Linux
Monthly
A lockless read race in the Linux kernel's ftrace ring-buffer subsystem allows a local attacker to corrupt kernel memory by concurrently triggering a subbuf resize while a reader accesses stale size metadata. Affected versions span from the commit introducing dynamic subbuf resizing (~Linux 6.8) through current stable branches. The CVSS vector rates confidentiality, integrity, and availability all high, reflecting that a successful race can yield kernel memory corruption; no public exploit or CISA KEV listing exists, and EPSS sits at a low 0.16%.
IRQ resource leak and potential use-after-free in the Linux kernel's NXP PIT (Periodic Interrupt Timer) clocksource driver allows a kernel crash if an interrupt fires after error-path cleanup. The driver's pit_clockevent_init() error path skips free_irq() when cpuhp_setup_state() fails after request_irq() has already succeeded, then proceeds to kfree(pit), leaving the registered IRQ handler's dev_id pointing to freed slab memory. If the IRQ subsequently fires, the handler dereferences the freed pointer, constituting a use-after-free. No public exploit exists and EPSS is 0.15% (5th percentile), consistent with a race-condition bug on niche embedded hardware.
Overlayfs in the Linux kernel exposes an unprivileged local DoS - and a theoretical privilege-escalation path - through a double `end_creating()` call in `ovl_create_real()` when a casefold consistency mismatch is detected during directory creation. The double call unlocks the parent directory's `i_rwsem` twice and calls `dput()` twice on the same dentry: the spurious unlock wedges every subsequent creation under that parent indefinitely, and the spurious `dput()` creates a reference-count imbalance that could underpin a use-after-free chain. The flaw is reachable without root in a user namespace on most modern Linux distributions. No public exploit has been identified at time of analysis and EPSS is 0.18%.
Use-after-free in the Linux kernel's Rust devres (device resource management) subsystem allows a local low-privileged attacker to cause kernel memory corruption or achieve privilege escalation. The race triggers when the driver core's devres_release_all() and Devres::drop() concurrently attempt to revoke the same Devres object - the losing revoker returns immediately while the winner's drop_in_place() is still executing, allowing adjacent resources such as DMA scatter-gather tables to be freed beneath active teardown. No public exploit code or CISA KEV listing exists; EPSS is 0.18%.
Use-after-free in the Linux kernel's KEYS trusted TPM subsystem permits concurrent kernel threads to dereference freed memory during module teardown. trusted_tpm_exit() incorrectly releases the TPM chip reference and frees the digest array before calling unregister_key_type(), which is the actual synchronization barrier that drains in-flight key operations. A local attacker with key-creation privileges racing a module unload can trigger a KASAN-confirmed slab-use-after-free in tpm_pcr_extend(), potentially yielding kernel memory corruption with high confidentiality, integrity, and availability impact. No public exploit exists and EPSS sits at 0.15%, indicating no widespread exploitation activity at time of analysis.
AppArmor's begin_current_label_crit_section() in the Linux kernel contains a use-after-free of struct cred that can be triggered on systems with active AppArmor profiles when those profiles are updated or disabled mid-syscall. The flaw arises from synchronous credential replacement inside LSM hooks: the override_creds() guard in aa_replace_current_label() fails to detect when overridden and objective credentials are the same object, causing two reference drops that free the struct cred while task_struct still holds a pointer to it. No public exploit or CISA KEV listing exists; EPSS is 0.16% at the 5th percentile, consistent with low immediate exploitation probability despite a theoretically high UAF impact.
Out-of-bounds write in the Linux kernel AppArmor LSM label parser allows any local user on an AppArmor-loaded system to corrupt kernel heap or stack memory by writing a crafted multi-component label string to /proc/self/attr/apparmor/current or to the world-writable (mode 0666) securityfs .access file, the latter path applying no privilege check whatsoever. The bug is a deterministic off-by-one: aa_vec_unique() writes a NULL terminator at vec[n] when no duplicates are found, but vec_setup() and DEFINE_VEC() allocate only n slots, so the write lands one entry past the end of either the local stack array or the kzalloc'd buffer. No public exploit has been identified at time of analysis; vendor-released patches are available in stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Memory corruption in the Linux kernel's swap/hibernation subsystem can produce silent data corruption and crashes in unrelated userspace processes during hibernation image preparation. swap_free_hibernation_slot() unconditionally calls __swap_cluster_free_entries() without checking whether a folio already occupies the slot in the swap cache - a state reachable when cluster readahead speculatively faults in pages over the hibernation window. The freed slot is returned to the allocator while its folio retains the stale swap offset in folio->swap; when page reclaim subsequently flushes that folio using the stale offset, it silently overwrites a swap table entry now belonging to a different process, corrupting arbitrary in-flight userspace data. No public exploit has been identified at time of analysis.
Memory corruption in the Linux kernel's mm/mempolicy subsystem allows a local unprivileged user to trigger a bogus folio pointer dereference, a VM_BUG_ON() panic, or silent LRU isolation of an unrelated live folio when an HMM-based GPU driver has migrated a transparent huge page (THP) to device memory. The flaw exists because queue_folios_pmd() does not guard against device-private PMDs before calling pmd_folio(), which misinterprets the device-private swap entry encoding as a hardware PFN. No public exploit has been identified at time of analysis, and EPSS is 0.18%, but the C:H/I:H/A:H CVSS impact rating reflects the potential severity if the precise conditions are met.
Stale swap-cache mapping in __migrate_device_pages() triggers invalid folio reference-count accounting in the Linux kernel mm/migrate_device subsystem, ultimately producing a BUG_ON kernel panic and potential memory corruption. The defect has two related components: the folio->mapping pointer is captured before folio_free_swap() executes, leaving a dangling reference to swap_space after swap-cache removal, and after a large folio is split the migration loop counter nr is not reset to 1, causing split order-0 folios to be processed with the original large-folio count. No public exploit code has been identified and EPSS is 0.18% (7th percentile), consistent with a local kernel-internals bug requiring a specific HMM/device-migration code path. Vendor-released patches are confirmed for stable trees targeting 7.2.4 and 7.3-rc1.
Stale walk->action state in the Linux kernel mm/pagewalk subsystem causes walk_pud_range() to spuriously retry PUD traversal and invoke page-walk callbacks twice, resulting in a slab-out-of-bounds write reachable by unprivileged local users via the mincore(2) syscall. Affected kernels in the 6.18.21-6.18.49 and 7.0-7.2.3 ranges contain the latent logic error activated by commit 3b89863c3fa4; the bug was confirmed by KASAN output and a local fuzzer producing an OOB write into a sigqueue slab object. No public exploit is available and no active exploitation has been identified; vendor-released patches are available in 6.18.50, 7.2.4, and 7.3-rc1.
UAF in the Linux kernel's user_events tracing subsystem (present since kernel 6.4) allows a local unprivileged user to trigger a reference-count underflow during fork failure, freeing the parent process's user_event_mm slab object while the parent retains a stale pointer. Any subsequent user_events ioctl() call by the parent dereferences the freed memory, enabling a write primitive that can lead to local privilege escalation. No public exploit exists and EPSS is low at 0.20%; no KEV listing is present at time of analysis.
Ring buffer corruption in the Linux kernel tracing subsystem arises from an inverted retry-exhaustion test in `simple_ring_buffer_swap_reader_page()`. When a compare-and-swap link replacement succeeds on the eighth and final attempt, the existing `!retry` guard (which triggers at zero) incorrectly returns -EBUSY while leaving the link update complete but reader bookkeeping unfinished; when all eight attempts fail, retry reaches -1, `!retry` is false, and the function falls through to update head and reader pointers as though the swap succeeded, silently corrupting the ring buffer structure. The fix, landed in Linux 7.2.4 and 7.3-rc1, corrects the guard to treat only a negative counter as exhaustion and return the documented -EBUSY. No public exploit code exists and EPSS is 0.19%.
Use-after-free in the Linux kernel tracing subsystem allows a local unprivileged attacker with tracefs access to corrupt kernel memory, potentially achieving privilege escalation. The race exists between trace_pipe readers holding stale event pointers and concurrent writes to buffer_subbuf_size_kb, which triggers ring_buffer_subbuf_order_set() to free and replace all ring buffer sub-buffer pages - including reader pages - without coordinating with active readers. KASAN-confirmed reproduction via syzbot (syz-executor989/6002) demonstrates practical triggering. No public exploit or CISA KEV listing at time of analysis; EPSS of 0.20% at the 10th percentile reflects low current exploitation probability.
Use-after-free in the Linux kernel tracing subsystem allows a local attacker with tracefs write access to panic the kernel or corrupt memory by registering two hist triggers sharing the same name= parameter on different events, followed by a third trigger referencing a variable. The second trigger's hist_data is freed by hist_register_trigger() during named-data reuse detection, but its tr->hist_vars list entry is never removed; a subsequent find_var_file() call then dereferences the freed 2048-byte slab region. The bug is confirmed by an included KASAN trace showing the precise allocation and free sites, with a deterministic three-command reproduction sequence documented in the CVE description itself; no public exploit has been identified at time of analysis.
An infinite loop in the Linux kernel's device property subsystem causes system hangs when iterating firmware nodes (fwnodes) with a secondary fwnode containing more than one child. Affected are Linux kernel versions across multiple stable branches (5.10.x through 6.19.x pre-patch). An attacker or malformed firmware blob that produces such a node topology can cause a kernel thread to spin indefinitely, consuming a CPU core and ultimately triggering a watchdog reset or complete system hang. No active exploitation has been confirmed, and EPSS stands at 0.17%.
Out-of-bounds kernel heap read in the Linux kernel's Nitro Secure Module (NSM) virtio driver allows a malicious or buggy NSM backend to disclose adjacent kernel heap memory to user space. The driver stores the used-ring response length reported by the backend device without clamping it to the actual response buffer size; parse_resp_raw() then copies that unclamped length of bytes to user space, leaking heap contents to the calling process. No public exploit has been identified at time of analysis; patches are available in stable kernel releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Use-after-free in the Linux kernel's RapidIO mport character device driver allows a local low-privileged user to trigger kernel memory corruption via the DMA request teardown path. The flaw exists in dma_req_free(), where the mutex protecting a mapping object is unlocked through a pointer that may have already been freed by kref_put() invoking the last-reference destructor. An attacker with access to the /dev/mport* character device interface can trigger this condition to achieve kernel privilege escalation. No public exploit code has been identified at time of analysis, and EPSS probability sits at 0.20%.
Double-free memory corruption in the Linux kernel V4L2 (Video for Linux 2) subsystem exists in the error-handling path of __video_register_device() after a prior patch introduced a put_device() call on device_register() failure. Because the V4L2 API contract requires callers to invoke video_device_release() - which kfree()s the video_device struct - on registration failure, the intermediate put_device() frees the struct first, causing a subsequent double-free. The fix reverts the erroneous commit (2a934fdb01db6458288fc9386d3d8ceba6dd551a), accepting a small memory leak in exchange for eliminating the double-free, given that device_register() failures are described as extremely rare in practice. No public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Linux kernel's at91_udc USB gadget driver allows a local low-privileged attacker to dereference freed kernel memory during driver teardown, potentially achieving kernel code execution. The vulnerability affects systems running AT91/SAM series Atmel ARM microcontrollers in polled-VBUS mode, where a self-restarting timer/work cycle is never cancelled before the devm-allocated udc structure is freed. No public exploit exists and no KEV listing has been issued, but the bug is reachable via a routine driver unbind without triggering any fault condition.
Use-after-free in the Linux kernel USB audio gadget driver (drivers/usb/gadget/function/u_audio.c) allows a local attacker or race condition to corrupt kernel memory when a USB audio gadget device is disconnected while userspace ALSA control file descriptors remain open. The root cause is that g_audio_cleanup() calls snd_card_free_when_closed() - which defers ALSA card teardown asynchronously - but immediately frees the underlying struct snd_uac_chip; kctl callbacks invoked when userspace closes those lingering FDs then dereference freed memory. No public exploit code exists and EPSS is 0.17%, but the kernel UAF class carries inherent privilege escalation potential on affected systems.
Dangling pointer use-after-free vulnerabilities in the Linux kernel USB gadget UVC (USB Video Class) driver allow a local attacker with low privileges to exploit freed memory in the uvc_function_bind() error path and uvc_function_unbind() teardown routine. The driver fails to NULL uvc->control_req after usb_ep_free_request() and uvc->control_buf after kfree(), leaving stale pointers that can be dereferenced in subsequent operations. No public exploit or active exploitation has been identified; EPSS sits at 0.20% (10th percentile), consistent with an unexploited kernel subsystem bug on niche hardware.
Out-of-bounds MMIO reads in the Linux kernel CXL RAS driver expose kernel memory contents and can crash the system on hosts equipped with CXL RCH hardware. The cxl_rch_get_aer_info() function bounds its readl() loop by the size of a software struct (struct aer_capability_regs) that has grown beyond the fixed physical on-wire AER register block due to expansions in struct pcie_tlp_log; reading past the MMIO mapping then populates header_log.header_len with garbage, triggering a second OOB read inside pcie_print_tlp_log(). No public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), consistent with the niche hardware prerequisite.
Out-of-bounds stack write in `sensor_hub_get_feature()` within the Linux kernel HID sensor-hub subsystem allows an attacker controlling a malicious HID device to corrupt kernel memory. A crafted HID descriptor that advertises an oversized feature field size exploits a mismatch between the function's return-value clamping logic and its unclamped per-value copy loop: when IIO subsystem callers (e.g., pressure or ambient-light sensor drivers) pass a small stack buffer such as a single s32, the copy loop writes beyond the buffer boundary by the full `field->report_size / 8` bytes per value. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), indicating low observed exploitation probability.
