Linux
Monthly
Use-after-free race condition in the Linux kernel's TC act_tunnel_key subsystem allows a local low-privileged attacker to corrupt kernel heap memory, potentially escalating privileges or crashing the system. The flaw exists in tunnel_key_release_params(), which synchronously frees metadata_dst via dst_release() while concurrent RCU readers in tunnel_key_act() may still hold the old params pointer and attempt dst_clone() on the already-dead reference. A proof-of-concept was developed by Trend Micro ZDI (zdi-disclosures@trendmicro.com) and verified by kernel maintainers with KASAN confirming slab-use-after-free; no public exploit is available beyond that researcher-held POC, and no KEV listing exists at time of analysis.
Stack-based buffer overflow in the Linux kernel's SCTP subsystem corrupts adjacent kernel memory when SCTP authentication is configured with four HMAC identifiers, enabling a remote unauthenticated attacker to achieve high-impact memory corruption via a crafted SCTP packet exchange. Affected kernels span from 2.6.24 through current stable branches, with patches backported to 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4. No public exploit code or CISA KEV listing has been identified; the EPSS score of 0.17% reflects the high exploitation complexity imposed by the required SCTP authentication configuration.
Use-after-free race condition in Linux kernel USB core sysfs allows a local low-privileged user to trigger concurrent memory access on freed BOS descriptor data, potentially leading to kernel memory corruption, privilege escalation, or system crash. The vulnerability arises in bos_descriptors_read() within the USB sysfs subsystem, where udev->bos is accessed without a lock while usb_reset_and_verify_device() - called by numerous drivers across the kernel - can free that same memory simultaneously. No public exploit code exists and the vulnerability is not listed in CISA KEV; the EPSS score of 0.17% confirms low observed exploitation probability at time of analysis.
Out-of-bounds kernel memory read in the at76c50x-usb WiFi driver affects Linux systems equipped with Atmel AT76C50x USB wireless adapters. When the kernel scans for networks, a truncated beacon or probe response frame between 24 and 35 bytes triggers an integer underflow in at76_guess_freq(): subtracting the fixed management-body offset (el_off = 36) from a shorter frame length wraps the unsigned value to near UINT_MAX, which is then passed to cfg80211_find_elem_match(), causing a walk far beyond the RX socket buffer boundary with consequences ranging from kernel memory disclosure to system crash. With an EPSS of 0.17% (6th percentile) and no CISA KEV listing, no public exploit identified at time of analysis, though the AV:A/PR:N vector means any adjacent attacker can trigger the condition without authentication during routine scanning.
Reference count underflow in the Linux kernel's USB MUSB OMAP2430 driver exposes systems built on Texas Instruments OMAP2430 SoCs to potential use-after-free conditions in kernel memory, with theoretical impact spanning privilege escalation and system crash. The flaw in omap2430_probe() calls of_node_put() on a borrowed platform device OF node that was never reference-counted by the probe function, leaving pdev->dev.of_node with an unbalanced count that can trigger premature freeing. No public exploit exists and EPSS exploitation probability stands at 0.20% (10th percentile), consistent with the extremely narrow hardware attack surface; this vulnerability is not listed in CISA KEV.
Race condition in the Linux kernel's dummy_hcd USB gadget driver corrupts a shared kernel request object's function pointer mid-callback, enabling a local low-privilege attacker on a multi-CPU system to redirect kernel execution and achieve privilege escalation. The vulnerable component is the FIFO fast-path in dummy_queue(), which reuses a single shared fifo_req before its completion callback has returned, allowing a concurrent CPU to overwrite the req->complete pointer while dummy_timer is actively invoking it - causing a general protection fault or page fault in kernel context. A syzkaller reproducer is documented (extid faf3a6cf579fc65591ca), but no public exploit or CISA KEV listing exists; EPSS sits at 0.18%, indicating very low observed exploitation activity.
FireWire network driver in the Linux kernel contains a linked-list boundary confusion flaw in `fwnet_frag_new()` that mishandles fragment reassembly at list edges, potentially enabling kernel memory corruption by adjacent-network attackers. Systems with the `firewire-net` module loaded are exposed to unauthenticated attackers sharing the same IEEE 1394 bus who can send crafted fragmented datagrams to trigger the defect. No public exploit exists and EPSS sits at 0.18% (7th percentile), but the CVSS 8.8 vector reflects high potential impact if type confusion against the list head leads to arbitrary kernel memory access.
Out-of-bounds kernel memory read in the Linux kernel ath6kl WiFi driver affects systems using Qualcomm Atheros AR6xxx chipsets from kernel 3.2 onward. The firmware-supplied `num_msg` field (a u8 value, range 0-255) governs a loop in `ath6kl_wmi_tx_complete_event_rx()` without any validation against the actual WMI event buffer length, enabling reads of up to 1020 bytes past the buffer boundary. An adjacent-network attacker with no privileges can potentially exploit this to leak sensitive kernel memory contents or trigger a kernel panic - neither CISA KEV listing nor public exploit code has been identified at time of analysis, and EPSS at 0.18% (7th percentile) corroborates low current exploitation activity.
Out-of-bounds kernel memory read in the Linux kernel's ath6kl WiFi driver exposes systems with Atheros AR600x chipsets to kernel memory disclosure and availability impact via a malicious adjacent-network access point. The ath6kl_wmi_connect_event_rx() function fails to validate firmware-supplied beacon_ie_len, assoc_req_len, and assoc_resp_len fields against the actual WMI event buffer size before parsing 802.11 Information Elements, allowing combined lengths of up to 765 bytes to exceed the buffer boundary and corrupt the wmi->is_wmm_enabled state flag. No public exploit has been identified and the vulnerability is not listed in CISA KEV; EPSS at 0.21% (11th percentile) reflects minimal opportunistic exploitation activity consistent with the niche hardware footprint.
Out-of-bounds read in the Linux kernel's TAS2781 ASoC audio driver firmware parser exposes systems with TAS2781 audio hardware to kernel memory disclosure and availability loss. The parser invokes strlen() on variable-length description strings read directly from a firmware image without first verifying a NUL terminator exists within the buffer, allowing a malformed firmware blob to drive pointer arithmetic past the allocated buffer boundary before downstream size checks execute. Patches have been released across multiple stable kernel branches (6.12.101, 6.6.148, 6.18.42, 7.1.6, 7.2-rc5); no public exploit or CISA KEV listing exists at time of analysis, and an EPSS score of 0.18% at the 7th percentile reflects minimal observed exploitation interest.
Out-of-bounds read in the Linux kernel's SMB/CIFS client DFS referral parser (parse_dfs_referrals) affects systems that mount SMB shares using DFS. A malicious or compromised SMB server can return a referral response whose PathConsumed value exceeds the search name length, causing later DFS path parsing to advance past the end of the buffer and leak adjacent kernel memory or crash the client. Tagged as Information Disclosure with a 9.1 CVSS; EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis.
Use-after-free in the ovpn (in-kernel OpenVPN data channel) module of the Linux kernel, present from version 6.16 onward, allows an authenticated remote VPN peer to trigger kernel memory corruption during peer cleanup. The flaw in unlock_ovpn() occurs because llist_for_each_entry() reads the next list pointer after ovpn_peer_put() may have already freed the peer structure, producing a classic UAF condition in kernel space. No public exploit code has been identified and EPSS probability is very low at 0.21% (11th percentile), though the theoretical worst-case per CVSS 3.1 is full kernel compromise (C:H/I:H/A:H).
Out-of-bounds read in the Linux kernel hwmon OCC (On-Chip Controller) driver exposes adjacent kernel memory and risks system availability on IBM POWER hardware running affected kernel versions. The poll response parser uses a static backing-array capacity as its parse boundary rather than the data_length field embedded in the firmware response, allowing a truncated OCC reply to cause the parser to read block headers or extents outside the valid response window. Vendor-released patches are available across multiple stable branches; no public exploit or CISA KEV listing exists at the time of analysis.
Race condition in the Linux kernel net/packet subsystem allows a local low-privileged attacker to re-register a fanout protocol hook after its associated network device has been unregistered, potentially corrupting kernel state and achieving privilege escalation. Affected systems are those running unpatched kernel versions prior to the stable-branch fixes across the 6.6, 6.12, 6.18, 7.1, and 7.2 release trees. No public exploit code and no CISA KEV listing exist at time of analysis, and the EPSS score of 0.21% (11th percentile) reflects low current exploitation activity.
Use-after-free in the Linux kernel RDS (Reliable Datagram Sockets) subsystem allows a local user with the ability to create unprivileged network namespaces to trigger memory corruption leading to privilege escalation. The flaw stems from rds_find_bound() performing socket lookups in a global hash table without accounting for network namespace boundaries, enabling a cross-namespace message delivery race condition where a freed rds_connection object is subsequently dereferenced. Two dangerous dereference sites have been KASAN-confirmed, including a function pointer call-through that constitutes a potential code execution primitive. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Silent data corruption in the Linux kernel's airoha NPU mailbox driver affects EN7581-based systems (Cortex-A53 without hardware DMA cache coherency) when NPU response data is read back through a CPU cache that was never invalidated. The driver's airoha_npu_send_msg() function maps buffers exclusively as DMA_TO_DEVICE, causing dma_unmap_single() to skip cache invalidation on non-coherent architectures - so CPU reads of NPU-written responses observe stale cached values rather than actual NPU output. The CVSS 7.8 score reflects high confidentiality, integrity, and availability impact for local low-privilege users; however, hardware specificity and timing sensitivity keep real-world exploitation likelihood low (EPSS 0.20%, 10th percentile), and no public exploit or CISA KEV listing exists.
Use-after-free in the Linux kernel AMD IOMMU driver allows a local low-privileged attacker on multi-CPU AMD systems to corrupt kernel memory by exploiting a logical race in `iommu_completion_wait()`. The `need_sync` flag was read locklessly, enabling a CPU to return without waiting for hardware IOMMU command completion while another CPU's page-table pages are freed - leaving the IOMMU walking stale, potentially freed memory. No public exploit exists and EPSS is 0.20% (10th percentile), but successful exploitation on AMD virtualization infrastructure could cross IOMMU isolation boundaries affecting co-tenant VMs.
Slab-out-of-bounds read and integer underflow in the Linux kernel mwifiex wifi driver's uAP event handler allow a malicious or malfunctioning Marvell WiFi device (USB/SDIO/PCIe) to leak kernel slab memory or trigger a kernel panic on a host running in AP mode. The firmware-supplied event->len field in EVENT_UAP_STA_ASSOC is never validated before being used to compute assoc_req_ies_len, enabling an attacker who controls device firmware to walk cfg80211_find_ie() past the fixed event_body buffer into adjacent slab objects, or to produce a massive size_t that copies stale kernel bytes into NL80211_CMD_NEW_STATION notifications. No active exploitation has been confirmed (not in CISA KEV) and EPSS places exploitation probability at the 6th percentile, though the CVSS 8.8 base score reflects potential for complete confidentiality and availability compromise against affected configurations.
Race condition in the Linux kernel's TIPC UDP bearer implementation allows a local low-privileged attacker to corrupt an RCU-protected peer list, triggering a kernel BUG and enabling potential privilege escalation to full system compromise. The flaw exists in the TIPC subsystem where tipc_udp_rcast_add() (running from a softirq) and cleanup_bearer() (running from a workqueue) both mutate ub->rcast.list without synchronization, and critically, TIPCv2 generic-netlink ops lack GENL_ADMIN_PERM, allowing the race to be triggered from an unprivileged user namespace. No public exploit is identified at time of analysis, and EPSS probability is very low at 0.15% (5th percentile).
Heap buffer overflow in the Linux kernel's SCTP authentication subsystem allows a local low-privileged user to corrupt kernel memory by adding more than 16 authentication chunk types to an SCTP endpoint. The capacity mismatch between sctp_auth_ep_add_chunkid()'s limit of SCTP_NUM_CHUNK_TYPES (20 entries) and the destination struct sctp_cookie's SCTP_AUTH_MAX_CHUNKS (16 entries) causes sctp_association_init() to memcpy up to 4 bytes past the auth_chunks buffer boundary. No public exploit has been identified at time of analysis and EPSS sits at the 6th percentile, but the kernel-space memory corruption potential and CVSS score of 7.3 warrant timely patching on any system where untrusted local users have shell access.
Element size miscalculation in the Linux kernel's accel/ethosu driver (Arm Ethos-U NPU) allows a local low-privileged user on hardware-equipped systems to bypass command stream validation and trigger out-of-bounds kernel memory access. Two discrete arithmetic errors - an entirely missing element size multiplier in the NHWC format path, and a shifted bitfield decode for OFM precision (bits 1:2 vs. the correct IFM bits 2:3) - cause the validator to underestimate buffer sizes for 16-, 32-, and 64-bit element widths. No public exploit code has been identified at time of analysis, and the EPSS score of 0.15% (5th percentile) reflects minimal observed exploitation activity; upstream fixes are available in Linux 7.1.6 and 7.2-rc5.
Kernel panic via integer overflow in the SCTP stream-reset path allows an unauthenticated remote peer to crash Linux systems running SCTP on interfaces with MTU exceeding 65535 bytes. sctp_process_strreset_inreq() fails to validate that the RESET_OUT_REQUEST constructed in response to a peer's RESET_IN_REQUEST would stay within SCTP_MAX_CHUNK_LEN, causing a __u16 overflow in sctp_make_strreset_req() that produces an undersized socket buffer and a fatal kernel BUG. No public exploit has been identified and EPSS is 0.17% (6th percentile), but the impact is total denial of service on affected hosts.
