Linux
Monthly
Unbounded sprintf() calls in the Linux kernel's CPU hotplug sysfs interface (states_show()) can overflow the PAGE_SIZE kernel buffer when a sufficient number of hotplug states are registered, enabling a local low-privileged user to corrupt adjacent kernel memory with potential high impact on confidentiality, integrity, and availability. Affected kernel versions span from the 4.6 era through multiple current stable branches (5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x), each with vendor-released patch versions confirmed by ENISA EUVD-2026-59024. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), indicating limited real-world exploitation probability despite the 7.8 CVSS score.
Out-of-bounds memory access in the Linux kernel MANA (Microsoft Azure Network Adapter) Ethernet driver arises because the RX completion queue entry (CQE) packet length reported by the NIC was passed to skb processing without validation. Affected systems are Linux VMs running the mana_en driver, predominantly Azure guests using MANA/SR-IOV networking. A NIC (or malicious hypervisor/device) supplying a crafted oversized length can trigger an out-of-bounds read leading to information disclosure or a kernel crash; the vulnerability is tagged Information Disclosure, has no public exploit identified at time of analysis, and carries a low EPSS of 0.21%.
Missing DMA sync-for-CPU in the Linux kernel's MANA (Microsoft Azure Network Adapter) RX path can hand stale or uninitialized buffer memory to the networking stack on systems that require explicit DMA syncing, such as those booted with swiotlb=force. The flaw affects the mana Ethernet driver when RX buffers come from page-pool fragments (frag_count > 1), where the DMA unmap that normally performs the implicit CPU sync is skipped. There is no public exploit identified at time of analysis, EPSS is low (0.20%), and it is not listed in CISA KEV.
Cross-namespace privilege escalation in the Linux kernel SIT (IPv6-in-IPv4) tunnel driver allows a local attacker with CAP_NET_ADMIN in one network namespace to rewrite SIT tunnel configuration belonging to a distinct, more privileged network namespace, bypassing the intended authorization boundary. This is particularly impactful in containerized environments where network namespace isolation is a primary security boundary, as tenant containers are commonly granted CAP_NET_ADMIN within their own namespace. Patches are confirmed available across all active stable kernel branches (5.10 through 7.x); no public exploit or CISA KEV entry exists at time of analysis, and EPSS is 0.22%, reflecting very low observed exploitation activity.
Metadata corruption in the Linux kernel traffic control connection-tracking action (act_ct) allows remote attackers to crash systems or corrupt qdisc packet-segment state by sending fragmented IP or IPv6 traffic. The flaw exists because tcf_ct_handle_fragments() invokes nf_ct_handle_fragments() without preserving skb->cb, so the netfilter defragmentation helper silently overwrites tc_skb_cb/qdisc_skb_cb in-place - the same memory region. On hosts with panic_on_warn enabled, this triggers a WARN_ON_ONCE in qdisc_pkt_segs() that escalates to a kernel panic. EPSS is low (0.21%, 11th percentile) and the vulnerability is not in CISA KEV, indicating opportunistic exploitation is unlikely but targeted denial-of-service against network appliances or container hosts using tc act_ct is realistic.
Privilege boundary bypass in the Linux kernel's ip6_vti (IPv6 Virtual Tunnel Interface) subsystem allows a local user with CAP_NET_ADMIN in one network namespace to reconfigure VTI6 tunnels residing in a separate, unprivileged network namespace. The rtnl changelink path validates CAP_NET_ADMIN only against dev_net(dev), leaving t->net unchecked when the device spans namespaces - enabling unauthorized rewrites of cross-namespace tunnel configurations with full confidentiality, integrity, and availability impact on the affected namespace. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (12th percentile) reflects low current exploitation probability, though the capability misuse pattern is well-understood in container-escape research.
Privilege escalation in the Linux kernel's IP VTI (Virtual Tunnel Interface) subsystem allows a local attacker holding CAP_NET_ADMIN in one network namespace to reconfigure VTI tunnel endpoints anchored in a separate, more privileged network namespace they do not control. Affected kernel versions span from approximately 3.15 through all stable branches prior to 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code has been identified and no CISA KEV listing exists, but the scope-changed CVSS rating (8.8) reflects real cross-namespace boundary violation risk relevant to container and VNF deployments.
Cross-namespace capability bypass in the Linux kernel's IPIP (IP-in-IP) tunnel driver allows a local process holding CAP_NET_ADMIN within one network namespace to modify IPIP tunnel parameters governed by a separate, more privileged network namespace. By exploiting the missing rtnl_dev_link_net_capable() check in ipip_changelink(), an attacker can redirect or disrupt encapsulated tunnel traffic across namespace boundaries - a meaningful concern in containerized environments where namespace separation is a security boundary. No public exploit code or CISA KEV listing has been identified; EPSS stands at 0.21% (11th percentile), indicating low current exploitation probability despite the high CVSS score of 8.8.
IPv6 GRE tunnel management in the Linux kernel allows a local attacker holding CAP_NET_ADMIN in one network namespace to modify tunnel configurations residing in a separate, unauthorized namespace - effectively escalating privilege across namespace security boundaries. Affected kernels span multiple long-term support trees from at least 4.19.100 onward, with patches released across stable series including 6.12.97, 6.6.145, 6.1.178, 6.18.40, 5.10.261, 5.15.212, and 7.1.5. No public exploit code has been identified at time of analysis; EPSS exploitation probability stands at 0.21% (12th percentile), indicating limited current attacker interest despite the high CVSS score.
Insufficient capability gating in the Linux kernel's IPv6 tunnel subsystem allows a local attacker with CAP_NET_ADMIN in one network namespace to reconfigure tunnel devices residing in a separate, more privileged namespace. Affected versions span from Linux 3.12 through all stable branches prior to 6.6.148, 6.12.101, 6.18.40, and 7.1.5, with the CVSS Scope:Changed metric confirming cross-namespace impact. This vulnerability is not listed in CISA KEV and carries an EPSS score of 0.20% (10th percentile), indicating limited observed exploitation at time of analysis; however, it is a meaningful privilege escalation primitive in containerized deployments where CAP_NET_ADMIN is routinely granted.
Raw AES-128 LLSEC key exposure in the Linux kernel's legacy ieee802154 netlink family allows any local user to extract 16-byte cryptographic key material directly from the kernel keytable on systems running IEEE 802.15.4 (wpan) interfaces with link-layer security configured. Because IEEE 802.15.4 LLSEC uses CCM* mode where the same key both encrypts frames and provides message authentication, key disclosure simultaneously breaks confidentiality and authenticity of the entire 802.15.4 wireless network. No confirmed active exploitation and no public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), consistent with the niche hardware requirement.
Header buffer corruption in the Linux kernel gve (Google Virtual Ethernet) driver's DQO RX datapath lets header bytes from one packet be copied onto another, and lets header buffers be re-posted while the device still owns them, when both header-split and HW-GRO are enabled with many concurrent flows. The gve driver is used by Google Cloud Platform Linux VMs, so exposure is limited to GCP guests running affected kernels with that specific offload configuration. There is no public exploit identified at time of analysis, EPSS is very low (0.20%), and the observed effect is roughly a 30% throughput drop with heavy TCP retransmissions rather than code execution.
Cross-VF/PF LMTLINE physical address disclosure in the Linux kernel's octeontx2-af CN10K driver allows a low-privileged VF caller to read another PF's LMTLINE physical base address and map it into its own LMT table entry. Affected are Linux kernel trees from commit 893ae97214c3 across stable branches 6.6.x before 6.6.148, 6.12.x before 6.12.101, 6.18.x before 6.18.42, and mainline before 7.1.5/7.2-rc1. No public exploit code or CISA KEV listing exists at time of analysis; the EPSS score of 0.20% (10th percentile) indicates low exploitation probability, consistent with the hardware-specific attack surface.
Data corruption in the Linux kernel's LoongArch memory management subsystem allows a local low-privileged user to cause silent loss of written data or potential exposure of stale page contents via a race condition between hardware page table walker behavior and software dirty-bit tracking. Affected systems are those running LoongArch CPUs with hardware PTW enabled - a condition that applies to the architecture by design - across kernel versions from 5.19 through stable branches prior to 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code exists and EPSS stands at 0.21% (11th percentile), though the bug was reliably reproduced via the LTP madvise09 test, confirming it is not theoretical.
Reference count underflow in the Linux kernel IPMI subsystem's handle_read_event_rsp() function enables local privilege escalation on server hardware with active IPMI interfaces. The flaw resides in the error-rollback path: when event delivery fails after successfully allocating receive messages for some users, the rollback incorrectly drops the user reference count twice - once through ipmi_free_recv_msg() and again through a now-stale explicit put - freeing an ipmi_user object that remains linked on intf->users. Subsequent event delivery then dereferences the freed object or trips refcount_t's addition-on-zero guard, enabling kernel memory corruption leading to full system compromise. No public exploit or CISA KEV listing exists; EPSS is 0.20% at the 10th percentile, consistent with no active exploitation at time of analysis.
Memory-accounting corruption in the Linux kernel's espintcp (ESP-in-TCP / IPsec RFC 8229) send path was resolved by switching to sk_msg_free_partial(), which keeps the socket message (skmsg) consistent on partial sends. On affected kernels the previous code mishandled uncharges and offsets when the full payload was not transmitted, corrupting skmsg accounting on a system where TCP encapsulation of IPsec is in use. This is a stable-tree fix carrying an NVD CVSS of 9.8 and the 'Information Disclosure' tag, but EPSS is only 0.20% (10th percentile) and no public exploit is identified at time of analysis.
Kernel panic via NULL pointer dereference in the Linux kernel's multiq traffic scheduler (net/sched/sch_multiq) affects all kernels from 2.6.29 through unpatched stable trees. When multiq pairs with a non-work-conserving child qdisc (such as qfq) routed through a peeking intermediary (such as tbf), multiq_dequeue() invokes the child's raw ->dequeue() method directly instead of qdisc_dequeue_peeked(), orphaning the stash, corrupting qlen/backlog accounting, and triggering a NULL dereference in softirq context during ordinary egress. Exploitation requires local access with CAP_NET_ADMIN and a deliberately constructed qdisc hierarchy; no public exploit code exists and EPSS probability is 0.21% (12th percentile), consistent with the niche configuration requirement.
Kernel panic via NULL pointer dereference in Linux's taprio traffic scheduler (net/sched/sch_taprio) delivers system-level denial of service when a non-work-conserving child qdisc such as qfq is attached to a taprio parent. The defect in taprio_dequeue_from_txq() calls the child's ->dequeue() function pointer directly rather than via qdisc_dequeue_peeked(), bypassing the child's gso_skb stash, orphaning the peeked skb, desyncing qlen/backlog counters, and re-entering the child on an emptied list - triggering a NULL dereference from softirq context during ordinary egress traffic. No public exploit has been identified at time of analysis, and EPSS stands at 0.20% (10th percentile), indicating very low opportunistic exploitation probability; the vulnerability is not listed in CISA KEV.
Null pointer dereference in the Linux kernel's fhandle subsystem allows a local low-privileged user to trigger a kernel panic via a race condition in capable_wrt_mount(). The vulnerable path is reached when open_by_handle_at() processes a file handle whose detached mount - created via open_tree(OPEN_TREE_CLONE) - is concurrently dissolved by fput(), causing umount_tree() to clear mount->mnt_ns to NULL before capable_wrt_mount() can safely dereference mnt_ns->user_ns. No public exploit identified at time of analysis (EPSS 0.20%, no CISA KEV listing), and patched kernel versions 6.12.97, 6.18.40, 7.1.5, and 7.2-rc2 are available from upstream stable trees.
Kernel memory disclosure and denial-of-service in the Linux kernel OrangeFS client affects systems mounting OrangeFS parallel filesystems, where fill_from_part() truncates a 64-bit directory-entry length into a __u32. An entry length near U32_MAX wraps to a small value that slips past the bounds check and is then used to index the directory part, causing an out-of-bounds read that oopses the kernel. The malformed trailer is supplied by the userspace OrangeFS client, and there is no public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and this is not in CISA KEV. Note: the input CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) conflicts with the description, which describes a local, client-supplied-data OOB read rather than remote unauthenticated code execution.
Out-of-bounds memory read and infinite-loop denial of service in the Linux kernel's iosm WWAN driver (net/wwan/iosm) allow a rogue or compromised modem to corrupt kernel memory and exhaust system resources by supplying crafted MUX downlink packets with malicious offsets and circular table references. Affected systems are those running Linux 5.18 and later with Intel WWAN hardware using the iosm driver, where the mux_dl_adb_decode() function failed to validate any of the device-supplied offsets and lengths (first_table_index, next_table_index, table_length, datagram_index, datagram_length) against the received socket buffer boundary. No public exploit exists and EPSS probability is very low at 0.21% (12th percentile); however, the CVSS 8.8 rating with Full C/I/A impact and reproduction confirmed under KASAN make this a credible risk for cellular-enabled Linux deployments awaiting patch application.
Memory corruption in the Linux kernel's compaction subsystem allows a local low-privileged attacker to trigger data corruption or potential privilege escalation by exploiting improper error handling in compaction_free(). The function ignores failure returns from free_pages_prepare(), causing hardware-poisoned pages (PageHWPoison) or bad pages (free_page_is_bad()) to be re-added to the compaction freepages list and subsequently reallocated to kernel or user structures. Exploitation requires low-privilege local access and is not confirmed actively exploited (absent from CISA KEV), with EPSS at a low 0.21% (11th percentile); vendor-released patches are available across multiple stable branches.
