, 6.18.54 and 7.2.8 stable releases.
Kernel memory corruption and crash in the Linux kernel's SMB/CIFS client (cifs.ko) arises from a missing list-head initialization in TCP_Server_Info.rlist combined with a race in cifs_signal_cifsd_for_reconnect(). Because rlist is allocated with kzalloc, its ->next and ->prev pointers are NULL rather than self-referential, so list_empty() always returns false and list_add() dereferences a NULL ->prev; concurrently, multiple cifsd threads can add the same server's rlist node twice, corrupting the list. Only systems actively using the kernel SMB/CIFS client with a mounted share and a reconnect event are affected; the authoritative assessment scores this CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H, i.e. unauthenticated but requiring user interaction and a hard-to-win timing race, with impact limited to a kernel crash (denial of service) rather than code execution or data theft. EPSS is low at 0.18% (6th percentile), and no public exploit has been identified at time of analysis.
A use-after-free race in the Linux kernel CIFS/SMB client (cifs_try_adding_channels()) allows a malicious or compromised SMB3 multichannel server to corrupt kernel memory on any client that mounts a share with multichannel enabled, primarily causing a kernel crash (high availability impact) and, secondarily, limited disclosure of freed memory contents. The client's interface iteration caches the next ses->iface_list entry under iface_lock, then drops that lock for the full duration of cifs_ses_add_channel(); a concurrent SMB3_request_interfaces()/parse_server_interfaces() refresh can mark interfaces inactive and kfree() that cached entry before the iterator advances, after which the loop dereferences freed memory. Reaching the window requires the client to have established an SMB3 multichannel session against an attacker-influenced server (CVSS vector PR:N but UI:R, AC:H), and no public exploit code has been identified at time of analysis; EPSS is 0.21% (10th percentile), so exploitation is opportunistic rather than broadly observed.
Use-after-free and out-of-bounds pointer handling in the Linux kernel CIFS/SMB client (cifs.ko) lets a malicious or man-in-the-middle SMB server corrupt kernel memory on a connecting client by returning crafted encrypted compound PDUs. The defect sits in receive_encrypted_standard(), where a stale next_buffer pointer retained on error paths and unvalidated NextCommand/next_cmd offsets taken from pre-decryption length can lead to use-after-free and reads beyond the reassembly buffer, affecting confidentiality, integrity and availability of the host. Exploitation requires the victim to act as an SMB client and mount or connect to an attacker-controlled share, with SMB3 encryption/sealing negotiated and attacker-controlled server responses; no public exploit has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and vendor-released patches exist for the affected stable trees.
Kernel slab memory disclosure in the Linux kernel's SMB/CIFS client (cifs.ko) occurs when a malicious or compromised SMB3 server returns a short reply to a snapshot-enumeration ioctl (FSCTL_SRV_ENUMERATE_SNAPSHOTS), causing smb3_enum_snapshots() to set ret_data_len to sizeof(struct smb_snapshot_array) (12 bytes) without validating the server's actual reply length; the subsequent copy_to_user() then reads past the end of the server-sized retbuf and exposes adjacent kernel heap contents to the requesting user-space process. Only Linux systems acting as SMB clients are affected, and exploitation requires the victim to connect outbound to the attacker-controlled server and actively trigger snapshot enumeration (UI:R) while running a kernel with the vulnerable cifs client code, so unauthenticated remote attackers cannot reach an idle host. There is no public proof-of-concept and no evidence of active exploitation at time of analysis; EPSS is 0.21% (11th percentile), and patches are available in stable releases 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
Use-after-free in the Linux kernel's drm/ttm graphics memory manager (a regression introduced by commit b2ed01e7ad3d, present in roughly 7.0.10 through 7.1 and in stable backports such as Ubuntu 7.0.0-31) allows a locally authenticated user with an active GPU workload to crash the kernel minutes to hours after a swapout event. Because ttm_bo_swapout_cb() skips the bulk_move bookkeeping on successful swapout, a swapped-out resource stays on its buffer object's bulk_move range and on the manager LRU while being unevictable; when it is later freed or the BO leaves the bulk_move, ttm_resource_del_bulk_move() skips it due to its unevictable guard, leaving a dangling cursor that the next ttm_lru_bulk_move_tail() or ttm_resource_add_bulk_move() dereferences. Exploitation requires local presence, an affected AMD/drm-ttm system, and timing-dependent hibernation or memory-pressure conditions (the reporter observed crashes in only 5 of 18 hibernation cycles), and no public exploit code has been identified at time of analysis; EPSS is 0.20% (9th percentile), signalling low near-term exploitation likelihood.