Linux Kernel's MCTP I3C driver leaves a dangling notifier and leaked bus objects when mctp_i3c_mod_init() encounters an error during i3c_driver_register(). Systems running Linux 6.7 through the unpatched stable branches are affected when the mctp_i3c module is loaded under specific failure conditions. No public exploit code has been identified and EPSS is 0.17%, but the theoretical impact includes kernel memory corruption via the stale notifier pointer if a subsequent I3C bus event fires against the freed module memory.
NULL pointer dereference in the Linux kernel's Intel Xe GPU SR-IOV virtual function (VF) driver allows a local user to crash the kernel during buffer object (BO) teardown. The flaw is triggered when CCS (Color Compression Surface) read/write buffers are freed after the device is unbound but while the DRM structure remains live, causing `xe_sriov_vf_ccs_rw_update_bb_addr` to dereference a NULL device pointer during process exit. CVSS rates this 7.8 (C:H/I:H/A:H) reflecting worst-case kernel-level impact, though practical exploitation is constrained by hardware and configuration prerequisites; EPSS is 0.16% (6th percentile) and no active exploitation is confirmed.
Memory corruption in the Linux kernel's AMT (Automatic Multicast Tunneling) driver stems from multiple receive and transmit paths caching skb-head pointers (ip_hdr, ipv6_hdr, eth_hdr, and AMT message headers) that are then invalidated by pull/reallocation helpers, leaving dangling pointers that are dereferenced as a use-after-free of the freed skb head. Systems acting as AMT gateways or relays that process attacker-supplied tunneled multicast packets are affected across kernels from 5.16 up to the fixed stable releases. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile), but the flaw is a network-reachable kernel UAF that could enable denial of service or, potentially, code execution.
Authentication bypass in the Linux kernel SCTP stack allows the AUTH requirement to be silently skipped: sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL. On endpoints configured to require SCTP AUTH, a remote peer can get COOKIE-ECHO (and associated control chunks) processed without the mandated authentication, either by omitting the preceding AUTH chunk or by exploiting a receive-path skb_clone() failure. The fix rechecks sctp_auth_recv_cid() and drops the chunk when authentication is required. No public exploit identified at time of analysis; EPSS is low (0.20%).
Kernel panic (denial of service) in the Linux kernel vmxnet3 driver affects VMware-hosted Linux guests receiving Geneve-encapsulated network traffic. The vmxnet3_get_hdr_len() function contains unguarded BUG_ON() assertions that assume hardware completion descriptor flags always describe outer headers; when the VMware VMXNET3 hardware signals inner-header processing of a Geneve tunnel packet via the VMXNET3_RCD_HDR_INNER_SHIFT bit, these assertions fire against the wrong protocol fields, crashing the kernel. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (6th percentile), reflecting very low current exploitation interest despite the elevated CVSS 7.5 base score.
Incomplete error-path cleanup in the Linux kernel's Intel Xe DRM GPU driver leaks kernel SVM and pagemap resources during GPU VM creation failures on systems equipped with Intel Xe-architecture hardware. The flaw, introduced when commit 9e9787414882 made xe_svm_init() unconditional without updating the matching teardown calls on the drm_gpuvm_resv_object_alloc() failure path, affects both fault-mode and non-fault-mode VMs running kernels between the introducing commit and the three stable-branch fixes. No public exploit code exists and no active exploitation is confirmed; EPSS sits at the 6th percentile, reflecting appropriately low short-term weaponization likelihood.
Integer truncation in the Linux kernel TIPC subsystem allows low-privileged local attackers - including unprivileged users leveraging user namespaces - to crash the kernel via division by zero or trigger link malfunction. Two independent netlink code paths (TIPC_NL_MEDIA_SET via tipc_udp_mtu_bad() and TIPC_NL_BEARER_SET via bearer.c:1160) accept MTU values above U16_MAX (65535) without enforcing an upper bound, causing silent truncation when the values are stored in u16 fields in tipc_link_create(). No exploit code is publicly known and the vulnerability is not listed in CISA KEV; EPSS at 0.17% (6th percentile) confirms very low observed exploitation probability.
LoongArch BPF JIT in the Linux kernel incorrectly sign-extends results of signed ALU32 division and modulo operations (off=1), leaving bits 63:32 set in JIT-compiled code while the verifier and interpreter model those bits as zero. This JIT-verifier semantic divergence affects low-privileged local users on LoongArch systems who can load BPF programs, and may be leveraged via crafted eBPF programs to violate verifier-enforced memory safety invariants, potentially enabling privilege escalation. EPSS is low at 0.19% (9th percentile), no public exploit is confirmed at time of analysis, and patches are available in Linux 7.1.6 and upstream commit dacd348b8a99.
QRTR (Qualcomm IPC Router) socket namespace isolation is completely absent in the Linux kernel, allowing a local user with low privileges to cross network namespace boundaries by invoking unshare(CLONE_NEWUSER | CLONE_NEWNET) and opening an AF_QIPCRTR socket in the resulting namespace. The attacker can then send QRTR datagrams - including control-plane messages such as QRTR_TYPE_NEW_SERVER - to QRTR services in the host or initial namespace, where those messages are indistinguishable from legitimate traffic because they appear to originate from node id 1. No public exploit has been identified at time of analysis, and EPSS probability is low at 0.20%, but the CVSS 8.8 score with scope change reflects the complete breakdown of the kernel's namespace isolation guarantee for QRTR IPC.
Buffer overflow in the Linux kernel's mlx5 network driver allows a local low-privileged attacker to crash the kernel or read out-of-bounds kernel memory when querying module EEPROM data via ethtool on systems equipped with Mellanox/NVIDIA ConnectX adapters that advertise the mcia_32dwords capability. The root cause is a struct size mismatch: mlx5_ifc_mcia_reg_bits defines only 12 dwords (48 bytes) of MCIA register storage while the hardware can return up to 32 dwords (128 bytes), causing mlx5_query_mcia() to memcpy beyond the allocated buffer. No public exploit has been identified at time of analysis and EPSS remains low at 0.18%, but the kernel BUG triggered by FORTIFY_SOURCE on patched builds confirms the overflow is reliably reproducible.
Use-after-free in the Linux kernel's RDS TCP subsystem allows a local low-privileged attacker to corrupt kernel memory during network namespace teardown, potentially achieving full privilege escalation to root. The flaw exists across multiple stable kernel branches (6.12.x before 6.12.101, 6.18.x before 6.18.42, 7.1.x before 7.1.6), with exploitation limited to systems where the RDS TCP module is loaded - a non-default configuration primarily found in Oracle RAC and HPC environments. Kernel patches have been merged across all affected stable branches; no public exploit exists and EPSS sits at 0.17%, indicating low current exploitation probability.
Kernel panic via buffer overrun in the Linux kernel's drop_monitor subsystem when reporting packet drop events on 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS. The size calculation functions net_dm_packet_report_size() and net_dm_hw_packet_report_size() under-budget SKB allocation by up to 4 bytes, failing to account for the alignment padding that nla_put_u64_64bit() inserts on affected architectures, resulting in skb_over_panic() and a full kernel crash. No public exploit is known, and EPSS at 0.20% (10th percentile) reflects low exploitation probability consistent with the architecture-specific trigger condition.
Use-after-free in the Linux kernel's BPF sockmap subsystem allows a local low-privileged attacker to corrupt kernel slab memory via a race condition in tcp_bpf_sendmsg(), potentially escalating privileges to root. The vulnerability arises because the error path in tcp_bpf_sendmsg() uses a stale msg_tx pointer to decide whether to free a shared cork object - a decision that becomes unsafe once a second thread has already freed it during the window when the socket lock is released by sk_stream_wait_memory(). No public exploit has been identified at time of analysis and EPSS is 0.18%, though KASAN telemetry in the disclosure confirms the bug was reproduced by the reporter.
Use-after-free in the Linux kernel tracing subsystem exposes kernel memory to corruption when event trigger data is freed asynchronously by a kthread while a concurrent tracepoint handler still holds a reference. Affected are Linux 6.19 and kernel versions containing commit 61d445af0a7c but lacking the fixes at b9c8a1400a3b or 79097812153b. A local attacker with sufficient privilege to configure kernel tracing triggers could exploit this race condition to achieve kernel memory corruption, potentially enabling privilege escalation. No public exploit has been identified at time of analysis, and EPSS of 0.16% (6th percentile) reflects minimal exploitation activity despite the high CVSS score.
Heap buffer overflow in the Linux kernel's Intel Xe GPU DRM driver (drm/xe/guc) corrupts kernel slab memory during device unbind, creating a local privilege escalation path on systems hosting Intel Xe/Arc discrete GPUs with compute-only DSS hardware units. The root cause is a mismatch between the steered register extarray allocation size - derived solely from the geometry DSS mask - and the fill loop, which iterates over the union of geometry and compute DSS masks, writing past the allocated region on affected hardware configurations. Vendor-released patches are available in kernel versions 6.18.44, 7.1.6, and 7.2-rc1; no public exploit code or CISA KEV listing exists at time of analysis.
Use-after-free and NULL pointer dereference vulnerabilities in the Linux kernel's amdgpu DRM driver allow a local authenticated user to corrupt kernel memory during GPU context initialization. The flaws stem from `amdgpu_ctx_init()` failing to acquire `adev->pm.stable_pstate_ctx_lock`, enabling a race between context initialization and concurrent sysfs pstate modifications, alongside a logic error where context finalization incorrectly restores pstate even when ownership has transferred to sysfs. CVSS rates this 7.8 (High), though EPSS at 0.18% (7th percentile) and absence from CISA KEV indicate no confirmed active exploitation at time of analysis.
Use-after-free in the Linux kernel's drm/xe Intel Xe GPU driver allows a local low-privileged user to trigger kernel memory corruption with potential for full system compromise (C:H/I:H/A:H). The bug arises because an imported dma-buf buffer object (BO) is created with its reservation object (resv) pointing to the exporter's dma_buf->resv before the importer acquires a reference on that dma-buf - leaving a window in which the exporter can be freed while the TTM workqueue asynchronously accesses the now-dangling pointer. Vendor-released patches are available for Linux 6.12.103, 6.18.42, and 7.1.6; no public exploit has been identified at time of analysis.
Out-of-bounds kernel memory access in the Linux drm/xe Intel GPU driver allows a local low-privileged user to read sensitive kernel memory, cause a kernel panic, or potentially corrupt kernel state. The flaw exists in the BO (buffer object) prefetch path of the Intel Xe GPU subsystem, where DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC (value -1) is incorrectly used as an array index into region_to_mem_type[], accessing memory before the array's base address. Discovered via AI-assisted static analysis confirmed by Intel Product Security; no public exploit or CISA KEV listing identified at time of analysis.
Out-of-bounds write and use-after-free in the Intel Xe GPU DRM driver (drm/xe/pt) allows a local low-privileged attacker to corrupt kernel heap memory and crash or potentially escalate privileges on systems running affected Linux kernel versions. The flaw exists in xe_pt_update_ops_init(), which fails to reset current_op, needs_svm_lock, and needs_invalidation before each pass, causing unbounded counter growth across drm_exec retry loops triggered by lock contention or OOM eviction. No public exploit code exists and EPSS is extremely low (0.18%), though the memory corruption primitive is structurally serious.
Use-after-free via refcount underflow in the Linux kernel's DRM Imagination (PowerVR) GPU driver allows a local low-privileged user to corrupt kernel memory during GPU context teardown. The drm_sched_entity_fini() function is called twice on the same scheduling entity - once via pvr_context_kill_queues and again via pvr_context_destroy_queues - triggering a refcount_t underflow exposed by commit fd177135f0e6 which added GPU entity time accounting. No public exploit identified at time of analysis, and EPSS at 0.17% (6th percentile) reflects low exploitation probability; exploitation requires hardware with an Imagination/PowerVR GPU.
Incorrect pointer arithmetic in the Linux kernel's drm/imagination (PowerVR GPU) driver exposes kernel memory to local users and can trigger availability failures. The `pvr_set_uobj_array()` function swaps the stride increments for the kernel and userspace pointers when copying object arrays, so with a larger userspace stride the kernel reads and forwards data from wrong kernel addresses (confidentiality breach), and with a smaller stride it writes copies at wrong userspace offsets (potential crash or memory corruption). Exploitation requires local, low-privileged access to a system running an affected kernel with an Imagination Technologies PowerVR GPU; no public exploit has been identified at time of analysis and EPSS is low at 0.18%.
NULL pointer dereference in the Linux kernel's drm/imagination PowerVR GPU driver allows a local attacker with low privileges to crash the kernel or potentially exploit kernel memory corruption. The vulnerability stems from pvr_vm_map() failing to acquire vm_ctx->lock before performing GPU virtual memory mapping operations, enabling a concurrent drm_gpuva_find() call to dereference a NULL pointer at kernel address offset 0x10 when map and find operations race. No public exploit code or confirmed active exploitation exists; vendor-released patches are available across multiple stable kernel branches as of Linux 6.12.101, 7.1.6, and 6.18.42.
Bounds validation is absent in the AMD KFD CRIU restore path of the Linux kernel, exposing local low-privilege users on AMD GPU systems to kernel memory disclosure and availability loss. The drm/amdkfd subsystem accepts user-controlled queue type and mqd_size values during CRIU restore without range checking, allowing crafted inputs to drive out-of-bounds kernel memory access. No public exploit has been identified, and vendor-released patches are confirmed in Linux 6.18.42 and 7.1.6.