Out-of-bounds write in the STM32 CEC driver (media/cec/platform/stm32) allows an adjacent attacker on the same HDMI CEC bus to corrupt kernel memory by sending an overlong CEC frame. The stm32_rx_done() IRQ handler appends each received byte to a fixed 16-byte rx_msg.msg[] buffer using rx_msg.len as an unsanitized write index; a peer device that withholds the EOM signal drives RXBR interrupts indefinitely, writing attacker-controlled bytes past the end of the array into adjacent kernel structures. This vulnerability is reachable as soon as the STM32 CEC driver has probed and reception is enabled, with no local privilege or prior authentication on the CEC bus. No public exploit is identified at time of analysis; the fix is available in stable releases.
Heap out-of-bounds write in the Linux kernel vicodec virtual video codec driver's FWHT encoder allows a local low-privileged user to corrupt adjacent kernel heap memory, potentially enabling privilege escalation to root. The root cause is an undersized CAPTURE buffer: the encoder allocates output using a size multiplier of 3, but 4-component pixel formats whose planes all hit the FWHT_FRAME_UNENCODED verbatim-copy fallback require a multiplier of 4, producing a per-frame overflow of coded_w × coded_h bytes into adjacent slab memory. No public exploit has been identified at time of analysis; the EPSS score of 0.20% reflects the niche status of the vicodec driver in production deployments.
Slab-out-of-bounds memory corruption in the Linux kernel's nilfs2 log-structured filesystem allows a local low-privileged user to corrupt kernel slab memory by truncating a file whose block mapping collapses from B-tree to direct form. When this collapse occurs, an orphaned intermediate B-tree node block remains dirty in the kernel cache; the nilfs2 log writer subsequently misclassifies it as a direct-mapping data block and calls nilfs_direct_propagate() on it, causing a KASAN-detected out-of-bounds access that can lead to privilege escalation or kernel panic. No public exploit exists and EPSS is 0.20%, but the low-complexity local trigger limits the risk primarily to systems actively using nilfs2 mounts.
Out-of-bounds kernel read in Linux UBIFS's superblock signature verifier allows mounting a crafted NAND filesystem image to disclose kernel memory or crash the system. Linux kernels from v5.3 with UBIFS authentication support compiled in are affected - the flaw is exercised before any cryptographic check occurs, so no valid signing key is required. No public exploit has been identified at time of analysis and EPSS stands at 0.20%, but the C:H/A:H impact is real on embedded or desktop Linux deployments using UBIFS.
Append-only file protection bypass in the Linux kernel NFS server (nfsd) allows an authenticated NFS client to truncate a file that the kernel would normally protect from truncation. nfsd_setattr() decides whether a SETATTR size change requires the NFSD_MAY_TRUNC permission using an i_size value read without inode_lock, but the actual ATTR_SIZE truncation is applied later under the lock by notify_change(); a concurrent append that extends the file between the two points causes notify_change() to truncate an IS_APPEND file without the check that would reject it. There is no public exploit identified at time of analysis and the EPSS score is low (0.20%, 10th percentile).
Use-after-free in the Linux kernel NFSD server's NFSv4.2 inter-server copy (SSC) teardown path allows a memory-corruption/crash condition when nfsd4_ssc_expire_umount() resumes its list walk after dropping nfsd_ssc_lock for an mntput(). The saved 'next' (tmp) entry is not pinned by the nsui_busy flag, so a concurrent nfsd RPC thread hitting nfsd4_ssc_cancel_dul() can list_del+kfree that entry in the lock-drop window, leaving the walk to dereference freed memory. It affects NFS servers configured for server-to-server (inter-server) copy; no public exploit is identified at time of analysis and EPSS is low (0.20%).
Linux kernel NFS server (NFSD) contains a spurious WARN_ON_ONCE in nfsd_mode_check() that fires when an authorized NFS client performs a LOOKUP on a re-exported NFS filesystem whose dentry legitimately lacks i_op->lookup (mountpoints, V4 referrals). On systems configured with panic_on_warn=1 - common in production-hardened Linux deployments - this constitutes a remotely triggerable kernel panic and full availability loss. The nfserr_notdir guard that prevents the downstream NULL pointer dereference in lookup_one_unlocked() → __lookup_slow() → inode->i_op->lookup() is preserved in the fix; without it, the same codepath would dereference a NULL method pointer. No public exploit is identified at time of analysis and EPSS is 0.17%.
Use-after-free and NULL pointer dereference in the Linux kernel's lockd/nfsd subsystem allow a race between nfsd module teardown and in-flight lockd dispatch to dereference freed module memory, causing kernel panic or potential slab corruption. Any Linux NFS server running both nfsd and lockd (NFSv2/NFSv3 file locking) from kernel 2.6.12 through pre-7.2.4 is affected when nfsd is dynamically unloaded during active NFS lock operations. No public exploit has been identified and EPSS is 0.15%, consistent with the race-condition prerequisite.
Use-after-free in the Linux kernel NFSD server's NFSv4.1+ callback channel lets a slab object be read after it is freed when a client's session is torn down. After a DESTROY_SESSION, the teardown path can kfree() a session while an inflight callback rpc_task on rpciod still dereferences clp->cl_cb_session, because flushing the callback workqueue does not wait for tasks already handed to rpc_call_async() and the 1-second rpc_shutdown_client() drain can be outlived by tasks parked in rpc_delay() during NFS4ERR_DELAY retries. The fix RCU-protects cl_cb_session and switches session freeing to kfree_rcu(); no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a race-dependent server-side kernel bug rather than a mass-exploitation target.
Reference leak in Linux kernel NFSD's nfsd_cross_mnt() allows any authenticated NFS client to incrementally exhaust VFS mount and dentry reference counts, ultimately blocking umount operations and degrading dentry cache reclaim. The err < 0 arm of follow_down() uniquely omits the path_put() call present in every other exit path of the function, making the leak reachable via nfsd_lookup_dentry and NFSv4 READDIR encoding. No public exploit is identified at time of analysis; EPSS is 0.20% at the 10th percentile, and no KEV listing exists.
Silent data loss in Linux kernel NFSD's NFSv4.2 async COPY implementation causes the server to omit a write-verifier rotation when asynchronous copy writeback fails: the server correctly encodes NFS_UNSTABLE in the CB_OFFLOAD callback, but leaves nn->writeverf unchanged, so the client's subsequent COMMIT handshake returns the same verifier the client already holds and the client concludes copied data is durable - silently discarding data whose writeback actually failed. This violates the UNSTABLE+COMMIT durability contract specified in RFC 7862 §15.1 and RFC 8881 §18.32, matching a protocol-state class of bug already remediated in nfsd_vfs_write() and nfsd_commit(). No public exploit or active exploitation is identified; EPSS is 0.20%, consistent with the narrow preconditions required.
NFSD's seq-lock-like rq_status_counter protocol in nfsd_dispatch() is broken on three non-success exit paths - cache-hit (RC_REPLY), drop (RC_DROPIT/RQ_DROPME), and encode-error - leaving the counter permanently odd and exposing actively-mutating kernel fields to the lockless reader in nfsd_nl_rpc_status_get_dumpit(). A local low-privileged user on an NFS server who can poll NFSD RPC status via the netlink interface while requests traverse these paths can trigger out-of-bounds reads past the 8-element inline ops array embedded in the rqstp structure, disclosing kernel memory or causing a kernel panic. No public exploit exists (EPSS 0.19%), but the 6.12 LTS series appears unpatched, with fixes confined to 7.2.4 and 7.3-rc1.
Silent data loss in the Linux kernel NFSD NFSv4.2 async COPY offload path allows writeback errors to go undetected, causing clients to treat unwritten data as durably committed. The vulnerability stems from a TOCTOU race in `_nfsd_copy_file_range()`: the writeback-error cursor 'since' is sampled after the copy loop rather than before it, so a concurrent COMMIT or stable WRITE on the same destination inode can advance the error cursor before the COPY worker reads it, masking any writeback failure. CB_OFFLOAD then signals `wr_stable_how = FILE_SYNC4` to the NFS client, which confidently discards its copy of the data under the false belief it is durably stored on the server. No public exploit has been identified at time of analysis, and EPSS stands at 0.20%.
Use-after-free in the Linux kernel NFSD server (nfsv4 state machine) arises because nfsd4_drop_revoked_stid() processes FREE_STATEID for admin-revoked delegations without setting the SC_STATUS_FREED flag before dropping cl_lock. Because revoke_delegation() relies on that flag to tell whether FREE_STATEID has already handled the delegation, the freed delegation is re-added to the client's cl_revoked list via list_add(), and the dangling entry is later dereferenced when cl_revoked is walked during __destroy_client(). Affects NFSv4-serving kernels from ~6.11.6 up to the fix; no public exploit identified at time of analysis and EPSS is low (0.20%).
Out-of-bounds ring-buffer write and stale-memory disclosure in the Linux kernel NFSD server affects the nfsd_fh_verify and nfsd_fh_verify_err tracepoints, which reserve a server-address trace slot sized by the transport's remote-address length (xpt_remotelen) but populate it from the local address using xpt_locallen. On NFSv2/v3-over-UDP, xpt_remotelen stays zero for the transport's lifetime, so every file-handle verification copies 16 or 28 bytes past a zero-byte slot; in the reverse case an oversized slot leaks prior ring-buffer contents to trace consumers. Exploitation requires the tracepoint to be enabled by a local administrator, and there is no public exploit identified at time of analysis (EPSS 0.17%).
Memory exhaustion DoS in Linux kernel NFSv4 server (nfsd) allows any network-reachable client to force multi-MiB kernel heap allocations per COMPOUND operation. The flaw lies in nfsd4_decode_create(), which accepted an unbounded cr_datalen wire value for NF4LNK symlink targets without validation - allocating up to the full RPC payload size (several MiB) per request before the VFS eventually rejected the target with ENAMETOOLONG. By flooding the server with malformed NFSv4 CREATE operations, an attacker can exhaust kernel memory and cause a denial of service. No public exploit is identified at time of analysis, and EPSS is 0.17% (6th percentile).
Missing mount write-reference in the Linux kernel NFS server (nfsd) lets an authenticated NFSv2 client's SETATTR request run notify_change() without acquiring a mount write reference, bypassing the read-only-remount protection that fh_want_write() normally provides. The flaw affects the BOTH_TIME_SET branch of nfsd_proc_setattr(), which calls fh_verify() early so setattr_prepare() can inspect the dentry, causing nfsd_setattr() to skip the fh_want_write() call. This is a server-side correctness bug with no public exploit identified at time of analysis (EPSS 0.20%, 10th percentile) and is fixed in stable kernels; the assigned CVSS 9.1 with I:H/A:H is substantially overstated.
NULL pointer dereference in Linux kernel NFSD's NFSv4.2 compound dispatch loop allows remote clients to crash NFS servers built with CONFIG_NFSD_V4_2_INTER_SSC. By inserting an operation such as SETATTR between a foreign PUTFH and SAVEFH within a crafted COMPOUND request, an attacker causes fh_want_write() to dereference a NULL fh_export pointer - killing the nfsd kthread and denying NFS service to all clients. No public exploit has been identified and EPSS stands at 0.22%, reflecting low current exploitation interest.
Unbounded O(n²) CPU consumption in the Linux kernel NFS server (nfsd) POSIX ACL decoder allows any NFS client reachable on port 2049 to cause server-side denial of service by supplying an oversized ACL entry count in a SETACL compound. The root cause is an asymmetry introduced in commit 5fc51dfc2eb1: the encoder already caps count at NFS_ACL_MAX_ENTRIES, but the decoder added in that commit omits the symmetric bound check, passing the raw wire u32 directly into an O(n²) bubble sort. Patches are available in Linux 7.2.4 and 7.3-rc1; no public exploit or active exploitation has been identified.
Delegation recall permanently stalls in Linux kernel NFSD when the callback queue fails during a lease break. In nfsd_break_one_deleg(), the NFSD4_CALLBACK_RUNNING bit is set atomically to serialize recall work, but if nfsd4_run_cb() cannot queue the workitem, the refcount is decremented while the bit is left set - creating a permanent latch that causes every subsequent break_lease() on the same delegation to silently return early. The result is that the delegation is never recalled and any conflicting NFS open or lock operation stalls indefinitely, constituting a server-side denial of service. No public exploit has been identified and EPSS is 0.17%, consistent with a logic-error DoS requiring a specific failure condition to manifest.
Stale opcnt in nfsd4_release_compoundargs() enables an out-of-bounds slab read that leaks kernel memory to userspace via the netlink RPC status interface on Linux NFS servers. When nfsd_dispatch() hits an error path that leaves rq_status_counter at an odd value, the RPC status dumpit handler reads up to 16 entries from args->ops[] - but the inline iops[] array has only 8 elements and is the last field in the struct, so indices 8-15 access adjacent slab memory belonging to whatever object follows in the allocator. The fix zeroes opcnt unconditionally at compound-args release time. No public exploit or active exploitation has been identified; EPSS is 0.17%.