Remote code execution in Mitel MiVoice Office 400 is possible when an authenticated high-privilege user uploads a malicious shared object through the Music on Hold configuration page instead of a valid WAV file, because the application fails to validate file type before loading it. This is a CWE-434 unrestricted file upload issue affecting the web portal on TCP 443; the independent assessment maps it as CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. No public exploit code or confirmed KEV exploitation was identified in the provided intelligence, and exploitation is constrained by the need for administrative credentials to reach the vulnerable upload feature.
Terminal escape-sequence injection in colmux, the multi-host aggregation front-end shipped with collectl before 4.3.20.2, lets an attacker who already holds an unprivileged local account on a monitored host embed crafted ANSI/VT100 control sequences - delivered via a fake process name (argv[0]) in the host's collected process data - into the terminal of an operator running colmux and viewing that host. Because colmux renders remote data without neutralizing escape, meta, or control characters (CWE-150), the injected sequences can rewrite displayed output or invoke terminal-emulator features, giving high integrity and confidentiality impact on the operator's session (CVSS 3.1 7.7, AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N). Exploitation is constrained by stacked prerequisites: attacker foothold on a monitored node, an operator actively viewing that host in colmux, and a terminal emulator that still honors the more dangerous escape sequences, which many modern emulators disable by default; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV.
Out-of-bounds write in the NVIDIA Virtual GPU Manager (vGPU plugin) lets an unprivileged user inside an assigned guest VM corrupt host-side memory by sending a specially crafted RPC call across the virtualization channel, resulting in privilege escalation, data tampering, and denial of service on the host. Rated CVSS 7.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H), the bug is only reachable in vGPU/VDI/cloud-GPU deployments where the host runs the vGPU plugin and has at least one guest assigned; it is not a network-facing flaw and does not affect standard bare-metal Linux GPU driver installs, and no public exploit code has been identified at time of analysis. Real-world risk is therefore defined by the attack surface rather than by mass exploitability, since a successful attack requires an attacker to already hold an unprivileged local account inside a hosted guest VM.
Incorrect resource transfer between spheres in the NVIDIA vGPU Virtual GPU Manager for Linux allows a locally positioned, low-privileged attacker to break an internal resource-handling boundary and gain high-integrity impact - code execution, privilege escalation, data tampering, information disclosure, or denial of service on the host running the vGPU Manager. This affects virtualization/vGPU deployments on Linux (the manager component on the hypervisor host), not standard desktop GPU drivers, and the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) confirms the attacker must already hold local low-privileged access to a context served by that manager, such as a guest VM or a local account on the host; there is no network or unauthenticated path. It is a genuine local privilege-escalation class issue rather than a remotely triggerable one, and no public exploit was identified at time of analysis.
An out-of-bounds write in the kernel-mode layer of NVIDIA vGPU Virtual GPU Manager for Linux lets a local attacker with low privileges corrupt kernel memory, which the vendor rates as potentially leading to code execution, denial of service, privilege escalation, information disclosure, and data tampering (CVSS 3.1 base 7.8, HIGH). The attack is strictly local - vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - so it is not remotely exploitable and requires only an authenticated low-privileged context or a tenant/guest that can reach the host kernel module; the risk is highest in multi-tenant VDI and cloud-GPU deployments where local access is comparatively easy to obtain. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so there is no evidence of confirmed active exploitation.
Local privilege escalation, code execution, denial of service, and information disclosure affect Linux hosts running NVIDIA vGPU Virtual GPU Manager because of an out-of-bounds read in the kernel-mode layer that services vGPU requests. A low-privileged local account or existing code-execution context (CVSS PR:L) is required, and no user interaction is needed, but the flaw is not remotely reachable and only impacts hosts with the vGPU Manager component installed. No public exploit or proof-of-concept has been identified at time of analysis, and EPSS data was not provided; the independent assessment rates this as a moderate, locally-scoped risk.