Integer overflow in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user on systems with multi-die AMD GPUs to trigger an undersized CWSR save-area allocation that AMD firmware subsequently overruns, enabling kernel heap corruption with full confidentiality, integrity, and availability impact. Affected stable branches include all kernel versions before 6.12.101, 6.18.42, and 7.1.6, with patches released across all trees. No public exploit code or active exploitation has been identified; EPSS at 0.18% (7th percentile) reflects very low near-term exploitation probability.
Out-of-bounds read in the Linux kernel drm/virtio driver allows a malicious virtio-gpu backend to leak adjacent guest kernel memory by returning a crafted EDID response with an inflated size and extension block count. Guests running Linux 5.0 through multiple unpatched stable branches are affected wherever virtio-gpu is in use, covering the majority of QEMU/KVM-based cloud VM deployments. No public exploit code is identified at time of analysis, and EPSS at 0.21% (11th percentile) reflects the high-privilege prerequisite of backend control, though the risk is material in adversarial multi-tenant cloud environments.
Buffer overflow in the Intel i915 HDCP subsystem of the Linux kernel allows a local, low-privileged user to corrupt kernel memory with potential privilege escalation to full system compromise. The bounds check on the `data->streams[]` array write executes after the overrun has already occurred, meaning any caller who can trigger this code path can write past the array boundary before the kernel detects the violation. Discovered via AI-assisted static analysis and confirmed by Intel Product Security; no public exploit exists and EPSS probability is 0.18%, indicating no observed exploitation at time of analysis.
Use-after-unlock memory corruption in the Linux kernel's DRM/AMDGPU driver allows local low-privileged users on systems with AMD GPUs to read or corrupt kernel memory via the `amdgpu_vm_get_task_info_pasid()` function. The defect stems from a lock lifetime design flaw: a `vm` pointer obtained under XArray lock is dereferenced after `xa_unlock_irqrestore` releases that lock, leaving the pointer unprotected against concurrent modification. No public exploit code has been identified and EPSS is very low (0.20%, 10th percentile), but the CVSS-rated impact is High across Confidentiality, Integrity, and Availability, and vendor patches are available across multiple stable branches.
GPU Shared Virtual Memory (SVM) page mapping in the Linux kernel's drm/gpusvm subsystem leaks device mappings when a partial page-acquisition operation fails mid-sequence, leaving IOMMU-level mappings orphaned and unrecoverable through the normal cleanup path. Local users with GPU access on affected kernels - ranging from the introduction of drm/gpusvm through Linux 6.18 and 7.1 stable series - can trigger the condition by causing a later page in a batch to fail with -EOPNOTSUPP when ctx->allow_mixed is false, bypassing device_unmap() in __drm_gpusvm_unmap_pages(). No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, though NVD assigns a CVSS of 8.8 due to potential changed-scope impact on GPU/IOMMU mappings.
Double-free and use-after-free conditions in the Linux kernel's drm/amd/display subsystem expose systems with AMD GPU hardware to potential privilege escalation or kernel crash. The flaw resides in dm_update_crtc_state(), where the skip_modeset path releases a display stream reference without nullifying the pointer, leaving it dangling for a second release if a subsequent error - such as a color management failure - triggers the fail label. Patches are confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4); no public exploit exists and EPSS sits at 0.17% (6th percentile), but the kernel-level memory corruption class demands prioritized patching on AMD GPU deployments.
Buffer overflow in the Linux kernel's Amlogic C3 ISP driver allows a local low-privileged attacker to trigger out-of-bounds memory access via crafted camera parameter configurations, with potential for kernel memory disclosure and system crash. Affected functions c3_isp_params_awb_wt() and c3_isp_params_ae_wt() in drivers/media/platform/amlogic/c3/isp/c3-isp-params.c fail to validate zones_num against the fixed-size zone_weight array bounds (768 entries for AWB, 255 for AE). Patched upstream in kernel versions 6.18.42, 7.1.6, and 7.2-rc1; EPSS is 0.21% with no public exploit or CISA KEV listing, indicating low active exploitation pressure.
Out-of-bounds read in the Linux kernel Cedrus V4L2 stateless H.264 video decoder driver exposes kernel memory and can cause system instability when a local low-privileged user submits crafted H.264 decode requests with invalid DPB reference indices. The flaw exists in `_cedrus_write_ref_list()`, which uses userspace-supplied ref_pic_list0/ref_pic_list1 index values to index into the fixed `decode->dpb[]` array without bounds validation, accepting out-of-range sentinel values that are technically legal in the stateless H.264 API but were never guarded at the driver use site. No public exploit identified at time of analysis; EPSS of 0.20% at the 10th percentile reflects the niche hardware platform and local-only access requirement.
Race condition in the chips-media Wave5 video encoder driver of the Linux kernel corrupts the V4L2 M2M ready queue linked list, enabling local privilege escalation. The IRQ handler returns a source buffer to userspace via v4l2_m2m_buf_done before removing it from the ready queue; if userspace re-queues that buffer before start_encode cleans up the index, __list_add creates a self-referential loop that __list_del cannot resolve, poisoning kernel list pointers. A low-privileged local user on a system with Wave5 hardware can trigger kernel memory corruption, leading to a crash or potential escalation to root. No public exploit has been identified at time of analysis, and EPSS at 0.20% reflects very low near-term weaponization probability.
Buffer management failures in the Linux kernel msi2500 USB SDR driver allow a local low-privileged user to cause kernel memory corruption through improperly handled start_streaming() error paths. Five distinct failure paths in msi2500_start_streaming() - including USB disconnection, mutex interruption, USB ADC setup failure, isoc initialization failure, and CMD_START_STREAMING failure - neglect to return queued vb2 buffers to the framework before returning errors, and the worst path leaves submitted isochronous URBs with no consumer. Patched stable releases are available (6.6.148, 6.12.101, 6.18.42, 7.1.6), no public exploit exists, and EPSS is 0.18% (7th percentile), indicating low current exploitation probability.
Out-of-bounds memory access in the Linux kernel's NXP i.MX8 ISI (Image Sensing Interface) media driver enables a local low-privileged attacker to corrupt kernel memory or freeze the system, with CVSS-assessed high impact across confidentiality, integrity, and availability. The flaw stems from missing minimum-value validation on the hardware downscaling factor - the ISI supports up to 16x downscaling, but no floor check is enforced before writing values to hardware registers, resulting in invalid hardware state and a kernel-level process freeze that survives Ctrl+C. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), reflecting the hardware-specific nature of the attack surface.
Buffer leakage in the Linux kernel's pwc (Philips WebCam) driver allows a local low-privileged user to corrupt kernel memory state when start_streaming() fails along two specific error paths: USB device disconnection (-ENODEV) and signal-interrupted mutex acquisition (-ERESTARTSYS). The vb2 videobuf2 framework transfers buffer ownership to the driver before invoking start_streaming(), but the pwc driver's error paths failed to return those buffers via vb2_buffer_done(), triggering WARN_ON(owned_by_drv_count) and leaving kernel buffers in an unreturned, leaked state. No public exploit or CISA KEV entry exists; EPSS is 0.21% (11th percentile), reflecting minimal active exploitation interest, though the CVSS C:H/I:H/A:H scoring reflects the potential severity of kernel-level memory corruption.
Buffer leak in the Linux kernel's rtl2832_sdr media driver allows a local low-privileged user with access to an RTL2832-based SDR device to trigger kernel memory corruption by causing start_streaming() to fail, leaving vb2 framework buffers unreturned and firing WARN_ON(owned_by_drv_count). Affected are Linux kernels from 3.15 through multiple stable branches prior to 6.6.148, 6.12.101, 6.18.42, and 7.1.6. No public exploit has been identified at time of analysis and EPSS is 0.21% (11th percentile), but the kernel-level memory corruption potential under C:H/I:H/A:H CVSS rating indicates a realistic local privilege escalation risk for systems with SDR hardware attached.
Improper error-path cleanup in the Linux kernel STM32 DCMI driver leaves a V4L2 async notifier registered against kernel structures that may be freed or reused after a failed probe, creating a use-after-free condition. Systems running a vulnerable kernel with STM32 DCMI hardware where reset_control_assert() or reset_control_deassert() returns an error during driver initialization are susceptible to kernel memory corruption or crashes. No public exploit has been identified and EPSS sits at the 11th percentile, but CVSS rates the impact as High across confidentiality, integrity, and availability when the specific failure condition is met.
Buffer leak in the Linux kernel's sun4i-csi camera driver (Allwinner SoC Camera Sensor Interface) allows a local attacker with low-privilege access to the V4L2 camera interface to exhaust kernel memory by repeatedly triggering start_streaming() failure with an unsupported CSI format. The vb2 framework hands buffers to the driver before calling start_streaming(); when that call returns -EINVAL on the early format-validation path, those buffers are never returned via vb2_buffer_done(), leaking kernel memory and triggering WARN_ON(owned_by_drv_count). No public exploit exists and EPSS stands at 0.21% (11th percentile), indicating negligible real-world exploitation interest; the NVD-assigned C:H/I:H/A:H impact appears overstated relative to the actual error-path memory leak primitive.
Unvalidated HEVC active reference counts in the Linux kernel's V4L2 common control path allow a local low-privileged user to trigger out-of-bounds kernel memory access on systems equipped with stateless HEVC hardware decoders. Affected kernels from the introduction of stateless HEVC support (approximately 5.14) through to the patch commits fail to check that num_active_dpb_entries values fall within valid bounds before driver-specific code (Cedrus, Hantro, etc.) consumes them. No active exploitation is confirmed - EPSS stands at 0.21% (11th percentile) and the vulnerability is not listed in CISA KEV - but patched stable releases are available across all maintained kernel branches.
Memory corruption in the Linux kernel's vivid virtual video driver arises from missing vb2_is_busy() guards when toggling CROP, COMPOSE, and SCALE capability controls, exploitable by local low-privileged users in the window between VIDIOC_REQBUFS and VIDIOC_STREAMON ioctls. The affected vivid_update_format_cap/out() functions can overwrite video queue format parameters on an already-allocated buffer queue, yielding kernel-level corruption with high confidentiality, integrity, and availability impact as reflected in the CVSS 7.8 score. No public exploit identified at time of analysis; EPSS is 0.21% (11th percentile), though the issue was surfaced by the syzbot automated kernel fuzzer and confirmed by upstream maintainers.
Use-after-free in the Linux kernel ALSA MIDI sequencer subsystem enables local privilege escalation by any unprivileged user with access to /dev/snd/seq, requiring no capabilities or queue ownership. The flaw stems from a race window during queue deletion where a concurrent thread can re-open a queue timer after it has been closed but before the queue is freed, leaving a stale callback pointer that the global timer subsequently dereferences on the next tick. No public exploit has been identified and EPSS is 0.21% (11th percentile), but the attack surface is broad given how widely ALSA seq is deployed across Linux desktop and development systems.
Use-after-free in the Linux kernel ALSA timer subsystem allows a local low-privileged attacker to corrupt kernel memory by exploiting a race condition during master-slave timer instance teardown. When a master timer closes, slave callback draining is skipped, causing the slave struct to be freed while its callback executes in parallel - a classic UAF primitive with potential for local privilege escalation. EPSS is low at 0.21% (11th percentile), no KEV listing exists, and no public exploit code has been identified at time of analysis, but patched stable kernel releases are available.
Use-after-free in the Linux kernel ALSA timer subsystem allows a local unprivileged user to corrupt kernel memory and potentially escalate privileges. The flaw resides in the userspace-driven timer (utimer) path: the in-flight callback state is tracked by a single bit that cannot represent two concurrent callbacks, so racing two TRIGGER ioctls against the same utimer frees the instance while a second callback is still executing against that memory. The vulnerability is reachable by any user who can open /dev/snd/timer, including via sequencer queue timers bound to a utimer; no public exploit code has been identified and EPSS probability is low at 0.21%.
Out-of-bounds kernel heap access in the Linux kernel's ath6kl WiFi driver allows an adjacent unauthenticated attacker to trigger zero-size or integer-overflowed kernel allocations by transmitting a malformed ADDBA (Block Acknowledgment) WiFi management frame with an out-of-range window size. Affected are Linux kernel versions from the introduction of the vulnerable code in commit bdcd81707973, with patches confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, 7.2-rc5). No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) reflects low current exploitation probability despite the high CVSS score of 8.8.
Use-after-free in the Linux kernel's ath6kl WiFi driver exposes systems with Atheros WiFi hardware to potential kernel memory corruption via a timer-callback race condition. The vulnerable `aggr_reset_state()` function calls non-synchronous `timer_delete()`, leaving a window in which the `aggr_timeout` callback continues accessing `aggr_conn->rx_tid[]` and `aggr_conn->stat[]` after those structures are freed by `aggr_module_destroy()`. Vendor-released patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.42, 7.1.6, 7.2-rc5), no public exploit has been identified, and EPSS stands at 0.18%, reflecting low observed exploitation activity.
Out-of-bounds read in the Linux kernel wilc1000 WiFi driver exposes devices with Microchip ATWILC1000 chipsets to memory disclosure and potential denial of service when a rogue access point sends a malformed association response shorter than 6 bytes. The driver's wilc_parse_assoc_resp_info() function performs an integer underflow when computing IE length without first validating the frame meets the minimum fixed-header size, causing kmemdup() to attempt copying up to 65534 bytes of out-of-bounds kernel memory. No public exploit code is identified at time of analysis, and EPSS probability sits at 0.21%, though the adjacent-network vector and no-authentication requirement make this exploitable by any attacker within WiFi range acting as a rogue AP.
