Linux
Monthly
Use-after-free in the Linux kernel fscrypt subsystem allows a local low-privileged user to potentially escalate privileges or corrupt kernel memory on systems running f2fs with inline encryption. The flaw surfaces in fscrypt_destroy_inline_crypt_key() during inode eviction under direct memory reclaim: when the dynamic heap allocation inside fscrypt_get_devices() fails under memory pressure, the function skips the mandatory blk_crypto_evict_key() call and immediately frees the blk_crypto_key structure while block device drivers still hold references to it. No public exploit code exists and EPSS is 0.18% (7th percentile), but the underlying kernel use-after-free primitive carries serious privilege-escalation potential on affected configurations; patches are available across multiple stable branches.
Out-of-bounds kernel heap write in the Linux kernel iomap subsystem allows a local unprivileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw resides in ifs_set_range_dirty() and ifs_set_range_uptodate(), where an unsigned integer underflow on a zero-length range argument produces a near-SIZE_MAX block count, causing bitmap_set() to write arbitrarily far beyond the ifs->state allocation. The reachable code path through __iomap_write_end() requires no special configuration and affects all iomap-backed filesystems (ext4, XFS, etc.). EPSS is low at 0.18% (7th percentile), no KEV listing, and no public exploit has been identified; however, the C:H/I:H/A:H CVSS impact profile reflects the severity of uncontrolled kernel heap corruption.
Use-after-free in the Linux kernel's Phonet PEP (Pipe End Point) receive path lets an attacker trigger memory corruption via crafted Phonet packets. In pep_get_sb(), a call to pskb_may_pull() can reallocate the skb data buffer, but the code keeps dereferencing the now-stale header pointer, producing a slab use-after-free read confirmed under KASAN. The flaw affects kernels from 2.6.28 through the fixed stable releases and is tagged as an information-disclosure issue; no public exploit identified at time of analysis and it is not listed in CISA KEV, with a low EPSS score (0.18%).
Race condition in the Linux kernel's SLIP (Serial Line Internet Protocol) driver allows a local attacker with low privileges to trigger an out-of-bounds write or use-after-free in kernel memory, potentially enabling privilege escalation. The `slip_receive_buf()` callback reads and writes the receive buffer `rbuff` without holding `sl->lock`, while `sl_realloc_bufs()` replaces that buffer under the lock during MTU changes - creating a classic TOCTOU window where an MTU shrink can cause writes beyond the new smaller buffer or into a freed allocation. No confirmed active exploitation exists (not in CISA KEV) and the EPSS score of 0.18% places this in the 7th percentile, though kernel memory corruption of this class carries inherent privilege escalation potential.
Cross-namespace privilege escalation in the Linux kernel GENEVE tunnel driver allows a locally authenticated attacker holding CAP_NET_ADMIN in a device network namespace to reconfigure the tunnel's underlay sockets in a separate, more privileged network namespace where they hold no such capability. Affected are kernels from version 4.14 through current stable branches prior to 7.1.6, 6.18.42, 6.12.101, and 6.6.148. With the Changed scope confirmed by NVD's CVSS vector (S:C, C:H/I:H/A:H), an attacker can redirect or disrupt overlay tunnel traffic crossing namespace boundaries; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
NULL pointer dereference in the Linux kernel's af_iucv network subsystem allows a remote attacker to crash a vulnerable kernel via a crafted SYN packet under low-memory conditions, resulting in a denial of service. The flaw resides in afiucv_hs_callback_syn(), where an unconditional call to iucv_sock_kill(nsk) is made even when nsk is NULL following a failed GFP_ATOMIC socket allocation, causing an immediate kernel panic. No public exploit is identified at time of analysis, and EPSS sits at 0.18% (7th percentile), reflecting low probability of widespread exploitation; however, the mainframe-specific HiperSockets network path reduces the realistic attacker pool significantly.
Use-after-free in the Linux kernel's IUCV (Inter-User Communication Vehicle) networking subsystem exposes IBM z/VM mainframe guests to kernel memory corruption via a malicious peer. When a remote peer severs an IUCV connection, the kernel frees the iucv_path object but leaves raw, non-reference-counted pointers to it in the pending message notification queue; a subsequent recvmsg() call dereferences the freed memory, enabling heap corruption with full confidentiality, integrity, and availability impact. The vulnerability has existed since kernel 2.6.24, carries no public exploit code, and has not been added to CISA KEV, with EPSS at 0.18% reflecting its narrow IBM mainframe deployment scope.
Use-after-free in the Linux kernel net/sched subsystem allows local, low-privileged attackers to corrupt kernel heap memory or escalate privileges by racing concurrent RTM_NEWTFILTER netlink requests against an unprotected global rate-table list. The flaw arises because cls_flower's TCF_PROTO_OPS_DOIT_UNLOCKED flag causes tcf_police_init() to call qdisc_get_rtab()/qdisc_put_rtab() without the RTNL mutex, exposing the process-global qdisc_rtab_list and a non-atomic refcnt to concurrent mutation across CPUs. EPSS is low at 0.16% (6th percentile) and the vulnerability does not appear in CISA KEV, but the kernel-level use-after-free impact and the system-wide scope of the corrupted object demand prompt patching.
Local kernel memory corruption in the Linux net/x25 subsystem allows an attacker to trigger a slab-use-after-free in x25_kill_by_neigh() by racing a neighbour (X.25 link) teardown against a socket close. The function drops x25_list_lock before calling lock_sock() without holding a socket reference, so a concurrent x25_release() can free the struct sock/x25_sock that the teardown path then dereferences, leading to a crash or potential privilege escalation. No public exploit identified at time of analysis; a KASAN reproducer under QEMU confirmed the flaw, and EPSS exploitation probability is very low (0.18%).
Kernel panic (denial of service) in the Linux kernel networking GRO path affects systems that forward or aggregate traffic. skb_gro_receive_list() is missing the NAPI_GRO_CB(skb)->flush validation that skb_gro_receive() already has, so flush-marked, already-aggregated frag_list packets get re-aggregated, corrupting the frag_list chain; a later skb_segment() on the TX path then dereferences a NULL/corrupted pointer and crashes the kernel. No public exploit identified at time of analysis and EPSS is low (0.18%), but a stable patch is available. Despite the NVD CVSS of 9.8, the described impact is availability-only (crash), not code execution.
Missing hardware facility validation in the Linux kernel's ptp_s390 driver exposes IBM System z (s390x) mainframes to potential kernel crashes and hardware register state disclosure when the driver registers the physical clock without confirming that Facility 28 is installed and that PTFF QPT is available. The vulnerability affects kernel versions from commit 2d7de7a3010d713fb89b7ba99e6fdc14475ad106 through the respective fix commits across multiple stable branches, with patched releases at 6.18.42, 7.1.6, and 7.2-rc5. No public exploit has been identified and EPSS probability stands at 0.17%, consistent with the niche IBM mainframe hardware dependency that sharply constrains the exploitable population.
Kernel crash via assertion failure in the RBD (RADOS Block Device) subsystem of the Linux kernel allows a denial-of-service condition when a crafted or corrupted OSD reply message with a positive result code is received during an object map update. Affected kernels from 5.3 onward lack the positive-result-code reset in `rbd_object_map_callback()` that already exists in `rbd_osd_req_callback()`, causing `rbd_assert(*result < 0)` in `__rbd_obj_handle_request()` to trigger and crash the kernel. No public exploit has been identified at time of analysis, and EPSS stands at 0.18% (7th percentile), indicating low observed exploitation probability.
Permanent network Rx queue stall in the Linux kernel GVE (Google Virtual Ethernet) driver allows denial of service under extreme memory pressure conditions affecting Google Cloud VM instances. When page allocations fail during the Rx buffer refill loop, posted buffers can drop below the 32-descriptor threshold, causing the device to drop incoming packets; because no Rx completions are generated, NAPI is never rescheduled, creating a self-reinforcing deadlock that persists even after memory is freed. No public exploit has been identified and EPSS is 0.18% (7th percentile), but the availability impact is total network loss for the affected VM - the assigned CVSS 7.5 reflects the severity of that outcome, not ease of triggering it.
Out-of-bounds bitmap write in the Linux kernel's Intel ICE SR-IOV driver allows a malicious Virtual Function guest to crash the host kernel or potentially escalate privileges to the host. The vulnerable function ice_parser_profile_init unconditionally passes caller-controlled ptype values from VIRTCHNL_OP_ADD_RSS_CFG into set_bit() against a statically sized 1024-bit bitmap, permitting a value such as 0xffff to write beyond the bitmap boundary and trigger a kernel NULL pointer dereference. No public exploit code has been identified and EPSS exploitation probability is low at 0.18%, but the CVSS 8.8 score and confirmed crash reproducibility signal real urgency for SR-IOV multi-tenant environments where stable-branch patches are already available.
Slab use-after-free in the Linux kernel's ILA (Identifier Locator Addressing) IPv6 module allows a remote attacker to trigger memory corruption by sending crafted IPv6 packets through a configured ILA csum-adjust-transport route or receive-side mapping. The flaw stems from ila_csum_adjust_transport() and ila_update_ipv6_locator() caching a stale IPv6 header pointer across a pskb_may_pull() call that can reallocate the skb head, leading to reads and a locator write through freed memory. No public exploit is identified at time of analysis, and EPSS exploitation probability is low (0.18%); the issue is patched upstream.
Integer underflow in the Linux kernel mac802154 link-layer security subsystem allows any unauthenticated IEEE 802.15.4 peer within radio range to corrupt kernel memory by transmitting a crafted secured frame with a payload shorter than the AEAD authentication tag. The flaw in llsec_do_decrypt_auth() causes an unsigned integer wraparound that passes an approximately 4 GiB associated-data length to the crypto subsystem, driving the AEAD scatterwalk far beyond the actual frame buffer and producing a general-protection-fault or exploitable kernel memory corruption. No public exploit is identified at time of analysis and EPSS is very low at 0.21%, but full kernel-level impact (C:H/I:H/A:H) is rated given confirmed KASAN reproduction; real-world exposure is constrained to embedded Linux deployments with 802.15.4 hardware and LLSEC explicitly configured.
Kernel heap out-of-bounds write in the Linux MCTP serial driver (drivers/net/mctp/mctp-serial.c) lets an attacker on the serial/tty channel corrupt memory adjacent to the netdev private area on any host where an mctpserialN interface has been configured. The receive state machine accepts a zero-length frame, sets rxlen=0, and enters STATE_DATA, so the 'rxpos == rxlen' terminator never fires and every subsequent inbound byte becomes a 1-byte attacker-controlled OOB heap write past the fixed 74-byte rxbuf, continuing effectively unbounded until a frame or escape byte resets the parser. No public exploit is identified at time of analysis and EPSS is low (0.19%), but the flaw was reproduced with KASAN/UBSAN and carries high memory-corruption impact.
Length-underflow in the Linux kernel's Open vSwitch (openvswitch) datapath lets a truncation delta be reused across GSO segments, so a segment can reach queue_userspace_packet() with a stored cutlen larger than skb->len and pass an underflowed length to skb_zerocopy(). The affected code is the OVS_ACTION_ATTR_TRUNC (packet truncate) path feeding userspace upcalls, and the flaw is tagged Information Disclosure, consistent with an out-of-bounds copy of adjacent kernel memory into the userspace listener (and/or a kernel crash). It is fixed in stable kernels 6.6.148, 6.12.101, 6.18.42 and 7.1.6; there is no public exploit identified at time of analysis and EPSS is low (0.18%).
Memory corruption in the Linux kernel PPPoE driver allows a local low-privilege attacker to write six bytes through a stale pointer into freed kernel memory, with potential for privilege escalation to root. The flaw exists in pppoe_sendmsg(), which saves a direct pointer to the PPPoE header before calling dev_hard_header() - a callback that may reallocate the socket buffer head, invalidating the saved pointer. This vulnerability is not confirmed actively exploited (not in CISA KEV), no public exploit is known, and EPSS stands at 0.18% (7th percentile); however, patches are available across multiple stable kernel series.
TX hang vulnerability in the Linux kernel rtase driver allows denial of service by causing the Realtek RTASE hardware packet parser to stall when it encounters incomplete IPv4, IPv6, TCP, or UDP transport headers, or undersized UDP packets on PTP ports 319/320. Systems running kernels from commit d6e882b89fdf80be0ab4f914ec10f75215e49495 through the respective patched releases and equipped with Realtek RTASE network hardware are affected. No public exploit has been identified at time of analysis, and EPSS at 0.17% (6th percentile) indicates extremely low real-world exploitation probability.
Uninitialized kernel memory disclosure via TCP-AO padding bytes affects Linux kernels since v6.7 (commit decde2586b34). When constructing standalone TCP responses - ACKs and RSTs - with TCP Authentication Option (TCP-AO) enabled, one to three alignment padding bytes following a non-four-byte-aligned MAC are left uninitialized and transmitted on the wire, leaking small amounts of kernel memory to on-path observers. No public exploit exists and EPSS is 0.17% (6th percentile), making this low-urgency despite the vendor-assigned CVSS 7.5 score; the C:H rating is likely overstated given the 1-3 byte disclosure boundary.
TCP connection disruption in the Linux kernel exposes systems handling SYN-RECEIVED state connections to blind RST injection attacks that bypass RFC 5961 and RFC 9293 challenge ACK protections. The tcp_check_req() function accepts in-window RST segments with non-exact sequence numbers, allowing a remote unauthenticated attacker to abort half-open connections without meeting the exact SEQ match requirement mandated by RFC 9293 section 3.10.7.4. Exploitation probability remains low (EPSS 0.17%, 6th percentile) and no public exploit or KEV listing has been identified, though the CVSS 8.2 score reflects the ease of network access (AV:N/AC:L/PR:N) combined with a high availability impact from connection disruption.