Local privilege escalation in NVIDIA vGPU Virtual GPU Manager for Linux stems from an out-of-bounds read in firmware (CWE-125) that a low-privileged local attacker can trigger with no user interaction and low complexity. The CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impact on vGPU/VDI/cloud-GPU hosts that use the affected Linux Virtual GPU Manager. No public exploit was identified at time of analysis, and exploitation requires an existing local foothold; it is not remotely exploitable despite the RCE tag.
Local attackers with low privileges on a Linux host running NVIDIA vGPU Virtual GPU Manager can trigger an out-of-bounds read in the kernel-mode layer, potentially leading to code execution, privilege escalation, denial of service, information disclosure, and data tampering. The flaw is not remotely reachable and affects only virtualization, VDI, or cloud-GPU hosts that run the vGPU Manager. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in NVIDIA vGPU Virtual GPU Manager for Linux allows a local authenticated attacker with low privileges to potentially achieve code execution, denial of service, or information disclosure. The vulnerability resides in the kernel-mode driver and affects both the vGPU Manager and guest driver components. No public exploit code has been identified, and the flaw is not known to be actively exploited. Integrity impact is assessed as low, but confidentiality and availability impacts are high, making this a significant risk in multi-tenant vGPU deployments.
An out-of-bounds read in the kernel-mode layer of the NVIDIA vGPU Virtual GPU Manager for Linux lets a local attacker who can already reach the vGPU kernel interface trigger memory reads past the bounds of an allocated buffer, potentially yielding information disclosure, data tampering, privilege escalation, denial of service, or kernel code execution. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is only reachable by an authenticated local principal - a low-privileged user or a guest context on the hypervisor - and not by an unauthenticated remote network attacker. Exposure is limited to hosts that actually deploy NVIDIA vGPU on Linux (VDI and cloud-GPU virtualization platforms), where the highest-impact scenario is a multi-tenant deployment in which the over-read crosses tenant isolation boundaries; no public exploit code or CISA KEV entry was identified at time of analysis, so this is a genuine but not emergency-grade issue warranting scheduled patching.
An out-of-bounds write in the NVIDIA Virtual GPU Manager (vGPU plugin) for Linux allows a user who already holds a low-privileged account inside a guest VM to corrupt host-side memory by sending a crafted RPC message whose performance-state list size parameters are invalid, potentially yielding code execution, privilege escalation, data tampering, denial of service, or information disclosure across the virtualization boundary. The defect is locally triggered (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and requires no user interaction, but it is only reachable on hosts actually running the vGPU Manager for multi-tenant vGPU/VDI/cloud-GPU workloads - single-tenant systems without vGPU virtualization are not exposed through this guest-to-host path. No public exploit has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); exploitability is constrained by the need for prior guest authentication and the presence of the vGPU component, making this a contained but genuine virtualization-trust-boundary flaw rather than a broad remote threat.
Out-of-bounds read (CWE-125) in the kernel-mode layer of NVIDIA's vGPU Virtual GPU Manager for Windows and Linux allows a low-privileged process inside a guest VM to force the host-side vGPU driver to read past the end of an allocated buffer (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), primarily exposing host memory contents and creating crash and denial-of-service risk, with code execution and privilege escalation described by the vendor only as possible rather than demonstrated. The issue is reachable only on hosts actively running vGPU configurations such as VDI or cloud GPU hosting where an attacker already holds a foothold inside a guest; bare-metal and non-vGPU installations are not affected, and no user interaction or network reach is required. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no fixed driver version appears in the available intelligence, so defenders should treat patch confirmation through NVIDIA's advisory as the priority action.
An out-of-bounds write in the kernel-mode layer of the NVIDIA vGPU Virtual GPU Manager for Windows and Linux allows a local attacker holding low privileges to corrupt kernel memory and potentially achieve code execution, privilege escalation, denial of service, information disclosure, and data tampering (CVSS 3.1 base 7.8). The flaw is local-only (AV:L) and requires an existing low-privileged foothold (PR:L) with no user interaction (UI:N); there is no public exploit identified at time of analysis and the package is not listed in CISA KEV. Although the numeric score is High, practical risk is assessed as MODERATE because exploitation demands local code execution on a host that specifically runs the vGPU manager - a component found in vGPU/VDI and cloud-GPU deployments rather than ordinary consumer driver installs.