Use-after-free in the Linux kernel NFSD subsystem allows a local attacker with low privileges to read freed vmalloc memory or trigger kernel memory corruption via a race between the rpc_status netlink diagnostic interface and NFSv4 compound request teardown. The ops buffer (args->ops[]) is freed synchronously by vfree() in nfsd4_release_compoundargs() without waiting for an RCU grace period, while the rpc_status dumpit holds only an rcu_read_lock that protects the parent svc_rqst struct but not the separately vmalloc'd ops buffer. Vendor-released patches are available in stable series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV entry exists at time of analysis.
Memory corruption in the Linux kernel NFSD server (NFSv4.1+ session handling) occurs because nfsd4_sequence() can free the very session slot it is currently processing. When the session slot shrinker lowers se_target_maxslots below the channel's maxreqs, free_session_slots() kfrees every slot at index >= se_target_maxslots without verifying the caller's own slotid or the NFSD4_SLOT_INUSE flag, so an authenticated NFSv4.1+ client using a high-numbered slot can have its live slot freed, after which the code writes to the freed object and nfsd4_store_cache_entry() copies the compound reply into the dangling sl_data[] buffer, corrupting the slab. This is a use-after-free / heap out-of-bounds write with no public exploit identified at time of analysis and a low EPSS (0.20%, 10th percentile).
Denial of service (and potential local privilege escalation) in the Linux kernel's NFS server (nfsd) arises from a stateowner reference-count underflow on the NFSv4 seqid-operation replay retry path. When nfsd4_cstate_assign_replay() returns -EAGAIN because the replay owner is being torn down (RP_UNHASHED), nfs4_preprocess_seqid_op() erroneously called nfs4_put_stateowner() on a reference it never acquired, corrupting so_count and risking a use-after-free, while simultaneously leaking the sc_count reference held on the stid. There is no public exploit identified at time of analysis and EPSS is low (0.20%), but the leaked stid reference can also stall a concurrent nfsd4_close_open_stateid(), amplifying availability impact on an NFSv4 export.
Defensive hardening in the Linux kernel NFSD subsystem closes an edge case where nfsd_file_do_acquire() could use a file returned by dentry_create() that was never actually opened. The POSIX VFS interface permits ->atomic_open handlers to return success while delegating the open to a retry path via finish_no_open(); if that path is reached during an NFSv4 file creation, the resulting struct file lacks FMODE_OPENED and is in an invalid state for server I/O. Using such a handle can lead to a kernel crash or panic on the NFS server, causing a denial-of-service. No public exploit exists and exploitation is described as extremely unlikely by the kernel developers themselves; no public exploit has been identified at time of analysis.
Remote denial of service in the Linux kernel's NFSD pNFS server (NFSv4.1+) lets authenticated NFS clients crash the server by racing a LAYOUTGET against a delegation revoke. nfsd4_alloc_layout_stateid() reads fp->fi_deleg_file without holding fi_lock on the delegation-parent path, so a concurrent laundromat revoke can clear that pointer, making nfsd_file_get() return NULL and triggering a BUG_ON kernel panic. No public exploit is identified at time of analysis, EPSS is low (0.21%, 11th percentile), and the issue is fixed in tagged stable releases.
Persistent denial-of-service in the Linux kernel's NFSv4 server grace-period logic allows any reachable NFSv4 client to hold the server in grace indefinitely by sending CLAIM_PREVIOUS OPEN requests. The root cause is a clock-domain mismatch in clients_still_reclaiming(): the deadline is derived from nn->boot_time (CLOCK_REALTIME, ~1.7 billion seconds since epoch) but compared against ktime_get_boottime_seconds() (CLOCK_BOOTTIME, seconds since last boot - orders of magnitude smaller), making the comparison permanently false. As long as any client continues sending CLAIM_PREVIOUS, the grace period never ends, blocking all non-reclaim NFSv4 operations for every other connected client. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17%.
Race condition in the Linux kernel NFSD NFSv4.2 server-side copy state management allows any authenticated NFSv4.2 client to crash the NFS server kernel. The cpntf entry is inserted into the IDR (making it immediately addressable by stateid) before its cp_list is initialized in a separate lock section; a concurrent OFFLOAD_CANCEL - using the cnr_stateid echoed to the client - reaches _free_cpntf_state_locked() and calls list_del() on a zeroed list_head, triggering a kernel oops. No public exploit code is known and the issue is not in CISA KEV; patches are available in stable releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Use-after-free in the Linux kernel NFS server (nfsd) file-cache disposal path allows concurrent kernel subsystem callbacks - the global memory shrinker, nfsd laundromat garbage collector, and fsnotify - to dereference a freed nfsd_fcache_disposal struct during per-network-namespace teardown, producing kernel heap corruption or a system panic. The vulnerable window opens when a network namespace hosting nfsd is destroyed while disposal callbacks remain in-flight; containerized NFS server deployments (Docker, Kubernetes) are the most realistic trigger scenario. No public exploit identified at time of analysis, with EPSS at 0.17% consistent with a race-condition-gated kernel bug.
Denial of service in the Linux kernel NFS server (nfsd) pNFS layout subsystem allows an authenticated NFSv4.1+ client to leak layout stateids, gradually exhausting kernel memory. A race in the layout fence/recall path (lm_breaker_timedout) lets the block-lease breaker acquire a duplicate sc_count reference that is never released, pinning the layout stateid forever. Rated CVSS 9.8 but the real-world impact is availability-only and gated on a niche pNFS export configuration plus a race window; no public exploit identified at time of analysis and EPSS is very low (0.15%, 5th percentile).
Resource exhaustion in the Linux kernel NFSv4.2 inter-server copy (COPY offload) path allows an authenticated NFS client to leak nfsd_file objects on the server. Each inter-server COPY request that triggers a failed nfsd4_setup_inter_ssc() call bypasses the cleanup path where release_copy_files() drops the nf_dst reference, permanently pinning a file, inode, dentry, and vfsmount. Over time, repeated failed COPY requests exhaust kernel memory resources, producing a denial-of-service condition. No public exploit exists and EPSS is 0.21%, reflecting the niche NFSv4.2 inter-server copy configuration required.
Remote kernel crash in the Linux kernel NFSv4 server (nfsd) allows any unauthenticated network client to trigger a NULL pointer dereference and kernel oops by sending a crafted SETATTR compound request. The flaw resides in nfsd4_setattr() when delegation timestamp attributes (FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY) are included alongside the NFSv4 'one stateid' (all-0xFF bytes): the special-stateid handling path in nfs4_preprocess_stateid_op() exits without populating the nfs4_stid output pointer, leaving the local variable NULL, after which the unconditional dereference of st->sc_type at offset 4 from NULL panics the kernel. No public exploit has been identified at time of analysis, and EPSS sits at 0.24% (15th percentile), though the zero-prerequisite attack surface makes this straightforward to trigger against any exposed NFSv4 server running an affected kernel.
Silent data corruption in the Linux kernel NFS server daemon (nfsd) allows authorized NFS write clients to induce incorrect file-offset placement whenever a partial write completes between 50% and 99% of a segment boundary. Affecting kernel revisions from commit 06c5c97293e3fca99ce15da157068edf45a7c6e4 up to the fix commits included in 7.2.4 and 7.3-rc1, the logic error in nfsd_direct_write() causes subsequent write segments to land at wrong file offsets while the byte-count returned to the NFS client is over-reported, masking the corruption. No public exploit has been identified at time of analysis and EPSS stands at 0.19%, but the impact is undetected, silent filesystem data corruption on any NFS-exported volume.
Use-after-free in the Linux kernel's NFS server (nfsd4_create_file, the NFSv4 OPEN-with-create path) allows a stale dentry to be dereferenced after being freed. When the exported filesystem is itself NFS (an NFS re-export), dentry_create() can return a different dentry than the one passed in, so the original 'child' dentry already recorded in resfhp may be freed and later dereferenced via fh_compose(), leading to memory corruption and likely a server crash. No public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile), and the fix is available upstream in stable kernels.
Use-after-free / dangling-pointer corruption in the Linux kernel NFSD server allows an NFSv4.2 client performing an asynchronous server-side COPY to leave a stale IDR entry in the s2s_cp_stateids table, pointing at per-request COMPOUND buffer memory that is immediately recycled. When the NFSD laundromat or manage_cpntf_state() later walks that IDR, it dereferences reused request memory and can be steered into refcount_dec()/idr_remove()/kfree() on attacker-influenced garbage, corrupting kernel memory or crashing the server. No public exploit is identified at time of analysis, EPSS is low (0.17%, 6th percentile), and a vendor patch is available; the CVSS 9.8 rating substantially overstates the practical risk.
A use-after-free in the Linux kernel NFSD server's asynchronous server-side copy (NFSv4.2 COPY offload) lets teardown paths race the copy kthread, corrupting or freeing the copy object early. When an OFFLOAD_CANCEL request, an nfsd export/superblock shutdown, or a per-filesystem cancel runs concurrently with the reaping copy kthread, nfsd_file structures (nf_src/nf_dst) are double-put and freed, the STOPPED flag is set before final dereferences, and the copy_task/callback are used after free - causing NULL derefs, double frees, and UAF that can crash an NFSv4.2-serving host. Fixed in stable kernels 6.18.51, 7.2.4, and 7.3-rc1; no public exploit identified at time of analysis and EPSS is low (0.17%).
Out-of-bounds write and kernel memory disclosure in the Linux kernel NFS server (nfsd) affect deployments exporting pNFS flexfiles layouts. The XDR length calculation in nfsd4_ff_encode_layoutget() miscomputes the reservation for the encoded layout, so with certain string/file-handle sizes the server writes up to 5 bytes past the reserved XDR buffer, and with 4-byte-aligned lengths it over-reserves and transmits uninitialized (stale) kernel buffer contents to the client. It is fixed in stable releases 6.12.109, 6.18.50, and 7.2.4 (and 7.3-rc1); no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Unintended ACL deletion in the Linux kernel NFSD server affects the NFSACL v2 SETACL path, where nfsacld_proc_setacl() passes both the access and default ACL pointers to set_posix_acl() unconditionally even when the request mask omits one of them. Because set_posix_acl(..., NULL) is the VFS 'remove this ACL type' operation, an NFS client sending a SETACL that carries only NFS_ACL silently strips the directory's default ACL, and a mask of 0 strips both, corrupting on-disk access controls. This is the NFSACL v2 counterpart of the same defect already fixed in nfsd3_proc_setacl(); it is a fixed upstream integrity bug with no public exploit identified at time of analysis and a low EPSS score (0.21%).
Silent ACL removal in the Linux kernel NFSv3 server (nfsd) lets a SETACL request unintentionally strip POSIX access or default ACLs from files and directories on an exported filesystem. The NFSACL SETACL handler passes the decoded acl_access/acl_default pointers to set_posix_acl() unconditionally, but the decoder leaves those pointers NULL whenever the client omits the corresponding NFS_ACL/NFS_DFACL mask bit - and a NULL pointer is the VFS signal to delete that ACL type, so a request with mask=NFS_ACL drops the directory's default ACL and mask=0 drops both. Present since 2.6.13 and fixed in 6.12.109/6.18.50/7.2.4/7.3-rc1; no public exploit identified at time of analysis and EPSS is low (0.20%).
Use-after-free in the Linux kernel NFSD localio code path allows a local user to dereference recycled slab memory by exploiting a missing RCU read-lock window in `nfsd_open_local_fh()`. The `again:` retry block performs a `cmpxchg` on an `nfsd_file` pointer and then calls `nfsd_file_get()` (refcount_inc_not_zero) without holding `rcu_read_lock`, while the sole caller drops the lock before the helper runs - leaving a race window where CPU1 can put the last reference, trigger `call_rcu`, and have the slab page recycled before CPU0 increments the refcount. Vendor-released patches are available for the 6.15, 6.18, 7.2, and 7.3-rc1 stable trees; no public exploit exists and EPSS is 0.20%.
Use-after-free in the Linux kernel NFSD server (nfsd4_copy_notify) lets a racing OFFLOAD_CANCEL operation free a copy-notify stateid before the COPY_NOTIFY caller finishes initializing and reading it, corrupting kernel memory on NFSv4.2 servers with inter-server copy offload. Affected are kernels from 5.6 up to the fixed 6.12.109/6.18.50/7.2.4/7.3-rc1 releases. The flaw requires an authenticated NFS client and a tight race window, and there is no public exploit identified at time of analysis (EPSS 0.20%, 10th percentile).
Stale debugfs function pointers in Linux kernel NFSD create a use-after-free condition when module initialization fails partway through. Specifically, nfsd_debugfs_init() registers debugfs files containing fops pointers into module text before nfsd4_init_slabs() succeeds; if slab allocation then fails, the module's text is freed but the debugfs entries remain live with now-dangling pointers. Any subsequent access to those orphaned debugfs files - for example by a local user browsing /sys/kernel/debug - can trigger a kernel-mode UAF, potentially crashing the system or enabling privilege escalation. No public exploit code exists and EPSS is 0.21%; patch commits are available for 6.18.50, 7.2.4, and 7.3-rc1.
Resource leak race condition in the Linux kernel NFS server (NFSD) filecache allows orphaned nfsd_file objects to accumulate when network-namespace shutdown races with the GC worker, shrinker, or fsnotify/lease callbacks. When nfsd_file_cache_shutdown_net() runs concurrently with any of these three paths, already-unhashed files queued to the per-net dispose list are missed by the shutdown drain, leaving both the file handle and associated NFS state permanently leaked. The vulnerability affects Linux 6.9 through pre-patch kernels and is DoS-leaning with no public exploit identified at time of analysis and an EPSS of 0.20%.
