Linux
Monthly
Improper error handling in the Linux kernel's ntfs3 filesystem driver leaves an inode in an inconsistent state after a failed rename, where a WARN_ON was previously hit instead of properly marking the inode bad. The fix replaces that WARN_ON with a _ntfs_bad_inode() call so the kernel stops operating on the corrupted inode. The recorded CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) is inconsistent with the actual change, which is a local filesystem-driver robustness fix; EPSS is 0.20% (10th percentile) and there is no public exploit identified at time of analysis and no CISA KEV listing.
Use-after-free in the Linux kernel dmaengine subsystem allows a local low-privileged attacker to corrupt kernel memory or crash the system by racing DMA channel release against DMA provider device teardown. The flaw exists in `dma_release_channel()` across kernels from 2.6.30 through multiple active stable branches, with patches confirmed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. No public exploit has been identified at time of analysis, and the EPSS probability of 0.22% (13th percentile) indicates very low near-term exploitation likelihood despite the High CVSS score.
Memory corruption in the Linux kernel's xprtrdma (RPC-over-RDMA / NFS-over-RDMA) transport arises from a use-after-free in request-slot lifetime management: the RPC Reply handler could drop the rl_kref refcount to zero and return an rpcrdma_req to its free pool while the RDMA HCA was still DMA-reading from that request's send buffer, specifically when a Send carried only pre-registered buffers (sc_unmap_count == 0). This affects Linux systems using RPC-over-RDMA transport (introduced around 5.3) and is fixed by decoupling req recycling from RPC completion. EPSS is low (0.21%, 12th percentile) and there is no public exploit identified at time of analysis; the auto-assigned 9.8 CVSS overstates real-world risk for a race-condition kernel bug on a niche transport.
Use-after-free memory corruption in the Linux kernel's NFSv4 client fixes a race in file-lock list traversal, where nfs_delegation_claim_locks, nfs4_locku_done, and nfs4_lock_done manipulated the inode file-lock list without holding nfsi->rwsem, allowing the list to change under iteration during delegation recall and lock reclaim. The fix serializes traversal under nfsi->rwsem and relocates locks_lock_inode_wait into _nfs4_proc_setlk. This is a locally-triggered kernel race affecting NFSv4 client mounts; no public exploit identified at time of analysis, EPSS is low (0.21%), and it is not on CISA KEV.
Uninitialized kernel memory read in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3) allows a low-privileged local user to potentially leak sensitive kernel memory contents via a crafted or specially structured NTFS file. The flaw manifests in ni_seek_data_or_hole() when run_lookup() fails to locate the target VCN in runs[0], causing attr_data_get_block_locked() to exit prematurely without initializing the lcn variable - a KMSAN-confirmed uninit-value read triggered through the ntfs_llseek/vfs_llseek call chain. No public exploit exists at time of analysis (EPSS 0.20%, 10th percentile) and this is not listed in CISA KEV, indicating low active exploitation risk despite the CVSS 7.1 base score.
Heap buffer overflow in the Linux kernel ntfs3 filesystem driver's log_replay() function allows a local authenticated user to corrupt kernel heap memory by mounting a dirty NTFS volume whose on-disk log page size exceeds the host PAGE_SIZE. The one_page_buf scratch buffer is allocated using the host page size but never resized when a larger on-disk page size is adopted from the restart area, causing read_log_page() to write beyond the allocation boundary. No public exploit code exists, EPSS is 0.18% (7th percentile), and this is not listed in the CISA KEV catalog, placing current exploitation probability very low despite a CVSS 7.8 base score.
Reference-count (kref) underflow in the Linux kernel xprtrdma subsystem permits use-after-free when RDMA_CM_EVENT_ADDR_CHANGE is delivered before RDMA_CM_EVENT_ESTABLISHED during NFS-over-RDMA connection setup. An attacker on the same RDMA fabric who can induce an address-change event during the narrow pre-ESTABLISHED window may corrupt freed kernel memory, potentially leading to privilege escalation, arbitrary kernel code execution, or system crash. No public exploit exists and EPSS of 0.21% (11th percentile) reflects low automated exploitation probability; active exploitation has not been confirmed and no CISA KEV listing is present.
Out-of-bounds read and receive-buffer leak in the Linux kernel's RPC-over-RDMA client transport (xprtrdma) let a malicious or malfunctioning RDMA peer send a short or malformed reply that is misclassified as a backchannel call. The flaw causes the kernel to read up to 20 bytes of stale DMA buffer contents past the wire payload and to orphan a persistently DMA-mapped receive buffer, progressively draining the Receive queue until the peer's Sends draw RNR NAKs. No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.21%); despite the NVD-assigned 9.8 CVSS, the real-world impact is bounded to limited information exposure and connection-level denial of service on systems actually using RPC/RDMA.
Resource exhaustion in the Linux kernel's xprtrdma (RDMA transport for NFS/RPC) subsystem allows a malicious or compromised RDMA peer to trigger unbounded Receive Work Request allocation, causing denial of service on affected systems. The flaw exists in rpcrdma_reply_handler(), where the credit clamp is bypassed for replies matching no pending request (unknown XID), and rpcrdma_post_recvs() then allocates WRs past re_max_requests without bound. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), reflecting the niche RDMA deployment context. Patches are available across multiple stable kernel branches.
Receive queue exhaustion in the Linux kernel's xprtrdma subsystem allows a remote RPC/RDMA peer to stall NFS-over-RDMA client transports by sending a sustained stream of malformed replies. Each reply that is shorter than the fixed RPC/RDMA transport header or carries an unrecognized protocol version drains one posted Receive Work Request without replacement, because two early-exit paths in rpcrdma_reply_handler() return without calling rpcrdma_post_recvs(). Once the queue empties, the transport stalls until reconnect - a targeted denial-of-service with no public exploit or CISA KEV listing and a very low EPSS score of 0.21% (12th percentile).
Use-after-free and reference-count imbalance in the Linux kernel's IPsec (xfrm) asynchronous resumption path allows a device UAF and refcnt leak when packets are processed through tunnel interfaces such as VTI. During async crypto resumption, xfrm_rcv_cb can reassign skb->dev to a tunnel device without taking a reference, so the later decrement frees the tunnel netdevice while the original device leaks (observable as 'unregister_netdevice: waiting for vti1 to become free. Usage count = -2'). The upstream fix stashes the original skb->dev and extends RCU protection over xfrm_rcv_cb and transport_finish. There is no public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile).
Race condition in the Linux kernel AppArmor unix socket mediation subsystem exposes systems with peer path-based AppArmor rules to a use-after-free scenario, enabling a local low-privileged user to potentially escalate privileges and achieve full compromise of confidentiality, integrity, and availability. The flaw involves accessing a peer unix socket's path (`peer_path`) outside the kernel socket state lock, creating a window for concurrent execution of `unix_release_sock()` to free the referenced path while AppArmor reads it. No public exploit code exists and the EPSS score sits at a low 0.17% (7th percentile), but the NVD-assigned CVSS scope change (S:C) reflects that successful exploitation could reach kernel-level components beyond the attacking process.
Reference count leak in the Linux kernel AppArmor security module allows a local low-privileged user to trigger use-after-free conditions via a bug in update_sk_ctx() socket context management, potentially achieving privilege escalation with high confidentiality, integrity, and availability impact. The fix, backported across stable branches (6.18.40, 7.1.5, 7.2-rc1), corrects the unconditional plabel reference put in the caller by adding a compensating reference acquisition. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation probability.
AppArmor's aa_change_profile() in the Linux kernel dereferences a potentially NULL or ERR_PTR label value before the existing IS_ERR_OR_NULL() guard is reached, allowing a local low-privilege attacker to trigger a kernel crash or kernel memory disclosure. Affected are kernel versions from the introducing commit e00b02bb6ac2a1893227ce8014b649028d6425d2 through multiple stable branches, with vendor-released patches confirmed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 7.1.5, and 7.2-rc1. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) reflects minimal current exploitation interest.
Resource leak in Linux kernel AppArmor's aa_label_alloc() function exposes local attackers with low privileges to potential privilege escalation. When proxy allocation fails during label creation, the error path bypasses aa_label_free(), leaving the security identifier (secid) and other label resources unreleased. No public exploit has been identified at time of analysis, and EPSS at 0.18% (8th percentile) reflects low near-term exploitation probability, though the C:H/I:H/A:H CVSS impact ratings signal meaningful consequence if exploited.
Kernel page fault in Linux kernel AppArmor's file auditing path allows a local low-privileged user to crash the system or leak kernel memory via the audit log. The regression was introduced by commit 4a134723f9f1, which left the *name pointer uninitialized when path->dentry is the aa_null sentinel, then passed it to audit_log_untrustedstring() where strlen() dereferences an invalid address. No public exploit code exists and EPSS probability is 0.17% (7th percentile), but patched stable releases 6.18.40, 7.1.5, and 7.2-rc1 are confirmed available.
Use-after-free and kernel crash exposure in the Linux kernel's MIPI I3C HCI driver stems from a locking gap between the IRQ handler and the bus device list. The `i3c_hci_addr_to_dev()` function traverses the bus device list from interrupt context without holding `bus.lock`, while concurrent I3C core operations can mutate that list under the lock - creating a window where the IRQ handler dereferences stale or freed device pointers. No public exploit code exists and EPSS sits at 0.16%, but exploitation on a system with I3C HCI hardware and active device hotplug could yield privilege escalation or a kernel panic.
Double-free kernel memory corruption in the Linux DRM/i915 Intel graphics driver allows a local low-privileged user to potentially escalate privileges or crash the system. The flaw resides in the CRTC color blob pointer cleanup path: after dropping blob references, the pointers are not nulled, so a subsequent failure in the atomic commit path (e.g., -EDEADLK from DP tunnel state lookup) can trigger a second call to intel_crtc_free_hw_state() on the same already-freed state. No public exploit code exists and EPSS is 0.21%, but the CVSS 7.8 local score reflects the full C/I/A impact if kernel heap corruption is reliably weaponized. Vendor patches are available for stable branches.
Denial-of-service (and potential use-after-free) in the Linux kernel's xfrm/IPsec state-cache logic lets a stale state be inserted into the input-path cache because the state's validity is checked before the global xfrm_state_lock is taken. In the window between the check and the lock, a concurrent operation can kill the state, so a dead (freed-path) state gets cached and later dereferenced on the IPsec input path. Despite an auto-generated 9.8 CVSS, real-world signals are modest: EPSS is 0.21% (11th percentile), the issue is tagged Denial of Service, it is not in CISA KEV, and no public exploit was identified at time of analysis.
Shift-out-of-bounds in the Linux kernel's XFRM subsystem allows a local low-privileged attacker to corrupt kernel memory by crafting an AF_UNSPEC selector with an oversized prefixlen (e.g., 128) and triggering a match against an IPv4 flow when XFRM_STATE_AF_UNSPEC is set. Affected systems span multiple long-term stable kernel branches from 4.19 through 6.12.x, with patched versions available across all impacted series. No public exploit has been identified and the vulnerability is not in CISA KEV; EPSS at 0.22% confirms minimal observed exploitation activity.
Use-after-free and double-free memory corruption in the Linux kernel's amdkfd DRM subsystem exposes systems with AMD GPUs to local privilege escalation. The flaw resides in kfd_criu_resume_svm(), where cleanup logic frees struct criu_svm_metadata objects without unlinking them from the list, leaving dangling pointers; a second AMDKFD_IOC_CRIU_OP ioctl from the same process then walks and double-frees those freed objects. Exploitation is reachable by any unprivileged user with render group membership via /dev/kfd - no additional capabilities required. No public exploit identified at time of analysis, and EPSS sits at 0.21% (12th percentile), consistent with a local-access kernel bug without weaponized tooling.
Out-of-bounds kernel memory corruption in the QCOM USB audio ALSA driver (`sound/usb/qcom/`) allows a local unprivileged user to corrupt kernel slab memory or trigger a kernel oops by sending a crafted stream-disable request over AF_QIPCRTR. The disable path in `handle_uaudio_stream_req()` fails to guard against a negative index returned by `info_idx_from_ifnum()`, an invariant violation that the enable path already handles - resulting in a wild-pointer dereference when the card has never been enabled, or an out-of-bounds 4-byte slab write when it has. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low-complexity local exploit path on QCOM-equipped systems warrants prompt patching.
Uninitialized kernel memory exposure in Linux kernel's flow_dissector subsystem allows a local low-privileged attacker to leak kernel memory contents by exploiting a missing device-type check in __skb_flow_dissect(). Affected are Linux kernel versions from 4.2 through stable branches prior to 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. An attacker who can create TUN devices and configure TC qdiscs reads 12 bytes of uninitialized skb memory through the flow dissector's Ethernet address extraction path, which then propagates into rhashtable lookups - a condition confirmed reported via KMSAN. No public exploit identified at time of analysis.
