Linux
Monthly
Memory corruption in the Linux kernel mlx5e driver's Hyper-V VHCA statistics subsystem causes a kernel fault when running as a Hyper-V guest with a Mellanox/NVIDIA ConnectX NIC. The driver initializes the stats buffer with a zero-size allocation that returns ZERO_SIZE_PTR (0x10) instead of NULL, bypasses the NULL guard, and stores the sentinel pointer; once channels open and the hypervisor enables stats reporting, a subsequent memset on address 0x10 faults the kernel. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), reflecting minimal real-world exploitation likelihood despite the high official CVSS score.
The mlx5e HV VHCA stats agent registration in the Linux kernel contains an initialization race condition that can produce NULL pointer dereferences or kernel timer list corruption, crashing a Hyper-V guest VM. Affected systems are those running Linux on Microsoft Hyper-V with a Mellanox mlx5e NIC across stable kernel trees spanning 6.1 through 7.1, with the root cause being that mlx5_hv_vhca_agent_create() publishes the agent and triggers an asynchronous workqueue callback before the caller has initialized the associated delayed_work structure and agent pointer. No public exploit code has been identified and EPSS exploitation probability is 0.21% (12th percentile); vendor patches have been released across all active stable branches and upstream commit references are available via kernel.org.
Race condition in the Linux kernel's Microchip VCAP network driver corrupts hardware forwarding table entries on systems using sparx5 or lan969x switching ASICs. A local authenticated user can simultaneously trigger a debugfs VCAP rule dump and a tc-flower rule write to different Super VCAP instances, causing shared cache registers to be overwritten mid-transaction and committing corrupt data directly into hardware forwarding entries. No public exploit code or CISA KEV listing exists; EPSS is 0.21%, reflecting low exploitation likelihood in practice.
Memory corruption in the Linux kernel qede network driver (QLogic/Marvell FastLinQ 40/100GbE) arises because qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a NULL return from qede_build_skb(), consuming an extra buffer descriptor and desynchronizing the RX BD ring. The resulting off-by-one can corrupt DMA page reference counts and trigger SLUB freelist corruption, most plausibly a kernel-crash denial of service rather than reliable code execution. No public exploit has been identified and it is not in CISA KEV; the low EPSS (0.22%, 13th percentile) reflects that the bug only manifests under kernel memory pressure.
Heap out-of-bounds write in the Linux kernel's act_pedit TC offload path allows a local attacker holding CAP_NET_ADMIN to corrupt kernel slab memory with attacker-controlled content, potentially leading to privilege escalation or denial of service. The flaw affects Linux kernel versions from approximately 4.11 through the stable branches patched in 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3. Trend Micro ZDI researchers confirmed exploitability via KASAN trace using a targeted POC; no public exploit has been released and this CVE is not listed in the CISA KEV catalog.
Use-after-free in the Linux kernel Bluetooth MGMT advertising monitor subsystem allows a local attacker with low privileges to corrupt kernel heap memory, potentially achieving privilege escalation. The flaw arises from a ownership race: hci_add_adv_monitor() publishes a new adv_monitor into the hdev->adv_monitors_idr before the MSFT HCI offload setup step completes, allowing the MSFT callback to free the monitor on failure while the MGMT completion path still holds a dangling pointer. KASAN confirmed the slab-use-after-free in mgmt_add_adv_patterns_monitor_complete; no public exploit or active exploitation (CISA KEV) has been identified, and EPSS is 0.21% (12th percentile).
Bluetooth ISO packet reassembly in the Linux kernel mishandles malformed ISO_CONT and ISO_END packets, exposing adjacent attackers to three distinct kernel-level impacts: a conn->rx_skb memory leak via abnormal ISO_START sequences, a kernel panic triggered by an unchecked skb_put call on oversized ISO_END frames, and silent acceptance of undersized ISO_END packets. All Linux kernel versions from 6.0 through the fix commits on affected stable branches are impacted, with fixes confirmed in 7.1.5 and 7.2-rc3. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS 8.8 AV:A/PR:N vector and the availability of upstream fix commits make this an actionable patching priority for any Bluetooth-enabled Linux deployment.
Use-after-free in the Linux kernel's accel/amdxdna driver exposes systems with AMD XDna NPU hardware to local privilege escalation by a low-privileged attacker. The race condition exists between `aie2_populate_range()` and `amdxdna_umap_release()`, both of which dereference a stale VMA pointer after the underlying virtual memory area may have been freed by the kernel memory manager. With EPSS at 0.20% (10th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, active exploitation is not currently observed - though the CVSS 7.8 score correctly reflects the theoretical potential for full kernel compromise on affected hardware configurations.
Denial of service in the Linux kernel's kernel TLS (kTLS) subsystem allows a remote peer to permanently stall a TLS connection by sending a single zero-length TLS 1.3 application_data record. The `tls_sw_read_sock()` function misinterprets the empty record's zero-length return as a backpressure signal, requeuing the record indefinitely at the head of rx_list and blocking all subsequent TLS data on that connection. No public exploit code exists, the CVE is absent from the CISA KEV catalog, and EPSS sits at 0.21% (11th percentile), indicating low current exploitation interest despite the 7.5 CVSS score.
Kernel-memory corruption in the Linux kernel's net/liquidio (Marvell/Cavium LiquidIO SmartNIC) SR-IOV driver stems from caching virtual-function pci_dev pointers that hold no reference; the stale pointer is later dereferenced when servicing an OCTEON_VF_FLR_REQUEST, yielding a use-after-free reachable from a virtual function. Affected systems are hosts running the liquidio PF driver with SR-IOV enabled and VFs assigned to guests. Successful triggering can crash the host or corrupt kernel memory (potential privilege/scope escalation from a VF into the host); this is no public exploit identified at time of analysis, EPSS is low (0.20%), and a vendor fix is available.
Use-after-free race condition in the Linux kernel's AMD XDNA accelerator driver (accel/amdxdna) allows a local, low-privileged attacker on systems with AMD XDNA hardware to corrupt kernel memory, potentially achieving full privilege escalation. The race window opens because amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove() before removing the object from abo->mem.umap_list, permitting aie2_populate_range() to obtain a stale reference concurrently. No public exploit has been identified at time of analysis, and an EPSS of 0.21% (11th percentile) signals minimal current exploitation interest.
Kernel panic (use-after-free) in the Linux kernel IPv4 IGMP stack allows a network-adjacent attacker to crash the host by racing an inbound IGMP membership query against network-device teardown. The flaw lives in igmp_gq_start_timer(), where in_dev_hold() re-arms the general-query timer on an in_device whose refcount has already dropped to zero during inetdev_destroy(), so the RCU-freed structure is accessed when the timer later fires. The upstream fix is merged and shipped across stable branches; there is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile).
Kernel panic (and potential memory corruption) in the Linux kernel's IPv6 multicast stack arises from a use-after-free in the MLD delayed-work path, where a race between network-device teardown and incoming MLD query processing lets igmp6_event_query() take a reference on an inet6_dev whose refcount has already reached zero. Affected systems run kernels across the 2.6.12-through-7.x range prior to the fixed stable releases, and successful triggering causes a refcount 'addition on 0' warning followed by access to freed memory once the scheduled work runs. There is no public exploit identified at time of analysis, EPSS risk is low (0.22%, 13th percentile), and it is not listed in CISA KEV.
Firewall policy bypass in the Linux kernel's netfilter nftables subsystem allows remote attackers to evade packet-filtering rules that use inverted set lookups. The flaw lives in nft_lookup_eval(), where the match result for negated lookups ('!= @set') is computed before the catchall element used by interval sets is folded in, so rules resolve to the wrong verdict. It affects the nf_tables classifier across a wide range of kernel branches; there is no public exploit identified at time of analysis and EPSS probability is low (0.21%).
Improper handling of ICMP error packets in the Linux kernel's IPVS (IP Virtual Server) subsystem allows crafted ICMP errors from tunneled traffic to reference inner IP headers that are not guaranteed to reside in the skb headroom after pskb_pull() strips the outer headers, leading to out-of-bounds access in path-MTU update, icmp_send() and debug paths. The flaw affects hosts using IPVS load balancing with tunnel encapsulation; the practical consequence is an out-of-bounds read (information disclosure per source tags) or kernel crash rather than code execution. No public exploit identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not listed in CISA KEV.
Out-of-bounds kernel memory read in the Linux kernel's CIFS/SMB client (parse_dfs_referrals) affects hosts that mount SMB shares involving DFS referrals. A malicious or man-in-the-middle SMB server can return a referral whose server-supplied string offsets point beyond the received response buffer; the unchecked offset yields a negative max_len that reaches kstrndup()/strnlen() as a size_t, causing an out-of-bounds read that can leak adjacent kernel memory or crash the client. CVSS is 9.4, but there is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.21%, 12th percentile), indicating no observed exploitation.
Use-after-free (refcount_t underflow) in the Linux kernel's SUNRPC TLS connect path lets a failing TLS-secured RPC transport dereference an already-freed upper rpc_clnt, corrupting kernel memory. It affects systems using RPC-with-TLS transports (notably NFS-over-TLS/mTLS mounts) where a fatal handshake failure races the delayed connect_worker. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile); the input's 9.8 CVSS reflects Linux's automated scoring rather than the local, config-dependent trigger described.
Linux kernel SMB/CIFS client exposes a race condition between direct I/O (DIO) write completion and filesystem unmount that leaves dentry reference counts unreleased, triggering a kernel BUG warning and potential use-after-free condition. Local users with access to CIFS-mounted shares can trigger this by initiating a DIO write and concurrently unmounting the filesystem, allowing the kernel's shrink_dcache_for_umount() to fire before deferred workqueue cleanup has decremented the dentry refcount. With CVSS 7.8 and C:H/I:H/A:H, the theoretical impact is full kernel compromise, though no public exploit and an EPSS of 0.20% (10th percentile) indicate this remains a low-exploitation-probability vulnerability at time of analysis.
The regulator subsystem in the Linux kernel contains a deadlock-handling defect where `regulator_lock_two()` compares the return value of `ww_mutex_lock()` against `-EDEADLOCK` instead of the correct `-EDEADLK` constant. On MIPS architecture - the only platform where the regulator core is active and these two error constants carry different numeric values - the mismatch causes the kernel to skip the mandatory unlock-and-retry backoff sequence, fire `WARN_ON`, and return to the caller with only one of the two regulators locked, producing corrupted locking state. No public exploit has been identified and EPSS is very low (0.22%, 13th percentile), but the high CVSS impact ratings (C:H/I:H/A:H) reflect the potential for kernel panic or local privilege escalation on affected MIPS systems.
The octeontx2-af driver in the Linux kernel mishandles SR-IOV mailbox requests for nix_set_rx_mode, allowing a low-privileged user controlling a Virtual Function on Marvell OcteonTX2 hardware to silently delete the Physical Function's MCAM promiscuous and allmulti filtering rules through ordinary interface bringup or teardown operations. Affected Linux kernel versions span 5.14 through multiple stable branches, patched in 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), consistent with negligible observed exploitation activity and the hardware-specific attack surface.
Integer overflow in the Linux kernel SMB client's smb2_ioctl_query_info() function enables a malicious SMB server to bypass bounds checking during PASSTHRU_FSCTL response processing, leading to an out-of-bounds kernel memory read disclosed to userspace. Affected systems are Linux kernels across multiple stable branches where OutputOffset and qi.input_buffer_length are summed without overflow protection, allowing a server-controlled 32-bit wrap to defeat the bounds check and cause copy_to_user() to read beyond the response buffer. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% reflects low current exploitation probability, but the network-reachable attack surface and high confidentiality impact (CVSS 8.1) make patching a near-term priority for any Linux host using SMB client connectivity.
Kernel memory corruption in the Linux ASoC Sound Open Firmware (SOF) IPC4 control subsystem allows a low-privileged local user to trigger incorrect buffer copy lengths in sof_ipc4_bytes_put(), potentially achieving high confidentiality, integrity, and availability impact. The root cause is a logic error - not a race - where the copy size is sourced from the stale in-kernel buffer's size field rather than from the incoming user-supplied sof_abi_hdr.size in ucontrol, enabling data truncation or stale-byte copying into kernel structures. No public exploit code or active exploitation has been identified at time of analysis; patch commits are available across multiple stable kernel series.
Missing payload size validation in the Linux kernel's ASoC SOF IPC4 control subsystem allows a local low-privileged attacker to trigger out-of-bounds memory access when the kernel processes MODULE_NOTIFICATION messages. Affected systems are those running Linux kernel 7.0 and related stable branches where the SOF IPC4 audio driver is active - typically Intel hardware using Sound Open Firmware. No public exploit or CISA KEV listing exists, and EPSS sits at 0.20% (10th percentile), indicating low current exploitation interest, though the CVSS 7.8 score reflects real kernel-level impact potential.