Integer overflow during NFSv2 SETATTR/CREATE decoding in the Linux kernel NFSD corrupts file timestamps before proc-level validation can occur. On ILP32 (32-bit) kernels, `tmp2 * NSEC_PER_USEC` overflows a 32-bit unsigned long, wrapping an out-of-range useconds value into an in-range tv_nsec - bypassing the subsequent range check and letting a bogus nanosecond value reach the filesystem. A secondary defect on all platforms allows a client placing useconds==1000000 in the atime field (without also setting mtime to 1000000) to leave ATTR_ATIME_SET armed with tv_nsec=10^9, which also reaches the filesystem unchecked. No public exploit has been identified at time of analysis; EPSS is 0.21%.
POSIX ACL reference-count leaks in Linux kernel NFSD allow a remote attacker to exhaust kernel memory via malformed NFSv4 OPEN compound requests. When the NFS server decodes an OPEN compound carrying valid POSIX ACL createhow4 attributes but encounters a non-seqid-mutating error from claim4 decoding, the compound dispatcher short-circuits before nfsd4_open() executes, permanently leaking both op_pacl and op_dpacl references because OP_OPEN lacked an op_release handler; a secondary leak exists on the NFSv4.0 replay path where op_release was never called from nfsd4_encode_replay(). No public exploit code has been identified and EPSS is 0.20%, but repeated malformed requests against a network-reachable NFSv4 server could drive the kernel toward OOM-induced service failure.
Use-after-free in Linux kernel NFSD's copy-notify stateid management (NFSv4.2 server-to-server copy) allows an authenticated NFS client to trigger a KASAN-detectable UAF at nfs4_put_cpntf_state() by racing OFFLOAD_CANCEL or laundromat expiry against concurrent stateid readers. Three separate revoke paths were affected: the parent-stid drain (nfs4_free_cpntf_statelist()), OFFLOAD_CANCEL via manage_cpntf_state(), and laundromat tick expiry. No public exploit or CISA KEV listing exists; EPSS is 0.17% (6th percentile), and real-world impact is DoS-leaning with theoretical memory disclosure.
Denial of service (and potential privilege-context corruption) in the Linux kernel's NFSv4 server (NFSD) arises from a use-after-free/NULL-dereference when a client is torn down. A lock owner whose only reference is a blocked lock (nbl) is not counted by client_has_state(), so a DESTROY_CLIENTID operation can reach __destroy_client(), which walks the owner hash table calling remove_blocked_locks() on such owners without holding a reference; the per-net laundromat concurrently reaps the same blocked locks and frees the owner, causing a dereference of freed memory. Fixed upstream and in stable trees; no public exploit identified at time of analysis and EPSS is low (0.20%, 10th percentile).
A use-after-free in the Linux kernel's NFSv4 server (NFSD) admin-state revocation path lets a client structure be freed while still in use, introduced in 6.9 and fixed in 6.18.51, 7.2.4, and 7.3-rc1. When an administrator revokes NFSv4 state, nfsd4_revoke_states() temporarily drops the client_lock while revoke_one_stid() dereferences a stateid's bare (non-pinning) pointer to its nfs4_client; a concurrent client teardown via force_expire_client() can free that client first, causing NFSD to read freed memory. No public exploit is identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not on CISA KEV; the practical impact is server crash/DoS on the NFS server rather than remote code execution.
Use-after-free in the Linux kernel's NFS server (nfsd) allows a freed nfs4_client structure to be dereferenced during NFSv4 delegation revocation. When a recalled delegation times out, nfs4_laundromat() briefly unhashes it from cl_delegations before revoke_delegation() relinks it onto cl_revoked, and in that window client_has_state() can report no remaining state, letting free_client() run while revoke_delegation() is still about to touch cl_lock. Fixed versions are available; no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Use-after-free in the Linux kernel's NFS server (NFSD) NFSv4.0 revoked-state cleanup path lets a race between the periodic laundromat sweep and administrative client expiry free an NFS client structure while it is still being dereferenced. In nfs40_clean_admin_revoked(), a stateid reference is held but does not pin the owning client, so nfsd4_drop_revoked_stid() can dereference s->sc_client after another thread frees the client. It is a server-side memory-corruption bug affecting hosts running NFSD with NFSv4.0 state, fixed in stable releases; there is no public exploit identified at time of analysis and EPSS is low at 0.20%.
Kernel crash in the Linux libceph client allows a malicious or compromised authenticated Ceph OSD to trigger a BUG_ON assertion in ceph_msg_data_next() by sending a crafted sparse-read reply. The flaw in net/ceph/osd_client.c:osd_sparse_read() validates total data length against summed extents but omits per-extent monotonicity, overlap, and bounds checks, enabling a far-forward extent offset to advance the message-data cursor past the request buffer. Impact is limited to availability - a targeted kernel panic on any Linux client mounting a RADOS-backed filesystem or block device (RBD/CephFS). No public exploit code has been identified at time of analysis, and EPSS is low at 0.20%.
Out-of-bounds slab write in the Linux kernel's libceph/CRUSH map decoder (crush_decode) lets a malformed CRUSH map corrupt kernel memory on any RADOS client (Ceph RBD or CephFS). Because crush_decode() stores buckets by array slot while the mapper derives each bucket's workspace index from its decoded id, a map encoding an id different from '-1 - slot' makes one bucket alias another's kvmalloc'd workspace; a uniform bucket's second-replica permutation then overflows the smaller aliased buffer, producing a 4-byte OOB write in bucket_perm_choose() confirmed by KASAN. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; the CRUSH map is delivered from the Ceph monitor/OSD map, so exploitation requires a malicious or compromised monitor rather than an arbitrary internet attacker.
Use-after-free in the Linux kernel CephFS client (__kick_flushing_caps) lets a race between cap-flush transmission and FLUSH_ACK handling corrupt kernel memory on a mounted CephFS client. Because the iterator drops i_ceph_lock to send cap messages, a fast-responding MDS can cause handle_cap_flush_ack() to detach and free the current cap-flush entry before the loop advances, dereferencing freed memory. No public exploit is identified at time of analysis and EPSS is low (0.20%); impact is a client-side crash/memory corruption rather than remote code execution.
Use-after-free in the Linux kernel CephFS client (check_new_map()) lets a freed ceph_mds_session be dereferenced during MDS map processing, enabling memory corruption and likely denial of service on machines with a mounted CephFS. When check_new_map() releases mdsc->mutex to handle a session's address change, reconnect, or active transition, it fails to take a reference on the session (unlike the forced-close path), so a concurrent thread can unregister and kfree that session before the original thread touches s->s_mutex. This is no public exploit identified at time of analysis; EPSS is low at 0.16%.
Out-of-bounds write in the Linux kernel CephFS client (ceph module) lets a malicious or compromised Ceph monitor corrupt kernel memory on any client with a mounted CephFS. The MDSMap decoder failed to bound export_targets rank values against CEPH_MAX_MDS, and check_new_map() then used each attacker-controlled rank as a bit index into a fixed-size stack bitmap, causing set_bit() to write past the array. No public exploit is identified at time of analysis and EPSS is low (0.17%), but the fix ships across multiple stable trees.
Slab out-of-bounds write in the Linux kernel's CephFS client (ceph_get_name() and __get_snap_name()) lets a malicious or compromised Ceph MDS overflow a NAME_MAX-sized name buffer during NFS-export name resolution. The code copies the MDS-supplied dentry name (rinfo->dname / rde->name) via memcpy and writes a NUL terminator at dname_len without ever checking dname_len against NAME_MAX, so a LOOKUPNAME reply with an oversized name corrupts adjacent slab memory (flagged by KASAN). It is only reachable when a CephFS mount is re-exported over NFS; fixed by the new ceph_export_copy_name() helper that rejects over-length names with -ENAMETOOLONG. No public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Remote denial of service in the Linux kernel's CephFS client (ceph module) allows a malicious or compromised Ceph MDS (Metadata Server) to crash a mounting client during session setup. In handle_session(), the MDSCapAuth match.path and match.fs_name fields of a CEPH_SESSION_OPEN message (msg_version >= 6) are copied with a bare ceph_decode_copy() after decoding an attacker-controlled 32-bit length, with no preceding bounds check, letting the copy read up to 4 GiB past the message front allocation and trigger a slab-out-of-bounds read. No public exploit is identified at time of analysis and EPSS is low (0.20%); exploitation requires a hostile server on the first post-connect message with no client-side user interaction.
Out-of-bounds read in the Linux kernel CephFS client (fs/ceph/mdsmap.c) lets a malicious or compromised Ceph monitor crash a client that has a CephFS mount. ceph_mdsmap_decode() advances its decode cursor by num_export_targets*4 bytes for each per-MDS info record without verifying enough bytes remain, and the only runaway-cursor guard is skipped for info versions 2 and 3, so an oversized count walks the cursor past the message front buffer and a later ceph_decode_32() reads slab memory out of bounds. No public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile).
Kernel heap information disclosure in the Linux CephFS client (fs/ceph) lets a malicious or compromised Ceph metadata server (MDS) leak adjacent kernel heap bytes to a local user. __build_xattrs() fails to bounds-check the value length of the final xattr in an MDS-supplied blob, so an oversized length is stored verbatim and later copied out of bounds by getxattr(2). No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile) and the flaw is not in CISA KEV.
Uncontrolled resource consumption in the Linux kernel Ceph client's ceph_parse_deleg_inos() function allows a malicious or compromised Ceph MDS (Metadata Server) to trigger denial of service against any connected client. The 64-bit interval length field in MDS create-with-delegation replies is decoded without value validation, enabling a crafted reply to spin the client's insert loop indefinitely or grow the per-session delegated-inode xarray without bound, exhausting CPU or kernel memory. No public exploit code exists and no CISA KEV listing is present, consistent with the EPSS score of 0.21%.
CPU exhaustion DoS in the Linux kernel's Ceph filesystem client affects systems with mounted Ceph volumes: `ceph_cap_reclaim_work()` enters a busy loop by unconditionally re-queuing itself whenever `ceph_trim_dentries()` returns `-EAGAIN`, which occurs even when no leases are eligible for reclaim. The underlying cause is `__dir_lease_check()` returning `TOUCH` for every valid lease when `expire_dir_lease=false`, churning the dentry list, resetting timestamps (preventing natural aging), and always exhausting the `nr_to_scan` budget - guaranteeing the `-EAGAIN` re-queue cycle. Vendor-confirmed data shows this produced 500 `ceph_trim_dentries()` calls per second and 128,000+ lock contentions on `dentry_list_lock` in a 5-minute window. No public exploit code exists and the CISA KEV does not list this vulnerability.
Ceph filesystem driver in the Linux kernel leaks an inode wrbuffer reference when writeback is aborted during umount, triggering a kernel BUG and system crash. The defect manifests specifically when ceph_submit_write() fails the osd_stopping_blocker check at unmount time: the wrbuffer claim taken by ceph_dirty_folio() is never released because writepages_finish() - the only release path - never runs for aborted, never-submitted writes. Because i_wrbuffer_ref never returns to zero, the corresponding ihold() is never dropped, the inode cannot be evicted, and the kernel panics with 'VFS: Busy inodes after unmount of ceph' at fs/super.c:650. No public exploit code exists and no active exploitation has been reported; EPSS probability is 0.21%.
Use-after-free in the Linux kernel audit subsystem lets a local privileged operator free an audit tree while another rule still references it, later dereferencing a freed pathname. The flaw is in audit_del_rule(), which unconditionally calls audit_put_tree() as if handling a netlink deletion template; when invoked via fsnotify autoremove for mixed AUDIT_DIR plus AUDIT_EXE rules it instead drops the installed rule's live tree reference. No public exploit is identified at time of analysis, and the EPSS score is low (0.20%, 10th percentile), consistent with a local, race-dependent memory-safety bug rather than a remotely weaponizable one.
Use-after-free in the Linux kernel CIFS client's cifs_file_set_size() allows a local low-privileged user to corrupt kernel heap memory when a handle-based set-size RPC fails during SMB session teardown or reconnection. The freed tcon pointer is reused in a path-based fallback because it is not NULLed after cifsFileInfo_put(), exposing slab memory that may have been reclaimed by the kernel allocator. Patches are confirmed in versions 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation has been identified at time of analysis.
Integer underflow in the Linux kernel CIFS client's cifs_remap_file_range() corrupts SMB protocol fields and inverts write-range operations when a clone-to-EOF request is made with a source offset exceeding the file's current size. A local user with low privileges and access to a CIFS-mounted filesystem can trigger this by supplying len=0 and an offset beyond i_size in a FICLONERANGE ioctl, sending a malformed FSCTL_DUPLICATE_EXTENTS_TO_FILE request to the SMB server and disrupting filemap_write_and_wait_range() with an inverted range. No public exploit has been identified at time of analysis; vendor-released patches are available in stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Stale fscache data exposure in the Linux kernel CIFS client allows a local low-privileged user with access to a mounted SMB share to read file data that should have been discarded after an O_TRUNC open. When cifs_do_truncate() is called from cifs_open() without holding i_rwsem, the fscache cookie invalidation step is skipped - meaning previously cached file contents remain readable via fscache_use_cookie() even after the file has been truncated to zero. This produces both confidentiality and integrity violations: a process can obtain pre-truncation data and the kernel cache becomes inconsistent with actual file state. No public exploit is identified at time of analysis; EPSS is 0.17%.