Double-free memory corruption in the Linux kernel's brcmfmac Broadcom WiFi PCIe driver exposes systems running kernel 5.2 and later to potential kernel heap corruption when a bus_reset event is sequentially followed by device removal. The flaw in brcmf_pcie_release_scratchbuffers() allows dma_free_coherent() to be called twice on the same DMA allocation because freed pointer fields are not NULLed - unlike the sibling release_ringbuffers() function which correctly NULLs its pointers. No public exploit code exists and EPSS exploitation probability is very low (0.21%, 11th percentile), though the high CVSS score (8.8) reflects the theoretical severity of kernel-level memory corruption if the double-free is successfully weaponized.
Use-after-free in the Linux kernel Bluetooth HCI sync subsystem allows a local low-privileged attacker to corrupt kernel memory, with potential for privilege escalation and full system compromise. The flaw is a race condition between the hci_sync async command work (holding hdev->req_lock) and Bluetooth management socket operations (add_uuid/remove_uuid, which operate under hdev->lock), enabling concurrent unsafe UUID list access confirmed by KASAN. No public exploit code exists and EPSS is 0.20% (10th percentile), but the high C/I/A CVSS impact reflects the severity of kernel-level memory corruption if the race is won.
Mutex unlock imbalance in the Linux kernel's Nitro Security Module (NSM) ioctl handler allows a local process to corrupt kernel locking state by supplying an invalid user pointer to NSM_IOCTL_RAW. The `nsm_dev_ioctl()` function's pre-lock `copy_from_user()` failure path incorrectly reaches the shared `out` label, which unconditionally calls `mutex_unlock()` on a mutex that was never acquired - triggering a bad-unlock-balance condition confirmed by Lockdep. Systems running AWS Nitro Enclaves on affected kernel versions are exposed; no public weaponized exploit exists but a functional PoC triggering the Lockdep warning is documented in the upstream commit itself, and EPSS sits at 0.20% (10th percentile), indicating no widespread exploitation observed to date.
Use-after-unload code execution in the Linux kernel's NSM (Nitro Security Module) misc device allows a local attacker with low privileges to call into freed kernel module text, potentially achieving full kernel compromise. The NSM driver fails to set nsm_dev_fops.owner to THIS_MODULE, meaning misc_open() never increments the module reference count when /dev/nsm is opened. When the nsm module is subsequently unloaded while a file descriptor remains open, a later ioctl through that descriptor jumps into unmapped or reallocated memory. No public exploit code or CISA KEV listing exists, and EPSS sits at 0.20% (10th percentile), reflecting limited real-world exploitation risk at this time.
Use-after-free in the Linux kernel tracing subsystem's enable_event trigger mechanism allows a local attacker to dereference freed module memory by racing module unloading against an active tracepoint trigger. Affected kernel versions span from commit 61d445af0a7c70018111919e47beaaee15653f2f up to the fix commits on stable branches; patched releases 7.1.6 and 7.2-rc5 are available. No public exploit is identified and EPSS is 0.19% (9th percentile), but the CVSS-rated impact is full compromise of confidentiality, integrity, and availability at the kernel level.
Premature device-live marking in the Linux kernel ublk subsystem causes stranded block I/O requests and indefinite fsync hangs on ext4 filesystems. The flaw exists in ublk's user-recovery state machine: if a ublk daemon sends END_USER_RECOVERY after START_USER_RECOVERY fails (e.g., with -EBUSY) and the error is silently ignored, a stale edge-triggered completion latch from a prior recovery cycle satisfies the kernel's readiness wait prematurely, marking the device LIVE while I/O cancellation flags are still set. Any local low-privileged user able to control or interact with a ublk server process can trigger this race, causing persistent uninterruptible-sleep hangs across all fsync calls and blocking kernel teardown - confirmed by a real report of lost PREFLUSH with ext4 on ublk after daemon crash recovery. No public exploit code and no KEV listing have been identified at time of analysis.
Kernel panic and unauthorized physical memory access are possible on arm64 Linux systems when huge_ptep_get() receives an unaligned virtual address during contiguous huge page table walks. On arm64 platforms configured with 16K page size - where CONT_PTES differs from CONT_PMDS - the kernel's find_num_contig() routine misidentifies a contpmd block as a contpte block, iterates past the valid PTE table boundary, and dereferences a garbage linear-map pointer, either crashing the kernel or touching physical memory not owned by the calling process. No active exploitation (KEV) or public proof-of-concept has been identified; EPSS is 0.20% at the 10th percentile, reflecting very low real-world exploitation probability.
Use-after-free in the Linux kernel's MPTCP (Multipath TCP) subflow teardown path allows a stale skb->sk pointer to survive after a subflow socket is freed, leading to a kernel warning in inet_sock_destruct() and a use-after-free in mptcp_backlog_purge(). The flaw affects Linux 6.19 and is fixed in 7.1.6 and 7.2-rc5; it is a race condition between subflow close and concurrent softirq RX backlog processing. There is no public exploit identified at time of analysis, and EPSS estimates exploitation probability at just 0.19% (9th percentile).
Memory corruption in the Linux kernel's mm/page_vma_mapped subsystem allows a local low-privileged attacker to trigger kernel memory corruption, potentially leading to privilege escalation or system crash. The flaw stems from incomplete handling of device-private PMD entries in the rmap walk code: when PVMW_MIGRATION is set, the caller incorrectly interprets a device-private PMD entry as a migration entry, producing undefined behavior. No public exploit has been identified at time of analysis, and EPSS at 0.20% (10th percentile) indicates low current exploitation interest, but the high CVSS 7.8 with full C/I/A impact reflects the severity of kernel memory corruption.
Use-after-free in the Linux kernel SCTP subsystem exposes a race condition during network namespace teardown, enabling a local low-privileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw stems from a lifecycle misalignment between per-net SCTP sysctl registration and the SCTP control socket: an open sysctl file descriptor targeting a network namespace can survive into teardown, causing proc_sctp_do_auth() to dereference an already-freed control socket. No public exploit has been identified at time of analysis; EPSS is 0.21% (11th percentile), consistent with the timing complexity required for successful exploitation.
Improper resource teardown in the Linux kernel's SCTP subsystem leaves per-net UDP tunnel sockets installed when a network namespace is destroyed, creating a use-after-free/dangling-socket condition once the control socket is released. The flaw affects systems where SCTP UDP encapsulation (net.sctp.udp_port) has been enabled inside a namespace before that namespace exits. There is no public exploit identified at time of analysis, EPSS is low (0.20%), and the issue is not in CISA KEV; the fix has already been merged to multiple stable trees. Note: the supplied 9.8/AV:N CVSS is inconsistent with the local, namespace-scoped nature of the actual defect.
Pre-authentication out-of-bounds kernel memory read in the Linux kernel's CephFS client (ceph_handle_caps) allows a malicious or compromised Ceph Metadata Server (MDS) to read beyond the message front buffer. By sending a CEPH_CAP_OP_IMPORT caps message with hdr.version set to 1 and an oversized snap_trace_len (e.g. 0xFFFFFFFF), the server bypasses all version-gated decoders and drives ceph_update_snap_trace() to decode a fake snap realm past the buffer, cascading into further OOB reads via attacker-controlled num_snaps/num_prior_parent_snaps counts. The flaw is present in every kernel since ceph_handle_caps() was introduced; it carries a CVSS 9.8 but currently has no public exploit and a low EPSS score (0.22%), and it is not on CISA KEV.
Stack out-of-bounds write in the Linux kernel's libceph client (net/ceph/osdmap.c) allows a malicious or compromised Ceph monitor to corrupt kernel stack memory on any client that mounts cephfs or maps RBD storage. The __decode_pg_temp() and __decode_pg_upmap_items() helpers accepted an attacker-controlled OSD-set length without bounding it to CEPH_PG_MAX_SIZE (32), so an oversized pg_temp/pg_upmap entry in an OSDMap is copied into the fixed-size on-stack ceph_osds.osds[32] array, triggering a KASAN-confirmed stack overflow that can panic the kernel and potentially enable privilege escalation. No public exploit identified at time of analysis; EPSS is low (0.20%) and it is not on the CISA KEV list.
Out-of-bounds memory read in the Linux kernel's in-kernel Ceph client (libceph) allows a malicious or compromised Ceph monitor/OSD to crash or potentially leak kernel memory from any host mounting CephFS or RBD. The flaw lives in decode_new_up_state_weight() when parsing a CEPH_MSG_OSD_MAP message: an attacker-controlled length field feeds a multiplication used for a bounds check, and the overflow makes the check pass so the decoder reads past the buffer. EPSS is low (0.20%, 10th percentile) with no public exploit identified at time of analysis; the CVSS 9.8 appears inflated for what is fundamentally an OOB read reachable only from the Ceph messaging path.
Null pointer dereference in the Linux kernel's libceph client crashes affected hosts processing malformed CRUSH map data from a Ceph cluster. Specifically, get_immediate_parent() during localized read selection fails to validate that a parent bucket's type has a corresponding entry in type_names before dereferencing type_cn, which may be NULL when the CRUSH map contains an incomplete hierarchy. Any Linux host acting as a Ceph client - including Kubernetes nodes with Ceph-backed persistent volumes and OpenStack compute nodes - is vulnerable to a kernel panic triggerable by a party controlling or compromising the upstream Ceph cluster. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.20% (10th percentile), but the network-accessible crash path and the wide deployment of Ceph in enterprise environments make patching a practical priority.
Use-after-free in the Linux kernel's libceph (Ceph client) authentication code lets a stale pointer to a freed ceph_buffer be transmitted during a msgr1 reconnect, triggering a KASAN slab-use-after-free in _copy_from_iter() as tcp_sendmsg() copies the authorizer. The flaw affects hosts acting as Ceph clients (RBD, CephFS, rados) and can crash the client kernel and potentially leak freed slab memory over the wire. It is patched upstream; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Kernel panic via crafted zero-monitor Ceph monmap in Linux libceph allows a network-reachable attacker to crash systems running the Ceph client. The libceph subsystem's ceph_monmap_decode() function fails to reject CEPH_MSG_MON_MAP messages advertising zero monitors - a logically impossible state, since no live monitor could emit such a map - accepting the corrupted payload as valid. Subsequent session establishment in __open_session() calls pick_new_mon(), where the hardcoded assertion BUG_ON(monc->monmap->num_mon < 1) triggers an immediate kernel panic. With EPSS at 0.20% (10th percentile) and no CISA KEV listing, large-scale exploitation is not currently observed, but the unauthenticated network-reachable CVSS vector makes this relevant for any environment running Ceph-attached Linux hosts.
Out-of-bounds memory access in the Linux kernel's libceph client (crush_decode) lets a malformed CRUSH map drive the CRUSH mapper into indexing the OSD weight array with a negative value. Because bucket type 0 is reserved for leaf devices, a bucket wrongly decoded with type 0 causes a negative bucket ID to be treated as a device and passed to is_out(), yielding an out-of-bounds read that can leak kernel memory or crash the host. Exploitation requires the kernel Ceph client to process the crafted map (i.e., connection to a malicious or compromised Ceph cluster); there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Use-after-free race condition in the Linux kernel's libceph subsystem allows a local low-privileged user to corrupt kernel memory during Ceph client teardown. The flaw exists because `ceph_destroy_client()` frees `monc->monmap` via `ceph_monc_stop()` before removing the associated debugfs entries, enabling a concurrent reader of `/sys/kernel/debug/ceph/*/monmap` to invoke `monmap_show()` on freed memory. No public exploit or CISA KEV listing exists; EPSS of 0.17% (6th percentile) confirms this remains unexploited in the wild, but the theoretical impact is kernel memory corruption or crash on any Ceph-connected Linux host.
Use-after-free in the Linux kernel's AMT (Automatic Multicast Tunneling) driver allows a local attacker to trigger kernel memory corruption or a system crash through a race condition introduced during AMT device removal. The flaw arises because amt_dev_stop() uses cancel_delayed_work_sync() to cancel req_wq and discovery_wq, but event_wq can re-schedule req_wq after that cancellation completes yet before the netdev is freed - leaving delayed work items that dereference the already-released amt_dev structure. Upstream patches are confirmed available in stable kernel releases 6.12.101, 6.18.42, and 7.1.6; no public exploit has been identified at time of analysis.
ACL cache state corruption in the Linux kernel's FUSE filesystem driver allows a local low-privileged attacker to receive stale POSIX ACL values from get_acl(), potentially bypassing access controls on files. The flaw resides in forget_cached_acl(), which can silently overwrite the ACL_DONT_CACHE sentinel for FUSE mounts where the userspace server has not negotiated FUSE_POSIX_ACL, re-enabling caching that the filesystem explicitly opted out of. No public exploit exists and EPSS sits at 0.18% (7th percentile), but the CVSS 8.4 score reflects high confidentiality and integrity impact from ACL policy bypass under specific FUSE configurations.
Use-after-free in the Linux kernel fscrypt subsystem's `find_or_insert_direct_key()` function allows a low-privileged local attacker to potentially read sensitive kernel memory, corrupt data structures, or crash the system. The global `fscrypt_direct_keys` hash table-used exclusively by the legacy v1 encryption policy path with `FSCRYPT_POLICY_FLAG_DIRECT_KEY`-matched cached master-key entries by cryptographic material without comparing the `super_block` pointer, enabling inodes from distinct filesystems to share a single `fscrypt_direct_key` and extend its lifetime past superblock teardown. No public exploit is identified at time of analysis, and EPSS stands at 0.12% (2nd percentile), indicating negligible observed exploitation activity.