Integer overflow in the Linux kernel's ASoC Sound Open Firmware (SOF) IPC3 control handler allows a local, low-privileged attacker on 32-bit platforms to bypass buffer size validation and trigger out-of-bounds memory access in `snd_sof_update_control`. The flaw exists because `sof_ipc3_control_update()` performs unguarded arithmetic on firmware-supplied `cdata->num_elems`, which wraps on 32-bit integer arithmetic and causes the subsequent header size check to pass with mismatched values. No public exploit code exists and no CISA KEV listing is present; EPSS probability is 0.23% at the 14th percentile, with vendor patches available across multiple stable kernel branches.
Memory corruption and information disclosure in the Linux kernel's ASoC Sound Open Firmware (SOF) IPC3 control subsystem allows local users with low privileges to corrupt kernel memory or leak sensitive data. The flaw affects sof_ipc3_bytes_put() and sof_ipc3_bytes_get() functions, where wrong-size memcpy operations and an off-by-sizeof bounds check create exploitable memory safety violations. No public exploit or CISA KEV listing exists at time of analysis; the EPSS score of 0.21% (12th percentile) reflects a low but non-negligible near-term exploitation probability.
Out-of-bounds/use-after-free read in the Linux kernel TIPC subsystem occurs when the enqueue-path debug tracepoints in tipc_sk_enqueue() dump sk_receive_queue while only sk->sk_lock.slock is held. Because that spinlock protects only the backlog queue and does not serialize against the socket owner consuming or purging the receive queue, the tracepoint can dereference skbs already dequeued or freed, as caught by KASAN. There is no public exploit identified at time of analysis, EPSS is very low (0.21%, 11th percentile), and the issue is only reachable when TIPC debug tracepoints are active.
Integer overflow in the Linux kernel's QRTR (Qualcomm IPC Router) subsystem on 32-bit platforms allows an out-of-bounds kernel heap write via a crafted incoming packet. On 32-bit builds where size_t is four bytes, passing size >= 0xfffffffd to ALIGN(size, 4) wraps the result to zero, bypassing the packet validation check in qrtr_endpoint_post() and allowing skb_put_data() to write attacker-controlled data far beyond the allocated socket buffer. This is the 32-bit residual of commit ad9d24c9429e2, which fixed only the 64-bit case; 64-bit kernels are structurally unaffected. No public exploit is identified at time of analysis, and EPSS at 0.22% reflects low exploitation probability.
Out-of-bounds read in the Linux kernel ATM networking subsystem (`net/atm`) allows local low-privileged users to disclose kernel memory or crash the system by supplying an out-of-range `traffic_class` value via the `SO_ATMQOS` socket option. The flaw persists because `check_tp()` fails to reject traffic class values above `ATM_ANYCLASS`, leaving the invalid value in `vcc->qos` where it is later used as an unguarded array index in `pvc_info()` when `/proc/net/atm/pvc` is read. EPSS sits at 0.22% (13th percentile) with no CISA KEV listing and no public exploit identified, making real-world exploitation risk considerably lower than the CVSS 7.1 score implies, particularly given that ATM networking is a legacy subsystem absent from most modern deployments.
Denial-of-service in the Linux kernel's IFE (Inter-Forwarding-Element) traffic-control action allows a crafted, malformed IFE frame to crash the host, because ife_decode() only guaranteed the outer IFE header was pullable before handing the decapsulated packet to eth_type_trans(), which then reads an inner Ethernet header that may be shorter than ETH_HLEN in the linear skb area. Only systems that have the tc act_ife action configured are exposed. There is no public exploit identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not in CISA KEV; the fix adds ETH_HLEN to the pull check.
Out-of-bounds array indexing in the Linux kernel's KVM irqfd routing for LoongArch allows a local user with KVM access to index past the routing table's chip array boundary, potentially exposing host kernel memory or enabling a hypervisor boundary breach with full triad impact. Patches are available in stable releases 6.18.40, 7.1.5, and 7.2-rc1 across three upstream commits. No public exploit code exists and EPSS sits at 0.21% (11th percentile), indicating negligible active exploitation probability despite the elevated CVSS 8.8 score.
Missing interrupt request (IRQ) validity checking in the LoongArch KVM subsystem of the Linux kernel allows a local low-privileged user with access to KVM device nodes to pass malformed IRQ values via the kvm_vcpu_ioctl_interrupt() ioctl, potentially causing memory corruption or privilege escalation that crosses the guest-to-host boundary. The CVSS scope change (S:C) signals that successful exploitation could compromise the hypervisor host, making this significant for LoongArch-based virtualization environments. No public exploit code has been identified and EPSS probability sits at 0.21%, suggesting exploitation remains theoretical at this time.
Local privilege/information-disclosure risk in the Linux kernel's s390 KVM subsystem stems from an unlikely race in try_get_locked_pte(), where puds or pmds can be unmapped between the p?dp_get() and p?d_offset() calls, leaving code operating on a stale or freed page-table entry. The flaw affects s390 (IBM Z mainframe) systems running KVM virtualization and has now been patched upstream; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.20%, 10th percentile).
Memory corruption in the Linux kernel's KVM/arm64 GICv3 virtualization (vgic) subsystem allows a local attacker on an ARM64 KVM host to trigger a double list removal, corrupting the ap_list and enabling a use-after-free style condition. The flaw lives in vgic_prune_ap_list(), where an interrupt can be pruned from a vCPU's active/pending list a second time after vgic_flush_pending_lpis() already removed it, because the affinity re-check does not confirm the interrupt is still owned by the vCPU. No public exploit is identified at time of analysis, and EPSS is low (0.22%), consistent with a race-condition kernel bug that is difficult to weaponize.
Local privilege escalation / host memory corruption in the Linux kernel's arm64 KVM vGIC subsystem allows a malicious or compromised guest VM to trigger a use-after-free by racing an LPI (Locality-specific Peripheral Interrupt) disable against an interrupt affinity migration across vCPUs. When vgic_prune_ap_list() drops and reacquires the irq and ap_list locks, a concurrent affinity change can free the interrupt out from under it, leading to a kernel UAF that can crash the host or potentially enable host-kernel code execution. This is not in CISA KEV and no public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile), consistent with a hard-to-win race rather than a turnkey exploit.
Improper state unwinding in the Linux kernel KVM nested VMX (nVMX) subsystem allows a low-privileged local attacker operating within an L1 guest to potentially escape the virtualization boundary and gain control over the host hypervisor's page table base register (CR3). When EPT is disabled and the deferred vTPR-vs-TPR Threshold consistency check fails, KVM does not restore vmcs01.GUEST_CR3 to its own value, leaving it set to an L1-controlled address - enabling a malicious guest to redirect hypervisor memory mappings to attacker-controlled structures. No public exploit has been identified and no CISA KEV listing exists; EPSS at 0.20% (10th percentile) confirms currently low observed exploitation probability.
Incomplete SEV-SNP state handling in the Linux kernel's KVM subsystem breaks AMD Secure Encrypted Virtualization isolation when intra-host VM migration or mirroring is attempted on SNP guests, potentially exposing encrypted guest memory to confidentiality and integrity breaches. The vulnerability affects multiple stable kernel branches from commit 1dfe571c12cf99244b933208fb77f29471ded677 onward, with fixes backported to 6.12.97, 6.18.40, 7.1.5, and 7.2-rc4. No public exploit code exists at time of analysis, and the EPSS score of 0.21% at the 11th percentile places real-world exploitation probability as very low despite the high official CVSS score of 8.8.
Out-of-bounds kernel memory access in Linux KVM's Intel TDX subsystem allows a local, low-privileged user to exploit a TOCTOU race condition during TD virtual machine initialization, potentially achieving kernel memory disclosure, corruption, or denial of service. The vulnerable path exists in tdx_td_init(), where the cpuid.nent field is read once to size a flexible allocation and then again from the copied structure - allowing userspace to change the count between those two references. No active exploitation has been confirmed and EPSS probability is very low (0.20%, 10th percentile), limiting immediate real-world risk to TDX-enabled production environments.
Denial-of-service in the Linux kernel's KVM x86 subsystem allows a guest VM to crash the host hypervisor by exploiting a state inconsistency in PV EOI (paravirtual end-of-interrupt) handling. When a guest triggers a memory read failure in `pv_eoi_get_user()` while concurrently disabling PV EOI, KVM fires a fatal assertion in `kvm_lapic_sync_from_vapic()` at `lapic.c:3338`, producing a kernel BUG and crashing the host. This takes down all co-resident virtual machines. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but vendor-confirmed patches are available across multiple stable kernel branches.
Use-after-free in the Linux kernel's KVM x86 irqfd subsystem exposes hypervisor hosts to potential privilege escalation and VM escape when VFIO PCI device passthrough is in use. The flaw arises because a failed IRTE bypass update leaves irqfd->producer as a dangling pointer; if the VFIO PCI vector is subsequently disabled-an event independent of KVM routing-the now-freed vfio_pci_irq_ctx struct can be dereferenced through KVM's routing table, corrupting kernel memory. No public exploit has been identified at time of analysis and EPSS is low (0.22%, 13th percentile), but the S:C scope change in the CVSS vector reflects the potential for a low-privilege local attacker to escape VM boundaries into the host kernel.
Improper locking scope in the Linux kernel KVM subsystem exposes a use-after-free race condition through `kvm_io_bus_get_dev()`, where the function drops the SRCU lock before returning a device pointer, leaving a window in which the referenced object may be freed before the caller can safely inspect it. All Linux kernel versions from the introducing commit (approximately 4.8) through the 7.1 and 6.x stable series are affected until patched releases across eight stable branches are applied. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% reflects a low current probability of exploitation despite the High CVSS severity rating.
Denial of service in the Linux kernel's KVM arm64 nested virtualization subsystem allows a guest to crash the host hypervisor by writing to the ZCR_EL2 system register alias during a nested context. Affected systems run arm64 Linux kernel builds where FEAT_NV2 is advertised to an L1 guest hypervisor; the write is architecturally legitimate in this context, but a misplaced WARN triggers a hyp_panic, taking down the KVM hypervisor layer. No public exploit or CISA KEV listing exists, and EPSS probability sits at 0.21% (11th percentile), reflecting low observed exploitation activity.
Improper permission handling in the KVM ARM64 nested-virtualization (NV) subsystem of the Linux kernel (6.16 through fixes in 6.18.40/7.1.5) lets a malicious L1 guest hypervisor write to a read-only backing page and trigger a page reference leak on the host. When mapping the L1 VNCR page into the host stage-1, KVM trusted only the guest stage-1 permissions and ignored that the backing PFN may be read-only (e.g. a read-only memslot), permitting writes to memory that should be immutable and leaking pages on the read-only early-return path. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the issue is not in CISA KEV.
Guest-to-host memory corruption in the Linux kernel's arm64 KVM nested-virtualization (NV) path arises from mishandling of the VNCR page translation: when a nested guest reads the VNCR page before writing, the host maps the PFN read-only and fails to re-fetch a writable translation on the subsequent write abort. The fix invalidates the VNCR TLB and re-translates before injecting the abort, restoring correct write-fault handling and satisfying FEAT_ETS2/3 ordering. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and it is not on CISA KEV.
Denial-of-service in the Linux kernel's arm64 KVM nested-virtualization (NV) support allows an L1 guest to trigger a host System Error (SError) by pointing its VNCR mapping at a non-memory PFN. Because kvm_translate_vncr() unconditionally applies cacheable memory attributes without checking whether the backing PFN is real memory, a writeback to a device/non-cacheable endpoint can raise an uncontained SError on the host. The upstream fix makes KVM reject non-memory backing and inject a Synchronous External Abort (SEA) into the guest instead. There is no public exploit identified at time of analysis and EPSS is low (0.21%).
KVM on s390 (IBM Z mainframe) exposes a hypervisor boundary-crossing flaw in its PCI Adapter Interrupt Forwarding (AIF) subsystem, where a guest VM registering IRQs without an Adapter Interrupt Summary Bit (AISB) causes the kernel to write `virt_to_phys(page_address(NULL))` - a non-zero, incorrect physical address - into the Guest Adapter Interrupt Table Entry (GAITE) rather than the correct zero sentinel. The CVSS scope change (S:C) indicates this poisoned GAITE entry can be used to cross the guest/host trust boundary, enabling potential host memory disclosure, corruption, or destabilization from a low-privileged guest context. No public exploit code and no CISA KEV listing exist at time of analysis; patches have been issued across multiple Linux stable kernel branches.
Buffer over-read and under-run vulnerabilities in the s390/zcrypt subsystem of the Linux kernel allow a local low-privileged user on IBM Z (mainframe) hardware to crash the kernel or expose adjacent kernel memory by submitting malformed CCA key token structures with attacker-controlled length fields. The affected functions cca_check_sec*token() and cca_gencipherkey() failed to validate the token's internal len field against actual buffer boundaries or minimum structure sizes before use in memory operations. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the CVSS score of 7.1 reflects genuine high-severity impacts in affected environments.
