Linux
Monthly
Out-of-bounds memory access in the Linux kernel RDMA/rxe (Soft RoCE) subsystem enables a local low-privileged attacker to corrupt kernel heap data or leak sensitive memory, potentially achieving local privilege escalation. The non-SRQ receive path in rxe_resp_check_length() and copy_data() reads WQE fields directly from a userspace-mapped shared buffer without snapshotting them first, creating a TOCTOU race window exploitable by any local user controlling a non-SRQ queue pair. Patches are confirmed available across multiple stable kernel branches; no public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.17% indicates low current exploitation probability consistent with the niche RDMA prerequisite.
Kernel memory (bio structure) leak in the Linux md/raid10 driver occurs when a discard operation reuses an r10bio object previously used for a read. Because put_all_bios() only releases the replacement bio (repl_bio) when read_slot is negative, a reused r10bio with a stale non-negative read_slot skips the bio_put() on repl_bio, leaking kernel memory on RAID10 arrays that have replacement/spare devices and receive discard (TRIM) traffic. There is no public exploit identified at time of analysis, and EPSS risk is very low (0.17%, 7th percentile).
Deadlock vulnerability in the Linux kernel md/raid1 and md/raid10 drivers can freeze systems running software RAID1 or RAID10 under concurrent memory pressure. The flaw causes incorrect GFP flag selection during block I/O error recovery - the kernel uses GFP_NOIO instead of GFP_NOIO|__GFP_HIGH after a failed bio is split and resubmitted, starving memory reclaim of emergency reserves and causing a kernel deadlock. No active exploitation has been identified (not in CISA KEV), and EPSS at 0.15% reflects low opportunistic risk; however, storage servers, hypervisors, and database hosts using Linux software RAID should prioritize patching to kernel 7.1.5 or 7.2-rc1.
Out-of-bounds write in the Linux kernel BPF subsystem allows a local low-privileged user to corrupt memory by issuing a BPF_PROG_QUERY syscall with an undersized bpf_attr buffer that omits the query.revision field introduced in v6.6. The cgroup attach-type code path is the primary hazard: BPF_PROG_QUERY on cgroup types shipped in 2017, and the revision write-back was added years later, creating a real population of legacy callers whose smaller buffers trigger the unconditional OOB write. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the CVSS 7.8 high-impact rating reflects that successful kernel memory corruption can yield full system compromise.
Inconsistent arvif state management in the Linux kernel's ath12k Qualcomm WiFi 7 driver exposes local low-privileged users to kernel memory corruption, information disclosure, and system crash via stale pointer dereference. Three distinct error paths in ath12k_mac_vdev_create() fail to clear or properly unwind arvif->ar and associated vdev/peer state, leaving the driver operating against ghost structures never confirmed in firmware. No public exploit identified at time of analysis, and EPSS probability sits at 0.15% (5th percentile), reflecting low near-term exploitation likelihood despite the 7.8 CVSS score.
Silent data corruption in the Linux kernel nvdimm/btt subsystem results from a broken lane-acquisition locking model that became invalid once BTT lanes were made preemptible. On systems with NVDIMM persistent memory configured in BTT (Block Translation Table) mode, a low-privileged local user can trigger a preemption-induced race where a second task observes a non-zero per-CPU recursion count, incorrectly infers it already holds the lane lock, bypasses mutual exclusion, and concurrently accesses shared per-lane metadata and workspace state, yielding high-integrity and high-confidentiality impact. No public exploit exists and EPSS is 0.18% (8th percentile), but the race is reproducible via the upstream ndctl btt-check.sh unit test and patches are available across all actively maintained stable kernel branches.
Exclusive BPF maps in the Linux kernel can be inserted as inner maps within non-exclusive outer map-in-map structures, allowing any unrelated local BPF program to look up and mutate a map that is supposed to be bound exclusively to a single program by cryptographic hash. This bypasses the signed BPF loader's integrity guarantee - an adversary on a hostile host can rewrite the frozen metadata map contents that the loader has already validated against a signed hash. No public exploit is identified at time of analysis and EPSS is very low (0.18%), but the impact is high for environments relying on exclusive maps as a trust boundary.
Use-after-free in the Linux kernel BPF filesystem (bpffs) inode lifecycle exposes freed kernel memory during concurrent path traversal, enabling local attackers with low privileges to crash the kernel or potentially escalate privileges. The flaw was introduced by commit 4f375ade6aa9, which incorrectly removed the RCU grace-period delay protecting inodes and cached symlink bodies accessible via concurrent RCU pathwalk operations (pick_link, may_lookup). KASAN confirmed the slab-use-after-free at inode offset +2 (i_opflags). No public exploit has been identified and EPSS is very low at 0.17% (7th percentile), with no CISA KEV listing.
Out-of-bounds access in the Linux kernel NVMe Flexible Data Placement (FDP) code allows an attacker who can submit NVMe commands to read beyond the fdpcidx configuration array. An off-by-one in the fdpcidx bounds check (using '>' instead of '>=' against n = NUMFDPC + 1) accepts an index one element past the valid range, tagged by intelligence sources as an information-disclosure issue. Affects Linux 6.16 through the fix; no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile), and the published CVSS 9.8 network vector appears inflated relative to the local/fabric-scoped nature of NVMe command handling.
Use-after-free in Linux kernel's configfs_lookup() allows a local low-privilege attacker to trigger kernel memory corruption via a dangling pointer in configfs_dirent->s_dentry. When inode allocation fails during a directory lookup, the code drops the configfs_dirent reference but neglects to clear ->s_dentry, leaving it pointing at a dentry object that is subsequently freed; a follow-on getdents(2) call in the same directory dereferences that stale pointer to read the inode number, producing the UAF condition. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at 0.17% (7th percentile), but the defect has been latent since Linux 2.6.16 in 2006, meaning a vast range of unpatched production kernels carries the flaw.
Heap out-of-bounds write in the Linux kernel amdgpu DRM driver's `amdgpu_coredump()` function allows a local attacker with GPU access to corrupt kernel heap memory during a GPU reset event. The vulnerability affects Linux kernel versions containing commit eea85914d15b up to the fix commits, specifically Linux 7.1 stable and prior, on systems with AMD GPU hardware. A local user who can trigger or time a GPU ring timeout during an active GPU reset could exploit this heap corruption for potential privilege escalation; however, no public exploit exists and EPSS probability is 0.15% (5th percentile), indicating limited real-world exploitation activity at time of analysis.
Livelock in the Linux kernel's vhost-net subsystem can cause a host denial-of-service against KVM virtualization environments when mergeable receive buffers (VIRTIO_NET_F_MRG_RXBUF) are negotiated between host and guest. The defect in `vhost_get_avail_idx` propagates an incorrect return value through `vhost_enable_notify`, causing the host vhost kernel thread to spin in an immediate disable-then-retry notification loop when the guest is not consuming virtio ring entries fast enough. No public exploit code exists and EPSS stands at 0.17% (6th percentile), but the CVSS Scope Changed (S:C) metric confirms cross-VM-boundary impact on the hypervisor host, making this a meaningful availability risk for KVM-based virtualization fleets.
RB-tree corruption in the Linux kernel iommu/vt-d driver allows a privileged local attacker to corrupt kernel memory structures during device probe error handling, leading to potential kernel panic, privilege escalation, or information disclosure. Affected systems must have Intel VT-d IOMMU enabled and encounter a device that does not support Address Translation Services (ATS) followed by a probe step failure. No public exploit code has been identified and no CISA KEV listing exists, but the Changed Scope (S:C) CVSS flag signals that kernel-level corruption can cascade across process and subsystem boundaries. Upstream fixes are available in stable branches targeting kernel 6.18.40, 7.1.5, and 7.2-rc1.
Local privilege escalation in the Linux kernel's BPF arena subsystem arises from zap_pages() invoking zap_vma_range() without first acquiring the owning mm's mmap_lock, creating a lock-ordering race condition against arena_vm_close() and arena_map_mmap(), both of which acquire mmap_write_lock before arena->lock in reverse order. A low-privileged local user capable of loading BPF programs on affected Linux 6.9+ systems can exploit this AB-BA deadlock opportunity or operate on stale VMA pointers after concurrent unmapping, potentially corrupting kernel memory and escalating privileges. No public exploit code has been identified at time of analysis, and EPSS scores place current exploitation probability at a low 0.15%.
Out-of-bounds kernel memory read in the Linux kernel's ocfs2 filesystem allows disclosure of adjacent kernel data when a maliciously crafted or corrupted ocfs2 volume is mounted and a fast symlink is read. ocfs2_validate_inode_block() failed to validate zero-cluster (fast) symlink dinodes, so ocfs2_fast_symlink_read_folio() would strnlen()/memcpy an inline payload whose i_size exceeds the inline area or lacks a terminating NUL, copying past the inode block buffer (KASAN flagged a 3905-byte over-read via readlink). No public exploit identified at time of analysis; EPSS is low at 0.15% (5th percentile) and the issue is not in CISA KEV.
Integer underflow in the ocfs2 filesystem's FITRIM implementation allows a local low-privileged user to corrupt filesystem data or trigger a crash by submitting a trim range shorter than one cluster. The validation in ocfs2_trim_mainbm() checks against sb->s_blocksize instead of s_clustersize; on filesystems where cluster size exceeds block size, a range that passes the block-size check gets shifted to len==0, after which pointer arithmetic involving start + len - 1 and len -= ... underflows, driving the trim operation past the requested bounds. No public exploit has been identified at time of analysis, and EPSS is 0.18% (7th percentile), consistent with its low real-world exploitation priority.
Use-after-free in the Linux kernel's netfilter conntrack timeout subsystem (nf_ct_timeout) allows a local low-privileged attacker to corrupt kernel memory by exploiting improper reference counting between the data plane and control plane lifecycle of timeout policy objects. Affected versions span from Linux 3.4 through pre-7.1.5/7.2-rc1, covering a very wide range of deployments wherever custom conntrack timeout policies are active. No public exploit code has been identified and EPSS sits at 0.15% (5th percentile), but the local high-impact profile (C:H/I:H/A:H) and the ubiquity of the Linux kernel make patching a clear priority for affected configurations.
Kernel memory corruption in the Linux RDMA/siw (soft-iWARP) driver lets a remote peer trigger a slab use-after-free during connection setup: siw_socket_disassoc() can drop the last reference on an endpoint and free it, after which siw_cm_work_handler() still dereferences the stale endpoint pointer. The demonstrated impact is a KASAN-confirmed use-after-free crash after a malformed MPA request, exploitable only where the siw module is loaded and an iWARP listener is active. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile) with no CISA KEV listing, so the 9.8 NVD score overstates practical risk for typical deployments.
Stale red-black tree node linkage in the Linux kernel BPF subsystem enables a use-after-free condition when a refcounted BPF object survives teardown of its owning rbtree root and that root's memory address is subsequently reused. Local attackers with BPF-capable low-privilege accounts can exploit the incorrect owner validation in bpf_rbtree_remove() to trigger rb_erase_cached() against stale, invalid tree pointers, potentially achieving kernel memory corruption with full confidentiality, integrity, and availability impact. No public exploit code has been identified and EPSS sits at the 6th percentile; patch commits are available across multiple stable branches.
Race condition in the kernfs xattr subsystem of Linux kernel 7.1 and earlier allows local low-privileged users to corrupt shared xattr structures across multiple superblocks, resulting in high-impact confidentiality, integrity, and availability compromise. The flaw arises specifically in namespace-multiplexed environments where kernfs_test_super() allows distinct superblocks to share a single kernfs_node while VFS locking remains per-inode and therefore insufficient. No public exploit has been identified at time of analysis; EPSS probability is 0.15% (5th percentile), indicating that despite the high CVSS score, widespread exploitation is currently assessed as unlikely.
Heap buffer overflow in the Linux kernel wcn36xx WiFi driver allows an adjacent-network attacker without authentication to corrupt kernel heap memory with firmware-controlled content. The vulnerability exists in the synchronous HAL response dispatcher for Qualcomm WCN36xx chipsets, which copies all firmware responses into a fixed 4096-byte buffer without first validating response length. Successful exploitation from an adjacent network position yields high confidentiality, integrity, and availability impact - consistent with potential kernel code execution. EPSS is low at 0.19% and no active exploitation is confirmed, but the lack of authentication requirement and network-adjacent reachability elevate real-world concern for affected embedded and mobile platforms. Patches are available across multiple stable kernel branches.
Out-of-bounds heap read in the Linux kernel's wcn36xx WiFi driver exposes kernel memory and risks system crashes on any adjacent-network attacker within radio range of a device using a Qualcomm WCN36xx series chipset. The flaw, introduced at commit 43efa3c0f241e04862be8e6a68ff765d36cde1ba (Linux 4.11 era), allows the PRINT_REG_INFO firmware indication handler to iterate over rsp->regs[] using a firmware-controlled rsp->count value that is never validated against the actual received message length, enabling reads beyond the heap-allocated buffer. No public exploit has been identified and EPSS is very low at 0.18% (7th percentile), but the CVSS 8.1 score and the availability of patches across seven stable branches make this a concrete patch priority for platforms running Qualcomm WCN36xx hardware.