A lockless read race in the Linux kernel's ftrace ring-buffer subsystem allows a local attacker to corrupt kernel memory by concurrently triggering a subbuf resize while a reader accesses stale size metadata. Affected versions span from the commit introducing dynamic subbuf resizing (~Linux 6.8) through current stable branches. The CVSS vector rates confidentiality, integrity, and availability all high, reflecting that a successful race can yield kernel memory corruption; no public exploit or CISA KEV listing exists, and EPSS sits at a low 0.16%.
IRQ resource leak and potential use-after-free in the Linux kernel's NXP PIT (Periodic Interrupt Timer) clocksource driver allows a kernel crash if an interrupt fires after error-path cleanup. The driver's pit_clockevent_init() error path skips free_irq() when cpuhp_setup_state() fails after request_irq() has already succeeded, then proceeds to kfree(pit), leaving the registered IRQ handler's dev_id pointing to freed slab memory. If the IRQ subsequently fires, the handler dereferences the freed pointer, constituting a use-after-free. No public exploit exists and EPSS is 0.15% (5th percentile), consistent with a race-condition bug on niche embedded hardware.
Overlayfs in the Linux kernel exposes an unprivileged local DoS - and a theoretical privilege-escalation path - through a double `end_creating()` call in `ovl_create_real()` when a casefold consistency mismatch is detected during directory creation. The double call unlocks the parent directory's `i_rwsem` twice and calls `dput()` twice on the same dentry: the spurious unlock wedges every subsequent creation under that parent indefinitely, and the spurious `dput()` creates a reference-count imbalance that could underpin a use-after-free chain. The flaw is reachable without root in a user namespace on most modern Linux distributions. No public exploit has been identified at time of analysis and EPSS is 0.18%.
Use-after-free in the Linux kernel's Rust devres (device resource management) subsystem allows a local low-privileged attacker to cause kernel memory corruption or achieve privilege escalation. The race triggers when the driver core's devres_release_all() and Devres::drop() concurrently attempt to revoke the same Devres object - the losing revoker returns immediately while the winner's drop_in_place() is still executing, allowing adjacent resources such as DMA scatter-gather tables to be freed beneath active teardown. No public exploit code or CISA KEV listing exists; EPSS is 0.18%.
Use-after-free in the Linux kernel's KEYS trusted TPM subsystem permits concurrent kernel threads to dereference freed memory during module teardown. trusted_tpm_exit() incorrectly releases the TPM chip reference and frees the digest array before calling unregister_key_type(), which is the actual synchronization barrier that drains in-flight key operations. A local attacker with key-creation privileges racing a module unload can trigger a KASAN-confirmed slab-use-after-free in tpm_pcr_extend(), potentially yielding kernel memory corruption with high confidentiality, integrity, and availability impact. No public exploit exists and EPSS sits at 0.15%, indicating no widespread exploitation activity at time of analysis.
AppArmor's begin_current_label_crit_section() in the Linux kernel contains a use-after-free of struct cred that can be triggered on systems with active AppArmor profiles when those profiles are updated or disabled mid-syscall. The flaw arises from synchronous credential replacement inside LSM hooks: the override_creds() guard in aa_replace_current_label() fails to detect when overridden and objective credentials are the same object, causing two reference drops that free the struct cred while task_struct still holds a pointer to it. No public exploit or CISA KEV listing exists; EPSS is 0.16% at the 5th percentile, consistent with low immediate exploitation probability despite a theoretically high UAF impact.
Out-of-bounds write in the Linux kernel AppArmor LSM label parser allows any local user on an AppArmor-loaded system to corrupt kernel heap or stack memory by writing a crafted multi-component label string to /proc/self/attr/apparmor/current or to the world-writable (mode 0666) securityfs .access file, the latter path applying no privilege check whatsoever. The bug is a deterministic off-by-one: aa_vec_unique() writes a NULL terminator at vec[n] when no duplicates are found, but vec_setup() and DEFINE_VEC() allocate only n slots, so the write lands one entry past the end of either the local stack array or the kzalloc'd buffer. No public exploit has been identified at time of analysis; vendor-released patches are available in stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Memory corruption in the Linux kernel's swap/hibernation subsystem can produce silent data corruption and crashes in unrelated userspace processes during hibernation image preparation. swap_free_hibernation_slot() unconditionally calls __swap_cluster_free_entries() without checking whether a folio already occupies the slot in the swap cache - a state reachable when cluster readahead speculatively faults in pages over the hibernation window. The freed slot is returned to the allocator while its folio retains the stale swap offset in folio->swap; when page reclaim subsequently flushes that folio using the stale offset, it silently overwrites a swap table entry now belonging to a different process, corrupting arbitrary in-flight userspace data. No public exploit has been identified at time of analysis.
Memory corruption in the Linux kernel's mm/mempolicy subsystem allows a local unprivileged user to trigger a bogus folio pointer dereference, a VM_BUG_ON() panic, or silent LRU isolation of an unrelated live folio when an HMM-based GPU driver has migrated a transparent huge page (THP) to device memory. The flaw exists because queue_folios_pmd() does not guard against device-private PMDs before calling pmd_folio(), which misinterprets the device-private swap entry encoding as a hardware PFN. No public exploit has been identified at time of analysis, and EPSS is 0.18%, but the C:H/I:H/A:H CVSS impact rating reflects the potential severity if the precise conditions are met.
Stale swap-cache mapping in __migrate_device_pages() triggers invalid folio reference-count accounting in the Linux kernel mm/migrate_device subsystem, ultimately producing a BUG_ON kernel panic and potential memory corruption. The defect has two related components: the folio->mapping pointer is captured before folio_free_swap() executes, leaving a dangling reference to swap_space after swap-cache removal, and after a large folio is split the migration loop counter nr is not reset to 1, causing split order-0 folios to be processed with the original large-folio count. No public exploit code has been identified and EPSS is 0.18% (7th percentile), consistent with a local kernel-internals bug requiring a specific HMM/device-migration code path. Vendor-released patches are confirmed for stable trees targeting 7.2.4 and 7.3-rc1.
Stale walk->action state in the Linux kernel mm/pagewalk subsystem causes walk_pud_range() to spuriously retry PUD traversal and invoke page-walk callbacks twice, resulting in a slab-out-of-bounds write reachable by unprivileged local users via the mincore(2) syscall. Affected kernels in the 6.18.21-6.18.49 and 7.0-7.2.3 ranges contain the latent logic error activated by commit 3b89863c3fa4; the bug was confirmed by KASAN output and a local fuzzer producing an OOB write into a sigqueue slab object. No public exploit is available and no active exploitation has been identified; vendor-released patches are available in 6.18.50, 7.2.4, and 7.3-rc1.
UAF in the Linux kernel's user_events tracing subsystem (present since kernel 6.4) allows a local unprivileged user to trigger a reference-count underflow during fork failure, freeing the parent process's user_event_mm slab object while the parent retains a stale pointer. Any subsequent user_events ioctl() call by the parent dereferences the freed memory, enabling a write primitive that can lead to local privilege escalation. No public exploit exists and EPSS is low at 0.20%; no KEV listing is present at time of analysis.
Ring buffer corruption in the Linux kernel tracing subsystem arises from an inverted retry-exhaustion test in `simple_ring_buffer_swap_reader_page()`. When a compare-and-swap link replacement succeeds on the eighth and final attempt, the existing `!retry` guard (which triggers at zero) incorrectly returns -EBUSY while leaving the link update complete but reader bookkeeping unfinished; when all eight attempts fail, retry reaches -1, `!retry` is false, and the function falls through to update head and reader pointers as though the swap succeeded, silently corrupting the ring buffer structure. The fix, landed in Linux 7.2.4 and 7.3-rc1, corrects the guard to treat only a negative counter as exhaustion and return the documented -EBUSY. No public exploit code exists and EPSS is 0.19%.
Use-after-free in the Linux kernel tracing subsystem allows a local unprivileged attacker with tracefs access to corrupt kernel memory, potentially achieving privilege escalation. The race exists between trace_pipe readers holding stale event pointers and concurrent writes to buffer_subbuf_size_kb, which triggers ring_buffer_subbuf_order_set() to free and replace all ring buffer sub-buffer pages - including reader pages - without coordinating with active readers. KASAN-confirmed reproduction via syzbot (syz-executor989/6002) demonstrates practical triggering. No public exploit or CISA KEV listing at time of analysis; EPSS of 0.20% at the 10th percentile reflects low current exploitation probability.
Use-after-free in the Linux kernel tracing subsystem allows a local attacker with tracefs write access to panic the kernel or corrupt memory by registering two hist triggers sharing the same name= parameter on different events, followed by a third trigger referencing a variable. The second trigger's hist_data is freed by hist_register_trigger() during named-data reuse detection, but its tr->hist_vars list entry is never removed; a subsequent find_var_file() call then dereferences the freed 2048-byte slab region. The bug is confirmed by an included KASAN trace showing the precise allocation and free sites, with a deterministic three-command reproduction sequence documented in the CVE description itself; no public exploit has been identified at time of analysis.
An infinite loop in the Linux kernel's device property subsystem causes system hangs when iterating firmware nodes (fwnodes) with a secondary fwnode containing more than one child. Affected are Linux kernel versions across multiple stable branches (5.10.x through 6.19.x pre-patch). An attacker or malformed firmware blob that produces such a node topology can cause a kernel thread to spin indefinitely, consuming a CPU core and ultimately triggering a watchdog reset or complete system hang. No active exploitation has been confirmed, and EPSS stands at 0.17%.
Out-of-bounds kernel heap read in the Linux kernel's Nitro Secure Module (NSM) virtio driver allows a malicious or buggy NSM backend to disclose adjacent kernel heap memory to user space. The driver stores the used-ring response length reported by the backend device without clamping it to the actual response buffer size; parse_resp_raw() then copies that unclamped length of bytes to user space, leaking heap contents to the calling process. No public exploit has been identified at time of analysis; patches are available in stable kernel releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Use-after-free in the Linux kernel's RapidIO mport character device driver allows a local low-privileged user to trigger kernel memory corruption via the DMA request teardown path. The flaw exists in dma_req_free(), where the mutex protecting a mapping object is unlocked through a pointer that may have already been freed by kref_put() invoking the last-reference destructor. An attacker with access to the /dev/mport* character device interface can trigger this condition to achieve kernel privilege escalation. No public exploit code has been identified at time of analysis, and EPSS probability sits at 0.20%.
Double-free memory corruption in the Linux kernel V4L2 (Video for Linux 2) subsystem exists in the error-handling path of __video_register_device() after a prior patch introduced a put_device() call on device_register() failure. Because the V4L2 API contract requires callers to invoke video_device_release() - which kfree()s the video_device struct - on registration failure, the intermediate put_device() frees the struct first, causing a subsequent double-free. The fix reverts the erroneous commit (2a934fdb01db6458288fc9386d3d8ceba6dd551a), accepting a small memory leak in exchange for eliminating the double-free, given that device_register() failures are described as extremely rare in practice. No public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Linux kernel's at91_udc USB gadget driver allows a local low-privileged attacker to dereference freed kernel memory during driver teardown, potentially achieving kernel code execution. The vulnerability affects systems running AT91/SAM series Atmel ARM microcontrollers in polled-VBUS mode, where a self-restarting timer/work cycle is never cancelled before the devm-allocated udc structure is freed. No public exploit exists and no KEV listing has been issued, but the bug is reachable via a routine driver unbind without triggering any fault condition.
Use-after-free in the Linux kernel USB audio gadget driver (drivers/usb/gadget/function/u_audio.c) allows a local attacker or race condition to corrupt kernel memory when a USB audio gadget device is disconnected while userspace ALSA control file descriptors remain open. The root cause is that g_audio_cleanup() calls snd_card_free_when_closed() - which defers ALSA card teardown asynchronously - but immediately frees the underlying struct snd_uac_chip; kctl callbacks invoked when userspace closes those lingering FDs then dereference freed memory. No public exploit code exists and EPSS is 0.17%, but the kernel UAF class carries inherent privilege escalation potential on affected systems.
Dangling pointer use-after-free vulnerabilities in the Linux kernel USB gadget UVC (USB Video Class) driver allow a local attacker with low privileges to exploit freed memory in the uvc_function_bind() error path and uvc_function_unbind() teardown routine. The driver fails to NULL uvc->control_req after usb_ep_free_request() and uvc->control_buf after kfree(), leaving stale pointers that can be dereferenced in subsequent operations. No public exploit or active exploitation has been identified; EPSS sits at 0.20% (10th percentile), consistent with an unexploited kernel subsystem bug on niche hardware.
Out-of-bounds MMIO reads in the Linux kernel CXL RAS driver expose kernel memory contents and can crash the system on hosts equipped with CXL RCH hardware. The cxl_rch_get_aer_info() function bounds its readl() loop by the size of a software struct (struct aer_capability_regs) that has grown beyond the fixed physical on-wire AER register block due to expansions in struct pcie_tlp_log; reading past the MMIO mapping then populates header_log.header_len with garbage, triggering a second OOB read inside pcie_print_tlp_log(). No public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), consistent with the niche hardware prerequisite.
Out-of-bounds stack write in `sensor_hub_get_feature()` within the Linux kernel HID sensor-hub subsystem allows an attacker controlling a malicious HID device to corrupt kernel memory. A crafted HID descriptor that advertises an oversized feature field size exploits a mismatch between the function's return-value clamping logic and its unclamped per-value copy loop: when IIO subsystem callers (e.g., pressure or ambient-light sensor drivers) pass a small stack buffer such as a single s32, the copy loop writes beyond the buffer boundary by the full `field->report_size / 8` bytes per value. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), indicating low observed exploitation probability.