Kernel memory corruption in the Linux kernel's s390/zcrypt CCA AES cipher key handling path allows a local low-privileged user on IBM Z mainframe systems to trigger an out-of-bounds buffer operation with full confidentiality, integrity, and availability impact. The function `cca_cipher2protkey()` uses the length field from a user-supplied key token header to determine the copy size for the CPRB parameter block without validating it against the actual available buffer space, enabling adjacent kernel memory corruption. No public exploit exists and this is not in CISA KEV; vendor-released patches are available across multiple stable kernel branches including 6.6.151, 6.12.103, 6.18.44, and 7.1.8.
Missing length validation in the Linux kernel's s390/zcrypt CCA ECC private key handler allows a local low-privileged user on IBM Z (s390) systems to trigger a buffer overread or overflow in the CPRB parameter block. The `cca_ecc2protkey()` function blindly trusts the length field embedded in a caller-supplied key token when computing how many bytes to copy into a fixed-size parameter block, enabling a crafted oversized token to corrupt adjacent kernel memory. No public exploit has been identified at time of analysis, and this vulnerability is architecture-specific to IBM Z mainframe Linux deployments.
Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with AMD v9 GPU hardware. The MQD control stack copy uses cp_hqd_cntl_stack_size directly from hardware registers without bounding it to the allocated Buffer Object, allowing memcpy to read past the BO into adjacent GTT memory. A local low-privileged user with access to AMD GPU compute queue checkpointing can recover sensitive kernel data; no public exploit has been identified at time of analysis, though the 15% EPSS score is above baseline for kernel information-disclosure flaws.
Missing input validation in the Linux kernel's drm/vmwgfx driver allows a low-privileged local user on a VMware guest VM to supply an arbitrary array_size value in vmw_surface_metadata via ioctl, bypassing per-Shader-Model limits and triggering out-of-bounds kernel memory access with high confidentiality, integrity, and availability impact. Affected kernel versions span 5.7 through multiple stable branches, with patches now available for 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. No public exploit code or CISA KEV listing has been identified at time of analysis, though EPSS at 16% signals a meaningfully elevated probability of eventual exploitation.
GPU shader validation bypass in the Linux kernel's drm/vc4 driver allows local low-privileged users to rewrite validated shader bytecode after it has been approved by the GPU security validator. Specifically, vc4_gem_object_mmap() rejects writable mappings of validated shader buffer objects (BOs) but neglects to clear VM_MAYWRITE, enabling a two-step attack: map the BO read-only, then invoke mprotect() to silently upgrade the mapping to PROT_WRITE, bypassing the one-time validation check the GPU trusts unconditionally. No public exploit has been identified and no CISA KEV listing exists, but an EPSS of 17% is elevated for a local-only kernel driver issue, warranting prompt patching on affected Raspberry Pi and BCM283x-based platforms.
Use-after-free in the Linux kernel's btrfs filesystem driver allows a low-privileged local user to cause kernel memory corruption with full system compromise potential. Introduced by a regression in commit f86f7a75e2fb, the btrfs extent map splitting code in btrfs_drop_extent_map_range() incorrectly propagates EXTENT_FLAG_LOGGING to child split maps, which are never cleared of this flag; when the extent map shrinker later frees such a map while it remains on the inode's modified_extents list, a use-after-free is triggered. No public exploit has been identified at time of analysis, but an EPSS of 16% signals elevated exploitation probability for a local kernel UAF affecting Linux 6.8 and later across multiple stable branches.
Heap overflow in the Linux kernel's txgbe network driver enables a local attacker to write beyond an allocated heap buffer during ethtool EEPROM reads, potentially escalating to full kernel compromise on systems with Wangxun txgbe 10GbE hardware. The flaw exists because txgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes into a buffer ethtool allocates to exactly length bytes, causing a 1-3 byte out-of-bounds write whenever the requested length is not 4-byte aligned. Vendor patches are available in Linux 6.19 and stable releases 7.1.6 and 7.2-rc5; no public exploit code or active exploitation has been identified at time of analysis, though the 16% EPSS score is notably elevated for a kernel driver defect.
Uninitialized memory read in the Linux kernel's libceph client library exposes stale kernel buffer contents and risks system instability on Ceph-connected hosts. The flaw exists in handle_get_version_reply(), which incorrectly uses msg->front_alloc_len - the allocated buffer size - as the decode boundary instead of msg->front.iov_len, the count of bytes actually received. A truncated MON_GET_VERSION_REPLY from a malicious or compromised Ceph monitor therefore passes the ceph_decode_need() guard and reads a second u64 from leftover bytes of a prior message, constituting an out-of-bounds read of uninitialized kernel memory. No public exploit has been identified at time of analysis, but the 16% EPSS score is elevated for a kernel library flaw and warrants prompt patching on Ceph-client deployments.
Privilege escalation in the Linux kernel's vxlan subsystem allows a local user holding CAP_NET_ADMIN in a vxlan device's network namespace to rewrite underlay configuration in a separate, more privileged namespace where they lack that capability. The flaw in vxlan_changelink() affects multiple stable kernel branches (6.6.x, 6.12.x, 6.18.x, 7.1.x, and 7.2-rc) and is most impactful in multi-tenant container or cloud environments where vxlan devices span namespace boundaries - a common topology in Kubernetes and OpenStack deployments. With an EPSS score of 17% and no public exploit or CISA KEV listing confirmed at time of analysis, this is an elevated-risk local privilege escalation requiring prompt patching on affected containerized infrastructure.
Out-of-bounds memory read in the Linux kernel's in-kernel SMB server (ksmbd) lets a remote, unauthenticated client leak adjacent kernel memory. The receive path applied the minimum SMB2 PDU size check only to packets with ProtocolId SMB2_PROTO_NUMBER, so a short packet carrying SMB2_TRANSFORM_PROTO_NUM slipped past validation on an SMB 2.1 connection (which offers no transform handling) and reached init_smb2_rsp_hdr(), which read past the request allocation and returned the copied fields to the client. Rated CVSS 9.1 with an EPSS of 11%; no public exploit or CISA KEV listing is indicated, so this is no public exploit identified at time of analysis.
Use-after-free in the Linux kernel's GPU host1x subsystem (`host1x_bo_clear_cached_mappings`) exposes local low-privileged users to potential kernel heap corruption leading to privilege escalation, memory disclosure, or system crash. The flaw occurs because `__host1x_bo_unpin()` frees the mapping object, yet the caller continues dereferencing `mapping` instead of the surviving `cache` local variable. Patches are confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, 7.2-rc4); no public exploit or active exploitation is identified at time of analysis, and EPSS sits at an extremely low 0.16% (6th percentile).
Use-after-free in the Linux kernel's IPsec transmit path (xfrm) occurs when validate_xmit_xfrm() processes a GSO segment list and async crypto offload steals the final segment via -EINPROGRESS, leaving the list head's ->prev pointing at a segment now owned (and potentially freed) by the crypto engine. validate_xmit_skb_list() then writes through that stale tail pointer, corrupting freed memory; the practical impact is kernel memory corruption and likely crash on systems using IPsec with asynchronous crypto. No public exploit identified at time of analysis, EPSS is low (0.16%), and it is not listed in CISA KEV, so this is a patch-and-move-on issue rather than an active-exploitation emergency.
Linux kernel's IB/mad subsystem exposes unauthenticated adjacent-network attackers to a kernel availability and integrity impact through premature RMPP reassembly state allocation. Systems with InfiniBand hardware running Linux 2.6.13 through multiple active stable branches are vulnerable: an attacker on the InfiniBand fabric can send unsolicited RMPP DATA responses routed to a kernel RMPP agent via crafted high TID bits, causing the kernel to allocate or extend RMPP receive state without any validated corresponding send request. EPSS exploitation probability is very low (0.16%, 6th percentile), no public exploit or CISA KEV listing exists, but the availability impact is rated High, making this a meaningful risk in HPC and data-center InfiniBand environments.
Stack-out-of-bounds read in the Linux kernel's XFRM/IPsec subsystem allows a local user with network policy configuration privileges to read out-of-bounds kernel stack memory and potentially crash the system by crafting an outbound XFRM policy using an optional IPTFS-mode template. The flaw is an incomplete fix: commit 3d776e31c841 blocked optional tunnel and BEET templates in outbound policies to prevent this exact class of bug, but the later-added IPTFS mode was never covered by that restriction. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.15%, and a functional reproducer is embedded in the upstream fix commit, lowering the barrier for any local attacker who discovers the configuration.
Remote memory access corruption in the Linux kernel's RDMA/irdma subsystem allows a local user with RDMA device access to trigger an invalid CQP (Control Queue Pair) command carrying a zero-initialized mkey by invoking rereg_mr on special QP/CQ/SRQ buffer registrations that were never intended for re-registration. Affected systems include Intel RDMA-capable hardware environments running Linux 6.6.x through 6.6.147, 6.7, and related stable branches prior to the fix commits. No public exploit code has been identified at time of analysis, and EPSS is very low at 0.16% (6th percentile), indicating limited exploitation interest despite the 7.8 CVSS score.
Race condition in the Linux kernel RDMA/siw (Software iWARP) subsystem exposes partially-constructed Queue Pair (QP) objects to concurrent lookups during QP creation. Affected kernels from 5.3 onward allow a local, low-privileged user on systems with the siw driver loaded to trigger a QPN lookup that resolves to a QP whose queues, CQ pointers, state, and device list entry have not yet been initialized. This can result in kernel memory corruption, information disclosure, or system availability loss - all three impact dimensions confirmed by the CVSS C:H/I:H/A:H rating. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.16% at the 5th percentile.
Stale mode_callbacks pointer dereference in the Linux kernel xfrm IPTFS subsystem causes kernel panic when deferred garbage collection runs after the xfrm_iptfs module has been unloaded following a failed IPTFS state initialization. The xfrm subsystem's __xfrm_init_state() caches x->mode_cbs before IPTFS setup completes, but releases the temporary module reference immediately on failure - leaving a dangling callback table pointer that xfrm_state_gc_task later dereferences against an unloaded module. No public exploit code exists and EPSS is 0.17% (6th percentile), though the vendor-assigned CVSS of 7.8 reflects worst-case kernel memory impact if the race is won.
Use-after-free in the Linux kernel cfg80211 WiFi subsystem exposes systems with wireless adapters to potential kernel memory corruption via a race condition between scheduled scan result processing and WiFi device unregistration. All Linux kernel versions from approximately 3.0 (commit 807f8a8c) through stable releases prior to 6.6.148, 6.12.101, 6.18.42, and 7.1.6 are affected wherever cfg80211-based WiFi drivers are in use. No public exploit has been identified at time of analysis, and EPSS at 0.16% (6th percentile) reflects low current exploitation probability despite the kernel-level C:H/I:H/A:H impact potential.
Use-after-free race condition in the Linux kernel mac80211 MLO (Multi-Link Operation) link removal path allows an adjacent-network attacker to trigger kernel memory corruption on WiFi 7-capable systems. The flaw exists because sta_remove_link() immediately frees the percpu RX stats buffer while deferring only the link container to RCU, leaving the kernel's fast RX path able to dereference the freed percpu block via a stale link_sta pointer. No public exploit code exists and EPSS is 0.17% (6th percentile), consistent with the kernel commit description's own characterization of the race window as 'hard to win in practice,' though a successful exploit would carry full kernel-level impact.
A race condition in the Linux kernel's cfg80211 wifi subsystem exposes systems to kernel memory corruption by a local, low-privilege user. The flaw exists between the NETLINK_URELEASE notification path and the NETDEV_GOING_DOWN cancellation path for the wireless device autodisconnect work item: because the work is a plain work_struct, it can be re-queued after cancellation and outlive the wdev structure it references, since synchronize_net() does not drain work queued by in-flight RCU readers. Upstream fix commits are available on kernel.org stable trees, and no public exploit or CISA KEV listing has been identified at time of analysis.
Slab-out-of-bounds read in the Linux kernel's wifi cfg80211 subsystem exposes systems with WiFi interfaces to kernel crash or minor memory disclosure when parsing crafted 802.11 frames from a rogue access point. The flaw, located in cfg80211_is_element_inherited() within net/wireless/scan.c, is triggered during Multi-Link Element (MLE) per-STA profile parsing when a zero-length WLAN_EID_EXTENSION element is present in a (re)association response or non-transmitted BSS profile - causing the parser to read one byte past the end of the element buffer. No public exploit or KEV listing exists at time of analysis; EPSS at 0.17% (6th percentile) reflects low current exploitation probability, though the adjacent-network attack vector and zero-privilege requirement keep real-world risk elevated for WiFi-attached Linux endpoints.