Use-after-free race condition in the Linux kernel's TC act_tunnel_key subsystem allows a local low-privileged attacker to corrupt kernel heap memory, potentially escalating privileges or crashing the system. The flaw exists in tunnel_key_release_params(), which synchronously frees metadata_dst via dst_release() while concurrent RCU readers in tunnel_key_act() may still hold the old params pointer and attempt dst_clone() on the already-dead reference. A proof-of-concept was developed by Trend Micro ZDI (zdi-disclosures@trendmicro.com) and verified by kernel maintainers with KASAN confirming slab-use-after-free; no public exploit is available beyond that researcher-held POC, and no KEV listing exists at time of analysis.
Stack-based buffer overflow in the Linux kernel's SCTP subsystem corrupts adjacent kernel memory when SCTP authentication is configured with four HMAC identifiers, enabling a remote unauthenticated attacker to achieve high-impact memory corruption via a crafted SCTP packet exchange. Affected kernels span from 2.6.24 through current stable branches, with patches backported to 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4. No public exploit code or CISA KEV listing has been identified; the EPSS score of 0.17% reflects the high exploitation complexity imposed by the required SCTP authentication configuration.
Use-after-free race condition in Linux kernel USB core sysfs allows a local low-privileged user to trigger concurrent memory access on freed BOS descriptor data, potentially leading to kernel memory corruption, privilege escalation, or system crash. The vulnerability arises in bos_descriptors_read() within the USB sysfs subsystem, where udev->bos is accessed without a lock while usb_reset_and_verify_device() - called by numerous drivers across the kernel - can free that same memory simultaneously. No public exploit code exists and the vulnerability is not listed in CISA KEV; the EPSS score of 0.17% confirms low observed exploitation probability at time of analysis.
Out-of-bounds kernel memory read in the at76c50x-usb WiFi driver affects Linux systems equipped with Atmel AT76C50x USB wireless adapters. When the kernel scans for networks, a truncated beacon or probe response frame between 24 and 35 bytes triggers an integer underflow in at76_guess_freq(): subtracting the fixed management-body offset (el_off = 36) from a shorter frame length wraps the unsigned value to near UINT_MAX, which is then passed to cfg80211_find_elem_match(), causing a walk far beyond the RX socket buffer boundary with consequences ranging from kernel memory disclosure to system crash. With an EPSS of 0.17% (6th percentile) and no CISA KEV listing, no public exploit identified at time of analysis, though the AV:A/PR:N vector means any adjacent attacker can trigger the condition without authentication during routine scanning.
Reference count underflow in the Linux kernel's USB MUSB OMAP2430 driver exposes systems built on Texas Instruments OMAP2430 SoCs to potential use-after-free conditions in kernel memory, with theoretical impact spanning privilege escalation and system crash. The flaw in omap2430_probe() calls of_node_put() on a borrowed platform device OF node that was never reference-counted by the probe function, leaving pdev->dev.of_node with an unbalanced count that can trigger premature freeing. No public exploit exists and EPSS exploitation probability stands at 0.20% (10th percentile), consistent with the extremely narrow hardware attack surface; this vulnerability is not listed in CISA KEV.
Race condition in the Linux kernel's dummy_hcd USB gadget driver corrupts a shared kernel request object's function pointer mid-callback, enabling a local low-privilege attacker on a multi-CPU system to redirect kernel execution and achieve privilege escalation. The vulnerable component is the FIFO fast-path in dummy_queue(), which reuses a single shared fifo_req before its completion callback has returned, allowing a concurrent CPU to overwrite the req->complete pointer while dummy_timer is actively invoking it - causing a general protection fault or page fault in kernel context. A syzkaller reproducer is documented (extid faf3a6cf579fc65591ca), but no public exploit or CISA KEV listing exists; EPSS sits at 0.18%, indicating very low observed exploitation activity.
FireWire network driver in the Linux kernel contains a linked-list boundary confusion flaw in `fwnet_frag_new()` that mishandles fragment reassembly at list edges, potentially enabling kernel memory corruption by adjacent-network attackers. Systems with the `firewire-net` module loaded are exposed to unauthenticated attackers sharing the same IEEE 1394 bus who can send crafted fragmented datagrams to trigger the defect. No public exploit exists and EPSS sits at 0.18% (7th percentile), but the CVSS 8.8 vector reflects high potential impact if type confusion against the list head leads to arbitrary kernel memory access.
Out-of-bounds kernel memory read in the Linux kernel ath6kl WiFi driver affects systems using Qualcomm Atheros AR6xxx chipsets from kernel 3.2 onward. The firmware-supplied `num_msg` field (a u8 value, range 0-255) governs a loop in `ath6kl_wmi_tx_complete_event_rx()` without any validation against the actual WMI event buffer length, enabling reads of up to 1020 bytes past the buffer boundary. An adjacent-network attacker with no privileges can potentially exploit this to leak sensitive kernel memory contents or trigger a kernel panic - neither CISA KEV listing nor public exploit code has been identified at time of analysis, and EPSS at 0.18% (7th percentile) corroborates low current exploitation activity.
Out-of-bounds kernel memory read in the Linux kernel's ath6kl WiFi driver exposes systems with Atheros AR600x chipsets to kernel memory disclosure and availability impact via a malicious adjacent-network access point. The ath6kl_wmi_connect_event_rx() function fails to validate firmware-supplied beacon_ie_len, assoc_req_len, and assoc_resp_len fields against the actual WMI event buffer size before parsing 802.11 Information Elements, allowing combined lengths of up to 765 bytes to exceed the buffer boundary and corrupt the wmi->is_wmm_enabled state flag. No public exploit has been identified and the vulnerability is not listed in CISA KEV; EPSS at 0.21% (11th percentile) reflects minimal opportunistic exploitation activity consistent with the niche hardware footprint.
Out-of-bounds read in the Linux kernel's TAS2781 ASoC audio driver firmware parser exposes systems with TAS2781 audio hardware to kernel memory disclosure and availability loss. The parser invokes strlen() on variable-length description strings read directly from a firmware image without first verifying a NUL terminator exists within the buffer, allowing a malformed firmware blob to drive pointer arithmetic past the allocated buffer boundary before downstream size checks execute. Patches have been released across multiple stable kernel branches (6.12.101, 6.6.148, 6.18.42, 7.1.6, 7.2-rc5); no public exploit or CISA KEV listing exists at time of analysis, and an EPSS score of 0.18% at the 7th percentile reflects minimal observed exploitation interest.
Out-of-bounds read in the Linux kernel's SMB/CIFS client DFS referral parser (parse_dfs_referrals) affects systems that mount SMB shares using DFS. A malicious or compromised SMB server can return a referral response whose PathConsumed value exceeds the search name length, causing later DFS path parsing to advance past the end of the buffer and leak adjacent kernel memory or crash the client. Tagged as Information Disclosure with a 9.1 CVSS; EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis.
Use-after-free in the ovpn (in-kernel OpenVPN data channel) module of the Linux kernel, present from version 6.16 onward, allows an authenticated remote VPN peer to trigger kernel memory corruption during peer cleanup. The flaw in unlock_ovpn() occurs because llist_for_each_entry() reads the next list pointer after ovpn_peer_put() may have already freed the peer structure, producing a classic UAF condition in kernel space. No public exploit code has been identified and EPSS probability is very low at 0.21% (11th percentile), though the theoretical worst-case per CVSS 3.1 is full kernel compromise (C:H/I:H/A:H).
Out-of-bounds read in the Linux kernel hwmon OCC (On-Chip Controller) driver exposes adjacent kernel memory and risks system availability on IBM POWER hardware running affected kernel versions. The poll response parser uses a static backing-array capacity as its parse boundary rather than the data_length field embedded in the firmware response, allowing a truncated OCC reply to cause the parser to read block headers or extents outside the valid response window. Vendor-released patches are available across multiple stable branches; no public exploit or CISA KEV listing exists at the time of analysis.
Race condition in the Linux kernel net/packet subsystem allows a local low-privileged attacker to re-register a fanout protocol hook after its associated network device has been unregistered, potentially corrupting kernel state and achieving privilege escalation. Affected systems are those running unpatched kernel versions prior to the stable-branch fixes across the 6.6, 6.12, 6.18, 7.1, and 7.2 release trees. No public exploit code and no CISA KEV listing exist at time of analysis, and the EPSS score of 0.21% (11th percentile) reflects low current exploitation activity.
Use-after-free in the Linux kernel RDS (Reliable Datagram Sockets) subsystem allows a local user with the ability to create unprivileged network namespaces to trigger memory corruption leading to privilege escalation. The flaw stems from rds_find_bound() performing socket lookups in a global hash table without accounting for network namespace boundaries, enabling a cross-namespace message delivery race condition where a freed rds_connection object is subsequently dereferenced. Two dangerous dereference sites have been KASAN-confirmed, including a function pointer call-through that constitutes a potential code execution primitive. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Silent data corruption in the Linux kernel's airoha NPU mailbox driver affects EN7581-based systems (Cortex-A53 without hardware DMA cache coherency) when NPU response data is read back through a CPU cache that was never invalidated. The driver's airoha_npu_send_msg() function maps buffers exclusively as DMA_TO_DEVICE, causing dma_unmap_single() to skip cache invalidation on non-coherent architectures - so CPU reads of NPU-written responses observe stale cached values rather than actual NPU output. The CVSS 7.8 score reflects high confidentiality, integrity, and availability impact for local low-privilege users; however, hardware specificity and timing sensitivity keep real-world exploitation likelihood low (EPSS 0.20%, 10th percentile), and no public exploit or CISA KEV listing exists.
Use-after-free in the Linux kernel AMD IOMMU driver allows a local low-privileged attacker on multi-CPU AMD systems to corrupt kernel memory by exploiting a logical race in `iommu_completion_wait()`. The `need_sync` flag was read locklessly, enabling a CPU to return without waiting for hardware IOMMU command completion while another CPU's page-table pages are freed - leaving the IOMMU walking stale, potentially freed memory. No public exploit exists and EPSS is 0.20% (10th percentile), but successful exploitation on AMD virtualization infrastructure could cross IOMMU isolation boundaries affecting co-tenant VMs.
Slab-out-of-bounds read and integer underflow in the Linux kernel mwifiex wifi driver's uAP event handler allow a malicious or malfunctioning Marvell WiFi device (USB/SDIO/PCIe) to leak kernel slab memory or trigger a kernel panic on a host running in AP mode. The firmware-supplied event->len field in EVENT_UAP_STA_ASSOC is never validated before being used to compute assoc_req_ies_len, enabling an attacker who controls device firmware to walk cfg80211_find_ie() past the fixed event_body buffer into adjacent slab objects, or to produce a massive size_t that copies stale kernel bytes into NL80211_CMD_NEW_STATION notifications. No active exploitation has been confirmed (not in CISA KEV) and EPSS places exploitation probability at the 6th percentile, though the CVSS 8.8 base score reflects potential for complete confidentiality and availability compromise against affected configurations.
Race condition in the Linux kernel's TIPC UDP bearer implementation allows a local low-privileged attacker to corrupt an RCU-protected peer list, triggering a kernel BUG and enabling potential privilege escalation to full system compromise. The flaw exists in the TIPC subsystem where tipc_udp_rcast_add() (running from a softirq) and cleanup_bearer() (running from a workqueue) both mutate ub->rcast.list without synchronization, and critically, TIPCv2 generic-netlink ops lack GENL_ADMIN_PERM, allowing the race to be triggered from an unprivileged user namespace. No public exploit is identified at time of analysis, and EPSS probability is very low at 0.15% (5th percentile).
Heap buffer overflow in the Linux kernel's SCTP authentication subsystem allows a local low-privileged user to corrupt kernel memory by adding more than 16 authentication chunk types to an SCTP endpoint. The capacity mismatch between sctp_auth_ep_add_chunkid()'s limit of SCTP_NUM_CHUNK_TYPES (20 entries) and the destination struct sctp_cookie's SCTP_AUTH_MAX_CHUNKS (16 entries) causes sctp_association_init() to memcpy up to 4 bytes past the auth_chunks buffer boundary. No public exploit has been identified at time of analysis and EPSS sits at the 6th percentile, but the kernel-space memory corruption potential and CVSS score of 7.3 warrant timely patching on any system where untrusted local users have shell access.
Element size miscalculation in the Linux kernel's accel/ethosu driver (Arm Ethos-U NPU) allows a local low-privileged user on hardware-equipped systems to bypass command stream validation and trigger out-of-bounds kernel memory access. Two discrete arithmetic errors - an entirely missing element size multiplier in the NHWC format path, and a shifted bitfield decode for OFM precision (bits 1:2 vs. the correct IFM bits 2:3) - cause the validator to underestimate buffer sizes for 16-, 32-, and 64-bit element widths. No public exploit code has been identified at time of analysis, and the EPSS score of 0.15% (5th percentile) reflects minimal observed exploitation activity; upstream fixes are available in Linux 7.1.6 and 7.2-rc5.
Kernel panic via integer overflow in the SCTP stream-reset path allows an unauthenticated remote peer to crash Linux systems running SCTP on interfaces with MTU exceeding 65535 bytes. sctp_process_strreset_inreq() fails to validate that the RESET_OUT_REQUEST constructed in response to a peer's RESET_IN_REQUEST would stay within SCTP_MAX_CHUNK_LEN, causing a __u16 overflow in sctp_make_strreset_req() that produces an undersized socket buffer and a fatal kernel BUG. No public exploit has been identified and EPSS is 0.17% (6th percentile), but the impact is total denial of service on affected hosts.