Improper packet-header validation in the Linux kernel's netfilter flowtable IP6IP6 tunnel fast path was corrected by switching nf_flow_ip6_tunnel_proto() from skb_header_pointer() to pskb_may_pull(), guaranteeing the outer IPv6 header is actually present in the skb before the offload path dereferences it. The flaw affects hosts using netfilter flowtable hardware/software offload with IP6IP6 tunnel encapsulation, where a malformed encapsulated packet could be processed against a header not fully pulled into the linear buffer. No public exploit identified at time of analysis; not listed in CISA KEV, and EPSS is low (0.20%, 10th percentile).
Reference count and barrier leaks in the Linux kernel md/raid1 write dispatch path leave writes_pending and barrier accounting permanently imbalanced on certain write failure conditions, producing a high availability impact - potential system hang or crash - on any Linux host running software RAID-1 from kernel 5.17 through pre-7.1.5. The vulnerability is fixed in stable trees at 7.1.5 and 7.2-rc1 via two upstream commits. No active exploitation has been confirmed (no CISA KEV listing), no public exploit code exists, and an EPSS score of 0.20% at the 10th percentile indicates very low current real-world exploitation probability.
Reference accounting defects in the Linux kernel's md/raid10 driver allow writes_pending and barrier references to permanently leak on discard operation failure paths, leading to an unrecoverable hang of the RAID10 array. raid10_make_request() acquires these references before entering raid10_handle_discard(), but multiple failure exits in that function bypass the corresponding release calls md_write_end() and allow_barrier(), causing write accounting and resync barriers to become permanently imbalanced. With no confirmed active exploitation (no CISA KEV listing), an EPSS of 0.16% at the 6th percentile, and no public exploit identified at time of analysis, this is a targeted kernel-configuration issue whose impact is confined to systems explicitly running md/raid10 with discard enabled.
Improper memory-barrier handling in the Linux kernel's netfilter ipset subsystem affects hash-type sets, where lockless RCU readers used the relaxed test_bit() operation instead of test_bit_acquire(), allowing readers running concurrently with add/delete/garbage-collection to observe stale or improperly ordered bit state. The flaw was fixed upstream and backported to stable trees; there is no public exploit identified at time of analysis and it is not in CISA KEV, and the EPSS score is very low (0.21%). Despite an automated NVD CVSS of 9.8, the defect is a memory-ordering race in a kernel packet-filtering path rather than a straightforward remote code execution primitive.
Incorrect RCU (Read-Copy-Update) operation ordering in the Linux kernel's netfilter ipset subsystem allows a local attacker with low privileges to trigger a use-after-free condition in kernel memory, potentially leading to privilege escalation or system crash. The flaw exists because kfree_rcu() was called before rcu_assign_pointer() in the comment extension handling path - scheduling memory for freeing before the pointer update is visible to all CPUs, creating a race window. With a CVSS score of 7.8 and an EPSS of 0.22% (13th percentile), this is assessed as a serious local privilege escalation with low likelihood of opportunistic exploitation. No public exploit has been identified and CISA KEV status is not confirmed.
Privilege escalation in the Linux kernel's netfilter ipset subsystem stems from a race condition between the garbage collector (GC) and set destruction logic, where `queue_delayed_work()` is called unconditionally inside the GC callback while `cancel_delayed_work_sync()` is called during set teardown, allowing the GC to run against freed memory. Affected kernel versions span from 5.4.24 through mainline prior to the fix commits, with patches backported to stable series 6.12.97 and 6.18.40. No public exploit code exists and the CVE is not listed in CISA KEV, but the CVSS 7.8 local-privilege-escalation impact reflects the potential for kernel heap corruption reachable by low-privileged local users.
Type confusion in the Linux kernel's IPv6 In-situ OAM (IOAM) lightweight-tunnel code lets a crafted IOAM route trigger an invalid cast in rt6_get_cookie(), which reads struct rt6_info fields out of a dummy dst_entry that was only ever a bare struct dst_entry embedded in ioam6_lwt. This CWE-843-class flaw affects kernels from 6.16 up to the fixed releases and can produce an invalid pointer access when the aliased sernum/reset_ts field reaches zero. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and the issue is not in CISA KEV, so it reads as a memory-safety/DoS-grade bug rather than a broadly weaponized RCE despite the 9.8 NVD score.
Use-after-free and effective program array corruption in the Linux kernel's BPF cgroup subsystem allow a local attacker with BPF attachment privileges to escalate to root via kernel memory corruption. The flaw in replace_effective_prog() and purge_effective_progs() miscalculates array slot positions when BPF_F_PREORDER programs are present in a cgroup hierarchy, causing purge_effective_progs() to zero the wrong slot and call bpf_prog_put() while a stale reference to the freed program remains in the array. With CVSS 7.8, EPSS at 0.18% (7th percentile), and no CISA KEV listing or public exploit identified at time of analysis, real-world risk is modulated by the non-default precondition of BPF_F_PREORDER cgroup program usage.
Stack type confusion in the Linux kernel BPF verifier allows a local attacker to bypass non-scalar pointer spill validation and treat a live kernel pointer slot as an ordinary scalar stack read. Affected are Linux 7.1 stable series prior to commit 0f9278b22cda and mainline prior to 3a354149bcea, with fixes confirmed in Linux 7.1.5 and 7.2-rc1. Successful exploitation permits full kernel memory read and write access, enabling local privilege escalation; no public exploit code or active exploitation has been identified at time of analysis.
Resource exhaustion in the Linux kernel ice driver allows accumulated CTRL VSI memory leaks during VF resets on Intel E800-series adapters with FDIR filters active, ultimately degrading host availability after repeated VF lifecycle operations. Affected kernel versions span from the introducing commit (da62c5ff9dcd) through all stable branches prior to the fix commits, with patched releases confirmed at 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. No public exploit tool exists and EPSS is a negligible 0.21% (12th percentile), placing this squarely in the patch-when-convenient tier for most deployments - with the exception of high-density SR-IOV virtualization hosts running frequent VF resets, where the cumulative leak poses a realistic availability risk.
Out-of-bounds kernel memory write in the Linux kernel BPF conntrack kfuncs allows a local attacker with BPF access to corrupt memory outside the verifier-enforced boundary. The BPF verifier constrains accessible memory using the caller-supplied opts__sz argument, but the conntrack wrapper functions unconditionally write to opts->error on failure regardless of whether that field falls within the verified range - enabling a write beyond the checked region when opts__sz is deliberately undersized. No public exploit has been identified and EPSS probability is very low (0.20%, 10th percentile), but the CVSS 8.8 score with scope change reflects kernel memory corruption potential and privilege escalation risk for deployments where unprivileged BPF is enabled.
Use-after-free in the Linux kernel's in-kernel SMB server (ksmbd) lets a remote client that opens an SMB connection race two concurrent SMB2 NEGOTIATE requests to trigger a slab UAF read of the shared conn->preauth_info structure (kmalloc-96). The response send path smb3_preauth_hash_rsp() reads and dereferences conn->preauth_info->Preauth_HashValue without holding conn_lock, so one worker can free the object on the failing-negotiate path while another reads it - a window a bare NULL check cannot close. Exploitation is pre-authentication over the network but requires ksmbd to be actively serving shares plus precise timing; EPSS is low (0.21%, 12th percentile), it is not on CISA KEV, and no public exploit identified at time of analysis.
Incorrect IPv4 FIB route resolution in the Linux kernel causes error routes (e.g. 'unreachable') in the merged local/main routing table to be silently overwritten by matching routes in the default table. This occurs specifically when CONFIG_IP_MULTIPLE_TABLES is compiled in but no routing rules have been added, so fib_lookup() fails to bail out after the first table lookup. The result is that traffic which should be blocked/dropped is instead routed, undermining routing-based access-control expectations; no public exploit identified at time of analysis and EPSS probability is low (0.22%).
Indefinite kernel task hang in the Linux kernel's md/raid5 subsystem exposes any system running software RAID5 to a local availability attack via a data race between break_stripe_batch_list() and raid5_make_request(). The race corrupts the R5_Overlap flag on stripe device state without issuing the corresponding wake_up_bit() call, permanently blocking a kernel task on wait_on_bit() with no recovery path short of reboot. EPSS probability is very low at 0.18% and no public exploit has been identified, but the structural impact on active RAID5 arrays under sustained concurrent I/O workloads is a genuine availability concern.
Invalid pointer dereference in the Linux kernel netfilter NAT subsystem exposes local attackers with CAP_NET_ADMIN to kernel slab-out-of-bounds memory access via nf_nat_register_fn(). When nf_nat_init() fails during module initialization, the nat_net pointer is left in an invalid state; subsequent calls to nf_nat_register_fn() dereference it without validation, producing a KASAN-confirmed out-of-bounds read that can escalate to full kernel memory corruption. No public exploit code exists and EPSS at 0.21% (12th percentile) reflects negligible observed exploitation activity, though the local-privilege attack surface in containerized environments warrants timely patching.
Netfilter connection-count logic in the Linux kernel falsely drops legitimate TCP connections on systems using xt_connlimit or nft_connlimit in soft-limiting mode, across multiple stable branches from 5.10.248 through 6.18.39. The regression, introduced by commit 69894e5b4c5e, causes the active connection count to drop to zero when a new connection reuses a TIME_WAIT socket, after which xt_connlimit misinterprets the zeroed count and rejects valid sessions. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the condition can be triggered by ordinary connection-cycling traffic without authentication.
Out-of-bounds memory access in the Linux kernel netfilter flowtable subsystem allows malformed IPv4 packets to overrun header-size calculations in nf_flow_ip4_tunnel_proto(), affecting systems that use nftables flowtable offload with IP tunnel processing. The bug stems from consuming the untrusted iph->ihl field without validation before computing header size. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not on CISA KEV; despite the CNA's 9.8 rating, real-world impact is most consistent with a denial-of-service kernel crash on a non-default configuration.
Verdict-type confusion in the Linux kernel's netfilter nft_compat layer allows a local low-privileged attacker to bypass firewall rules and destabilize packet processing on systems running ebtables emulation. The nft_compat code fails to reject non-bridge xtables targets in NFPROTO_BRIDGE context, permitting a fallback to NFPROTO_UNSPEC that was already blocked in the legacy ebtables path since commit 11ff7288beb2; the nft_compat layer simply missed that guard. No public exploit is identified at time of analysis, and EPSS sits at a low 0.21%, though patched kernel versions are available across all active stable branches.
Out-of-bounds heap read in the Linux kernel ASoC SDCA subsystem allows a local attacker with low privileges to read past the end of a kernel heap buffer by writing an out-of-range enumeration index to the ge_put_enum_double() ALSA control handler. Affected kernels from commit 812ff1baa764 through pre-7.1.5 are vulnerable; the existing bounds check in snd_soc_dapm_put_enum_double() runs only after the unsafe read, providing no protection. No public exploit code has been identified and no active exploitation is confirmed; EPSS of 0.20% (10th percentile) reflects low near-term exploitation probability.
Guest memory corruption in the Linux kernel's s390 (IBM Z) memory-management code, where mishandling of the _PAGE_UNUSED software PTE bit causes in-use KVM guest pages to be discarded as if unused. On s390 KVM hosts running kernels before 7.1.5 (and 7.2-rc series before the fix), the bit set by KVM on unmapped guest pages was not cleared by all PTE-setting paths, so a page returned to use could later be silently dropped - corrupting guest state. There is no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and it is not in CISA KEV.
Use-after-free in the Linux kernel mxl862xx DSA driver exposes systems running MaxLinear MXL862xx Ethernet switches to local privilege escalation via kernel heap corruption. The race condition between the MDIO CRC error work handler and driver teardown allows freed dsa_port objects to be dereferenced if a CRC error is scheduled during the narrow window between MXL862XX_FLAG_WORK_STOPPED being set and dsa_unregister_switch() completing. EPSS is 0.20% (10th percentile) with no CISA KEV listing, reflecting niche hardware dependency and low broad exploitation interest.
Incorrect bounds validation in the Linux kernel's octeontx2-af driver allows a local attacker with low privileges to trigger a kernel-level flaw by issuing a crafted devlink command that sets NIX maximum LFs before any PF/VF assignment, bypassing the faulty assignment-check condition. Systems running Marvell OcteonTX2 SoC hardware with the octeontx2-af driver loaded are affected across multiple stable kernel branches originating from commit dd7842878633453e38d6a4927593dd28b9d8ab91. EPSS exploitation probability is very low at 0.21% (11th percentile), no public exploit code has been identified, and this vulnerability is not listed in the CISA KEV catalog.
Permanent network connectivity loss on Marvell MPIC platforms (Armada 370/XP/38x) results from the mvneta driver failing to re-enable its per-CPU interrupt after a suspend/resume cycle when a NAPI poll was in-flight at suspend time. The race leaves the MPIC per-CPU interrupt masked indefinitely post-resume: the NIC generates interrupts that the CPU never receives, causing a complete outage until reboot. No public exploit exists (EPSS 0.22%, 13th percentile) and the vulnerability is absent from CISA KEV; patches have been released across eight Linux stable branches.