Race condition in the Linux kernel mac802154 subsystem allows a local low-privileged attacker to trigger kernel memory corruption by racing hardware teardown against an in-flight asynchronous transmit completion. Affected systems are those running IEEE 802.15.4 wireless networking hardware with the mac802154 module loaded; versions from Linux 3.19 through the respective stable-branch fix commits are vulnerable. No public exploit identified at time of analysis, and EPSS of 0.21% (12th percentile) reflects negligible observed exploitation activity; vendor patches have been released across all active stable kernel branches.
IPVS (IP Virtual Server) SCTP state tracking in the Linux kernel misreads chunk headers for IPv6 packets carrying extension headers, causing incorrect connection state transitions that affect load balancer behavior and resource accounting. The IPVS subsystem, widely deployed in Kubernetes and LVS environments via kube-proxy, can misclassify an SCTP INIT packet as an already-ESTABLISHED connection when the IPv6 packet includes extension headers (e.g., an 8-byte Destination Options header), because set_sctp_state() hardcodes sizeof(struct ipv6hdr) as the transport offset rather than using the offset already resolved by ipv6_find_hdr(). No public exploit identified at time of analysis, and EPSS at 0.21% (12th percentile) confirms very low current exploitation interest despite the CVSS 8.2 score.
Information disclosure and TCP flow corruption in the Linux kernel's IPVS (IP Virtual Server) load balancer arises because ip_vs_conn_new() only zeroes the delta fields of its two ip_vs_seq structures, leaving init_seq and previous_delta filled with stale slab data. A director acting as a connection-sync backup can hash a connection with IP_VS_CONN_F_IN_SEQ/OUT_SEQ flags set (inherited from IP_VS_CONN_F_BACKUP_MASK) while an attacker-supplied sync message omits IPVS_OPT_SEQ_DATA, so an IPVS application helper later rewrites forwarded TCP sequence/ack numbers using uninitialized kernel memory. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and the issue is not in CISA KEV.
Heap out-of-bounds read in the Linux kernel MACsec subsystem (`macsec_encrypt()`) allows a local attacker with CAP_NET_RAW capability to leak 12 bytes of kernel heap memory and emit that raw heap content onto the wire as a malformed Ethernet frame, with additional potential for kernel destabilization. The flaw is triggered exclusively via the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path, where the socket buffer arrives at `macsec_start_xmit()` with `skb->mac_header` unset, resolving `eth_hdr(skb)` to `skb->head + 65535` - far outside valid headroom. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (12th percentile) reflects low exploitation probability; patches have been backported across all active stable kernel series.
Out-of-bounds write in the Linux kernel's dibs loopback subsystem enables a local low-privileged attacker to corrupt kernel memory by supplying a crafted offset or oversized write through the move_data() interface, which calls memcpy() without verifying that offset + size stays within the registered DMB's allocated length. The software loopback omits the memory-region bounds enforcement that real ISM hardware provides natively, leaving peer-supplied parameters unchecked. Patch commits are confirmed across four stable kernel branches (6.12.97, 6.18.40, 7.1.5, 7.2-rc3); the vulnerability is not in CISA KEV and no public exploit code has been identified at time of analysis.
Kernel memory corruption in the Linux kernel's DRBD (Distributed Replicated Block Device) driver lets a malicious or man-in-the-middle replication peer write attacker-chosen bytes past a bio page in a receiving node. The flaw lives in recv_dless_read(), where a peer-supplied payload length is handled as a signed int (data_size) that can be driven negative, and it affects any node that reads from its peer - a diskless node or one using read-balancing - in the default configuration. Rated CVSS 9.8 by NVD; there is no public exploit identified at time of analysis and EPSS probability is low (0.20%).
Use-after-free race condition in the Linux kernel's osnoise tracing subsystem allows a local low-privileged attacker to potentially escalate privileges or destabilize the kernel. The flaw, present in kernels since commit a6ed2aee (Linux 5.17), stems from missing synchronize_rcu() synchronization during osnoise instance unregistration, leaving a window where RCU readers can dereference freed tracer memory. Patched stable releases (6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2-rc3) are available; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Shared MIPI PHY resource mismanagement in the Linux kernel's NXP i.MX93 block-control power domain driver (imx93-blk-ctrl) allows a local attacker with low privileges to trigger kernel-level incorrect behavior - including potential memory corruption, information disclosure, and system instability - by exploiting the fact that the DSI and CSI subdomains share clock and reset control bits without coordination. Patches are available across stable branches (6.18.42, 7.1.5, 7.2-rc4), and exploitation probability is low per EPSS (0.20%, 10th percentile). No public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Linux kernel's rt2x00 WiFi driver stems from improper error handling during device probe, where early allocation failures invoke a full teardown path that assumes work items (intf_work, autowakeup_work, sleep_work) are already initialized. On systems with Ralink/MediaTek rt2x00-compatible WiFi hardware, a local low-privileged attacker who can trigger workqueue allocation failure during driver probe can corrupt uninitialized kernel work_struct objects, as confirmed by DEBUG_OBJECTS reporting invalid work drains. EPSS is low (0.21%, 12th percentile) and this is not listed in CISA KEV, though a QEMU-based proof-of-concept demonstrating the failure path was confirmed by the reporters.
Heap overflow in the Linux kernel brcmfmac/cyw WiFi driver allows a network-adjacent attacker controlling a rogue or compromised access point to corrupt kernel heap memory during WPA3 SAE authentication. The flaw in `brcmf_notify_auth_frame_rx()` causes an unsigned integer underflow when a short auth frame (under 24 bytes) is received, producing a wrap-around copy length that drives `memcpy` far beyond the allocated buffer. With CVSS 8.8 and full C/H/I/H/A/H impact on the vulnerable system, exploitation yields arbitrary kernel memory write capability; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (12th percentile), indicating low observed exploitation pressure despite the critical technical severity.
Integer underflow and overflow flaws in the Linux kernel's Realtek Bluetooth driver (btrtl) corrupt kernel memory during firmware loading, enabling a local attacker with low privileges to achieve full kernel-level compromise. The vulnerability exists in rtlbt_parse_firmware(), where a malformed firmware patch with a length field smaller than 4 causes a subtraction underflow that transforms a subsequent memcpy into an oversized kernel memory write; a separate addition overflow on 32-bit architectures compounds the exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), consistent with the local-only attack vector.
Incorrect IPv6 transport-header offset handling in the Linux kernel's IPVS (IP Virtual Server) load-balancing subsystem causes application-layer helper code and ICMPv6 checksum validation to misread packet headers when IPv6 traffic - particularly packets carrying extension headers - is processed. The IPVS TCP application path wrongly assumed an IPv4 network header even after the ipvsh offset argument was supplied, and ip_vs_out_icmp_v6() used an incorrect ICMPv6 offset. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and this is not on CISA KEV, and for the only in-tree app (FTP) the maintainers note the effect is harmless because port mangling is handled by Netfilter without TCP sequence adjustment.
Memory-safety defect in the Linux kernel IPVS (IP Virtual Server) subsystem where __ip_vs_get_out_rt() calls skb_ensure_writable(), which can reallocate skb->head, leaving a stale IP-header pointer that is then dereferenced. Affected hosts are Linux systems acting as IPVS load balancers/directors; the flaw can lead to reads of freed/relocated packet memory (information disclosure) or kernel instability. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile); the upstream fix reloads the IP header after reallocation.
Out-of-bounds memory access in the Linux kernel's spufs (SPU filesystem) subsystem on PowerPC Cell Broadband Engine architectures allows a local low-privileged user to read or write beyond the SPU local store buffer via a flawed bounds check in `spufs_mem_mmap_access()`. The function computes the mmap offset correctly but validates it against `vma->vm_end` rather than `LS_SIZE`, causing the guard to never fire on 64-bit systems and leaving the length parameter unconstrained relative to the actual local store buffer. Vendor-released patches are confirmed across multiple stable kernel branches; no public exploit has been identified and EPSS is 0.21% at the 12th percentile.
PowerPC E500 systems running Linux kernel 7.0 through 7.1.4 and 7.2-rc4 silently lose kernel address-masking protection due to a compile-time preprocessor symbol typo - `CONFIG_E500` instead of `CONFIG_PPC_E500` - causing `mask_user_address_isel()` to be omitted from E500 builds entirely. A local low-privileged user on affected E500 hardware can exploit the absent address-masking primitive to achieve high-impact memory disclosure, integrity corruption, or denial of service against the kernel. No public exploit exists, EPSS is 0.19% (9th percentile), and this vulnerability is not in CISA KEV, indicating very limited current exploitation activity despite a CVSS score of 7.8.
Out-of-bounds read in the Linux kernel cfg80211 WiFi subsystem allows an adjacent-network unauthenticated attacker to disclose kernel memory or crash the system by sending a crafted EHT Multi-Link Element inside an MBSSID beacon frame. Affected kernels fail to call ieee80211_mle_type_ok() before passing the element to ieee80211_mle_get_mld_id(), violating the helper's documented contract and allowing reads past the IE boundary. No public exploit exists and EPSS is 0.20% (10th percentile), but the attack requires only radio proximity to a device with Wi-Fi scanning active - no authentication and no user interaction needed.
Insufficient Multi-Link Element (MLE) common info length validation in the Linux kernel's IEEE 802.11 WiFi stack exposes adjacent-network attackers to high-impact memory corruption. Kernels from commit 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 onward failed to validate the advertised common-info length field for Reconfiguration and Priority Access MLE types - and also omitted the length octet when computing the minimum common size for Reconfiguration MLEs - meaning a malformed MLE frame crafted by a nearby attacker can trigger out-of-bounds access. The CVSS score of 8.8 (AV:A) and EPSS of 0.20% (10th percentile) together indicate high potential impact but no public exploit activity at time of analysis; no public exploit and no CISA KEV listing have been identified.
Remote kernel memory corruption in the Linux mac80211 WiFi subsystem allows an unauthenticated attacker within WiFi range to trigger out-of-bounds memory accesses by sending crafted 802.11 extension frames that bypass subtype validation and reach generic RX path code expecting regular 802.11 header layouts. Affected systems include any Linux host with an active mac80211-based WiFi driver across a broad range of kernel versions spanning 5.10 through pre-patch 7.x releases. The CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact at the kernel level; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Wrong MTD geometry is applied in the Linux kernel's mchp23k256 SPI SRAM driver when the chip is matched via the SPI id-table rather than via Device Tree, potentially exposing or corrupting unintended SRAM address regions. The driver's probe function calls of_device_get_match_data() exclusively, causing any non-OF SPI modalias match to silently fall back to the default mchp23k256_caps structure regardless of which part was actually selected by the SPI id-table, leading to incorrect chip capacity and address geometry. No public exploit exists and EPSS places this at the 7th percentile (0.17%), but the C:H/I:H/A:H CVSS impact flags reflect that incorrect geometry can expose the entire SRAM contents or allow out-of-bounds writes on affected embedded systems.
Kernel memory corruption in the Linux MTD raw NAND driver for NXP LPC32xx SLC hardware arises because lpc32xx_xmit_dma() silently discards the return value of wait_for_completion_timeout(), treating an expired DMA transfer as successful. The timed-out DMA engine can continue accessing a scatterlist buffer after it has been unmapped and potentially reused by the NAND read/write path, creating a use-after-free condition in kernel space. Exploitation requires local access to an embedded Linux system built on LPC32xx silicon with NAND flash; no public exploit has been identified and EPSS probability sits at 0.18% (7th percentile), indicating limited real-world exploitation interest.
The BPF verifier in the Linux kernel incorrectly accepts constant negative offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF pointer accesses, enabling a local attacker with BPF program loading privileges to perform out-of-bounds kernel memory reads and writes by bypassing the boundary enforcement in __check_buffer_access(). The regression was introduced when commit 022ac0750883 moved constant pointer offsets from reg->off to reg->var_off without updating the corresponding validation logic, leaving a signedness blind spot that allows programs with negative var_off values to load and attach to raw tracepoints undetected. No public exploit code has been identified at time of analysis and the vulnerability is absent from the CISA KEV catalog, but the well-documented commit trail makes independent derivation feasible for a skilled kernel researcher.
Uninitialized pointer dereference in the Linux kernel's `fwnode_init()` function exposes systems to local privilege escalation or kernel crash via a garbage `secondary` pointer in `struct fwnode_handle`. When firmware nodes are allocated on the stack or via non-zeroing heap allocators, `fwnode_init()` leaves `fwnode->secondary` containing arbitrary memory content; subsequent kernel functions such as `dev_to_swnode()` that check `IS_ERR_OR_NULL()` before dereferencing will silently proceed with the garbage pointer. Patches are confirmed available across all active stable kernel branches (5.15.x through 7.x); no public exploit code exists and this CVE is not listed in the CISA KEV catalog.
The Linux kernel's binder IPC driver contains a use-after-clear bug in binder_transaction() where lsmctx.len is re-read after security_release_secctx() has already zeroed the field via memset, causing sg_buf_end_offset to be inflated by the full aligned LSM security context size on every transaction to a txn_security_ctx binder node. This allows BINDER_TYPE_PTR scatter-gather copies to overrun into bytes already populated with the secctx data, enabling LSM security context disclosure and potential kernel buffer corruption. No public exploit or CISA KEV listing exists at time of analysis; the EPSS score of 0.17% reflects low current exploitation probability, though the low-privilege local attack vector is meaningful on Android where binder IPC is the foundational IPC mechanism.