Use-after-free in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem lets a local actor trigger a write to freed slab memory via the accept() error path of tipc_sk_create(). When socket insertion into the per-netns rhashtable fails, sock->sk is left dangling instead of NULLed, so tipc_release() bypasses its own NULL guard and calls lock_sock() on the freed sk. It affects kernels using the AF_TIPC protocol across many stable branches (fixes backported to 5.4.x through 6.18.x and mainline 7.x); there is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS of 0.18%.
Source list corruption in the Linux kernel's VXLAN Multicast Database (MDB) subsystem can be triggered by a local low-privileged user during a failed MDB remote entry replace operation, silently corrupting multicast forwarding state across affected kernel branches. The logic flaw in vxlan_mdb_remote_srcs_add() incorrectly tears down pre-existing (S,G) source entries during an error rollback, rather than restricting the rollback to entries added during the current failed call. EXCLUDE-mode multicast filters subsequently forward traffic that should be blocked, and INCLUDE-mode filters drop traffic that should be forwarded; no public exploit is identified at time of analysis.
Integer overflow in the Linux kernel's drm/amdgpu VCE (Video Codec Engine) driver enables local low-privileged users on systems with AMD GPU hardware to corrupt GPU memory. Crafted VCE command streams containing extreme image dimensions such as 65536×65536 pixels trigger a 32-bit arithmetic overflow, collapsing the computed buffer size to zero, which bypasses bounds validation and permits the GPU firmware to perform out-of-bounds memory access with scope-change implications rated CVSS 8.8. No public exploit code has been identified and EPSS stands at 0.18% (7th percentile), indicating low real-world exploitation activity; the high score reflects the full-impact scope change to GPU firmware memory rather than immediate internet-facing risk.
Time-of-check to time-of-use (TOCTOU) race condition in the Linux kernel's AMDGPU VCN4 video encoder driver allows a local low-privileged user with GPU device access to corrupt the IB (Indirect Buffer) parameter length between driver reads, potentially achieving out-of-bounds kernel memory access. Affected systems must run AMD RDNA3-class GPU hardware; the official CVSS 3.1 score of 8.8 with scope change (S:C) and High C/I/A ratings implies a local privilege escalation path to kernel level. No public exploit code has been identified and EPSS is 0.17% (6th percentile), indicating low real-world exploitation activity despite the high theoretical severity.
Division by zero in the Linux kernel's amdgpu DRM subsystem (drm/amdgpu UVD driver) allows a local attacker with access to AMD GPU render nodes to crash the kernel or potentially escalate privileges by submitting H264 video decode requests with frame dimensions below 16 pixels. Affected stable branches span kernel versions prior to 6.6.148, 6.12.101, 6.18.42, and 7.1.6, all of which now have upstream patches committed. No public exploit code and no CISA KEV listing have been identified; EPSS at 0.17% (6th percentile) indicates negligible near-term automated exploitation probability.
Use-after-free in the Linux kernel's drm/amdgpu driver arises from freeing the ACP (Audio CoProcessor) generic power domain memory before unregistering it from the kernel's global power domain list via pm_genpd_remove(), leaving a dangling pointer in that list. Systems running a vulnerable kernel with AMD GPU hardware present are exposed to a local privilege escalation path - an attacker with low-privileged local access could trigger kernel memory corruption during driver teardown. No public exploit code exists and EPSS is 0.17% (6th percentile), but the CVSS 7.8 score reflects potential for full system compromise if exploited.
Doorbell mapping corruption in the Linux kernel amdgpu DRM driver allows a local low-privileged user with AMD GPU access to overwrite another queue's doorbell entry by creating a second user-queue sharing the same Buffer Object handle and offset. The root cause is use of `xa_store_irq()`, which permits silent overwrites in the XArray, replaced by the patch with `xa_insert_irq()`. Consequences include fence IRQ misrouting to wrong queues and destructive cleanup that erases a live queue's mapping, yielding high integrity and availability impact. No public exploit code exists and EPSS is 0.15% (5th percentile), indicating negligible real-world exploitation activity.
Out-of-bounds heap read in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated network attacker to disclose approximately 1 KB of kernel heap memory at an attacker-controlled offset and potentially crash the ksmbd service or host kernel. The flaw resides in set_ntacl_dacl(), which copies ACEs from a previously stored attacker-controlled security descriptor without validating sid.num_subauth against the fixed SID_MAX_SUB_AUTHORITIES (15) array bound, enabling a crafted num_subauth value of up to 255 to drive a sub_auth[] array overread. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Kernel memory corruption via out-of-bounds ACE dedup walk in the Linux kernel's ksmbd SMB server subsystem exposes any network-reachable Linux host running ksmbd to high-impact compromise with only low-privilege SMB authentication. When set_ntacl_dacl() terminates ACE copying early due to a size-accounting overflow, set_posix_acl_entries_dacl() continues iterating using the original inflated nt_num_aces count rather than the count of ACEs actually copied, causing the dedup walk to scan into uninitialized buffer tail memory. No public exploit or CISA KEV entry exists at time of analysis, and EPSS remains low at 0.17%, but the patch is available across multiple stable kernel branches and should be applied promptly on any ksmbd-enabled deployment.
Out-of-bounds memory read in the Linux kernel's ksmbd (in-kernel SMB server) allows authenticated network attackers to trigger kernel memory disclosure via a crafted NT ACL. The flaw resides in set_ntacl_dacl(), which validates sid.num_subauth before copying an ACE but fails to verify the declared ACE size can contain all declared SID sub-authorities, permitting undersized ACEs through. The subsequent POSIX ACL deduplication walk then reads beyond the copied ACE's legitimate boundary. No active exploitation is confirmed (not in CISA KEV), and the EPSS probability is 0.17% (6th percentile), indicating low real-world exploitation activity at time of analysis.
Recursive locking deadlock in the Linux kernel audit subsystem causes a complete, unrecoverable kernel hang when a file matching an executable audit rule is renamed. Affected kernels from 4.3 through stable branches prior to 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc1 are vulnerable. Any local user able to rename a file that matches an active exe= audit rule can trigger the deadlock, forcing a hard reboot; no public exploit exists and EPSS is 0.18%, consistent with the specific preconditions required.
Resource mismanagement in the Linux kernel Wacom HID driver leaves hardware running after failed initialization, creating a potential use-after-free condition in kernel memory. Affects a broad range of stable Linux kernel branches from 4.19 through 6.8, requiring a Wacom HID device and a specific probe failure to trigger. Despite a CVSS score of 8.8, EPSS sits at 0.18% (7th percentile) and no public exploit exists; the vulnerability was discovered via static analysis, not active exploitation.
Race condition and state management bug in the Linux kernel Bluetooth HCI UART driver (hci_uart) allows an adjacent attacker with low privileges to block all future writes to a Bluetooth UART device after it is closed and reopened, with potential for kernel memory corruption via an unsafely cleared tx_skb pointer. Affected versions span multiple stable branches from 5.10.x through 6.18.x. No public exploit has been identified at time of analysis and EPSS is very low (0.17%), though the CVSS score of 8.0 with high C/I/A impact signals potential for use-after-free conditions beyond pure denial of service.
Directory-traversal / share escape in the Linux kernel's in-kernel SMB3 server (ksmbd) lets an authenticated SMB client create files, directories, or hardlinks outside the exported share. The SMB2 open lookup is correctly rooted at the share with LOOKUP_BENEATH, but ksmbd_vfs_kern_path_create() built an absolute path via convert_to_unix_name() and resolved it from AT_FDCWD, so a '..' component walked from the real filesystem root and escaped the export. It is exploited through a TOCTOU race and has no public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not in CISA KEV.
Out-of-bounds kernel memory reads in the Linux kernel's libceph client (decode_lockers() in net/ceph/cls_lock_client.c) let a malicious or compromised Ceph OSD trigger slab-out-of-bounds reads on any kernel client that issues the lock.get_info RADOS class method, such as during RBD exclusive-lock acquisition. A crafted reply with struct_len=0 causes a bare ceph_decode_32() to read 4 bytes past the validated buffer (feeding a garbage locker count into allocation), and a crafted num_lockers lets a subsequent bare ceph_decode_8() read one byte past the end, giving the OSD direct influence over the returned lock-type discriminator. There is no public exploit identified at time of analysis, and the EPSS score is low (0.20%, 10th percentile); the issue is a memory-safety information-leak/DoS rather than the remote code execution implied by the CNA's 9.8 rating.
Use-after-free in the Linux kernel ALSA driver for TASCAM US-144MKII USB audio devices allows a local low-privileged attacker to corrupt kernel memory, with potential for privilege escalation. The flaw originates in capture_urb_complete(), where redundant usb_anchor_urb() calls on every URB completion progressively corrupt the anchor's doubly-linked list and inflate the URB reference count; when usb_kill_anchored_urbs() later traverses this list during stream stop, suspend, or device disconnect, it dereferences freed memory. No public exploit or CISA KEV listing exists, and EPSS at 0.17% (6th percentile) reflects the narrow exposure created by the required TASCAM hardware dependency.
Use-after-free in the Linux kernel's Amlogic GXL crypto driver (`crypto/amlogic`) allows a local attacker to trigger memory corruption during driver probe failure, potentially enabling privilege escalation or denial of service on affected kernels (5.5 through pre-patch stable branches). The double-cleanup defect in `meson_crypto_probe()` causes `meson_free_chanlist()` to tear down already-freed per-flow resources - confirmed via KASAN slab-use-after-free in `kthread_destroy_worker()` - when `meson_allocate_chanlist()` fails after partial initialization. No public exploit identified at time of analysis; EPSS is 0.16% (6th percentile), consistent with the narrow hardware footprint and non-trivial triggering conditions.
Kernel crash vulnerability in the Linux SMB client subsystem results from a type mismatch in smb2_aead_req_alloc() where an unsigned 32-bit integer is incorrectly passed to ERR_PTR(), generating an invalid error pointer that causes a system panic upon dereference. Systems running the Linux kernel with the SMB client module (cifs) and SMBv2/v3 AEAD encryption enabled are affected across multiple stable branches, with patches available in versions 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1. No public exploit code exists and no CISA KEV listing applies; EPSS probability is extremely low at 0.16% (5th percentile), indicating this is primarily a kernel reliability fix with negligible active exploitation interest despite the high official CVSS score.
Memory corruption (double-free) in the Linux kernel's SMB/CIFS client SMB2_close replay path can be triggered when a mounted SMB server returns a replayable error and a subsequent SMB2_close_init() fails, causing the same response buffer to be freed twice. It affects Linux stable kernels across the 6.6.x through 7.x series before the fixed releases; while the CNA-assigned CVSS is 9.8 with no public exploit identified at time of analysis, real-world abuse requires the victim host to communicate with a malicious or compromised SMB server, making this primarily a client-side memory-corruption/DoS concern rather than trivial remote code execution.
Memory ordering data races in the Linux kernel's fuse-uring subsystem expose weakly-ordered architecture systems (ARM64, PowerPC, RISC-V) to kernel-level impacts when the fuse-uring ring initializes. On kernels from commit c2c9af9a through the fix, missing acquire/release semantics around ring->ready and fiq->ops allow a CPU to observe ring->ready == true while reading a stale fiq->ops function pointer table, which could trigger undefined behavior ranging from kernel crashes to potential control-flow hijacking. No public exploit has been identified and EPSS sits at 0.15% (5th percentile), indicating low near-term exploitation probability despite the High CVSS rating; no CISA KEV listing confirms active exploitation.
Race condition in the Linux kernel's ARC EMAC Ethernet driver exposes a use-after-free window during driver probe teardown on ARC processor-based embedded systems. When probe unwinds after devm_request_irq() installs the interrupt handler, stale or firmware-latched EMAC interrupt status bits can fire arc_emac_intr() concurrently with net_device deallocation, potentially corrupting kernel memory. Patched versions are available across all active stable branches (5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9, 7.0); no public exploit or CISA KEV entry exists at time of analysis.
Use-after-free race condition in the Linux kernel brcmfmac Broadcom WiFi driver enables adjacent-network attackers to corrupt kernel memory during concurrent device removal and bus_reset work execution. Affected systems include any Linux host running brcmfmac on PCIe, SDIO, or USB Broadcom chipsets - including Raspberry Pi devices - on kernel versions since 5.2 through pre-7.1.6. No public exploit or CISA KEV listing exists at time of analysis, and EPSS probability is low at 0.14% (4th percentile), though the kernel-level impact class remains high.
Use-after-free in the Linux kernel esd_usb CAN driver exposes local privilege escalation on systems using ESD CAN USB hardware. The esd_usb_disconnect() teardown sequence frees each CAN netdev (and its embedded private struct) before calling unlink_all_urbs(), which then dereferences that already-freed per-netdev memory to kill TX anchors and reset TX contexts. Found by an in-house static analysis tool with no public exploit identified at time of analysis; EPSS is 0.16% (6th percentile), consistent with a niche driver defect rather than a broadly targeted flaw.