Out-of-bounds kernel memory read in the Linux kernel's GENEVE tunnel GRO path (drivers/net/geneve.c) affects tunnels that have not enabled the IFLA_GENEVE_GRO_HINT feature - which is the default. geneve_gro_complete() honours an attacker-supplied GRO hint option unconditionally while geneve_gro_receive() ignores it, so the two paths disagree and dispatch the inner gro_complete handler at an unvalidated offset (nhoff + gh_len), reading past the skb head. Confirmed via a KASAN slab-out-of-bounds report in ipv6_gro_complete; there is no public exploit identified at time of analysis and EPSS is low (0.16%).
Out-of-bounds access in the Linux kernel's GENEVE tunnel GRO (Generic Receive Offload) path affects systems using GENEVE overlay networking, where geneve_gro_complete() can re-derive an inner dispatch offset that disagrees with what geneve_gro_receive() recorded - either through a race with geneve_quiesce()/geneve_unquiesce() flipping gs->gro_hint, or through re-read option bytes differing from the parsed ones - and complete GRO past the validated inner network header. Successful triggering leads to memory-safety corruption in softirq packet processing, most plausibly a kernel crash (denial of service). This is fixed upstream; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Double-free memory corruption in the Linux kernel's sungem (Sun GEM) Ethernet driver probe error path allows local attackers to trigger kernel heap corruption on systems equipped with Sun GEM hardware. gem_init_one() incorrectly delegates cleanup to gem_remove_one() on register_netdev() failure - which frees DMA blocks, MMIO mappings, PCI regions, and the net_device struct - then falls through to its own cleanup labels that attempt to release the same already-freed resources. No public exploit or active exploitation is identified at time of analysis; EPSS is 0.22% (13th percentile), consistent with the extreme obsolescence of the affected hardware.
Use-after-free in the Linux kernel's UDP tunnel NIC device sync workqueue allows a local low-privileged attacker to corrupt kernel memory during concurrent device operations, potentially achieving full kernel compromise. The flaw stems from a race condition between the workqueue subsystem's internal pending bit and the driver-level work_pending flag in udp_tunnel_nic_device_sync_work(), causing udp_tunnel_nic_unregister() to free the structure while a second work item is still queued and active. No public exploit identified at time of analysis, but patched versions are available across all active stable kernel branches.
Use-after-free in the Linux kernel's TIPC UDP media bearer teardown path allows a local low-privileged user to trigger a kernel memory corruption by racing bearer cleanup against concurrent UDP transmission or reception. The function cleanup_bearer() calls dst_cache_destroy() - which immediately frees per-CPU cache memory - before calling synchronize_net() to drain RCU readers, leaving concurrent tipc_udp_xmit() and tipc_udp_recv() callers able to dereference freed memory. The fix is available in stable commits and kernel 7.1.5; no public exploit has been identified at time of analysis, and EPSS at the 10th percentile reflects the niche exploitability profile.
Out-of-bounds read in the Linux kernel's SRv6 (Segment Routing for IPv6) subsystem allows a local attacker with BPF program execution capability to read kernel memory past a caller-supplied buffer boundary. The flaw in seg6_validate_srh() - reachable via BPF helpers bpf_lwt_push_encap() and the SEG6 local actions END_B6 and END_B6_ENCAP - permits a crafted 2-byte SEG6 encap header to trigger a kernel out-of-bounds read before any minimum-size validation occurs. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; the EPSS score of 0.22% (13th percentile) reflects low current exploitation probability.
Out-of-bounds array access in the Linux kernel's NXP ENETC Ethernet driver (net/ethernet/freescale/enetc) occurs on the XDP_REDIRECT transmit path when an xdp_frame carries a number of fragments greater than or equal to ENETC_MAX_SKB_FRAGS, overrunning the fixed-size xdp_redirect_arr buffer-descriptor array. Affected are systems using NXP/Freescale ENETC MACs (e.g., LS1028A-class SoCs) with an XDP program that performs redirect on multi-buffer frames, introduced in 5.13 and fixed across current stable branches. No public exploit identified at time of analysis, and EPSS is low (0.21%, 12th percentile), consistent with a driver-specific memory-safety bug rather than a broadly exploited flaw.
Improper validation of SCTP COOKIE-ECHO data in the Linux kernel's SCTP stack allows a remote peer to have tampered INIT chunk parameters processed by the server when cookie authentication (cookie_auth_enable) is disabled. Because the server previously reconstructed and trusted the INIT embedded in the returned cookie without re-verifying it, a manipulated cookie could drive parameter parsing beyond the embedded INIT's real bounds, risking out-of-bounds reads (information disclosure) or association instability. No public exploit has been identified at time of analysis, EPSS is low (0.25%), and the issue is not in CISA KEV; the fix adds sctp_verify_init() re-validation after cookie unpacking.
Incorrect VID encoding in the Linux kernel PMBus hwmon driver causes dangerously wrong voltage commands to be written to PMBus power management chips when non-VR11 VID modes are configured. The function `pmbus_data2reg_vid()` hardcoded VR11 encoding for writes while `pmbus_reg2data_vid()` correctly honored the driver-configured `vrm_version` for reads, creating an asymmetry that sends incorrect PMBUS_VOUT_COMMAND values - for example, a request for 200 mV on a VR12/VR13-mode device results in 1080 mV being delivered instead. No public exploit has been identified at time of analysis, and EPSS probability is 0.20% (10th percentile), reflecting the niche hardware and configuration requirements.
Hardware protection bypass in the Linux kernel's PMBus hwmon driver silently discards concurrent regulator fault events, preventing hw_protection_trigger() from firing when multiple power faults coincide. Systems running affected kernel versions (6.6.143-6.6.145, 6.12.92-6.12.97, 6.18.21-6.18.40, 6.19.11-6.20, 7.0-7.1.4) with PMBus-managed power rails may fail to respond to simultaneous under-voltage and over-current events, leaving hardware operating without critical protection. No public exploit has been identified; EPSS of 0.22% (13th percentile) and absence from CISA KEV confirm this is not actively exploited.
Memory corruption (use-after-free) in the Linux kernel's fbnic Ethernet driver occurs on the transmit path when fbnic_tx_lso() caches a pointer into the skb shared-info region and then calls skb_cow_head(), which may reallocate the skb and free the original buffer. Any host equipped with Meta's fbnic NIC that transmits large-segmentation-offload (LSO/TSO) traffic can trigger a slab-use-after-free, reading freed skbuff memory and potentially crashing the kernel. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%), and the issue is not in CISA KEV.
Slab-use-after-free in the Linux kernel's True Equalizer (TEQL) traffic scheduler (`net/sched/sch_teql`) enables a local low-privileged attacker to achieve full kernel-level compromise by exploiting an unprotected race on the `master->slaves` linked list. The `teql_master_xmit()` function can retain a stale pointer to a freed qdisc object while concurrent mutations in `teql_destroy()` and `teql_qdisc_init()` proceed without holding any list lock or RCU protection, producing a confirmed KASAN-detected slab-use-after-free. Reported by Trend Micro's ZDI team with a working proof-of-concept trigger, no public exploit code has been confirmed and the vulnerability is not yet listed in the CISA KEV catalog, with an EPSS score of 0.21% indicating low current opportunistic exploitation pressure.
Use-after-free in the Linux kernel bridge STP subsystem allows a local low-privileged attacker to achieve kernel code execution by engineering a specific state involving the topology change timer. The flaw exists in br_topology_change_detection(), which lacks the IFF_UP guard present at all other STP timer-arming call sites, enabling the timer to be armed while the bridge is administratively down; deleting the bridge subsequently frees kernel structures while the timer remains scheduled, triggering a dereference of freed memory when the timer fires. No public exploit is identified and EPSS sits at 0.21% (12th percentile), though the CVSS 7.8 High score with full C/I/A impact correctly reflects the severity of kernel-level UAF if successfully triggered.
Use-after-free in the Linux kernel SCTP subsystem allows a local low-privileged attacker to potentially achieve full kernel compromise (confidentiality, integrity, and availability impact rated High) by triggering a race condition during SCTP address workqueue teardown. The race occurs because `sctp_free_addr_wq()` previously used `timer_delete()`, which does not wait for an in-flight timer handler to complete, permitting `sctp_addr_wq_timeout_handler()` to acquire `addr_wq_lock` and dereference already-freed memory. No public exploit code has been identified and EPSS is low at 0.21% (11th percentile), but kernel UAF primitives have historically been weaponized into privilege escalation; three backport fixes have been merged into multiple stable kernel branches.
Integer underflow in the ksmbd in-kernel SMB3 server's DACL parsing logic allows authenticated remote SMB clients to bypass ACE count validation, driving large kernel heap allocations. The flaw exists in parse_dacl(), where subtracting sizeof(struct smb_acl) from an attacker-controlled 16-bit DACL size using unsigned arithmetic wraps to a large size_t when the DACL size is smaller than the header, permitting an ACE count of up to 0xffff to pass the guard unchecked. No public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) indicates minimal current exploitation activity, though upstream kernel patches confirm vendor acknowledgment and the attack path is fully documented in the fix commit.
A use-after-free in the Linux kernel's in-kernel SMB3 server (ksmbd) durable-handle path lets a concurrent SMB2 durable reconnect (DH2C/DHnC) read the freed fp->owner.name buffer via strcmp() in ksmbd_vfs_compare_durable_owner(), as caught by KASAN. Only systems that enable and export shares over ksmbd are affected, and exploitation requires winning a tight race between two reconnects on the same persistent_id. No public exploit identified at time of analysis, and EPSS is low (0.21%), consistent with a hard-to-time kernel race rather than a turnkey remote exploit despite the 9.8 input score.
Out-of-bounds kernel heap write in the Linux kernel Xen PV Calls (pvcalls) frontend allows a malicious or compromised Xen backend domain to corrupt guest kernel memory by supplying a ring response with req_id set beyond PVCALLS_NR_RSP_PER_RING, potentially enabling privilege escalation or denial of service within the affected guest. A compounding int vs. u32 type confusion means req_id=0xffffffff is cast to -1, bypasses a signed comparison, and indexes bedata->rsp[-1] - making the missing bounds check exploitable via two independent paths. Fixes are confirmed in Linux 7.1.5 and 7.2-rc2; no public exploit exists at time of analysis and EPSS is 0.20% at the 10th percentile.
Incorrect error code propagation in the Linux kernel's AFS (Andrew File System) subsystem allows a remote attacker capable of influencing AFS Volume Location server responses to trigger incorrect error handling in `afs_extract_vl_addrs()`, potentially causing availability impact on affected kernels. Systems running AFS-enabled Linux kernels from version 4.20 through the unpatched stable branches are affected, with all known impact limited to availability (C:N/I:N in CVSS). No public exploit code exists and this vulnerability is not listed in CISA KEV; EPSS probability is 0.22%, consistent with low current exploitation interest.
Improper re-initialization of the AFS inode's work_struct (`lock_work`) in the Linux kernel allows a low-privileged local user to trigger a kernel-level bug during file locking operations on AFS-mounted filesystems, potentially causing a kernel crash or enabling privilege escalation. The vulnerability affects Linux kernels from v2.6.23 (commit e8d6c554126b) through all stable branches prior to 6.18.40 and 7.1.5. No public exploit code exists and no active exploitation has been reported; EPSS is 0.21% (11th percentile), consistent with a kernel bug requiring specific subsystem use.
Denial of service in the Linux kernel AFS filesystem client can be triggered by remote attackers sending crafted rxrpc callback notification messages, exploiting a bug where afs_extract_data() inadvertently converts -EAGAIN return values to 0 in callback service message parsers. Systems actively mounting AFS volumes are affected across multiple stable kernel branches prior to patch releases 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code exists and EPSS exploitation probability is low at 0.22%, though the unauthenticated network attack vector yields a CVSS 7.5 base score reflecting the potential to crash or destabilize the AFS subsystem on affected hosts.
Denial-of-service in the Linux kernel's AFS (Andrew File System) client allows a remote attacker to crash the kernel by triggering a NULL pointer dereference in `afs_break_some_callbacks()`. The flaw exists because `afs_lookup_volume_rcu()` can return NULL when a referenced volume is unknown, and this return value is used without a NULL check. No public exploit code exists and EPSS sits at 0.21%, though the official CVSS scores it 7.5 (High) due to a network attack vector with no authentication required.
Race condition in the Linux kernel's AFS (Andrew File System) subsystem allows local low-privileged users to corrupt kernel memory by exploiting unsynchronized writes to net->cells_dyn_ino, with potential for privilege escalation to root. The flaw exists because cell lifecycle operations modified shared kernel state without holding net->cells_lock exclusively, and RCU cleanup context constraints in afs_cell_destroy() prevented a straightforward fix - requiring cell removal to be relocated to afs_destroy_cell_work() in a workqueue context. No public exploit exists and EPSS sits at 0.21% (11th percentile), though the 7.8 CVSS score is technically justified by the potential kernel-level impact on affected configurations.