Improper credential context in the Linux kernel's in-kernel SMB3 server (ksmbd) allows an attacker with an open SMB handle to have SET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION FSCTL operations executed under the ksmbd worker's credentials instead of the credentials captured when the file was opened. Because the underlying VFS xattr, fallocate and fileattr helpers revalidate inode permissions, ownership and LSM policy against those worker credentials rather than the SMB handle's access mask, an attacker can corrupt or zero file data and alter file attributes beyond what their handle should permit (CVSS 9.1, I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not in CISA KEV; the upstream fix is merged into stable kernels.
Use-after-free / torn-entry race in the Linux kernel's Intel VT-d IOMMU driver (iommu/vt-d) lets the hardware walk a stale scalable-mode context entry pointing at freed PASID directory memory during device_pasid_table_teardown(), producing spurious DMA faults, unpredictable IOMMU behavior, and potential memory corruption. It affects Linux 6.8.2 through the 6.x/7.x stable series on systems using Intel scalable-mode (PASID) IOMMU translation. There is no public exploit identified at time of analysis and EPSS is low (0.16%), but the vendor-released fix is available in the stable trees.
Buffer overflow and missing locking in the Linux kernel's sun4i-ss PRNG driver expose local low-privilege users on AllWinner sun4i SoC hardware to potential kernel memory corruption and privilege escalation. Two distinct flaws exist: sun4i_ss_prng_seed() lacks mutual exclusion and accepts input without bounds checking, while sun4i_ss_prng_generate() truncates output length and fails to synchronize with hardware before reading bytes, producing cryptographically unreliable output. No public exploit has been identified, EPSS sits at 0.18% (8th percentile), and the kernel maintainers resolved the issue by removing the entire dead code block rather than patching individual bugs.
Use-after-free in the Linux kernel's AF_RXRPC (rxrpc) networking subsystem lets a freed struct rxrpc_backlog be reused when kernel accept preallocation races against socket teardown. The flaw affects kernels using the rxrpc transport (notably kAFS/AFS clients) prior to the fixed stable releases; a kernel worker calling rxrpc_kernel_charge_accept() reads rx->backlog with no lock while rxrpc_discard_prealloc() concurrently NULLs and frees it, corrupting backlog head/tail pointers and array slots. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.16% (5th percentile).
NULL pointer dereference in the Linux kernel's rxrpc subsystem allows a remote unauthenticated attacker to crash the kernel, causing a denial of service. The flaw exists in rxrpc_verify_data(), which skips allocating the rx_dec_buffer when the associated skb private length is zero, while its caller rxrpc_recvmsg_data() unconditionally assumes the buffer is populated after a successful return. A crafted RxRPC network packet with zero-length payload data can trigger this path, passing a NULL pointer to skb_copy_bits() and causing a kernel panic. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is very low at 0.16% (5th percentile), consistent with a niche kernel subsystem.
Memory corruption and use-after-free in the Linux kernel's AF_RXRPC subsystem (rxrpc) let a local process trigger a double-free and connection refcount underflow by reading an out-of-band challenge message with MSG_PEEK. Because rxrpc_recvmsg_oob() guards only the unlink from recvmsg_oobq under MSG_PEEK but always moves the skb onto pending_oobq, the same singly-referenced skb becomes linked into both a list and an rbtree that share storage, corrupting linkage and freeing the skb and its connection reference twice on socket close. The NVD-assigned CVSS is 9.8, but EPSS is only 0.15% (5th percentile) and there is no public exploit identified at time of analysis; the fix is upstream in the stable trees.
Memory corruption in the Linux kernel's rxrpc networking subsystem (rxgk/GSS Kerberos security class) affects kernels from 6.16 onward, where rxgk_issue_challenge() frees the page holding challenge content before a tracepoint reads the wire header (whdr) that still points into that freed page, creating a use-after-free. The flaw is patched in stable releases 6.18.40, 7.1.5 and 7.2-rc1, and is triggerable only where the rxrpc RxGK security class is active (primarily kAFS deployments). There is no public exploit identified at time of analysis, and the EPSS score is very low at 0.15% (5th percentile), indicating negligible observed exploitation interest.
Denial of service in the Linux kernel's rxrpc subsystem allows remote, unauthenticated attackers to trigger an infinite loop in rxrpc_recvmsg() by sending packets that populate the out-of-band (OOB) queue, which the wait condition fails to check. Systems exposing RxRPC endpoints - primarily AFS (Andrew File System) clients and servers - are affected from the introducing commit through Linux 7.1.4 and 6.18.39. No public exploit exists and EPSS sits at 0.15% (5th percentile), signaling negligible real-world exploitation probability; this is not listed in CISA KEV.
Null-pointer dereference in the Linux kernel's rxrpc subsystem allows a remote unauthenticated attacker to crash the kernel by sending a forged ACKALL control packet to an exposed rxrpc service. Affected systems run Linux from commit b341a0263b1b804d329f864c2dc24815364510ec through the fixes landed in stable releases 6.18.40 and 7.1.5; Linux 6.14 is explicitly confirmed affected. No public exploit has been identified and EPSS probability is very low at 0.15%, but the network-accessible, no-authentication attack path warrants immediate patching on any system actively serving rxrpc traffic.
Kernel panic via rxrpc protocol mishandling in the Linux kernel allows a network-positioned attacker to crash an AFS client system by sending a premature reply DATA packet before any request packets have been transmitted on a client call. The flaw resides in rxrpc_receiving_reply(), which fails to verify call exposure state before invoking rxrpc_rotate_tx_window() - a function whose do...while loop oopses on an empty transmit queue. Fixes have been backported to stable branches 7.1.5 and 6.18.40; no public exploit has been identified and EPSS exploitation probability is extremely low at 0.15% (5th percentile), indicating no known active exploitation.
Denial of service (and potential memory corruption) in the Linux kernel's AF_RXRPC networking stack stems from a double unlock in rxrpc_recvmsg() triggered while handling out-of-band (OOB) messages, affecting kernels from roughly 6.16 up to the fixed 6.18.40, 7.1.5 and 7.2-rc1 releases. Releasing an already-released lock corrupts kernel lock state and can crash the host or open a race window. No public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile).
Use-after-free / stale work-item race in the Linux kernel's kAFS (Andrew File System client) network-namespace teardown path allows a use-after-free when an afs netns is destroyed. Fixed upstream (this issue was found by AI review), the flaw stems from afs_charge_preallocation() and afs_rx_new_call() failing to stop the rxrpc preallocation 'charger' work item before incoming calls are disabled during net-namespace deletion, so the charger can run against freed/torn-down state. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and it is not in CISA KEV, so this is a correctness/stability defect far below the raw CVSS 9.8 rating.
Denial-of-service in the Linux kernel's AFS (Andrew File System) cache manager allows remote attackers to crash or destabilize systems running AFS by sending a crafted CB.InitCallBackState3 callback request that arrives without an associated server record. The CB.InitCallBackState3 handler failed to perform the null-check present in all other callback handlers, meaning an unexpected or spoofed callback packet lacking a peer-to-server mapping causes a kernel-level fault. No public exploits have been identified, and EPSS places exploitation probability at just 0.16% (5th percentile), reflecting the niche deployment footprint of AFS.
Improper bounds enforcement in the Linux kernel's accel/amdxdna driver allows a local low-privileged user to trigger a kernel-to-userspace copy that exceeds the application-provided buffer size via a crafted ioctl call. The root cause is that copy_to_user() was using the kernel's internal data size rather than the caller-supplied buffer size to bound the copy, enabling overflow into adjacent userspace memory and exposure of unintended kernel data. No public exploit exists and no active exploitation has been confirmed, but the CVSS vector (C:H/I:H) reflects a real dual-impact risk: confidentiality loss from kernel memory spillover and integrity loss from overwriting adjacent user-space structures.
Integer overflow in the Linux kernel's legacy DRM radeon driver exposes systems with older ATI/AMD Radeon GPUs to kernel memory corruption via crafted dumb-buffer allocation requests from a low-privileged local user. The flaw resides in radeon_align_pitch(), where both the alignment round-up addition and the final width-times-bytes-per-pixel multiplication can overflow signed 32-bit integers, causing radeon_mode_dumb_create() to return an invalid pitch or allocate a zero-sized kernel buffer - a condition that can be leveraged for heap corruption. EPSS sits at 0.16% (5th percentile) with no CISA KEV listing and no public proof-of-concept, indicating active exploitation has not been confirmed; however, the low-privilege local vector and straightforward arithmetic overflow make this notable for shared Linux systems with this legacy hardware.
Type confusion in the rtw89 PCI Advanced Error Reporting (AER) handlers corrupts kernel memory on Linux systems equipped with Realtek RTL8852CE and related WiFi adapters. The driver stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() incorrectly retrieve it as a net_device pointer, causing netif_device_detach/attach to read and write at wrong memory offsets within a misidentified kernel struct. An adjacent-network attacker within WiFi range could potentially trigger the faulty AER handler path by inducing hardware-level PCI errors via crafted 802.11 frames, resulting in kernel memory corruption. No public exploit exists and EPSS is 0.17% (6th percentile), indicating low observed exploitation activity despite a high CVSS score of 8.8.
Type confusion in the rtw88 Realtek PCIe Wi-Fi driver's PCI Advanced Error Reporting (AER) handlers allows an adjacent-network attacker to corrupt kernel memory, potentially enabling privilege escalation or arbitrary kernel code execution on Linux systems using Realtek PCIe Wi-Fi hardware. The driver stores an ieee80211_hw pointer via pci_set_drvdata() at probe time but retrieves it as a net_device pointer in io_error_detected() and io_resume(), causing netif operations to read and write kernel memory at incorrect struct offsets. No public exploit code has been identified, EPSS places exploitation probability at 0.17% (6th percentile), and the vulnerability is not listed in CISA KEV.
Kernel soft lockup and system panic in the Linux rtw89 Wi-Fi driver affects systems with Realtek RTW89 802.11ax chipsets during 6GHz band scanning. The root cause is an integer truncation bug where the loop counter variable `i` is silently narrowed to 8 bits via a `movzbl %bl, %eax` instruction; when `req->n_6ghz_params` exceeds 255, the counter wraps to zero and the loop never terminates, trapping the CPU for 26+ seconds until the watchdog fires and triggers a kernel panic. No public exploit identified at time of analysis, and EPSS of 0.17% at the 6th percentile reflects low exploitation probability despite the provided CVSS score of 8.8.
Out-of-bounds read in the Linux kernel's rtw88 PCIe WiFi driver allows an adjacent-network attacker to trigger kernel memory disclosure or a system crash via crafted WiFi RX descriptor values. Systems running unpatched kernels with Realtek RTW88-series WiFi chipsets attached over PCIe are affected; the USB transport path was already protected by an equivalent check. The vulnerability arises because the PCIe receive path in rtw_pci_rx_napi() does not validate that the firmware-derived new_len value stays within the pre-allocated DMA buffer before calling skb_put_data. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog.
Out-of-bounds array indexing in the Linux kernel's rtw89 WiFi driver exposes systems using Realtek 802.11ax hardware to kernel memory corruption or disclosure from adjacent network attackers. The driver accepts an 8-bit mac_id (range 0-255) from firmware-processed RX descriptors and uses it without validation to index into assoc_link_on_macid[], which contains only 128 entries - creating a 128-entry gap where attacker-controlled values trigger reads or writes beyond the array boundary. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at 0.17% (6th percentile), but the CVSS 8.8 score reflects the full kernel memory impact achievable by an unauthenticated adjacent attacker.
Out-of-bounds array access in the Linux kernel's ath9k WiFi driver allows an adjacent network attacker to trigger kernel memory corruption via a maliciously crafted firmware transmit status queue ID. The ath_tx_edma_tasklet() function blindly indexes sc->tx.txq[] using a 4-bit hardware field (range 0-15) against an array of only 10 entries (ATH9K_NUM_TX_QUEUES), meaning any qid value of 10 or greater causes an OOB memory access with potential for high confidentiality, integrity, and availability impact. No active exploitation is confirmed (not in CISA KEV), and EPSS stands at 0.18% (7th percentile), but the adjacent-network, no-authentication attack vector keeps this relevant for environments running Atheros 802.11n hardware.
Kernel panic via NULL pointer dereference in the Linux kernel's ath11k PCI WiFi driver affects systems running kernel versions from 5.19 through pre-7.1.5/7.2-rc1 with Qualcomm PCI-attached WiFi chipsets such as WCN6855. The race condition occurs when a system reboot overlaps with WLAN firmware crash recovery (Subsystem Reset, SSR), causing the MHI teardown path and SSR recovery path to simultaneously attempt to deinitialize MHI and free DMA-backed contexts, resulting in a double-free scenario and kernel crash. No public exploit code exists and EPSS exploitation probability is very low at 0.15%, consistent with an accidental-trigger vulnerability rather than a targeted attack vector.
Denial of service in the Linux kernel's VXLAN driver stems from a race condition in vxlan_gro_prepare_receive(): udp_tunnel_sock_release() can set sk->sk_user_data to NULL while GRO processing is mid-flight, producing a NULL-pointer dereference and kernel panic. It affects hosts using VXLAN overlay tunnels across numerous stable branches, is fixed upstream, and has no public exploit identified at time of analysis (EPSS 0.17%). The published NVD CVSS of 9.8 (C:H/I:H/A:H) overstates impact - the actual effect is a crash, not code execution or data disclosure.