Linux Kernel's MCTP I3C driver leaves a dangling notifier and leaked bus objects when mctp_i3c_mod_init() encounters an error during i3c_driver_register(). Systems running Linux 6.7 through the unpatched stable branches are affected when the mctp_i3c module is loaded under specific failure conditions. No public exploit code has been identified and EPSS is 0.17%, but the theoretical impact includes kernel memory corruption via the stale notifier pointer if a subsequent I3C bus event fires against the freed module memory.
NULL pointer dereference in the Linux kernel's Intel Xe GPU SR-IOV virtual function (VF) driver allows a local user to crash the kernel during buffer object (BO) teardown. The flaw is triggered when CCS (Color Compression Surface) read/write buffers are freed after the device is unbound but while the DRM structure remains live, causing `xe_sriov_vf_ccs_rw_update_bb_addr` to dereference a NULL device pointer during process exit. CVSS rates this 7.8 (C:H/I:H/A:H) reflecting worst-case kernel-level impact, though practical exploitation is constrained by hardware and configuration prerequisites; EPSS is 0.16% (6th percentile) and no active exploitation is confirmed.
Memory corruption in the Linux kernel's AMT (Automatic Multicast Tunneling) driver stems from multiple receive and transmit paths caching skb-head pointers (ip_hdr, ipv6_hdr, eth_hdr, and AMT message headers) that are then invalidated by pull/reallocation helpers, leaving dangling pointers that are dereferenced as a use-after-free of the freed skb head. Systems acting as AMT gateways or relays that process attacker-supplied tunneled multicast packets are affected across kernels from 5.16 up to the fixed stable releases. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile), but the flaw is a network-reachable kernel UAF that could enable denial of service or, potentially, code execution.
Authentication bypass in the Linux kernel SCTP stack allows the AUTH requirement to be silently skipped: sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL. On endpoints configured to require SCTP AUTH, a remote peer can get COOKIE-ECHO (and associated control chunks) processed without the mandated authentication, either by omitting the preceding AUTH chunk or by exploiting a receive-path skb_clone() failure. The fix rechecks sctp_auth_recv_cid() and drops the chunk when authentication is required. No public exploit identified at time of analysis; EPSS is low (0.20%).
Kernel panic (denial of service) in the Linux kernel vmxnet3 driver affects VMware-hosted Linux guests receiving Geneve-encapsulated network traffic. The vmxnet3_get_hdr_len() function contains unguarded BUG_ON() assertions that assume hardware completion descriptor flags always describe outer headers; when the VMware VMXNET3 hardware signals inner-header processing of a Geneve tunnel packet via the VMXNET3_RCD_HDR_INNER_SHIFT bit, these assertions fire against the wrong protocol fields, crashing the kernel. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (6th percentile), reflecting very low current exploitation interest despite the elevated CVSS 7.5 base score.
Incomplete error-path cleanup in the Linux kernel's Intel Xe DRM GPU driver leaks kernel SVM and pagemap resources during GPU VM creation failures on systems equipped with Intel Xe-architecture hardware. The flaw, introduced when commit 9e9787414882 made xe_svm_init() unconditional without updating the matching teardown calls on the drm_gpuvm_resv_object_alloc() failure path, affects both fault-mode and non-fault-mode VMs running kernels between the introducing commit and the three stable-branch fixes. No public exploit code exists and no active exploitation is confirmed; EPSS sits at the 6th percentile, reflecting appropriately low short-term weaponization likelihood.
Integer truncation in the Linux kernel TIPC subsystem allows low-privileged local attackers - including unprivileged users leveraging user namespaces - to crash the kernel via division by zero or trigger link malfunction. Two independent netlink code paths (TIPC_NL_MEDIA_SET via tipc_udp_mtu_bad() and TIPC_NL_BEARER_SET via bearer.c:1160) accept MTU values above U16_MAX (65535) without enforcing an upper bound, causing silent truncation when the values are stored in u16 fields in tipc_link_create(). No exploit code is publicly known and the vulnerability is not listed in CISA KEV; EPSS at 0.17% (6th percentile) confirms very low observed exploitation probability.
LoongArch BPF JIT in the Linux kernel incorrectly sign-extends results of signed ALU32 division and modulo operations (off=1), leaving bits 63:32 set in JIT-compiled code while the verifier and interpreter model those bits as zero. This JIT-verifier semantic divergence affects low-privileged local users on LoongArch systems who can load BPF programs, and may be leveraged via crafted eBPF programs to violate verifier-enforced memory safety invariants, potentially enabling privilege escalation. EPSS is low at 0.19% (9th percentile), no public exploit is confirmed at time of analysis, and patches are available in Linux 7.1.6 and upstream commit dacd348b8a99.
QRTR (Qualcomm IPC Router) socket namespace isolation is completely absent in the Linux kernel, allowing a local user with low privileges to cross network namespace boundaries by invoking unshare(CLONE_NEWUSER | CLONE_NEWNET) and opening an AF_QIPCRTR socket in the resulting namespace. The attacker can then send QRTR datagrams - including control-plane messages such as QRTR_TYPE_NEW_SERVER - to QRTR services in the host or initial namespace, where those messages are indistinguishable from legitimate traffic because they appear to originate from node id 1. No public exploit has been identified at time of analysis, and EPSS probability is low at 0.20%, but the CVSS 8.8 score with scope change reflects the complete breakdown of the kernel's namespace isolation guarantee for QRTR IPC.
Buffer overflow in the Linux kernel's mlx5 network driver allows a local low-privileged attacker to crash the kernel or read out-of-bounds kernel memory when querying module EEPROM data via ethtool on systems equipped with Mellanox/NVIDIA ConnectX adapters that advertise the mcia_32dwords capability. The root cause is a struct size mismatch: mlx5_ifc_mcia_reg_bits defines only 12 dwords (48 bytes) of MCIA register storage while the hardware can return up to 32 dwords (128 bytes), causing mlx5_query_mcia() to memcpy beyond the allocated buffer. No public exploit has been identified at time of analysis and EPSS remains low at 0.18%, but the kernel BUG triggered by FORTIFY_SOURCE on patched builds confirms the overflow is reliably reproducible.
Use-after-free in the Linux kernel's RDS TCP subsystem allows a local low-privileged attacker to corrupt kernel memory during network namespace teardown, potentially achieving full privilege escalation to root. The flaw exists across multiple stable kernel branches (6.12.x before 6.12.101, 6.18.x before 6.18.42, 7.1.x before 7.1.6), with exploitation limited to systems where the RDS TCP module is loaded - a non-default configuration primarily found in Oracle RAC and HPC environments. Kernel patches have been merged across all affected stable branches; no public exploit exists and EPSS sits at 0.17%, indicating low current exploitation probability.
Kernel panic via buffer overrun in the Linux kernel's drop_monitor subsystem when reporting packet drop events on 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS. The size calculation functions net_dm_packet_report_size() and net_dm_hw_packet_report_size() under-budget SKB allocation by up to 4 bytes, failing to account for the alignment padding that nla_put_u64_64bit() inserts on affected architectures, resulting in skb_over_panic() and a full kernel crash. No public exploit is known, and EPSS at 0.20% (10th percentile) reflects low exploitation probability consistent with the architecture-specific trigger condition.
Use-after-free in the Linux kernel's BPF sockmap subsystem allows a local low-privileged attacker to corrupt kernel slab memory via a race condition in tcp_bpf_sendmsg(), potentially escalating privileges to root. The vulnerability arises because the error path in tcp_bpf_sendmsg() uses a stale msg_tx pointer to decide whether to free a shared cork object - a decision that becomes unsafe once a second thread has already freed it during the window when the socket lock is released by sk_stream_wait_memory(). No public exploit has been identified at time of analysis and EPSS is 0.18%, though KASAN telemetry in the disclosure confirms the bug was reproduced by the reporter.
Use-after-free in the Linux kernel tracing subsystem exposes kernel memory to corruption when event trigger data is freed asynchronously by a kthread while a concurrent tracepoint handler still holds a reference. Affected are Linux 6.19 and kernel versions containing commit 61d445af0a7c but lacking the fixes at b9c8a1400a3b or 79097812153b. A local attacker with sufficient privilege to configure kernel tracing triggers could exploit this race condition to achieve kernel memory corruption, potentially enabling privilege escalation. No public exploit has been identified at time of analysis, and EPSS of 0.16% (6th percentile) reflects minimal exploitation activity despite the high CVSS score.
Heap buffer overflow in the Linux kernel's Intel Xe GPU DRM driver (drm/xe/guc) corrupts kernel slab memory during device unbind, creating a local privilege escalation path on systems hosting Intel Xe/Arc discrete GPUs with compute-only DSS hardware units. The root cause is a mismatch between the steered register extarray allocation size - derived solely from the geometry DSS mask - and the fill loop, which iterates over the union of geometry and compute DSS masks, writing past the allocated region on affected hardware configurations. Vendor-released patches are available in kernel versions 6.18.44, 7.1.6, and 7.2-rc1; no public exploit code or CISA KEV listing exists at time of analysis.
Use-after-free and NULL pointer dereference vulnerabilities in the Linux kernel's amdgpu DRM driver allow a local authenticated user to corrupt kernel memory during GPU context initialization. The flaws stem from `amdgpu_ctx_init()` failing to acquire `adev->pm.stable_pstate_ctx_lock`, enabling a race between context initialization and concurrent sysfs pstate modifications, alongside a logic error where context finalization incorrectly restores pstate even when ownership has transferred to sysfs. CVSS rates this 7.8 (High), though EPSS at 0.18% (7th percentile) and absence from CISA KEV indicate no confirmed active exploitation at time of analysis.
Use-after-free in the Linux kernel's drm/xe Intel Xe GPU driver allows a local low-privileged user to trigger kernel memory corruption with potential for full system compromise (C:H/I:H/A:H). The bug arises because an imported dma-buf buffer object (BO) is created with its reservation object (resv) pointing to the exporter's dma_buf->resv before the importer acquires a reference on that dma-buf - leaving a window in which the exporter can be freed while the TTM workqueue asynchronously accesses the now-dangling pointer. Vendor-released patches are available for Linux 6.12.103, 6.18.42, and 7.1.6; no public exploit has been identified at time of analysis.
Out-of-bounds kernel memory access in the Linux drm/xe Intel GPU driver allows a local low-privileged user to read sensitive kernel memory, cause a kernel panic, or potentially corrupt kernel state. The flaw exists in the BO (buffer object) prefetch path of the Intel Xe GPU subsystem, where DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC (value -1) is incorrectly used as an array index into region_to_mem_type[], accessing memory before the array's base address. Discovered via AI-assisted static analysis confirmed by Intel Product Security; no public exploit or CISA KEV listing identified at time of analysis.
Out-of-bounds write and use-after-free in the Intel Xe GPU DRM driver (drm/xe/pt) allows a local low-privileged attacker to corrupt kernel heap memory and crash or potentially escalate privileges on systems running affected Linux kernel versions. The flaw exists in xe_pt_update_ops_init(), which fails to reset current_op, needs_svm_lock, and needs_invalidation before each pass, causing unbounded counter growth across drm_exec retry loops triggered by lock contention or OOM eviction. No public exploit code exists and EPSS is extremely low (0.18%), though the memory corruption primitive is structurally serious.
Use-after-free via refcount underflow in the Linux kernel's DRM Imagination (PowerVR) GPU driver allows a local low-privileged user to corrupt kernel memory during GPU context teardown. The drm_sched_entity_fini() function is called twice on the same scheduling entity - once via pvr_context_kill_queues and again via pvr_context_destroy_queues - triggering a refcount_t underflow exposed by commit fd177135f0e6 which added GPU entity time accounting. No public exploit identified at time of analysis, and EPSS at 0.17% (6th percentile) reflects low exploitation probability; exploitation requires hardware with an Imagination/PowerVR GPU.
Incorrect pointer arithmetic in the Linux kernel's drm/imagination (PowerVR GPU) driver exposes kernel memory to local users and can trigger availability failures. The `pvr_set_uobj_array()` function swaps the stride increments for the kernel and userspace pointers when copying object arrays, so with a larger userspace stride the kernel reads and forwards data from wrong kernel addresses (confidentiality breach), and with a smaller stride it writes copies at wrong userspace offsets (potential crash or memory corruption). Exploitation requires local, low-privileged access to a system running an affected kernel with an Imagination Technologies PowerVR GPU; no public exploit has been identified at time of analysis and EPSS is low at 0.18%.
NULL pointer dereference in the Linux kernel's drm/imagination PowerVR GPU driver allows a local attacker with low privileges to crash the kernel or potentially exploit kernel memory corruption. The vulnerability stems from pvr_vm_map() failing to acquire vm_ctx->lock before performing GPU virtual memory mapping operations, enabling a concurrent drm_gpuva_find() call to dereference a NULL pointer at kernel address offset 0x10 when map and find operations race. No public exploit code or confirmed active exploitation exists; vendor-released patches are available across multiple stable kernel branches as of Linux 6.12.101, 7.1.6, and 6.18.42.
Bounds validation is absent in the AMD KFD CRIU restore path of the Linux kernel, exposing local low-privilege users on AMD GPU systems to kernel memory disclosure and availability loss. The drm/amdkfd subsystem accepts user-controlled queue type and mqd_size values during CRIU restore without range checking, allowing crafted inputs to drive out-of-bounds kernel memory access. No public exploit has been identified, and vendor-released patches are confirmed in Linux 6.18.42 and 7.1.6.