Sleepable BPF_LSM_CGROUP programs can be loaded into the Linux kernel without verifier rejection, causing a kernel BUG when those programs invoke blocking helpers inside an RCU read-side critical section. The cgroup BPF shim runs under rcu_read_lock_dont_migrate(), which prohibits sleeping; if a program marked BPF_F_SLEEPABLE attaches to an LSM cgroup hook such as file_open and calls bpf_get_dentry_xattr(), the kernel triggers a 'sleeping function called from invalid context' BUG. No public exploit identified at time of analysis; EPSS at 0.17% reflects the niche exploitation path requiring BPF-loading capability.
Race condition exploitation in the Linux kernel's RDMA/nldev subsystem allows a local low-privileged attacker to trigger a use-after-free or stale pointer dereference via racy access to the mr->pd pointer during concurrent rereg_mr and nldev introspection operations, with potential for kernel memory corruption yielding high confidentiality, integrity, and availability impact. The flaw affects Linux 4.18 and later on any system with RDMA-capable hardware, with upstream fixes committed to stable branches at 7.1.5 and 7.2-rc1. No public exploit code exists and EPSS exploitation probability is very low at 0.15%, consistent with the specialized hardware requirement and race timing dependency.
Out-of-bounds slab read in the Linux kernel's ASoC AMD ACP SoundWire legacy machine driver allows a local attacker - or a hardware-triggered probe path - to read beyond an allocated array in create_sdw_dailinks(), potentially causing kernel memory disclosure or denial of service. The vulnerability is introduced when all DAI link entries are initialized, causing the boundary-unchecked loop to walk past the end of the soc_dais allocation. KASAN confirmed the read-of-size-1 in mc_probe(). EPSS is at 0.17% (6th percentile) and the vulnerability is not listed in CISA KEV; no public exploit has been identified at time of analysis. Fixes are available for Linux stable branches 6.18.40 and 7.1.5, as well as the 7.2-rc1 mainline.
Out-of-bounds array read in the Linux kernel's AMD ACP SoundWire SOF audio driver exposes kernel memory to local attackers on systems equipped with AMD SoundWire hardware. The flaw in create_sdw_dailinks() allows iteration past the end of the allocated sof_dais array when all entries are initialized, lacking any bounds guard on the loop termination condition. No active exploitation is recorded (EPSS 0.17%, 6th percentile; no CISA KEV entry), and patches are available across multiple Linux stable branches.
Lockless directory traversal in the Linux kernel configfs subsystem allows a low-privileged local user to race concurrent lseek() operations against directory iteration, corrupting or dereferencing freed cursor objects in kernel memory. Affecting all Linux kernels from version 2.6.27 through multiple long-term stable branches (fixed in 7.1.5, 6.18.40, 6.12.97, 6.6.145, 6.1.178, 5.15.212, and 5.10.261), successful exploitation could yield full kernel privilege escalation with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and EPSS sits at 0.18% (7th percentile), indicating low near-term exploitation probability.
Use-after-free in the Linux kernel iommufd subsystem allows a local low-privileged attacker on IOMMU-enabled systems to corrupt kernel memory by triggering dmabuf invalidation callbacks against already-destroyed page structures during detach. Affected configurations include virtualization hosts using VFIO or vDPA device passthrough where the iommufd framework is active. The CVSS S:C (Changed Scope) rating reflects the potential for cross-workload impact in multi-tenant environments; no public exploit identified at time of analysis, and EPSS at 0.15% (5th percentile) indicates negligible observed exploitation activity.
Use-after-free in the Linux kernel mt76 MediaTek WiFi driver allows a local low-privileged attacker to dereference freed memory during concurrent TX datapath operations, potentially achieving full kernel compromise (C:H/I:H/A:H). The flaw exists in mt76_put_vif_phy_link(), where kfree() is called on an offchannel link structure immediately after rcu_assign_pointer(NULL) - without synchronizing against in-flight RCU readers in the TX softirq path (mt7996_mac_write_txwi) that already hold the pointer. No public exploit is identified at time of analysis, and EPSS of 0.17% (6th percentile) confirms very low current exploitation activity despite a CVSS score of 7.8.
Token resource leak in the Linux kernel mt7996 WiFi driver (mt76 subsystem) allows an adjacent unauthenticated attacker to exhaust TX tokens by repeatedly triggering failed link_conf or link_sta lookups in mt7996_tx_prepare_skb(), potentially degrading or crashing WiFi functionality on affected devices. The provided CVSS 8.8 score with C:H/I:H/A:H is notably high for what the description characterizes as a resource management bug; the actual impact most closely aligns with denial-of-service through token exhaustion, not direct confidentiality or integrity compromise. No public exploit code exists and EPSS sits at 0.17% (6th percentile), indicating minimal current exploitation interest. Patches are available in Linux 6.18.40, 7.1.5, and 7.2-rc1.
Invalid pointer dereference in the Linux kernel btrfs delayed reference processing loop (`__btrfs_run_delayed_refs()`) allows a local attacker with access to a btrfs-mounted volume to crash the kernel, causing a denial of service. The defect was introduced by a refactoring commit (0110a4c43451) that inadvertently removed safety guards which reset an internal pointer to NULL when `btrfs_select_ref_head()` returns `ERR_PTR(-EAGAIN)`, causing a subsequent `spin_lock()` call on the error code value treated as a pointer address. No public exploit code has been identified and EPSS probability is 0.18% (7th percentile), though patches are available across all active stable kernel branches.
Linux kernel ixgbe driver on Intel E610 adapters triggers a KASAN slab-out-of-bounds write when an XDP program is loaded on hosts with 64 or more logical CPUs. The root cause is a queue-count mismatch: MSI-X constraints cap the netdev at 63 queue pairs on E610, but XDP allocates 64 queues on ≥64-CPU systems, causing netif_set_xps_queue() to write 4 bytes beyond the allocated slab at queue index 63. With EPSS at 0.15% (5th percentile), no KEV listing, and hardware-specific trigger conditions, real-world exploitation is low-probability but not negligible in high-CPU-count data center environments running this Intel hardware.
Resource leak in the Linux kernel NFS server (NFSD) allows connected NFS clients to cause a denial-of-service condition by sending FREE_STATEID for an admin-revoked parallel NFS (pNFS) layout stateid. The kernel function nfsd4_drop_revoked_stid() lacks handling for the SC_TYPE_LAYOUT case, causing the stateid to remain allocated in the IDR tree and on the per-client list indefinitely rather than being properly unhashed and freed. No public exploit exists and EPSS is 0.17% (6th percentile), but the unauthenticated network vector and availability impact score of 7.5 warrant attention on NFS servers with pNFS layouts enabled. Vendor-released patches are available in stable kernel branches.
Incorrect file-handle hashing in the Linux kernel's lockd (NLM) server causes NLMv4 lock-state lookups to fail intermittently. When a client presents an NFS file handle shorter than LOCKD_FH_HASH_SIZE (32 bytes), file_hash() digests stale bytes left in the argument buffer from a prior request, so the same wire handle hashes into different nlm_files[] buckets across calls and nlm_lookup_file() misses existing lock records. This is a functional-correctness and reliability defect introduced by commit 3de744ee4e45 during the xdrgen NLMv4 TEST conversion; a vendor patch is available, EPSS is low (0.15%), and there is no public exploit identified at time of analysis and no CISA KEV listing.
Unsafe destructor execution in the Linux kernel BPF subsystem allows a local attacker with BPF program loading privileges to trigger memory corruption by causing map value cleanup routines to run from NMI (Non-Maskable Interrupt) context. The flaw affects array and hashtab BPF maps containing special fields such as referenced kptrs, uptr, timer, workqueue, and graph roots - destructors for these types are not NMI-safe, yet tracing BPF programs can invoke map update or delete operations from that context. No active exploitation has been identified (not in CISA KEV); EPSS is 0.17% (7th percentile), consistent with a locally-exploitable kernel flaw requiring specialized capabilities.
Use-after-free in the Linux kernel VDUSE (vDPA Device in Userspace) subsystem allows a local low-privileged user to corrupt kernel memory and escalate privileges to full kernel control. The flaw exists in vduse_dev_open(), which releases vduse_lock after an IDR lookup but before acquiring dev->lock, creating a race window where a concurrent VDUSE_DESTROY_DEV ioctl can remove and free the same struct vduse_dev object - causing the open path to later dereference freed memory. No public exploit code and no CISA KEV listing are identified at time of analysis, and EPSS sits at 0.17% (7th percentile), indicating low current exploitation probability despite a high CVSS score of 8.8.
Out-of-bounds kernel memory access in the Linux kernel vhost/vdpa subsystem allows a local attacker with low privileges to crash the system or trigger invalid physical memory mappings via crafted mmap operations. The vhost_vdpa_mmap() and vhost_vdpa_fault() functions accept a user-controlled virtqueue index from vma->vm_pgoff without validating it against the driver's configured queue count (v->nvqs), while the ioctl path already enforces both a bounds check and array_index_nospec(). Patches are available across all active stable branches; EPSS is 0.18% (7th percentile) and the vulnerability is not listed in CISA KEV.
Guest kernel crash in the Linux virtio RTC driver occurs during device restore when stale virtqueues are not cleaned up before reinitialization. Systems running virtual machines with a virtio-rtc device exposed are affected across Linux kernel versions up to 6.18.40 and 7.1.5 stable series. A local low-privileged user on the guest who triggers a suspend/resume cycle under conditions where virtqueue reinitialization fails can dereference a NULL info pointer in vp_del_vq(), panicking the guest kernel. No public exploit is identified at time of analysis, and EPSS of 0.17% (6th percentile) confirms exploitation is not currently widespread.
Local memory corruption in the Linux kernel's vhost-net driver arises from mishandling of zerocopy TX completion: vhost_zerocopy_complete() treats every ubuf_info callback as a finished vhost descriptor, so when the networking stack clones a zerocopy skb (e.g. batman-adv fragmentation via skb_split/skb_zerocopy_clone, or veth forwarding via skb_copy_ubufs) and a backend reset frees the vhost_net_ubuf_ref, a later delayed completion dereferences the freed ubufs pointer - a slab use-after-free confirmed by KASAN. It affects virtualization hosts running vhost-net with zerocopy TX, and a successful trigger yields kernel memory corruption (crash and potential privilege escalation). There is no public exploit identified at time of analysis, EPSS is low (0.17%), and a vendor patch is available across multiple stable branches.
Incorrect IRQ-to-ring mapping in the Linux kernel's vdpa/octeon_ep driver mishandles interrupt routing on Marvell OCTEON EP devices that expose non-contiguous or non-zero-based IRQ numbers, causing the interrupt handler to index the wrong virtqueue ring. Only systems with OCTEON EP hardware using the vDPA data path are affected, and the fix ships in stable kernels 6.18.40, 7.1.5, and 7.2-rc1. There is no public exploit identified at time of analysis, EPSS is very low (0.17%, 6th percentile), and the published 10.0 CVSS vector is inconsistent with the local, hardware-specific nature of the flaw.
Out-of-bounds write in the Linux kernel's vfio/qat driver allows a local low-privileged user with access to the Intel QuickAssist Technology virtual function migration interface to corrupt kernel memory through a race condition. The root cause is a Time-of-Check Time-of-Use flaw in qat_vf_resume_write(), where two concurrent writers can both pass the filp->f_pos boundary check before the lock is held, causing the second writer to copy data past the end of the migration-state buffer once the first writer has already advanced the file position. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% at the 6th percentile reflects low current exploitation probability; vendor-released patches are available in stable kernel series 6.12.97, 6.18.40, and 7.1.5.
Out-of-bounds memory access in the Linux kernel BPF cgroup storage subsystem exposes multiple stable kernel branches to local privilege escalation, stemming from an incomplete fix for predecessor commit abad3d0bad72. A local attacker with CAP_BPF privilege can construct a tail call chain using a storage-less intermediate BPF program as a bridge between two cgroup-storage-using programs (A→B(no storage)→C(storage)), bypassing cookie validation and causing runtime cgroup local storage in the callee to operate on the original caller's context, triggering an out-of-bounds kernel memory access with C:H/I:H/A:H impact. EPSS is low at 0.17% (7th percentile) and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Use-after-free in the Linux kernel Bluetooth HCI core subsystem allows a local attacker with low privileges to corrupt kernel memory and potentially escalate privileges or crash the system. The hci_unregister_dev() function fails to quiesce cmd_timer and ncmd_timer delayed work items before freeing the hci_dev structure, creating a race window where timer callbacks dereference stale memory including the hdev->reset function pointer. EPSS is very low at 0.17% (6th percentile), no active exploitation has been confirmed, and patched versions are available across multiple Linux stable kernel branches.
Out-of-bounds memory read in the Linux kernel Bluetooth HCI subsystem enables a malformed or malicious Bluetooth controller response to the Read Local Codec Capabilities command to cause the kernel to copy one byte beyond the HCI response payload into the codec list. All kernel versions from 5.16 onward that include Bluetooth codec capability support are affected, and fixed stable releases are available across the 6.1, 6.6, 6.12, 6.18, and 7.1 branches. No public exploit has been identified, and the 7th-percentile EPSS score of 0.17% indicates negligible opportunistic exploitation risk at this time.