Use-after-free in the Linux kernel's USB MIDI gadget driver (f_midi) exposes systems configured as USB MIDI gadgets to local privilege escalation or denial-of-service. The flaw stems from midi->work not being cancelled before struct f_midi is freed in f_midi_free(), allowing a concurrent ALSA rawmidi write via f_midi_in_trigger() to rearm the work item after f_midi_disable() returns but before the object is deallocated - causing f_midi_in_work() to dereference freed kernel memory. No public exploit has been identified and EPSS sits at 0.16% (5th percentile), but the CVSS 7.8 score and kernel-level impact make patching the correct priority on systems deploying USB gadget functionality.
Use-after-free and NULL pointer dereference in the Linux kernel Broadcom BDC USB Device Controller driver expose systems to local privilege escalation during device teardown. The BDC driver's teardown sequence frees DMA-coherent memory and endpoint arrays while a shared IRQ handler remains live - a structural defect introduced when the driver adopted devm_request_irq(), whose LIFO devm release order creates a window where the interrupt handler dereferences freed or NULLed kernel structures. A separately unguarded delayed_work (func_wake_notify) compounds the issue with no cancellation path anywhere in the driver, allowing post-teardown callbacks against freed memory. No public exploit exists and the vulnerability is not in CISA KEV; it was identified by in-house static analysis with EPSS at the 5th percentile (0.16%), indicating negligible current exploitation activity.
Use-after-free race condition in the Linux kernel's RDMA/rxe (SoftRoCE) subsystem allows a local unprivileged user to trigger a kernel crash or achieve page-level memory corruption. The race occurs between rxe_mmap() - which releases pending_lock while a rxe_mmap_info kref is still live - and a concurrent DESTROY_CQ ioctl that drops the kref to zero, causing vfree() to clear vmalloc PTEs mid-walk in remap_vmalloc_range_partial(). No CISA KEV listing exists and EPSS is 0.16% (5th percentile), reflecting the race's very narrow exploitation window; however, the C:H/I:H/A:H impact and confirmed upstream patch make this a priority update for any environment with RDMA/rxe loaded.
Double-free use-after-free in the Linux kernel's xfrm (IPsec) subsystem allows a low-privileged local user to corrupt kernel heap memory, potentially achieving privilege escalation. The race condition in xfrm_user_policy() between a non-atomic sk_dst_cache reset via setsockopt and the UDP fast-path's atomic xchg() reset causes both code paths to observe the same dst pointer and call dst_release() twice, freeing the xfrm_dst bundle while still in use. Critically, the description confirms this is reachable by an unprivileged user via user and network namespaces, making it exploitable on most modern Linux distributions where user namespaces are enabled by default. No public exploit exists and no KEV listing, but the KASAN-confirmed write-to-freed-memory primitive is a classic kernel privilege escalation vector.
Double reference-count release (double netdev_put()) in the Linux kernel's IPv6 XFRM/IPsec policy subsystem allows a local low-privileged user to underflow a net_device refcount, producing kernel ref_tracker warnings and 'unregister_netdevice: waiting for <dev> to become free' hangs that can destabilize or crash the system and potentially enable privilege escalation through kernel memory corruption. The flaw exists in xfrm6_fill_dst() at net/ipv6/xfrm6_policy.c: on the error path where in6_dev_get(dev) returns NULL, netdev_put() is called but xdst->u.dst.dev is not cleared, so dst_destroy() later releases the same reference a second time. No public exploit and no CISA KEV listing have been identified at time of analysis; EPSS is 0.16% (5th percentile), indicating currently low automated exploitation probability.
Slab-out-of-bounds read in the Linux kernel's ksmbd SMB2 server allows remote unauthenticated attackers to crash the kernel or leak one byte of adjacent slab memory by sending a crafted compound SMB2 request. The vulnerable path in ksmbd_smb2_check_message() reads the 2-byte StructureSize2 field at offset 64 from each compound element without first confirming the element is at least 66 bytes, so a trailing element of exactly 64 bytes causes a one-byte overread beyond the receive buffer. No exploitation has been publicly confirmed (EPSS 0.16%, 5th percentile, not in CISA KEV), but the unauthenticated network attack vector (CVSS 8.2) makes any ksmbd-exposed host a realistic DoS target. Vendor-released patches are available across all maintained stable kernel series.
Remote kernel panic in the Linux kernel's GTP (GPRS Tunneling Protocol) driver allows an unauthenticated network attacker to crash a GTP-enabled host by sending a malformed echo request packet of 16-19 bytes. The vulnerability arises because gtp1u_send_echo_resp() ignores the NULL return from skb_pull_data() on an undersized buffer, causing skb->data to be pushed below skb->head by subsequent header operations, which trips skb_under_panic() and causes an immediate kernel BUG halt. No public exploit has been identified at time of analysis and EPSS of 0.18% (8th percentile) reflects low current exploitation probability, but the unauthenticated network-triggerable DoS against mobile core infrastructure warrants prompt patching for telecom operators.
Uninitialized stack memory dereference in the Linux kernel's IPv4 nexthop subsystem (net/ipv4/nexthop.c) enables local low-privileged attackers to cause kernel panic or leak sensitive stack contents on systems built with CONFIG_INIT_STACK_NONE. Versions from 5.13 through stable branches prior to 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5 are affected. No public exploit code has been identified and EPSS stands at 0.16% (5th percentile), placing this in the low-urgency tier despite a CVSS 7.1 score driven by dual high-impact outcomes.
Double-release memory corruption in the Linux kernel's BPF TCP iterator (bpf_iter_tcp_batch) allows a local low-privileged user with BPF iterator access to trigger a kernel panic. When batch reallocation fails, the first bpf_iter_tcp_put_batch() call frees socket references and overwrites batch slots with socket cookies; if realloc then fails, the iterator's stop routine executes a second put_batch() and dereferences those cookie integer values as struct sock pointers, causing a KASAN-detected null-pointer dereference and kernel panic. No public exploit identified at time of analysis; EPSS is 0.15% (5th percentile), indicating low current automated exploitation probability.
Use-after-free in the Linux kernel mac80211 MLO (Multi-Link Operation) subsystem allows a local attacker with low privileges to corrupt kernel memory by reading stale debugfs entries after a failed ieee80211_vif_update_links() operation. Systems running kernel 6.4 or later with WiFi 7 (IEEE 802.11be) MLO-capable hardware are within the affected code path; patched releases are available across all active stable branches. No public exploit or CISA KEV listing exists and EPSS is 0.16%, but CVSS impact metrics of C:H/I:H/A:H indicate full kernel compromise potential if the vulnerability is successfully triggered, as confirmed by a KASAN slab-use-after-free trace referencing a task named 'exploit/145'.
Double-free memory corruption in the Linux kernel's mac80211 WiFi subsystem exposes systems running in WiFi 6 AP mode with FILS discovery configured to potential kernel heap corruption and privilege escalation. The flaw in ieee80211_set_fils_discovery() prematurely queues the old template for deferred freeing before confirming the new allocation succeeds; when kzalloc() fails, a stale pointer is retained and freed a second time upon AP teardown or reconfiguration. No public exploit identified at time of analysis; EPSS is 0.19% (8th percentile), consistent with the constrained exploitation prerequisites.
Double-free memory corruption in the Linux kernel's mac80211 WiFi subsystem allows a local attacker with low privileges to corrupt kernel heap memory, potentially leading to privilege escalation or denial of service. The flaw exists in ieee80211_set_unsol_bcast_probe_resp(), where kfree_rcu() is invoked on the old unsolicited broadcast probe response template before a new one is successfully allocated - if kzalloc() then fails, the stale pointer is re-queued for freeing during AP teardown or subsequent configuration updates, triggering a KASAN-detected double-free in softirq context. No public exploit exists and EPSS is extremely low (0.16%, 5th percentile), but the local PR:L CVSS vector and high C/I/A impact scores make this a meaningful kernel hardening target for multi-tenant or shared Linux environments.
Slab-out-of-bounds read in the Linux kernel btrfs free space cache loader allows a local attacker to trigger kernel memory corruption by supplying a crafted btrfs filesystem with an inflated num_entries value in the on-disk btrfs_free_space_header. All Linux kernel versions from commit 5b0e95bf607d through the patched stable releases across the 6.6, 6.12, 6.18, 7.1, and 7.2 series are affected. An attacker who can mount or cause the kernel to process such a crafted volume causes the io_ctl->index pointer to walk past the pages[] array boundary, with the overrun slot treated as a struct page and passed to crc32c(), culminating in a general protection fault with kernel code execution or information disclosure potential. No public exploit has been identified and this vulnerability is not in CISA KEV; EPSS places exploitation probability at the 5th percentile.
Kernel memory corruption in the Linux IPsec IP-TFS/AGGFRAG (xfrm iptfs) receive path allows crafted or normal traffic arriving on an IPTFS tunnel to corrupt kernel memory and panic affected hosts (introduced in Linux 6.14, fixed in 6.18.42, 7.1.6 and 7.2-rc4). Because iptfs_skb_add_frags() fails to propagate the SKBFL_SHARED_FRAG flag when copying page-pool-backed shared frags, a subsequent nested transport-mode esp_input() takes the no-COW fast path and decrypts in place over pages still referenced by the outer SKB. There is no public exploit identified at time of analysis and EPSS is low (0.15%), consistent with the narrow, non-default configuration required.
Kernel memory corruption in the Linux kernel SCTP stack allows a remote peer to trigger a use-after-free during ASCONF DEL-IP processing, corrupting an association's transport list and leaving primary_path/active_path pointing at freed memory. The flaw affects the SCTP dynamic address reconfiguration (ASCONF) path across a wide range of kernel versions and, given kernel-level impact, can lead to denial of service and potentially privilege escalation or code execution. Despite the 9.8 CVSS and 'Information Disclosure' tag, there is no public exploit identified at time of analysis and EPSS is low (0.16%), reflecting the SCTP/ASCONF-specific conditions required.
Use-after-free in the Linux kernel rhashtable walk subsystem allows a local attacker with low privileges to dereference a stale pointer into freed slab memory, enabling kernel memory disclosure, crash, or potential privilege escalation. The defect is in rhashtable_walk_start_check(): when a hash table is freed during resize (iter->walker.tbl == NULL), the restart path clears slot and skip but omits clearing iter->p, leaving a dangling pointer that rhashtable_walk_next() then dereferences. Confirmed callers affected include netlink_diag and TIPC socket diagnostics. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.15% (5th percentile), reflecting low current exploitation activity despite real kernel memory-safety impact.
Race condition in the Linux kernel's KVM nVMX (nested VMX) subsystem allows a low-privileged local attacker to trigger a use-after-free via shadow VMCS teardown, with potential for full hypervisor compromise. The flaw arises because free_nested() releases the shadow VMCS page while vmcs01 still holds a dangling pointer; if the vCPU migrates to another physical CPU before the pointer is cleared, __loaded_vmcs_clear() executes VMCLEAR against the freed page, corrupting kernel memory. No public exploit code exists and no active exploitation is confirmed (EPSS 0.16%, 5th percentile), but the S:C scope change in the CVSS vector and the C:H/I:H/A:H impact triad indicate this could enable a guest-to-host escape under the right conditions.
Shadow MMU ordering flaw in the Linux kernel KVM x86 subsystem allows a low-privileged guest process to corrupt the hypervisor's page table state by triggering invalid root population during shadow page reclamation. Kernels from 5.9 through multiple unpatched stable branches permit child shadow pages to be created under an invalidated parent root, violating a core MMU invariant and potentially enabling guest-to-host privilege escalation. No public exploit has been identified and EPSS is low (0.16%), but the confirmed scope change to the host hypervisor makes this a high-priority patch for any KVM-based multi-tenant or cloud virtualization environment.
Local privilege-escalation/denial-of-service in the Linux kernel's POSIX CPU timers subsystem arises from a use-after-free triggered by a race between sys_timer_delete() and a non-leader exec(). When de_thread() switches the thread-group leader and releases the old leader, posix_cpu_timer_del() can observe the stale leader with a now-NULL sighand, return without unqueueing an armed TGID-targeted timer, and free the underlying k_itimer while its timerqueue node remains enqueued in p->signal - leaving run_posix_cpu_timers() and other timer add/delete operations to dereference freed memory. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; a vendor patch is available in stable releases.
Local information disclosure in the Linux kernel s390 protected-key (pkey) subsystem affects IBM Z (s390x) mainframe systems where the PKEY_VERIFYPROTK ioctl fails to validate the user-supplied buffer length before processing, allowing a local low-privileged user with access to the pkey device to trigger an out-of-bounds kernel memory access. Fixed by explicitly checking the request length against the buffer size and failing when it exceeds it. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Local privilege-impacting memory corruption in the Linux kernel's s390 (IBM Z) pkey subsystem allows a low-privileged local user to trigger an out-of-bounds write through the pkey_pckmo key_to_protkey() handler, which failed to validate that generated protected-key output fits within the caller-provided target buffer. The flaw affects s390 builds of the kernel prior to the fixed stable releases and carries high confidentiality, integrity, and availability impact (CVSS 7.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Kernel memory corruption in the Linux kernel Bluetooth L2CAP stack arises from a use-after-free in l2cap_sock_new_connection_cb(), which dereferenced a child socket after release_sock(parent) had already exposed it via the accept queue, letting a racing task accept and free the socket first. Any Linux host with Bluetooth enabled and an L2CAP listening socket is affected; a Bluetooth-adjacent attacker able to trigger new connections can win the race to corrupt freed kernel memory, rated CVSS 3.1 8.8 (C:H/I:H/A:H). There is no public exploit identified at time of analysis and EPSS is low at 0.16%, indicating a proactively fixed memory-safety bug rather than one under active attack.
