Linux
Monthly
Use-after-free in the Linux kernel net/handshake subsystem allows a struct socket to be torn down while the handshake netlink accept path still holds a pointer to it. The submit path only took a sock_hold(), which keeps struct sock alive via sk_refcnt but does not pin the struct socket (owned by sock->file); once the userspace handshake agent releases the last file reference, sock_release() destroys the socket, leaving handshake_nl_accept_doit() dereferencing freed memory. Fixed versions are available (6.12.93, 7.0.12, 7.1); EPSS is low at 0.21% and no public exploit is identified at time of analysis.
State-counter underflow in the Linux kernel's mlx5e (NVIDIA/Mellanox ConnectX) IPsec offload driver lets the eswitch mode-block reference counter (esw->offloads.num_block_mode) be decremented without a matching increment when a temporary acquire-flow security association is installed. The affected code is the mlx5e_xfrm_add_state() acquire-SA path, which skips hardware offload but still falls through to the common success label that unconditionally calls mlx5_eswitch_unblock_mode(). Fixed upstream in the stable kernel series; no public exploit identified at time of analysis and EPSS probability is low (0.21%).
Local privilege escalation in the Linux kernel's ARM FFA firmware interface allows an unprivileged local attacker to achieve arbitrary code execution by triggering an out-of-bounds write when processing PARTITION_INFO_GET descriptors. The kernel fails to validate firmware-supplied indices, enabling a heap buffer overflow that can corrupt memory. Patches are available, no public exploit exists, and EPSS indicates low exploitation probability (0.21%).
Out-of-bounds access in the Linux kernel amdgpu VCE 1 driver allows a low-privileged local attacker on systems with older AMD GPU hardware to potentially corrupt kernel memory and escalate privileges. The drm/amdgpu/vce1 driver failed to account for the firmware offset when sizing the VCPU Buffer Object, omitted alignment of stack and data offsets to the 32K TLB boundary, and lacked bounds checks ensuring firmware microcode fits reserved space - creating conditions for OOB read/write in kernel space. No public exploit code exists and EPSS stands at 0.20%, placing this in the 10th percentile for exploitation probability despite the high CVSS score.
Heap-based information disclosure and denial of service in the Linux kernel's mac80211 WiFi subsystem can be triggered by adjacent network attackers. The vulnerability arises from incorrect pointer usage during MLE defragmentation, potentially leading to kernel heap memory over-read and exposure of sensitive data, as well as system crashes. Affected kernels from version 6.9 are vulnerable until patched; no public exploit is known and EPSS indicates a low exploitation probability (0.21%).
Use-after-free vulnerability in the Linux kernel's ACPI NFIT driver allows a local attacker with low privileges to trigger a Machine Check Exception, leading to a dangling pointer dereference that can cause memory corruption, privilege escalation, or denial of service. Affected are kernel versions from commit a61fe6f7902ec (4.6-rc1) up
Heap corruption in the Linux kernel's IIO ad_sigma_delta driver allows a local attacker with low privileges to overflow the kernel heap, potentially achieving privilege escalation or causing denial of service. The flaw stems from improper handling of registerless sigma‑delta ADC devices when no ready GPIO is assigned and the reset clock count is zero. EPSS modelling indicates low exploitation likelihood (0.21%), and no active exploitation is reported; patches are available from the vendor.
Improper handling of SPI chip select and bus locking in the Linux kernel's ad_sigma_delta IIO ADC driver allows a local attacker with low privileges to leave the SPI bus in an inconsistent state. This can cause denial of service through bus contention and potential data corruption. Affected kernels include versions before specific stable patches (e.g., 6.14, 7.2-rc1), with no known active exploitation but a low EPSS score indicating minor real-world risk.
Kernel memory leak in the Linux kernel's IIO event subsystem allows local attackers to read kernel memory via a race condition. A local unauthenticated attacker with low privileges can exploit a race between file descriptor installation and FIFO reset to trigger an out-of-bounds read, potentially leaking sensitive kernel data. No active exploitation or public exploit code is currently known, and the EPSS likelihood is low (0.22%).
Out-of-bounds read/write in the Linux kernel's ALSA virtio sound driver allows a malicious hypervisor to corrupt guest memory, potentially leading to code execution or information disclosure. Affected are Linux kernel versions with the CONFIG_SND_VIRTIO option enabled, where the driver trusts device-supplied control metadata without validation. Exploitation requires a compromised or malicious host with local access to the virtualized guest; no public exploit or active exploitation has been identified.