Undefined behavior from a signed integer overflow in the Linux kernel's RDMA/mlx5 driver exposes systems with Mellanox ConnectX RDMA hardware to local privilege escalation or kernel crash. The flaw in set_rq_size() accepts user-supplied rq_wqe_shift values up to and including 32, causing signed 32-bit integer overflow when computing '1 << rq_wqe_shift' - undefined behavior under the C standard that can corrupt kernel memory structures. The vulnerability carries a CVSS 7.8 High score but EPSS of just 0.18% (7th percentile) and is absent from CISA KEV, indicating no public exploit or active exploitation at time of analysis.
Incorrect UAR index release in the Linux kernel RDMA/mlx5 driver allows a local attacker with low privileges to corrupt kernel-level resource tracking structures, potentially enabling privilege escalation, information disclosure, or denial-of-service via kernel crash. All kernel versions from 4.16 through the fixed stable releases (6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5) are affected on systems equipped with Mellanox/NVIDIA ConnectX RDMA hardware. No public exploit code or active exploitation has been identified; EPSS stands at 0.17% (7th percentile), indicating very low current exploitation probability.
Out-of-bounds read in the Linux kernel's ASoC hdac_hdmi HDMI audio codec driver allows a local attacker with low privileges to expose sensitive kernel memory or crash the kernel by writing a crafted out-of-range enum value to the ALSA control interface. The flaw exists in hdac_hdmi_set_pin_port_mux(), which indexes the texts array using the attacker-supplied value before the bounds-checking helper snd_soc_dapm_put_enum_double() has a chance to reject it. Patches are confirmed available across seven stable kernel branches; with an EPSS of 0.17% and no CISA KEV listing, no active exploitation has been identified at time of analysis.
Missing input validation in the Linux kernel's ASoC Meson AIU audio driver allows a local low-privileged attacker to supply out-of-range enum values to HDMI and internal codec mux put callbacks, triggering snd_soc_enum_item_to_val() on unvalidated input and resulting in out-of-bounds kernel memory access. Systems running Linux 5.7 through pre-7.1.5 on Amlogic Meson SoC hardware are affected, with potential for high confidentiality impact (kernel memory disclosure), limited integrity impact, and kernel crash (availability). No public exploit code exists and exploitation probability is very low (EPSS 0.15%, 5th percentile), but the local attack vector and low privilege requirement mean any user with ALSA device access on affected hardware is a potential threat actor.
Input validation bypass in the Linux kernel's FSL audmix ASoC driver allows a local low-privileged user to write out-of-range enum values to ALSA mixer controls, triggering out-of-bounds memory access in kernel space with potential for privilege escalation or kernel memory disclosure. Specifically, fsl_audmix_put_mix_clk_src() uses an unvalidated value in a BIT() shift operation, and fsl_audmix_put_out_src() uses it to index the prms transition table, both before any bounds check is performed. No public exploit exists and EPSS is extremely low (0.18%, 7th percentile), but the CVSS score of 7.8 reflects the high kernel-level impact if exploited on hardware where the driver is active.
Out-of-bounds array read in the Linux kernel's ASoC Tegra audio driver (tegra210_ahub) allows a local attacker with low privileges to disclose kernel memory contents or trigger a kernel panic on NVIDIA Tegra 210-based systems. The flaw in tegra_ahub_put_value_enum() accesses e->values[item[0]] before validating that item[0] falls within the valid enum range, making the existing bounds check ineffective. Patches are confirmed across multiple stable kernel branches; no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Linux kernel's IPv4 Forwarding Information Base (FIB) subsystem enables a local low-privileged attacker to corrupt kernel memory, potentially escalating to root. The flaw manifests in fib_leaf_notify() when network device driver callbacks - mlxsw, rocker, and nsim - invoke refcount_inc() on a dying fib_info object under RCU, violating reference-counting safety and triggering the 'addition on 0; use-after-free' kernel warning confirmed by syzbot. Patches are available in Linux 7.1.5 stable and 7.2-rc1; no public exploit or CISA KEV listing has been identified at time of analysis.
Concurrent use-after-free-adjacent race condition in the Linux kernel's FIB rules subsystem allows a local low-privileged user to trigger a kernel refcount complaint - and potentially a system crash or memory corruption - by racing a FIB rules dump against the teardown of a dying fib_rule object. Affected versions span multiple long-term stable branches from 4.12 onward through 7.x series kernels prior to the backported fix commits. No public exploit has been identified at time of analysis, and the EPSS score of 0.18% (7th percentile) reflects low exploitation probability; exploitation is not confirmed in the CISA KEV catalog.
Out-of-bounds read in the Linux kernel's SCTP protocol implementation allows a malicious SCTP peer to trigger memory over-reads during INIT or ASCONF chunk processing. The flaw stems from insufficient validation of an embedded address parameter's declared length inside ADD_IP, DEL_IP, and SET_PRIMARY ASCONF parameters, letting a crafted peer advertise a length exceeding the enclosing parameter's bounds. No public exploit has been identified at time of analysis, EPSS is low (0.18%), and it is not on CISA KEV, but the CVSS 9.1 score reflects remote unauthenticated reachability against SCTP-enabled hosts.
Incorrect teardown ordering in the Linux kernel's netkit queue lease subsystem allows a local attacker with low privileges to trigger a race window where live NAPI polling consumes net_iov entries whose DMA addresses have already been cleared, causing the physical NIC to DMA to a stale or zero address. Affected kernel versions span from the introducing commit 5602ad61ebee through the 7.1 stable series, with fixes landing in 7.1.5 and 7.2-rc1. No public exploit code exists and EPSS probability stands at 0.15%, but the S:C scope change in the CVSS vector signals that successful exploitation can corrupt memory beyond the vulnerable process boundary, potentially enabling privilege escalation.
Privilege escalation in the Linux kernel's TIPCv2 generic netlink interface exposes mutating operations - including TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and bearer enable/disable - to any local unprivileged process. The legacy TIPCv1 netlink API already enforces CAP_NET_ADMIN via netlink_net_capable(), but TIPCv2's generic netlink handlers omit the GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM flags, creating an enforcement gap. A QEMU/KASAN reproducer running as uid/gid 65534 with zero effective capabilities confirmed the flaw: an attacker can alter network identity, inject or flush cryptographic key material, and disrupt bearer connectivity. No public exploit has been identified and EPSS is very low (0.21%), but the primitives are straightforward for any local user.
TIPC connection send-side denial of service in the Linux kernel allows a remote TIPC peer to permanently wedge a connection by sending a crafted CONN_ACK message with an inflated acknowledgment count. When the peer-supplied count exceeds the unsigned 16-bit snt_unacked counter in tipc_sk_conn_proto_rcv(), integer underflow wraps the counter to a near-maximum value, causing tsk_conn_cong() to report congestion indefinitely and blocking all further transmits on that connection. This affects Linux kernels from the commit that introduced TIPC connection ack handling (around 4.7) through multiple stable branches prior to the backported fixes. No public exploit has been identified and EPSS is 0.21% (12th percentile), indicating low opportunistic risk despite the AV:N CVSS rating.
Unbounded kernel memory exhaustion in the Linux kernel TIPC subsystem allows a malicious peer node to cause a denial-of-service condition by sending PUBLICATION messages with inverted service-range bounds (lower > upper). Kernels from version 4.17 onward accept these malformed bindings in the name-distribution network receive path - unlike the local bind path, which enforces ordering via tipc_uaddr_valid() - causing service_range rbtree entries and associated publication structures to be permanently leaked with no per-peer cap, for the lifetime of the namespace. No public exploit or CISA KEV listing exists, and EPSS is very low (0.21%, 11th percentile), but the attack is mechanically straightforward for any attacker already operating as a TIPC peer.
Improper error-path cleanup in the Linux kernel's Marvell OcteonTX crypto hardware-accelerator driver (crypto/marvell/octeontx) mishandles DMA unmapping: on a mapping failure the sg_cleanup loop indexes list[i] instead of list[j], leaking successfully mapped scatter-gather entries while repeatedly unmapping the already-failed one. Only systems with Marvell OcteonTX crypto hardware and this driver loaded are affected. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile) and the issue is not in CISA KEV.
Resource-leak and repeated-unmap defect in the Linux kernel's Cavium/Marvell CPT cryptographic accelerator driver (crypto/cavium/cpt) mishandles its DMA error-cleanup path, using the outer loop index (list[i]) instead of the inner index (list[j]) so that successfully mapped scatter-gather entries leak while the single failed entry is unmapped repeatedly. It affects only systems running the cavium CPT driver against OcteonTX CPT hardware, is reachable solely when a DMA mapping failure occurs during request setup, and is a local reliability/resource-management bug rather than a remotely exploitable code-execution flaw. No public exploit identified at time of analysis; EPSS is 0.18% (7th percentile) and it is not in CISA KEV.
Corrupted DMA length assignments in the Linux kernel's iommu/dma-iommu subsystem allow a local attacker with low privileges to trigger memory corruption through the PCI Peer-to-Peer DMA (P2PDMA) code path, potentially achieving confidentiality, integrity, and availability impact across scope boundaries. The flaw stems from a variable typo in iommu_dma_map_sg() where multi-segment P2PDMA scatterlists receive the head segment's length for all entries, corrupting DMA mappings and leading to out-of-bounds memory operations. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.19% (9th percentile) reflects low observed exploitation probability.
Out-of-bounds kernel memory access in the Linux kernel CXL (Compute Express Link) region driver allows a local attacker on systems equipped with CXL memory hardware to corrupt kernel memory by causing cxl_cancel_auto_attach() to use a negative errno value as an array index into p->targets[]. The flaw originates when cxl_region_sort_targets() fails - setting cxled->pos to a negative errno - and that invalid index is later used directly without validation. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.15% at the 5th percentile, reflecting very low real-world exploitation probability consistent with the niche CXL hardware requirement.
Missing authorization on the handshake genl family's DONE downcall in Linux kernel 6.4 and later allows a local low-privileged process to forge TLS handshake completion signals to the kernel's TLS infrastructure. Any unprivileged user that can observe or guess a valid sockfd associated with an in-flight handshake request can submit a crafted DONE message - either with STATUS=0 to make the kernel consumer accept a session as if TLS authentication succeeded, or with a non-zero status to abort a legitimate handshake before the trusted agent tlshd can report its real result. No public exploit has been identified at time of analysis, and EPSS is very low (0.17%), but patches are confirmed across multiple stable branches.
Memory corruption in the Linux kernel's bnxt (Broadcom NetXtreme) Ethernet driver arises when an XDP program grows the packet head, causing a head-pointer underflow in bnxt_rx_multi_page_skb that drops a page-pool fragment reference on the wrong page or fragment. This corrupts page-pool refcounts, allowing a page to be recycled while still in use and producing a double free on driver teardown, which realistically manifests as a kernel crash or memory corruption on hosts using Broadcom bnxt NICs with native XDP. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS is low at 0.15% (5th percentile).
Local denial-of-service / kernel-warning condition in the Linux kernel TCP stack allows a race during failed connection setup to trip a socket-lock assertion when eBPF sock_ops callbacks are in use. When a listener has a BPF sock_ops program with BPF_SOCK_OPS_STATE_CB_FLAG attached, a child socket that fails setup in tcp_v4/v6_syn_recv_sock() is force-closed without its socket lock held, causing tcp_done() -> tcp_set_state() -> tcp_call_bpf() to fire sock_owned_by_me() and emit a WARNING. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and the issue is not in CISA KEV; the headline CVSS 9.8 is inconsistent with the actual local, privilege- and race-dependent nature of the bug.
Memory corruption in the Linux kernel network scheduler (net/sched/sch_codel) allows a privileged local user to trigger a wild/dangling pointer dereference by mis-accounting queue length during the CoDel peek operation. When CoDel drops packets during peek it calls qdisc_tree_reduce_backlog before re-incrementing qlen; if qlen momentarily hits zero while peek still returns an skb, the parent qdisc's qlen_notify prematurely deactivates the class, corrupting scheduler state (demonstrated as a KASAN wild-memory-access in qfq_deactivate_agg when qfq parents a codel child). No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and this is not in CISA KEV.
Refcount tracking race in the Linux kernel's network watchdog subsystem enables a local low-privilege user to crash the kernel via list corruption. The flaw originates from a commit that introduced `dev->watchdog_dev_tracker` to store reference tracking state without adding synchronization between `netdev_watchdog_up()` and the `dev_watchdog()` timer, allowing the pointer to be concurrently overwritten or freed. The observable outcome is a `list_del` corruption BUG followed by a kernel Oops, confirmed by syzbot; no public exploit exists and the vulnerability is not in CISA KEV, with EPSS at 0.20% (10th percentile). Patches are available in stable kernel releases.
Race condition in the Linux kernel's KCM (Kernel Connection Multiplexor) subsystem exposes systems to potential privilege escalation, memory corruption, and information disclosure when KCM sockets are in active use on multi-CPU systems. The kcm_attach() and kcm_unattach() functions modify live TCP socket callback pointers (sk_data_ready, sk_write_space) via plain stores rather than WRITE_ONCE(), violating the kernel's memory visibility contract and allowing a concurrent CPU to invoke a KCM handler against a mismatched sk_user_data pointer. No active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.19% (9th percentile), but vendor-supplied patches are available across all active stable kernel branches.