Out-of-bounds memory writes in the Linux kernel's ARM Firmware Framework for Armv8-A (FF-A) driver expose local low-privilege users to kernel memory corruption on affected ARM platforms. Two distinct write-past-end defects exist in ffa_setup_and_transmit(): one triggered when the FFA protocol version is below 1.2 due to a struct size mismatch causing writes beyond allocated memory, and another from missing size validation before writing constituents. Upstream kernel patches are available across multiple stable branches (6.18.42, 7.1.6, 7.2-rc4); no public exploit or active exploitation has been identified at time of analysis, and EPSS probability is very low at 0.17%.
Incorrect offset calculation in the Linux kernel's arm_ffa firmware subsystem exposes local privilege escalation on systems using the Arm Firmware Framework for Armv8-A (FF-A). The flaw uses a hardcoded sizeof(struct ffa_mem_region) instead of the descriptor's ep_mem_offset field to locate the endpoint memory access array, violating the FF-A specification. A local user with low privileges could exploit this memory misinterpretation to achieve high confidentiality, integrity, and availability impact; no public exploit or active exploitation (KEV) has been identified at time of analysis.
Use-after-free in the Linux kernel BPF subsystem allows a local low-privileged attacker to corrupt or access freed kernel memory through a race condition in socket cloning. The flaw exists in sk_clone() where a shallow copy via sock_copy() leaves newsk->sk_bpf_storage pointing to the parent socket's BPF local storage; if an early bailout occurs before bpf_sk_storage_clone() runs, subsequent freeing of the cloned socket destroys the parent's storage, triggering a UAF. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and EPSS sits at 0.16% (6th percentile), indicating low current exploitation probability.
Use-after-free in the Linux kernel's PPP-over-L2TP subsystem exposes a race condition between softirq RX processing and socket teardown, reachable by an unprivileged local user and capable of yielding full kernel memory corruption and privilege escalation. The pppol2tp_recv() function runs under rcu_read_lock() but dereferences an internal struct channel that close() can free with a plain kfree() when the channel was bound via PPPIOCGCHAN without a subsequent PPPIOCCONNECT, bypassing all RCU grace-period fences. Patches are available across multiple stable kernel branches; no public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV.
Use-after-free race condition in the Linux kernel AF_IUCV HiperSockets receive path allows a network-adjacent unauthenticated attacker to dereference freed kernel memory, potentially achieving kernel code execution and full system compromise. The flaw exclusively affects IBM z/Architecture (mainframe) systems running Linux under z/VM with the AF_IUCV subsystem active, making the exploitable population extremely narrow. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), consistent with the niche deployment context; patched stable kernel releases are available across multiple branches.
Use-after-free in the Linux kernel's Bluetooth MGMT subsystem allows a local attacker with low-privilege Bluetooth Management socket access to corrupt kernel heap memory and potentially escalate privileges to root. The flaw exists in MGMT_OP_LOAD_CONN_PARAM handling, where a borrowed hci_conn_params pointer stored in a queued work item can be freed by a subsequent LOAD_CONN_PARAM call before hci_cmd_sync_work executes the callback - a race-driven use-after-free confirmed by KASAN. No public exploit or active exploitation has been identified at time of analysis; patches are available across stable kernel series 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4.
Use-after-free in the Linux kernel Bluetooth HCI synchronization layer (hci_sync) allows adjacent, unauthenticated attackers to corrupt kernel memory, potentially achieving full system compromise. The root cause is that RCU-protected conn_hash lookup results were dereferenced outside RCU critical sections without holding a reference count, permitting concurrent deletion to free the connection object while it is still in use. With a CVSS score of 8.8 (AV:A), exploitation requires only Bluetooth adjacency and no privileges; however, the EPSS score of 0.17% (6th percentile) and absence from CISA KEV indicate no confirmed active exploitation or public weaponized exploit at time of analysis.
Use-after-free in the Linux kernel's Bluetooth management subsystem allows a local low-privileged attacker to corrupt kernel memory during unpair_device or disconnect_sync operations, potentially achieving full kernel compromise (High C/I/A). The flaw stems from dereferencing RCU-protected hci_conn pointers outside proper critical sections, enabling a concurrent free of the structure while it is still in use. Vendor-released patches are available across multiple stable branches (6.6.148, 6.12.101, 7.1.6, 6.18.42); no public exploit code is identified at time of analysis, and EPSS of 0.17% indicates low immediate exploitation probability.
Use-after-free and data race conditions in the Linux kernel Bluetooth management subsystem allow a local low-privileged attacker to corrupt kernel memory, potentially escalating privileges to root. Affected kernels fail to properly hold reference counts on hci_conn objects stored in mgmt_pending_cmd structures and fail to acquire hdev->lock before accessing conn->state, enabling RCU-protected pointers to be dereferenced after the underlying memory has been freed. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects low observed exploitation pressure despite the high CVSS score.
Missing mutex protection in the Linux kernel's Bluetooth HCI synchronization layer creates a race condition when hci_conn_params_lookup is called without holding hdev->lock, enabling unsafe concurrent list iteration and parameter access at kernel level. All Linux kernel builds spanning commit c530569adc19b5f0c62955de41f067bad34e3fe0 up to the respective fix commits are affected when the Bluetooth subsystem is active. An adjacent, unauthenticated attacker within Bluetooth radio range could exploit this race window to achieve kernel-level memory corruption, information disclosure, or potentially arbitrary code execution. No public exploit or active exploitation (CISA KEV) has been identified; EPSS at 0.15% (5th percentile) reflects low current weaponization despite the elevated CVSS base score.
Use-after-free in the Linux kernel Bluetooth hci_qca driver allows an attacker within Bluetooth radio range to corrupt kernel heap memory by inducing a Qualcomm Atheros QCA controller to report a zero-length memory dump. Systems running unpatched kernels prior to 6.6.148, 6.12.101, 6.18.42, or 7.1.6 with QCA Bluetooth hardware are exposed, with potential impact spanning kernel information disclosure, memory corruption, and denial of service. No public exploit code has been identified at time of analysis, and EPSS probability is very low at 0.17% (6th percentile), indicating no evidence of active or widespread exploitation.
Client-side data-integrity failure and bounded out-of-bounds read in the Linux kernel SMB/CIFS client (smb3_simple_fallocate_range) allows a malicious or compromised SMB server to cause the client to skip zero-filling holes during fallocate, so a range the client reports as successfully allocated is left as an un-zeroed hole and a later write can fail with ENOSPC; a malformed server-supplied range length can additionally trigger an out-of-bounds read of the zero buffer. Affected systems are Linux hosts that mount SMB3 shares and call fallocate on them; the fix is merged upstream and backported to stable trees. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is 0.17% (6th percentile).
Race condition in the Linux kernel's CAN raw socket subsystem allows a local low-privileged user to trigger concurrent read-modify-write operations on the raw flags bitfield, potentially leading to kernel memory corruption and local privilege escalation. Introduced by commit 890e5198a6e5, which consolidated separate integer flags into a single bitfield in struct raw_sock without adequate locking in raw_setsockopt(), any concurrent call path can race to produce inconsistent flag state. No public exploit code has been identified and EPSS sits at the 11th percentile, indicating low current exploitation probability despite the high CVSS base score.
Incorrect checksum computation in the Linux kernel's s390 (IBM Z mainframe) architecture code causes csum_partial() to read from memory address zero instead of the intended source buffer on machines lacking the vector (VX) facility. Affects s390 systems running the buggy kernel builds; the practical effect is corrupted checksums and potential leakage of kernel memory contents near address zero into computed checksums. Rated CVSS 9.8 by automated scoring, but this is a local architecture-specific correctness bug with no public exploit identified at time of analysis and a low EPSS (0.18%, 7th percentile).
Race conditions in the Linux kernel's drm/xe Virtual Function CCS state management expose Intel Xe GPU SR-IOV environments to local privilege escalation, information disclosure, and memory corruption. The driver's buffer object move operations improperly sequence CCS batch buffer attach and detach relative to in-flight copy jobs, creating two distinct timing windows where a VF migration event can observe partially-copied or already-torn-down CCS metadata. No CISA KEV listing or public proof-of-concept exists at time of analysis, and EPSS of 0.18% (8th percentile) reflects negligible observed exploitation activity; the primary exposure surface is cloud and VDI infrastructure using Intel Xe GPUs with SR-IOV enabled.
Use-after-free in the Linux kernel's Intel Xe discrete GPU driver (DRM/xe) allows a local unprivileged user to access freed kernel memory via a dangling pointer in the GuC execution queue scheduler. The scheduler retains a pointer to an exec queue's name string (`q->name`) that is freed when the exec queue is destroyed, while scheduler fence timelines can still dereference it. Affected kernel versions span the 6.12, 6.15, and 6.16 stable series; no active exploitation has been identified (EPSS: 0.16%, not in CISA KEV), though the impact is rated High (CVSS 7.8) due to full kernel memory read/write/crash potential.
Deadlock in the Linux kernel's drm/xe Intel Xe GPU driver allows a local low-privileged user with GPU queue access to hang or crash the kernel by triggering asynchronous GuC exec queue teardown at device removal time. Affected are kernel versions across the 6.10.14-6.12 stable series on systems with Intel Xe architecture GPUs (Arc, Lunar Lake). No public exploit has been identified and EPSS is at the 6th percentile, indicating low real-world exploitation probability; the risk is primarily an availability impact via kernel deadlock rather than code execution despite the high CVSS score.
Use-after-free in the Linux kernel's in-kernel SMB server (ksmbd) allows the async oplock/lease break notification worker to operate on a freed ksmbd_conn object when connection teardown races with a pending break notification. Affected kernels span the 6.6.x through 6.18 stable series (fixed in 6.6.148, 6.12.101, 6.14, 6.18.42 and related patch releases); the fix pins a real conn reference for the queued work item. Rated CVSS 9.8 by the automated feed, but this is a timing-dependent race with no public exploit identified at time of analysis and a low EPSS score (0.17%, 6th percentile).
Use-after-free in the Linux kernel's AMD XDNA accelerator driver (amdxdna) exposes systems with AMD NPU hardware to local privilege escalation, kernel memory corruption, or system crash. The flaw exists in the job scheduler path: amdxdna_cmd_submit() stores a raw pointer to the submitting process's mm_struct in job->mm without calling mmgrab() to hold a structural reference, while aie2_sched_job_run() later dereferences that pointer from the DRM worker thread - after the originating process may have exited and freed the mm_struct. No public exploit code has been identified at time of analysis, and the EPSS score of 0.17% (7th percentile) is consistent with specialized hardware prerequisites and no active exploitation campaign.
Memory exhaustion in the Linux kernel TCP stack allows remote network-reachable attackers to trigger a reference leak in tcp_tw_bucket structures when PSP (Packet Security Protocol) policy lookup fails during packet processing in both IPv4 and IPv6 receive paths. TIME_WAIT socket references are not released on this failure path, causing a gradual accumulation of unreclaimable kernel memory. The CVSS score of 7.5 (High) reflects the network accessibility and potential for denial-of-service via memory exhaustion, though EPSS at 0.21% (11th percentile) and the absence from CISA KEV indicate no public exploit or confirmed active exploitation at time of analysis.
Use-after-free race condition in the Linux kernel's TC act_tunnel_key subsystem allows a local low-privileged attacker to corrupt kernel heap memory, potentially escalating privileges or crashing the system. The flaw exists in tunnel_key_release_params(), which synchronously frees metadata_dst via dst_release() while concurrent RCU readers in tunnel_key_act() may still hold the old params pointer and attempt dst_clone() on the already-dead reference. A proof-of-concept was developed by Trend Micro ZDI (zdi-disclosures@trendmicro.com) and verified by kernel maintainers with KASAN confirming slab-use-after-free; no public exploit is available beyond that researcher-held POC, and no KEV listing exists at time of analysis.
Stack-based buffer overflow in the Linux kernel's SCTP subsystem corrupts adjacent kernel memory when SCTP authentication is configured with four HMAC identifiers, enabling a remote unauthenticated attacker to achieve high-impact memory corruption via a crafted SCTP packet exchange. Affected kernels span from 2.6.24 through current stable branches, with patches backported to 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4. No public exploit code or CISA KEV listing has been identified; the EPSS score of 0.17% reflects the high exploitation complexity imposed by the required SCTP authentication configuration.
Use-after-free race condition in Linux kernel USB core sysfs allows a local low-privileged user to trigger concurrent memory access on freed BOS descriptor data, potentially leading to kernel memory corruption, privilege escalation, or system crash. The vulnerability arises in bos_descriptors_read() within the USB sysfs subsystem, where udev->bos is accessed without a lock while usb_reset_and_verify_device() - called by numerous drivers across the kernel - can free that same memory simultaneously. No public exploit code exists and the vulnerability is not listed in CISA KEV; the EPSS score of 0.17% confirms low observed exploitation probability at time of analysis.