The AFS subsystem in the Linux kernel misassigns the AFS_VOLUME_RM_TREE flag during volume insertion, marking the newly inserted volume for tree removal instead of the replaced one. This logic inversion causes the old volume to be processed for removal twice - creating a double-free or use-after-free condition - while the new volume is never properly cleaned up from the cell's volume tree. Locally authenticated users on systems with AFS filesystems mounted could exploit this to corrupt kernel heap memory, with CVSS assessing potential full confidentiality, integrity, and availability impact; however, with EPSS at 0.21% (12th percentile), no CISA KEV listing, and no public exploit identified, the near-term exploitation probability is low.
Integer overflow in the Linux kernel minix filesystem driver allows a local low-privileged user to crash the kernel by mounting a crafted Minix v3 image. The minix_blocks_needed() helper uses DIV_ROUND_UP() in unsigned int arithmetic; an image with s_ninodes or s_zones set near UINT_MAX causes the addition to wrap to zero, tricking minix_check_superblock() into accepting an invalid zero bitmap-block count, after which minix_fill_super() dereferences the unallocated s_imap[0] or s_zmap[0] pointer and panics the kernel. No public exploit identified at time of analysis; EPSS is 0.21% (11th percentile), reflecting very low exploitation probability consistent with a legacy, rarely-used filesystem driver.
Double-unlock of an inode's rwsem in the Linux kernel cachefiles subsystem corrupts kernel locking state when start_creating() fails with ENOMEM during directory creation. Local attackers with low-privilege access on systems using network filesystem caching via cachefiles can exploit the corrupted rwsem to achieve privilege escalation or kernel crash, reflecting the high CIA impact in the CVSS 7.8 score. No public exploit has been identified and EPSS is very low (0.20%, 10th percentile), but upstream patches are confirmed available via the kernel stable tree.
Unsigned integer underflow in the Linux kernel iomap writeback subsystem allows a low-privileged user to corrupt filesystem EOF metadata and on-disk size tracking. The flaw occurs in the io_size EOF trim path when a concurrent truncate shrinks the file after end_pos is sampled, causing end_pos to fall below ioend->io_offset; the resulting negative subtraction wraps to a huge value in the size_t io_size field. This corrupted io_size is then consumed by end_io paths for decisions including on-disk EOF updates, unwritten extent completion, and COW range handling. No public exploit has been identified at time of analysis, and EPSS is very low at 0.21% (11th percentile), though the official CVSS scores this 8.8 High with full C/I/A impact.
Improper handling of asynchronous fscache cache-object creation in the Linux kernel's netfs subsystem affects kernels from 6.11 up to the fixed 6.18.40, 7.1.5 and 7.2-rc2 releases. In netfs_create_write_req(), caching is skipped when the fscache cookie appears disabled, but a still-in-progress async cache object may not yet have enabled it, causing fscache_begin_write_operation() to be bypassed and write operations to the local cache to be mishandled. The issue is a local netfs/fscache correctness bug (tagged Information Disclosure); it is not remotely reachable, and there is no public exploit identified at time of analysis.
Improper error handling in the Linux kernel's netfs (network filesystem) subsystem allows a local user with low privileges to corrupt kernel folio state or trigger a kernel hang. The writeback_iter() loop fails to re-invoke itself with the error code set when a write operation fails, leaving folios unlocked and non-redirtied, which produces incorrect iteration state with high integrity and availability consequences. No public exploit code has been identified, and EPSS places exploitation probability at 0.21% (11th percentile), consistent with a constrained local kernel defect rather than a broadly weaponized vulnerability.
Integrity and availability compromise in the Linux kernel's Intel Xe GPU Physical Function (PF) driver allows a low-privileged local user operating within a guest Virtual Function (VF) environment to trigger PF-side assertion failures and ABI protocol breakage by sending FAST_REQUEST or EVENT relay messages - message types the PF handler is not designed to process. The vulnerability crosses a privilege boundary from guest to host, reflected in the CVSS scope-changed rating of 8.4. No public exploit code exists and no active exploitation has been confirmed; EPSS stands at 0.21% (11th percentile). Vendor-released patches are available across multiple stable kernel branches.
Invalid cursor access in the Linux kernel's Intel Xe GPU (drm/xe) page table subsystem allows local low-privileged users to trigger kernel warnings and potentially exploit uninitialized memory during page table binding walks involving purged buffer objects. Affected kernel versions span Linux 7.1 up to the fix points in 7.1.5 and 7.2-rc2, and only systems equipped with Intel Xe GPU hardware are at risk. No public exploit identified at time of analysis; EPSS at 0.20% (10th percentile) reflects minimal current exploitation interest, though the kernel memory-management context elevates the theoretical impact ceiling.
Context confusion in the Linux kernel's uprobes/x86 subsystem allows a local attacker with low privileges to trigger incorrect VMA lookups by exploiting the use of `current->mm` (the tracer's memory map) instead of the traced process's `mm_struct` during uprobe unregistration. Affected are kernel versions in the 6.18.x, 7.1.x, and pre-rc2 7.2 branches originating from commit ba2bfc97b462. Patches are confirmed in 6.18.40, 7.1.5, and 7.2-rc2; no public exploit code has been identified and the vulnerability is not listed in CISA KEV, with EPSS at a low 0.21% (11th percentile).
Credit resource leak in the Linux kernel CIFS client function cifs_issue_read() enables a server-side actor to exhaust the SMB flow-control credit pool on a connected Linux host, producing a denial of service for all I/O on the affected CIFS mount. Linux kernel versions from commit 69c3c023af25edb5433a2db824d3e7cc328f0183 onward are affected until stable-tree patches landing in 6.12.97, 6.18.40, 7.1.5, and 7.2-rc2. No public exploit identified at time of analysis; EPSS of 0.21% (11th percentile) confirms very low real-world exploitation probability and no CISA KEV listing exists.
Memory-ordering (barriering) defect in the Linux kernel's netfs subsystem allows a subrequest that was just added by an application thread to be observed inconsistently while the retry path walks the subrequest list, risking use of partially-initialized data. The flaw affects netfs-backed network filesystems (e.g. AFS, Ceph, CIFS, 9p) in kernels from 6.10 onward and has been resolved upstream. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.20%, 10th percentile), indicating negligible observed exploitation interest despite the NVD's 9.8 rating.
Use-after-free in the Linux kernel's legacy NTFS filesystem driver (ntfs_mft_writepages) allows a local low-privileged attacker to corrupt kernel slab memory by winning a timing race between MFT writeback and concurrent MFT allocation extension. Affected kernels span the Linux 7.1 stable series up through 7.1.4; fix commits are confirmed in the upstream stable tree targeting 7.1.5 and 7.2-rc3. No public exploit is identified at time of analysis and EPSS is low (0.20%), but the confirmed slab-use-after-free in ring-0 writeback code represents a high-severity memory safety defect warranting scheduled patching.
Use-after-free race condition in the Linux kernel's legacy NTFS driver (ntfs.ko) exposes systems with NTFS-mounted volumes to kernel heap memory corruption, enabling local privilege escalation, information disclosure, or kernel panic. The flaw in ntfs_attr_fallocate() releases a read lock before consuming a borrowed runlist pointer, while a concurrent mmap page_mkwrite path can simultaneously reallocate and free the underlying array - confirmed by a KASAN slab-use-after-free trace in the CVE description. No public exploit or CISA KEV entry exists; EPSS of 0.20% (10th percentile) reflects the difficulty of reliably winning this race, though successful exploitation carries severe kernel-level impact.
Integer wraparound in the Linux kernel HID-BPF subsystem's hid_bpf_get_data() helper allows a local low-privileged user to bypass a buffer range check and obtain an out-of-bounds pointer into kernel memory, potentially enabling privilege escalation or memory corruption. Affected kernels span from Linux 6.3 (commit 658ee5a64fcfbbf) through versions prior to 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3, where upstream fix commits have landed. No public exploit has been identified at time of analysis and EPSS remains at 0.21%, but the CVSS 7.8 local-privilege score reflects a high-impact, low-complexity code path once local access is established.
Out-of-bounds read in the Linux kernel's Generic UDP Encapsulation (GUE) tunnel receive path lets remote attackers read adjacent packet memory by sending malformed GUE packets that set the GUE_PFLAG_REMCSUM private flag without carrying the corresponding remote-checksum start/offset bytes. Because guehdr_priv_flags_len() failed to account for GUE_PLEN_REMCSUM, such truncated packets slipped past validate_gue_flags() and were then processed by gue_remcsum()/gue_gro_remcsum(), which read the missing fields from following bytes. There is no public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and the flaw is not in CISA KEV, so despite the headline CVSS 9.8 the realistic impact is information disclosure/instability rather than confirmed remote code execution.
Undefined-behavior shift in the Linux kernel's netfilter xt_u32 match module allows a local attacker with CAP_NET_ADMIN to supply malformed packet-filter rules containing shift counts of 32 or more, triggering out-of-bounds shift operations on 32-bit values in u32_match_it() during live packet evaluation. The vulnerability affects all kernel versions from 2.6.23 (when xt_u32 was introduced) through the stable-branch fix commits, with patched versions confirmed across six stable trees. No active exploitation (KEV) or public proof-of-concept has been identified; EPSS sits at the 13th percentile, reflecting currently limited exploitation probability.
Netfilter ip6tables rule evasion in the Linux kernel allows remote attackers to slip malformed IPv6 packets past firewall policy. The ah, hbh, and rt matches for IPv6 extension headers derived the header length without fully validating it against available skb data, so a packet whose advertised extension-header length exceeded the real data was treated as a rule mismatch (returning false) rather than being dropped - letting it bypass ip6tables rules specifically written to drop such traffic. The fix sets hotdrop=true so malformed packets are discarded. No public exploit identified at time of analysis; EPSS is low (0.23%, 14th percentile) and this is not in CISA KEV.
Undefined-shift undefined behavior in the Linux kernel netfilter subsystem (xt_connmark) allows a local attacker with low privileges to trigger kernel crashes, potential memory corruption, and limited information disclosure. The flaw resides in the CONNMARK target revision 2, introduced in Linux 4.17, where user-supplied shift_bits values of 32 or greater are passed unchecked to 32-bit bitshift operations in connmark_tg_shift(), invoking C undefined behavior at packet-processing time. Exploitation is not confirmed active (not in CISA KEV) and EPSS sits at 0.21% (12th percentile), but the kernel-level impact and wide Linux deployment make patching a clear priority for exposed hosts.
Off-by-one memory corruption in the Linux kernel's mlx5 LAG (Link Aggregation) subsystem exposes systems with Mellanox/NVIDIA ConnectX NICs to local privilege escalation via a defective error rollback loop in `mlx5_lag_create_single_fdb()`. When rule installation fails at index `i`, the cleanup loop incorrectly begins teardown at `i` rather than `i-1`, operating on uninitialized kernel state or double-freeing a rule the `add_one` path already rolled back - resulting in heap corruption with C:H/I:H/A:H impact potential. No public exploit or CISA KEV listing exists at time of analysis; EPSS probability stands at 0.20% (10th percentile), and upstream fix commits are confirmed available.
Kernel crash via bad memory access in the mlx5e traffic control peer flow cleanup path affects Linux systems running Mellanox/NVIDIA mlx5 NICs in LAG (Link Aggregation Group) mode. When mlx5_lag_get_dev_seq() returns an error during device teardown - because the peer is absent from the LAG or no master device is marked - the driver proceeds to dereference an invalid pointer in mlx5e_tc_del_fdb_peers_flow, causing a kernel panic. No public exploit exists and EPSS is 0.20% (10th percentile), but the crash is deterministically reproducible on affected hardware configurations during device removal or driver teardown sequences.
Memory corruption in the Linux kernel mlx5e driver's Hyper-V VHCA statistics subsystem causes a kernel fault when running as a Hyper-V guest with a Mellanox/NVIDIA ConnectX NIC. The driver initializes the stats buffer with a zero-size allocation that returns ZERO_SIZE_PTR (0x10) instead of NULL, bypasses the NULL guard, and stores the sentinel pointer; once channels open and the hypervisor enables stats reporting, a subsequent memset on address 0x10 faults the kernel. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), reflecting minimal real-world exploitation likelihood despite the high official CVSS score.
The mlx5e HV VHCA stats agent registration in the Linux kernel contains an initialization race condition that can produce NULL pointer dereferences or kernel timer list corruption, crashing a Hyper-V guest VM. Affected systems are those running Linux on Microsoft Hyper-V with a Mellanox mlx5e NIC across stable kernel trees spanning 6.1 through 7.1, with the root cause being that mlx5_hv_vhca_agent_create() publishes the agent and triggers an asynchronous workqueue callback before the caller has initialized the associated delayed_work structure and agent pointer. No public exploit code has been identified and EPSS exploitation probability is 0.21% (12th percentile); vendor patches have been released across all active stable branches and upstream commit references are available via kernel.org.