Local privilege escalation potential via memory corruption in the Linux kernel's perf/core subsystem, where perf_event_remove_on_exec() fails to detach group relationships when removing a group-leader event during exec. On affected kernels, a local user who can open perf events can corrupt the PMU context active list through a double list_add, undermining kernel memory integrity (CVSS 7.8, C:H/I:H/A:H). EPSS is low at 0.16% (5th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
Guest-to-host state corruption in the Linux kernel's arm64 KVM nested-virtualization (NV) support arises because kvm_hyp_handle_mops() writes an untranslated synthetic CPSR value directly into hardware when rewinding single-step state after a MOPS (FEAT_MOPS memory copy/set) exception. On systems running a nested guest at virtual EL2, this bypasses the vEL2-to-hardware translation, leaving SPSR_EL2 with an invalid exception-return state that the host later consumes. The fix modifies SPSR_EL2 directly and defers resynchronization to the next full exit. There is no public exploit identified at time of analysis; EPSS is very low (0.17%, 6th percentile) and it is not in CISA KEV.
Use-after-free write in the Linux kernel's bridge netfilter IPv6 fragmentation path (br_ip6_fragment) lets an adjacent attacker corrupt kernel memory and crash the host. The flaw affects systems acting as bridges with connection-tracking (nf_conntrack_bridge) forwarding IPv6 traffic, where a stale prevhdr pointer is dereferenced after skb_checksum_help() reallocates the skb head for a cloned packet. There is no public exploit identified at time of analysis and it is not in CISA KEV; the reported KASAN trace demonstrates a reliable kernel panic (denial of service), with memory-corruption escalation theoretically possible.
Out-of-bounds kernel write in the Linux virtio-net driver's receive_big() path allows a malicious or compromised virtio backend (host/hypervisor-side device emulator) to corrupt guest kernel memory. The length validation meant to bound device-announced packet size still permits a ~20-byte gap, so a crafted len drives page_to_skb() one fragment past the page chain, writing into skb_shinfo()->frags[MAX_SKB_FRAGS] and passing a NULL frag up the receive path. There is no public exploit identified at time of analysis and EPSS is low (0.17%), but the flaw carries a high CVSS (8.4) due to kernel-level memory corruption.
Uninitialized kernel memory disclosure in the Linux kernel SCTP stack allows a remote peer to leak stale kernel heap/stack bytes by sending a malformed ERROR chunk carrying a STALE_COOKIE cause. When an association is in the COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads a 4-byte 'Measure of Staleness' from the first cause in the chunk without verifying that the field is actually present, and echoes that value back to the peer in the Cookie Preservative of the reply INIT. It is reachable by any peer - including an unprivileged local process using a raw SCTP socket inside a user+network namespace - and there is no public exploit identified at time of analysis (EPSS 0.18%, not in CISA KEV).
Out-of-bounds read in the Qualcomm rmnet (Rmnet Multiplexing and Aggregation Protocol) driver of the Linux kernel allows a local attacker to read kernel slab memory beyond frame boundaries by injecting a short MAP frame while ingress deaggregation is disabled. The no-aggregation ingress path skipped the length validation performed on the aggregated path, so the parser dereferenced the MAP header and checksum trailer using the on-wire pkt_len without verifying skb->len. No public exploit has been identified at time of analysis, and the low EPSS score (0.18%, 7th percentile) reflects the local-only, niche-driver nature of the flaw rather than widespread mass exploitation.
Kernel memory corruption in the Linux kernel's BPF sockmap subsystem allows a local actor able to load a BPF sk_msg program to trigger an out-of-bounds write via an integer overflow in bpf_msg_push_data(). A crafted u32 'len' argument (typed ARG_ANYTHING) wraps the 'copy + len' page-allocation size to a small value, producing an undersized allocation followed by an oversized memcpy that corrupts kernel heap memory, enabling denial of service and potential privilege escalation. There is no public exploit identified at time of analysis and the EPSS score is low (0.18%), but the flaw is confirmed and patched upstream by kernel maintainers.
Out-of-bounds read in the Linux kernel's net1080 USB networking driver allows a malicious NetChip 1080 (NC1080) USB device to read slab memory past the end of a socket buffer during RX processing. In net1080_rx_fixup(), an even attacker-controlled packet_len is used to index a pad byte (skb->data[packet_len]) before it is validated against the actual frame length, so a short frame advertising a large even packet_len (e.g. 0x4000, bounded only by NC_MAX_PACKET) triggers a KASAN slab-out-of-bounds read in softirq/ksoftirqd context. This is a vendor-fixed kernel hardening bug with no public exploit identified at time of analysis; EPSS is low (0.18%) and it is not in CISA KEV.
Heap out-of-bounds read in the Linux kernel's DRM EDID parser (drm_parse_tiled_block in drivers/gpu/drm/drm_edid.c) lets a crafted DisplayID tiled-display block trigger a slab-out-of-bounds read past the exact-sized kmemdup()'d EDID buffer. The affected code casts the block to struct displayid_tiled_block and reads the fixed 22-byte layout up to topology_id[7] without validating num_bytes, so an EDID advertising a tiled block (DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for DisplayID v2.0) with an undersized payload at the end of a DisplayID extension reads out of bounds, causing kernel memory disclosure or a crash. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV; the fix is upstreamed and backported to multiple stable trees.
Denial of service in the Linux kernel XDP generic receive path allows a NULL pointer dereference and kernel panic when a bond slave interface is released while XDP redirect processing is in flight. The affected code, xdp_master_redirect() in net/core/filter.c, guards only on netif_is_bond_slave() but dereferences the master device that bond_upper_dev_unlink() has already cleared, faulting on master->flags at offset 0xb0. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; the issue is a race-window crash rather than a memory-disclosure or code-execution bug.
Local privilege escalation and kernel memory corruption in the Linux kernel's TIPC subsystem occurs because bearer_disable() frees the discoverer object (b->disc) with a plain kfree() via tipc_disc_delete(), while tipc_disc_rcv() still dereferences it in RX softirq under rcu_read_lock(); for UDP bearers the synchronize_net() grace period is deferred to a workqueue, so the object is freed with no RCU protection. The flaw is reachable from an unprivileged user namespace because the TIPCv2 generic-netlink family is netnsok and its bearer commands carry no GENL_ADMIN_PERM, requiring only that the kernel be built with CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP. No public exploit is identified at time of analysis and EPSS is low (0.17%, 6th percentile), but the KASAN-confirmed use-after-free yields a high-impact memory-corruption primitive affecting confidentiality, integrity and availability.
Use-after-free in the Linux kernel's SMC-R (Shared Memory Communications over RDMA) subsystem allows a race between the CDC receive tasklet and socket close to operate on freed memory, enabling a kernel crash and potential memory corruption on hosts using SMC-R. The flaw lives in smc_cdc_rx_handler(), which looks up a connection under conns_lock, releases the lock, and then dereferences the socket via sock_hold() in smc_cdc_msg_recv() without holding a reference across the window. It affects only systems that have SMC-R enabled and active; there is no public exploit identified at time of analysis and EPSS is low (0.18%, 7th percentile).
Out-of-bounds kernel heap read in the Linux kernel's usbnet gl620a driver allows a malicious GeneLink (GL620A) USB link-cable device to leak adjacent slab memory into the network stack. The flaw is in genelink_rx_fixup(), which trusts a device-supplied per-packet length (bounded only by GL_MAX_PACKET_LEN of 1514 bytes) without checking it against the number of bytes actually received in the URB. Rated CVSS 8.1, it is unauthenticated (PR:N) and needs no user login, but no public exploit identified at time of analysis and EPSS is low at 0.18% (7th percentile).
Stack out-of-bounds write in the Linux kernel Bluetooth subsystem (net/bluetooth/eir.c) lets a local privileged user corrupt kernel stack memory when an LE-only controller assembles legacy advertising data. eir_create_adv_data() prepends a 3-byte 'Flags' AD structure to a fixed 31-byte buffer without accounting for it in the length check, so an advertising instance created with flags == 0 and a maximal adv_data_len causes a 3-byte overflow past the buffer during hci_update_adv_data_sync(). There is no public exploit identified at time of analysis and EPSS is low (0.16%), consistent with a local, capability-gated memory-corruption bug rather than a mass-exploitation target.
Out-of-bounds kernel memory reads in the Linux kernel's staging rtl8723bs Realtek Wi-Fi driver allow a malicious or spoofed access point within radio range to leak adjacent kernel memory or crash the system by sending beacon/probe-response frames carrying truncated or undersized information elements (IEs). The flaw lives in is_ap_in_tkip(), which parses IEs without bounds-checking the IE header or payload length before dereferencing WLAN_EID_VENDOR_SPECIFIC (needs length >= 16) and WLAN_EID_RSN (needs length >= 12) data. No public exploit identified at time of analysis; EPSS probability is low (0.16%, 6th percentile), and the issue is not listed in CISA KEV.
Local denial-of-service (kernel double-free/UAF) in the Linux kernel NVMe/TCP target driver (nvmet-tcp) affects hosts serving block storage over NVMe-over-TCP with data digest enabled. When a data-digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based transfer, the command is uninited but not marked complete, so queue teardown uninits it a second time, causing a double percpu_ref_put against a single get. There is no public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and the flaw is not in CISA KEV.
Denial of service (and potential use-after-free) in the Linux kernel's NVMe-over-TCP target (nvmet-tcp) subsystem allows a connected NVMe-oF initiator to trigger a refcount underflow via a crafted data-digest mismatch. When a command that previously failed nvmet_req_init() (marked NVMET_TCP_F_INIT_FAILED) hits a data digest error, nvmet_req_uninit() runs an unbalanced percpu_ref_put(), producing a percpu_ref warning, a use-after-free diagnostic, and ultimately a permanent workqueue deadlock that hangs the target. No public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile), and it is not listed in CISA KEV, so despite the 9.8 NVD score this is realistically a stability/DoS bug confined to hosts acting as NVMe-oF TCP targets with data digest enabled.
Out-of-bounds memory access in the Linux kernel's ntfs3 filesystem driver allows a crafted NTFS image to corrupt kernel memory during NTFS log replay. When log_replay() converts version 0 restart-table records (DIR_PAGE_ENTRY_32 to DIR_PAGE_ENTRY), it derives a memmove() length directly from the attacker-controlled on-disk lcns_follow field, which check_rstbl() does not bound against the entry size; an oversized value drives reads/writes past the allocated restart-table buffer. There is no public exploit identified at time of analysis and EPSS is low (0.17%), but the flaw carries CVSS 7.8 with high confidentiality, integrity, and availability impact because it executes in kernel context when a malicious volume is mounted.
Out-of-bounds heap write in the Linux kernel's ntfs3 filesystem driver allows a crafted NTFS volume to corrupt kernel memory when the journal is replayed. The flaw lives in do_action()'s UpdateRecordDataRoot and UpdateRecordDataAllocation log-replay cases (fs/ntfs3/fslog.c), where the on-disk NTFS_DE field view.data_off is used as a memmove destination offset without bounding it against the entry size, letting an attacker-controlled offset (demonstrated at 0xFFFC) push a write ~32 bytes past the NTFS_DE. There is no public exploit identified at time of analysis and EPSS risk is low (0.16%), but the CVSS 7.8 rating reflects the kernel-level memory corruption impact against any system that mounts the malicious volume.
Local privilege-boundary memory-safety flaw in the Linux kernel's Open vSwitch (openvswitch) datapath allows a local user with network-configuration capability to desynchronize the validated action stream from the one later executed. Introduced by commit a1e64addf3ff which removed the 64 KiB actions-length guard, the bug lets a generated nested action container (e.g. CLONE/CT) exceed U16_MAX and close with a truncated 16-bit nla_len, so subsequent bytes are reinterpreted as independent actions during dump or teardown. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile), and it is not in CISA KEV.
Use-after-free in the Linux kernel's net/sched cls_api when handling TC_ACT_CONSUMED in tcf_qevent_handle can allow remote code execution. The flaw is triggered if a RED qdisc is configured with a qevent early_drop and a tc filter using connection tracking (act_ct) with defragmentation enabled while receiving out-of-order fragments. No active exploitation or public PoC exists; EPSS score 0.17% indicates low exploitation probability despite a CVSS 9.8 base score.
Local privilege escalation in the Linux kernel's QAT driver allows a low-privileged local attacker to achieve full system compromise by exploiting a legacy character device interface with IOCTLs. The unused /dev/qat_adf_ctl device node increases attack surface and has been the subject of multiple bug reports. With an EPSS score of 0.24%, active exploitation is unlikely, and no public exploit code is known; the vulnerability is addressed by removing the entire character device and IOCTL infrastructure.
Out-of-bounds array read and missing initialization flaw in the Linux kernel's drm/hyperv virtual display driver affect Linux VMs running under Microsoft Hyper-V. A SYNTHVID_RESOLUTION_RESPONSE message carrying resolution_count exceeding 64 causes the guest kernel driver to walk past the end of the 64-entry supported_resolution[] array, potentially disclosing adjacent guest kernel heap memory to the Hyper-V host. A separate missing-initialization defect in the WIN10-to-WIN8 protocol fallback path leaves screen dimension fields at zero, causing drm_internal_framebuffer_create() to reject every userspace framebuffer with -EINVAL and effectively disabling virtual display. No public exploit exists and EPSS is 0.21%; exploitation of the OOB read requires host-level control over Hyper-V VMBus messaging.