Memory corruption in the Linux kernel mlx5e driver's Hyper-V VHCA statistics subsystem causes a kernel fault when running as a Hyper-V guest with a Mellanox/NVIDIA ConnectX NIC. The driver initializes the stats buffer with a zero-size allocation that returns ZERO_SIZE_PTR (0x10) instead of NULL, bypasses the NULL guard, and stores the sentinel pointer; once channels open and the hypervisor enables stats reporting, a subsequent memset on address 0x10 faults the kernel. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), reflecting minimal real-world exploitation likelihood despite the high official CVSS score.
The mlx5e HV VHCA stats agent registration in the Linux kernel contains an initialization race condition that can produce NULL pointer dereferences or kernel timer list corruption, crashing a Hyper-V guest VM. Affected systems are those running Linux on Microsoft Hyper-V with a Mellanox mlx5e NIC across stable kernel trees spanning 6.1 through 7.1, with the root cause being that mlx5_hv_vhca_agent_create() publishes the agent and triggers an asynchronous workqueue callback before the caller has initialized the associated delayed_work structure and agent pointer. No public exploit code has been identified and EPSS exploitation probability is 0.21% (12th percentile); vendor patches have been released across all active stable branches and upstream commit references are available via kernel.org.
Race condition in the Linux kernel's Microchip VCAP network driver corrupts hardware forwarding table entries on systems using sparx5 or lan969x switching ASICs. A local authenticated user can simultaneously trigger a debugfs VCAP rule dump and a tc-flower rule write to different Super VCAP instances, causing shared cache registers to be overwritten mid-transaction and committing corrupt data directly into hardware forwarding entries. No public exploit code or CISA KEV listing exists; EPSS is 0.21%, reflecting low exploitation likelihood in practice.
Memory corruption in the Linux kernel qede network driver (QLogic/Marvell FastLinQ 40/100GbE) arises because qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a NULL return from qede_build_skb(), consuming an extra buffer descriptor and desynchronizing the RX BD ring. The resulting off-by-one can corrupt DMA page reference counts and trigger SLUB freelist corruption, most plausibly a kernel-crash denial of service rather than reliable code execution. No public exploit has been identified and it is not in CISA KEV; the low EPSS (0.22%, 13th percentile) reflects that the bug only manifests under kernel memory pressure.
Heap out-of-bounds write in the Linux kernel's act_pedit TC offload path allows a local attacker holding CAP_NET_ADMIN to corrupt kernel slab memory with attacker-controlled content, potentially leading to privilege escalation or denial of service. The flaw affects Linux kernel versions from approximately 4.11 through the stable branches patched in 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3. Trend Micro ZDI researchers confirmed exploitability via KASAN trace using a targeted POC; no public exploit has been released and this CVE is not listed in the CISA KEV catalog.
Use-after-free in the Linux kernel Bluetooth MGMT advertising monitor subsystem allows a local attacker with low privileges to corrupt kernel heap memory, potentially achieving privilege escalation. The flaw arises from a ownership race: hci_add_adv_monitor() publishes a new adv_monitor into the hdev->adv_monitors_idr before the MSFT HCI offload setup step completes, allowing the MSFT callback to free the monitor on failure while the MGMT completion path still holds a dangling pointer. KASAN confirmed the slab-use-after-free in mgmt_add_adv_patterns_monitor_complete; no public exploit or active exploitation (CISA KEV) has been identified, and EPSS is 0.21% (12th percentile).
Bluetooth ISO packet reassembly in the Linux kernel mishandles malformed ISO_CONT and ISO_END packets, exposing adjacent attackers to three distinct kernel-level impacts: a conn->rx_skb memory leak via abnormal ISO_START sequences, a kernel panic triggered by an unchecked skb_put call on oversized ISO_END frames, and silent acceptance of undersized ISO_END packets. All Linux kernel versions from 6.0 through the fix commits on affected stable branches are impacted, with fixes confirmed in 7.1.5 and 7.2-rc3. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS 8.8 AV:A/PR:N vector and the availability of upstream fix commits make this an actionable patching priority for any Bluetooth-enabled Linux deployment.
Use-after-free in the Linux kernel's accel/amdxdna driver exposes systems with AMD XDna NPU hardware to local privilege escalation by a low-privileged attacker. The race condition exists between `aie2_populate_range()` and `amdxdna_umap_release()`, both of which dereference a stale VMA pointer after the underlying virtual memory area may have been freed by the kernel memory manager. With EPSS at 0.20% (10th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, active exploitation is not currently observed - though the CVSS 7.8 score correctly reflects the theoretical potential for full kernel compromise on affected hardware configurations.
Denial of service in the Linux kernel's kernel TLS (kTLS) subsystem allows a remote peer to permanently stall a TLS connection by sending a single zero-length TLS 1.3 application_data record. The `tls_sw_read_sock()` function misinterprets the empty record's zero-length return as a backpressure signal, requeuing the record indefinitely at the head of rx_list and blocking all subsequent TLS data on that connection. No public exploit code exists, the CVE is absent from the CISA KEV catalog, and EPSS sits at 0.21% (11th percentile), indicating low current exploitation interest despite the 7.5 CVSS score.
Kernel-memory corruption in the Linux kernel's net/liquidio (Marvell/Cavium LiquidIO SmartNIC) SR-IOV driver stems from caching virtual-function pci_dev pointers that hold no reference; the stale pointer is later dereferenced when servicing an OCTEON_VF_FLR_REQUEST, yielding a use-after-free reachable from a virtual function. Affected systems are hosts running the liquidio PF driver with SR-IOV enabled and VFs assigned to guests. Successful triggering can crash the host or corrupt kernel memory (potential privilege/scope escalation from a VF into the host); this is no public exploit identified at time of analysis, EPSS is low (0.20%), and a vendor fix is available.
Use-after-free race condition in the Linux kernel's AMD XDNA accelerator driver (accel/amdxdna) allows a local, low-privileged attacker on systems with AMD XDNA hardware to corrupt kernel memory, potentially achieving full privilege escalation. The race window opens because amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove() before removing the object from abo->mem.umap_list, permitting aie2_populate_range() to obtain a stale reference concurrently. No public exploit has been identified at time of analysis, and an EPSS of 0.21% (11th percentile) signals minimal current exploitation interest.
Kernel panic (use-after-free) in the Linux kernel IPv4 IGMP stack allows a network-adjacent attacker to crash the host by racing an inbound IGMP membership query against network-device teardown. The flaw lives in igmp_gq_start_timer(), where in_dev_hold() re-arms the general-query timer on an in_device whose refcount has already dropped to zero during inetdev_destroy(), so the RCU-freed structure is accessed when the timer later fires. The upstream fix is merged and shipped across stable branches; there is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile).
Kernel panic (and potential memory corruption) in the Linux kernel's IPv6 multicast stack arises from a use-after-free in the MLD delayed-work path, where a race between network-device teardown and incoming MLD query processing lets igmp6_event_query() take a reference on an inet6_dev whose refcount has already reached zero. Affected systems run kernels across the 2.6.12-through-7.x range prior to the fixed stable releases, and successful triggering causes a refcount 'addition on 0' warning followed by access to freed memory once the scheduled work runs. There is no public exploit identified at time of analysis, EPSS risk is low (0.22%, 13th percentile), and it is not listed in CISA KEV.
Firewall policy bypass in the Linux kernel's netfilter nftables subsystem allows remote attackers to evade packet-filtering rules that use inverted set lookups. The flaw lives in nft_lookup_eval(), where the match result for negated lookups ('!= @set') is computed before the catchall element used by interval sets is folded in, so rules resolve to the wrong verdict. It affects the nf_tables classifier across a wide range of kernel branches; there is no public exploit identified at time of analysis and EPSS probability is low (0.21%).
Improper handling of ICMP error packets in the Linux kernel's IPVS (IP Virtual Server) subsystem allows crafted ICMP errors from tunneled traffic to reference inner IP headers that are not guaranteed to reside in the skb headroom after pskb_pull() strips the outer headers, leading to out-of-bounds access in path-MTU update, icmp_send() and debug paths. The flaw affects hosts using IPVS load balancing with tunnel encapsulation; the practical consequence is an out-of-bounds read (information disclosure per source tags) or kernel crash rather than code execution. No public exploit identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not listed in CISA KEV.
Out-of-bounds kernel memory read in the Linux kernel's CIFS/SMB client (parse_dfs_referrals) affects hosts that mount SMB shares involving DFS referrals. A malicious or man-in-the-middle SMB server can return a referral whose server-supplied string offsets point beyond the received response buffer; the unchecked offset yields a negative max_len that reaches kstrndup()/strnlen() as a size_t, causing an out-of-bounds read that can leak adjacent kernel memory or crash the client. CVSS is 9.4, but there is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.21%, 12th percentile), indicating no observed exploitation.
Use-after-free (refcount_t underflow) in the Linux kernel's SUNRPC TLS connect path lets a failing TLS-secured RPC transport dereference an already-freed upper rpc_clnt, corrupting kernel memory. It affects systems using RPC-with-TLS transports (notably NFS-over-TLS/mTLS mounts) where a fatal handshake failure races the delayed connect_worker. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile); the input's 9.8 CVSS reflects Linux's automated scoring rather than the local, config-dependent trigger described.
Linux kernel SMB/CIFS client exposes a race condition between direct I/O (DIO) write completion and filesystem unmount that leaves dentry reference counts unreleased, triggering a kernel BUG warning and potential use-after-free condition. Local users with access to CIFS-mounted shares can trigger this by initiating a DIO write and concurrently unmounting the filesystem, allowing the kernel's shrink_dcache_for_umount() to fire before deferred workqueue cleanup has decremented the dentry refcount. With CVSS 7.8 and C:H/I:H/A:H, the theoretical impact is full kernel compromise, though no public exploit and an EPSS of 0.20% (10th percentile) indicate this remains a low-exploitation-probability vulnerability at time of analysis.
The regulator subsystem in the Linux kernel contains a deadlock-handling defect where `regulator_lock_two()` compares the return value of `ww_mutex_lock()` against `-EDEADLOCK` instead of the correct `-EDEADLK` constant. On MIPS architecture - the only platform where the regulator core is active and these two error constants carry different numeric values - the mismatch causes the kernel to skip the mandatory unlock-and-retry backoff sequence, fire `WARN_ON`, and return to the caller with only one of the two regulators locked, producing corrupted locking state. No public exploit has been identified and EPSS is very low (0.22%, 13th percentile), but the high CVSS impact ratings (C:H/I:H/A:H) reflect the potential for kernel panic or local privilege escalation on affected MIPS systems.
The octeontx2-af driver in the Linux kernel mishandles SR-IOV mailbox requests for nix_set_rx_mode, allowing a low-privileged user controlling a Virtual Function on Marvell OcteonTX2 hardware to silently delete the Physical Function's MCAM promiscuous and allmulti filtering rules through ordinary interface bringup or teardown operations. Affected Linux kernel versions span 5.14 through multiple stable branches, patched in 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), consistent with negligible observed exploitation activity and the hardware-specific attack surface.
Integer overflow in the Linux kernel SMB client's smb2_ioctl_query_info() function enables a malicious SMB server to bypass bounds checking during PASSTHRU_FSCTL response processing, leading to an out-of-bounds kernel memory read disclosed to userspace. Affected systems are Linux kernels across multiple stable branches where OutputOffset and qi.input_buffer_length are summed without overflow protection, allowing a server-controlled 32-bit wrap to defeat the bounds check and cause copy_to_user() to read beyond the response buffer. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% reflects low current exploitation probability, but the network-reachable attack surface and high confidentiality impact (CVSS 8.1) make patching a near-term priority for any Linux host using SMB client connectivity.
Kernel memory corruption in the Linux ASoC Sound Open Firmware (SOF) IPC4 control subsystem allows a low-privileged local user to trigger incorrect buffer copy lengths in sof_ipc4_bytes_put(), potentially achieving high confidentiality, integrity, and availability impact. The root cause is a logic error - not a race - where the copy size is sourced from the stale in-kernel buffer's size field rather than from the incoming user-supplied sof_abi_hdr.size in ucontrol, enabling data truncation or stale-byte copying into kernel structures. No public exploit code or active exploitation has been identified at time of analysis; patch commits are available across multiple stable kernel series.
Missing payload size validation in the Linux kernel's ASoC SOF IPC4 control subsystem allows a local low-privileged attacker to trigger out-of-bounds memory access when the kernel processes MODULE_NOTIFICATION messages. Affected systems are those running Linux kernel 7.0 and related stable branches where the SOF IPC4 audio driver is active - typically Intel hardware using Sound Open Firmware. No public exploit or CISA KEV listing exists, and EPSS sits at 0.20% (10th percentile), indicating low current exploitation interest, though the CVSS 7.8 score reflects real kernel-level impact potential.