Netfilter's nf_dup_netdev component in the Linux kernel exposes a race condition in nft_dup and nft_fwd expressions where the absence of Bottom Half disabling during skb transmission permits CPU migration, causing imbalanced decrementation of xmit recursion counters. A locally authenticated low-privilege user who can influence netfilter packet processing paths may exploit this counter imbalance to escalate privileges or destabilize the kernel. No public exploit code has been identified at time of analysis, and EPSS probability sits at a low 0.19%, indicating limited current exploitation interest despite the high CVSS base score.
Missing access_ok bounds validation in the Linux kernel's BPF uprobe_multi subsystem exposes systems running affected kernel versions to local privilege escalation, kernel memory disclosure, and system crash. Low-privileged local users on systems within the vulnerable commit range - spanning Linux 6.6 and related stable branches - can submit crafted user-space pointers via uprobe_multi BPF configuration that the kernel reads using __get_user without prior bounds verification. No public exploit identified at time of analysis, and EPSS of 0.19% at the 9th percentile reflects low current exploitation activity, but the full C:H/I:H/A:H CVSS impact triad warrants prompt kernel patching on multi-tenant and shared-access systems.
Use-after-free in the Linux kernel's BPF sockmap UDP receive path allows a local low-privileged attacker to corrupt kernel heap memory, enabling potential privilege escalation, kernel memory disclosure, or system crash. The race condition in udp_bpf_recvmsg() allows concurrent threads to access a sk_msg structure after it has been freed, because a prior refactor removed the lock_sock() serialization that TCP and AF_UNIX sockets retain. Discovered by Google's syzbot automated fuzzer on Google Compute Engine; no public exploit beyond that reproduction harness and no CISA KEV listing exist at time of analysis.
Integer overflow in the Linux kernel's BPF sockmap helper `bpf_msg_pop_data()` enables a local privileged attacker to bypass scatterlist bounds checks, causing an out-of-bounds traversal that dereferences a null or non-canonical page pointer and crashes the kernel. Affected are all kernel stable series from 5.10 through pre-7.2, with patches confirmed across eight stable branches. No public exploit has been identified at time of analysis and the EPSS score of 0.21% (12th percentile) indicates negligible current exploitation activity, though the confirmed kernel crash impact and High CVSS score warrant prompt patching on systems using BPF sockmap.
Denial of service (and potential memory corruption) in the Linux kernel's TIPC networking subsystem arises from a use-after-free in tipc_l2_send_msg(); when a TIPC L2 bearer is disabled, tipc_disable_l2_media() runs synchronize_net() while b->media_ptr still references the underlying net_device, letting concurrent RCU readers keep sending on a device that is subsequently freed. Syzbot reproduced the slab-use-after-free via ipvlan_hard_header(). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.18%, 7th percentile), consistent with a race-condition kernel bug rather than a mass-exploited flaw.
NULL pointer dereference in the Linux kernel's TCP/IPv6 stack crashes the kernel when a system with a large-MTU interface processes oversized TCP segments whose GSO size collides with the GSO_BY_FRAGS magic value (0xFFFF). Systems running Linux kernel from commit 3953c46c onwards with jumbo-frame or high-MTU IPv6 interfaces are affected across multiple stable branches up to and including 7.1.4. A remote, unauthenticated attacker capable of establishing a TCP/IPv6 session with a vulnerable host can induce a kernel panic, causing a full denial of service. No public exploit code has been identified at time of analysis, and EPSS probability is very low (0.21%, 12th percentile).
Use-after-free race condition in the Linux kernel RDMA/bnxt_re driver allows a local attacker with low privileges to write data to a freed kernel memory page, potentially enabling privilege escalation or kernel crash. The vulnerability affects systems running the Broadcom NetXtreme-E RDMA driver across multiple stable kernel branches, with confirmed fixes in kernel versions 7.1.5, 6.18.40, and 7.2-rc1. No public exploit code has been identified and EPSS probability sits at 0.20% (10th percentile), reflecting the narrow hardware prerequisite that sharply limits the exposed population.
Use-after-free race condition in the Linux kernel's RDMA bnxt_re driver allows a local low-privileged user to corrupt kernel memory by triggering a Notification Queue (NQ) interrupt that writes to a freed CQ toggle page during Completion Queue teardown. Systems running Linux kernel versions prior to 7.1.5 or 7.2-rc1 with Broadcom NetXtreme-E/C RDMA-capable adapters are affected. No public exploit or active exploitation has been identified; EPSS remains at 0.15% (5th percentile), reflecting low real-world exploitation probability at time of analysis.
Kernel memory corruption in the Linux RDMA bnxt_re (Broadcom NetXtreme) driver allows a local low-privileged user to trigger undefined hardware behavior by submitting WQE (Work Queue Entry) mode values that exceed the 64K hardware maximum or are zero, with no bounds validation applied. The CVSS vector (AV:L/AC:L/PR:L/S:C/C:H/I:H/A:H, score 8.8) reflects that a local unprivileged process interacting with RDMA verbs can cause a scoped kernel-level impact, including potential memory corruption or system crash. No public exploit has been identified at time of analysis, and EPSS at 0.15% (5th percentile) indicates very low observed exploitation probability, but the scope change to kernel space makes this a meaningful risk in environments deploying Broadcom RDMA adapters.
Improper error handling in the Linux kernel's RDMA/bnxt_re driver (Broadcom NetXtreme RoCE) causes bnxt_qplib_alloc_dpi() to report success even when the underlying ioremap() call fails, leaving callers to operate on an unmapped/invalid Doorbell Page Index resource. Affected kernels are 6.5 and later on systems using the bnxt_re driver with Broadcom RDMA-capable NICs. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is very low (0.15%), so the practical risk is confined to local DoS/robustness rather than remote compromise, despite the high assigned CVSS of 9.2.
Improper resource handling in the Linux kernel's RDMA bnxt_re driver (Broadcom NetXtreme RoCE) allows a local user with access to the uverbs interface to trigger a race and an error-path resource leak by repeatedly requesting write-combining (WC) mmap pages for the same ucontext. The driver historically supported only one WC page per ucontext without a serializing lock, so concurrent or repeated requests could race and, on mmap-insert failure, leak the mapped Doorbell page index. The published CVSS is 9.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), but this reflects the Linux CNA's conservative scoring convention; EPSS is 0.21% (11th percentile), it is not on CISA KEV, and no public exploit identified at time of analysis.
Race condition in the Linux kernel's RDMA/irdma (Intel Ethernet RDMA) driver arises from a legacy waitqueue-plus-flag synchronization pattern that lacked memory barriers around the request_done flag; maintainers resolved it by switching to a completion primitive. Kernels from 5.14 onward that load the irdma module are affected, but the defect is a local concurrency bug in a specific hardware driver, not the remote unauthenticated code execution its CVSS 9.8 rating implies. No public exploit identified at time of analysis, EPSS is low (0.16%, 6th percentile), and it is not in CISA KEV.
Kernel memory corruption in the Linux networking stack lets a local actor trigger a slab use-after-free in the packet-processing path (fib_rules_lookup) via a TOCTOU race in enqueue_to_backlog(). The flaw affects the per-CPU backlog flushing during device unregistration/network-namespace teardown, where a lockless transmitter such as veth_xmit can queue a packet that escapes flush_all_backlogs() and is later dereferenced after free. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and it is not on CISA KEV, so this is a defect fixed upstream rather than an actively-exploited threat.
Use-after-free in the Linux kernel's ksmbd in-kernel SMB server allows a low-privileged authenticated SMB client to dereference freed kernel memory, potentially achieving arbitrary kernel-level code execution or sensitive information disclosure. The race condition exists between `same_client_has_lease()` releasing `ci->m_lock` without holding a reference on the returned `opinfo` pointer and a concurrent SMB CLOSE operation freeing that same object. Affected kernels span the 5.15 through 7.1 stable series; patches are confirmed available across all branches. No public exploit code or CISA KEV listing has been identified at time of analysis, and an EPSS of 0.18% (8th percentile) indicates no currently observed widespread exploitation.
Kernel-level use-after-free in the Linux 9p RDMA transport (net/9p, trans_rdma.c) arises from a race on the unsynchronized rdma->state field, where recv_done() in softirq context and p9_cm_event_handler() mutate state without the req_lock that rdma_request() relies on. Concurrent teardown can silently overwrite a FLUSHING transition with CLOSING, corrupting the connection state machine and freeing RDMA request objects still in use - enabling denial of service and potential local privilege escalation on systems mounting 9p over RDMA. No public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and the flaw is not in CISA KEV.
Use-after-free in the Linux kernel staging nvec driver's nvec_rx_completed() function exposes Tegra-based systems to potential kernel memory corruption. The flaw arises from a TOCTOU race: nvec_msg_free() releases a message pool slot atomically, but the immediately following read of nvec->rx->data[0] occurs after that release - allowing a concurrent nvec_msg_alloc() to reclaim and overwrite the same slot. No public exploit has been identified at time of analysis, and the very low EPSS score (0.18%, 8th percentile) reflects the niche Tegra hardware prerequisite and staging driver context. Fixed commits are available across multiple stable kernel branches.
Out-of-bounds memory access in the Linux kernel's SoundWire audio subsystem exposes local low-privilege users on affected kernel versions to potential privilege escalation to root. The off-by-one loop error in sdw_add_element_group_count, discovered via Google's syzkaller fuzzer, allows iteration to read beyond valid array bounds when the iterator equals the element count, potentially corrupting adjacent kernel memory. No active exploitation is confirmed (no CISA KEV entry), and an EPSS of 0.21% at the 11th percentile reflects minimal real-world exploitation activity at time of analysis, though the local vector and low privilege requirement mean any authenticated user on a SoundWire-equipped system is theoretically within scope.
Out-of-bounds memory access in the Linux kernel PCI ROM parsing subsystem crashes or leaks kernel memory on both x86_64 and arm64 architectures. The `pci_get_rom_size()` function fails to validate ROM image header and PCI data structure pointer bounds before dereferencing them, allowing a crafted or malformed PCI ROM space to induce a kernel page fault (x86_64) or alignment fault (arm64). Any local actor able to trigger a PCI ROM sysfs read against a device with a broken ROM region can crash the kernel (DoS) or expose kernel memory contents (information disclosure). EPSS is 0.21% with no KEV listing, indicating no confirmed broad exploitation, though the local crash path is straightforwardly reproducible as demonstrated by stress-ng.
Kernel panic in Linux CoreSight platform driver exposes ARM systems to local denial-of-service via a NULL pointer dereference on the error cleanup path. The counter tracking output and input connections is incremented before confirming that the backing allocation succeeded; when devm_krealloc_array() or devm_kmalloc() returns ENOMEM, the cleanup routine coresight_release_platform_data() walks the inflated counter and dereferences the resulting NULL or uninitialized garbage pointer, panicking instead of returning gracefully. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), and the absence of KEV listing reflects low observed exploitation. Vendor-released patches are available in Linux 7.1.5 (stable) and 7.2-rc1 (mainline).
Shift-out-of-bounds undefined behavior in the Linux kernel's MAX3421E USB host controller driver (`max3421-hcd`) allows a local low-privileged user with access to the raw USB device node to corrupt kernel hub state. The `max3421_hub_control()` function blindly shifts the integer constant 1 left by an attacker-controlled `wValue` field without bounds-checking, so any value ≥ 32 invokes undefined behavior that arbitrarily corrupts `max3421_hcd->port_status`, including immutable change bits that gate internal state transitions. No public exploit exists and this CVE is not in the CISA KEV catalog; EPSS at 0.25% (16th percentile) reflects low exploitation likelihood, but the CVSS 7.8 is grounded in a genuine local privilege-escalation primitive within the kernel USB subsystem.
Double-decrement of the descriptor_busy reference counter in the Linux kernel's GPIB driver re-introduces a use-after-free condition that a prior security patch (commit d1857f8296dc) was specifically designed to prevent. Affected kernels include the 6.18.22-6.18.39 range and Linux 7.0, with patched releases available at 6.18.40, 7.1.5, and 7.2-rc1. Exploitation requires a local low-privilege account and access to GPIB device nodes; no public exploit code has been identified at time of analysis, and the EPSS score of 0.19% reflects negligible observed exploitation activity.
Out-of-bounds memory access in the Linux kernel's xilinx-ams IIO ADC driver allows a local low-privileged user to corrupt kernel memory through malformed event handling in ams_handle_event(). Affected versions span multiple stable kernel branches beginning with the commit that introduced the xilinx-ams driver, with the flaw present from Linux 5.17 onward across the 6.1, 6.6, 6.12, 6.18, and 7.1 stable series. No public exploit exists and EPSS sits at 0.18% (8th percentile), though vendor-released patches are confirmed across six stable branches and the CVSS 7.8 score reflects genuine kernel memory corruption potential on affected Xilinx hardware platforms.
Slab-out-of-bounds read in the Linux kernel ntfs3 filesystem driver exposes kernel heap memory and can cause a denial of service when a crafted NTFS volume is mounted. The flaw resides in `run_get_highest_vcn()`, which iterates over NTFS mapping-pairs buffers with no length bound, trusting a 0x00 terminator that a crafted $LogFile UpdateMappingPairs record can omit; the bug fires unconditionally during `ntfs_fill_super` on mount of the malicious image. Affected stable series span Linux 6.1.x through 7.0.x; the EPSS score is 0.18% (8th percentile) and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.