Improper error handling in the Linux kernel's ntfs3 filesystem driver leaves an inode in an inconsistent state after a failed rename, where a WARN_ON was previously hit instead of properly marking the inode bad. The fix replaces that WARN_ON with a _ntfs_bad_inode() call so the kernel stops operating on the corrupted inode. The recorded CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) is inconsistent with the actual change, which is a local filesystem-driver robustness fix; EPSS is 0.20% (10th percentile) and there is no public exploit identified at time of analysis and no CISA KEV listing.
Use-after-free in the Linux kernel dmaengine subsystem allows a local low-privileged attacker to corrupt kernel memory or crash the system by racing DMA channel release against DMA provider device teardown. The flaw exists in `dma_release_channel()` across kernels from 2.6.30 through multiple active stable branches, with patches confirmed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. No public exploit has been identified at time of analysis, and the EPSS probability of 0.22% (13th percentile) indicates very low near-term exploitation likelihood despite the High CVSS score.
Memory corruption in the Linux kernel's xprtrdma (RPC-over-RDMA / NFS-over-RDMA) transport arises from a use-after-free in request-slot lifetime management: the RPC Reply handler could drop the rl_kref refcount to zero and return an rpcrdma_req to its free pool while the RDMA HCA was still DMA-reading from that request's send buffer, specifically when a Send carried only pre-registered buffers (sc_unmap_count == 0). This affects Linux systems using RPC-over-RDMA transport (introduced around 5.3) and is fixed by decoupling req recycling from RPC completion. EPSS is low (0.21%, 12th percentile) and there is no public exploit identified at time of analysis; the auto-assigned 9.8 CVSS overstates real-world risk for a race-condition kernel bug on a niche transport.
Use-after-free memory corruption in the Linux kernel's NFSv4 client fixes a race in file-lock list traversal, where nfs_delegation_claim_locks, nfs4_locku_done, and nfs4_lock_done manipulated the inode file-lock list without holding nfsi->rwsem, allowing the list to change under iteration during delegation recall and lock reclaim. The fix serializes traversal under nfsi->rwsem and relocates locks_lock_inode_wait into _nfs4_proc_setlk. This is a locally-triggered kernel race affecting NFSv4 client mounts; no public exploit identified at time of analysis, EPSS is low (0.21%), and it is not on CISA KEV.
Uninitialized kernel memory read in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3) allows a low-privileged local user to potentially leak sensitive kernel memory contents via a crafted or specially structured NTFS file. The flaw manifests in ni_seek_data_or_hole() when run_lookup() fails to locate the target VCN in runs[0], causing attr_data_get_block_locked() to exit prematurely without initializing the lcn variable - a KMSAN-confirmed uninit-value read triggered through the ntfs_llseek/vfs_llseek call chain. No public exploit exists at time of analysis (EPSS 0.20%, 10th percentile) and this is not listed in CISA KEV, indicating low active exploitation risk despite the CVSS 7.1 base score.
Heap buffer overflow in the Linux kernel ntfs3 filesystem driver's log_replay() function allows a local authenticated user to corrupt kernel heap memory by mounting a dirty NTFS volume whose on-disk log page size exceeds the host PAGE_SIZE. The one_page_buf scratch buffer is allocated using the host page size but never resized when a larger on-disk page size is adopted from the restart area, causing read_log_page() to write beyond the allocation boundary. No public exploit code exists, EPSS is 0.18% (7th percentile), and this is not listed in the CISA KEV catalog, placing current exploitation probability very low despite a CVSS 7.8 base score.
Reference-count (kref) underflow in the Linux kernel xprtrdma subsystem permits use-after-free when RDMA_CM_EVENT_ADDR_CHANGE is delivered before RDMA_CM_EVENT_ESTABLISHED during NFS-over-RDMA connection setup. An attacker on the same RDMA fabric who can induce an address-change event during the narrow pre-ESTABLISHED window may corrupt freed kernel memory, potentially leading to privilege escalation, arbitrary kernel code execution, or system crash. No public exploit exists and EPSS of 0.21% (11th percentile) reflects low automated exploitation probability; active exploitation has not been confirmed and no CISA KEV listing is present.
Out-of-bounds read and receive-buffer leak in the Linux kernel's RPC-over-RDMA client transport (xprtrdma) let a malicious or malfunctioning RDMA peer send a short or malformed reply that is misclassified as a backchannel call. The flaw causes the kernel to read up to 20 bytes of stale DMA buffer contents past the wire payload and to orphan a persistently DMA-mapped receive buffer, progressively draining the Receive queue until the peer's Sends draw RNR NAKs. No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.21%); despite the NVD-assigned 9.8 CVSS, the real-world impact is bounded to limited information exposure and connection-level denial of service on systems actually using RPC/RDMA.
Resource exhaustion in the Linux kernel's xprtrdma (RDMA transport for NFS/RPC) subsystem allows a malicious or compromised RDMA peer to trigger unbounded Receive Work Request allocation, causing denial of service on affected systems. The flaw exists in rpcrdma_reply_handler(), where the credit clamp is bypassed for replies matching no pending request (unknown XID), and rpcrdma_post_recvs() then allocates WRs past re_max_requests without bound. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), reflecting the niche RDMA deployment context. Patches are available across multiple stable kernel branches.
Receive queue exhaustion in the Linux kernel's xprtrdma subsystem allows a remote RPC/RDMA peer to stall NFS-over-RDMA client transports by sending a sustained stream of malformed replies. Each reply that is shorter than the fixed RPC/RDMA transport header or carries an unrecognized protocol version drains one posted Receive Work Request without replacement, because two early-exit paths in rpcrdma_reply_handler() return without calling rpcrdma_post_recvs(). Once the queue empties, the transport stalls until reconnect - a targeted denial-of-service with no public exploit or CISA KEV listing and a very low EPSS score of 0.21% (12th percentile).
Use-after-free and reference-count imbalance in the Linux kernel's IPsec (xfrm) asynchronous resumption path allows a device UAF and refcnt leak when packets are processed through tunnel interfaces such as VTI. During async crypto resumption, xfrm_rcv_cb can reassign skb->dev to a tunnel device without taking a reference, so the later decrement frees the tunnel netdevice while the original device leaks (observable as 'unregister_netdevice: waiting for vti1 to become free. Usage count = -2'). The upstream fix stashes the original skb->dev and extends RCU protection over xfrm_rcv_cb and transport_finish. There is no public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile).
Race condition in the Linux kernel AppArmor unix socket mediation subsystem exposes systems with peer path-based AppArmor rules to a use-after-free scenario, enabling a local low-privileged user to potentially escalate privileges and achieve full compromise of confidentiality, integrity, and availability. The flaw involves accessing a peer unix socket's path (`peer_path`) outside the kernel socket state lock, creating a window for concurrent execution of `unix_release_sock()` to free the referenced path while AppArmor reads it. No public exploit code exists and the EPSS score sits at a low 0.17% (7th percentile), but the NVD-assigned CVSS scope change (S:C) reflects that successful exploitation could reach kernel-level components beyond the attacking process.
Reference count leak in the Linux kernel AppArmor security module allows a local low-privileged user to trigger use-after-free conditions via a bug in update_sk_ctx() socket context management, potentially achieving privilege escalation with high confidentiality, integrity, and availability impact. The fix, backported across stable branches (6.18.40, 7.1.5, 7.2-rc1), corrects the unconditional plabel reference put in the caller by adding a compensating reference acquisition. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation probability.
AppArmor's aa_change_profile() in the Linux kernel dereferences a potentially NULL or ERR_PTR label value before the existing IS_ERR_OR_NULL() guard is reached, allowing a local low-privilege attacker to trigger a kernel crash or kernel memory disclosure. Affected are kernel versions from the introducing commit e00b02bb6ac2a1893227ce8014b649028d6425d2 through multiple stable branches, with vendor-released patches confirmed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 7.1.5, and 7.2-rc1. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) reflects minimal current exploitation interest.
Resource leak in Linux kernel AppArmor's aa_label_alloc() function exposes local attackers with low privileges to potential privilege escalation. When proxy allocation fails during label creation, the error path bypasses aa_label_free(), leaving the security identifier (secid) and other label resources unreleased. No public exploit has been identified at time of analysis, and EPSS at 0.18% (8th percentile) reflects low near-term exploitation probability, though the C:H/I:H/A:H CVSS impact ratings signal meaningful consequence if exploited.
Kernel page fault in Linux kernel AppArmor's file auditing path allows a local low-privileged user to crash the system or leak kernel memory via the audit log. The regression was introduced by commit 4a134723f9f1, which left the *name pointer uninitialized when path->dentry is the aa_null sentinel, then passed it to audit_log_untrustedstring() where strlen() dereferences an invalid address. No public exploit code exists and EPSS probability is 0.17% (7th percentile), but patched stable releases 6.18.40, 7.1.5, and 7.2-rc1 are confirmed available.
Use-after-free and kernel crash exposure in the Linux kernel's MIPI I3C HCI driver stems from a locking gap between the IRQ handler and the bus device list. The `i3c_hci_addr_to_dev()` function traverses the bus device list from interrupt context without holding `bus.lock`, while concurrent I3C core operations can mutate that list under the lock - creating a window where the IRQ handler dereferences stale or freed device pointers. No public exploit code exists and EPSS sits at 0.16%, but exploitation on a system with I3C HCI hardware and active device hotplug could yield privilege escalation or a kernel panic.
Double-free kernel memory corruption in the Linux DRM/i915 Intel graphics driver allows a local low-privileged user to potentially escalate privileges or crash the system. The flaw resides in the CRTC color blob pointer cleanup path: after dropping blob references, the pointers are not nulled, so a subsequent failure in the atomic commit path (e.g., -EDEADLK from DP tunnel state lookup) can trigger a second call to intel_crtc_free_hw_state() on the same already-freed state. No public exploit code exists and EPSS is 0.21%, but the CVSS 7.8 local score reflects the full C/I/A impact if kernel heap corruption is reliably weaponized. Vendor patches are available for stable branches.
Denial-of-service (and potential use-after-free) in the Linux kernel's xfrm/IPsec state-cache logic lets a stale state be inserted into the input-path cache because the state's validity is checked before the global xfrm_state_lock is taken. In the window between the check and the lock, a concurrent operation can kill the state, so a dead (freed-path) state gets cached and later dereferenced on the IPsec input path. Despite an auto-generated 9.8 CVSS, real-world signals are modest: EPSS is 0.21% (11th percentile), the issue is tagged Denial of Service, it is not in CISA KEV, and no public exploit was identified at time of analysis.
Shift-out-of-bounds in the Linux kernel's XFRM subsystem allows a local low-privileged attacker to corrupt kernel memory by crafting an AF_UNSPEC selector with an oversized prefixlen (e.g., 128) and triggering a match against an IPv4 flow when XFRM_STATE_AF_UNSPEC is set. Affected systems span multiple long-term stable kernel branches from 4.19 through 6.12.x, with patched versions available across all impacted series. No public exploit has been identified and the vulnerability is not in CISA KEV; EPSS at 0.22% confirms minimal observed exploitation activity.
Use-after-free and double-free memory corruption in the Linux kernel's amdkfd DRM subsystem exposes systems with AMD GPUs to local privilege escalation. The flaw resides in kfd_criu_resume_svm(), where cleanup logic frees struct criu_svm_metadata objects without unlinking them from the list, leaving dangling pointers; a second AMDKFD_IOC_CRIU_OP ioctl from the same process then walks and double-frees those freed objects. Exploitation is reachable by any unprivileged user with render group membership via /dev/kfd - no additional capabilities required. No public exploit identified at time of analysis, and EPSS sits at 0.21% (12th percentile), consistent with a local-access kernel bug without weaponized tooling.
Out-of-bounds kernel memory corruption in the QCOM USB audio ALSA driver (`sound/usb/qcom/`) allows a local unprivileged user to corrupt kernel slab memory or trigger a kernel oops by sending a crafted stream-disable request over AF_QIPCRTR. The disable path in `handle_uaudio_stream_req()` fails to guard against a negative index returned by `info_idx_from_ifnum()`, an invariant violation that the enable path already handles - resulting in a wild-pointer dereference when the card has never been enabled, or an out-of-bounds 4-byte slab write when it has. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low-complexity local exploit path on QCOM-equipped systems warrants prompt patching.
Uninitialized kernel memory exposure in Linux kernel's flow_dissector subsystem allows a local low-privileged attacker to leak kernel memory contents by exploiting a missing device-type check in __skb_flow_dissect(). Affected are Linux kernel versions from 4.2 through stable branches prior to 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. An attacker who can create TUN devices and configure TC qdiscs reads 12 bytes of uninitialized skb memory through the flow dissector's Ethernet address extraction path, which then propagates into rhashtable lookups - a condition confirmed reported via KMSAN. No public exploit identified at time of analysis.