Integer overflow in the Linux kernel's ASoC Sound Open Firmware (SOF) IPC3 control handler allows a local, low-privileged attacker on 32-bit platforms to bypass buffer size validation and trigger out-of-bounds memory access in `snd_sof_update_control`. The flaw exists because `sof_ipc3_control_update()` performs unguarded arithmetic on firmware-supplied `cdata->num_elems`, which wraps on 32-bit integer arithmetic and causes the subsequent header size check to pass with mismatched values. No public exploit code exists and no CISA KEV listing is present; EPSS probability is 0.23% at the 14th percentile, with vendor patches available across multiple stable kernel branches.
Memory corruption and information disclosure in the Linux kernel's ASoC Sound Open Firmware (SOF) IPC3 control subsystem allows local users with low privileges to corrupt kernel memory or leak sensitive data. The flaw affects sof_ipc3_bytes_put() and sof_ipc3_bytes_get() functions, where wrong-size memcpy operations and an off-by-sizeof bounds check create exploitable memory safety violations. No public exploit or CISA KEV listing exists at time of analysis; the EPSS score of 0.21% (12th percentile) reflects a low but non-negligible near-term exploitation probability.
Out-of-bounds/use-after-free read in the Linux kernel TIPC subsystem occurs when the enqueue-path debug tracepoints in tipc_sk_enqueue() dump sk_receive_queue while only sk->sk_lock.slock is held. Because that spinlock protects only the backlog queue and does not serialize against the socket owner consuming or purging the receive queue, the tracepoint can dereference skbs already dequeued or freed, as caught by KASAN. There is no public exploit identified at time of analysis, EPSS is very low (0.21%, 11th percentile), and the issue is only reachable when TIPC debug tracepoints are active.
Integer overflow in the Linux kernel's QRTR (Qualcomm IPC Router) subsystem on 32-bit platforms allows an out-of-bounds kernel heap write via a crafted incoming packet. On 32-bit builds where size_t is four bytes, passing size >= 0xfffffffd to ALIGN(size, 4) wraps the result to zero, bypassing the packet validation check in qrtr_endpoint_post() and allowing skb_put_data() to write attacker-controlled data far beyond the allocated socket buffer. This is the 32-bit residual of commit ad9d24c9429e2, which fixed only the 64-bit case; 64-bit kernels are structurally unaffected. No public exploit is identified at time of analysis, and EPSS at 0.22% reflects low exploitation probability.
Out-of-bounds read in the Linux kernel ATM networking subsystem (`net/atm`) allows local low-privileged users to disclose kernel memory or crash the system by supplying an out-of-range `traffic_class` value via the `SO_ATMQOS` socket option. The flaw persists because `check_tp()` fails to reject traffic class values above `ATM_ANYCLASS`, leaving the invalid value in `vcc->qos` where it is later used as an unguarded array index in `pvc_info()` when `/proc/net/atm/pvc` is read. EPSS sits at 0.22% (13th percentile) with no CISA KEV listing and no public exploit identified, making real-world exploitation risk considerably lower than the CVSS 7.1 score implies, particularly given that ATM networking is a legacy subsystem absent from most modern deployments.
Denial-of-service in the Linux kernel's IFE (Inter-Forwarding-Element) traffic-control action allows a crafted, malformed IFE frame to crash the host, because ife_decode() only guaranteed the outer IFE header was pullable before handing the decapsulated packet to eth_type_trans(), which then reads an inner Ethernet header that may be shorter than ETH_HLEN in the linear skb area. Only systems that have the tc act_ife action configured are exposed. There is no public exploit identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not in CISA KEV; the fix adds ETH_HLEN to the pull check.
Out-of-bounds array indexing in the Linux kernel's KVM irqfd routing for LoongArch allows a local user with KVM access to index past the routing table's chip array boundary, potentially exposing host kernel memory or enabling a hypervisor boundary breach with full triad impact. Patches are available in stable releases 6.18.40, 7.1.5, and 7.2-rc1 across three upstream commits. No public exploit code exists and EPSS sits at 0.21% (11th percentile), indicating negligible active exploitation probability despite the elevated CVSS 8.8 score.
Missing interrupt request (IRQ) validity checking in the LoongArch KVM subsystem of the Linux kernel allows a local low-privileged user with access to KVM device nodes to pass malformed IRQ values via the kvm_vcpu_ioctl_interrupt() ioctl, potentially causing memory corruption or privilege escalation that crosses the guest-to-host boundary. The CVSS scope change (S:C) signals that successful exploitation could compromise the hypervisor host, making this significant for LoongArch-based virtualization environments. No public exploit code has been identified and EPSS probability sits at 0.21%, suggesting exploitation remains theoretical at this time.
Local privilege/information-disclosure risk in the Linux kernel's s390 KVM subsystem stems from an unlikely race in try_get_locked_pte(), where puds or pmds can be unmapped between the p?dp_get() and p?d_offset() calls, leaving code operating on a stale or freed page-table entry. The flaw affects s390 (IBM Z mainframe) systems running KVM virtualization and has now been patched upstream; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.20%, 10th percentile).
Memory corruption in the Linux kernel's KVM/arm64 GICv3 virtualization (vgic) subsystem allows a local attacker on an ARM64 KVM host to trigger a double list removal, corrupting the ap_list and enabling a use-after-free style condition. The flaw lives in vgic_prune_ap_list(), where an interrupt can be pruned from a vCPU's active/pending list a second time after vgic_flush_pending_lpis() already removed it, because the affinity re-check does not confirm the interrupt is still owned by the vCPU. No public exploit is identified at time of analysis, and EPSS is low (0.22%), consistent with a race-condition kernel bug that is difficult to weaponize.
Local privilege escalation / host memory corruption in the Linux kernel's arm64 KVM vGIC subsystem allows a malicious or compromised guest VM to trigger a use-after-free by racing an LPI (Locality-specific Peripheral Interrupt) disable against an interrupt affinity migration across vCPUs. When vgic_prune_ap_list() drops and reacquires the irq and ap_list locks, a concurrent affinity change can free the interrupt out from under it, leading to a kernel UAF that can crash the host or potentially enable host-kernel code execution. This is not in CISA KEV and no public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile), consistent with a hard-to-win race rather than a turnkey exploit.
Improper state unwinding in the Linux kernel KVM nested VMX (nVMX) subsystem allows a low-privileged local attacker operating within an L1 guest to potentially escape the virtualization boundary and gain control over the host hypervisor's page table base register (CR3). When EPT is disabled and the deferred vTPR-vs-TPR Threshold consistency check fails, KVM does not restore vmcs01.GUEST_CR3 to its own value, leaving it set to an L1-controlled address - enabling a malicious guest to redirect hypervisor memory mappings to attacker-controlled structures. No public exploit has been identified and no CISA KEV listing exists; EPSS at 0.20% (10th percentile) confirms currently low observed exploitation probability.
Incomplete SEV-SNP state handling in the Linux kernel's KVM subsystem breaks AMD Secure Encrypted Virtualization isolation when intra-host VM migration or mirroring is attempted on SNP guests, potentially exposing encrypted guest memory to confidentiality and integrity breaches. The vulnerability affects multiple stable kernel branches from commit 1dfe571c12cf99244b933208fb77f29471ded677 onward, with fixes backported to 6.12.97, 6.18.40, 7.1.5, and 7.2-rc4. No public exploit code exists at time of analysis, and the EPSS score of 0.21% at the 11th percentile places real-world exploitation probability as very low despite the high official CVSS score of 8.8.
Out-of-bounds kernel memory access in Linux KVM's Intel TDX subsystem allows a local, low-privileged user to exploit a TOCTOU race condition during TD virtual machine initialization, potentially achieving kernel memory disclosure, corruption, or denial of service. The vulnerable path exists in tdx_td_init(), where the cpuid.nent field is read once to size a flexible allocation and then again from the copied structure - allowing userspace to change the count between those two references. No active exploitation has been confirmed and EPSS probability is very low (0.20%, 10th percentile), limiting immediate real-world risk to TDX-enabled production environments.
Denial-of-service in the Linux kernel's KVM x86 subsystem allows a guest VM to crash the host hypervisor by exploiting a state inconsistency in PV EOI (paravirtual end-of-interrupt) handling. When a guest triggers a memory read failure in `pv_eoi_get_user()` while concurrently disabling PV EOI, KVM fires a fatal assertion in `kvm_lapic_sync_from_vapic()` at `lapic.c:3338`, producing a kernel BUG and crashing the host. This takes down all co-resident virtual machines. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but vendor-confirmed patches are available across multiple stable kernel branches.
Use-after-free in the Linux kernel's KVM x86 irqfd subsystem exposes hypervisor hosts to potential privilege escalation and VM escape when VFIO PCI device passthrough is in use. The flaw arises because a failed IRTE bypass update leaves irqfd->producer as a dangling pointer; if the VFIO PCI vector is subsequently disabled-an event independent of KVM routing-the now-freed vfio_pci_irq_ctx struct can be dereferenced through KVM's routing table, corrupting kernel memory. No public exploit has been identified at time of analysis and EPSS is low (0.22%, 13th percentile), but the S:C scope change in the CVSS vector reflects the potential for a low-privilege local attacker to escape VM boundaries into the host kernel.
Improper locking scope in the Linux kernel KVM subsystem exposes a use-after-free race condition through `kvm_io_bus_get_dev()`, where the function drops the SRCU lock before returning a device pointer, leaving a window in which the referenced object may be freed before the caller can safely inspect it. All Linux kernel versions from the introducing commit (approximately 4.8) through the 7.1 and 6.x stable series are affected until patched releases across eight stable branches are applied. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% reflects a low current probability of exploitation despite the High CVSS severity rating.
Denial of service in the Linux kernel's KVM arm64 nested virtualization subsystem allows a guest to crash the host hypervisor by writing to the ZCR_EL2 system register alias during a nested context. Affected systems run arm64 Linux kernel builds where FEAT_NV2 is advertised to an L1 guest hypervisor; the write is architecturally legitimate in this context, but a misplaced WARN triggers a hyp_panic, taking down the KVM hypervisor layer. No public exploit or CISA KEV listing exists, and EPSS probability sits at 0.21% (11th percentile), reflecting low observed exploitation activity.
Improper permission handling in the KVM ARM64 nested-virtualization (NV) subsystem of the Linux kernel (6.16 through fixes in 6.18.40/7.1.5) lets a malicious L1 guest hypervisor write to a read-only backing page and trigger a page reference leak on the host. When mapping the L1 VNCR page into the host stage-1, KVM trusted only the guest stage-1 permissions and ignored that the backing PFN may be read-only (e.g. a read-only memslot), permitting writes to memory that should be immutable and leaking pages on the read-only early-return path. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the issue is not in CISA KEV.
Guest-to-host memory corruption in the Linux kernel's arm64 KVM nested-virtualization (NV) path arises from mishandling of the VNCR page translation: when a nested guest reads the VNCR page before writing, the host maps the PFN read-only and fails to re-fetch a writable translation on the subsequent write abort. The fix invalidates the VNCR TLB and re-translates before injecting the abort, restoring correct write-fault handling and satisfying FEAT_ETS2/3 ordering. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and it is not on CISA KEV.
Denial-of-service in the Linux kernel's arm64 KVM nested-virtualization (NV) support allows an L1 guest to trigger a host System Error (SError) by pointing its VNCR mapping at a non-memory PFN. Because kvm_translate_vncr() unconditionally applies cacheable memory attributes without checking whether the backing PFN is real memory, a writeback to a device/non-cacheable endpoint can raise an uncontained SError on the host. The upstream fix makes KVM reject non-memory backing and inject a Synchronous External Abort (SEA) into the guest instead. There is no public exploit identified at time of analysis and EPSS is low (0.21%).
KVM on s390 (IBM Z mainframe) exposes a hypervisor boundary-crossing flaw in its PCI Adapter Interrupt Forwarding (AIF) subsystem, where a guest VM registering IRQs without an Adapter Interrupt Summary Bit (AISB) causes the kernel to write `virt_to_phys(page_address(NULL))` - a non-zero, incorrect physical address - into the Guest Adapter Interrupt Table Entry (GAITE) rather than the correct zero sentinel. The CVSS scope change (S:C) indicates this poisoned GAITE entry can be used to cross the guest/host trust boundary, enabling potential host memory disclosure, corruption, or destabilization from a low-privileged guest context. No public exploit code and no CISA KEV listing exist at time of analysis; patches have been issued across multiple Linux stable kernel branches.
Buffer over-read and under-run vulnerabilities in the s390/zcrypt subsystem of the Linux kernel allow a local low-privileged user on IBM Z (mainframe) hardware to crash the kernel or expose adjacent kernel memory by submitting malformed CCA key token structures with attacker-controlled length fields. The affected functions cca_check_sec*token() and cca_gencipherkey() failed to validate the token's internal len field against actual buffer boundaries or minimum structure sizes before use in memory operations. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the CVSS score of 7.1 reflects genuine high-severity impacts in affected environments.