Out-of-bounds memory access in the Linux kernel RDMA/rxe (Soft RoCE) subsystem enables a local low-privileged attacker to corrupt kernel heap data or leak sensitive memory, potentially achieving local privilege escalation. The non-SRQ receive path in rxe_resp_check_length() and copy_data() reads WQE fields directly from a userspace-mapped shared buffer without snapshotting them first, creating a TOCTOU race window exploitable by any local user controlling a non-SRQ queue pair. Patches are confirmed available across multiple stable kernel branches; no public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.17% indicates low current exploitation probability consistent with the niche RDMA prerequisite.
Kernel memory (bio structure) leak in the Linux md/raid10 driver occurs when a discard operation reuses an r10bio object previously used for a read. Because put_all_bios() only releases the replacement bio (repl_bio) when read_slot is negative, a reused r10bio with a stale non-negative read_slot skips the bio_put() on repl_bio, leaking kernel memory on RAID10 arrays that have replacement/spare devices and receive discard (TRIM) traffic. There is no public exploit identified at time of analysis, and EPSS risk is very low (0.17%, 7th percentile).
Deadlock vulnerability in the Linux kernel md/raid1 and md/raid10 drivers can freeze systems running software RAID1 or RAID10 under concurrent memory pressure. The flaw causes incorrect GFP flag selection during block I/O error recovery - the kernel uses GFP_NOIO instead of GFP_NOIO|__GFP_HIGH after a failed bio is split and resubmitted, starving memory reclaim of emergency reserves and causing a kernel deadlock. No active exploitation has been identified (not in CISA KEV), and EPSS at 0.15% reflects low opportunistic risk; however, storage servers, hypervisors, and database hosts using Linux software RAID should prioritize patching to kernel 7.1.5 or 7.2-rc1.
Out-of-bounds write in the Linux kernel BPF subsystem allows a local low-privileged user to corrupt memory by issuing a BPF_PROG_QUERY syscall with an undersized bpf_attr buffer that omits the query.revision field introduced in v6.6. The cgroup attach-type code path is the primary hazard: BPF_PROG_QUERY on cgroup types shipped in 2017, and the revision write-back was added years later, creating a real population of legacy callers whose smaller buffers trigger the unconditional OOB write. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the CVSS 7.8 high-impact rating reflects that successful kernel memory corruption can yield full system compromise.
Inconsistent arvif state management in the Linux kernel's ath12k Qualcomm WiFi 7 driver exposes local low-privileged users to kernel memory corruption, information disclosure, and system crash via stale pointer dereference. Three distinct error paths in ath12k_mac_vdev_create() fail to clear or properly unwind arvif->ar and associated vdev/peer state, leaving the driver operating against ghost structures never confirmed in firmware. No public exploit identified at time of analysis, and EPSS probability sits at 0.15% (5th percentile), reflecting low near-term exploitation likelihood despite the 7.8 CVSS score.
Silent data corruption in the Linux kernel nvdimm/btt subsystem results from a broken lane-acquisition locking model that became invalid once BTT lanes were made preemptible. On systems with NVDIMM persistent memory configured in BTT (Block Translation Table) mode, a low-privileged local user can trigger a preemption-induced race where a second task observes a non-zero per-CPU recursion count, incorrectly infers it already holds the lane lock, bypasses mutual exclusion, and concurrently accesses shared per-lane metadata and workspace state, yielding high-integrity and high-confidentiality impact. No public exploit exists and EPSS is 0.18% (8th percentile), but the race is reproducible via the upstream ndctl btt-check.sh unit test and patches are available across all actively maintained stable kernel branches.
Exclusive BPF maps in the Linux kernel can be inserted as inner maps within non-exclusive outer map-in-map structures, allowing any unrelated local BPF program to look up and mutate a map that is supposed to be bound exclusively to a single program by cryptographic hash. This bypasses the signed BPF loader's integrity guarantee - an adversary on a hostile host can rewrite the frozen metadata map contents that the loader has already validated against a signed hash. No public exploit is identified at time of analysis and EPSS is very low (0.18%), but the impact is high for environments relying on exclusive maps as a trust boundary.
Use-after-free in the Linux kernel BPF filesystem (bpffs) inode lifecycle exposes freed kernel memory during concurrent path traversal, enabling local attackers with low privileges to crash the kernel or potentially escalate privileges. The flaw was introduced by commit 4f375ade6aa9, which incorrectly removed the RCU grace-period delay protecting inodes and cached symlink bodies accessible via concurrent RCU pathwalk operations (pick_link, may_lookup). KASAN confirmed the slab-use-after-free at inode offset +2 (i_opflags). No public exploit has been identified and EPSS is very low at 0.17% (7th percentile), with no CISA KEV listing.
Out-of-bounds access in the Linux kernel NVMe Flexible Data Placement (FDP) code allows an attacker who can submit NVMe commands to read beyond the fdpcidx configuration array. An off-by-one in the fdpcidx bounds check (using '>' instead of '>=' against n = NUMFDPC + 1) accepts an index one element past the valid range, tagged by intelligence sources as an information-disclosure issue. Affects Linux 6.16 through the fix; no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile), and the published CVSS 9.8 network vector appears inflated relative to the local/fabric-scoped nature of NVMe command handling.
Use-after-free in Linux kernel's configfs_lookup() allows a local low-privilege attacker to trigger kernel memory corruption via a dangling pointer in configfs_dirent->s_dentry. When inode allocation fails during a directory lookup, the code drops the configfs_dirent reference but neglects to clear ->s_dentry, leaving it pointing at a dentry object that is subsequently freed; a follow-on getdents(2) call in the same directory dereferences that stale pointer to read the inode number, producing the UAF condition. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at 0.17% (7th percentile), but the defect has been latent since Linux 2.6.16 in 2006, meaning a vast range of unpatched production kernels carries the flaw.
Heap out-of-bounds write in the Linux kernel amdgpu DRM driver's `amdgpu_coredump()` function allows a local attacker with GPU access to corrupt kernel heap memory during a GPU reset event. The vulnerability affects Linux kernel versions containing commit eea85914d15b up to the fix commits, specifically Linux 7.1 stable and prior, on systems with AMD GPU hardware. A local user who can trigger or time a GPU ring timeout during an active GPU reset could exploit this heap corruption for potential privilege escalation; however, no public exploit exists and EPSS probability is 0.15% (5th percentile), indicating limited real-world exploitation activity at time of analysis.
Livelock in the Linux kernel's vhost-net subsystem can cause a host denial-of-service against KVM virtualization environments when mergeable receive buffers (VIRTIO_NET_F_MRG_RXBUF) are negotiated between host and guest. The defect in `vhost_get_avail_idx` propagates an incorrect return value through `vhost_enable_notify`, causing the host vhost kernel thread to spin in an immediate disable-then-retry notification loop when the guest is not consuming virtio ring entries fast enough. No public exploit code exists and EPSS stands at 0.17% (6th percentile), but the CVSS Scope Changed (S:C) metric confirms cross-VM-boundary impact on the hypervisor host, making this a meaningful availability risk for KVM-based virtualization fleets.
RB-tree corruption in the Linux kernel iommu/vt-d driver allows a privileged local attacker to corrupt kernel memory structures during device probe error handling, leading to potential kernel panic, privilege escalation, or information disclosure. Affected systems must have Intel VT-d IOMMU enabled and encounter a device that does not support Address Translation Services (ATS) followed by a probe step failure. No public exploit code has been identified and no CISA KEV listing exists, but the Changed Scope (S:C) CVSS flag signals that kernel-level corruption can cascade across process and subsystem boundaries. Upstream fixes are available in stable branches targeting kernel 6.18.40, 7.1.5, and 7.2-rc1.
Local privilege escalation in the Linux kernel's BPF arena subsystem arises from zap_pages() invoking zap_vma_range() without first acquiring the owning mm's mmap_lock, creating a lock-ordering race condition against arena_vm_close() and arena_map_mmap(), both of which acquire mmap_write_lock before arena->lock in reverse order. A low-privileged local user capable of loading BPF programs on affected Linux 6.9+ systems can exploit this AB-BA deadlock opportunity or operate on stale VMA pointers after concurrent unmapping, potentially corrupting kernel memory and escalating privileges. No public exploit code has been identified at time of analysis, and EPSS scores place current exploitation probability at a low 0.15%.
Out-of-bounds kernel memory read in the Linux kernel's ocfs2 filesystem allows disclosure of adjacent kernel data when a maliciously crafted or corrupted ocfs2 volume is mounted and a fast symlink is read. ocfs2_validate_inode_block() failed to validate zero-cluster (fast) symlink dinodes, so ocfs2_fast_symlink_read_folio() would strnlen()/memcpy an inline payload whose i_size exceeds the inline area or lacks a terminating NUL, copying past the inode block buffer (KASAN flagged a 3905-byte over-read via readlink). No public exploit identified at time of analysis; EPSS is low at 0.15% (5th percentile) and the issue is not in CISA KEV.
Integer underflow in the ocfs2 filesystem's FITRIM implementation allows a local low-privileged user to corrupt filesystem data or trigger a crash by submitting a trim range shorter than one cluster. The validation in ocfs2_trim_mainbm() checks against sb->s_blocksize instead of s_clustersize; on filesystems where cluster size exceeds block size, a range that passes the block-size check gets shifted to len==0, after which pointer arithmetic involving start + len - 1 and len -= ... underflows, driving the trim operation past the requested bounds. No public exploit has been identified at time of analysis, and EPSS is 0.18% (7th percentile), consistent with its low real-world exploitation priority.
Use-after-free in the Linux kernel's netfilter conntrack timeout subsystem (nf_ct_timeout) allows a local low-privileged attacker to corrupt kernel memory by exploiting improper reference counting between the data plane and control plane lifecycle of timeout policy objects. Affected versions span from Linux 3.4 through pre-7.1.5/7.2-rc1, covering a very wide range of deployments wherever custom conntrack timeout policies are active. No public exploit code has been identified and EPSS sits at 0.15% (5th percentile), but the local high-impact profile (C:H/I:H/A:H) and the ubiquity of the Linux kernel make patching a clear priority for affected configurations.
Kernel memory corruption in the Linux RDMA/siw (soft-iWARP) driver lets a remote peer trigger a slab use-after-free during connection setup: siw_socket_disassoc() can drop the last reference on an endpoint and free it, after which siw_cm_work_handler() still dereferences the stale endpoint pointer. The demonstrated impact is a KASAN-confirmed use-after-free crash after a malformed MPA request, exploitable only where the siw module is loaded and an iWARP listener is active. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile) with no CISA KEV listing, so the 9.8 NVD score overstates practical risk for typical deployments.
Stale red-black tree node linkage in the Linux kernel BPF subsystem enables a use-after-free condition when a refcounted BPF object survives teardown of its owning rbtree root and that root's memory address is subsequently reused. Local attackers with BPF-capable low-privilege accounts can exploit the incorrect owner validation in bpf_rbtree_remove() to trigger rb_erase_cached() against stale, invalid tree pointers, potentially achieving kernel memory corruption with full confidentiality, integrity, and availability impact. No public exploit code has been identified and EPSS sits at the 6th percentile; patch commits are available across multiple stable branches.
Race condition in the kernfs xattr subsystem of Linux kernel 7.1 and earlier allows local low-privileged users to corrupt shared xattr structures across multiple superblocks, resulting in high-impact confidentiality, integrity, and availability compromise. The flaw arises specifically in namespace-multiplexed environments where kernfs_test_super() allows distinct superblocks to share a single kernfs_node while VFS locking remains per-inode and therefore insufficient. No public exploit has been identified at time of analysis; EPSS probability is 0.15% (5th percentile), indicating that despite the high CVSS score, widespread exploitation is currently assessed as unlikely.
Heap buffer overflow in the Linux kernel wcn36xx WiFi driver allows an adjacent-network attacker without authentication to corrupt kernel heap memory with firmware-controlled content. The vulnerability exists in the synchronous HAL response dispatcher for Qualcomm WCN36xx chipsets, which copies all firmware responses into a fixed 4096-byte buffer without first validating response length. Successful exploitation from an adjacent network position yields high confidentiality, integrity, and availability impact - consistent with potential kernel code execution. EPSS is low at 0.19% and no active exploitation is confirmed, but the lack of authentication requirement and network-adjacent reachability elevate real-world concern for affected embedded and mobile platforms. Patches are available across multiple stable kernel branches.
Out-of-bounds heap read in the Linux kernel's wcn36xx WiFi driver exposes kernel memory and risks system crashes on any adjacent-network attacker within radio range of a device using a Qualcomm WCN36xx series chipset. The flaw, introduced at commit 43efa3c0f241e04862be8e6a68ff765d36cde1ba (Linux 4.11 era), allows the PRINT_REG_INFO firmware indication handler to iterate over rsp->regs[] using a firmware-controlled rsp->count value that is never validated against the actual received message length, enabling reads beyond the heap-allocated buffer. No public exploit has been identified and EPSS is very low at 0.18% (7th percentile), but the CVSS 8.1 score and the availability of patches across seven stable branches make this a concrete patch priority for platforms running Qualcomm WCN36xx hardware.