Improper packet-header validation in the Linux kernel's netfilter flowtable IP6IP6 tunnel fast path was corrected by switching nf_flow_ip6_tunnel_proto() from skb_header_pointer() to pskb_may_pull(), guaranteeing the outer IPv6 header is actually present in the skb before the offload path dereferences it. The flaw affects hosts using netfilter flowtable hardware/software offload with IP6IP6 tunnel encapsulation, where a malformed encapsulated packet could be processed against a header not fully pulled into the linear buffer. No public exploit identified at time of analysis; not listed in CISA KEV, and EPSS is low (0.20%, 10th percentile).
Reference count and barrier leaks in the Linux kernel md/raid1 write dispatch path leave writes_pending and barrier accounting permanently imbalanced on certain write failure conditions, producing a high availability impact - potential system hang or crash - on any Linux host running software RAID-1 from kernel 5.17 through pre-7.1.5. The vulnerability is fixed in stable trees at 7.1.5 and 7.2-rc1 via two upstream commits. No active exploitation has been confirmed (no CISA KEV listing), no public exploit code exists, and an EPSS score of 0.20% at the 10th percentile indicates very low current real-world exploitation probability.
Reference accounting defects in the Linux kernel's md/raid10 driver allow writes_pending and barrier references to permanently leak on discard operation failure paths, leading to an unrecoverable hang of the RAID10 array. raid10_make_request() acquires these references before entering raid10_handle_discard(), but multiple failure exits in that function bypass the corresponding release calls md_write_end() and allow_barrier(), causing write accounting and resync barriers to become permanently imbalanced. With no confirmed active exploitation (no CISA KEV listing), an EPSS of 0.16% at the 6th percentile, and no public exploit identified at time of analysis, this is a targeted kernel-configuration issue whose impact is confined to systems explicitly running md/raid10 with discard enabled.
Improper memory-barrier handling in the Linux kernel's netfilter ipset subsystem affects hash-type sets, where lockless RCU readers used the relaxed test_bit() operation instead of test_bit_acquire(), allowing readers running concurrently with add/delete/garbage-collection to observe stale or improperly ordered bit state. The flaw was fixed upstream and backported to stable trees; there is no public exploit identified at time of analysis and it is not in CISA KEV, and the EPSS score is very low (0.21%). Despite an automated NVD CVSS of 9.8, the defect is a memory-ordering race in a kernel packet-filtering path rather than a straightforward remote code execution primitive.
Incorrect RCU (Read-Copy-Update) operation ordering in the Linux kernel's netfilter ipset subsystem allows a local attacker with low privileges to trigger a use-after-free condition in kernel memory, potentially leading to privilege escalation or system crash. The flaw exists because kfree_rcu() was called before rcu_assign_pointer() in the comment extension handling path - scheduling memory for freeing before the pointer update is visible to all CPUs, creating a race window. With a CVSS score of 7.8 and an EPSS of 0.22% (13th percentile), this is assessed as a serious local privilege escalation with low likelihood of opportunistic exploitation. No public exploit has been identified and CISA KEV status is not confirmed.
Privilege escalation in the Linux kernel's netfilter ipset subsystem stems from a race condition between the garbage collector (GC) and set destruction logic, where `queue_delayed_work()` is called unconditionally inside the GC callback while `cancel_delayed_work_sync()` is called during set teardown, allowing the GC to run against freed memory. Affected kernel versions span from 5.4.24 through mainline prior to the fix commits, with patches backported to stable series 6.12.97 and 6.18.40. No public exploit code exists and the CVE is not listed in CISA KEV, but the CVSS 7.8 local-privilege-escalation impact reflects the potential for kernel heap corruption reachable by low-privileged local users.
Type confusion in the Linux kernel's IPv6 In-situ OAM (IOAM) lightweight-tunnel code lets a crafted IOAM route trigger an invalid cast in rt6_get_cookie(), which reads struct rt6_info fields out of a dummy dst_entry that was only ever a bare struct dst_entry embedded in ioam6_lwt. This CWE-843-class flaw affects kernels from 6.16 up to the fixed releases and can produce an invalid pointer access when the aliased sernum/reset_ts field reaches zero. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and the issue is not in CISA KEV, so it reads as a memory-safety/DoS-grade bug rather than a broadly weaponized RCE despite the 9.8 NVD score.
Use-after-free and effective program array corruption in the Linux kernel's BPF cgroup subsystem allow a local attacker with BPF attachment privileges to escalate to root via kernel memory corruption. The flaw in replace_effective_prog() and purge_effective_progs() miscalculates array slot positions when BPF_F_PREORDER programs are present in a cgroup hierarchy, causing purge_effective_progs() to zero the wrong slot and call bpf_prog_put() while a stale reference to the freed program remains in the array. With CVSS 7.8, EPSS at 0.18% (7th percentile), and no CISA KEV listing or public exploit identified at time of analysis, real-world risk is modulated by the non-default precondition of BPF_F_PREORDER cgroup program usage.
Stack type confusion in the Linux kernel BPF verifier allows a local attacker to bypass non-scalar pointer spill validation and treat a live kernel pointer slot as an ordinary scalar stack read. Affected are Linux 7.1 stable series prior to commit 0f9278b22cda and mainline prior to 3a354149bcea, with fixes confirmed in Linux 7.1.5 and 7.2-rc1. Successful exploitation permits full kernel memory read and write access, enabling local privilege escalation; no public exploit code or active exploitation has been identified at time of analysis.
Resource exhaustion in the Linux kernel ice driver allows accumulated CTRL VSI memory leaks during VF resets on Intel E800-series adapters with FDIR filters active, ultimately degrading host availability after repeated VF lifecycle operations. Affected kernel versions span from the introducing commit (da62c5ff9dcd) through all stable branches prior to the fix commits, with patched releases confirmed at 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. No public exploit tool exists and EPSS is a negligible 0.21% (12th percentile), placing this squarely in the patch-when-convenient tier for most deployments - with the exception of high-density SR-IOV virtualization hosts running frequent VF resets, where the cumulative leak poses a realistic availability risk.
Out-of-bounds kernel memory write in the Linux kernel BPF conntrack kfuncs allows a local attacker with BPF access to corrupt memory outside the verifier-enforced boundary. The BPF verifier constrains accessible memory using the caller-supplied opts__sz argument, but the conntrack wrapper functions unconditionally write to opts->error on failure regardless of whether that field falls within the verified range - enabling a write beyond the checked region when opts__sz is deliberately undersized. No public exploit has been identified and EPSS probability is very low (0.20%, 10th percentile), but the CVSS 8.8 score with scope change reflects kernel memory corruption potential and privilege escalation risk for deployments where unprivileged BPF is enabled.
Use-after-free in the Linux kernel's in-kernel SMB server (ksmbd) lets a remote client that opens an SMB connection race two concurrent SMB2 NEGOTIATE requests to trigger a slab UAF read of the shared conn->preauth_info structure (kmalloc-96). The response send path smb3_preauth_hash_rsp() reads and dereferences conn->preauth_info->Preauth_HashValue without holding conn_lock, so one worker can free the object on the failing-negotiate path while another reads it - a window a bare NULL check cannot close. Exploitation is pre-authentication over the network but requires ksmbd to be actively serving shares plus precise timing; EPSS is low (0.21%, 12th percentile), it is not on CISA KEV, and no public exploit identified at time of analysis.
Incorrect IPv4 FIB route resolution in the Linux kernel causes error routes (e.g. 'unreachable') in the merged local/main routing table to be silently overwritten by matching routes in the default table. This occurs specifically when CONFIG_IP_MULTIPLE_TABLES is compiled in but no routing rules have been added, so fib_lookup() fails to bail out after the first table lookup. The result is that traffic which should be blocked/dropped is instead routed, undermining routing-based access-control expectations; no public exploit identified at time of analysis and EPSS probability is low (0.22%).
Indefinite kernel task hang in the Linux kernel's md/raid5 subsystem exposes any system running software RAID5 to a local availability attack via a data race between break_stripe_batch_list() and raid5_make_request(). The race corrupts the R5_Overlap flag on stripe device state without issuing the corresponding wake_up_bit() call, permanently blocking a kernel task on wait_on_bit() with no recovery path short of reboot. EPSS probability is very low at 0.18% and no public exploit has been identified, but the structural impact on active RAID5 arrays under sustained concurrent I/O workloads is a genuine availability concern.
Invalid pointer dereference in the Linux kernel netfilter NAT subsystem exposes local attackers with CAP_NET_ADMIN to kernel slab-out-of-bounds memory access via nf_nat_register_fn(). When nf_nat_init() fails during module initialization, the nat_net pointer is left in an invalid state; subsequent calls to nf_nat_register_fn() dereference it without validation, producing a KASAN-confirmed out-of-bounds read that can escalate to full kernel memory corruption. No public exploit code exists and EPSS at 0.21% (12th percentile) reflects negligible observed exploitation activity, though the local-privilege attack surface in containerized environments warrants timely patching.
Netfilter connection-count logic in the Linux kernel falsely drops legitimate TCP connections on systems using xt_connlimit or nft_connlimit in soft-limiting mode, across multiple stable branches from 5.10.248 through 6.18.39. The regression, introduced by commit 69894e5b4c5e, causes the active connection count to drop to zero when a new connection reuses a TIME_WAIT socket, after which xt_connlimit misinterprets the zeroed count and rejects valid sessions. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the condition can be triggered by ordinary connection-cycling traffic without authentication.
Out-of-bounds memory access in the Linux kernel netfilter flowtable subsystem allows malformed IPv4 packets to overrun header-size calculations in nf_flow_ip4_tunnel_proto(), affecting systems that use nftables flowtable offload with IP tunnel processing. The bug stems from consuming the untrusted iph->ihl field without validation before computing header size. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not on CISA KEV; despite the CNA's 9.8 rating, real-world impact is most consistent with a denial-of-service kernel crash on a non-default configuration.
Verdict-type confusion in the Linux kernel's netfilter nft_compat layer allows a local low-privileged attacker to bypass firewall rules and destabilize packet processing on systems running ebtables emulation. The nft_compat code fails to reject non-bridge xtables targets in NFPROTO_BRIDGE context, permitting a fallback to NFPROTO_UNSPEC that was already blocked in the legacy ebtables path since commit 11ff7288beb2; the nft_compat layer simply missed that guard. No public exploit is identified at time of analysis, and EPSS sits at a low 0.21%, though patched kernel versions are available across all active stable branches.
Out-of-bounds heap read in the Linux kernel ASoC SDCA subsystem allows a local attacker with low privileges to read past the end of a kernel heap buffer by writing an out-of-range enumeration index to the ge_put_enum_double() ALSA control handler. Affected kernels from commit 812ff1baa764 through pre-7.1.5 are vulnerable; the existing bounds check in snd_soc_dapm_put_enum_double() runs only after the unsafe read, providing no protection. No public exploit code has been identified and no active exploitation is confirmed; EPSS of 0.20% (10th percentile) reflects low near-term exploitation probability.
Guest memory corruption in the Linux kernel's s390 (IBM Z) memory-management code, where mishandling of the _PAGE_UNUSED software PTE bit causes in-use KVM guest pages to be discarded as if unused. On s390 KVM hosts running kernels before 7.1.5 (and 7.2-rc series before the fix), the bit set by KVM on unmapped guest pages was not cleared by all PTE-setting paths, so a page returned to use could later be silently dropped - corrupting guest state. There is no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and it is not in CISA KEV.
Use-after-free in the Linux kernel mxl862xx DSA driver exposes systems running MaxLinear MXL862xx Ethernet switches to local privilege escalation via kernel heap corruption. The race condition between the MDIO CRC error work handler and driver teardown allows freed dsa_port objects to be dereferenced if a CRC error is scheduled during the narrow window between MXL862XX_FLAG_WORK_STOPPED being set and dsa_unregister_switch() completing. EPSS is 0.20% (10th percentile) with no CISA KEV listing, reflecting niche hardware dependency and low broad exploitation interest.
Incorrect bounds validation in the Linux kernel's octeontx2-af driver allows a local attacker with low privileges to trigger a kernel-level flaw by issuing a crafted devlink command that sets NIX maximum LFs before any PF/VF assignment, bypassing the faulty assignment-check condition. Systems running Marvell OcteonTX2 SoC hardware with the octeontx2-af driver loaded are affected across multiple stable kernel branches originating from commit dd7842878633453e38d6a4927593dd28b9d8ab91. EPSS exploitation probability is very low at 0.21% (11th percentile), no public exploit code has been identified, and this vulnerability is not listed in the CISA KEV catalog.
Permanent network connectivity loss on Marvell MPIC platforms (Armada 370/XP/38x) results from the mvneta driver failing to re-enable its per-CPU interrupt after a suspend/resume cycle when a NAPI poll was in-flight at suspend time. The race leaves the MPIC per-CPU interrupt masked indefinitely post-resume: the NIC generates interrupts that the CPU never receives, causing a complete outage until reboot. No public exploit exists (EPSS 0.22%, 13th percentile) and the vulnerability is absent from CISA KEV; patches have been released across eight Linux stable branches.