Reference count corruption in the Linux kernel's Operating Performance Points (OPP) subsystem exposes systems to memory corruption and potential privilege escalation via a race condition between OPP object addition and frequency lookup. Affected kernels from 4.11 through stable branches predating commits to 7.1.5 and 6.18.40 are vulnerable when concurrent DVFS (Dynamic Voltage and Frequency Scaling) operations race during OPP table construction. No public exploit exists and EPSS sits at 0.17% (6th percentile), suggesting no known widespread exploitation; however, the H/H/H CVSS impact reflects the severity of kernel memory corruption if triggered.
Heap buffer overflow in the Linux kernel CCP driver's snp_filter_reserved_mem_regions() function enables a low-privileged local attacker to corrupt kernel memory on AMD SEV-SNP-enabled systems. The off-by-one error in the boundary check permits a 4-byte write past a PAGE_SIZE kzalloc buffer when 255 or more IOMEM reserved memory regions are present, yielding full High impact on confidentiality, integrity, and availability per CVSS 7.8. No public exploit has been identified and EPSS stands at 0.19% (8th percentile), indicating no current widespread exploitation activity despite the severity score.
Incorrect NULL-check ordering in the Linux kernel's crypto/ccp driver exposes AMD SEV-SNP systems to kernel memory corruption during Trusted I/O firmware initialization. On architectures without HASHED_PAGE_VIRTUAL, passing the return value of __snp_alloc_firmware_pages() directly to page_address() before checking for NULL causes page_address(NULL) to return a deterministic but invalid non-zero address, silently bypassing the allocation-failure guard and allowing sev_tsm_init_locked() to dereference garbage memory. Affected kernel versions span from commit 4be423572da1f4c1 through the patched releases (7.1.5, 7.2-rc1, 6.19); no public exploit identified at time of analysis, and EPSS is 0.16% (5th percentile), consistent with zero confirmed in-the-wild exploitation.
Use-after-free in the Linux kernel's DLM (Distributed Lock Manager) subsystem stems from incorrect sequence-number ordering of message handles in a node's send_queue, which breaks the before(mh->seq, seq) tail-walk in dlm_receive_ack and leads to refcounting corruption and freeing of an in-use send buffer. It affects Linux kernels using DLM (clustered filesystems such as GFS2/OCFS2) from 5.14 onward, and is fixed in stable releases 6.6.145, 6.12.97, 6.18.40 and 7.1.5. Despite a headline CVSS of 9.8, EPSS is only 0.17% (6th percentile), there is no public exploit, and it is not on CISA KEV - the reporter only reproduced it on an experimental branch with an io_uring userspace benchmark.
Denial of service (and potential memory corruption) in the Linux kernel IPv6 stack arises from a race condition in addrconf_dad_failure() where ifp->lock is transiently dropped, letting a concurrent ipv6_del_addr() poison a list entry that Duplicate Address Detection (DAD) work then dereferences, producing a general protection fault in ipv6_del_addr(). The flaw affects the addrconf DAD-failure path across a broad range of kernel versions and is fixed by folding the state transition into a single locked critical section. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%), and it is not listed in CISA KEV.
Resource leak and premature mutex use in the Linux kernel's mlx5 InfiniBand driver (IB/mlx5) expose systems with Mellanox/NVIDIA ConnectX hardware to local privilege escalation, denial of service, and potential information disclosure. When mlx5_ib_alloc_transport_domain() successfully allocates a transport domain (TD) but mlx5_ib_enable_lb() subsequently fails, the TD object is never freed, leaking kernel memory. Compounding this, the loopback mutex (dev->lb.mutex) was initialized too late - after code paths that could use it - creating a window for undefined kernel behavior. No public exploit exists and EPSS sits at 0.17% (7th percentile), placing real-world risk well below the CVSS 7.8 headline score.
Resource leak and potential mutex deadlock in the Linux kernel's RDMA/mlx5 driver (UMR XLT cleanup path) enables denial-of-service conditions on systems using Mellanox/NVIDIA ConnectX RDMA adapters. The vulnerability exists from commit 1efe8c0670d6a6883faa09c9abc746c741f5664a onward, including Linux 6.16, where a fallible error path in mlx5_odp_populate_xlt() skips the mandatory DMA buffer and XLT mapping cleanup performed by mlx5r_umr_unmap_free_xlt(), and if the emergency XLT page code path was taken, permanently locks xlt_emergency_page_mutex. EPSS is very low at 0.18% (8th percentile), no public exploit code exists, and the vulnerability is not listed in CISA KEV, but RDMA-enabled HPC, storage, and financial infrastructure running affected kernel versions should prioritize patching.
Kernel-level memory corruption in the Linux RDMA SCSI RDMA Protocol target driver (ib_srpt) lets a malicious SRP initiator on the RDMA fabric overflow an integer length calculation and drive a ~4GB out-of-bounds scatter-gather mapping. The flaw stems from adding an attacker-controlled 32-bit immediate-data length to an offset without overflow checking, wrapping req_size below its bounds check. It carries a CVSS 9.8 rating, but there is no public exploit identified at time of analysis and EPSS is low (0.19%, 8th percentile); a vendor patch is available across current stable kernel trees.
Out-of-bounds write in the Linux kernel's RDMA irdma driver allows a local low-privileged user to overflow a fixed-size kernel array and corrupt heap memory, potentially escalating privileges or crashing the system. The flaw exists in irdma_copy_user_pgaddrs, where the loop guard based on palloc->total_cnt is inert when set to zero (the lvl==0 path), allowing a user-supplied umem with more than 4 DMA blocks to write beyond the 4-entry iwmr->pgaddrmem array. Patch-confirmed fixes are available across multiple stable kernel branches; no public exploit code exists and EPSS sits at 0.17%, but the High C/I/A impact of a kernel heap write warrants prompt patching on affected configurations.
Use-after-free in the Linux kernel's ALSA OSS sequencer subsystem allows a local low-privileged attacker to corrupt kernel heap memory by racing SysEx MIDI event dispatch against concurrent sequencer port closure. The vulnerable code path in snd_seq_oss_process_event() stores a raw pointer to SysEx byte data in the event record without retaining a refcount across the full dispatch lifecycle, enabling freed memory to be accessed in snd_seq_event_dup() if the OSS MIDI port is closed before dispatch completes. Vendor-released patches are available at kernel versions 6.18.40 and 7.1.5; no public exploit code and no active exploitation have been identified at time of analysis.
Use-after-free and NULL-pointer dereference in the Linux kernel ALSA sequencer MIDI subsystem allows a local low-privileged user to crash the kernel or potentially escalate privileges by racing MIDI output event processing against port teardown. The flaw exists because `event_process_midi()` reads `msynth->output_rfile.output` without holding any lock, while `midisynth_unuse()` can concurrently free `substream->runtime` before `snd_rawmidi_kernel_write1()` pins its buffer reference - leaving the event path with a dangling pointer confirmed via KASAN null-ptr-deref reproduction. No public exploit identified at time of analysis, and EPSS of 0.17% (7th percentile) signals low current exploitation interest despite the 7.8 CVSS score.
Resource leakage in the Linux kernel's NVMe-over-TCP target subsystem (nvmet-tcp) allows unauthenticated network clients to exhaust kernel queue and socket resources by manipulating a TLS handshake. The flaw in `nvmet_tcp_tls_handshake_done()` ignores the return value of `nvmet_tcp_set_queue_sock()`, so if the socket leaves TCP_ESTABLISHED state during handshake completion - a condition an attacker can induce by timing a connection abort - resources are never cleaned up. No public exploit is identified and EPSS is 0.17%, but repeated triggering can deny service to storage infrastructure running nvmet-tcp with TLS configured.
Out-of-bounds slab write in the Linux kernel's NVMe-multipath driver (nvme_mpath_revalidate_paths) affects hosts whose NUMA node IDs are sparse rather than densely packed from zero, notably some powerpc/POWER9 systems. The nvme_ns_head.current_path[] flexible array is sized with num_possible_nodes() but indexed with the raw numa_node_id(), so on non-contiguous topologies the driver writes a pointer past the end of the allocation during namespace scanning, producing the KASAN slab-out-of-bounds splat shown in the report. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and it is not on CISA KEV, despite an inflated NVD score of 9.8.
Out-of-bounds array access in the Linux kernel's nvme-pci driver crashes the kernel and prevents NVMe namespaces from appearing as /dev nodes on systems built without NUMA support (CONFIG_NUMA=n). The root cause is a signed-to-unsigned type mismatch: NUMA_NO_NODE (-1) is cast to UINT_MAX when passed through a parameter declared 'unsigned', causing nvme_setup_descriptor_pools() to index far beyond the bounds of the descriptor pool array (sized to nr_node_ids). No active exploitation has been identified (not in CISA KEV), and EPSS of 0.17% reflects negligible real-world exploitation probability, though the CONFIG_NUMA=n precondition significantly limits the exposed population to non-enterprise kernel builds.
The host1x GPU driver in the Linux kernel mishandles the return value of iommu_map_sgtable() after an upstream API change switched its return type from size_t (unsigned, zero on error) to ssize_t (signed, negative on error), leaving pin_job() blind to failures. Compounded by pin_job() assigning the result to a plain int - risking overflow on large sizes - an IOMMU mapping failure can be silently treated as success, potentially allowing a low-privileged local user on Tegra hardware to trigger kernel memory corruption and escalate privileges. No public exploit identified at time of analysis; the CVSS 8.8 score with Scope:Changed reflects the theoretical kernel-level blast radius, while the 0.17% EPSS and absence of CISA KEV listing indicate low current exploitation activity.
Heap buffer overflow in the Linux kernel's RDMA/rxe (Soft-RoCE) subsystem exposes local low-privileged users to a TOCTOU race condition in get_srq_wqe(), where a concurrent userspace thread can corrupt the num_sge field in a kernel-userspace shared SRQ buffer between its validation and use, bypassing bounds checks on the memcpy into qp->resp.srq_wqe. Affected kernels span from the rxe SRQ introduction at commit 8700e3e7c485 (circa Linux 4.8) through multiple stable branches, with fixes backported to 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit has been identified at time of analysis, and EPSS at 0.19% reflects limited real-world exploitation activity despite the 7.8 CVSS score.
Out-of-bounds memory access in the Linux kernel RDMA/rxe (Soft RoCE) subsystem enables a local low-privileged attacker to corrupt kernel heap data or leak sensitive memory, potentially achieving local privilege escalation. The non-SRQ receive path in rxe_resp_check_length() and copy_data() reads WQE fields directly from a userspace-mapped shared buffer without snapshotting them first, creating a TOCTOU race window exploitable by any local user controlling a non-SRQ queue pair. Patches are confirmed available across multiple stable kernel branches; no public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.17% indicates low current exploitation probability consistent with the niche RDMA prerequisite.
Kernel memory (bio structure) leak in the Linux md/raid10 driver occurs when a discard operation reuses an r10bio object previously used for a read. Because put_all_bios() only releases the replacement bio (repl_bio) when read_slot is negative, a reused r10bio with a stale non-negative read_slot skips the bio_put() on repl_bio, leaking kernel memory on RAID10 arrays that have replacement/spare devices and receive discard (TRIM) traffic. There is no public exploit identified at time of analysis, and EPSS risk is very low (0.17%, 7th percentile).
Deadlock vulnerability in the Linux kernel md/raid1 and md/raid10 drivers can freeze systems running software RAID1 or RAID10 under concurrent memory pressure. The flaw causes incorrect GFP flag selection during block I/O error recovery - the kernel uses GFP_NOIO instead of GFP_NOIO|__GFP_HIGH after a failed bio is split and resubmitted, starving memory reclaim of emergency reserves and causing a kernel deadlock. No active exploitation has been identified (not in CISA KEV), and EPSS at 0.15% reflects low opportunistic risk; however, storage servers, hypervisors, and database hosts using Linux software RAID should prioritize patching to kernel 7.1.5 or 7.2-rc1.
Out-of-bounds write in the Linux kernel BPF subsystem allows a local low-privileged user to corrupt memory by issuing a BPF_PROG_QUERY syscall with an undersized bpf_attr buffer that omits the query.revision field introduced in v6.6. The cgroup attach-type code path is the primary hazard: BPF_PROG_QUERY on cgroup types shipped in 2017, and the revision write-back was added years later, creating a real population of legacy callers whose smaller buffers trigger the unconditional OOB write. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the CVSS 7.8 high-impact rating reflects that successful kernel memory corruption can yield full system compromise.
Inconsistent arvif state management in the Linux kernel's ath12k Qualcomm WiFi 7 driver exposes local low-privileged users to kernel memory corruption, information disclosure, and system crash via stale pointer dereference. Three distinct error paths in ath12k_mac_vdev_create() fail to clear or properly unwind arvif->ar and associated vdev/peer state, leaving the driver operating against ghost structures never confirmed in firmware. No public exploit identified at time of analysis, and EPSS probability sits at 0.15% (5th percentile), reflecting low near-term exploitation likelihood despite the 7.8 CVSS score.
Silent data corruption in the Linux kernel nvdimm/btt subsystem results from a broken lane-acquisition locking model that became invalid once BTT lanes were made preemptible. On systems with NVDIMM persistent memory configured in BTT (Block Translation Table) mode, a low-privileged local user can trigger a preemption-induced race where a second task observes a non-zero per-CPU recursion count, incorrectly infers it already holds the lane lock, bypasses mutual exclusion, and concurrently accesses shared per-lane metadata and workspace state, yielding high-integrity and high-confidentiality impact. No public exploit exists and EPSS is 0.18% (8th percentile), but the race is reproducible via the upstream ndctl btt-check.sh unit test and patches are available across all actively maintained stable kernel branches.