Sleepable BPF_LSM_CGROUP programs can be loaded into the Linux kernel without verifier rejection, causing a kernel BUG when those programs invoke blocking helpers inside an RCU read-side critical section. The cgroup BPF shim runs under rcu_read_lock_dont_migrate(), which prohibits sleeping; if a program marked BPF_F_SLEEPABLE attaches to an LSM cgroup hook such as file_open and calls bpf_get_dentry_xattr(), the kernel triggers a 'sleeping function called from invalid context' BUG. No public exploit identified at time of analysis; EPSS at 0.17% reflects the niche exploitation path requiring BPF-loading capability.
Race condition exploitation in the Linux kernel's RDMA/nldev subsystem allows a local low-privileged attacker to trigger a use-after-free or stale pointer dereference via racy access to the mr->pd pointer during concurrent rereg_mr and nldev introspection operations, with potential for kernel memory corruption yielding high confidentiality, integrity, and availability impact. The flaw affects Linux 4.18 and later on any system with RDMA-capable hardware, with upstream fixes committed to stable branches at 7.1.5 and 7.2-rc1. No public exploit code exists and EPSS exploitation probability is very low at 0.15%, consistent with the specialized hardware requirement and race timing dependency.
Out-of-bounds slab read in the Linux kernel's ASoC AMD ACP SoundWire legacy machine driver allows a local attacker - or a hardware-triggered probe path - to read beyond an allocated array in create_sdw_dailinks(), potentially causing kernel memory disclosure or denial of service. The vulnerability is introduced when all DAI link entries are initialized, causing the boundary-unchecked loop to walk past the end of the soc_dais allocation. KASAN confirmed the read-of-size-1 in mc_probe(). EPSS is at 0.17% (6th percentile) and the vulnerability is not listed in CISA KEV; no public exploit has been identified at time of analysis. Fixes are available for Linux stable branches 6.18.40 and 7.1.5, as well as the 7.2-rc1 mainline.
Out-of-bounds array read in the Linux kernel's AMD ACP SoundWire SOF audio driver exposes kernel memory to local attackers on systems equipped with AMD SoundWire hardware. The flaw in create_sdw_dailinks() allows iteration past the end of the allocated sof_dais array when all entries are initialized, lacking any bounds guard on the loop termination condition. No active exploitation is recorded (EPSS 0.17%, 6th percentile; no CISA KEV entry), and patches are available across multiple Linux stable branches.
Lockless directory traversal in the Linux kernel configfs subsystem allows a low-privileged local user to race concurrent lseek() operations against directory iteration, corrupting or dereferencing freed cursor objects in kernel memory. Affecting all Linux kernels from version 2.6.27 through multiple long-term stable branches (fixed in 7.1.5, 6.18.40, 6.12.97, 6.6.145, 6.1.178, 5.15.212, and 5.10.261), successful exploitation could yield full kernel privilege escalation with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and EPSS sits at 0.18% (7th percentile), indicating low near-term exploitation probability.
Use-after-free in the Linux kernel iommufd subsystem allows a local low-privileged attacker on IOMMU-enabled systems to corrupt kernel memory by triggering dmabuf invalidation callbacks against already-destroyed page structures during detach. Affected configurations include virtualization hosts using VFIO or vDPA device passthrough where the iommufd framework is active. The CVSS S:C (Changed Scope) rating reflects the potential for cross-workload impact in multi-tenant environments; no public exploit identified at time of analysis, and EPSS at 0.15% (5th percentile) indicates negligible observed exploitation activity.
Use-after-free in the Linux kernel mt76 MediaTek WiFi driver allows a local low-privileged attacker to dereference freed memory during concurrent TX datapath operations, potentially achieving full kernel compromise (C:H/I:H/A:H). The flaw exists in mt76_put_vif_phy_link(), where kfree() is called on an offchannel link structure immediately after rcu_assign_pointer(NULL) - without synchronizing against in-flight RCU readers in the TX softirq path (mt7996_mac_write_txwi) that already hold the pointer. No public exploit is identified at time of analysis, and EPSS of 0.17% (6th percentile) confirms very low current exploitation activity despite a CVSS score of 7.8.
Token resource leak in the Linux kernel mt7996 WiFi driver (mt76 subsystem) allows an adjacent unauthenticated attacker to exhaust TX tokens by repeatedly triggering failed link_conf or link_sta lookups in mt7996_tx_prepare_skb(), potentially degrading or crashing WiFi functionality on affected devices. The provided CVSS 8.8 score with C:H/I:H/A:H is notably high for what the description characterizes as a resource management bug; the actual impact most closely aligns with denial-of-service through token exhaustion, not direct confidentiality or integrity compromise. No public exploit code exists and EPSS sits at 0.17% (6th percentile), indicating minimal current exploitation interest. Patches are available in Linux 6.18.40, 7.1.5, and 7.2-rc1.
Invalid pointer dereference in the Linux kernel btrfs delayed reference processing loop (`__btrfs_run_delayed_refs()`) allows a local attacker with access to a btrfs-mounted volume to crash the kernel, causing a denial of service. The defect was introduced by a refactoring commit (0110a4c43451) that inadvertently removed safety guards which reset an internal pointer to NULL when `btrfs_select_ref_head()` returns `ERR_PTR(-EAGAIN)`, causing a subsequent `spin_lock()` call on the error code value treated as a pointer address. No public exploit code has been identified and EPSS probability is 0.18% (7th percentile), though patches are available across all active stable kernel branches.
Linux kernel ixgbe driver on Intel E610 adapters triggers a KASAN slab-out-of-bounds write when an XDP program is loaded on hosts with 64 or more logical CPUs. The root cause is a queue-count mismatch: MSI-X constraints cap the netdev at 63 queue pairs on E610, but XDP allocates 64 queues on ≥64-CPU systems, causing netif_set_xps_queue() to write 4 bytes beyond the allocated slab at queue index 63. With EPSS at 0.15% (5th percentile), no KEV listing, and hardware-specific trigger conditions, real-world exploitation is low-probability but not negligible in high-CPU-count data center environments running this Intel hardware.
Resource leak in the Linux kernel NFS server (NFSD) allows connected NFS clients to cause a denial-of-service condition by sending FREE_STATEID for an admin-revoked parallel NFS (pNFS) layout stateid. The kernel function nfsd4_drop_revoked_stid() lacks handling for the SC_TYPE_LAYOUT case, causing the stateid to remain allocated in the IDR tree and on the per-client list indefinitely rather than being properly unhashed and freed. No public exploit exists and EPSS is 0.17% (6th percentile), but the unauthenticated network vector and availability impact score of 7.5 warrant attention on NFS servers with pNFS layouts enabled. Vendor-released patches are available in stable kernel branches.
Incorrect file-handle hashing in the Linux kernel's lockd (NLM) server causes NLMv4 lock-state lookups to fail intermittently. When a client presents an NFS file handle shorter than LOCKD_FH_HASH_SIZE (32 bytes), file_hash() digests stale bytes left in the argument buffer from a prior request, so the same wire handle hashes into different nlm_files[] buckets across calls and nlm_lookup_file() misses existing lock records. This is a functional-correctness and reliability defect introduced by commit 3de744ee4e45 during the xdrgen NLMv4 TEST conversion; a vendor patch is available, EPSS is low (0.15%), and there is no public exploit identified at time of analysis and no CISA KEV listing.
Unsafe destructor execution in the Linux kernel BPF subsystem allows a local attacker with BPF program loading privileges to trigger memory corruption by causing map value cleanup routines to run from NMI (Non-Maskable Interrupt) context. The flaw affects array and hashtab BPF maps containing special fields such as referenced kptrs, uptr, timer, workqueue, and graph roots - destructors for these types are not NMI-safe, yet tracing BPF programs can invoke map update or delete operations from that context. No active exploitation has been identified (not in CISA KEV); EPSS is 0.17% (7th percentile), consistent with a locally-exploitable kernel flaw requiring specialized capabilities.
Use-after-free in the Linux kernel VDUSE (vDPA Device in Userspace) subsystem allows a local low-privileged user to corrupt kernel memory and escalate privileges to full kernel control. The flaw exists in vduse_dev_open(), which releases vduse_lock after an IDR lookup but before acquiring dev->lock, creating a race window where a concurrent VDUSE_DESTROY_DEV ioctl can remove and free the same struct vduse_dev object - causing the open path to later dereference freed memory. No public exploit code and no CISA KEV listing are identified at time of analysis, and EPSS sits at 0.17% (7th percentile), indicating low current exploitation probability despite a high CVSS score of 8.8.
Out-of-bounds kernel memory access in the Linux kernel vhost/vdpa subsystem allows a local attacker with low privileges to crash the system or trigger invalid physical memory mappings via crafted mmap operations. The vhost_vdpa_mmap() and vhost_vdpa_fault() functions accept a user-controlled virtqueue index from vma->vm_pgoff without validating it against the driver's configured queue count (v->nvqs), while the ioctl path already enforces both a bounds check and array_index_nospec(). Patches are available across all active stable branches; EPSS is 0.18% (7th percentile) and the vulnerability is not listed in CISA KEV.
Guest kernel crash in the Linux virtio RTC driver occurs during device restore when stale virtqueues are not cleaned up before reinitialization. Systems running virtual machines with a virtio-rtc device exposed are affected across Linux kernel versions up to 6.18.40 and 7.1.5 stable series. A local low-privileged user on the guest who triggers a suspend/resume cycle under conditions where virtqueue reinitialization fails can dereference a NULL info pointer in vp_del_vq(), panicking the guest kernel. No public exploit is identified at time of analysis, and EPSS of 0.17% (6th percentile) confirms exploitation is not currently widespread.
Local memory corruption in the Linux kernel's vhost-net driver arises from mishandling of zerocopy TX completion: vhost_zerocopy_complete() treats every ubuf_info callback as a finished vhost descriptor, so when the networking stack clones a zerocopy skb (e.g. batman-adv fragmentation via skb_split/skb_zerocopy_clone, or veth forwarding via skb_copy_ubufs) and a backend reset frees the vhost_net_ubuf_ref, a later delayed completion dereferences the freed ubufs pointer - a slab use-after-free confirmed by KASAN. It affects virtualization hosts running vhost-net with zerocopy TX, and a successful trigger yields kernel memory corruption (crash and potential privilege escalation). There is no public exploit identified at time of analysis, EPSS is low (0.17%), and a vendor patch is available across multiple stable branches.
Incorrect IRQ-to-ring mapping in the Linux kernel's vdpa/octeon_ep driver mishandles interrupt routing on Marvell OCTEON EP devices that expose non-contiguous or non-zero-based IRQ numbers, causing the interrupt handler to index the wrong virtqueue ring. Only systems with OCTEON EP hardware using the vDPA data path are affected, and the fix ships in stable kernels 6.18.40, 7.1.5, and 7.2-rc1. There is no public exploit identified at time of analysis, EPSS is very low (0.17%, 6th percentile), and the published 10.0 CVSS vector is inconsistent with the local, hardware-specific nature of the flaw.
Out-of-bounds write in the Linux kernel's vfio/qat driver allows a local low-privileged user with access to the Intel QuickAssist Technology virtual function migration interface to corrupt kernel memory through a race condition. The root cause is a Time-of-Check Time-of-Use flaw in qat_vf_resume_write(), where two concurrent writers can both pass the filp->f_pos boundary check before the lock is held, causing the second writer to copy data past the end of the migration-state buffer once the first writer has already advanced the file position. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% at the 6th percentile reflects low current exploitation probability; vendor-released patches are available in stable kernel series 6.12.97, 6.18.40, and 7.1.5.
Out-of-bounds memory access in the Linux kernel BPF cgroup storage subsystem exposes multiple stable kernel branches to local privilege escalation, stemming from an incomplete fix for predecessor commit abad3d0bad72. A local attacker with CAP_BPF privilege can construct a tail call chain using a storage-less intermediate BPF program as a bridge between two cgroup-storage-using programs (A→B(no storage)→C(storage)), bypassing cookie validation and causing runtime cgroup local storage in the callee to operate on the original caller's context, triggering an out-of-bounds kernel memory access with C:H/I:H/A:H impact. EPSS is low at 0.17% (7th percentile) and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Use-after-free in the Linux kernel Bluetooth HCI core subsystem allows a local attacker with low privileges to corrupt kernel memory and potentially escalate privileges or crash the system. The hci_unregister_dev() function fails to quiesce cmd_timer and ncmd_timer delayed work items before freeing the hci_dev structure, creating a race window where timer callbacks dereference stale memory including the hdev->reset function pointer. EPSS is very low at 0.17% (6th percentile), no active exploitation has been confirmed, and patched versions are available across multiple Linux stable kernel branches.
Out-of-bounds memory read in the Linux kernel Bluetooth HCI subsystem enables a malformed or malicious Bluetooth controller response to the Read Local Codec Capabilities command to cause the kernel to copy one byte beyond the HCI response payload into the codec list. All kernel versions from 5.16 onward that include Bluetooth codec capability support are affected, and fixed stable releases are available across the 6.1, 6.6, 6.12, 6.18, and 7.1 branches. No public exploit has been identified, and the 7th-percentile EPSS score of 0.17% indicates negligible opportunistic exploitation risk at this time.