Integer overflow in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user on systems with multi-die AMD GPUs to trigger an undersized CWSR save-area allocation that AMD firmware subsequently overruns, enabling kernel heap corruption with full confidentiality, integrity, and availability impact. Affected stable branches include all kernel versions before 6.12.101, 6.18.42, and 7.1.6, with patches released across all trees. No public exploit code or active exploitation has been identified; EPSS at 0.18% (7th percentile) reflects very low near-term exploitation probability.
Out-of-bounds read in the Linux kernel drm/virtio driver allows a malicious virtio-gpu backend to leak adjacent guest kernel memory by returning a crafted EDID response with an inflated size and extension block count. Guests running Linux 5.0 through multiple unpatched stable branches are affected wherever virtio-gpu is in use, covering the majority of QEMU/KVM-based cloud VM deployments. No public exploit code is identified at time of analysis, and EPSS at 0.21% (11th percentile) reflects the high-privilege prerequisite of backend control, though the risk is material in adversarial multi-tenant cloud environments.
Buffer overflow in the Intel i915 HDCP subsystem of the Linux kernel allows a local, low-privileged user to corrupt kernel memory with potential privilege escalation to full system compromise. The bounds check on the `data->streams[]` array write executes after the overrun has already occurred, meaning any caller who can trigger this code path can write past the array boundary before the kernel detects the violation. Discovered via AI-assisted static analysis and confirmed by Intel Product Security; no public exploit exists and EPSS probability is 0.18%, indicating no observed exploitation at time of analysis.
Use-after-unlock memory corruption in the Linux kernel's DRM/AMDGPU driver allows local low-privileged users on systems with AMD GPUs to read or corrupt kernel memory via the `amdgpu_vm_get_task_info_pasid()` function. The defect stems from a lock lifetime design flaw: a `vm` pointer obtained under XArray lock is dereferenced after `xa_unlock_irqrestore` releases that lock, leaving the pointer unprotected against concurrent modification. No public exploit code has been identified and EPSS is very low (0.20%, 10th percentile), but the CVSS-rated impact is High across Confidentiality, Integrity, and Availability, and vendor patches are available across multiple stable branches.
GPU Shared Virtual Memory (SVM) page mapping in the Linux kernel's drm/gpusvm subsystem leaks device mappings when a partial page-acquisition operation fails mid-sequence, leaving IOMMU-level mappings orphaned and unrecoverable through the normal cleanup path. Local users with GPU access on affected kernels - ranging from the introduction of drm/gpusvm through Linux 6.18 and 7.1 stable series - can trigger the condition by causing a later page in a batch to fail with -EOPNOTSUPP when ctx->allow_mixed is false, bypassing device_unmap() in __drm_gpusvm_unmap_pages(). No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, though NVD assigns a CVSS of 8.8 due to potential changed-scope impact on GPU/IOMMU mappings.
Double-free and use-after-free conditions in the Linux kernel's drm/amd/display subsystem expose systems with AMD GPU hardware to potential privilege escalation or kernel crash. The flaw resides in dm_update_crtc_state(), where the skip_modeset path releases a display stream reference without nullifying the pointer, leaving it dangling for a second release if a subsequent error - such as a color management failure - triggers the fail label. Patches are confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4); no public exploit exists and EPSS sits at 0.17% (6th percentile), but the kernel-level memory corruption class demands prioritized patching on AMD GPU deployments.
Buffer overflow in the Linux kernel's Amlogic C3 ISP driver allows a local low-privileged attacker to trigger out-of-bounds memory access via crafted camera parameter configurations, with potential for kernel memory disclosure and system crash. Affected functions c3_isp_params_awb_wt() and c3_isp_params_ae_wt() in drivers/media/platform/amlogic/c3/isp/c3-isp-params.c fail to validate zones_num against the fixed-size zone_weight array bounds (768 entries for AWB, 255 for AE). Patched upstream in kernel versions 6.18.42, 7.1.6, and 7.2-rc1; EPSS is 0.21% with no public exploit or CISA KEV listing, indicating low active exploitation pressure.
Out-of-bounds read in the Linux kernel Cedrus V4L2 stateless H.264 video decoder driver exposes kernel memory and can cause system instability when a local low-privileged user submits crafted H.264 decode requests with invalid DPB reference indices. The flaw exists in `_cedrus_write_ref_list()`, which uses userspace-supplied ref_pic_list0/ref_pic_list1 index values to index into the fixed `decode->dpb[]` array without bounds validation, accepting out-of-range sentinel values that are technically legal in the stateless H.264 API but were never guarded at the driver use site. No public exploit identified at time of analysis; EPSS of 0.20% at the 10th percentile reflects the niche hardware platform and local-only access requirement.
Race condition in the chips-media Wave5 video encoder driver of the Linux kernel corrupts the V4L2 M2M ready queue linked list, enabling local privilege escalation. The IRQ handler returns a source buffer to userspace via v4l2_m2m_buf_done before removing it from the ready queue; if userspace re-queues that buffer before start_encode cleans up the index, __list_add creates a self-referential loop that __list_del cannot resolve, poisoning kernel list pointers. A low-privileged local user on a system with Wave5 hardware can trigger kernel memory corruption, leading to a crash or potential escalation to root. No public exploit has been identified at time of analysis, and EPSS at 0.20% reflects very low near-term weaponization probability.
Buffer management failures in the Linux kernel msi2500 USB SDR driver allow a local low-privileged user to cause kernel memory corruption through improperly handled start_streaming() error paths. Five distinct failure paths in msi2500_start_streaming() - including USB disconnection, mutex interruption, USB ADC setup failure, isoc initialization failure, and CMD_START_STREAMING failure - neglect to return queued vb2 buffers to the framework before returning errors, and the worst path leaves submitted isochronous URBs with no consumer. Patched stable releases are available (6.6.148, 6.12.101, 6.18.42, 7.1.6), no public exploit exists, and EPSS is 0.18% (7th percentile), indicating low current exploitation probability.
Out-of-bounds memory access in the Linux kernel's NXP i.MX8 ISI (Image Sensing Interface) media driver enables a local low-privileged attacker to corrupt kernel memory or freeze the system, with CVSS-assessed high impact across confidentiality, integrity, and availability. The flaw stems from missing minimum-value validation on the hardware downscaling factor - the ISI supports up to 16x downscaling, but no floor check is enforced before writing values to hardware registers, resulting in invalid hardware state and a kernel-level process freeze that survives Ctrl+C. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), reflecting the hardware-specific nature of the attack surface.
Buffer leakage in the Linux kernel's pwc (Philips WebCam) driver allows a local low-privileged user to corrupt kernel memory state when start_streaming() fails along two specific error paths: USB device disconnection (-ENODEV) and signal-interrupted mutex acquisition (-ERESTARTSYS). The vb2 videobuf2 framework transfers buffer ownership to the driver before invoking start_streaming(), but the pwc driver's error paths failed to return those buffers via vb2_buffer_done(), triggering WARN_ON(owned_by_drv_count) and leaving kernel buffers in an unreturned, leaked state. No public exploit or CISA KEV entry exists; EPSS is 0.21% (11th percentile), reflecting minimal active exploitation interest, though the CVSS C:H/I:H/A:H scoring reflects the potential severity of kernel-level memory corruption.
Buffer leak in the Linux kernel's rtl2832_sdr media driver allows a local low-privileged user with access to an RTL2832-based SDR device to trigger kernel memory corruption by causing start_streaming() to fail, leaving vb2 framework buffers unreturned and firing WARN_ON(owned_by_drv_count). Affected are Linux kernels from 3.15 through multiple stable branches prior to 6.6.148, 6.12.101, 6.18.42, and 7.1.6. No public exploit has been identified at time of analysis and EPSS is 0.21% (11th percentile), but the kernel-level memory corruption potential under C:H/I:H/A:H CVSS rating indicates a realistic local privilege escalation risk for systems with SDR hardware attached.
Improper error-path cleanup in the Linux kernel STM32 DCMI driver leaves a V4L2 async notifier registered against kernel structures that may be freed or reused after a failed probe, creating a use-after-free condition. Systems running a vulnerable kernel with STM32 DCMI hardware where reset_control_assert() or reset_control_deassert() returns an error during driver initialization are susceptible to kernel memory corruption or crashes. No public exploit has been identified and EPSS sits at the 11th percentile, but CVSS rates the impact as High across confidentiality, integrity, and availability when the specific failure condition is met.
Buffer leak in the Linux kernel's sun4i-csi camera driver (Allwinner SoC Camera Sensor Interface) allows a local attacker with low-privilege access to the V4L2 camera interface to exhaust kernel memory by repeatedly triggering start_streaming() failure with an unsupported CSI format. The vb2 framework hands buffers to the driver before calling start_streaming(); when that call returns -EINVAL on the early format-validation path, those buffers are never returned via vb2_buffer_done(), leaking kernel memory and triggering WARN_ON(owned_by_drv_count). No public exploit exists and EPSS stands at 0.21% (11th percentile), indicating negligible real-world exploitation interest; the NVD-assigned C:H/I:H/A:H impact appears overstated relative to the actual error-path memory leak primitive.
Unvalidated HEVC active reference counts in the Linux kernel's V4L2 common control path allow a local low-privileged user to trigger out-of-bounds kernel memory access on systems equipped with stateless HEVC hardware decoders. Affected kernels from the introduction of stateless HEVC support (approximately 5.14) through to the patch commits fail to check that num_active_dpb_entries values fall within valid bounds before driver-specific code (Cedrus, Hantro, etc.) consumes them. No active exploitation is confirmed - EPSS stands at 0.21% (11th percentile) and the vulnerability is not listed in CISA KEV - but patched stable releases are available across all maintained kernel branches.
Memory corruption in the Linux kernel's vivid virtual video driver arises from missing vb2_is_busy() guards when toggling CROP, COMPOSE, and SCALE capability controls, exploitable by local low-privileged users in the window between VIDIOC_REQBUFS and VIDIOC_STREAMON ioctls. The affected vivid_update_format_cap/out() functions can overwrite video queue format parameters on an already-allocated buffer queue, yielding kernel-level corruption with high confidentiality, integrity, and availability impact as reflected in the CVSS 7.8 score. No public exploit identified at time of analysis; EPSS is 0.21% (11th percentile), though the issue was surfaced by the syzbot automated kernel fuzzer and confirmed by upstream maintainers.
Use-after-free in the Linux kernel ALSA MIDI sequencer subsystem enables local privilege escalation by any unprivileged user with access to /dev/snd/seq, requiring no capabilities or queue ownership. The flaw stems from a race window during queue deletion where a concurrent thread can re-open a queue timer after it has been closed but before the queue is freed, leaving a stale callback pointer that the global timer subsequently dereferences on the next tick. No public exploit has been identified and EPSS is 0.21% (11th percentile), but the attack surface is broad given how widely ALSA seq is deployed across Linux desktop and development systems.
Use-after-free in the Linux kernel ALSA timer subsystem allows a local low-privileged attacker to corrupt kernel memory by exploiting a race condition during master-slave timer instance teardown. When a master timer closes, slave callback draining is skipped, causing the slave struct to be freed while its callback executes in parallel - a classic UAF primitive with potential for local privilege escalation. EPSS is low at 0.21% (11th percentile), no KEV listing exists, and no public exploit code has been identified at time of analysis, but patched stable kernel releases are available.
Use-after-free in the Linux kernel ALSA timer subsystem allows a local unprivileged user to corrupt kernel memory and potentially escalate privileges. The flaw resides in the userspace-driven timer (utimer) path: the in-flight callback state is tracked by a single bit that cannot represent two concurrent callbacks, so racing two TRIGGER ioctls against the same utimer frees the instance while a second callback is still executing against that memory. The vulnerability is reachable by any user who can open /dev/snd/timer, including via sequencer queue timers bound to a utimer; no public exploit code has been identified and EPSS probability is low at 0.21%.
Out-of-bounds kernel heap access in the Linux kernel's ath6kl WiFi driver allows an adjacent unauthenticated attacker to trigger zero-size or integer-overflowed kernel allocations by transmitting a malformed ADDBA (Block Acknowledgment) WiFi management frame with an out-of-range window size. Affected are Linux kernel versions from the introduction of the vulnerable code in commit bdcd81707973, with patches confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, 7.2-rc5). No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) reflects low current exploitation probability despite the high CVSS score of 8.8.
Use-after-free in the Linux kernel's ath6kl WiFi driver exposes systems with Atheros WiFi hardware to potential kernel memory corruption via a timer-callback race condition. The vulnerable `aggr_reset_state()` function calls non-synchronous `timer_delete()`, leaving a window in which the `aggr_timeout` callback continues accessing `aggr_conn->rx_tid[]` and `aggr_conn->stat[]` after those structures are freed by `aggr_module_destroy()`. Vendor-released patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.42, 7.1.6, 7.2-rc5), no public exploit has been identified, and EPSS stands at 0.18%, reflecting low observed exploitation activity.
Out-of-bounds read in the Linux kernel wilc1000 WiFi driver exposes devices with Microchip ATWILC1000 chipsets to memory disclosure and potential denial of service when a rogue access point sends a malformed association response shorter than 6 bytes. The driver's wilc_parse_assoc_resp_info() function performs an integer underflow when computing IE length without first validating the frame meets the minimum fixed-header size, causing kmemdup() to attempt copying up to 65534 bytes of out-of-bounds kernel memory. No public exploit code is identified at time of analysis, and EPSS probability sits at 0.21%, though the adjacent-network vector and no-authentication requirement make this exploitable by any attacker within WiFi range acting as a rogue AP.