Use-after-free in the Linux kernel fscrypt subsystem allows a local low-privileged user to potentially escalate privileges or corrupt kernel memory on systems running f2fs with inline encryption. The flaw surfaces in fscrypt_destroy_inline_crypt_key() during inode eviction under direct memory reclaim: when the dynamic heap allocation inside fscrypt_get_devices() fails under memory pressure, the function skips the mandatory blk_crypto_evict_key() call and immediately frees the blk_crypto_key structure while block device drivers still hold references to it. No public exploit code exists and EPSS is 0.18% (7th percentile), but the underlying kernel use-after-free primitive carries serious privilege-escalation potential on affected configurations; patches are available across multiple stable branches.
Out-of-bounds kernel heap write in the Linux kernel iomap subsystem allows a local unprivileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw resides in ifs_set_range_dirty() and ifs_set_range_uptodate(), where an unsigned integer underflow on a zero-length range argument produces a near-SIZE_MAX block count, causing bitmap_set() to write arbitrarily far beyond the ifs->state allocation. The reachable code path through __iomap_write_end() requires no special configuration and affects all iomap-backed filesystems (ext4, XFS, etc.). EPSS is low at 0.18% (7th percentile), no KEV listing, and no public exploit has been identified; however, the C:H/I:H/A:H CVSS impact profile reflects the severity of uncontrolled kernel heap corruption.
Use-after-free in the Linux kernel's Phonet PEP (Pipe End Point) receive path lets an attacker trigger memory corruption via crafted Phonet packets. In pep_get_sb(), a call to pskb_may_pull() can reallocate the skb data buffer, but the code keeps dereferencing the now-stale header pointer, producing a slab use-after-free read confirmed under KASAN. The flaw affects kernels from 2.6.28 through the fixed stable releases and is tagged as an information-disclosure issue; no public exploit identified at time of analysis and it is not listed in CISA KEV, with a low EPSS score (0.18%).
Race condition in the Linux kernel's SLIP (Serial Line Internet Protocol) driver allows a local attacker with low privileges to trigger an out-of-bounds write or use-after-free in kernel memory, potentially enabling privilege escalation. The `slip_receive_buf()` callback reads and writes the receive buffer `rbuff` without holding `sl->lock`, while `sl_realloc_bufs()` replaces that buffer under the lock during MTU changes - creating a classic TOCTOU window where an MTU shrink can cause writes beyond the new smaller buffer or into a freed allocation. No confirmed active exploitation exists (not in CISA KEV) and the EPSS score of 0.18% places this in the 7th percentile, though kernel memory corruption of this class carries inherent privilege escalation potential.
Cross-namespace privilege escalation in the Linux kernel GENEVE tunnel driver allows a locally authenticated attacker holding CAP_NET_ADMIN in a device network namespace to reconfigure the tunnel's underlay sockets in a separate, more privileged network namespace where they hold no such capability. Affected are kernels from version 4.14 through current stable branches prior to 7.1.6, 6.18.42, 6.12.101, and 6.6.148. With the Changed scope confirmed by NVD's CVSS vector (S:C, C:H/I:H/A:H), an attacker can redirect or disrupt overlay tunnel traffic crossing namespace boundaries; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
NULL pointer dereference in the Linux kernel's af_iucv network subsystem allows a remote attacker to crash a vulnerable kernel via a crafted SYN packet under low-memory conditions, resulting in a denial of service. The flaw resides in afiucv_hs_callback_syn(), where an unconditional call to iucv_sock_kill(nsk) is made even when nsk is NULL following a failed GFP_ATOMIC socket allocation, causing an immediate kernel panic. No public exploit is identified at time of analysis, and EPSS sits at 0.18% (7th percentile), reflecting low probability of widespread exploitation; however, the mainframe-specific HiperSockets network path reduces the realistic attacker pool significantly.
Use-after-free in the Linux kernel's IUCV (Inter-User Communication Vehicle) networking subsystem exposes IBM z/VM mainframe guests to kernel memory corruption via a malicious peer. When a remote peer severs an IUCV connection, the kernel frees the iucv_path object but leaves raw, non-reference-counted pointers to it in the pending message notification queue; a subsequent recvmsg() call dereferences the freed memory, enabling heap corruption with full confidentiality, integrity, and availability impact. The vulnerability has existed since kernel 2.6.24, carries no public exploit code, and has not been added to CISA KEV, with EPSS at 0.18% reflecting its narrow IBM mainframe deployment scope.
Use-after-free in the Linux kernel net/sched subsystem allows local, low-privileged attackers to corrupt kernel heap memory or escalate privileges by racing concurrent RTM_NEWTFILTER netlink requests against an unprotected global rate-table list. The flaw arises because cls_flower's TCF_PROTO_OPS_DOIT_UNLOCKED flag causes tcf_police_init() to call qdisc_get_rtab()/qdisc_put_rtab() without the RTNL mutex, exposing the process-global qdisc_rtab_list and a non-atomic refcnt to concurrent mutation across CPUs. EPSS is low at 0.16% (6th percentile) and the vulnerability does not appear in CISA KEV, but the kernel-level use-after-free impact and the system-wide scope of the corrupted object demand prompt patching.
Local kernel memory corruption in the Linux net/x25 subsystem allows an attacker to trigger a slab-use-after-free in x25_kill_by_neigh() by racing a neighbour (X.25 link) teardown against a socket close. The function drops x25_list_lock before calling lock_sock() without holding a socket reference, so a concurrent x25_release() can free the struct sock/x25_sock that the teardown path then dereferences, leading to a crash or potential privilege escalation. No public exploit identified at time of analysis; a KASAN reproducer under QEMU confirmed the flaw, and EPSS exploitation probability is very low (0.18%).
Kernel panic (denial of service) in the Linux kernel networking GRO path affects systems that forward or aggregate traffic. skb_gro_receive_list() is missing the NAPI_GRO_CB(skb)->flush validation that skb_gro_receive() already has, so flush-marked, already-aggregated frag_list packets get re-aggregated, corrupting the frag_list chain; a later skb_segment() on the TX path then dereferences a NULL/corrupted pointer and crashes the kernel. No public exploit identified at time of analysis and EPSS is low (0.18%), but a stable patch is available. Despite the NVD CVSS of 9.8, the described impact is availability-only (crash), not code execution.
Missing hardware facility validation in the Linux kernel's ptp_s390 driver exposes IBM System z (s390x) mainframes to potential kernel crashes and hardware register state disclosure when the driver registers the physical clock without confirming that Facility 28 is installed and that PTFF QPT is available. The vulnerability affects kernel versions from commit 2d7de7a3010d713fb89b7ba99e6fdc14475ad106 through the respective fix commits across multiple stable branches, with patched releases at 6.18.42, 7.1.6, and 7.2-rc5. No public exploit has been identified and EPSS probability stands at 0.17%, consistent with the niche IBM mainframe hardware dependency that sharply constrains the exploitable population.
Kernel crash via assertion failure in the RBD (RADOS Block Device) subsystem of the Linux kernel allows a denial-of-service condition when a crafted or corrupted OSD reply message with a positive result code is received during an object map update. Affected kernels from 5.3 onward lack the positive-result-code reset in `rbd_object_map_callback()` that already exists in `rbd_osd_req_callback()`, causing `rbd_assert(*result < 0)` in `__rbd_obj_handle_request()` to trigger and crash the kernel. No public exploit has been identified at time of analysis, and EPSS stands at 0.18% (7th percentile), indicating low observed exploitation probability.
Permanent network Rx queue stall in the Linux kernel GVE (Google Virtual Ethernet) driver allows denial of service under extreme memory pressure conditions affecting Google Cloud VM instances. When page allocations fail during the Rx buffer refill loop, posted buffers can drop below the 32-descriptor threshold, causing the device to drop incoming packets; because no Rx completions are generated, NAPI is never rescheduled, creating a self-reinforcing deadlock that persists even after memory is freed. No public exploit has been identified and EPSS is 0.18% (7th percentile), but the availability impact is total network loss for the affected VM - the assigned CVSS 7.5 reflects the severity of that outcome, not ease of triggering it.
Out-of-bounds bitmap write in the Linux kernel's Intel ICE SR-IOV driver allows a malicious Virtual Function guest to crash the host kernel or potentially escalate privileges to the host. The vulnerable function ice_parser_profile_init unconditionally passes caller-controlled ptype values from VIRTCHNL_OP_ADD_RSS_CFG into set_bit() against a statically sized 1024-bit bitmap, permitting a value such as 0xffff to write beyond the bitmap boundary and trigger a kernel NULL pointer dereference. No public exploit code has been identified and EPSS exploitation probability is low at 0.18%, but the CVSS 8.8 score and confirmed crash reproducibility signal real urgency for SR-IOV multi-tenant environments where stable-branch patches are already available.
Slab use-after-free in the Linux kernel's ILA (Identifier Locator Addressing) IPv6 module allows a remote attacker to trigger memory corruption by sending crafted IPv6 packets through a configured ILA csum-adjust-transport route or receive-side mapping. The flaw stems from ila_csum_adjust_transport() and ila_update_ipv6_locator() caching a stale IPv6 header pointer across a pskb_may_pull() call that can reallocate the skb head, leading to reads and a locator write through freed memory. No public exploit is identified at time of analysis, and EPSS exploitation probability is low (0.18%); the issue is patched upstream.
Integer underflow in the Linux kernel mac802154 link-layer security subsystem allows any unauthenticated IEEE 802.15.4 peer within radio range to corrupt kernel memory by transmitting a crafted secured frame with a payload shorter than the AEAD authentication tag. The flaw in llsec_do_decrypt_auth() causes an unsigned integer wraparound that passes an approximately 4 GiB associated-data length to the crypto subsystem, driving the AEAD scatterwalk far beyond the actual frame buffer and producing a general-protection-fault or exploitable kernel memory corruption. No public exploit is identified at time of analysis and EPSS is very low at 0.21%, but full kernel-level impact (C:H/I:H/A:H) is rated given confirmed KASAN reproduction; real-world exposure is constrained to embedded Linux deployments with 802.15.4 hardware and LLSEC explicitly configured.
Kernel heap out-of-bounds write in the Linux MCTP serial driver (drivers/net/mctp/mctp-serial.c) lets an attacker on the serial/tty channel corrupt memory adjacent to the netdev private area on any host where an mctpserialN interface has been configured. The receive state machine accepts a zero-length frame, sets rxlen=0, and enters STATE_DATA, so the 'rxpos == rxlen' terminator never fires and every subsequent inbound byte becomes a 1-byte attacker-controlled OOB heap write past the fixed 74-byte rxbuf, continuing effectively unbounded until a frame or escape byte resets the parser. No public exploit is identified at time of analysis and EPSS is low (0.19%), but the flaw was reproduced with KASAN/UBSAN and carries high memory-corruption impact.
Length-underflow in the Linux kernel's Open vSwitch (openvswitch) datapath lets a truncation delta be reused across GSO segments, so a segment can reach queue_userspace_packet() with a stored cutlen larger than skb->len and pass an underflowed length to skb_zerocopy(). The affected code is the OVS_ACTION_ATTR_TRUNC (packet truncate) path feeding userspace upcalls, and the flaw is tagged Information Disclosure, consistent with an out-of-bounds copy of adjacent kernel memory into the userspace listener (and/or a kernel crash). It is fixed in stable kernels 6.6.148, 6.12.101, 6.18.42 and 7.1.6; there is no public exploit identified at time of analysis and EPSS is low (0.18%).
Memory corruption in the Linux kernel PPPoE driver allows a local low-privilege attacker to write six bytes through a stale pointer into freed kernel memory, with potential for privilege escalation to root. The flaw exists in pppoe_sendmsg(), which saves a direct pointer to the PPPoE header before calling dev_hard_header() - a callback that may reallocate the socket buffer head, invalidating the saved pointer. This vulnerability is not confirmed actively exploited (not in CISA KEV), no public exploit is known, and EPSS stands at 0.18% (7th percentile); however, patches are available across multiple stable kernel series.
TX hang vulnerability in the Linux kernel rtase driver allows denial of service by causing the Realtek RTASE hardware packet parser to stall when it encounters incomplete IPv4, IPv6, TCP, or UDP transport headers, or undersized UDP packets on PTP ports 319/320. Systems running kernels from commit d6e882b89fdf80be0ab4f914ec10f75215e49495 through the respective patched releases and equipped with Realtek RTASE network hardware are affected. No public exploit has been identified at time of analysis, and EPSS at 0.17% (6th percentile) indicates extremely low real-world exploitation probability.
Uninitialized kernel memory disclosure via TCP-AO padding bytes affects Linux kernels since v6.7 (commit decde2586b34). When constructing standalone TCP responses - ACKs and RSTs - with TCP Authentication Option (TCP-AO) enabled, one to three alignment padding bytes following a non-four-byte-aligned MAC are left uninitialized and transmitted on the wire, leaking small amounts of kernel memory to on-path observers. No public exploit exists and EPSS is 0.17% (6th percentile), making this low-urgency despite the vendor-assigned CVSS 7.5 score; the C:H rating is likely overstated given the 1-3 byte disclosure boundary.
TCP connection disruption in the Linux kernel exposes systems handling SYN-RECEIVED state connections to blind RST injection attacks that bypass RFC 5961 and RFC 9293 challenge ACK protections. The tcp_check_req() function accepts in-window RST segments with non-exact sequence numbers, allowing a remote unauthenticated attacker to abort half-open connections without meeting the exact SEQ match requirement mandated by RFC 9293 section 3.10.7.4. Exploitation probability remains low (EPSS 0.17%, 6th percentile) and no public exploit or KEV listing has been identified, though the CVSS 8.2 score reflects the ease of network access (AV:N/AC:L/PR:N) combined with a high availability impact from connection disruption.