Unbounded sprintf() calls in the Linux kernel's CPU hotplug sysfs interface (states_show()) can overflow the PAGE_SIZE kernel buffer when a sufficient number of hotplug states are registered, enabling a local low-privileged user to corrupt adjacent kernel memory with potential high impact on confidentiality, integrity, and availability. Affected kernel versions span from the 4.6 era through multiple current stable branches (5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x), each with vendor-released patch versions confirmed by ENISA EUVD-2026-59024. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), indicating limited real-world exploitation probability despite the 7.8 CVSS score.
Out-of-bounds memory access in the Linux kernel MANA (Microsoft Azure Network Adapter) Ethernet driver arises because the RX completion queue entry (CQE) packet length reported by the NIC was passed to skb processing without validation. Affected systems are Linux VMs running the mana_en driver, predominantly Azure guests using MANA/SR-IOV networking. A NIC (or malicious hypervisor/device) supplying a crafted oversized length can trigger an out-of-bounds read leading to information disclosure or a kernel crash; the vulnerability is tagged Information Disclosure, has no public exploit identified at time of analysis, and carries a low EPSS of 0.21%.
Missing DMA sync-for-CPU in the Linux kernel's MANA (Microsoft Azure Network Adapter) RX path can hand stale or uninitialized buffer memory to the networking stack on systems that require explicit DMA syncing, such as those booted with swiotlb=force. The flaw affects the mana Ethernet driver when RX buffers come from page-pool fragments (frag_count > 1), where the DMA unmap that normally performs the implicit CPU sync is skipped. There is no public exploit identified at time of analysis, EPSS is low (0.20%), and it is not listed in CISA KEV.
Cross-namespace privilege escalation in the Linux kernel SIT (IPv6-in-IPv4) tunnel driver allows a local attacker with CAP_NET_ADMIN in one network namespace to rewrite SIT tunnel configuration belonging to a distinct, more privileged network namespace, bypassing the intended authorization boundary. This is particularly impactful in containerized environments where network namespace isolation is a primary security boundary, as tenant containers are commonly granted CAP_NET_ADMIN within their own namespace. Patches are confirmed available across all active stable kernel branches (5.10 through 7.x); no public exploit or CISA KEV entry exists at time of analysis, and EPSS is 0.22%, reflecting very low observed exploitation activity.
Metadata corruption in the Linux kernel traffic control connection-tracking action (act_ct) allows remote attackers to crash systems or corrupt qdisc packet-segment state by sending fragmented IP or IPv6 traffic. The flaw exists because tcf_ct_handle_fragments() invokes nf_ct_handle_fragments() without preserving skb->cb, so the netfilter defragmentation helper silently overwrites tc_skb_cb/qdisc_skb_cb in-place - the same memory region. On hosts with panic_on_warn enabled, this triggers a WARN_ON_ONCE in qdisc_pkt_segs() that escalates to a kernel panic. EPSS is low (0.21%, 11th percentile) and the vulnerability is not in CISA KEV, indicating opportunistic exploitation is unlikely but targeted denial-of-service against network appliances or container hosts using tc act_ct is realistic.
Privilege boundary bypass in the Linux kernel's ip6_vti (IPv6 Virtual Tunnel Interface) subsystem allows a local user with CAP_NET_ADMIN in one network namespace to reconfigure VTI6 tunnels residing in a separate, unprivileged network namespace. The rtnl changelink path validates CAP_NET_ADMIN only against dev_net(dev), leaving t->net unchecked when the device spans namespaces - enabling unauthorized rewrites of cross-namespace tunnel configurations with full confidentiality, integrity, and availability impact on the affected namespace. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (12th percentile) reflects low current exploitation probability, though the capability misuse pattern is well-understood in container-escape research.
Privilege escalation in the Linux kernel's IP VTI (Virtual Tunnel Interface) subsystem allows a local attacker holding CAP_NET_ADMIN in one network namespace to reconfigure VTI tunnel endpoints anchored in a separate, more privileged network namespace they do not control. Affected kernel versions span from approximately 3.15 through all stable branches prior to 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code has been identified and no CISA KEV listing exists, but the scope-changed CVSS rating (8.8) reflects real cross-namespace boundary violation risk relevant to container and VNF deployments.
Cross-namespace capability bypass in the Linux kernel's IPIP (IP-in-IP) tunnel driver allows a local process holding CAP_NET_ADMIN within one network namespace to modify IPIP tunnel parameters governed by a separate, more privileged network namespace. By exploiting the missing rtnl_dev_link_net_capable() check in ipip_changelink(), an attacker can redirect or disrupt encapsulated tunnel traffic across namespace boundaries - a meaningful concern in containerized environments where namespace separation is a security boundary. No public exploit code or CISA KEV listing has been identified; EPSS stands at 0.21% (11th percentile), indicating low current exploitation probability despite the high CVSS score of 8.8.
IPv6 GRE tunnel management in the Linux kernel allows a local attacker holding CAP_NET_ADMIN in one network namespace to modify tunnel configurations residing in a separate, unauthorized namespace - effectively escalating privilege across namespace security boundaries. Affected kernels span multiple long-term support trees from at least 4.19.100 onward, with patches released across stable series including 6.12.97, 6.6.145, 6.1.178, 6.18.40, 5.10.261, 5.15.212, and 7.1.5. No public exploit code has been identified at time of analysis; EPSS exploitation probability stands at 0.21% (12th percentile), indicating limited current attacker interest despite the high CVSS score.
Insufficient capability gating in the Linux kernel's IPv6 tunnel subsystem allows a local attacker with CAP_NET_ADMIN in one network namespace to reconfigure tunnel devices residing in a separate, more privileged namespace. Affected versions span from Linux 3.12 through all stable branches prior to 6.6.148, 6.12.101, 6.18.40, and 7.1.5, with the CVSS Scope:Changed metric confirming cross-namespace impact. This vulnerability is not listed in CISA KEV and carries an EPSS score of 0.20% (10th percentile), indicating limited observed exploitation at time of analysis; however, it is a meaningful privilege escalation primitive in containerized deployments where CAP_NET_ADMIN is routinely granted.
Raw AES-128 LLSEC key exposure in the Linux kernel's legacy ieee802154 netlink family allows any local user to extract 16-byte cryptographic key material directly from the kernel keytable on systems running IEEE 802.15.4 (wpan) interfaces with link-layer security configured. Because IEEE 802.15.4 LLSEC uses CCM* mode where the same key both encrypts frames and provides message authentication, key disclosure simultaneously breaks confidentiality and authenticity of the entire 802.15.4 wireless network. No confirmed active exploitation and no public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), consistent with the niche hardware requirement.
Header buffer corruption in the Linux kernel gve (Google Virtual Ethernet) driver's DQO RX datapath lets header bytes from one packet be copied onto another, and lets header buffers be re-posted while the device still owns them, when both header-split and HW-GRO are enabled with many concurrent flows. The gve driver is used by Google Cloud Platform Linux VMs, so exposure is limited to GCP guests running affected kernels with that specific offload configuration. There is no public exploit identified at time of analysis, EPSS is very low (0.20%), and the observed effect is roughly a 30% throughput drop with heavy TCP retransmissions rather than code execution.
Cross-VF/PF LMTLINE physical address disclosure in the Linux kernel's octeontx2-af CN10K driver allows a low-privileged VF caller to read another PF's LMTLINE physical base address and map it into its own LMT table entry. Affected are Linux kernel trees from commit 893ae97214c3 across stable branches 6.6.x before 6.6.148, 6.12.x before 6.12.101, 6.18.x before 6.18.42, and mainline before 7.1.5/7.2-rc1. No public exploit code or CISA KEV listing exists at time of analysis; the EPSS score of 0.20% (10th percentile) indicates low exploitation probability, consistent with the hardware-specific attack surface.
Data corruption in the Linux kernel's LoongArch memory management subsystem allows a local low-privileged user to cause silent loss of written data or potential exposure of stale page contents via a race condition between hardware page table walker behavior and software dirty-bit tracking. Affected systems are those running LoongArch CPUs with hardware PTW enabled - a condition that applies to the architecture by design - across kernel versions from 5.19 through stable branches prior to 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code exists and EPSS stands at 0.21% (11th percentile), though the bug was reliably reproduced via the LTP madvise09 test, confirming it is not theoretical.
Reference count underflow in the Linux kernel IPMI subsystem's handle_read_event_rsp() function enables local privilege escalation on server hardware with active IPMI interfaces. The flaw resides in the error-rollback path: when event delivery fails after successfully allocating receive messages for some users, the rollback incorrectly drops the user reference count twice - once through ipmi_free_recv_msg() and again through a now-stale explicit put - freeing an ipmi_user object that remains linked on intf->users. Subsequent event delivery then dereferences the freed object or trips refcount_t's addition-on-zero guard, enabling kernel memory corruption leading to full system compromise. No public exploit or CISA KEV listing exists; EPSS is 0.20% at the 10th percentile, consistent with no active exploitation at time of analysis.
Memory-accounting corruption in the Linux kernel's espintcp (ESP-in-TCP / IPsec RFC 8229) send path was resolved by switching to sk_msg_free_partial(), which keeps the socket message (skmsg) consistent on partial sends. On affected kernels the previous code mishandled uncharges and offsets when the full payload was not transmitted, corrupting skmsg accounting on a system where TCP encapsulation of IPsec is in use. This is a stable-tree fix carrying an NVD CVSS of 9.8 and the 'Information Disclosure' tag, but EPSS is only 0.20% (10th percentile) and no public exploit is identified at time of analysis.
Kernel panic via NULL pointer dereference in the Linux kernel's multiq traffic scheduler (net/sched/sch_multiq) affects all kernels from 2.6.29 through unpatched stable trees. When multiq pairs with a non-work-conserving child qdisc (such as qfq) routed through a peeking intermediary (such as tbf), multiq_dequeue() invokes the child's raw ->dequeue() method directly instead of qdisc_dequeue_peeked(), orphaning the stash, corrupting qlen/backlog accounting, and triggering a NULL dereference in softirq context during ordinary egress. Exploitation requires local access with CAP_NET_ADMIN and a deliberately constructed qdisc hierarchy; no public exploit code exists and EPSS probability is 0.21% (12th percentile), consistent with the niche configuration requirement.
Kernel panic via NULL pointer dereference in Linux's taprio traffic scheduler (net/sched/sch_taprio) delivers system-level denial of service when a non-work-conserving child qdisc such as qfq is attached to a taprio parent. The defect in taprio_dequeue_from_txq() calls the child's ->dequeue() function pointer directly rather than via qdisc_dequeue_peeked(), bypassing the child's gso_skb stash, orphaning the peeked skb, desyncing qlen/backlog counters, and re-entering the child on an emptied list - triggering a NULL dereference from softirq context during ordinary egress traffic. No public exploit has been identified at time of analysis, and EPSS stands at 0.20% (10th percentile), indicating very low opportunistic exploitation probability; the vulnerability is not listed in CISA KEV.
Null pointer dereference in the Linux kernel's fhandle subsystem allows a local low-privileged user to trigger a kernel panic via a race condition in capable_wrt_mount(). The vulnerable path is reached when open_by_handle_at() processes a file handle whose detached mount - created via open_tree(OPEN_TREE_CLONE) - is concurrently dissolved by fput(), causing umount_tree() to clear mount->mnt_ns to NULL before capable_wrt_mount() can safely dereference mnt_ns->user_ns. No public exploit identified at time of analysis (EPSS 0.20%, no CISA KEV listing), and patched kernel versions 6.12.97, 6.18.40, 7.1.5, and 7.2-rc2 are available from upstream stable trees.
Kernel memory disclosure and denial-of-service in the Linux kernel OrangeFS client affects systems mounting OrangeFS parallel filesystems, where fill_from_part() truncates a 64-bit directory-entry length into a __u32. An entry length near U32_MAX wraps to a small value that slips past the bounds check and is then used to index the directory part, causing an out-of-bounds read that oopses the kernel. The malformed trailer is supplied by the userspace OrangeFS client, and there is no public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and this is not in CISA KEV. Note: the input CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) conflicts with the description, which describes a local, client-supplied-data OOB read rather than remote unauthenticated code execution.
Out-of-bounds memory read and infinite-loop denial of service in the Linux kernel's iosm WWAN driver (net/wwan/iosm) allow a rogue or compromised modem to corrupt kernel memory and exhaust system resources by supplying crafted MUX downlink packets with malicious offsets and circular table references. Affected systems are those running Linux 5.18 and later with Intel WWAN hardware using the iosm driver, where the mux_dl_adb_decode() function failed to validate any of the device-supplied offsets and lengths (first_table_index, next_table_index, table_length, datagram_index, datagram_length) against the received socket buffer boundary. No public exploit exists and EPSS probability is very low at 0.21% (12th percentile); however, the CVSS 8.8 rating with Full C/I/A impact and reproduction confirmed under KASAN make this a credible risk for cellular-enabled Linux deployments awaiting patch application.
Memory corruption in the Linux kernel's compaction subsystem allows a local low-privileged attacker to trigger data corruption or potential privilege escalation by exploiting improper error handling in compaction_free(). The function ignores failure returns from free_pages_prepare(), causing hardware-poisoned pages (PageHWPoison) or bad pages (free_page_is_bad()) to be re-added to the compaction freepages list and subsequently reallocated to kernel or user structures. Exploitation requires low-privilege local access and is not confirmed actively exploited (absent from CISA KEV), with EPSS at a low 0.21% (11th percentile); vendor-released patches are available across multiple stable branches.