Out-of-bounds kernel memory read in the Linux kernel's GENEVE tunnel GRO path (drivers/net/geneve.c) affects tunnels that have not enabled the IFLA_GENEVE_GRO_HINT feature - which is the default. geneve_gro_complete() honours an attacker-supplied GRO hint option unconditionally while geneve_gro_receive() ignores it, so the two paths disagree and dispatch the inner gro_complete handler at an unvalidated offset (nhoff + gh_len), reading past the skb head. Confirmed via a KASAN slab-out-of-bounds report in ipv6_gro_complete; there is no public exploit identified at time of analysis and EPSS is low (0.16%).
Out-of-bounds access in the Linux kernel's GENEVE tunnel GRO (Generic Receive Offload) path affects systems using GENEVE overlay networking, where geneve_gro_complete() can re-derive an inner dispatch offset that disagrees with what geneve_gro_receive() recorded - either through a race with geneve_quiesce()/geneve_unquiesce() flipping gs->gro_hint, or through re-read option bytes differing from the parsed ones - and complete GRO past the validated inner network header. Successful triggering leads to memory-safety corruption in softirq packet processing, most plausibly a kernel crash (denial of service). This is fixed upstream; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Double-free memory corruption in the Linux kernel's sungem (Sun GEM) Ethernet driver probe error path allows local attackers to trigger kernel heap corruption on systems equipped with Sun GEM hardware. gem_init_one() incorrectly delegates cleanup to gem_remove_one() on register_netdev() failure - which frees DMA blocks, MMIO mappings, PCI regions, and the net_device struct - then falls through to its own cleanup labels that attempt to release the same already-freed resources. No public exploit or active exploitation is identified at time of analysis; EPSS is 0.22% (13th percentile), consistent with the extreme obsolescence of the affected hardware.
Use-after-free in the Linux kernel's UDP tunnel NIC device sync workqueue allows a local low-privileged attacker to corrupt kernel memory during concurrent device operations, potentially achieving full kernel compromise. The flaw stems from a race condition between the workqueue subsystem's internal pending bit and the driver-level work_pending flag in udp_tunnel_nic_device_sync_work(), causing udp_tunnel_nic_unregister() to free the structure while a second work item is still queued and active. No public exploit identified at time of analysis, but patched versions are available across all active stable kernel branches.
Use-after-free in the Linux kernel's TIPC UDP media bearer teardown path allows a local low-privileged user to trigger a kernel memory corruption by racing bearer cleanup against concurrent UDP transmission or reception. The function cleanup_bearer() calls dst_cache_destroy() - which immediately frees per-CPU cache memory - before calling synchronize_net() to drain RCU readers, leaving concurrent tipc_udp_xmit() and tipc_udp_recv() callers able to dereference freed memory. The fix is available in stable commits and kernel 7.1.5; no public exploit has been identified at time of analysis, and EPSS at the 10th percentile reflects the niche exploitability profile.
Out-of-bounds read in the Linux kernel's SRv6 (Segment Routing for IPv6) subsystem allows a local attacker with BPF program execution capability to read kernel memory past a caller-supplied buffer boundary. The flaw in seg6_validate_srh() - reachable via BPF helpers bpf_lwt_push_encap() and the SEG6 local actions END_B6 and END_B6_ENCAP - permits a crafted 2-byte SEG6 encap header to trigger a kernel out-of-bounds read before any minimum-size validation occurs. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; the EPSS score of 0.22% (13th percentile) reflects low current exploitation probability.
Out-of-bounds array access in the Linux kernel's NXP ENETC Ethernet driver (net/ethernet/freescale/enetc) occurs on the XDP_REDIRECT transmit path when an xdp_frame carries a number of fragments greater than or equal to ENETC_MAX_SKB_FRAGS, overrunning the fixed-size xdp_redirect_arr buffer-descriptor array. Affected are systems using NXP/Freescale ENETC MACs (e.g., LS1028A-class SoCs) with an XDP program that performs redirect on multi-buffer frames, introduced in 5.13 and fixed across current stable branches. No public exploit identified at time of analysis, and EPSS is low (0.21%, 12th percentile), consistent with a driver-specific memory-safety bug rather than a broadly exploited flaw.
Improper validation of SCTP COOKIE-ECHO data in the Linux kernel's SCTP stack allows a remote peer to have tampered INIT chunk parameters processed by the server when cookie authentication (cookie_auth_enable) is disabled. Because the server previously reconstructed and trusted the INIT embedded in the returned cookie without re-verifying it, a manipulated cookie could drive parameter parsing beyond the embedded INIT's real bounds, risking out-of-bounds reads (information disclosure) or association instability. No public exploit has been identified at time of analysis, EPSS is low (0.25%), and the issue is not in CISA KEV; the fix adds sctp_verify_init() re-validation after cookie unpacking.
Incorrect VID encoding in the Linux kernel PMBus hwmon driver causes dangerously wrong voltage commands to be written to PMBus power management chips when non-VR11 VID modes are configured. The function `pmbus_data2reg_vid()` hardcoded VR11 encoding for writes while `pmbus_reg2data_vid()` correctly honored the driver-configured `vrm_version` for reads, creating an asymmetry that sends incorrect PMBUS_VOUT_COMMAND values - for example, a request for 200 mV on a VR12/VR13-mode device results in 1080 mV being delivered instead. No public exploit has been identified at time of analysis, and EPSS probability is 0.20% (10th percentile), reflecting the niche hardware and configuration requirements.
Hardware protection bypass in the Linux kernel's PMBus hwmon driver silently discards concurrent regulator fault events, preventing hw_protection_trigger() from firing when multiple power faults coincide. Systems running affected kernel versions (6.6.143-6.6.145, 6.12.92-6.12.97, 6.18.21-6.18.40, 6.19.11-6.20, 7.0-7.1.4) with PMBus-managed power rails may fail to respond to simultaneous under-voltage and over-current events, leaving hardware operating without critical protection. No public exploit has been identified; EPSS of 0.22% (13th percentile) and absence from CISA KEV confirm this is not actively exploited.
Memory corruption (use-after-free) in the Linux kernel's fbnic Ethernet driver occurs on the transmit path when fbnic_tx_lso() caches a pointer into the skb shared-info region and then calls skb_cow_head(), which may reallocate the skb and free the original buffer. Any host equipped with Meta's fbnic NIC that transmits large-segmentation-offload (LSO/TSO) traffic can trigger a slab-use-after-free, reading freed skbuff memory and potentially crashing the kernel. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%), and the issue is not in CISA KEV.
Slab-use-after-free in the Linux kernel's True Equalizer (TEQL) traffic scheduler (`net/sched/sch_teql`) enables a local low-privileged attacker to achieve full kernel-level compromise by exploiting an unprotected race on the `master->slaves` linked list. The `teql_master_xmit()` function can retain a stale pointer to a freed qdisc object while concurrent mutations in `teql_destroy()` and `teql_qdisc_init()` proceed without holding any list lock or RCU protection, producing a confirmed KASAN-detected slab-use-after-free. Reported by Trend Micro's ZDI team with a working proof-of-concept trigger, no public exploit code has been confirmed and the vulnerability is not yet listed in the CISA KEV catalog, with an EPSS score of 0.21% indicating low current opportunistic exploitation pressure.
Use-after-free in the Linux kernel bridge STP subsystem allows a local low-privileged attacker to achieve kernel code execution by engineering a specific state involving the topology change timer. The flaw exists in br_topology_change_detection(), which lacks the IFF_UP guard present at all other STP timer-arming call sites, enabling the timer to be armed while the bridge is administratively down; deleting the bridge subsequently frees kernel structures while the timer remains scheduled, triggering a dereference of freed memory when the timer fires. No public exploit is identified and EPSS sits at 0.21% (12th percentile), though the CVSS 7.8 High score with full C/I/A impact correctly reflects the severity of kernel-level UAF if successfully triggered.
Use-after-free in the Linux kernel SCTP subsystem allows a local low-privileged attacker to potentially achieve full kernel compromise (confidentiality, integrity, and availability impact rated High) by triggering a race condition during SCTP address workqueue teardown. The race occurs because `sctp_free_addr_wq()` previously used `timer_delete()`, which does not wait for an in-flight timer handler to complete, permitting `sctp_addr_wq_timeout_handler()` to acquire `addr_wq_lock` and dereference already-freed memory. No public exploit code has been identified and EPSS is low at 0.21% (11th percentile), but kernel UAF primitives have historically been weaponized into privilege escalation; three backport fixes have been merged into multiple stable kernel branches.
Integer underflow in the ksmbd in-kernel SMB3 server's DACL parsing logic allows authenticated remote SMB clients to bypass ACE count validation, driving large kernel heap allocations. The flaw exists in parse_dacl(), where subtracting sizeof(struct smb_acl) from an attacker-controlled 16-bit DACL size using unsigned arithmetic wraps to a large size_t when the DACL size is smaller than the header, permitting an ACE count of up to 0xffff to pass the guard unchecked. No public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) indicates minimal current exploitation activity, though upstream kernel patches confirm vendor acknowledgment and the attack path is fully documented in the fix commit.
A use-after-free in the Linux kernel's in-kernel SMB3 server (ksmbd) durable-handle path lets a concurrent SMB2 durable reconnect (DH2C/DHnC) read the freed fp->owner.name buffer via strcmp() in ksmbd_vfs_compare_durable_owner(), as caught by KASAN. Only systems that enable and export shares over ksmbd are affected, and exploitation requires winning a tight race between two reconnects on the same persistent_id. No public exploit identified at time of analysis, and EPSS is low (0.21%), consistent with a hard-to-time kernel race rather than a turnkey remote exploit despite the 9.8 input score.
Out-of-bounds kernel heap write in the Linux kernel Xen PV Calls (pvcalls) frontend allows a malicious or compromised Xen backend domain to corrupt guest kernel memory by supplying a ring response with req_id set beyond PVCALLS_NR_RSP_PER_RING, potentially enabling privilege escalation or denial of service within the affected guest. A compounding int vs. u32 type confusion means req_id=0xffffffff is cast to -1, bypasses a signed comparison, and indexes bedata->rsp[-1] - making the missing bounds check exploitable via two independent paths. Fixes are confirmed in Linux 7.1.5 and 7.2-rc2; no public exploit exists at time of analysis and EPSS is 0.20% at the 10th percentile.
Incorrect error code propagation in the Linux kernel's AFS (Andrew File System) subsystem allows a remote attacker capable of influencing AFS Volume Location server responses to trigger incorrect error handling in `afs_extract_vl_addrs()`, potentially causing availability impact on affected kernels. Systems running AFS-enabled Linux kernels from version 4.20 through the unpatched stable branches are affected, with all known impact limited to availability (C:N/I:N in CVSS). No public exploit code exists and this vulnerability is not listed in CISA KEV; EPSS probability is 0.22%, consistent with low current exploitation interest.
Improper re-initialization of the AFS inode's work_struct (`lock_work`) in the Linux kernel allows a low-privileged local user to trigger a kernel-level bug during file locking operations on AFS-mounted filesystems, potentially causing a kernel crash or enabling privilege escalation. The vulnerability affects Linux kernels from v2.6.23 (commit e8d6c554126b) through all stable branches prior to 6.18.40 and 7.1.5. No public exploit code exists and no active exploitation has been reported; EPSS is 0.21% (11th percentile), consistent with a kernel bug requiring specific subsystem use.
Denial of service in the Linux kernel AFS filesystem client can be triggered by remote attackers sending crafted rxrpc callback notification messages, exploiting a bug where afs_extract_data() inadvertently converts -EAGAIN return values to 0 in callback service message parsers. Systems actively mounting AFS volumes are affected across multiple stable kernel branches prior to patch releases 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code exists and EPSS exploitation probability is low at 0.22%, though the unauthenticated network attack vector yields a CVSS 7.5 base score reflecting the potential to crash or destabilize the AFS subsystem on affected hosts.
Denial-of-service in the Linux kernel's AFS (Andrew File System) client allows a remote attacker to crash the kernel by triggering a NULL pointer dereference in `afs_break_some_callbacks()`. The flaw exists because `afs_lookup_volume_rcu()` can return NULL when a referenced volume is unknown, and this return value is used without a NULL check. No public exploit code exists and EPSS sits at 0.21%, though the official CVSS scores it 7.5 (High) due to a network attack vector with no authentication required.
Race condition in the Linux kernel's AFS (Andrew File System) subsystem allows local low-privileged users to corrupt kernel memory by exploiting unsynchronized writes to net->cells_dyn_ino, with potential for privilege escalation to root. The flaw exists because cell lifecycle operations modified shared kernel state without holding net->cells_lock exclusively, and RCU cleanup context constraints in afs_cell_destroy() prevented a straightforward fix - requiring cell removal to be relocated to afs_destroy_cell_work() in a workqueue context. No public exploit exists and EPSS sits at 0.21% (11th percentile), though the 7.8 CVSS score is technically justified by the potential kernel-level impact on affected configurations.