Use-after-free in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem lets a local actor trigger a write to freed slab memory via the accept() error path of tipc_sk_create(). When socket insertion into the per-netns rhashtable fails, sock->sk is left dangling instead of NULLed, so tipc_release() bypasses its own NULL guard and calls lock_sock() on the freed sk. It affects kernels using the AF_TIPC protocol across many stable branches (fixes backported to 5.4.x through 6.18.x and mainline 7.x); there is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS of 0.18%.
Source list corruption in the Linux kernel's VXLAN Multicast Database (MDB) subsystem can be triggered by a local low-privileged user during a failed MDB remote entry replace operation, silently corrupting multicast forwarding state across affected kernel branches. The logic flaw in vxlan_mdb_remote_srcs_add() incorrectly tears down pre-existing (S,G) source entries during an error rollback, rather than restricting the rollback to entries added during the current failed call. EXCLUDE-mode multicast filters subsequently forward traffic that should be blocked, and INCLUDE-mode filters drop traffic that should be forwarded; no public exploit is identified at time of analysis.
Integer overflow in the Linux kernel's drm/amdgpu VCE (Video Codec Engine) driver enables local low-privileged users on systems with AMD GPU hardware to corrupt GPU memory. Crafted VCE command streams containing extreme image dimensions such as 65536×65536 pixels trigger a 32-bit arithmetic overflow, collapsing the computed buffer size to zero, which bypasses bounds validation and permits the GPU firmware to perform out-of-bounds memory access with scope-change implications rated CVSS 8.8. No public exploit code has been identified and EPSS stands at 0.18% (7th percentile), indicating low real-world exploitation activity; the high score reflects the full-impact scope change to GPU firmware memory rather than immediate internet-facing risk.
Time-of-check to time-of-use (TOCTOU) race condition in the Linux kernel's AMDGPU VCN4 video encoder driver allows a local low-privileged user with GPU device access to corrupt the IB (Indirect Buffer) parameter length between driver reads, potentially achieving out-of-bounds kernel memory access. Affected systems must run AMD RDNA3-class GPU hardware; the official CVSS 3.1 score of 8.8 with scope change (S:C) and High C/I/A ratings implies a local privilege escalation path to kernel level. No public exploit code has been identified and EPSS is 0.17% (6th percentile), indicating low real-world exploitation activity despite the high theoretical severity.
Division by zero in the Linux kernel's amdgpu DRM subsystem (drm/amdgpu UVD driver) allows a local attacker with access to AMD GPU render nodes to crash the kernel or potentially escalate privileges by submitting H264 video decode requests with frame dimensions below 16 pixels. Affected stable branches span kernel versions prior to 6.6.148, 6.12.101, 6.18.42, and 7.1.6, all of which now have upstream patches committed. No public exploit code and no CISA KEV listing have been identified; EPSS at 0.17% (6th percentile) indicates negligible near-term automated exploitation probability.
Use-after-free in the Linux kernel's drm/amdgpu driver arises from freeing the ACP (Audio CoProcessor) generic power domain memory before unregistering it from the kernel's global power domain list via pm_genpd_remove(), leaving a dangling pointer in that list. Systems running a vulnerable kernel with AMD GPU hardware present are exposed to a local privilege escalation path - an attacker with low-privileged local access could trigger kernel memory corruption during driver teardown. No public exploit code exists and EPSS is 0.17% (6th percentile), but the CVSS 7.8 score reflects potential for full system compromise if exploited.
Doorbell mapping corruption in the Linux kernel amdgpu DRM driver allows a local low-privileged user with AMD GPU access to overwrite another queue's doorbell entry by creating a second user-queue sharing the same Buffer Object handle and offset. The root cause is use of `xa_store_irq()`, which permits silent overwrites in the XArray, replaced by the patch with `xa_insert_irq()`. Consequences include fence IRQ misrouting to wrong queues and destructive cleanup that erases a live queue's mapping, yielding high integrity and availability impact. No public exploit code exists and EPSS is 0.15% (5th percentile), indicating negligible real-world exploitation activity.
Out-of-bounds heap read in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated network attacker to disclose approximately 1 KB of kernel heap memory at an attacker-controlled offset and potentially crash the ksmbd service or host kernel. The flaw resides in set_ntacl_dacl(), which copies ACEs from a previously stored attacker-controlled security descriptor without validating sid.num_subauth against the fixed SID_MAX_SUB_AUTHORITIES (15) array bound, enabling a crafted num_subauth value of up to 255 to drive a sub_auth[] array overread. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Kernel memory corruption via out-of-bounds ACE dedup walk in the Linux kernel's ksmbd SMB server subsystem exposes any network-reachable Linux host running ksmbd to high-impact compromise with only low-privilege SMB authentication. When set_ntacl_dacl() terminates ACE copying early due to a size-accounting overflow, set_posix_acl_entries_dacl() continues iterating using the original inflated nt_num_aces count rather than the count of ACEs actually copied, causing the dedup walk to scan into uninitialized buffer tail memory. No public exploit or CISA KEV entry exists at time of analysis, and EPSS remains low at 0.17%, but the patch is available across multiple stable kernel branches and should be applied promptly on any ksmbd-enabled deployment.
Out-of-bounds memory read in the Linux kernel's ksmbd (in-kernel SMB server) allows authenticated network attackers to trigger kernel memory disclosure via a crafted NT ACL. The flaw resides in set_ntacl_dacl(), which validates sid.num_subauth before copying an ACE but fails to verify the declared ACE size can contain all declared SID sub-authorities, permitting undersized ACEs through. The subsequent POSIX ACL deduplication walk then reads beyond the copied ACE's legitimate boundary. No active exploitation is confirmed (not in CISA KEV), and the EPSS probability is 0.17% (6th percentile), indicating low real-world exploitation activity at time of analysis.
Recursive locking deadlock in the Linux kernel audit subsystem causes a complete, unrecoverable kernel hang when a file matching an executable audit rule is renamed. Affected kernels from 4.3 through stable branches prior to 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc1 are vulnerable. Any local user able to rename a file that matches an active exe= audit rule can trigger the deadlock, forcing a hard reboot; no public exploit exists and EPSS is 0.18%, consistent with the specific preconditions required.
Resource mismanagement in the Linux kernel Wacom HID driver leaves hardware running after failed initialization, creating a potential use-after-free condition in kernel memory. Affects a broad range of stable Linux kernel branches from 4.19 through 6.8, requiring a Wacom HID device and a specific probe failure to trigger. Despite a CVSS score of 8.8, EPSS sits at 0.18% (7th percentile) and no public exploit exists; the vulnerability was discovered via static analysis, not active exploitation.
Race condition and state management bug in the Linux kernel Bluetooth HCI UART driver (hci_uart) allows an adjacent attacker with low privileges to block all future writes to a Bluetooth UART device after it is closed and reopened, with potential for kernel memory corruption via an unsafely cleared tx_skb pointer. Affected versions span multiple stable branches from 5.10.x through 6.18.x. No public exploit has been identified at time of analysis and EPSS is very low (0.17%), though the CVSS score of 8.0 with high C/I/A impact signals potential for use-after-free conditions beyond pure denial of service.
Directory-traversal / share escape in the Linux kernel's in-kernel SMB3 server (ksmbd) lets an authenticated SMB client create files, directories, or hardlinks outside the exported share. The SMB2 open lookup is correctly rooted at the share with LOOKUP_BENEATH, but ksmbd_vfs_kern_path_create() built an absolute path via convert_to_unix_name() and resolved it from AT_FDCWD, so a '..' component walked from the real filesystem root and escaped the export. It is exploited through a TOCTOU race and has no public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not in CISA KEV.
Out-of-bounds kernel memory reads in the Linux kernel's libceph client (decode_lockers() in net/ceph/cls_lock_client.c) let a malicious or compromised Ceph OSD trigger slab-out-of-bounds reads on any kernel client that issues the lock.get_info RADOS class method, such as during RBD exclusive-lock acquisition. A crafted reply with struct_len=0 causes a bare ceph_decode_32() to read 4 bytes past the validated buffer (feeding a garbage locker count into allocation), and a crafted num_lockers lets a subsequent bare ceph_decode_8() read one byte past the end, giving the OSD direct influence over the returned lock-type discriminator. There is no public exploit identified at time of analysis, and the EPSS score is low (0.20%, 10th percentile); the issue is a memory-safety information-leak/DoS rather than the remote code execution implied by the CNA's 9.8 rating.
Use-after-free in the Linux kernel ALSA driver for TASCAM US-144MKII USB audio devices allows a local low-privileged attacker to corrupt kernel memory, with potential for privilege escalation. The flaw originates in capture_urb_complete(), where redundant usb_anchor_urb() calls on every URB completion progressively corrupt the anchor's doubly-linked list and inflate the URB reference count; when usb_kill_anchored_urbs() later traverses this list during stream stop, suspend, or device disconnect, it dereferences freed memory. No public exploit or CISA KEV listing exists, and EPSS at 0.17% (6th percentile) reflects the narrow exposure created by the required TASCAM hardware dependency.
Use-after-free in the Linux kernel's Amlogic GXL crypto driver (`crypto/amlogic`) allows a local attacker to trigger memory corruption during driver probe failure, potentially enabling privilege escalation or denial of service on affected kernels (5.5 through pre-patch stable branches). The double-cleanup defect in `meson_crypto_probe()` causes `meson_free_chanlist()` to tear down already-freed per-flow resources - confirmed via KASAN slab-use-after-free in `kthread_destroy_worker()` - when `meson_allocate_chanlist()` fails after partial initialization. No public exploit identified at time of analysis; EPSS is 0.16% (6th percentile), consistent with the narrow hardware footprint and non-trivial triggering conditions.
Kernel crash vulnerability in the Linux SMB client subsystem results from a type mismatch in smb2_aead_req_alloc() where an unsigned 32-bit integer is incorrectly passed to ERR_PTR(), generating an invalid error pointer that causes a system panic upon dereference. Systems running the Linux kernel with the SMB client module (cifs) and SMBv2/v3 AEAD encryption enabled are affected across multiple stable branches, with patches available in versions 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1. No public exploit code exists and no CISA KEV listing applies; EPSS probability is extremely low at 0.16% (5th percentile), indicating this is primarily a kernel reliability fix with negligible active exploitation interest despite the high official CVSS score.
Memory corruption (double-free) in the Linux kernel's SMB/CIFS client SMB2_close replay path can be triggered when a mounted SMB server returns a replayable error and a subsequent SMB2_close_init() fails, causing the same response buffer to be freed twice. It affects Linux stable kernels across the 6.6.x through 7.x series before the fixed releases; while the CNA-assigned CVSS is 9.8 with no public exploit identified at time of analysis, real-world abuse requires the victim host to communicate with a malicious or compromised SMB server, making this primarily a client-side memory-corruption/DoS concern rather than trivial remote code execution.
Memory ordering data races in the Linux kernel's fuse-uring subsystem expose weakly-ordered architecture systems (ARM64, PowerPC, RISC-V) to kernel-level impacts when the fuse-uring ring initializes. On kernels from commit c2c9af9a through the fix, missing acquire/release semantics around ring->ready and fiq->ops allow a CPU to observe ring->ready == true while reading a stale fiq->ops function pointer table, which could trigger undefined behavior ranging from kernel crashes to potential control-flow hijacking. No public exploit has been identified and EPSS sits at 0.15% (5th percentile), indicating low near-term exploitation probability despite the High CVSS rating; no CISA KEV listing confirms active exploitation.
Race condition in the Linux kernel's ARC EMAC Ethernet driver exposes a use-after-free window during driver probe teardown on ARC processor-based embedded systems. When probe unwinds after devm_request_irq() installs the interrupt handler, stale or firmware-latched EMAC interrupt status bits can fire arc_emac_intr() concurrently with net_device deallocation, potentially corrupting kernel memory. Patched versions are available across all active stable branches (5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9, 7.0); no public exploit or CISA KEV entry exists at time of analysis.
Use-after-free race condition in the Linux kernel brcmfmac Broadcom WiFi driver enables adjacent-network attackers to corrupt kernel memory during concurrent device removal and bus_reset work execution. Affected systems include any Linux host running brcmfmac on PCIe, SDIO, or USB Broadcom chipsets - including Raspberry Pi devices - on kernel versions since 5.2 through pre-7.1.6. No public exploit or CISA KEV listing exists at time of analysis, and EPSS probability is low at 0.14% (4th percentile), though the kernel-level impact class remains high.
Use-after-free in the Linux kernel esd_usb CAN driver exposes local privilege escalation on systems using ESD CAN USB hardware. The esd_usb_disconnect() teardown sequence frees each CAN netdev (and its embedded private struct) before calling unlink_all_urbs(), which then dereferences that already-freed per-netdev memory to kill TX anchors and reset TX contexts. Found by an in-house static analysis tool with no public exploit identified at time of analysis; EPSS is 0.16% (6th percentile), consistent with a niche driver defect rather than a broadly targeted flaw.