Race condition in the Linux kernel mac802154 subsystem allows a local low-privileged attacker to trigger kernel memory corruption by racing hardware teardown against an in-flight asynchronous transmit completion. Affected systems are those running IEEE 802.15.4 wireless networking hardware with the mac802154 module loaded; versions from Linux 3.19 through the respective stable-branch fix commits are vulnerable. No public exploit identified at time of analysis, and EPSS of 0.21% (12th percentile) reflects negligible observed exploitation activity; vendor patches have been released across all active stable kernel branches.
IPVS (IP Virtual Server) SCTP state tracking in the Linux kernel misreads chunk headers for IPv6 packets carrying extension headers, causing incorrect connection state transitions that affect load balancer behavior and resource accounting. The IPVS subsystem, widely deployed in Kubernetes and LVS environments via kube-proxy, can misclassify an SCTP INIT packet as an already-ESTABLISHED connection when the IPv6 packet includes extension headers (e.g., an 8-byte Destination Options header), because set_sctp_state() hardcodes sizeof(struct ipv6hdr) as the transport offset rather than using the offset already resolved by ipv6_find_hdr(). No public exploit identified at time of analysis, and EPSS at 0.21% (12th percentile) confirms very low current exploitation interest despite the CVSS 8.2 score.
Information disclosure and TCP flow corruption in the Linux kernel's IPVS (IP Virtual Server) load balancer arises because ip_vs_conn_new() only zeroes the delta fields of its two ip_vs_seq structures, leaving init_seq and previous_delta filled with stale slab data. A director acting as a connection-sync backup can hash a connection with IP_VS_CONN_F_IN_SEQ/OUT_SEQ flags set (inherited from IP_VS_CONN_F_BACKUP_MASK) while an attacker-supplied sync message omits IPVS_OPT_SEQ_DATA, so an IPVS application helper later rewrites forwarded TCP sequence/ack numbers using uninitialized kernel memory. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and the issue is not in CISA KEV.
Heap out-of-bounds read in the Linux kernel MACsec subsystem (`macsec_encrypt()`) allows a local attacker with CAP_NET_RAW capability to leak 12 bytes of kernel heap memory and emit that raw heap content onto the wire as a malformed Ethernet frame, with additional potential for kernel destabilization. The flaw is triggered exclusively via the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path, where the socket buffer arrives at `macsec_start_xmit()` with `skb->mac_header` unset, resolving `eth_hdr(skb)` to `skb->head + 65535` - far outside valid headroom. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (12th percentile) reflects low exploitation probability; patches have been backported across all active stable kernel series.
Out-of-bounds write in the Linux kernel's dibs loopback subsystem enables a local low-privileged attacker to corrupt kernel memory by supplying a crafted offset or oversized write through the move_data() interface, which calls memcpy() without verifying that offset + size stays within the registered DMB's allocated length. The software loopback omits the memory-region bounds enforcement that real ISM hardware provides natively, leaving peer-supplied parameters unchecked. Patch commits are confirmed across four stable kernel branches (6.12.97, 6.18.40, 7.1.5, 7.2-rc3); the vulnerability is not in CISA KEV and no public exploit code has been identified at time of analysis.
Kernel memory corruption in the Linux kernel's DRBD (Distributed Replicated Block Device) driver lets a malicious or man-in-the-middle replication peer write attacker-chosen bytes past a bio page in a receiving node. The flaw lives in recv_dless_read(), where a peer-supplied payload length is handled as a signed int (data_size) that can be driven negative, and it affects any node that reads from its peer - a diskless node or one using read-balancing - in the default configuration. Rated CVSS 9.8 by NVD; there is no public exploit identified at time of analysis and EPSS probability is low (0.20%).
Use-after-free race condition in the Linux kernel's osnoise tracing subsystem allows a local low-privileged attacker to potentially escalate privileges or destabilize the kernel. The flaw, present in kernels since commit a6ed2aee (Linux 5.17), stems from missing synchronize_rcu() synchronization during osnoise instance unregistration, leaving a window where RCU readers can dereference freed tracer memory. Patched stable releases (6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2-rc3) are available; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Shared MIPI PHY resource mismanagement in the Linux kernel's NXP i.MX93 block-control power domain driver (imx93-blk-ctrl) allows a local attacker with low privileges to trigger kernel-level incorrect behavior - including potential memory corruption, information disclosure, and system instability - by exploiting the fact that the DSI and CSI subdomains share clock and reset control bits without coordination. Patches are available across stable branches (6.18.42, 7.1.5, 7.2-rc4), and exploitation probability is low per EPSS (0.20%, 10th percentile). No public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Linux kernel's rt2x00 WiFi driver stems from improper error handling during device probe, where early allocation failures invoke a full teardown path that assumes work items (intf_work, autowakeup_work, sleep_work) are already initialized. On systems with Ralink/MediaTek rt2x00-compatible WiFi hardware, a local low-privileged attacker who can trigger workqueue allocation failure during driver probe can corrupt uninitialized kernel work_struct objects, as confirmed by DEBUG_OBJECTS reporting invalid work drains. EPSS is low (0.21%, 12th percentile) and this is not listed in CISA KEV, though a QEMU-based proof-of-concept demonstrating the failure path was confirmed by the reporters.
Heap overflow in the Linux kernel brcmfmac/cyw WiFi driver allows a network-adjacent attacker controlling a rogue or compromised access point to corrupt kernel heap memory during WPA3 SAE authentication. The flaw in `brcmf_notify_auth_frame_rx()` causes an unsigned integer underflow when a short auth frame (under 24 bytes) is received, producing a wrap-around copy length that drives `memcpy` far beyond the allocated buffer. With CVSS 8.8 and full C/H/I/H/A/H impact on the vulnerable system, exploitation yields arbitrary kernel memory write capability; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (12th percentile), indicating low observed exploitation pressure despite the critical technical severity.
Integer underflow and overflow flaws in the Linux kernel's Realtek Bluetooth driver (btrtl) corrupt kernel memory during firmware loading, enabling a local attacker with low privileges to achieve full kernel-level compromise. The vulnerability exists in rtlbt_parse_firmware(), where a malformed firmware patch with a length field smaller than 4 causes a subtraction underflow that transforms a subsequent memcpy into an oversized kernel memory write; a separate addition overflow on 32-bit architectures compounds the exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), consistent with the local-only attack vector.
Incorrect IPv6 transport-header offset handling in the Linux kernel's IPVS (IP Virtual Server) load-balancing subsystem causes application-layer helper code and ICMPv6 checksum validation to misread packet headers when IPv6 traffic - particularly packets carrying extension headers - is processed. The IPVS TCP application path wrongly assumed an IPv4 network header even after the ipvsh offset argument was supplied, and ip_vs_out_icmp_v6() used an incorrect ICMPv6 offset. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and this is not on CISA KEV, and for the only in-tree app (FTP) the maintainers note the effect is harmless because port mangling is handled by Netfilter without TCP sequence adjustment.
Memory-safety defect in the Linux kernel IPVS (IP Virtual Server) subsystem where __ip_vs_get_out_rt() calls skb_ensure_writable(), which can reallocate skb->head, leaving a stale IP-header pointer that is then dereferenced. Affected hosts are Linux systems acting as IPVS load balancers/directors; the flaw can lead to reads of freed/relocated packet memory (information disclosure) or kernel instability. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile); the upstream fix reloads the IP header after reallocation.
Out-of-bounds memory access in the Linux kernel's spufs (SPU filesystem) subsystem on PowerPC Cell Broadband Engine architectures allows a local low-privileged user to read or write beyond the SPU local store buffer via a flawed bounds check in `spufs_mem_mmap_access()`. The function computes the mmap offset correctly but validates it against `vma->vm_end` rather than `LS_SIZE`, causing the guard to never fire on 64-bit systems and leaving the length parameter unconstrained relative to the actual local store buffer. Vendor-released patches are confirmed across multiple stable kernel branches; no public exploit has been identified and EPSS is 0.21% at the 12th percentile.
PowerPC E500 systems running Linux kernel 7.0 through 7.1.4 and 7.2-rc4 silently lose kernel address-masking protection due to a compile-time preprocessor symbol typo - `CONFIG_E500` instead of `CONFIG_PPC_E500` - causing `mask_user_address_isel()` to be omitted from E500 builds entirely. A local low-privileged user on affected E500 hardware can exploit the absent address-masking primitive to achieve high-impact memory disclosure, integrity corruption, or denial of service against the kernel. No public exploit exists, EPSS is 0.19% (9th percentile), and this vulnerability is not in CISA KEV, indicating very limited current exploitation activity despite a CVSS score of 7.8.
Out-of-bounds read in the Linux kernel cfg80211 WiFi subsystem allows an adjacent-network unauthenticated attacker to disclose kernel memory or crash the system by sending a crafted EHT Multi-Link Element inside an MBSSID beacon frame. Affected kernels fail to call ieee80211_mle_type_ok() before passing the element to ieee80211_mle_get_mld_id(), violating the helper's documented contract and allowing reads past the IE boundary. No public exploit exists and EPSS is 0.20% (10th percentile), but the attack requires only radio proximity to a device with Wi-Fi scanning active - no authentication and no user interaction needed.
Insufficient Multi-Link Element (MLE) common info length validation in the Linux kernel's IEEE 802.11 WiFi stack exposes adjacent-network attackers to high-impact memory corruption. Kernels from commit 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 onward failed to validate the advertised common-info length field for Reconfiguration and Priority Access MLE types - and also omitted the length octet when computing the minimum common size for Reconfiguration MLEs - meaning a malformed MLE frame crafted by a nearby attacker can trigger out-of-bounds access. The CVSS score of 8.8 (AV:A) and EPSS of 0.20% (10th percentile) together indicate high potential impact but no public exploit activity at time of analysis; no public exploit and no CISA KEV listing have been identified.
Remote kernel memory corruption in the Linux mac80211 WiFi subsystem allows an unauthenticated attacker within WiFi range to trigger out-of-bounds memory accesses by sending crafted 802.11 extension frames that bypass subtype validation and reach generic RX path code expecting regular 802.11 header layouts. Affected systems include any Linux host with an active mac80211-based WiFi driver across a broad range of kernel versions spanning 5.10 through pre-patch 7.x releases. The CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact at the kernel level; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Wrong MTD geometry is applied in the Linux kernel's mchp23k256 SPI SRAM driver when the chip is matched via the SPI id-table rather than via Device Tree, potentially exposing or corrupting unintended SRAM address regions. The driver's probe function calls of_device_get_match_data() exclusively, causing any non-OF SPI modalias match to silently fall back to the default mchp23k256_caps structure regardless of which part was actually selected by the SPI id-table, leading to incorrect chip capacity and address geometry. No public exploit exists and EPSS places this at the 7th percentile (0.17%), but the C:H/I:H/A:H CVSS impact flags reflect that incorrect geometry can expose the entire SRAM contents or allow out-of-bounds writes on affected embedded systems.
Kernel memory corruption in the Linux MTD raw NAND driver for NXP LPC32xx SLC hardware arises because lpc32xx_xmit_dma() silently discards the return value of wait_for_completion_timeout(), treating an expired DMA transfer as successful. The timed-out DMA engine can continue accessing a scatterlist buffer after it has been unmapped and potentially reused by the NAND read/write path, creating a use-after-free condition in kernel space. Exploitation requires local access to an embedded Linux system built on LPC32xx silicon with NAND flash; no public exploit has been identified and EPSS probability sits at 0.18% (7th percentile), indicating limited real-world exploitation interest.
The BPF verifier in the Linux kernel incorrectly accepts constant negative offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF pointer accesses, enabling a local attacker with BPF program loading privileges to perform out-of-bounds kernel memory reads and writes by bypassing the boundary enforcement in __check_buffer_access(). The regression was introduced when commit 022ac0750883 moved constant pointer offsets from reg->off to reg->var_off without updating the corresponding validation logic, leaving a signedness blind spot that allows programs with negative var_off values to load and attach to raw tracepoints undetected. No public exploit code has been identified at time of analysis and the vulnerability is absent from the CISA KEV catalog, but the well-documented commit trail makes independent derivation feasible for a skilled kernel researcher.
Uninitialized pointer dereference in the Linux kernel's `fwnode_init()` function exposes systems to local privilege escalation or kernel crash via a garbage `secondary` pointer in `struct fwnode_handle`. When firmware nodes are allocated on the stack or via non-zeroing heap allocators, `fwnode_init()` leaves `fwnode->secondary` containing arbitrary memory content; subsequent kernel functions such as `dev_to_swnode()` that check `IS_ERR_OR_NULL()` before dereferencing will silently proceed with the garbage pointer. Patches are confirmed available across all active stable kernel branches (5.15.x through 7.x); no public exploit code exists and this CVE is not listed in the CISA KEV catalog.
The Linux kernel's binder IPC driver contains a use-after-clear bug in binder_transaction() where lsmctx.len is re-read after security_release_secctx() has already zeroed the field via memset, causing sg_buf_end_offset to be inflated by the full aligned LSM security context size on every transaction to a txn_security_ctx binder node. This allows BINDER_TYPE_PTR scatter-gather copies to overrun into bytes already populated with the secctx data, enabling LSM security context disclosure and potential kernel buffer corruption. No public exploit or CISA KEV listing exists at time of analysis; the EPSS score of 0.17% reflects low current exploitation probability, though the low-privilege local attack vector is meaningful on Android where binder IPC is the foundational IPC mechanism.