Undefined behavior from a signed integer overflow in the Linux kernel's RDMA/mlx5 driver exposes systems with Mellanox ConnectX RDMA hardware to local privilege escalation or kernel crash. The flaw in set_rq_size() accepts user-supplied rq_wqe_shift values up to and including 32, causing signed 32-bit integer overflow when computing '1 << rq_wqe_shift' - undefined behavior under the C standard that can corrupt kernel memory structures. The vulnerability carries a CVSS 7.8 High score but EPSS of just 0.18% (7th percentile) and is absent from CISA KEV, indicating no public exploit or active exploitation at time of analysis.
Incorrect UAR index release in the Linux kernel RDMA/mlx5 driver allows a local attacker with low privileges to corrupt kernel-level resource tracking structures, potentially enabling privilege escalation, information disclosure, or denial-of-service via kernel crash. All kernel versions from 4.16 through the fixed stable releases (6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5) are affected on systems equipped with Mellanox/NVIDIA ConnectX RDMA hardware. No public exploit code or active exploitation has been identified; EPSS stands at 0.17% (7th percentile), indicating very low current exploitation probability.
Out-of-bounds read in the Linux kernel's ASoC hdac_hdmi HDMI audio codec driver allows a local attacker with low privileges to expose sensitive kernel memory or crash the kernel by writing a crafted out-of-range enum value to the ALSA control interface. The flaw exists in hdac_hdmi_set_pin_port_mux(), which indexes the texts array using the attacker-supplied value before the bounds-checking helper snd_soc_dapm_put_enum_double() has a chance to reject it. Patches are confirmed available across seven stable kernel branches; with an EPSS of 0.17% and no CISA KEV listing, no active exploitation has been identified at time of analysis.
Missing input validation in the Linux kernel's ASoC Meson AIU audio driver allows a local low-privileged attacker to supply out-of-range enum values to HDMI and internal codec mux put callbacks, triggering snd_soc_enum_item_to_val() on unvalidated input and resulting in out-of-bounds kernel memory access. Systems running Linux 5.7 through pre-7.1.5 on Amlogic Meson SoC hardware are affected, with potential for high confidentiality impact (kernel memory disclosure), limited integrity impact, and kernel crash (availability). No public exploit code exists and exploitation probability is very low (EPSS 0.15%, 5th percentile), but the local attack vector and low privilege requirement mean any user with ALSA device access on affected hardware is a potential threat actor.
Input validation bypass in the Linux kernel's FSL audmix ASoC driver allows a local low-privileged user to write out-of-range enum values to ALSA mixer controls, triggering out-of-bounds memory access in kernel space with potential for privilege escalation or kernel memory disclosure. Specifically, fsl_audmix_put_mix_clk_src() uses an unvalidated value in a BIT() shift operation, and fsl_audmix_put_out_src() uses it to index the prms transition table, both before any bounds check is performed. No public exploit exists and EPSS is extremely low (0.18%, 7th percentile), but the CVSS score of 7.8 reflects the high kernel-level impact if exploited on hardware where the driver is active.
Out-of-bounds array read in the Linux kernel's ASoC Tegra audio driver (tegra210_ahub) allows a local attacker with low privileges to disclose kernel memory contents or trigger a kernel panic on NVIDIA Tegra 210-based systems. The flaw in tegra_ahub_put_value_enum() accesses e->values[item[0]] before validating that item[0] falls within the valid enum range, making the existing bounds check ineffective. Patches are confirmed across multiple stable kernel branches; no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Linux kernel's IPv4 Forwarding Information Base (FIB) subsystem enables a local low-privileged attacker to corrupt kernel memory, potentially escalating to root. The flaw manifests in fib_leaf_notify() when network device driver callbacks - mlxsw, rocker, and nsim - invoke refcount_inc() on a dying fib_info object under RCU, violating reference-counting safety and triggering the 'addition on 0; use-after-free' kernel warning confirmed by syzbot. Patches are available in Linux 7.1.5 stable and 7.2-rc1; no public exploit or CISA KEV listing has been identified at time of analysis.
Concurrent use-after-free-adjacent race condition in the Linux kernel's FIB rules subsystem allows a local low-privileged user to trigger a kernel refcount complaint - and potentially a system crash or memory corruption - by racing a FIB rules dump against the teardown of a dying fib_rule object. Affected versions span multiple long-term stable branches from 4.12 onward through 7.x series kernels prior to the backported fix commits. No public exploit has been identified at time of analysis, and the EPSS score of 0.18% (7th percentile) reflects low exploitation probability; exploitation is not confirmed in the CISA KEV catalog.
Out-of-bounds read in the Linux kernel's SCTP protocol implementation allows a malicious SCTP peer to trigger memory over-reads during INIT or ASCONF chunk processing. The flaw stems from insufficient validation of an embedded address parameter's declared length inside ADD_IP, DEL_IP, and SET_PRIMARY ASCONF parameters, letting a crafted peer advertise a length exceeding the enclosing parameter's bounds. No public exploit has been identified at time of analysis, EPSS is low (0.18%), and it is not on CISA KEV, but the CVSS 9.1 score reflects remote unauthenticated reachability against SCTP-enabled hosts.
Incorrect teardown ordering in the Linux kernel's netkit queue lease subsystem allows a local attacker with low privileges to trigger a race window where live NAPI polling consumes net_iov entries whose DMA addresses have already been cleared, causing the physical NIC to DMA to a stale or zero address. Affected kernel versions span from the introducing commit 5602ad61ebee through the 7.1 stable series, with fixes landing in 7.1.5 and 7.2-rc1. No public exploit code exists and EPSS probability stands at 0.15%, but the S:C scope change in the CVSS vector signals that successful exploitation can corrupt memory beyond the vulnerable process boundary, potentially enabling privilege escalation.
Privilege escalation in the Linux kernel's TIPCv2 generic netlink interface exposes mutating operations - including TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and bearer enable/disable - to any local unprivileged process. The legacy TIPCv1 netlink API already enforces CAP_NET_ADMIN via netlink_net_capable(), but TIPCv2's generic netlink handlers omit the GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM flags, creating an enforcement gap. A QEMU/KASAN reproducer running as uid/gid 65534 with zero effective capabilities confirmed the flaw: an attacker can alter network identity, inject or flush cryptographic key material, and disrupt bearer connectivity. No public exploit has been identified and EPSS is very low (0.21%), but the primitives are straightforward for any local user.
TIPC connection send-side denial of service in the Linux kernel allows a remote TIPC peer to permanently wedge a connection by sending a crafted CONN_ACK message with an inflated acknowledgment count. When the peer-supplied count exceeds the unsigned 16-bit snt_unacked counter in tipc_sk_conn_proto_rcv(), integer underflow wraps the counter to a near-maximum value, causing tsk_conn_cong() to report congestion indefinitely and blocking all further transmits on that connection. This affects Linux kernels from the commit that introduced TIPC connection ack handling (around 4.7) through multiple stable branches prior to the backported fixes. No public exploit has been identified and EPSS is 0.21% (12th percentile), indicating low opportunistic risk despite the AV:N CVSS rating.
Unbounded kernel memory exhaustion in the Linux kernel TIPC subsystem allows a malicious peer node to cause a denial-of-service condition by sending PUBLICATION messages with inverted service-range bounds (lower > upper). Kernels from version 4.17 onward accept these malformed bindings in the name-distribution network receive path - unlike the local bind path, which enforces ordering via tipc_uaddr_valid() - causing service_range rbtree entries and associated publication structures to be permanently leaked with no per-peer cap, for the lifetime of the namespace. No public exploit or CISA KEV listing exists, and EPSS is very low (0.21%, 11th percentile), but the attack is mechanically straightforward for any attacker already operating as a TIPC peer.
Improper error-path cleanup in the Linux kernel's Marvell OcteonTX crypto hardware-accelerator driver (crypto/marvell/octeontx) mishandles DMA unmapping: on a mapping failure the sg_cleanup loop indexes list[i] instead of list[j], leaking successfully mapped scatter-gather entries while repeatedly unmapping the already-failed one. Only systems with Marvell OcteonTX crypto hardware and this driver loaded are affected. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile) and the issue is not in CISA KEV.
Resource-leak and repeated-unmap defect in the Linux kernel's Cavium/Marvell CPT cryptographic accelerator driver (crypto/cavium/cpt) mishandles its DMA error-cleanup path, using the outer loop index (list[i]) instead of the inner index (list[j]) so that successfully mapped scatter-gather entries leak while the single failed entry is unmapped repeatedly. It affects only systems running the cavium CPT driver against OcteonTX CPT hardware, is reachable solely when a DMA mapping failure occurs during request setup, and is a local reliability/resource-management bug rather than a remotely exploitable code-execution flaw. No public exploit identified at time of analysis; EPSS is 0.18% (7th percentile) and it is not in CISA KEV.
Corrupted DMA length assignments in the Linux kernel's iommu/dma-iommu subsystem allow a local attacker with low privileges to trigger memory corruption through the PCI Peer-to-Peer DMA (P2PDMA) code path, potentially achieving confidentiality, integrity, and availability impact across scope boundaries. The flaw stems from a variable typo in iommu_dma_map_sg() where multi-segment P2PDMA scatterlists receive the head segment's length for all entries, corrupting DMA mappings and leading to out-of-bounds memory operations. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.19% (9th percentile) reflects low observed exploitation probability.
Out-of-bounds kernel memory access in the Linux kernel CXL (Compute Express Link) region driver allows a local attacker on systems equipped with CXL memory hardware to corrupt kernel memory by causing cxl_cancel_auto_attach() to use a negative errno value as an array index into p->targets[]. The flaw originates when cxl_region_sort_targets() fails - setting cxled->pos to a negative errno - and that invalid index is later used directly without validation. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.15% at the 5th percentile, reflecting very low real-world exploitation probability consistent with the niche CXL hardware requirement.
Missing authorization on the handshake genl family's DONE downcall in Linux kernel 6.4 and later allows a local low-privileged process to forge TLS handshake completion signals to the kernel's TLS infrastructure. Any unprivileged user that can observe or guess a valid sockfd associated with an in-flight handshake request can submit a crafted DONE message - either with STATUS=0 to make the kernel consumer accept a session as if TLS authentication succeeded, or with a non-zero status to abort a legitimate handshake before the trusted agent tlshd can report its real result. No public exploit has been identified at time of analysis, and EPSS is very low (0.17%), but patches are confirmed across multiple stable branches.
Memory corruption in the Linux kernel's bnxt (Broadcom NetXtreme) Ethernet driver arises when an XDP program grows the packet head, causing a head-pointer underflow in bnxt_rx_multi_page_skb that drops a page-pool fragment reference on the wrong page or fragment. This corrupts page-pool refcounts, allowing a page to be recycled while still in use and producing a double free on driver teardown, which realistically manifests as a kernel crash or memory corruption on hosts using Broadcom bnxt NICs with native XDP. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS is low at 0.15% (5th percentile).
Local denial-of-service / kernel-warning condition in the Linux kernel TCP stack allows a race during failed connection setup to trip a socket-lock assertion when eBPF sock_ops callbacks are in use. When a listener has a BPF sock_ops program with BPF_SOCK_OPS_STATE_CB_FLAG attached, a child socket that fails setup in tcp_v4/v6_syn_recv_sock() is force-closed without its socket lock held, causing tcp_done() -> tcp_set_state() -> tcp_call_bpf() to fire sock_owned_by_me() and emit a WARNING. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and the issue is not in CISA KEV; the headline CVSS 9.8 is inconsistent with the actual local, privilege- and race-dependent nature of the bug.
Memory corruption in the Linux kernel network scheduler (net/sched/sch_codel) allows a privileged local user to trigger a wild/dangling pointer dereference by mis-accounting queue length during the CoDel peek operation. When CoDel drops packets during peek it calls qdisc_tree_reduce_backlog before re-incrementing qlen; if qlen momentarily hits zero while peek still returns an skb, the parent qdisc's qlen_notify prematurely deactivates the class, corrupting scheduler state (demonstrated as a KASAN wild-memory-access in qfq_deactivate_agg when qfq parents a codel child). No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and this is not in CISA KEV.
Refcount tracking race in the Linux kernel's network watchdog subsystem enables a local low-privilege user to crash the kernel via list corruption. The flaw originates from a commit that introduced `dev->watchdog_dev_tracker` to store reference tracking state without adding synchronization between `netdev_watchdog_up()` and the `dev_watchdog()` timer, allowing the pointer to be concurrently overwritten or freed. The observable outcome is a `list_del` corruption BUG followed by a kernel Oops, confirmed by syzbot; no public exploit exists and the vulnerability is not in CISA KEV, with EPSS at 0.20% (10th percentile). Patches are available in stable kernel releases.
Race condition in the Linux kernel's KCM (Kernel Connection Multiplexor) subsystem exposes systems to potential privilege escalation, memory corruption, and information disclosure when KCM sockets are in active use on multi-CPU systems. The kcm_attach() and kcm_unattach() functions modify live TCP socket callback pointers (sk_data_ready, sk_write_space) via plain stores rather than WRITE_ONCE(), violating the kernel's memory visibility contract and allowing a concurrent CPU to invoke a KCM handler against a mismatched sk_user_data pointer. No active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.19% (9th percentile), but vendor-supplied patches are available across all active stable kernel branches.