Out-of-bounds write in the STM32 CEC driver (media/cec/platform/stm32) allows an adjacent attacker on the same HDMI CEC bus to corrupt kernel memory by sending an overlong CEC frame. The stm32_rx_done() IRQ handler appends each received byte to a fixed 16-byte rx_msg.msg[] buffer using rx_msg.len as an unsanitized write index; a peer device that withholds the EOM signal drives RXBR interrupts indefinitely, writing attacker-controlled bytes past the end of the array into adjacent kernel structures. This vulnerability is reachable as soon as the STM32 CEC driver has probed and reception is enabled, with no local privilege or prior authentication on the CEC bus. No public exploit is identified at time of analysis; the fix is available in stable releases.
Heap out-of-bounds write in the Linux kernel vicodec virtual video codec driver's FWHT encoder allows a local low-privileged user to corrupt adjacent kernel heap memory, potentially enabling privilege escalation to root. The root cause is an undersized CAPTURE buffer: the encoder allocates output using a size multiplier of 3, but 4-component pixel formats whose planes all hit the FWHT_FRAME_UNENCODED verbatim-copy fallback require a multiplier of 4, producing a per-frame overflow of coded_w × coded_h bytes into adjacent slab memory. No public exploit has been identified at time of analysis; the EPSS score of 0.20% reflects the niche status of the vicodec driver in production deployments.
Slab-out-of-bounds memory corruption in the Linux kernel's nilfs2 log-structured filesystem allows a local low-privileged user to corrupt kernel slab memory by truncating a file whose block mapping collapses from B-tree to direct form. When this collapse occurs, an orphaned intermediate B-tree node block remains dirty in the kernel cache; the nilfs2 log writer subsequently misclassifies it as a direct-mapping data block and calls nilfs_direct_propagate() on it, causing a KASAN-detected out-of-bounds access that can lead to privilege escalation or kernel panic. No public exploit exists and EPSS is 0.20%, but the low-complexity local trigger limits the risk primarily to systems actively using nilfs2 mounts.
Out-of-bounds kernel read in Linux UBIFS's superblock signature verifier allows mounting a crafted NAND filesystem image to disclose kernel memory or crash the system. Linux kernels from v5.3 with UBIFS authentication support compiled in are affected - the flaw is exercised before any cryptographic check occurs, so no valid signing key is required. No public exploit has been identified at time of analysis and EPSS stands at 0.20%, but the C:H/A:H impact is real on embedded or desktop Linux deployments using UBIFS.
Append-only file protection bypass in the Linux kernel NFS server (nfsd) allows an authenticated NFS client to truncate a file that the kernel would normally protect from truncation. nfsd_setattr() decides whether a SETATTR size change requires the NFSD_MAY_TRUNC permission using an i_size value read without inode_lock, but the actual ATTR_SIZE truncation is applied later under the lock by notify_change(); a concurrent append that extends the file between the two points causes notify_change() to truncate an IS_APPEND file without the check that would reject it. There is no public exploit identified at time of analysis and the EPSS score is low (0.20%, 10th percentile).
Use-after-free in the Linux kernel NFSD server's NFSv4.2 inter-server copy (SSC) teardown path allows a memory-corruption/crash condition when nfsd4_ssc_expire_umount() resumes its list walk after dropping nfsd_ssc_lock for an mntput(). The saved 'next' (tmp) entry is not pinned by the nsui_busy flag, so a concurrent nfsd RPC thread hitting nfsd4_ssc_cancel_dul() can list_del+kfree that entry in the lock-drop window, leaving the walk to dereference freed memory. It affects NFS servers configured for server-to-server (inter-server) copy; no public exploit is identified at time of analysis and EPSS is low (0.20%).
Linux kernel NFS server (NFSD) contains a spurious WARN_ON_ONCE in nfsd_mode_check() that fires when an authorized NFS client performs a LOOKUP on a re-exported NFS filesystem whose dentry legitimately lacks i_op->lookup (mountpoints, V4 referrals). On systems configured with panic_on_warn=1 - common in production-hardened Linux deployments - this constitutes a remotely triggerable kernel panic and full availability loss. The nfserr_notdir guard that prevents the downstream NULL pointer dereference in lookup_one_unlocked() → __lookup_slow() → inode->i_op->lookup() is preserved in the fix; without it, the same codepath would dereference a NULL method pointer. No public exploit is identified at time of analysis and EPSS is 0.17%.
Use-after-free and NULL pointer dereference in the Linux kernel's lockd/nfsd subsystem allow a race between nfsd module teardown and in-flight lockd dispatch to dereference freed module memory, causing kernel panic or potential slab corruption. Any Linux NFS server running both nfsd and lockd (NFSv2/NFSv3 file locking) from kernel 2.6.12 through pre-7.2.4 is affected when nfsd is dynamically unloaded during active NFS lock operations. No public exploit has been identified and EPSS is 0.15%, consistent with the race-condition prerequisite.
Use-after-free in the Linux kernel NFSD server's NFSv4.1+ callback channel lets a slab object be read after it is freed when a client's session is torn down. After a DESTROY_SESSION, the teardown path can kfree() a session while an inflight callback rpc_task on rpciod still dereferences clp->cl_cb_session, because flushing the callback workqueue does not wait for tasks already handed to rpc_call_async() and the 1-second rpc_shutdown_client() drain can be outlived by tasks parked in rpc_delay() during NFS4ERR_DELAY retries. The fix RCU-protects cl_cb_session and switches session freeing to kfree_rcu(); no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a race-dependent server-side kernel bug rather than a mass-exploitation target.
Reference leak in Linux kernel NFSD's nfsd_cross_mnt() allows any authenticated NFS client to incrementally exhaust VFS mount and dentry reference counts, ultimately blocking umount operations and degrading dentry cache reclaim. The err < 0 arm of follow_down() uniquely omits the path_put() call present in every other exit path of the function, making the leak reachable via nfsd_lookup_dentry and NFSv4 READDIR encoding. No public exploit is identified at time of analysis; EPSS is 0.20% at the 10th percentile, and no KEV listing exists.
Silent data loss in Linux kernel NFSD's NFSv4.2 async COPY implementation causes the server to omit a write-verifier rotation when asynchronous copy writeback fails: the server correctly encodes NFS_UNSTABLE in the CB_OFFLOAD callback, but leaves nn->writeverf unchanged, so the client's subsequent COMMIT handshake returns the same verifier the client already holds and the client concludes copied data is durable - silently discarding data whose writeback actually failed. This violates the UNSTABLE+COMMIT durability contract specified in RFC 7862 §15.1 and RFC 8881 §18.32, matching a protocol-state class of bug already remediated in nfsd_vfs_write() and nfsd_commit(). No public exploit or active exploitation is identified; EPSS is 0.20%, consistent with the narrow preconditions required.
NFSD's seq-lock-like rq_status_counter protocol in nfsd_dispatch() is broken on three non-success exit paths - cache-hit (RC_REPLY), drop (RC_DROPIT/RQ_DROPME), and encode-error - leaving the counter permanently odd and exposing actively-mutating kernel fields to the lockless reader in nfsd_nl_rpc_status_get_dumpit(). A local low-privileged user on an NFS server who can poll NFSD RPC status via the netlink interface while requests traverse these paths can trigger out-of-bounds reads past the 8-element inline ops array embedded in the rqstp structure, disclosing kernel memory or causing a kernel panic. No public exploit exists (EPSS 0.19%), but the 6.12 LTS series appears unpatched, with fixes confined to 7.2.4 and 7.3-rc1.
Silent data loss in the Linux kernel NFSD NFSv4.2 async COPY offload path allows writeback errors to go undetected, causing clients to treat unwritten data as durably committed. The vulnerability stems from a TOCTOU race in `_nfsd_copy_file_range()`: the writeback-error cursor 'since' is sampled after the copy loop rather than before it, so a concurrent COMMIT or stable WRITE on the same destination inode can advance the error cursor before the COPY worker reads it, masking any writeback failure. CB_OFFLOAD then signals `wr_stable_how = FILE_SYNC4` to the NFS client, which confidently discards its copy of the data under the false belief it is durably stored on the server. No public exploit has been identified at time of analysis, and EPSS stands at 0.20%.
Use-after-free in the Linux kernel NFSD server (nfsv4 state machine) arises because nfsd4_drop_revoked_stid() processes FREE_STATEID for admin-revoked delegations without setting the SC_STATUS_FREED flag before dropping cl_lock. Because revoke_delegation() relies on that flag to tell whether FREE_STATEID has already handled the delegation, the freed delegation is re-added to the client's cl_revoked list via list_add(), and the dangling entry is later dereferenced when cl_revoked is walked during __destroy_client(). Affects NFSv4-serving kernels from ~6.11.6 up to the fix; no public exploit identified at time of analysis and EPSS is low (0.20%).
Out-of-bounds ring-buffer write and stale-memory disclosure in the Linux kernel NFSD server affects the nfsd_fh_verify and nfsd_fh_verify_err tracepoints, which reserve a server-address trace slot sized by the transport's remote-address length (xpt_remotelen) but populate it from the local address using xpt_locallen. On NFSv2/v3-over-UDP, xpt_remotelen stays zero for the transport's lifetime, so every file-handle verification copies 16 or 28 bytes past a zero-byte slot; in the reverse case an oversized slot leaks prior ring-buffer contents to trace consumers. Exploitation requires the tracepoint to be enabled by a local administrator, and there is no public exploit identified at time of analysis (EPSS 0.17%).
Memory exhaustion DoS in Linux kernel NFSv4 server (nfsd) allows any network-reachable client to force multi-MiB kernel heap allocations per COMPOUND operation. The flaw lies in nfsd4_decode_create(), which accepted an unbounded cr_datalen wire value for NF4LNK symlink targets without validation - allocating up to the full RPC payload size (several MiB) per request before the VFS eventually rejected the target with ENAMETOOLONG. By flooding the server with malformed NFSv4 CREATE operations, an attacker can exhaust kernel memory and cause a denial of service. No public exploit is identified at time of analysis, and EPSS is 0.17% (6th percentile).
Missing mount write-reference in the Linux kernel NFS server (nfsd) lets an authenticated NFSv2 client's SETATTR request run notify_change() without acquiring a mount write reference, bypassing the read-only-remount protection that fh_want_write() normally provides. The flaw affects the BOTH_TIME_SET branch of nfsd_proc_setattr(), which calls fh_verify() early so setattr_prepare() can inspect the dentry, causing nfsd_setattr() to skip the fh_want_write() call. This is a server-side correctness bug with no public exploit identified at time of analysis (EPSS 0.20%, 10th percentile) and is fixed in stable kernels; the assigned CVSS 9.1 with I:H/A:H is substantially overstated.
NULL pointer dereference in Linux kernel NFSD's NFSv4.2 compound dispatch loop allows remote clients to crash NFS servers built with CONFIG_NFSD_V4_2_INTER_SSC. By inserting an operation such as SETATTR between a foreign PUTFH and SAVEFH within a crafted COMPOUND request, an attacker causes fh_want_write() to dereference a NULL fh_export pointer - killing the nfsd kthread and denying NFS service to all clients. No public exploit has been identified and EPSS stands at 0.22%, reflecting low current exploitation interest.
Unbounded O(n²) CPU consumption in the Linux kernel NFS server (nfsd) POSIX ACL decoder allows any NFS client reachable on port 2049 to cause server-side denial of service by supplying an oversized ACL entry count in a SETACL compound. The root cause is an asymmetry introduced in commit 5fc51dfc2eb1: the encoder already caps count at NFS_ACL_MAX_ENTRIES, but the decoder added in that commit omits the symmetric bound check, passing the raw wire u32 directly into an O(n²) bubble sort. Patches are available in Linux 7.2.4 and 7.3-rc1; no public exploit or active exploitation has been identified.
Delegation recall permanently stalls in Linux kernel NFSD when the callback queue fails during a lease break. In nfsd_break_one_deleg(), the NFSD4_CALLBACK_RUNNING bit is set atomically to serialize recall work, but if nfsd4_run_cb() cannot queue the workitem, the refcount is decremented while the bit is left set - creating a permanent latch that causes every subsequent break_lease() on the same delegation to silently return early. The result is that the delegation is never recalled and any conflicting NFS open or lock operation stalls indefinitely, constituting a server-side denial of service. No public exploit has been identified and EPSS is 0.17%, consistent with a logic-error DoS requiring a specific failure condition to manifest.
Stale opcnt in nfsd4_release_compoundargs() enables an out-of-bounds slab read that leaks kernel memory to userspace via the netlink RPC status interface on Linux NFS servers. When nfsd_dispatch() hits an error path that leaves rq_status_counter at an odd value, the RPC status dumpit handler reads up to 16 entries from args->ops[] - but the inline iops[] array has only 8 elements and is the last field in the struct, so indices 8-15 access adjacent slab memory belonging to whatever object follows in the allocator. The fix zeroes opcnt unconditionally at compound-args release time. No public exploit or active exploitation has been identified; EPSS is 0.17%.