Improper credential context in the Linux kernel's in-kernel SMB3 server (ksmbd) allows an attacker with an open SMB handle to have SET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION FSCTL operations executed under the ksmbd worker's credentials instead of the credentials captured when the file was opened. Because the underlying VFS xattr, fallocate and fileattr helpers revalidate inode permissions, ownership and LSM policy against those worker credentials rather than the SMB handle's access mask, an attacker can corrupt or zero file data and alter file attributes beyond what their handle should permit (CVSS 9.1, I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not in CISA KEV; the upstream fix is merged into stable kernels.
Use-after-free / torn-entry race in the Linux kernel's Intel VT-d IOMMU driver (iommu/vt-d) lets the hardware walk a stale scalable-mode context entry pointing at freed PASID directory memory during device_pasid_table_teardown(), producing spurious DMA faults, unpredictable IOMMU behavior, and potential memory corruption. It affects Linux 6.8.2 through the 6.x/7.x stable series on systems using Intel scalable-mode (PASID) IOMMU translation. There is no public exploit identified at time of analysis and EPSS is low (0.16%), but the vendor-released fix is available in the stable trees.
Buffer overflow and missing locking in the Linux kernel's sun4i-ss PRNG driver expose local low-privilege users on AllWinner sun4i SoC hardware to potential kernel memory corruption and privilege escalation. Two distinct flaws exist: sun4i_ss_prng_seed() lacks mutual exclusion and accepts input without bounds checking, while sun4i_ss_prng_generate() truncates output length and fails to synchronize with hardware before reading bytes, producing cryptographically unreliable output. No public exploit has been identified, EPSS sits at 0.18% (8th percentile), and the kernel maintainers resolved the issue by removing the entire dead code block rather than patching individual bugs.
Use-after-free in the Linux kernel's AF_RXRPC (rxrpc) networking subsystem lets a freed struct rxrpc_backlog be reused when kernel accept preallocation races against socket teardown. The flaw affects kernels using the rxrpc transport (notably kAFS/AFS clients) prior to the fixed stable releases; a kernel worker calling rxrpc_kernel_charge_accept() reads rx->backlog with no lock while rxrpc_discard_prealloc() concurrently NULLs and frees it, corrupting backlog head/tail pointers and array slots. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.16% (5th percentile).
NULL pointer dereference in the Linux kernel's rxrpc subsystem allows a remote unauthenticated attacker to crash the kernel, causing a denial of service. The flaw exists in rxrpc_verify_data(), which skips allocating the rx_dec_buffer when the associated skb private length is zero, while its caller rxrpc_recvmsg_data() unconditionally assumes the buffer is populated after a successful return. A crafted RxRPC network packet with zero-length payload data can trigger this path, passing a NULL pointer to skb_copy_bits() and causing a kernel panic. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is very low at 0.16% (5th percentile), consistent with a niche kernel subsystem.
Memory corruption and use-after-free in the Linux kernel's AF_RXRPC subsystem (rxrpc) let a local process trigger a double-free and connection refcount underflow by reading an out-of-band challenge message with MSG_PEEK. Because rxrpc_recvmsg_oob() guards only the unlink from recvmsg_oobq under MSG_PEEK but always moves the skb onto pending_oobq, the same singly-referenced skb becomes linked into both a list and an rbtree that share storage, corrupting linkage and freeing the skb and its connection reference twice on socket close. The NVD-assigned CVSS is 9.8, but EPSS is only 0.15% (5th percentile) and there is no public exploit identified at time of analysis; the fix is upstream in the stable trees.
Memory corruption in the Linux kernel's rxrpc networking subsystem (rxgk/GSS Kerberos security class) affects kernels from 6.16 onward, where rxgk_issue_challenge() frees the page holding challenge content before a tracepoint reads the wire header (whdr) that still points into that freed page, creating a use-after-free. The flaw is patched in stable releases 6.18.40, 7.1.5 and 7.2-rc1, and is triggerable only where the rxrpc RxGK security class is active (primarily kAFS deployments). There is no public exploit identified at time of analysis, and the EPSS score is very low at 0.15% (5th percentile), indicating negligible observed exploitation interest.
Denial of service in the Linux kernel's rxrpc subsystem allows remote, unauthenticated attackers to trigger an infinite loop in rxrpc_recvmsg() by sending packets that populate the out-of-band (OOB) queue, which the wait condition fails to check. Systems exposing RxRPC endpoints - primarily AFS (Andrew File System) clients and servers - are affected from the introducing commit through Linux 7.1.4 and 6.18.39. No public exploit exists and EPSS sits at 0.15% (5th percentile), signaling negligible real-world exploitation probability; this is not listed in CISA KEV.
Null-pointer dereference in the Linux kernel's rxrpc subsystem allows a remote unauthenticated attacker to crash the kernel by sending a forged ACKALL control packet to an exposed rxrpc service. Affected systems run Linux from commit b341a0263b1b804d329f864c2dc24815364510ec through the fixes landed in stable releases 6.18.40 and 7.1.5; Linux 6.14 is explicitly confirmed affected. No public exploit has been identified and EPSS probability is very low at 0.15%, but the network-accessible, no-authentication attack path warrants immediate patching on any system actively serving rxrpc traffic.
Kernel panic via rxrpc protocol mishandling in the Linux kernel allows a network-positioned attacker to crash an AFS client system by sending a premature reply DATA packet before any request packets have been transmitted on a client call. The flaw resides in rxrpc_receiving_reply(), which fails to verify call exposure state before invoking rxrpc_rotate_tx_window() - a function whose do...while loop oopses on an empty transmit queue. Fixes have been backported to stable branches 7.1.5 and 6.18.40; no public exploit has been identified and EPSS exploitation probability is extremely low at 0.15% (5th percentile), indicating no known active exploitation.
Denial of service (and potential memory corruption) in the Linux kernel's AF_RXRPC networking stack stems from a double unlock in rxrpc_recvmsg() triggered while handling out-of-band (OOB) messages, affecting kernels from roughly 6.16 up to the fixed 6.18.40, 7.1.5 and 7.2-rc1 releases. Releasing an already-released lock corrupts kernel lock state and can crash the host or open a race window. No public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile).
Use-after-free / stale work-item race in the Linux kernel's kAFS (Andrew File System client) network-namespace teardown path allows a use-after-free when an afs netns is destroyed. Fixed upstream (this issue was found by AI review), the flaw stems from afs_charge_preallocation() and afs_rx_new_call() failing to stop the rxrpc preallocation 'charger' work item before incoming calls are disabled during net-namespace deletion, so the charger can run against freed/torn-down state. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and it is not in CISA KEV, so this is a correctness/stability defect far below the raw CVSS 9.8 rating.
Denial-of-service in the Linux kernel's AFS (Andrew File System) cache manager allows remote attackers to crash or destabilize systems running AFS by sending a crafted CB.InitCallBackState3 callback request that arrives without an associated server record. The CB.InitCallBackState3 handler failed to perform the null-check present in all other callback handlers, meaning an unexpected or spoofed callback packet lacking a peer-to-server mapping causes a kernel-level fault. No public exploits have been identified, and EPSS places exploitation probability at just 0.16% (5th percentile), reflecting the niche deployment footprint of AFS.
Improper bounds enforcement in the Linux kernel's accel/amdxdna driver allows a local low-privileged user to trigger a kernel-to-userspace copy that exceeds the application-provided buffer size via a crafted ioctl call. The root cause is that copy_to_user() was using the kernel's internal data size rather than the caller-supplied buffer size to bound the copy, enabling overflow into adjacent userspace memory and exposure of unintended kernel data. No public exploit exists and no active exploitation has been confirmed, but the CVSS vector (C:H/I:H) reflects a real dual-impact risk: confidentiality loss from kernel memory spillover and integrity loss from overwriting adjacent user-space structures.
Integer overflow in the Linux kernel's legacy DRM radeon driver exposes systems with older ATI/AMD Radeon GPUs to kernel memory corruption via crafted dumb-buffer allocation requests from a low-privileged local user. The flaw resides in radeon_align_pitch(), where both the alignment round-up addition and the final width-times-bytes-per-pixel multiplication can overflow signed 32-bit integers, causing radeon_mode_dumb_create() to return an invalid pitch or allocate a zero-sized kernel buffer - a condition that can be leveraged for heap corruption. EPSS sits at 0.16% (5th percentile) with no CISA KEV listing and no public proof-of-concept, indicating active exploitation has not been confirmed; however, the low-privilege local vector and straightforward arithmetic overflow make this notable for shared Linux systems with this legacy hardware.
Type confusion in the rtw89 PCI Advanced Error Reporting (AER) handlers corrupts kernel memory on Linux systems equipped with Realtek RTL8852CE and related WiFi adapters. The driver stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() incorrectly retrieve it as a net_device pointer, causing netif_device_detach/attach to read and write at wrong memory offsets within a misidentified kernel struct. An adjacent-network attacker within WiFi range could potentially trigger the faulty AER handler path by inducing hardware-level PCI errors via crafted 802.11 frames, resulting in kernel memory corruption. No public exploit exists and EPSS is 0.17% (6th percentile), indicating low observed exploitation activity despite a high CVSS score of 8.8.
Type confusion in the rtw88 Realtek PCIe Wi-Fi driver's PCI Advanced Error Reporting (AER) handlers allows an adjacent-network attacker to corrupt kernel memory, potentially enabling privilege escalation or arbitrary kernel code execution on Linux systems using Realtek PCIe Wi-Fi hardware. The driver stores an ieee80211_hw pointer via pci_set_drvdata() at probe time but retrieves it as a net_device pointer in io_error_detected() and io_resume(), causing netif operations to read and write kernel memory at incorrect struct offsets. No public exploit code has been identified, EPSS places exploitation probability at 0.17% (6th percentile), and the vulnerability is not listed in CISA KEV.
Kernel soft lockup and system panic in the Linux rtw89 Wi-Fi driver affects systems with Realtek RTW89 802.11ax chipsets during 6GHz band scanning. The root cause is an integer truncation bug where the loop counter variable `i` is silently narrowed to 8 bits via a `movzbl %bl, %eax` instruction; when `req->n_6ghz_params` exceeds 255, the counter wraps to zero and the loop never terminates, trapping the CPU for 26+ seconds until the watchdog fires and triggers a kernel panic. No public exploit identified at time of analysis, and EPSS of 0.17% at the 6th percentile reflects low exploitation probability despite the provided CVSS score of 8.8.
Out-of-bounds read in the Linux kernel's rtw88 PCIe WiFi driver allows an adjacent-network attacker to trigger kernel memory disclosure or a system crash via crafted WiFi RX descriptor values. Systems running unpatched kernels with Realtek RTW88-series WiFi chipsets attached over PCIe are affected; the USB transport path was already protected by an equivalent check. The vulnerability arises because the PCIe receive path in rtw_pci_rx_napi() does not validate that the firmware-derived new_len value stays within the pre-allocated DMA buffer before calling skb_put_data. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog.
Out-of-bounds array indexing in the Linux kernel's rtw89 WiFi driver exposes systems using Realtek 802.11ax hardware to kernel memory corruption or disclosure from adjacent network attackers. The driver accepts an 8-bit mac_id (range 0-255) from firmware-processed RX descriptors and uses it without validation to index into assoc_link_on_macid[], which contains only 128 entries - creating a 128-entry gap where attacker-controlled values trigger reads or writes beyond the array boundary. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at 0.17% (6th percentile), but the CVSS 8.8 score reflects the full kernel memory impact achievable by an unauthenticated adjacent attacker.
Out-of-bounds array access in the Linux kernel's ath9k WiFi driver allows an adjacent network attacker to trigger kernel memory corruption via a maliciously crafted firmware transmit status queue ID. The ath_tx_edma_tasklet() function blindly indexes sc->tx.txq[] using a 4-bit hardware field (range 0-15) against an array of only 10 entries (ATH9K_NUM_TX_QUEUES), meaning any qid value of 10 or greater causes an OOB memory access with potential for high confidentiality, integrity, and availability impact. No active exploitation is confirmed (not in CISA KEV), and EPSS stands at 0.18% (7th percentile), but the adjacent-network, no-authentication attack vector keeps this relevant for environments running Atheros 802.11n hardware.
Kernel panic via NULL pointer dereference in the Linux kernel's ath11k PCI WiFi driver affects systems running kernel versions from 5.19 through pre-7.1.5/7.2-rc1 with Qualcomm PCI-attached WiFi chipsets such as WCN6855. The race condition occurs when a system reboot overlaps with WLAN firmware crash recovery (Subsystem Reset, SSR), causing the MHI teardown path and SSR recovery path to simultaneously attempt to deinitialize MHI and free DMA-backed contexts, resulting in a double-free scenario and kernel crash. No public exploit code exists and EPSS exploitation probability is very low at 0.15%, consistent with an accidental-trigger vulnerability rather than a targeted attack vector.
Denial of service in the Linux kernel's VXLAN driver stems from a race condition in vxlan_gro_prepare_receive(): udp_tunnel_sock_release() can set sk->sk_user_data to NULL while GRO processing is mid-flight, producing a NULL-pointer dereference and kernel panic. It affects hosts using VXLAN overlay tunnels across numerous stable branches, is fixed upstream, and has no public exploit identified at time of analysis (EPSS 0.17%). The published NVD CVSS of 9.8 (C:H/I:H/A:H) overstates impact - the actual effect is a crash, not code execution or data disclosure.