Double-free memory corruption in the Linux kernel's brcmfmac Broadcom WiFi PCIe driver exposes systems running kernel 5.2 and later to potential kernel heap corruption when a bus_reset event is sequentially followed by device removal. The flaw in brcmf_pcie_release_scratchbuffers() allows dma_free_coherent() to be called twice on the same DMA allocation because freed pointer fields are not NULLed - unlike the sibling release_ringbuffers() function which correctly NULLs its pointers. No public exploit code exists and EPSS exploitation probability is very low (0.21%, 11th percentile), though the high CVSS score (8.8) reflects the theoretical severity of kernel-level memory corruption if the double-free is successfully weaponized.
Use-after-free in the Linux kernel Bluetooth HCI sync subsystem allows a local low-privileged attacker to corrupt kernel memory, with potential for privilege escalation and full system compromise. The flaw is a race condition between the hci_sync async command work (holding hdev->req_lock) and Bluetooth management socket operations (add_uuid/remove_uuid, which operate under hdev->lock), enabling concurrent unsafe UUID list access confirmed by KASAN. No public exploit code exists and EPSS is 0.20% (10th percentile), but the high C/I/A CVSS impact reflects the severity of kernel-level memory corruption if the race is won.
Mutex unlock imbalance in the Linux kernel's Nitro Security Module (NSM) ioctl handler allows a local process to corrupt kernel locking state by supplying an invalid user pointer to NSM_IOCTL_RAW. The `nsm_dev_ioctl()` function's pre-lock `copy_from_user()` failure path incorrectly reaches the shared `out` label, which unconditionally calls `mutex_unlock()` on a mutex that was never acquired - triggering a bad-unlock-balance condition confirmed by Lockdep. Systems running AWS Nitro Enclaves on affected kernel versions are exposed; no public weaponized exploit exists but a functional PoC triggering the Lockdep warning is documented in the upstream commit itself, and EPSS sits at 0.20% (10th percentile), indicating no widespread exploitation observed to date.
Use-after-unload code execution in the Linux kernel's NSM (Nitro Security Module) misc device allows a local attacker with low privileges to call into freed kernel module text, potentially achieving full kernel compromise. The NSM driver fails to set nsm_dev_fops.owner to THIS_MODULE, meaning misc_open() never increments the module reference count when /dev/nsm is opened. When the nsm module is subsequently unloaded while a file descriptor remains open, a later ioctl through that descriptor jumps into unmapped or reallocated memory. No public exploit code or CISA KEV listing exists, and EPSS sits at 0.20% (10th percentile), reflecting limited real-world exploitation risk at this time.
Use-after-free in the Linux kernel tracing subsystem's enable_event trigger mechanism allows a local attacker to dereference freed module memory by racing module unloading against an active tracepoint trigger. Affected kernel versions span from commit 61d445af0a7c70018111919e47beaaee15653f2f up to the fix commits on stable branches; patched releases 7.1.6 and 7.2-rc5 are available. No public exploit is identified and EPSS is 0.19% (9th percentile), but the CVSS-rated impact is full compromise of confidentiality, integrity, and availability at the kernel level.
Premature device-live marking in the Linux kernel ublk subsystem causes stranded block I/O requests and indefinite fsync hangs on ext4 filesystems. The flaw exists in ublk's user-recovery state machine: if a ublk daemon sends END_USER_RECOVERY after START_USER_RECOVERY fails (e.g., with -EBUSY) and the error is silently ignored, a stale edge-triggered completion latch from a prior recovery cycle satisfies the kernel's readiness wait prematurely, marking the device LIVE while I/O cancellation flags are still set. Any local low-privileged user able to control or interact with a ublk server process can trigger this race, causing persistent uninterruptible-sleep hangs across all fsync calls and blocking kernel teardown - confirmed by a real report of lost PREFLUSH with ext4 on ublk after daemon crash recovery. No public exploit code and no KEV listing have been identified at time of analysis.
Kernel panic and unauthorized physical memory access are possible on arm64 Linux systems when huge_ptep_get() receives an unaligned virtual address during contiguous huge page table walks. On arm64 platforms configured with 16K page size - where CONT_PTES differs from CONT_PMDS - the kernel's find_num_contig() routine misidentifies a contpmd block as a contpte block, iterates past the valid PTE table boundary, and dereferences a garbage linear-map pointer, either crashing the kernel or touching physical memory not owned by the calling process. No active exploitation (KEV) or public proof-of-concept has been identified; EPSS is 0.20% at the 10th percentile, reflecting very low real-world exploitation probability.
Use-after-free in the Linux kernel's MPTCP (Multipath TCP) subflow teardown path allows a stale skb->sk pointer to survive after a subflow socket is freed, leading to a kernel warning in inet_sock_destruct() and a use-after-free in mptcp_backlog_purge(). The flaw affects Linux 6.19 and is fixed in 7.1.6 and 7.2-rc5; it is a race condition between subflow close and concurrent softirq RX backlog processing. There is no public exploit identified at time of analysis, and EPSS estimates exploitation probability at just 0.19% (9th percentile).
Memory corruption in the Linux kernel's mm/page_vma_mapped subsystem allows a local low-privileged attacker to trigger kernel memory corruption, potentially leading to privilege escalation or system crash. The flaw stems from incomplete handling of device-private PMD entries in the rmap walk code: when PVMW_MIGRATION is set, the caller incorrectly interprets a device-private PMD entry as a migration entry, producing undefined behavior. No public exploit has been identified at time of analysis, and EPSS at 0.20% (10th percentile) indicates low current exploitation interest, but the high CVSS 7.8 with full C/I/A impact reflects the severity of kernel memory corruption.
Use-after-free in the Linux kernel SCTP subsystem exposes a race condition during network namespace teardown, enabling a local low-privileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw stems from a lifecycle misalignment between per-net SCTP sysctl registration and the SCTP control socket: an open sysctl file descriptor targeting a network namespace can survive into teardown, causing proc_sctp_do_auth() to dereference an already-freed control socket. No public exploit has been identified at time of analysis; EPSS is 0.21% (11th percentile), consistent with the timing complexity required for successful exploitation.
Improper resource teardown in the Linux kernel's SCTP subsystem leaves per-net UDP tunnel sockets installed when a network namespace is destroyed, creating a use-after-free/dangling-socket condition once the control socket is released. The flaw affects systems where SCTP UDP encapsulation (net.sctp.udp_port) has been enabled inside a namespace before that namespace exits. There is no public exploit identified at time of analysis, EPSS is low (0.20%), and the issue is not in CISA KEV; the fix has already been merged to multiple stable trees. Note: the supplied 9.8/AV:N CVSS is inconsistent with the local, namespace-scoped nature of the actual defect.
Pre-authentication out-of-bounds kernel memory read in the Linux kernel's CephFS client (ceph_handle_caps) allows a malicious or compromised Ceph Metadata Server (MDS) to read beyond the message front buffer. By sending a CEPH_CAP_OP_IMPORT caps message with hdr.version set to 1 and an oversized snap_trace_len (e.g. 0xFFFFFFFF), the server bypasses all version-gated decoders and drives ceph_update_snap_trace() to decode a fake snap realm past the buffer, cascading into further OOB reads via attacker-controlled num_snaps/num_prior_parent_snaps counts. The flaw is present in every kernel since ceph_handle_caps() was introduced; it carries a CVSS 9.8 but currently has no public exploit and a low EPSS score (0.22%), and it is not on CISA KEV.
Stack out-of-bounds write in the Linux kernel's libceph client (net/ceph/osdmap.c) allows a malicious or compromised Ceph monitor to corrupt kernel stack memory on any client that mounts cephfs or maps RBD storage. The __decode_pg_temp() and __decode_pg_upmap_items() helpers accepted an attacker-controlled OSD-set length without bounding it to CEPH_PG_MAX_SIZE (32), so an oversized pg_temp/pg_upmap entry in an OSDMap is copied into the fixed-size on-stack ceph_osds.osds[32] array, triggering a KASAN-confirmed stack overflow that can panic the kernel and potentially enable privilege escalation. No public exploit identified at time of analysis; EPSS is low (0.20%) and it is not on the CISA KEV list.
Out-of-bounds memory read in the Linux kernel's in-kernel Ceph client (libceph) allows a malicious or compromised Ceph monitor/OSD to crash or potentially leak kernel memory from any host mounting CephFS or RBD. The flaw lives in decode_new_up_state_weight() when parsing a CEPH_MSG_OSD_MAP message: an attacker-controlled length field feeds a multiplication used for a bounds check, and the overflow makes the check pass so the decoder reads past the buffer. EPSS is low (0.20%, 10th percentile) with no public exploit identified at time of analysis; the CVSS 9.8 appears inflated for what is fundamentally an OOB read reachable only from the Ceph messaging path.
Null pointer dereference in the Linux kernel's libceph client crashes affected hosts processing malformed CRUSH map data from a Ceph cluster. Specifically, get_immediate_parent() during localized read selection fails to validate that a parent bucket's type has a corresponding entry in type_names before dereferencing type_cn, which may be NULL when the CRUSH map contains an incomplete hierarchy. Any Linux host acting as a Ceph client - including Kubernetes nodes with Ceph-backed persistent volumes and OpenStack compute nodes - is vulnerable to a kernel panic triggerable by a party controlling or compromising the upstream Ceph cluster. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.20% (10th percentile), but the network-accessible crash path and the wide deployment of Ceph in enterprise environments make patching a practical priority.
Use-after-free in the Linux kernel's libceph (Ceph client) authentication code lets a stale pointer to a freed ceph_buffer be transmitted during a msgr1 reconnect, triggering a KASAN slab-use-after-free in _copy_from_iter() as tcp_sendmsg() copies the authorizer. The flaw affects hosts acting as Ceph clients (RBD, CephFS, rados) and can crash the client kernel and potentially leak freed slab memory over the wire. It is patched upstream; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Kernel panic via crafted zero-monitor Ceph monmap in Linux libceph allows a network-reachable attacker to crash systems running the Ceph client. The libceph subsystem's ceph_monmap_decode() function fails to reject CEPH_MSG_MON_MAP messages advertising zero monitors - a logically impossible state, since no live monitor could emit such a map - accepting the corrupted payload as valid. Subsequent session establishment in __open_session() calls pick_new_mon(), where the hardcoded assertion BUG_ON(monc->monmap->num_mon < 1) triggers an immediate kernel panic. With EPSS at 0.20% (10th percentile) and no CISA KEV listing, large-scale exploitation is not currently observed, but the unauthenticated network-reachable CVSS vector makes this relevant for any environment running Ceph-attached Linux hosts.
Out-of-bounds memory access in the Linux kernel's libceph client (crush_decode) lets a malformed CRUSH map drive the CRUSH mapper into indexing the OSD weight array with a negative value. Because bucket type 0 is reserved for leaf devices, a bucket wrongly decoded with type 0 causes a negative bucket ID to be treated as a device and passed to is_out(), yielding an out-of-bounds read that can leak kernel memory or crash the host. Exploitation requires the kernel Ceph client to process the crafted map (i.e., connection to a malicious or compromised Ceph cluster); there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Use-after-free race condition in the Linux kernel's libceph subsystem allows a local low-privileged user to corrupt kernel memory during Ceph client teardown. The flaw exists because `ceph_destroy_client()` frees `monc->monmap` via `ceph_monc_stop()` before removing the associated debugfs entries, enabling a concurrent reader of `/sys/kernel/debug/ceph/*/monmap` to invoke `monmap_show()` on freed memory. No public exploit or CISA KEV listing exists; EPSS of 0.17% (6th percentile) confirms this remains unexploited in the wild, but the theoretical impact is kernel memory corruption or crash on any Ceph-connected Linux host.
Use-after-free in the Linux kernel's AMT (Automatic Multicast Tunneling) driver allows a local attacker to trigger kernel memory corruption or a system crash through a race condition introduced during AMT device removal. The flaw arises because amt_dev_stop() uses cancel_delayed_work_sync() to cancel req_wq and discovery_wq, but event_wq can re-schedule req_wq after that cancellation completes yet before the netdev is freed - leaving delayed work items that dereference the already-released amt_dev structure. Upstream patches are confirmed available in stable kernel releases 6.12.101, 6.18.42, and 7.1.6; no public exploit has been identified at time of analysis.
ACL cache state corruption in the Linux kernel's FUSE filesystem driver allows a local low-privileged attacker to receive stale POSIX ACL values from get_acl(), potentially bypassing access controls on files. The flaw resides in forget_cached_acl(), which can silently overwrite the ACL_DONT_CACHE sentinel for FUSE mounts where the userspace server has not negotiated FUSE_POSIX_ACL, re-enabling caching that the filesystem explicitly opted out of. No public exploit exists and EPSS sits at 0.18% (7th percentile), but the CVSS 8.4 score reflects high confidentiality and integrity impact from ACL policy bypass under specific FUSE configurations.
Use-after-free in the Linux kernel fscrypt subsystem's `find_or_insert_direct_key()` function allows a low-privileged local attacker to potentially read sensitive kernel memory, corrupt data structures, or crash the system. The global `fscrypt_direct_keys` hash table-used exclusively by the legacy v1 encryption policy path with `FSCRYPT_POLICY_FLAG_DIRECT_KEY`-matched cached master-key entries by cryptographic material without comparing the `super_block` pointer, enabling inodes from distinct filesystems to share a single `fscrypt_direct_key` and extend its lifetime past superblock teardown. No public exploit is identified at time of analysis, and EPSS stands at 0.12% (2nd percentile), indicating negligible observed exploitation activity.