Use-after-free in the Linux kernel NFSD subsystem allows a local attacker with low privileges to read freed vmalloc memory or trigger kernel memory corruption via a race between the rpc_status netlink diagnostic interface and NFSv4 compound request teardown. The ops buffer (args->ops[]) is freed synchronously by vfree() in nfsd4_release_compoundargs() without waiting for an RCU grace period, while the rpc_status dumpit holds only an rcu_read_lock that protects the parent svc_rqst struct but not the separately vmalloc'd ops buffer. Vendor-released patches are available in stable series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV entry exists at time of analysis.
Memory corruption in the Linux kernel NFSD server (NFSv4.1+ session handling) occurs because nfsd4_sequence() can free the very session slot it is currently processing. When the session slot shrinker lowers se_target_maxslots below the channel's maxreqs, free_session_slots() kfrees every slot at index >= se_target_maxslots without verifying the caller's own slotid or the NFSD4_SLOT_INUSE flag, so an authenticated NFSv4.1+ client using a high-numbered slot can have its live slot freed, after which the code writes to the freed object and nfsd4_store_cache_entry() copies the compound reply into the dangling sl_data[] buffer, corrupting the slab. This is a use-after-free / heap out-of-bounds write with no public exploit identified at time of analysis and a low EPSS (0.20%, 10th percentile).
Denial of service (and potential local privilege escalation) in the Linux kernel's NFS server (nfsd) arises from a stateowner reference-count underflow on the NFSv4 seqid-operation replay retry path. When nfsd4_cstate_assign_replay() returns -EAGAIN because the replay owner is being torn down (RP_UNHASHED), nfs4_preprocess_seqid_op() erroneously called nfs4_put_stateowner() on a reference it never acquired, corrupting so_count and risking a use-after-free, while simultaneously leaking the sc_count reference held on the stid. There is no public exploit identified at time of analysis and EPSS is low (0.20%), but the leaked stid reference can also stall a concurrent nfsd4_close_open_stateid(), amplifying availability impact on an NFSv4 export.
Defensive hardening in the Linux kernel NFSD subsystem closes an edge case where nfsd_file_do_acquire() could use a file returned by dentry_create() that was never actually opened. The POSIX VFS interface permits ->atomic_open handlers to return success while delegating the open to a retry path via finish_no_open(); if that path is reached during an NFSv4 file creation, the resulting struct file lacks FMODE_OPENED and is in an invalid state for server I/O. Using such a handle can lead to a kernel crash or panic on the NFS server, causing a denial-of-service. No public exploit exists and exploitation is described as extremely unlikely by the kernel developers themselves; no public exploit has been identified at time of analysis.
Remote denial of service in the Linux kernel's NFSD pNFS server (NFSv4.1+) lets authenticated NFS clients crash the server by racing a LAYOUTGET against a delegation revoke. nfsd4_alloc_layout_stateid() reads fp->fi_deleg_file without holding fi_lock on the delegation-parent path, so a concurrent laundromat revoke can clear that pointer, making nfsd_file_get() return NULL and triggering a BUG_ON kernel panic. No public exploit is identified at time of analysis, EPSS is low (0.21%, 11th percentile), and the issue is fixed in tagged stable releases.
Persistent denial-of-service in the Linux kernel's NFSv4 server grace-period logic allows any reachable NFSv4 client to hold the server in grace indefinitely by sending CLAIM_PREVIOUS OPEN requests. The root cause is a clock-domain mismatch in clients_still_reclaiming(): the deadline is derived from nn->boot_time (CLOCK_REALTIME, ~1.7 billion seconds since epoch) but compared against ktime_get_boottime_seconds() (CLOCK_BOOTTIME, seconds since last boot - orders of magnitude smaller), making the comparison permanently false. As long as any client continues sending CLAIM_PREVIOUS, the grace period never ends, blocking all non-reclaim NFSv4 operations for every other connected client. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17%.
Race condition in the Linux kernel NFSD NFSv4.2 server-side copy state management allows any authenticated NFSv4.2 client to crash the NFS server kernel. The cpntf entry is inserted into the IDR (making it immediately addressable by stateid) before its cp_list is initialized in a separate lock section; a concurrent OFFLOAD_CANCEL - using the cnr_stateid echoed to the client - reaches _free_cpntf_state_locked() and calls list_del() on a zeroed list_head, triggering a kernel oops. No public exploit code is known and the issue is not in CISA KEV; patches are available in stable releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Use-after-free in the Linux kernel NFS server (nfsd) file-cache disposal path allows concurrent kernel subsystem callbacks - the global memory shrinker, nfsd laundromat garbage collector, and fsnotify - to dereference a freed nfsd_fcache_disposal struct during per-network-namespace teardown, producing kernel heap corruption or a system panic. The vulnerable window opens when a network namespace hosting nfsd is destroyed while disposal callbacks remain in-flight; containerized NFS server deployments (Docker, Kubernetes) are the most realistic trigger scenario. No public exploit identified at time of analysis, with EPSS at 0.17% consistent with a race-condition-gated kernel bug.
Denial of service in the Linux kernel NFS server (nfsd) pNFS layout subsystem allows an authenticated NFSv4.1+ client to leak layout stateids, gradually exhausting kernel memory. A race in the layout fence/recall path (lm_breaker_timedout) lets the block-lease breaker acquire a duplicate sc_count reference that is never released, pinning the layout stateid forever. Rated CVSS 9.8 but the real-world impact is availability-only and gated on a niche pNFS export configuration plus a race window; no public exploit identified at time of analysis and EPSS is very low (0.15%, 5th percentile).
Resource exhaustion in the Linux kernel NFSv4.2 inter-server copy (COPY offload) path allows an authenticated NFS client to leak nfsd_file objects on the server. Each inter-server COPY request that triggers a failed nfsd4_setup_inter_ssc() call bypasses the cleanup path where release_copy_files() drops the nf_dst reference, permanently pinning a file, inode, dentry, and vfsmount. Over time, repeated failed COPY requests exhaust kernel memory resources, producing a denial-of-service condition. No public exploit exists and EPSS is 0.21%, reflecting the niche NFSv4.2 inter-server copy configuration required.
Remote kernel crash in the Linux kernel NFSv4 server (nfsd) allows any unauthenticated network client to trigger a NULL pointer dereference and kernel oops by sending a crafted SETATTR compound request. The flaw resides in nfsd4_setattr() when delegation timestamp attributes (FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY) are included alongside the NFSv4 'one stateid' (all-0xFF bytes): the special-stateid handling path in nfs4_preprocess_stateid_op() exits without populating the nfs4_stid output pointer, leaving the local variable NULL, after which the unconditional dereference of st->sc_type at offset 4 from NULL panics the kernel. No public exploit has been identified at time of analysis, and EPSS sits at 0.24% (15th percentile), though the zero-prerequisite attack surface makes this straightforward to trigger against any exposed NFSv4 server running an affected kernel.
Silent data corruption in the Linux kernel NFS server daemon (nfsd) allows authorized NFS write clients to induce incorrect file-offset placement whenever a partial write completes between 50% and 99% of a segment boundary. Affecting kernel revisions from commit 06c5c97293e3fca99ce15da157068edf45a7c6e4 up to the fix commits included in 7.2.4 and 7.3-rc1, the logic error in nfsd_direct_write() causes subsequent write segments to land at wrong file offsets while the byte-count returned to the NFS client is over-reported, masking the corruption. No public exploit has been identified at time of analysis and EPSS stands at 0.19%, but the impact is undetected, silent filesystem data corruption on any NFS-exported volume.
Use-after-free in the Linux kernel's NFS server (nfsd4_create_file, the NFSv4 OPEN-with-create path) allows a stale dentry to be dereferenced after being freed. When the exported filesystem is itself NFS (an NFS re-export), dentry_create() can return a different dentry than the one passed in, so the original 'child' dentry already recorded in resfhp may be freed and later dereferenced via fh_compose(), leading to memory corruption and likely a server crash. No public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile), and the fix is available upstream in stable kernels.
Use-after-free / dangling-pointer corruption in the Linux kernel NFSD server allows an NFSv4.2 client performing an asynchronous server-side COPY to leave a stale IDR entry in the s2s_cp_stateids table, pointing at per-request COMPOUND buffer memory that is immediately recycled. When the NFSD laundromat or manage_cpntf_state() later walks that IDR, it dereferences reused request memory and can be steered into refcount_dec()/idr_remove()/kfree() on attacker-influenced garbage, corrupting kernel memory or crashing the server. No public exploit is identified at time of analysis, EPSS is low (0.17%, 6th percentile), and a vendor patch is available; the CVSS 9.8 rating substantially overstates the practical risk.
A use-after-free in the Linux kernel NFSD server's asynchronous server-side copy (NFSv4.2 COPY offload) lets teardown paths race the copy kthread, corrupting or freeing the copy object early. When an OFFLOAD_CANCEL request, an nfsd export/superblock shutdown, or a per-filesystem cancel runs concurrently with the reaping copy kthread, nfsd_file structures (nf_src/nf_dst) are double-put and freed, the STOPPED flag is set before final dereferences, and the copy_task/callback are used after free - causing NULL derefs, double frees, and UAF that can crash an NFSv4.2-serving host. Fixed in stable kernels 6.18.51, 7.2.4, and 7.3-rc1; no public exploit identified at time of analysis and EPSS is low (0.17%).
Out-of-bounds write and kernel memory disclosure in the Linux kernel NFS server (nfsd) affect deployments exporting pNFS flexfiles layouts. The XDR length calculation in nfsd4_ff_encode_layoutget() miscomputes the reservation for the encoded layout, so with certain string/file-handle sizes the server writes up to 5 bytes past the reserved XDR buffer, and with 4-byte-aligned lengths it over-reserves and transmits uninitialized (stale) kernel buffer contents to the client. It is fixed in stable releases 6.12.109, 6.18.50, and 7.2.4 (and 7.3-rc1); no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Unintended ACL deletion in the Linux kernel NFSD server affects the NFSACL v2 SETACL path, where nfsacld_proc_setacl() passes both the access and default ACL pointers to set_posix_acl() unconditionally even when the request mask omits one of them. Because set_posix_acl(..., NULL) is the VFS 'remove this ACL type' operation, an NFS client sending a SETACL that carries only NFS_ACL silently strips the directory's default ACL, and a mask of 0 strips both, corrupting on-disk access controls. This is the NFSACL v2 counterpart of the same defect already fixed in nfsd3_proc_setacl(); it is a fixed upstream integrity bug with no public exploit identified at time of analysis and a low EPSS score (0.21%).
Silent ACL removal in the Linux kernel NFSv3 server (nfsd) lets a SETACL request unintentionally strip POSIX access or default ACLs from files and directories on an exported filesystem. The NFSACL SETACL handler passes the decoded acl_access/acl_default pointers to set_posix_acl() unconditionally, but the decoder leaves those pointers NULL whenever the client omits the corresponding NFS_ACL/NFS_DFACL mask bit - and a NULL pointer is the VFS signal to delete that ACL type, so a request with mask=NFS_ACL drops the directory's default ACL and mask=0 drops both. Present since 2.6.13 and fixed in 6.12.109/6.18.50/7.2.4/7.3-rc1; no public exploit identified at time of analysis and EPSS is low (0.20%).
Use-after-free in the Linux kernel NFSD localio code path allows a local user to dereference recycled slab memory by exploiting a missing RCU read-lock window in `nfsd_open_local_fh()`. The `again:` retry block performs a `cmpxchg` on an `nfsd_file` pointer and then calls `nfsd_file_get()` (refcount_inc_not_zero) without holding `rcu_read_lock`, while the sole caller drops the lock before the helper runs - leaving a race window where CPU1 can put the last reference, trigger `call_rcu`, and have the slab page recycled before CPU0 increments the refcount. Vendor-released patches are available for the 6.15, 6.18, 7.2, and 7.3-rc1 stable trees; no public exploit exists and EPSS is 0.20%.
Use-after-free in the Linux kernel NFSD server (nfsd4_copy_notify) lets a racing OFFLOAD_CANCEL operation free a copy-notify stateid before the COPY_NOTIFY caller finishes initializing and reading it, corrupting kernel memory on NFSv4.2 servers with inter-server copy offload. Affected are kernels from 5.6 up to the fixed 6.12.109/6.18.50/7.2.4/7.3-rc1 releases. The flaw requires an authenticated NFS client and a tight race window, and there is no public exploit identified at time of analysis (EPSS 0.20%, 10th percentile).
Stale debugfs function pointers in Linux kernel NFSD create a use-after-free condition when module initialization fails partway through. Specifically, nfsd_debugfs_init() registers debugfs files containing fops pointers into module text before nfsd4_init_slabs() succeeds; if slab allocation then fails, the module's text is freed but the debugfs entries remain live with now-dangling pointers. Any subsequent access to those orphaned debugfs files - for example by a local user browsing /sys/kernel/debug - can trigger a kernel-mode UAF, potentially crashing the system or enabling privilege escalation. No public exploit code exists and EPSS is 0.21%; patch commits are available for 6.18.50, 7.2.4, and 7.3-rc1.
Resource leak race condition in the Linux kernel NFS server (NFSD) filecache allows orphaned nfsd_file objects to accumulate when network-namespace shutdown races with the GC worker, shrinker, or fsnotify/lease callbacks. When nfsd_file_cache_shutdown_net() runs concurrently with any of these three paths, already-unhashed files queued to the per-net dispose list are missed by the shutdown drain, leaving both the file handle and associated NFS state permanently leaked. The vulnerability affects Linux 6.9 through pre-patch kernels and is DoS-leaning with no public exploit identified at time of analysis and an EPSS of 0.20%.