Missing authorization in the NVIDIA vGPU GPU kernel driver lets a low-privileged user inside a guest VM reach privileged host GPU resources on Windows and Linux hosts, giving up to code execution, privilege escalation, data tampering, denial of service, and information disclosure on the hypervisor-side GPU stack. Exploitation requires local code execution within a guest (CVSS AV:L, PR:L, UI:N) in a vGPU deployment, so it is a realistic escalation primitive for tenants of shared-GPU, VDI, and cloud desktops rather than an internet-facing issue. No public exploit identified at time of analysis; risk is operator-context-dependent, but the high CIA impact and easy automation make prioritization relevant wherever untrusted tenants share vGPU capacity. Authentication requirements are confirmed as low-privileged/authenticated (CVSS vector PR:L).
Local privilege escalation, code execution, denial of service, information disclosure, and data tampering are possible in NVIDIA GPU Display Driver for Linux due to a use-after-free in the open-source kernel module's event-delivery path. An authenticated local user with access to NVIDIA GPU device nodes can race asynchronous event delivery against file close (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), though the high attack complexity makes success non-deterministic and typically requires repeated attempts; no public exploit has been identified at time of analysis. Risk is concentrated on Linux hosts using the affected open-source kernel module, particularly multi-tenant vGPU, VDI, and cloud GPU deployments.
Local privilege escalation in the NVIDIA GPU Display Driver for Linux kernel-mode layer allows an already-present local user or code-execution foothold (PR:L) to write to memory that should be read-only because memory permissions are not preserved, potentially achieving code execution and elevated privileges on affected GeForce, RTX/Quadro/NVS, and Tesla systems, including vGPU Guest Driver deployments. Exploitation requires local access and high attack complexity, with no remote or unauthenticated network path; no public exploit was identified at time of analysis and the CVE is not listed in CISA KEV. The vendor-supplied CVSS vector uses AV:P while our independent assessment uses AV:L, so the physical-access requirement should be confirmed against NVIDIA bulletin 5861.
Denial of service and kernel memory disclosure in the NVIDIA GPU Display Driver for Windows and Linux let a local, low-privileged user who already holds an interactive session on the host force the kernel-mode component to dereference an untrusted pointer, crashing the driver or leaking kernel memory. The flaw is scored CVSS 3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) - a local-only, low-complexity attack requiring low-privilege authenticated access with no user interaction, delivering high confidentiality and availability impact but no integrity or write primitive, so it cannot by itself be chained into privilege escalation or code execution. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing); the most exposed deployments are multi-user, VDI, and cloud-GPU hosts where untrusted users share a GPU, since the attacker must first obtain code execution or an interactive session on the GPU host.
Authenticated low-privileged local users can bypass cryptographic signature verification in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux when the system is under memory pressure, leading to data tampering and denial of service. The flaw affects GeForce, RTX/Quadro/NVS, and Tesla driver branches on Linux; no public exploit code has been identified at time of analysis. Our assessment rates this as a genuine but bounded-priority local issue because the attacker must reliably induce a low-memory kernel state at the moment of verification, making exploitation opportunistic rather than dependable.
Local privilege escalation in NVIDIA GPU Display Driver for Windows and Linux can be achieved by an unprivileged local user through the open-source kernel module's DMA-BUF import path, where importing a read-only buffer from another device's DMA-BUF exporter improperly preserves memory access permissions. Successful exploitation can result in code execution, privilege escalation, denial of service, information disclosure, and data tampering, with CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data.
Local privilege escalation and kernel-level code execution in the NVIDIA GPU Display Driver for Windows and Linux, where the kernel-mode layer follows an error-handling path that operates on an improperly initialized resource (CWE-908). The flaw is reachable by an authenticated, low-privileged local user (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) on any host where the affected driver is installed and loaded, granting full confidentiality, integrity, and availability impact within the kernel-mode driver's scope. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); risk is concentrated on shared multi-tenant GPU hosts such as VDI, cloud GPU instances, and vGPU guests where untrusted local users coexist with the driver, and success may be probabilistic because the attacker must reliably trigger the failing error path.