Kernel memory corruption in the Linux kernel's s390/zcrypt CCA AES cipher key handling path allows a local low-privileged user on IBM Z mainframe systems to trigger an out-of-bounds buffer operation with full confidentiality, integrity, and availability impact. The function `cca_cipher2protkey()` uses the length field from a user-supplied key token header to determine the copy size for the CPRB parameter block without validating it against the actual available buffer space, enabling adjacent kernel memory corruption. No public exploit exists and this is not in CISA KEV; vendor-released patches are available across multiple stable kernel branches including 6.6.151, 6.12.103, 6.18.44, and 7.1.8.
Missing length validation in the Linux kernel's s390/zcrypt CCA ECC private key handler allows a local low-privileged user on IBM Z (s390) systems to trigger a buffer overread or overflow in the CPRB parameter block. The `cca_ecc2protkey()` function blindly trusts the length field embedded in a caller-supplied key token when computing how many bytes to copy into a fixed-size parameter block, enabling a crafted oversized token to corrupt adjacent kernel memory. No public exploit has been identified at time of analysis, and this vulnerability is architecture-specific to IBM Z mainframe Linux deployments.
Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with AMD v9 GPU hardware. The MQD control stack copy uses cp_hqd_cntl_stack_size directly from hardware registers without bounding it to the allocated Buffer Object, allowing memcpy to read past the BO into adjacent GTT memory. A local low-privileged user with access to AMD GPU compute queue checkpointing can recover sensitive kernel data; no public exploit has been identified at time of analysis, though the 15% EPSS score is above baseline for kernel information-disclosure flaws.
Missing input validation in the Linux kernel's drm/vmwgfx driver allows a low-privileged local user on a VMware guest VM to supply an arbitrary array_size value in vmw_surface_metadata via ioctl, bypassing per-Shader-Model limits and triggering out-of-bounds kernel memory access with high confidentiality, integrity, and availability impact. Affected kernel versions span 5.7 through multiple stable branches, with patches now available for 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. No public exploit code or CISA KEV listing has been identified at time of analysis, though EPSS at 16% signals a meaningfully elevated probability of eventual exploitation.
GPU shader validation bypass in the Linux kernel's drm/vc4 driver allows local low-privileged users to rewrite validated shader bytecode after it has been approved by the GPU security validator. Specifically, vc4_gem_object_mmap() rejects writable mappings of validated shader buffer objects (BOs) but neglects to clear VM_MAYWRITE, enabling a two-step attack: map the BO read-only, then invoke mprotect() to silently upgrade the mapping to PROT_WRITE, bypassing the one-time validation check the GPU trusts unconditionally. No public exploit has been identified and no CISA KEV listing exists, but an EPSS of 17% is elevated for a local-only kernel driver issue, warranting prompt patching on affected Raspberry Pi and BCM283x-based platforms.
Use-after-free in the Linux kernel's btrfs filesystem driver allows a low-privileged local user to cause kernel memory corruption with full system compromise potential. Introduced by a regression in commit f86f7a75e2fb, the btrfs extent map splitting code in btrfs_drop_extent_map_range() incorrectly propagates EXTENT_FLAG_LOGGING to child split maps, which are never cleared of this flag; when the extent map shrinker later frees such a map while it remains on the inode's modified_extents list, a use-after-free is triggered. No public exploit has been identified at time of analysis, but an EPSS of 16% signals elevated exploitation probability for a local kernel UAF affecting Linux 6.8 and later across multiple stable branches.
Heap overflow in the Linux kernel's txgbe network driver enables a local attacker to write beyond an allocated heap buffer during ethtool EEPROM reads, potentially escalating to full kernel compromise on systems with Wangxun txgbe 10GbE hardware. The flaw exists because txgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes into a buffer ethtool allocates to exactly length bytes, causing a 1-3 byte out-of-bounds write whenever the requested length is not 4-byte aligned. Vendor patches are available in Linux 6.19 and stable releases 7.1.6 and 7.2-rc5; no public exploit code or active exploitation has been identified at time of analysis, though the 16% EPSS score is notably elevated for a kernel driver defect.
Uninitialized memory read in the Linux kernel's libceph client library exposes stale kernel buffer contents and risks system instability on Ceph-connected hosts. The flaw exists in handle_get_version_reply(), which incorrectly uses msg->front_alloc_len - the allocated buffer size - as the decode boundary instead of msg->front.iov_len, the count of bytes actually received. A truncated MON_GET_VERSION_REPLY from a malicious or compromised Ceph monitor therefore passes the ceph_decode_need() guard and reads a second u64 from leftover bytes of a prior message, constituting an out-of-bounds read of uninitialized kernel memory. No public exploit has been identified at time of analysis, but the 16% EPSS score is elevated for a kernel library flaw and warrants prompt patching on Ceph-client deployments.
Privilege escalation in the Linux kernel's vxlan subsystem allows a local user holding CAP_NET_ADMIN in a vxlan device's network namespace to rewrite underlay configuration in a separate, more privileged namespace where they lack that capability. The flaw in vxlan_changelink() affects multiple stable kernel branches (6.6.x, 6.12.x, 6.18.x, 7.1.x, and 7.2-rc) and is most impactful in multi-tenant container or cloud environments where vxlan devices span namespace boundaries - a common topology in Kubernetes and OpenStack deployments. With an EPSS score of 17% and no public exploit or CISA KEV listing confirmed at time of analysis, this is an elevated-risk local privilege escalation requiring prompt patching on affected containerized infrastructure.
Out-of-bounds memory read in the Linux kernel's in-kernel SMB server (ksmbd) lets a remote, unauthenticated client leak adjacent kernel memory. The receive path applied the minimum SMB2 PDU size check only to packets with ProtocolId SMB2_PROTO_NUMBER, so a short packet carrying SMB2_TRANSFORM_PROTO_NUM slipped past validation on an SMB 2.1 connection (which offers no transform handling) and reached init_smb2_rsp_hdr(), which read past the request allocation and returned the copied fields to the client. Rated CVSS 9.1 with an EPSS of 11%; no public exploit or CISA KEV listing is indicated, so this is no public exploit identified at time of analysis.
Use-after-free in the Linux kernel's GPU host1x subsystem (`host1x_bo_clear_cached_mappings`) exposes local low-privileged users to potential kernel heap corruption leading to privilege escalation, memory disclosure, or system crash. The flaw occurs because `__host1x_bo_unpin()` frees the mapping object, yet the caller continues dereferencing `mapping` instead of the surviving `cache` local variable. Patches are confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, 7.2-rc4); no public exploit or active exploitation is identified at time of analysis, and EPSS sits at an extremely low 0.16% (6th percentile).
Use-after-free in the Linux kernel's IPsec transmit path (xfrm) occurs when validate_xmit_xfrm() processes a GSO segment list and async crypto offload steals the final segment via -EINPROGRESS, leaving the list head's ->prev pointing at a segment now owned (and potentially freed) by the crypto engine. validate_xmit_skb_list() then writes through that stale tail pointer, corrupting freed memory; the practical impact is kernel memory corruption and likely crash on systems using IPsec with asynchronous crypto. No public exploit identified at time of analysis, EPSS is low (0.16%), and it is not listed in CISA KEV, so this is a patch-and-move-on issue rather than an active-exploitation emergency.
Linux kernel's IB/mad subsystem exposes unauthenticated adjacent-network attackers to a kernel availability and integrity impact through premature RMPP reassembly state allocation. Systems with InfiniBand hardware running Linux 2.6.13 through multiple active stable branches are vulnerable: an attacker on the InfiniBand fabric can send unsolicited RMPP DATA responses routed to a kernel RMPP agent via crafted high TID bits, causing the kernel to allocate or extend RMPP receive state without any validated corresponding send request. EPSS exploitation probability is very low (0.16%, 6th percentile), no public exploit or CISA KEV listing exists, but the availability impact is rated High, making this a meaningful risk in HPC and data-center InfiniBand environments.
Stack-out-of-bounds read in the Linux kernel's XFRM/IPsec subsystem allows a local user with network policy configuration privileges to read out-of-bounds kernel stack memory and potentially crash the system by crafting an outbound XFRM policy using an optional IPTFS-mode template. The flaw is an incomplete fix: commit 3d776e31c841 blocked optional tunnel and BEET templates in outbound policies to prevent this exact class of bug, but the later-added IPTFS mode was never covered by that restriction. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.15%, and a functional reproducer is embedded in the upstream fix commit, lowering the barrier for any local attacker who discovers the configuration.
Remote memory access corruption in the Linux kernel's RDMA/irdma subsystem allows a local user with RDMA device access to trigger an invalid CQP (Control Queue Pair) command carrying a zero-initialized mkey by invoking rereg_mr on special QP/CQ/SRQ buffer registrations that were never intended for re-registration. Affected systems include Intel RDMA-capable hardware environments running Linux 6.6.x through 6.6.147, 6.7, and related stable branches prior to the fix commits. No public exploit code has been identified at time of analysis, and EPSS is very low at 0.16% (6th percentile), indicating limited exploitation interest despite the 7.8 CVSS score.
Race condition in the Linux kernel RDMA/siw (Software iWARP) subsystem exposes partially-constructed Queue Pair (QP) objects to concurrent lookups during QP creation. Affected kernels from 5.3 onward allow a local, low-privileged user on systems with the siw driver loaded to trigger a QPN lookup that resolves to a QP whose queues, CQ pointers, state, and device list entry have not yet been initialized. This can result in kernel memory corruption, information disclosure, or system availability loss - all three impact dimensions confirmed by the CVSS C:H/I:H/A:H rating. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.16% at the 5th percentile.
Stale mode_callbacks pointer dereference in the Linux kernel xfrm IPTFS subsystem causes kernel panic when deferred garbage collection runs after the xfrm_iptfs module has been unloaded following a failed IPTFS state initialization. The xfrm subsystem's __xfrm_init_state() caches x->mode_cbs before IPTFS setup completes, but releases the temporary module reference immediately on failure - leaving a dangling callback table pointer that xfrm_state_gc_task later dereferences against an unloaded module. No public exploit code exists and EPSS is 0.17% (6th percentile), though the vendor-assigned CVSS of 7.8 reflects worst-case kernel memory impact if the race is won.
Use-after-free in the Linux kernel cfg80211 WiFi subsystem exposes systems with wireless adapters to potential kernel memory corruption via a race condition between scheduled scan result processing and WiFi device unregistration. All Linux kernel versions from approximately 3.0 (commit 807f8a8c) through stable releases prior to 6.6.148, 6.12.101, 6.18.42, and 7.1.6 are affected wherever cfg80211-based WiFi drivers are in use. No public exploit has been identified at time of analysis, and EPSS at 0.16% (6th percentile) reflects low current exploitation probability despite the kernel-level C:H/I:H/A:H impact potential.
Use-after-free race condition in the Linux kernel mac80211 MLO (Multi-Link Operation) link removal path allows an adjacent-network attacker to trigger kernel memory corruption on WiFi 7-capable systems. The flaw exists because sta_remove_link() immediately frees the percpu RX stats buffer while deferring only the link container to RCU, leaving the kernel's fast RX path able to dereference the freed percpu block via a stale link_sta pointer. No public exploit code exists and EPSS is 0.17% (6th percentile), consistent with the kernel commit description's own characterization of the race window as 'hard to win in practice,' though a successful exploit would carry full kernel-level impact.
A race condition in the Linux kernel's cfg80211 wifi subsystem exposes systems to kernel memory corruption by a local, low-privilege user. The flaw exists between the NETLINK_URELEASE notification path and the NETDEV_GOING_DOWN cancellation path for the wireless device autodisconnect work item: because the work is a plain work_struct, it can be re-queued after cancellation and outlive the wdev structure it references, since synchronize_net() does not drain work queued by in-flight RCU readers. Upstream fix commits are available on kernel.org stable trees, and no public exploit or CISA KEV listing has been identified at time of analysis.
Slab-out-of-bounds read in the Linux kernel's wifi cfg80211 subsystem exposes systems with WiFi interfaces to kernel crash or minor memory disclosure when parsing crafted 802.11 frames from a rogue access point. The flaw, located in cfg80211_is_element_inherited() within net/wireless/scan.c, is triggered during Multi-Link Element (MLE) per-STA profile parsing when a zero-length WLAN_EID_EXTENSION element is present in a (re)association response or non-transmitted BSS profile - causing the parser to read one byte past the end of the element buffer. No public exploit or KEV listing exists at time of analysis; EPSS at 0.17% (6th percentile) reflects low current exploitation probability, though the adjacent-network attack vector and zero-privilege requirement keep real-world risk elevated for WiFi-attached Linux endpoints.