Integer overflow during NFSv2 SETATTR/CREATE decoding in the Linux kernel NFSD corrupts file timestamps before proc-level validation can occur. On ILP32 (32-bit) kernels, `tmp2 * NSEC_PER_USEC` overflows a 32-bit unsigned long, wrapping an out-of-range useconds value into an in-range tv_nsec - bypassing the subsequent range check and letting a bogus nanosecond value reach the filesystem. A secondary defect on all platforms allows a client placing useconds==1000000 in the atime field (without also setting mtime to 1000000) to leave ATTR_ATIME_SET armed with tv_nsec=10^9, which also reaches the filesystem unchecked. No public exploit has been identified at time of analysis; EPSS is 0.21%.
POSIX ACL reference-count leaks in Linux kernel NFSD allow a remote attacker to exhaust kernel memory via malformed NFSv4 OPEN compound requests. When the NFS server decodes an OPEN compound carrying valid POSIX ACL createhow4 attributes but encounters a non-seqid-mutating error from claim4 decoding, the compound dispatcher short-circuits before nfsd4_open() executes, permanently leaking both op_pacl and op_dpacl references because OP_OPEN lacked an op_release handler; a secondary leak exists on the NFSv4.0 replay path where op_release was never called from nfsd4_encode_replay(). No public exploit code has been identified and EPSS is 0.20%, but repeated malformed requests against a network-reachable NFSv4 server could drive the kernel toward OOM-induced service failure.
Use-after-free in Linux kernel NFSD's copy-notify stateid management (NFSv4.2 server-to-server copy) allows an authenticated NFS client to trigger a KASAN-detectable UAF at nfs4_put_cpntf_state() by racing OFFLOAD_CANCEL or laundromat expiry against concurrent stateid readers. Three separate revoke paths were affected: the parent-stid drain (nfs4_free_cpntf_statelist()), OFFLOAD_CANCEL via manage_cpntf_state(), and laundromat tick expiry. No public exploit or CISA KEV listing exists; EPSS is 0.17% (6th percentile), and real-world impact is DoS-leaning with theoretical memory disclosure.
Denial of service (and potential privilege-context corruption) in the Linux kernel's NFSv4 server (NFSD) arises from a use-after-free/NULL-dereference when a client is torn down. A lock owner whose only reference is a blocked lock (nbl) is not counted by client_has_state(), so a DESTROY_CLIENTID operation can reach __destroy_client(), which walks the owner hash table calling remove_blocked_locks() on such owners without holding a reference; the per-net laundromat concurrently reaps the same blocked locks and frees the owner, causing a dereference of freed memory. Fixed upstream and in stable trees; no public exploit identified at time of analysis and EPSS is low (0.20%, 10th percentile).
A use-after-free in the Linux kernel's NFSv4 server (NFSD) admin-state revocation path lets a client structure be freed while still in use, introduced in 6.9 and fixed in 6.18.51, 7.2.4, and 7.3-rc1. When an administrator revokes NFSv4 state, nfsd4_revoke_states() temporarily drops the client_lock while revoke_one_stid() dereferences a stateid's bare (non-pinning) pointer to its nfs4_client; a concurrent client teardown via force_expire_client() can free that client first, causing NFSD to read freed memory. No public exploit is identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not on CISA KEV; the practical impact is server crash/DoS on the NFS server rather than remote code execution.
Use-after-free in the Linux kernel's NFS server (nfsd) allows a freed nfs4_client structure to be dereferenced during NFSv4 delegation revocation. When a recalled delegation times out, nfs4_laundromat() briefly unhashes it from cl_delegations before revoke_delegation() relinks it onto cl_revoked, and in that window client_has_state() can report no remaining state, letting free_client() run while revoke_delegation() is still about to touch cl_lock. Fixed versions are available; no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Use-after-free in the Linux kernel's NFS server (NFSD) NFSv4.0 revoked-state cleanup path lets a race between the periodic laundromat sweep and administrative client expiry free an NFS client structure while it is still being dereferenced. In nfs40_clean_admin_revoked(), a stateid reference is held but does not pin the owning client, so nfsd4_drop_revoked_stid() can dereference s->sc_client after another thread frees the client. It is a server-side memory-corruption bug affecting hosts running NFSD with NFSv4.0 state, fixed in stable releases; there is no public exploit identified at time of analysis and EPSS is low at 0.20%.
Kernel crash in the Linux libceph client allows a malicious or compromised authenticated Ceph OSD to trigger a BUG_ON assertion in ceph_msg_data_next() by sending a crafted sparse-read reply. The flaw in net/ceph/osd_client.c:osd_sparse_read() validates total data length against summed extents but omits per-extent monotonicity, overlap, and bounds checks, enabling a far-forward extent offset to advance the message-data cursor past the request buffer. Impact is limited to availability - a targeted kernel panic on any Linux client mounting a RADOS-backed filesystem or block device (RBD/CephFS). No public exploit code has been identified at time of analysis, and EPSS is low at 0.20%.
Out-of-bounds slab write in the Linux kernel's libceph/CRUSH map decoder (crush_decode) lets a malformed CRUSH map corrupt kernel memory on any RADOS client (Ceph RBD or CephFS). Because crush_decode() stores buckets by array slot while the mapper derives each bucket's workspace index from its decoded id, a map encoding an id different from '-1 - slot' makes one bucket alias another's kvmalloc'd workspace; a uniform bucket's second-replica permutation then overflows the smaller aliased buffer, producing a 4-byte OOB write in bucket_perm_choose() confirmed by KASAN. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; the CRUSH map is delivered from the Ceph monitor/OSD map, so exploitation requires a malicious or compromised monitor rather than an arbitrary internet attacker.
Use-after-free in the Linux kernel CephFS client (__kick_flushing_caps) lets a race between cap-flush transmission and FLUSH_ACK handling corrupt kernel memory on a mounted CephFS client. Because the iterator drops i_ceph_lock to send cap messages, a fast-responding MDS can cause handle_cap_flush_ack() to detach and free the current cap-flush entry before the loop advances, dereferencing freed memory. No public exploit is identified at time of analysis and EPSS is low (0.20%); impact is a client-side crash/memory corruption rather than remote code execution.
Use-after-free in the Linux kernel CephFS client (check_new_map()) lets a freed ceph_mds_session be dereferenced during MDS map processing, enabling memory corruption and likely denial of service on machines with a mounted CephFS. When check_new_map() releases mdsc->mutex to handle a session's address change, reconnect, or active transition, it fails to take a reference on the session (unlike the forced-close path), so a concurrent thread can unregister and kfree that session before the original thread touches s->s_mutex. This is no public exploit identified at time of analysis; EPSS is low at 0.16%.
Out-of-bounds write in the Linux kernel CephFS client (ceph module) lets a malicious or compromised Ceph monitor corrupt kernel memory on any client with a mounted CephFS. The MDSMap decoder failed to bound export_targets rank values against CEPH_MAX_MDS, and check_new_map() then used each attacker-controlled rank as a bit index into a fixed-size stack bitmap, causing set_bit() to write past the array. No public exploit is identified at time of analysis and EPSS is low (0.17%), but the fix ships across multiple stable trees.
Slab out-of-bounds write in the Linux kernel's CephFS client (ceph_get_name() and __get_snap_name()) lets a malicious or compromised Ceph MDS overflow a NAME_MAX-sized name buffer during NFS-export name resolution. The code copies the MDS-supplied dentry name (rinfo->dname / rde->name) via memcpy and writes a NUL terminator at dname_len without ever checking dname_len against NAME_MAX, so a LOOKUPNAME reply with an oversized name corrupts adjacent slab memory (flagged by KASAN). It is only reachable when a CephFS mount is re-exported over NFS; fixed by the new ceph_export_copy_name() helper that rejects over-length names with -ENAMETOOLONG. No public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Remote denial of service in the Linux kernel's CephFS client (ceph module) allows a malicious or compromised Ceph MDS (Metadata Server) to crash a mounting client during session setup. In handle_session(), the MDSCapAuth match.path and match.fs_name fields of a CEPH_SESSION_OPEN message (msg_version >= 6) are copied with a bare ceph_decode_copy() after decoding an attacker-controlled 32-bit length, with no preceding bounds check, letting the copy read up to 4 GiB past the message front allocation and trigger a slab-out-of-bounds read. No public exploit is identified at time of analysis and EPSS is low (0.20%); exploitation requires a hostile server on the first post-connect message with no client-side user interaction.
Out-of-bounds read in the Linux kernel CephFS client (fs/ceph/mdsmap.c) lets a malicious or compromised Ceph monitor crash a client that has a CephFS mount. ceph_mdsmap_decode() advances its decode cursor by num_export_targets*4 bytes for each per-MDS info record without verifying enough bytes remain, and the only runaway-cursor guard is skipped for info versions 2 and 3, so an oversized count walks the cursor past the message front buffer and a later ceph_decode_32() reads slab memory out of bounds. No public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile).
Kernel heap information disclosure in the Linux CephFS client (fs/ceph) lets a malicious or compromised Ceph metadata server (MDS) leak adjacent kernel heap bytes to a local user. __build_xattrs() fails to bounds-check the value length of the final xattr in an MDS-supplied blob, so an oversized length is stored verbatim and later copied out of bounds by getxattr(2). No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile) and the flaw is not in CISA KEV.
Uncontrolled resource consumption in the Linux kernel Ceph client's ceph_parse_deleg_inos() function allows a malicious or compromised Ceph MDS (Metadata Server) to trigger denial of service against any connected client. The 64-bit interval length field in MDS create-with-delegation replies is decoded without value validation, enabling a crafted reply to spin the client's insert loop indefinitely or grow the per-session delegated-inode xarray without bound, exhausting CPU or kernel memory. No public exploit code exists and no CISA KEV listing is present, consistent with the EPSS score of 0.21%.
CPU exhaustion DoS in the Linux kernel's Ceph filesystem client affects systems with mounted Ceph volumes: `ceph_cap_reclaim_work()` enters a busy loop by unconditionally re-queuing itself whenever `ceph_trim_dentries()` returns `-EAGAIN`, which occurs even when no leases are eligible for reclaim. The underlying cause is `__dir_lease_check()` returning `TOUCH` for every valid lease when `expire_dir_lease=false`, churning the dentry list, resetting timestamps (preventing natural aging), and always exhausting the `nr_to_scan` budget - guaranteeing the `-EAGAIN` re-queue cycle. Vendor-confirmed data shows this produced 500 `ceph_trim_dentries()` calls per second and 128,000+ lock contentions on `dentry_list_lock` in a 5-minute window. No public exploit code exists and the CISA KEV does not list this vulnerability.
Ceph filesystem driver in the Linux kernel leaks an inode wrbuffer reference when writeback is aborted during umount, triggering a kernel BUG and system crash. The defect manifests specifically when ceph_submit_write() fails the osd_stopping_blocker check at unmount time: the wrbuffer claim taken by ceph_dirty_folio() is never released because writepages_finish() - the only release path - never runs for aborted, never-submitted writes. Because i_wrbuffer_ref never returns to zero, the corresponding ihold() is never dropped, the inode cannot be evicted, and the kernel panics with 'VFS: Busy inodes after unmount of ceph' at fs/super.c:650. No public exploit code exists and no active exploitation has been reported; EPSS probability is 0.21%.
Use-after-free in the Linux kernel audit subsystem lets a local privileged operator free an audit tree while another rule still references it, later dereferencing a freed pathname. The flaw is in audit_del_rule(), which unconditionally calls audit_put_tree() as if handling a netlink deletion template; when invoked via fsnotify autoremove for mixed AUDIT_DIR plus AUDIT_EXE rules it instead drops the installed rule's live tree reference. No public exploit is identified at time of analysis, and the EPSS score is low (0.20%, 10th percentile), consistent with a local, race-dependent memory-safety bug rather than a remotely weaponizable one.
Use-after-free in the Linux kernel CIFS client's cifs_file_set_size() allows a local low-privileged user to corrupt kernel heap memory when a handle-based set-size RPC fails during SMB session teardown or reconnection. The freed tcon pointer is reused in a path-based fallback because it is not NULLed after cifsFileInfo_put(), exposing slab memory that may have been reclaimed by the kernel allocator. Patches are confirmed in versions 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation has been identified at time of analysis.
Integer underflow in the Linux kernel CIFS client's cifs_remap_file_range() corrupts SMB protocol fields and inverts write-range operations when a clone-to-EOF request is made with a source offset exceeding the file's current size. A local user with low privileges and access to a CIFS-mounted filesystem can trigger this by supplying len=0 and an offset beyond i_size in a FICLONERANGE ioctl, sending a malformed FSCTL_DUPLICATE_EXTENTS_TO_FILE request to the SMB server and disrupting filemap_write_and_wait_range() with an inverted range. No public exploit has been identified at time of analysis; vendor-released patches are available in stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Stale fscache data exposure in the Linux kernel CIFS client allows a local low-privileged user with access to a mounted SMB share to read file data that should have been discarded after an O_TRUNC open. When cifs_do_truncate() is called from cifs_open() without holding i_rwsem, the fscache cookie invalidation step is skipped - meaning previously cached file contents remain readable via fscache_use_cookie() even after the file has been truncated to zero. This produces both confidentiality and integrity violations: a process can obtain pre-truncation data and the kernel cache becomes inconsistent with actual file state. No public exploit is identified at time of analysis; EPSS is 0.17%.