Use-after-free in the Linux kernel's USB MIDI gadget driver (f_midi) exposes systems configured as USB MIDI gadgets to local privilege escalation or denial-of-service. The flaw stems from midi->work not being cancelled before struct f_midi is freed in f_midi_free(), allowing a concurrent ALSA rawmidi write via f_midi_in_trigger() to rearm the work item after f_midi_disable() returns but before the object is deallocated - causing f_midi_in_work() to dereference freed kernel memory. No public exploit has been identified and EPSS sits at 0.16% (5th percentile), but the CVSS 7.8 score and kernel-level impact make patching the correct priority on systems deploying USB gadget functionality.
Use-after-free and NULL pointer dereference in the Linux kernel Broadcom BDC USB Device Controller driver expose systems to local privilege escalation during device teardown. The BDC driver's teardown sequence frees DMA-coherent memory and endpoint arrays while a shared IRQ handler remains live - a structural defect introduced when the driver adopted devm_request_irq(), whose LIFO devm release order creates a window where the interrupt handler dereferences freed or NULLed kernel structures. A separately unguarded delayed_work (func_wake_notify) compounds the issue with no cancellation path anywhere in the driver, allowing post-teardown callbacks against freed memory. No public exploit exists and the vulnerability is not in CISA KEV; it was identified by in-house static analysis with EPSS at the 5th percentile (0.16%), indicating negligible current exploitation activity.
Use-after-free race condition in the Linux kernel's RDMA/rxe (SoftRoCE) subsystem allows a local unprivileged user to trigger a kernel crash or achieve page-level memory corruption. The race occurs between rxe_mmap() - which releases pending_lock while a rxe_mmap_info kref is still live - and a concurrent DESTROY_CQ ioctl that drops the kref to zero, causing vfree() to clear vmalloc PTEs mid-walk in remap_vmalloc_range_partial(). No CISA KEV listing exists and EPSS is 0.16% (5th percentile), reflecting the race's very narrow exploitation window; however, the C:H/I:H/A:H impact and confirmed upstream patch make this a priority update for any environment with RDMA/rxe loaded.
Double-free use-after-free in the Linux kernel's xfrm (IPsec) subsystem allows a low-privileged local user to corrupt kernel heap memory, potentially achieving privilege escalation. The race condition in xfrm_user_policy() between a non-atomic sk_dst_cache reset via setsockopt and the UDP fast-path's atomic xchg() reset causes both code paths to observe the same dst pointer and call dst_release() twice, freeing the xfrm_dst bundle while still in use. Critically, the description confirms this is reachable by an unprivileged user via user and network namespaces, making it exploitable on most modern Linux distributions where user namespaces are enabled by default. No public exploit exists and no KEV listing, but the KASAN-confirmed write-to-freed-memory primitive is a classic kernel privilege escalation vector.
Double reference-count release (double netdev_put()) in the Linux kernel's IPv6 XFRM/IPsec policy subsystem allows a local low-privileged user to underflow a net_device refcount, producing kernel ref_tracker warnings and 'unregister_netdevice: waiting for <dev> to become free' hangs that can destabilize or crash the system and potentially enable privilege escalation through kernel memory corruption. The flaw exists in xfrm6_fill_dst() at net/ipv6/xfrm6_policy.c: on the error path where in6_dev_get(dev) returns NULL, netdev_put() is called but xdst->u.dst.dev is not cleared, so dst_destroy() later releases the same reference a second time. No public exploit and no CISA KEV listing have been identified at time of analysis; EPSS is 0.16% (5th percentile), indicating currently low automated exploitation probability.
Slab-out-of-bounds read in the Linux kernel's ksmbd SMB2 server allows remote unauthenticated attackers to crash the kernel or leak one byte of adjacent slab memory by sending a crafted compound SMB2 request. The vulnerable path in ksmbd_smb2_check_message() reads the 2-byte StructureSize2 field at offset 64 from each compound element without first confirming the element is at least 66 bytes, so a trailing element of exactly 64 bytes causes a one-byte overread beyond the receive buffer. No exploitation has been publicly confirmed (EPSS 0.16%, 5th percentile, not in CISA KEV), but the unauthenticated network attack vector (CVSS 8.2) makes any ksmbd-exposed host a realistic DoS target. Vendor-released patches are available across all maintained stable kernel series.
Remote kernel panic in the Linux kernel's GTP (GPRS Tunneling Protocol) driver allows an unauthenticated network attacker to crash a GTP-enabled host by sending a malformed echo request packet of 16-19 bytes. The vulnerability arises because gtp1u_send_echo_resp() ignores the NULL return from skb_pull_data() on an undersized buffer, causing skb->data to be pushed below skb->head by subsequent header operations, which trips skb_under_panic() and causes an immediate kernel BUG halt. No public exploit has been identified at time of analysis and EPSS of 0.18% (8th percentile) reflects low current exploitation probability, but the unauthenticated network-triggerable DoS against mobile core infrastructure warrants prompt patching for telecom operators.
Uninitialized stack memory dereference in the Linux kernel's IPv4 nexthop subsystem (net/ipv4/nexthop.c) enables local low-privileged attackers to cause kernel panic or leak sensitive stack contents on systems built with CONFIG_INIT_STACK_NONE. Versions from 5.13 through stable branches prior to 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5 are affected. No public exploit code has been identified and EPSS stands at 0.16% (5th percentile), placing this in the low-urgency tier despite a CVSS 7.1 score driven by dual high-impact outcomes.
Double-release memory corruption in the Linux kernel's BPF TCP iterator (bpf_iter_tcp_batch) allows a local low-privileged user with BPF iterator access to trigger a kernel panic. When batch reallocation fails, the first bpf_iter_tcp_put_batch() call frees socket references and overwrites batch slots with socket cookies; if realloc then fails, the iterator's stop routine executes a second put_batch() and dereferences those cookie integer values as struct sock pointers, causing a KASAN-detected null-pointer dereference and kernel panic. No public exploit identified at time of analysis; EPSS is 0.15% (5th percentile), indicating low current automated exploitation probability.
Use-after-free in the Linux kernel mac80211 MLO (Multi-Link Operation) subsystem allows a local attacker with low privileges to corrupt kernel memory by reading stale debugfs entries after a failed ieee80211_vif_update_links() operation. Systems running kernel 6.4 or later with WiFi 7 (IEEE 802.11be) MLO-capable hardware are within the affected code path; patched releases are available across all active stable branches. No public exploit or CISA KEV listing exists and EPSS is 0.16%, but CVSS impact metrics of C:H/I:H/A:H indicate full kernel compromise potential if the vulnerability is successfully triggered, as confirmed by a KASAN slab-use-after-free trace referencing a task named 'exploit/145'.
Double-free memory corruption in the Linux kernel's mac80211 WiFi subsystem exposes systems running in WiFi 6 AP mode with FILS discovery configured to potential kernel heap corruption and privilege escalation. The flaw in ieee80211_set_fils_discovery() prematurely queues the old template for deferred freeing before confirming the new allocation succeeds; when kzalloc() fails, a stale pointer is retained and freed a second time upon AP teardown or reconfiguration. No public exploit identified at time of analysis; EPSS is 0.19% (8th percentile), consistent with the constrained exploitation prerequisites.
Double-free memory corruption in the Linux kernel's mac80211 WiFi subsystem allows a local attacker with low privileges to corrupt kernel heap memory, potentially leading to privilege escalation or denial of service. The flaw exists in ieee80211_set_unsol_bcast_probe_resp(), where kfree_rcu() is invoked on the old unsolicited broadcast probe response template before a new one is successfully allocated - if kzalloc() then fails, the stale pointer is re-queued for freeing during AP teardown or subsequent configuration updates, triggering a KASAN-detected double-free in softirq context. No public exploit exists and EPSS is extremely low (0.16%, 5th percentile), but the local PR:L CVSS vector and high C/I/A impact scores make this a meaningful kernel hardening target for multi-tenant or shared Linux environments.
Slab-out-of-bounds read in the Linux kernel btrfs free space cache loader allows a local attacker to trigger kernel memory corruption by supplying a crafted btrfs filesystem with an inflated num_entries value in the on-disk btrfs_free_space_header. All Linux kernel versions from commit 5b0e95bf607d through the patched stable releases across the 6.6, 6.12, 6.18, 7.1, and 7.2 series are affected. An attacker who can mount or cause the kernel to process such a crafted volume causes the io_ctl->index pointer to walk past the pages[] array boundary, with the overrun slot treated as a struct page and passed to crc32c(), culminating in a general protection fault with kernel code execution or information disclosure potential. No public exploit has been identified and this vulnerability is not in CISA KEV; EPSS places exploitation probability at the 5th percentile.
Kernel memory corruption in the Linux IPsec IP-TFS/AGGFRAG (xfrm iptfs) receive path allows crafted or normal traffic arriving on an IPTFS tunnel to corrupt kernel memory and panic affected hosts (introduced in Linux 6.14, fixed in 6.18.42, 7.1.6 and 7.2-rc4). Because iptfs_skb_add_frags() fails to propagate the SKBFL_SHARED_FRAG flag when copying page-pool-backed shared frags, a subsequent nested transport-mode esp_input() takes the no-COW fast path and decrypts in place over pages still referenced by the outer SKB. There is no public exploit identified at time of analysis and EPSS is low (0.15%), consistent with the narrow, non-default configuration required.
Kernel memory corruption in the Linux kernel SCTP stack allows a remote peer to trigger a use-after-free during ASCONF DEL-IP processing, corrupting an association's transport list and leaving primary_path/active_path pointing at freed memory. The flaw affects the SCTP dynamic address reconfiguration (ASCONF) path across a wide range of kernel versions and, given kernel-level impact, can lead to denial of service and potentially privilege escalation or code execution. Despite the 9.8 CVSS and 'Information Disclosure' tag, there is no public exploit identified at time of analysis and EPSS is low (0.16%), reflecting the SCTP/ASCONF-specific conditions required.
Use-after-free in the Linux kernel rhashtable walk subsystem allows a local attacker with low privileges to dereference a stale pointer into freed slab memory, enabling kernel memory disclosure, crash, or potential privilege escalation. The defect is in rhashtable_walk_start_check(): when a hash table is freed during resize (iter->walker.tbl == NULL), the restart path clears slot and skip but omits clearing iter->p, leaving a dangling pointer that rhashtable_walk_next() then dereferences. Confirmed callers affected include netlink_diag and TIPC socket diagnostics. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.15% (5th percentile), reflecting low current exploitation activity despite real kernel memory-safety impact.
Race condition in the Linux kernel's KVM nVMX (nested VMX) subsystem allows a low-privileged local attacker to trigger a use-after-free via shadow VMCS teardown, with potential for full hypervisor compromise. The flaw arises because free_nested() releases the shadow VMCS page while vmcs01 still holds a dangling pointer; if the vCPU migrates to another physical CPU before the pointer is cleared, __loaded_vmcs_clear() executes VMCLEAR against the freed page, corrupting kernel memory. No public exploit code exists and no active exploitation is confirmed (EPSS 0.16%, 5th percentile), but the S:C scope change in the CVSS vector and the C:H/I:H/A:H impact triad indicate this could enable a guest-to-host escape under the right conditions.
Shadow MMU ordering flaw in the Linux kernel KVM x86 subsystem allows a low-privileged guest process to corrupt the hypervisor's page table state by triggering invalid root population during shadow page reclamation. Kernels from 5.9 through multiple unpatched stable branches permit child shadow pages to be created under an invalidated parent root, violating a core MMU invariant and potentially enabling guest-to-host privilege escalation. No public exploit has been identified and EPSS is low (0.16%), but the confirmed scope change to the host hypervisor makes this a high-priority patch for any KVM-based multi-tenant or cloud virtualization environment.
Local privilege-escalation/denial-of-service in the Linux kernel's POSIX CPU timers subsystem arises from a use-after-free triggered by a race between sys_timer_delete() and a non-leader exec(). When de_thread() switches the thread-group leader and releases the old leader, posix_cpu_timer_del() can observe the stale leader with a now-NULL sighand, return without unqueueing an armed TGID-targeted timer, and free the underlying k_itimer while its timerqueue node remains enqueued in p->signal - leaving run_posix_cpu_timers() and other timer add/delete operations to dereference freed memory. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; a vendor patch is available in stable releases.
Local information disclosure in the Linux kernel s390 protected-key (pkey) subsystem affects IBM Z (s390x) mainframe systems where the PKEY_VERIFYPROTK ioctl fails to validate the user-supplied buffer length before processing, allowing a local low-privileged user with access to the pkey device to trigger an out-of-bounds kernel memory access. Fixed by explicitly checking the request length against the buffer size and failing when it exceeds it. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Local privilege-impacting memory corruption in the Linux kernel's s390 (IBM Z) pkey subsystem allows a low-privileged local user to trigger an out-of-bounds write through the pkey_pckmo key_to_protkey() handler, which failed to validate that generated protected-key output fits within the caller-provided target buffer. The flaw affects s390 builds of the kernel prior to the fixed stable releases and carries high confidentiality, integrity, and availability impact (CVSS 7.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Kernel memory corruption in the Linux kernel Bluetooth L2CAP stack arises from a use-after-free in l2cap_sock_new_connection_cb(), which dereferenced a child socket after release_sock(parent) had already exposed it via the accept queue, letting a racing task accept and free the socket first. Any Linux host with Bluetooth enabled and an L2CAP listening socket is affected; a Bluetooth-adjacent attacker able to trigger new connections can win the race to corrupt freed kernel memory, rated CVSS 3.1 8.8 (C:H/I:H/A:H). There is no public exploit identified at time of analysis and EPSS is low at 0.16%, indicating a proactively fixed memory-safety bug rather than one under active attack.