Reference count corruption in the Linux kernel's Operating Performance Points (OPP) subsystem exposes systems to memory corruption and potential privilege escalation via a race condition between OPP object addition and frequency lookup. Affected kernels from 4.11 through stable branches predating commits to 7.1.5 and 6.18.40 are vulnerable when concurrent DVFS (Dynamic Voltage and Frequency Scaling) operations race during OPP table construction. No public exploit exists and EPSS sits at 0.17% (6th percentile), suggesting no known widespread exploitation; however, the H/H/H CVSS impact reflects the severity of kernel memory corruption if triggered.
Heap buffer overflow in the Linux kernel CCP driver's snp_filter_reserved_mem_regions() function enables a low-privileged local attacker to corrupt kernel memory on AMD SEV-SNP-enabled systems. The off-by-one error in the boundary check permits a 4-byte write past a PAGE_SIZE kzalloc buffer when 255 or more IOMEM reserved memory regions are present, yielding full High impact on confidentiality, integrity, and availability per CVSS 7.8. No public exploit has been identified and EPSS stands at 0.19% (8th percentile), indicating no current widespread exploitation activity despite the severity score.
Incorrect NULL-check ordering in the Linux kernel's crypto/ccp driver exposes AMD SEV-SNP systems to kernel memory corruption during Trusted I/O firmware initialization. On architectures without HASHED_PAGE_VIRTUAL, passing the return value of __snp_alloc_firmware_pages() directly to page_address() before checking for NULL causes page_address(NULL) to return a deterministic but invalid non-zero address, silently bypassing the allocation-failure guard and allowing sev_tsm_init_locked() to dereference garbage memory. Affected kernel versions span from commit 4be423572da1f4c1 through the patched releases (7.1.5, 7.2-rc1, 6.19); no public exploit identified at time of analysis, and EPSS is 0.16% (5th percentile), consistent with zero confirmed in-the-wild exploitation.
Use-after-free in the Linux kernel's DLM (Distributed Lock Manager) subsystem stems from incorrect sequence-number ordering of message handles in a node's send_queue, which breaks the before(mh->seq, seq) tail-walk in dlm_receive_ack and leads to refcounting corruption and freeing of an in-use send buffer. It affects Linux kernels using DLM (clustered filesystems such as GFS2/OCFS2) from 5.14 onward, and is fixed in stable releases 6.6.145, 6.12.97, 6.18.40 and 7.1.5. Despite a headline CVSS of 9.8, EPSS is only 0.17% (6th percentile), there is no public exploit, and it is not on CISA KEV - the reporter only reproduced it on an experimental branch with an io_uring userspace benchmark.
Denial of service (and potential memory corruption) in the Linux kernel IPv6 stack arises from a race condition in addrconf_dad_failure() where ifp->lock is transiently dropped, letting a concurrent ipv6_del_addr() poison a list entry that Duplicate Address Detection (DAD) work then dereferences, producing a general protection fault in ipv6_del_addr(). The flaw affects the addrconf DAD-failure path across a broad range of kernel versions and is fixed by folding the state transition into a single locked critical section. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%), and it is not listed in CISA KEV.
Resource leak and premature mutex use in the Linux kernel's mlx5 InfiniBand driver (IB/mlx5) expose systems with Mellanox/NVIDIA ConnectX hardware to local privilege escalation, denial of service, and potential information disclosure. When mlx5_ib_alloc_transport_domain() successfully allocates a transport domain (TD) but mlx5_ib_enable_lb() subsequently fails, the TD object is never freed, leaking kernel memory. Compounding this, the loopback mutex (dev->lb.mutex) was initialized too late - after code paths that could use it - creating a window for undefined kernel behavior. No public exploit exists and EPSS sits at 0.17% (7th percentile), placing real-world risk well below the CVSS 7.8 headline score.
Resource leak and potential mutex deadlock in the Linux kernel's RDMA/mlx5 driver (UMR XLT cleanup path) enables denial-of-service conditions on systems using Mellanox/NVIDIA ConnectX RDMA adapters. The vulnerability exists from commit 1efe8c0670d6a6883faa09c9abc746c741f5664a onward, including Linux 6.16, where a fallible error path in mlx5_odp_populate_xlt() skips the mandatory DMA buffer and XLT mapping cleanup performed by mlx5r_umr_unmap_free_xlt(), and if the emergency XLT page code path was taken, permanently locks xlt_emergency_page_mutex. EPSS is very low at 0.18% (8th percentile), no public exploit code exists, and the vulnerability is not listed in CISA KEV, but RDMA-enabled HPC, storage, and financial infrastructure running affected kernel versions should prioritize patching.
Kernel-level memory corruption in the Linux RDMA SCSI RDMA Protocol target driver (ib_srpt) lets a malicious SRP initiator on the RDMA fabric overflow an integer length calculation and drive a ~4GB out-of-bounds scatter-gather mapping. The flaw stems from adding an attacker-controlled 32-bit immediate-data length to an offset without overflow checking, wrapping req_size below its bounds check. It carries a CVSS 9.8 rating, but there is no public exploit identified at time of analysis and EPSS is low (0.19%, 8th percentile); a vendor patch is available across current stable kernel trees.
Out-of-bounds write in the Linux kernel's RDMA irdma driver allows a local low-privileged user to overflow a fixed-size kernel array and corrupt heap memory, potentially escalating privileges or crashing the system. The flaw exists in irdma_copy_user_pgaddrs, where the loop guard based on palloc->total_cnt is inert when set to zero (the lvl==0 path), allowing a user-supplied umem with more than 4 DMA blocks to write beyond the 4-entry iwmr->pgaddrmem array. Patch-confirmed fixes are available across multiple stable kernel branches; no public exploit code exists and EPSS sits at 0.17%, but the High C/I/A impact of a kernel heap write warrants prompt patching on affected configurations.
Use-after-free in the Linux kernel's ALSA OSS sequencer subsystem allows a local low-privileged attacker to corrupt kernel heap memory by racing SysEx MIDI event dispatch against concurrent sequencer port closure. The vulnerable code path in snd_seq_oss_process_event() stores a raw pointer to SysEx byte data in the event record without retaining a refcount across the full dispatch lifecycle, enabling freed memory to be accessed in snd_seq_event_dup() if the OSS MIDI port is closed before dispatch completes. Vendor-released patches are available at kernel versions 6.18.40 and 7.1.5; no public exploit code and no active exploitation have been identified at time of analysis.
Use-after-free and NULL-pointer dereference in the Linux kernel ALSA sequencer MIDI subsystem allows a local low-privileged user to crash the kernel or potentially escalate privileges by racing MIDI output event processing against port teardown. The flaw exists because `event_process_midi()` reads `msynth->output_rfile.output` without holding any lock, while `midisynth_unuse()` can concurrently free `substream->runtime` before `snd_rawmidi_kernel_write1()` pins its buffer reference - leaving the event path with a dangling pointer confirmed via KASAN null-ptr-deref reproduction. No public exploit identified at time of analysis, and EPSS of 0.17% (7th percentile) signals low current exploitation interest despite the 7.8 CVSS score.
Resource leakage in the Linux kernel's NVMe-over-TCP target subsystem (nvmet-tcp) allows unauthenticated network clients to exhaust kernel queue and socket resources by manipulating a TLS handshake. The flaw in `nvmet_tcp_tls_handshake_done()` ignores the return value of `nvmet_tcp_set_queue_sock()`, so if the socket leaves TCP_ESTABLISHED state during handshake completion - a condition an attacker can induce by timing a connection abort - resources are never cleaned up. No public exploit is identified and EPSS is 0.17%, but repeated triggering can deny service to storage infrastructure running nvmet-tcp with TLS configured.
Out-of-bounds slab write in the Linux kernel's NVMe-multipath driver (nvme_mpath_revalidate_paths) affects hosts whose NUMA node IDs are sparse rather than densely packed from zero, notably some powerpc/POWER9 systems. The nvme_ns_head.current_path[] flexible array is sized with num_possible_nodes() but indexed with the raw numa_node_id(), so on non-contiguous topologies the driver writes a pointer past the end of the allocation during namespace scanning, producing the KASAN slab-out-of-bounds splat shown in the report. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and it is not on CISA KEV, despite an inflated NVD score of 9.8.
Out-of-bounds array access in the Linux kernel's nvme-pci driver crashes the kernel and prevents NVMe namespaces from appearing as /dev nodes on systems built without NUMA support (CONFIG_NUMA=n). The root cause is a signed-to-unsigned type mismatch: NUMA_NO_NODE (-1) is cast to UINT_MAX when passed through a parameter declared 'unsigned', causing nvme_setup_descriptor_pools() to index far beyond the bounds of the descriptor pool array (sized to nr_node_ids). No active exploitation has been identified (not in CISA KEV), and EPSS of 0.17% reflects negligible real-world exploitation probability, though the CONFIG_NUMA=n precondition significantly limits the exposed population to non-enterprise kernel builds.
The host1x GPU driver in the Linux kernel mishandles the return value of iommu_map_sgtable() after an upstream API change switched its return type from size_t (unsigned, zero on error) to ssize_t (signed, negative on error), leaving pin_job() blind to failures. Compounded by pin_job() assigning the result to a plain int - risking overflow on large sizes - an IOMMU mapping failure can be silently treated as success, potentially allowing a low-privileged local user on Tegra hardware to trigger kernel memory corruption and escalate privileges. No public exploit identified at time of analysis; the CVSS 8.8 score with Scope:Changed reflects the theoretical kernel-level blast radius, while the 0.17% EPSS and absence of CISA KEV listing indicate low current exploitation activity.
Heap buffer overflow in the Linux kernel's RDMA/rxe (Soft-RoCE) subsystem exposes local low-privileged users to a TOCTOU race condition in get_srq_wqe(), where a concurrent userspace thread can corrupt the num_sge field in a kernel-userspace shared SRQ buffer between its validation and use, bypassing bounds checks on the memcpy into qp->resp.srq_wqe. Affected kernels span from the rxe SRQ introduction at commit 8700e3e7c485 (circa Linux 4.8) through multiple stable branches, with fixes backported to 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit has been identified at time of analysis, and EPSS at 0.19% reflects limited real-world exploitation activity despite the 7.8 CVSS score.
Out-of-bounds memory access in the Linux kernel RDMA/rxe (Soft RoCE) subsystem enables a local low-privileged attacker to corrupt kernel heap data or leak sensitive memory, potentially achieving local privilege escalation. The non-SRQ receive path in rxe_resp_check_length() and copy_data() reads WQE fields directly from a userspace-mapped shared buffer without snapshotting them first, creating a TOCTOU race window exploitable by any local user controlling a non-SRQ queue pair. Patches are confirmed available across multiple stable kernel branches; no public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.17% indicates low current exploitation probability consistent with the niche RDMA prerequisite.
Kernel memory (bio structure) leak in the Linux md/raid10 driver occurs when a discard operation reuses an r10bio object previously used for a read. Because put_all_bios() only releases the replacement bio (repl_bio) when read_slot is negative, a reused r10bio with a stale non-negative read_slot skips the bio_put() on repl_bio, leaking kernel memory on RAID10 arrays that have replacement/spare devices and receive discard (TRIM) traffic. There is no public exploit identified at time of analysis, and EPSS risk is very low (0.17%, 7th percentile).
Deadlock vulnerability in the Linux kernel md/raid1 and md/raid10 drivers can freeze systems running software RAID1 or RAID10 under concurrent memory pressure. The flaw causes incorrect GFP flag selection during block I/O error recovery - the kernel uses GFP_NOIO instead of GFP_NOIO|__GFP_HIGH after a failed bio is split and resubmitted, starving memory reclaim of emergency reserves and causing a kernel deadlock. No active exploitation has been identified (not in CISA KEV), and EPSS at 0.15% reflects low opportunistic risk; however, storage servers, hypervisors, and database hosts using Linux software RAID should prioritize patching to kernel 7.1.5 or 7.2-rc1.
Out-of-bounds write in the Linux kernel BPF subsystem allows a local low-privileged user to corrupt memory by issuing a BPF_PROG_QUERY syscall with an undersized bpf_attr buffer that omits the query.revision field introduced in v6.6. The cgroup attach-type code path is the primary hazard: BPF_PROG_QUERY on cgroup types shipped in 2017, and the revision write-back was added years later, creating a real population of legacy callers whose smaller buffers trigger the unconditional OOB write. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the CVSS 7.8 high-impact rating reflects that successful kernel memory corruption can yield full system compromise.
Inconsistent arvif state management in the Linux kernel's ath12k Qualcomm WiFi 7 driver exposes local low-privileged users to kernel memory corruption, information disclosure, and system crash via stale pointer dereference. Three distinct error paths in ath12k_mac_vdev_create() fail to clear or properly unwind arvif->ar and associated vdev/peer state, leaving the driver operating against ghost structures never confirmed in firmware. No public exploit identified at time of analysis, and EPSS probability sits at 0.15% (5th percentile), reflecting low near-term exploitation likelihood despite the 7.8 CVSS score.
Silent data corruption in the Linux kernel nvdimm/btt subsystem results from a broken lane-acquisition locking model that became invalid once BTT lanes were made preemptible. On systems with NVDIMM persistent memory configured in BTT (Block Translation Table) mode, a low-privileged local user can trigger a preemption-induced race where a second task observes a non-zero per-CPU recursion count, incorrectly infers it already holds the lane lock, bypasses mutual exclusion, and concurrently accesses shared per-lane metadata and workspace state, yielding high-integrity and high-confidentiality impact. No public exploit exists and EPSS is 0.18% (8th percentile), but the race is reproducible via the upstream ndctl btt-check.sh unit test and patches are available across all actively maintained stable kernel branches.