The AFS subsystem in the Linux kernel misassigns the AFS_VOLUME_RM_TREE flag during volume insertion, marking the newly inserted volume for tree removal instead of the replaced one. This logic inversion causes the old volume to be processed for removal twice - creating a double-free or use-after-free condition - while the new volume is never properly cleaned up from the cell's volume tree. Locally authenticated users on systems with AFS filesystems mounted could exploit this to corrupt kernel heap memory, with CVSS assessing potential full confidentiality, integrity, and availability impact; however, with EPSS at 0.21% (12th percentile), no CISA KEV listing, and no public exploit identified, the near-term exploitation probability is low.
Integer overflow in the Linux kernel minix filesystem driver allows a local low-privileged user to crash the kernel by mounting a crafted Minix v3 image. The minix_blocks_needed() helper uses DIV_ROUND_UP() in unsigned int arithmetic; an image with s_ninodes or s_zones set near UINT_MAX causes the addition to wrap to zero, tricking minix_check_superblock() into accepting an invalid zero bitmap-block count, after which minix_fill_super() dereferences the unallocated s_imap[0] or s_zmap[0] pointer and panics the kernel. No public exploit identified at time of analysis; EPSS is 0.21% (11th percentile), reflecting very low exploitation probability consistent with a legacy, rarely-used filesystem driver.
Double-unlock of an inode's rwsem in the Linux kernel cachefiles subsystem corrupts kernel locking state when start_creating() fails with ENOMEM during directory creation. Local attackers with low-privilege access on systems using network filesystem caching via cachefiles can exploit the corrupted rwsem to achieve privilege escalation or kernel crash, reflecting the high CIA impact in the CVSS 7.8 score. No public exploit has been identified and EPSS is very low (0.20%, 10th percentile), but upstream patches are confirmed available via the kernel stable tree.
Unsigned integer underflow in the Linux kernel iomap writeback subsystem allows a low-privileged user to corrupt filesystem EOF metadata and on-disk size tracking. The flaw occurs in the io_size EOF trim path when a concurrent truncate shrinks the file after end_pos is sampled, causing end_pos to fall below ioend->io_offset; the resulting negative subtraction wraps to a huge value in the size_t io_size field. This corrupted io_size is then consumed by end_io paths for decisions including on-disk EOF updates, unwritten extent completion, and COW range handling. No public exploit has been identified at time of analysis, and EPSS is very low at 0.21% (11th percentile), though the official CVSS scores this 8.8 High with full C/I/A impact.
Improper handling of asynchronous fscache cache-object creation in the Linux kernel's netfs subsystem affects kernels from 6.11 up to the fixed 6.18.40, 7.1.5 and 7.2-rc2 releases. In netfs_create_write_req(), caching is skipped when the fscache cookie appears disabled, but a still-in-progress async cache object may not yet have enabled it, causing fscache_begin_write_operation() to be bypassed and write operations to the local cache to be mishandled. The issue is a local netfs/fscache correctness bug (tagged Information Disclosure); it is not remotely reachable, and there is no public exploit identified at time of analysis.
Improper error handling in the Linux kernel's netfs (network filesystem) subsystem allows a local user with low privileges to corrupt kernel folio state or trigger a kernel hang. The writeback_iter() loop fails to re-invoke itself with the error code set when a write operation fails, leaving folios unlocked and non-redirtied, which produces incorrect iteration state with high integrity and availability consequences. No public exploit code has been identified, and EPSS places exploitation probability at 0.21% (11th percentile), consistent with a constrained local kernel defect rather than a broadly weaponized vulnerability.
Integrity and availability compromise in the Linux kernel's Intel Xe GPU Physical Function (PF) driver allows a low-privileged local user operating within a guest Virtual Function (VF) environment to trigger PF-side assertion failures and ABI protocol breakage by sending FAST_REQUEST or EVENT relay messages - message types the PF handler is not designed to process. The vulnerability crosses a privilege boundary from guest to host, reflected in the CVSS scope-changed rating of 8.4. No public exploit code exists and no active exploitation has been confirmed; EPSS stands at 0.21% (11th percentile). Vendor-released patches are available across multiple stable kernel branches.
Invalid cursor access in the Linux kernel's Intel Xe GPU (drm/xe) page table subsystem allows local low-privileged users to trigger kernel warnings and potentially exploit uninitialized memory during page table binding walks involving purged buffer objects. Affected kernel versions span Linux 7.1 up to the fix points in 7.1.5 and 7.2-rc2, and only systems equipped with Intel Xe GPU hardware are at risk. No public exploit identified at time of analysis; EPSS at 0.20% (10th percentile) reflects minimal current exploitation interest, though the kernel memory-management context elevates the theoretical impact ceiling.
Context confusion in the Linux kernel's uprobes/x86 subsystem allows a local attacker with low privileges to trigger incorrect VMA lookups by exploiting the use of `current->mm` (the tracer's memory map) instead of the traced process's `mm_struct` during uprobe unregistration. Affected are kernel versions in the 6.18.x, 7.1.x, and pre-rc2 7.2 branches originating from commit ba2bfc97b462. Patches are confirmed in 6.18.40, 7.1.5, and 7.2-rc2; no public exploit code has been identified and the vulnerability is not listed in CISA KEV, with EPSS at a low 0.21% (11th percentile).
Credit resource leak in the Linux kernel CIFS client function cifs_issue_read() enables a server-side actor to exhaust the SMB flow-control credit pool on a connected Linux host, producing a denial of service for all I/O on the affected CIFS mount. Linux kernel versions from commit 69c3c023af25edb5433a2db824d3e7cc328f0183 onward are affected until stable-tree patches landing in 6.12.97, 6.18.40, 7.1.5, and 7.2-rc2. No public exploit identified at time of analysis; EPSS of 0.21% (11th percentile) confirms very low real-world exploitation probability and no CISA KEV listing exists.
Memory-ordering (barriering) defect in the Linux kernel's netfs subsystem allows a subrequest that was just added by an application thread to be observed inconsistently while the retry path walks the subrequest list, risking use of partially-initialized data. The flaw affects netfs-backed network filesystems (e.g. AFS, Ceph, CIFS, 9p) in kernels from 6.10 onward and has been resolved upstream. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.20%, 10th percentile), indicating negligible observed exploitation interest despite the NVD's 9.8 rating.
Use-after-free in the Linux kernel's legacy NTFS filesystem driver (ntfs_mft_writepages) allows a local low-privileged attacker to corrupt kernel slab memory by winning a timing race between MFT writeback and concurrent MFT allocation extension. Affected kernels span the Linux 7.1 stable series up through 7.1.4; fix commits are confirmed in the upstream stable tree targeting 7.1.5 and 7.2-rc3. No public exploit is identified at time of analysis and EPSS is low (0.20%), but the confirmed slab-use-after-free in ring-0 writeback code represents a high-severity memory safety defect warranting scheduled patching.
Use-after-free race condition in the Linux kernel's legacy NTFS driver (ntfs.ko) exposes systems with NTFS-mounted volumes to kernel heap memory corruption, enabling local privilege escalation, information disclosure, or kernel panic. The flaw in ntfs_attr_fallocate() releases a read lock before consuming a borrowed runlist pointer, while a concurrent mmap page_mkwrite path can simultaneously reallocate and free the underlying array - confirmed by a KASAN slab-use-after-free trace in the CVE description. No public exploit or CISA KEV entry exists; EPSS of 0.20% (10th percentile) reflects the difficulty of reliably winning this race, though successful exploitation carries severe kernel-level impact.
Integer wraparound in the Linux kernel HID-BPF subsystem's hid_bpf_get_data() helper allows a local low-privileged user to bypass a buffer range check and obtain an out-of-bounds pointer into kernel memory, potentially enabling privilege escalation or memory corruption. Affected kernels span from Linux 6.3 (commit 658ee5a64fcfbbf) through versions prior to 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3, where upstream fix commits have landed. No public exploit has been identified at time of analysis and EPSS remains at 0.21%, but the CVSS 7.8 local-privilege score reflects a high-impact, low-complexity code path once local access is established.
Out-of-bounds read in the Linux kernel's Generic UDP Encapsulation (GUE) tunnel receive path lets remote attackers read adjacent packet memory by sending malformed GUE packets that set the GUE_PFLAG_REMCSUM private flag without carrying the corresponding remote-checksum start/offset bytes. Because guehdr_priv_flags_len() failed to account for GUE_PLEN_REMCSUM, such truncated packets slipped past validate_gue_flags() and were then processed by gue_remcsum()/gue_gro_remcsum(), which read the missing fields from following bytes. There is no public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and the flaw is not in CISA KEV, so despite the headline CVSS 9.8 the realistic impact is information disclosure/instability rather than confirmed remote code execution.
Undefined-behavior shift in the Linux kernel's netfilter xt_u32 match module allows a local attacker with CAP_NET_ADMIN to supply malformed packet-filter rules containing shift counts of 32 or more, triggering out-of-bounds shift operations on 32-bit values in u32_match_it() during live packet evaluation. The vulnerability affects all kernel versions from 2.6.23 (when xt_u32 was introduced) through the stable-branch fix commits, with patched versions confirmed across six stable trees. No active exploitation (KEV) or public proof-of-concept has been identified; EPSS sits at the 13th percentile, reflecting currently limited exploitation probability.
Netfilter ip6tables rule evasion in the Linux kernel allows remote attackers to slip malformed IPv6 packets past firewall policy. The ah, hbh, and rt matches for IPv6 extension headers derived the header length without fully validating it against available skb data, so a packet whose advertised extension-header length exceeded the real data was treated as a rule mismatch (returning false) rather than being dropped - letting it bypass ip6tables rules specifically written to drop such traffic. The fix sets hotdrop=true so malformed packets are discarded. No public exploit identified at time of analysis; EPSS is low (0.23%, 14th percentile) and this is not in CISA KEV.
Undefined-shift undefined behavior in the Linux kernel netfilter subsystem (xt_connmark) allows a local attacker with low privileges to trigger kernel crashes, potential memory corruption, and limited information disclosure. The flaw resides in the CONNMARK target revision 2, introduced in Linux 4.17, where user-supplied shift_bits values of 32 or greater are passed unchecked to 32-bit bitshift operations in connmark_tg_shift(), invoking C undefined behavior at packet-processing time. Exploitation is not confirmed active (not in CISA KEV) and EPSS sits at 0.21% (12th percentile), but the kernel-level impact and wide Linux deployment make patching a clear priority for exposed hosts.
Off-by-one memory corruption in the Linux kernel's mlx5 LAG (Link Aggregation) subsystem exposes systems with Mellanox/NVIDIA ConnectX NICs to local privilege escalation via a defective error rollback loop in `mlx5_lag_create_single_fdb()`. When rule installation fails at index `i`, the cleanup loop incorrectly begins teardown at `i` rather than `i-1`, operating on uninitialized kernel state or double-freeing a rule the `add_one` path already rolled back - resulting in heap corruption with C:H/I:H/A:H impact potential. No public exploit or CISA KEV listing exists at time of analysis; EPSS probability stands at 0.20% (10th percentile), and upstream fix commits are confirmed available.
Kernel crash via bad memory access in the mlx5e traffic control peer flow cleanup path affects Linux systems running Mellanox/NVIDIA mlx5 NICs in LAG (Link Aggregation Group) mode. When mlx5_lag_get_dev_seq() returns an error during device teardown - because the peer is absent from the LAG or no master device is marked - the driver proceeds to dereference an invalid pointer in mlx5e_tc_del_fdb_peers_flow, causing a kernel panic. No public exploit exists and EPSS is 0.20% (10th percentile), but the crash is deterministically reproducible on affected hardware configurations during device removal or driver teardown sequences.
Memory corruption in the Linux kernel mlx5e driver's Hyper-V VHCA statistics subsystem causes a kernel fault when running as a Hyper-V guest with a Mellanox/NVIDIA ConnectX NIC. The driver initializes the stats buffer with a zero-size allocation that returns ZERO_SIZE_PTR (0x10) instead of NULL, bypasses the NULL guard, and stores the sentinel pointer; once channels open and the hypervisor enables stats reporting, a subsequent memset on address 0x10 faults the kernel. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), reflecting minimal real-world exploitation likelihood despite the high official CVSS score.
The mlx5e HV VHCA stats agent registration in the Linux kernel contains an initialization race condition that can produce NULL pointer dereferences or kernel timer list corruption, crashing a Hyper-V guest VM. Affected systems are those running Linux on Microsoft Hyper-V with a Mellanox mlx5e NIC across stable kernel trees spanning 6.1 through 7.1, with the root cause being that mlx5_hv_vhca_agent_create() publishes the agent and triggers an asynchronous workqueue callback before the caller has initialized the associated delayed_work structure and agent pointer. No public exploit code has been identified and EPSS exploitation probability is 0.21% (12th percentile); vendor patches have been released across all active stable branches and upstream commit references are available via kernel.org.