Out-of-bounds memory writes in the Linux kernel's ARM Firmware Framework for Armv8-A (FF-A) driver expose local low-privilege users to kernel memory corruption on affected ARM platforms. Two distinct write-past-end defects exist in ffa_setup_and_transmit(): one triggered when the FFA protocol version is below 1.2 due to a struct size mismatch causing writes beyond allocated memory, and another from missing size validation before writing constituents. Upstream kernel patches are available across multiple stable branches (6.18.42, 7.1.6, 7.2-rc4); no public exploit or active exploitation has been identified at time of analysis, and EPSS probability is very low at 0.17%.
Incorrect offset calculation in the Linux kernel's arm_ffa firmware subsystem exposes local privilege escalation on systems using the Arm Firmware Framework for Armv8-A (FF-A). The flaw uses a hardcoded sizeof(struct ffa_mem_region) instead of the descriptor's ep_mem_offset field to locate the endpoint memory access array, violating the FF-A specification. A local user with low privileges could exploit this memory misinterpretation to achieve high confidentiality, integrity, and availability impact; no public exploit or active exploitation (KEV) has been identified at time of analysis.
Use-after-free in the Linux kernel BPF subsystem allows a local low-privileged attacker to corrupt or access freed kernel memory through a race condition in socket cloning. The flaw exists in sk_clone() where a shallow copy via sock_copy() leaves newsk->sk_bpf_storage pointing to the parent socket's BPF local storage; if an early bailout occurs before bpf_sk_storage_clone() runs, subsequent freeing of the cloned socket destroys the parent's storage, triggering a UAF. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and EPSS sits at 0.16% (6th percentile), indicating low current exploitation probability.
Use-after-free in the Linux kernel's PPP-over-L2TP subsystem exposes a race condition between softirq RX processing and socket teardown, reachable by an unprivileged local user and capable of yielding full kernel memory corruption and privilege escalation. The pppol2tp_recv() function runs under rcu_read_lock() but dereferences an internal struct channel that close() can free with a plain kfree() when the channel was bound via PPPIOCGCHAN without a subsequent PPPIOCCONNECT, bypassing all RCU grace-period fences. Patches are available across multiple stable kernel branches; no public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV.
Use-after-free race condition in the Linux kernel AF_IUCV HiperSockets receive path allows a network-adjacent unauthenticated attacker to dereference freed kernel memory, potentially achieving kernel code execution and full system compromise. The flaw exclusively affects IBM z/Architecture (mainframe) systems running Linux under z/VM with the AF_IUCV subsystem active, making the exploitable population extremely narrow. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), consistent with the niche deployment context; patched stable kernel releases are available across multiple branches.
Use-after-free in the Linux kernel's Bluetooth MGMT subsystem allows a local attacker with low-privilege Bluetooth Management socket access to corrupt kernel heap memory and potentially escalate privileges to root. The flaw exists in MGMT_OP_LOAD_CONN_PARAM handling, where a borrowed hci_conn_params pointer stored in a queued work item can be freed by a subsequent LOAD_CONN_PARAM call before hci_cmd_sync_work executes the callback - a race-driven use-after-free confirmed by KASAN. No public exploit or active exploitation has been identified at time of analysis; patches are available across stable kernel series 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4.
Use-after-free in the Linux kernel Bluetooth HCI synchronization layer (hci_sync) allows adjacent, unauthenticated attackers to corrupt kernel memory, potentially achieving full system compromise. The root cause is that RCU-protected conn_hash lookup results were dereferenced outside RCU critical sections without holding a reference count, permitting concurrent deletion to free the connection object while it is still in use. With a CVSS score of 8.8 (AV:A), exploitation requires only Bluetooth adjacency and no privileges; however, the EPSS score of 0.17% (6th percentile) and absence from CISA KEV indicate no confirmed active exploitation or public weaponized exploit at time of analysis.
Use-after-free in the Linux kernel's Bluetooth management subsystem allows a local low-privileged attacker to corrupt kernel memory during unpair_device or disconnect_sync operations, potentially achieving full kernel compromise (High C/I/A). The flaw stems from dereferencing RCU-protected hci_conn pointers outside proper critical sections, enabling a concurrent free of the structure while it is still in use. Vendor-released patches are available across multiple stable branches (6.6.148, 6.12.101, 7.1.6, 6.18.42); no public exploit code is identified at time of analysis, and EPSS of 0.17% indicates low immediate exploitation probability.
Use-after-free and data race conditions in the Linux kernel Bluetooth management subsystem allow a local low-privileged attacker to corrupt kernel memory, potentially escalating privileges to root. Affected kernels fail to properly hold reference counts on hci_conn objects stored in mgmt_pending_cmd structures and fail to acquire hdev->lock before accessing conn->state, enabling RCU-protected pointers to be dereferenced after the underlying memory has been freed. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects low observed exploitation pressure despite the high CVSS score.
Missing mutex protection in the Linux kernel's Bluetooth HCI synchronization layer creates a race condition when hci_conn_params_lookup is called without holding hdev->lock, enabling unsafe concurrent list iteration and parameter access at kernel level. All Linux kernel builds spanning commit c530569adc19b5f0c62955de41f067bad34e3fe0 up to the respective fix commits are affected when the Bluetooth subsystem is active. An adjacent, unauthenticated attacker within Bluetooth radio range could exploit this race window to achieve kernel-level memory corruption, information disclosure, or potentially arbitrary code execution. No public exploit or active exploitation (CISA KEV) has been identified; EPSS at 0.15% (5th percentile) reflects low current weaponization despite the elevated CVSS base score.
Use-after-free in the Linux kernel Bluetooth hci_qca driver allows an attacker within Bluetooth radio range to corrupt kernel heap memory by inducing a Qualcomm Atheros QCA controller to report a zero-length memory dump. Systems running unpatched kernels prior to 6.6.148, 6.12.101, 6.18.42, or 7.1.6 with QCA Bluetooth hardware are exposed, with potential impact spanning kernel information disclosure, memory corruption, and denial of service. No public exploit code has been identified at time of analysis, and EPSS probability is very low at 0.17% (6th percentile), indicating no evidence of active or widespread exploitation.
Client-side data-integrity failure and bounded out-of-bounds read in the Linux kernel SMB/CIFS client (smb3_simple_fallocate_range) allows a malicious or compromised SMB server to cause the client to skip zero-filling holes during fallocate, so a range the client reports as successfully allocated is left as an un-zeroed hole and a later write can fail with ENOSPC; a malformed server-supplied range length can additionally trigger an out-of-bounds read of the zero buffer. Affected systems are Linux hosts that mount SMB3 shares and call fallocate on them; the fix is merged upstream and backported to stable trees. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is 0.17% (6th percentile).
Race condition in the Linux kernel's CAN raw socket subsystem allows a local low-privileged user to trigger concurrent read-modify-write operations on the raw flags bitfield, potentially leading to kernel memory corruption and local privilege escalation. Introduced by commit 890e5198a6e5, which consolidated separate integer flags into a single bitfield in struct raw_sock without adequate locking in raw_setsockopt(), any concurrent call path can race to produce inconsistent flag state. No public exploit code has been identified and EPSS sits at the 11th percentile, indicating low current exploitation probability despite the high CVSS base score.
Incorrect checksum computation in the Linux kernel's s390 (IBM Z mainframe) architecture code causes csum_partial() to read from memory address zero instead of the intended source buffer on machines lacking the vector (VX) facility. Affects s390 systems running the buggy kernel builds; the practical effect is corrupted checksums and potential leakage of kernel memory contents near address zero into computed checksums. Rated CVSS 9.8 by automated scoring, but this is a local architecture-specific correctness bug with no public exploit identified at time of analysis and a low EPSS (0.18%, 7th percentile).
Race conditions in the Linux kernel's drm/xe Virtual Function CCS state management expose Intel Xe GPU SR-IOV environments to local privilege escalation, information disclosure, and memory corruption. The driver's buffer object move operations improperly sequence CCS batch buffer attach and detach relative to in-flight copy jobs, creating two distinct timing windows where a VF migration event can observe partially-copied or already-torn-down CCS metadata. No CISA KEV listing or public proof-of-concept exists at time of analysis, and EPSS of 0.18% (8th percentile) reflects negligible observed exploitation activity; the primary exposure surface is cloud and VDI infrastructure using Intel Xe GPUs with SR-IOV enabled.
Use-after-free in the Linux kernel's Intel Xe discrete GPU driver (DRM/xe) allows a local unprivileged user to access freed kernel memory via a dangling pointer in the GuC execution queue scheduler. The scheduler retains a pointer to an exec queue's name string (`q->name`) that is freed when the exec queue is destroyed, while scheduler fence timelines can still dereference it. Affected kernel versions span the 6.12, 6.15, and 6.16 stable series; no active exploitation has been identified (EPSS: 0.16%, not in CISA KEV), though the impact is rated High (CVSS 7.8) due to full kernel memory read/write/crash potential.
Deadlock in the Linux kernel's drm/xe Intel Xe GPU driver allows a local low-privileged user with GPU queue access to hang or crash the kernel by triggering asynchronous GuC exec queue teardown at device removal time. Affected are kernel versions across the 6.10.14-6.12 stable series on systems with Intel Xe architecture GPUs (Arc, Lunar Lake). No public exploit has been identified and EPSS is at the 6th percentile, indicating low real-world exploitation probability; the risk is primarily an availability impact via kernel deadlock rather than code execution despite the high CVSS score.
Use-after-free in the Linux kernel's in-kernel SMB server (ksmbd) allows the async oplock/lease break notification worker to operate on a freed ksmbd_conn object when connection teardown races with a pending break notification. Affected kernels span the 6.6.x through 6.18 stable series (fixed in 6.6.148, 6.12.101, 6.14, 6.18.42 and related patch releases); the fix pins a real conn reference for the queued work item. Rated CVSS 9.8 by the automated feed, but this is a timing-dependent race with no public exploit identified at time of analysis and a low EPSS score (0.17%, 6th percentile).
Use-after-free in the Linux kernel's AMD XDNA accelerator driver (amdxdna) exposes systems with AMD NPU hardware to local privilege escalation, kernel memory corruption, or system crash. The flaw exists in the job scheduler path: amdxdna_cmd_submit() stores a raw pointer to the submitting process's mm_struct in job->mm without calling mmgrab() to hold a structural reference, while aie2_sched_job_run() later dereferences that pointer from the DRM worker thread - after the originating process may have exited and freed the mm_struct. No public exploit code has been identified at time of analysis, and the EPSS score of 0.17% (7th percentile) is consistent with specialized hardware prerequisites and no active exploitation campaign.
Memory exhaustion in the Linux kernel TCP stack allows remote network-reachable attackers to trigger a reference leak in tcp_tw_bucket structures when PSP (Packet Security Protocol) policy lookup fails during packet processing in both IPv4 and IPv6 receive paths. TIME_WAIT socket references are not released on this failure path, causing a gradual accumulation of unreclaimable kernel memory. The CVSS score of 7.5 (High) reflects the network accessibility and potential for denial-of-service via memory exhaustion, though EPSS at 0.21% (11th percentile) and the absence from CISA KEV indicate no public exploit or confirmed active exploitation at time of analysis.
Use-after-free race condition in the Linux kernel's TC act_tunnel_key subsystem allows a local low-privileged attacker to corrupt kernel heap memory, potentially escalating privileges or crashing the system. The flaw exists in tunnel_key_release_params(), which synchronously frees metadata_dst via dst_release() while concurrent RCU readers in tunnel_key_act() may still hold the old params pointer and attempt dst_clone() on the already-dead reference. A proof-of-concept was developed by Trend Micro ZDI (zdi-disclosures@trendmicro.com) and verified by kernel maintainers with KASAN confirming slab-use-after-free; no public exploit is available beyond that researcher-held POC, and no KEV listing exists at time of analysis.
Stack-based buffer overflow in the Linux kernel's SCTP subsystem corrupts adjacent kernel memory when SCTP authentication is configured with four HMAC identifiers, enabling a remote unauthenticated attacker to achieve high-impact memory corruption via a crafted SCTP packet exchange. Affected kernels span from 2.6.24 through current stable branches, with patches backported to 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4. No public exploit code or CISA KEV listing has been identified; the EPSS score of 0.17% reflects the high exploitation complexity imposed by the required SCTP authentication configuration.
Use-after-free race condition in Linux kernel USB core sysfs allows a local low-privileged user to trigger concurrent memory access on freed BOS descriptor data, potentially leading to kernel memory corruption, privilege escalation, or system crash. The vulnerability arises in bos_descriptors_read() within the USB sysfs subsystem, where udev->bos is accessed without a lock while usb_reset_and_verify_device() - called by numerous drivers across the kernel - can free that same memory simultaneously. No public exploit code exists and the vulnerability is not listed in CISA KEV; the EPSS score of 0.17% confirms low observed exploitation probability at time of analysis.