Local privilege escalation potential via memory corruption in the Linux kernel's perf/core subsystem, where perf_event_remove_on_exec() fails to detach group relationships when removing a group-leader event during exec. On affected kernels, a local user who can open perf events can corrupt the PMU context active list through a double list_add, undermining kernel memory integrity (CVSS 7.8, C:H/I:H/A:H). EPSS is low at 0.16% (5th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
Guest-to-host state corruption in the Linux kernel's arm64 KVM nested-virtualization (NV) support arises because kvm_hyp_handle_mops() writes an untranslated synthetic CPSR value directly into hardware when rewinding single-step state after a MOPS (FEAT_MOPS memory copy/set) exception. On systems running a nested guest at virtual EL2, this bypasses the vEL2-to-hardware translation, leaving SPSR_EL2 with an invalid exception-return state that the host later consumes. The fix modifies SPSR_EL2 directly and defers resynchronization to the next full exit. There is no public exploit identified at time of analysis; EPSS is very low (0.17%, 6th percentile) and it is not in CISA KEV.
Use-after-free write in the Linux kernel's bridge netfilter IPv6 fragmentation path (br_ip6_fragment) lets an adjacent attacker corrupt kernel memory and crash the host. The flaw affects systems acting as bridges with connection-tracking (nf_conntrack_bridge) forwarding IPv6 traffic, where a stale prevhdr pointer is dereferenced after skb_checksum_help() reallocates the skb head for a cloned packet. There is no public exploit identified at time of analysis and it is not in CISA KEV; the reported KASAN trace demonstrates a reliable kernel panic (denial of service), with memory-corruption escalation theoretically possible.
Out-of-bounds kernel write in the Linux virtio-net driver's receive_big() path allows a malicious or compromised virtio backend (host/hypervisor-side device emulator) to corrupt guest kernel memory. The length validation meant to bound device-announced packet size still permits a ~20-byte gap, so a crafted len drives page_to_skb() one fragment past the page chain, writing into skb_shinfo()->frags[MAX_SKB_FRAGS] and passing a NULL frag up the receive path. There is no public exploit identified at time of analysis and EPSS is low (0.17%), but the flaw carries a high CVSS (8.4) due to kernel-level memory corruption.
Uninitialized kernel memory disclosure in the Linux kernel SCTP stack allows a remote peer to leak stale kernel heap/stack bytes by sending a malformed ERROR chunk carrying a STALE_COOKIE cause. When an association is in the COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads a 4-byte 'Measure of Staleness' from the first cause in the chunk without verifying that the field is actually present, and echoes that value back to the peer in the Cookie Preservative of the reply INIT. It is reachable by any peer - including an unprivileged local process using a raw SCTP socket inside a user+network namespace - and there is no public exploit identified at time of analysis (EPSS 0.18%, not in CISA KEV).
Out-of-bounds read in the Qualcomm rmnet (Rmnet Multiplexing and Aggregation Protocol) driver of the Linux kernel allows a local attacker to read kernel slab memory beyond frame boundaries by injecting a short MAP frame while ingress deaggregation is disabled. The no-aggregation ingress path skipped the length validation performed on the aggregated path, so the parser dereferenced the MAP header and checksum trailer using the on-wire pkt_len without verifying skb->len. No public exploit has been identified at time of analysis, and the low EPSS score (0.18%, 7th percentile) reflects the local-only, niche-driver nature of the flaw rather than widespread mass exploitation.
Kernel memory corruption in the Linux kernel's BPF sockmap subsystem allows a local actor able to load a BPF sk_msg program to trigger an out-of-bounds write via an integer overflow in bpf_msg_push_data(). A crafted u32 'len' argument (typed ARG_ANYTHING) wraps the 'copy + len' page-allocation size to a small value, producing an undersized allocation followed by an oversized memcpy that corrupts kernel heap memory, enabling denial of service and potential privilege escalation. There is no public exploit identified at time of analysis and the EPSS score is low (0.18%), but the flaw is confirmed and patched upstream by kernel maintainers.
Out-of-bounds read in the Linux kernel's net1080 USB networking driver allows a malicious NetChip 1080 (NC1080) USB device to read slab memory past the end of a socket buffer during RX processing. In net1080_rx_fixup(), an even attacker-controlled packet_len is used to index a pad byte (skb->data[packet_len]) before it is validated against the actual frame length, so a short frame advertising a large even packet_len (e.g. 0x4000, bounded only by NC_MAX_PACKET) triggers a KASAN slab-out-of-bounds read in softirq/ksoftirqd context. This is a vendor-fixed kernel hardening bug with no public exploit identified at time of analysis; EPSS is low (0.18%) and it is not in CISA KEV.
Heap out-of-bounds read in the Linux kernel's DRM EDID parser (drm_parse_tiled_block in drivers/gpu/drm/drm_edid.c) lets a crafted DisplayID tiled-display block trigger a slab-out-of-bounds read past the exact-sized kmemdup()'d EDID buffer. The affected code casts the block to struct displayid_tiled_block and reads the fixed 22-byte layout up to topology_id[7] without validating num_bytes, so an EDID advertising a tiled block (DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for DisplayID v2.0) with an undersized payload at the end of a DisplayID extension reads out of bounds, causing kernel memory disclosure or a crash. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV; the fix is upstreamed and backported to multiple stable trees.
Denial of service in the Linux kernel XDP generic receive path allows a NULL pointer dereference and kernel panic when a bond slave interface is released while XDP redirect processing is in flight. The affected code, xdp_master_redirect() in net/core/filter.c, guards only on netif_is_bond_slave() but dereferences the master device that bond_upper_dev_unlink() has already cleared, faulting on master->flags at offset 0xb0. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; the issue is a race-window crash rather than a memory-disclosure or code-execution bug.
Local privilege escalation and kernel memory corruption in the Linux kernel's TIPC subsystem occurs because bearer_disable() frees the discoverer object (b->disc) with a plain kfree() via tipc_disc_delete(), while tipc_disc_rcv() still dereferences it in RX softirq under rcu_read_lock(); for UDP bearers the synchronize_net() grace period is deferred to a workqueue, so the object is freed with no RCU protection. The flaw is reachable from an unprivileged user namespace because the TIPCv2 generic-netlink family is netnsok and its bearer commands carry no GENL_ADMIN_PERM, requiring only that the kernel be built with CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP. No public exploit is identified at time of analysis and EPSS is low (0.17%, 6th percentile), but the KASAN-confirmed use-after-free yields a high-impact memory-corruption primitive affecting confidentiality, integrity and availability.
Use-after-free in the Linux kernel's SMC-R (Shared Memory Communications over RDMA) subsystem allows a race between the CDC receive tasklet and socket close to operate on freed memory, enabling a kernel crash and potential memory corruption on hosts using SMC-R. The flaw lives in smc_cdc_rx_handler(), which looks up a connection under conns_lock, releases the lock, and then dereferences the socket via sock_hold() in smc_cdc_msg_recv() without holding a reference across the window. It affects only systems that have SMC-R enabled and active; there is no public exploit identified at time of analysis and EPSS is low (0.18%, 7th percentile).
Out-of-bounds kernel heap read in the Linux kernel's usbnet gl620a driver allows a malicious GeneLink (GL620A) USB link-cable device to leak adjacent slab memory into the network stack. The flaw is in genelink_rx_fixup(), which trusts a device-supplied per-packet length (bounded only by GL_MAX_PACKET_LEN of 1514 bytes) without checking it against the number of bytes actually received in the URB. Rated CVSS 8.1, it is unauthenticated (PR:N) and needs no user login, but no public exploit identified at time of analysis and EPSS is low at 0.18% (7th percentile).
Stack out-of-bounds write in the Linux kernel Bluetooth subsystem (net/bluetooth/eir.c) lets a local privileged user corrupt kernel stack memory when an LE-only controller assembles legacy advertising data. eir_create_adv_data() prepends a 3-byte 'Flags' AD structure to a fixed 31-byte buffer without accounting for it in the length check, so an advertising instance created with flags == 0 and a maximal adv_data_len causes a 3-byte overflow past the buffer during hci_update_adv_data_sync(). There is no public exploit identified at time of analysis and EPSS is low (0.16%), consistent with a local, capability-gated memory-corruption bug rather than a mass-exploitation target.
Out-of-bounds kernel memory reads in the Linux kernel's staging rtl8723bs Realtek Wi-Fi driver allow a malicious or spoofed access point within radio range to leak adjacent kernel memory or crash the system by sending beacon/probe-response frames carrying truncated or undersized information elements (IEs). The flaw lives in is_ap_in_tkip(), which parses IEs without bounds-checking the IE header or payload length before dereferencing WLAN_EID_VENDOR_SPECIFIC (needs length >= 16) and WLAN_EID_RSN (needs length >= 12) data. No public exploit identified at time of analysis; EPSS probability is low (0.16%, 6th percentile), and the issue is not listed in CISA KEV.
Local denial-of-service (kernel double-free/UAF) in the Linux kernel NVMe/TCP target driver (nvmet-tcp) affects hosts serving block storage over NVMe-over-TCP with data digest enabled. When a data-digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based transfer, the command is uninited but not marked complete, so queue teardown uninits it a second time, causing a double percpu_ref_put against a single get. There is no public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and the flaw is not in CISA KEV.
Denial of service (and potential use-after-free) in the Linux kernel's NVMe-over-TCP target (nvmet-tcp) subsystem allows a connected NVMe-oF initiator to trigger a refcount underflow via a crafted data-digest mismatch. When a command that previously failed nvmet_req_init() (marked NVMET_TCP_F_INIT_FAILED) hits a data digest error, nvmet_req_uninit() runs an unbalanced percpu_ref_put(), producing a percpu_ref warning, a use-after-free diagnostic, and ultimately a permanent workqueue deadlock that hangs the target. No public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile), and it is not listed in CISA KEV, so despite the 9.8 NVD score this is realistically a stability/DoS bug confined to hosts acting as NVMe-oF TCP targets with data digest enabled.
Out-of-bounds memory access in the Linux kernel's ntfs3 filesystem driver allows a crafted NTFS image to corrupt kernel memory during NTFS log replay. When log_replay() converts version 0 restart-table records (DIR_PAGE_ENTRY_32 to DIR_PAGE_ENTRY), it derives a memmove() length directly from the attacker-controlled on-disk lcns_follow field, which check_rstbl() does not bound against the entry size; an oversized value drives reads/writes past the allocated restart-table buffer. There is no public exploit identified at time of analysis and EPSS is low (0.17%), but the flaw carries CVSS 7.8 with high confidentiality, integrity, and availability impact because it executes in kernel context when a malicious volume is mounted.
Out-of-bounds heap write in the Linux kernel's ntfs3 filesystem driver allows a crafted NTFS volume to corrupt kernel memory when the journal is replayed. The flaw lives in do_action()'s UpdateRecordDataRoot and UpdateRecordDataAllocation log-replay cases (fs/ntfs3/fslog.c), where the on-disk NTFS_DE field view.data_off is used as a memmove destination offset without bounding it against the entry size, letting an attacker-controlled offset (demonstrated at 0xFFFC) push a write ~32 bytes past the NTFS_DE. There is no public exploit identified at time of analysis and EPSS risk is low (0.16%), but the CVSS 7.8 rating reflects the kernel-level memory corruption impact against any system that mounts the malicious volume.
Local privilege-boundary memory-safety flaw in the Linux kernel's Open vSwitch (openvswitch) datapath allows a local user with network-configuration capability to desynchronize the validated action stream from the one later executed. Introduced by commit a1e64addf3ff which removed the 64 KiB actions-length guard, the bug lets a generated nested action container (e.g. CLONE/CT) exceed U16_MAX and close with a truncated 16-bit nla_len, so subsequent bytes are reinterpreted as independent actions during dump or teardown. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile), and it is not in CISA KEV.
Use-after-free in the Linux kernel's net/sched cls_api when handling TC_ACT_CONSUMED in tcf_qevent_handle can allow remote code execution. The flaw is triggered if a RED qdisc is configured with a qevent early_drop and a tc filter using connection tracking (act_ct) with defragmentation enabled while receiving out-of-order fragments. No active exploitation or public PoC exists; EPSS score 0.17% indicates low exploitation probability despite a CVSS 9.8 base score.
Local privilege escalation in the Linux kernel's QAT driver allows a low-privileged local attacker to achieve full system compromise by exploiting a legacy character device interface with IOCTLs. The unused /dev/qat_adf_ctl device node increases attack surface and has been the subject of multiple bug reports. With an EPSS score of 0.24%, active exploitation is unlikely, and no public exploit code is known; the vulnerability is addressed by removing the entire character device and IOCTL infrastructure.
Out-of-bounds array read and missing initialization flaw in the Linux kernel's drm/hyperv virtual display driver affect Linux VMs running under Microsoft Hyper-V. A SYNTHVID_RESOLUTION_RESPONSE message carrying resolution_count exceeding 64 causes the guest kernel driver to walk past the end of the 64-entry supported_resolution[] array, potentially disclosing adjacent guest kernel heap memory to the Hyper-V host. A separate missing-initialization defect in the WIN10-to-WIN8 protocol fallback path leaves screen dimension fields at zero, causing drm_internal_framebuffer_create() to reject every userspace framebuffer with -EINVAL and effectively disabling virtual display. No public exploit exists and EPSS is 0.21%; exploitation of the OOB read requires host-level control over Hyper-V VMBus messaging.