Netfilter's nf_dup_netdev component in the Linux kernel exposes a race condition in nft_dup and nft_fwd expressions where the absence of Bottom Half disabling during skb transmission permits CPU migration, causing imbalanced decrementation of xmit recursion counters. A locally authenticated low-privilege user who can influence netfilter packet processing paths may exploit this counter imbalance to escalate privileges or destabilize the kernel. No public exploit code has been identified at time of analysis, and EPSS probability sits at a low 0.19%, indicating limited current exploitation interest despite the high CVSS base score.
Missing access_ok bounds validation in the Linux kernel's BPF uprobe_multi subsystem exposes systems running affected kernel versions to local privilege escalation, kernel memory disclosure, and system crash. Low-privileged local users on systems within the vulnerable commit range - spanning Linux 6.6 and related stable branches - can submit crafted user-space pointers via uprobe_multi BPF configuration that the kernel reads using __get_user without prior bounds verification. No public exploit identified at time of analysis, and EPSS of 0.19% at the 9th percentile reflects low current exploitation activity, but the full C:H/I:H/A:H CVSS impact triad warrants prompt kernel patching on multi-tenant and shared-access systems.
Use-after-free in the Linux kernel's BPF sockmap UDP receive path allows a local low-privileged attacker to corrupt kernel heap memory, enabling potential privilege escalation, kernel memory disclosure, or system crash. The race condition in udp_bpf_recvmsg() allows concurrent threads to access a sk_msg structure after it has been freed, because a prior refactor removed the lock_sock() serialization that TCP and AF_UNIX sockets retain. Discovered by Google's syzbot automated fuzzer on Google Compute Engine; no public exploit beyond that reproduction harness and no CISA KEV listing exist at time of analysis.
Integer overflow in the Linux kernel's BPF sockmap helper `bpf_msg_pop_data()` enables a local privileged attacker to bypass scatterlist bounds checks, causing an out-of-bounds traversal that dereferences a null or non-canonical page pointer and crashes the kernel. Affected are all kernel stable series from 5.10 through pre-7.2, with patches confirmed across eight stable branches. No public exploit has been identified at time of analysis and the EPSS score of 0.21% (12th percentile) indicates negligible current exploitation activity, though the confirmed kernel crash impact and High CVSS score warrant prompt patching on systems using BPF sockmap.
Denial of service (and potential memory corruption) in the Linux kernel's TIPC networking subsystem arises from a use-after-free in tipc_l2_send_msg(); when a TIPC L2 bearer is disabled, tipc_disable_l2_media() runs synchronize_net() while b->media_ptr still references the underlying net_device, letting concurrent RCU readers keep sending on a device that is subsequently freed. Syzbot reproduced the slab-use-after-free via ipvlan_hard_header(). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.18%, 7th percentile), consistent with a race-condition kernel bug rather than a mass-exploited flaw.
NULL pointer dereference in the Linux kernel's TCP/IPv6 stack crashes the kernel when a system with a large-MTU interface processes oversized TCP segments whose GSO size collides with the GSO_BY_FRAGS magic value (0xFFFF). Systems running Linux kernel from commit 3953c46c onwards with jumbo-frame or high-MTU IPv6 interfaces are affected across multiple stable branches up to and including 7.1.4. A remote, unauthenticated attacker capable of establishing a TCP/IPv6 session with a vulnerable host can induce a kernel panic, causing a full denial of service. No public exploit code has been identified at time of analysis, and EPSS probability is very low (0.21%, 12th percentile).
Use-after-free race condition in the Linux kernel RDMA/bnxt_re driver allows a local attacker with low privileges to write data to a freed kernel memory page, potentially enabling privilege escalation or kernel crash. The vulnerability affects systems running the Broadcom NetXtreme-E RDMA driver across multiple stable kernel branches, with confirmed fixes in kernel versions 7.1.5, 6.18.40, and 7.2-rc1. No public exploit code has been identified and EPSS probability sits at 0.20% (10th percentile), reflecting the narrow hardware prerequisite that sharply limits the exposed population.
Use-after-free race condition in the Linux kernel's RDMA bnxt_re driver allows a local low-privileged user to corrupt kernel memory by triggering a Notification Queue (NQ) interrupt that writes to a freed CQ toggle page during Completion Queue teardown. Systems running Linux kernel versions prior to 7.1.5 or 7.2-rc1 with Broadcom NetXtreme-E/C RDMA-capable adapters are affected. No public exploit or active exploitation has been identified; EPSS remains at 0.15% (5th percentile), reflecting low real-world exploitation probability at time of analysis.
Kernel memory corruption in the Linux RDMA bnxt_re (Broadcom NetXtreme) driver allows a local low-privileged user to trigger undefined hardware behavior by submitting WQE (Work Queue Entry) mode values that exceed the 64K hardware maximum or are zero, with no bounds validation applied. The CVSS vector (AV:L/AC:L/PR:L/S:C/C:H/I:H/A:H, score 8.8) reflects that a local unprivileged process interacting with RDMA verbs can cause a scoped kernel-level impact, including potential memory corruption or system crash. No public exploit has been identified at time of analysis, and EPSS at 0.15% (5th percentile) indicates very low observed exploitation probability, but the scope change to kernel space makes this a meaningful risk in environments deploying Broadcom RDMA adapters.
Improper error handling in the Linux kernel's RDMA/bnxt_re driver (Broadcom NetXtreme RoCE) causes bnxt_qplib_alloc_dpi() to report success even when the underlying ioremap() call fails, leaving callers to operate on an unmapped/invalid Doorbell Page Index resource. Affected kernels are 6.5 and later on systems using the bnxt_re driver with Broadcom RDMA-capable NICs. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is very low (0.15%), so the practical risk is confined to local DoS/robustness rather than remote compromise, despite the high assigned CVSS of 9.2.
Improper resource handling in the Linux kernel's RDMA bnxt_re driver (Broadcom NetXtreme RoCE) allows a local user with access to the uverbs interface to trigger a race and an error-path resource leak by repeatedly requesting write-combining (WC) mmap pages for the same ucontext. The driver historically supported only one WC page per ucontext without a serializing lock, so concurrent or repeated requests could race and, on mmap-insert failure, leak the mapped Doorbell page index. The published CVSS is 9.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), but this reflects the Linux CNA's conservative scoring convention; EPSS is 0.21% (11th percentile), it is not on CISA KEV, and no public exploit identified at time of analysis.
Race condition in the Linux kernel's RDMA/irdma (Intel Ethernet RDMA) driver arises from a legacy waitqueue-plus-flag synchronization pattern that lacked memory barriers around the request_done flag; maintainers resolved it by switching to a completion primitive. Kernels from 5.14 onward that load the irdma module are affected, but the defect is a local concurrency bug in a specific hardware driver, not the remote unauthenticated code execution its CVSS 9.8 rating implies. No public exploit identified at time of analysis, EPSS is low (0.16%, 6th percentile), and it is not in CISA KEV.
Kernel memory corruption in the Linux networking stack lets a local actor trigger a slab use-after-free in the packet-processing path (fib_rules_lookup) via a TOCTOU race in enqueue_to_backlog(). The flaw affects the per-CPU backlog flushing during device unregistration/network-namespace teardown, where a lockless transmitter such as veth_xmit can queue a packet that escapes flush_all_backlogs() and is later dereferenced after free. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and it is not on CISA KEV, so this is a defect fixed upstream rather than an actively-exploited threat.
Use-after-free in the Linux kernel's ksmbd in-kernel SMB server allows a low-privileged authenticated SMB client to dereference freed kernel memory, potentially achieving arbitrary kernel-level code execution or sensitive information disclosure. The race condition exists between `same_client_has_lease()` releasing `ci->m_lock` without holding a reference on the returned `opinfo` pointer and a concurrent SMB CLOSE operation freeing that same object. Affected kernels span the 5.15 through 7.1 stable series; patches are confirmed available across all branches. No public exploit code or CISA KEV listing has been identified at time of analysis, and an EPSS of 0.18% (8th percentile) indicates no currently observed widespread exploitation.
Kernel-level use-after-free in the Linux 9p RDMA transport (net/9p, trans_rdma.c) arises from a race on the unsynchronized rdma->state field, where recv_done() in softirq context and p9_cm_event_handler() mutate state without the req_lock that rdma_request() relies on. Concurrent teardown can silently overwrite a FLUSHING transition with CLOSING, corrupting the connection state machine and freeing RDMA request objects still in use - enabling denial of service and potential local privilege escalation on systems mounting 9p over RDMA. No public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and the flaw is not in CISA KEV.
Use-after-free in the Linux kernel staging nvec driver's nvec_rx_completed() function exposes Tegra-based systems to potential kernel memory corruption. The flaw arises from a TOCTOU race: nvec_msg_free() releases a message pool slot atomically, but the immediately following read of nvec->rx->data[0] occurs after that release - allowing a concurrent nvec_msg_alloc() to reclaim and overwrite the same slot. No public exploit has been identified at time of analysis, and the very low EPSS score (0.18%, 8th percentile) reflects the niche Tegra hardware prerequisite and staging driver context. Fixed commits are available across multiple stable kernel branches.
Out-of-bounds memory access in the Linux kernel's SoundWire audio subsystem exposes local low-privilege users on affected kernel versions to potential privilege escalation to root. The off-by-one loop error in sdw_add_element_group_count, discovered via Google's syzkaller fuzzer, allows iteration to read beyond valid array bounds when the iterator equals the element count, potentially corrupting adjacent kernel memory. No active exploitation is confirmed (no CISA KEV entry), and an EPSS of 0.21% at the 11th percentile reflects minimal real-world exploitation activity at time of analysis, though the local vector and low privilege requirement mean any authenticated user on a SoundWire-equipped system is theoretically within scope.
Out-of-bounds memory access in the Linux kernel PCI ROM parsing subsystem crashes or leaks kernel memory on both x86_64 and arm64 architectures. The `pci_get_rom_size()` function fails to validate ROM image header and PCI data structure pointer bounds before dereferencing them, allowing a crafted or malformed PCI ROM space to induce a kernel page fault (x86_64) or alignment fault (arm64). Any local actor able to trigger a PCI ROM sysfs read against a device with a broken ROM region can crash the kernel (DoS) or expose kernel memory contents (information disclosure). EPSS is 0.21% with no KEV listing, indicating no confirmed broad exploitation, though the local crash path is straightforwardly reproducible as demonstrated by stress-ng.
Kernel panic in Linux CoreSight platform driver exposes ARM systems to local denial-of-service via a NULL pointer dereference on the error cleanup path. The counter tracking output and input connections is incremented before confirming that the backing allocation succeeded; when devm_krealloc_array() or devm_kmalloc() returns ENOMEM, the cleanup routine coresight_release_platform_data() walks the inflated counter and dereferences the resulting NULL or uninitialized garbage pointer, panicking instead of returning gracefully. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), and the absence of KEV listing reflects low observed exploitation. Vendor-released patches are available in Linux 7.1.5 (stable) and 7.2-rc1 (mainline).
Shift-out-of-bounds undefined behavior in the Linux kernel's MAX3421E USB host controller driver (`max3421-hcd`) allows a local low-privileged user with access to the raw USB device node to corrupt kernel hub state. The `max3421_hub_control()` function blindly shifts the integer constant 1 left by an attacker-controlled `wValue` field without bounds-checking, so any value ≥ 32 invokes undefined behavior that arbitrarily corrupts `max3421_hcd->port_status`, including immutable change bits that gate internal state transitions. No public exploit exists and this CVE is not in the CISA KEV catalog; EPSS at 0.25% (16th percentile) reflects low exploitation likelihood, but the CVSS 7.8 is grounded in a genuine local privilege-escalation primitive within the kernel USB subsystem.
Double-decrement of the descriptor_busy reference counter in the Linux kernel's GPIB driver re-introduces a use-after-free condition that a prior security patch (commit d1857f8296dc) was specifically designed to prevent. Affected kernels include the 6.18.22-6.18.39 range and Linux 7.0, with patched releases available at 6.18.40, 7.1.5, and 7.2-rc1. Exploitation requires a local low-privilege account and access to GPIB device nodes; no public exploit code has been identified at time of analysis, and the EPSS score of 0.19% reflects negligible observed exploitation activity.
Out-of-bounds memory access in the Linux kernel's xilinx-ams IIO ADC driver allows a local low-privileged user to corrupt kernel memory through malformed event handling in ams_handle_event(). Affected versions span multiple stable kernel branches beginning with the commit that introduced the xilinx-ams driver, with the flaw present from Linux 5.17 onward across the 6.1, 6.6, 6.12, 6.18, and 7.1 stable series. No public exploit exists and EPSS sits at 0.18% (8th percentile), though vendor-released patches are confirmed across six stable branches and the CVSS 7.8 score reflects genuine kernel memory corruption potential on affected Xilinx hardware platforms.
Slab-out-of-bounds read in the Linux kernel ntfs3 filesystem driver exposes kernel heap memory and can cause a denial of service when a crafted NTFS volume is mounted. The flaw resides in `run_get_highest_vcn()`, which iterates over NTFS mapping-pairs buffers with no length bound, trusting a 0x00 terminator that a crafted $LogFile UpdateMappingPairs record can omit; the bug fires unconditionally during `ntfs_fill_super` on mount of the malicious image. Affected stable series span Linux 6.1.x through 7.0.x; the EPSS score is 0.18% (8th percentile) and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.