The user asks for a comprehensive JSON analysis of CVE-2026-64485. I need to synthesize data from the provided sources. Let's examine the input carefully. CVE ID: CVE-2026-64485 Description: In the Linux kernel, ALSA: compress: Fix task creation error unwind. It details a resource leak when snd_compr_task_new() allocates driver task, and if subsequent steps fail, task_free() callback is not called, leaking driver resources. Also, an error in file descriptor allocation may not be reported correctly, leading to incorrect success reporting. CVSS: 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE: N/A EPSS: 0.21% (11th percentile) Patch: Available from vendor Reported by: Linux CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* Tags: Information Disclosure, Linux ENISA EUVD ID: EUVD-2026-48829 Affected versions (EUVD): a list of commit hashes and kernel versions. The patch refs are three git.kernel.org links. Now, I need to generate all fields as plain text strings. I'll go through each field requirement. product_name: "Linux kernel" (or "Linux Kernel"? The requirement: 1-3 words ONLY. The CVE is in the Linux kernel, specifically the ALSA compress subsystem. So "Linux Kernel" is appropriate. summary: Must be an original synthesis, 2-3 sentences. Not copying description. Start with specific impact verb and product. So: "Local privilege escalation in the Linux kernel's ALSA compress driver subsystem allows a local authenticated attacker to trigger a resource leak and potentially escalate privileges due to improper cleanup when creating an audio compress task. The vulnerability affects Linux kernels with the snd-compress module (versions as specified), and can lead to memory leaks and denial of service or arbitrary code execution. Although no public exploit is identified at time of analysis, the issue is addressed in upstream patches." I'll incorporate that the vulnerability leads to resource leak and eventually could lead to other issues. But the description doesn't explicitly men
Local privilege escalation in the Linux kernel’s cs35l41_hda audio driver allows a low-privileged user to corrupt kernel memory and execute arbitrary code. The flaw arises when firmware autostart is disabled and a firmware load work item is queued, then
Missing VGA arbiter client cleanup on vfio/pci registration failure in the Linux kernel leaves a stale callback registered against a freed vdev cookie. The displaced vfio_pci_vga_init() call in vfio_pci_core_register_device() was never paired with an unwind handler, so any failure after VGA arbiter registration exits without releasing the arbiter client. While currently mostly benign because the existing vfio_pci_set_decode() callback only dereferences pci_dev state, the stale registration becomes a live use-after-free vector once any code path makes the callback follow drvdata to the freed vfio device structure. No public exploit has been identified and EPSS is 0.22%, consistent with a latent defect rather than an actively targeted flaw.
Local privilege escalation to root via a use-after-free race condition in the Linux kernel's binder driver allows a low-privileged attacker to exploit a flaw in binder_thread_release() when a thread exit races with a parallel process death. The vulnerability affects Linux kernel versions since commit 7a4408c6bd3e and can lead to full system compromise. EPSS exploitation probability is low (0.22%), and no public exploit or active exploitation is known at time of analysis.
Local privilege escalation in the Linux kernel's binder driver allows a low-privileged attacker to execute arbitrary code with kernel rights. The vulnerability arises from a race condition in binder_free_transaction() where a freed target process can still be accessed, leading to a use-after-free. No active exploitation or public exploit code is currently known, and vendor patches are available across multiple stable kernel branches.
Reference-count corruption in the Linux kernel's rust_binder IPC driver on 32-bit kernels allows a local, low-privileged user to over-decrement binder object reference counts by submitting transactions with a crafted offsets array. The allocation cleanup path uses usize (32-bit on 32-bit kernels) as the stride and read width for 8-byte binder_size_t entries, causing an N-entry array to be walked 2N times and the object at offset 0 to receive N spurious release operations. This corrupts binder reference accounting, can produce premature BR_RELEASE notifications to object owners, and may lead to use-after-free conditions enabling privilege escalation or kernel instability. No public exploit and no CISA KEV listing identified at time of analysis; EPSS is 0.21%.
Elevation of privilege in the Linux kernel's tcpci_rt1711h USB Type-C port controller driver allows a local attacker with low privileges to potentially achieve full system compromise. The driver fails to unregister the TCPCI port when an interrupt request or alert enable step fails during device probe, leaving a stale resource that can be exploited for code execution. No active exploitation or public exploit code is known; EPSS probability is low (0.21%).
Out-of-bounds array access in the Linux kernel PCI SR-IOV subsystem crashes the kernel when a GPU or other PCIe device becomes unresponsive during a power-state restore. Inside `sriov_restore_vf_rebar_state()` (drivers/pci/iov.c:948), if the VF Resizable BAR Control register returns PCI_ERROR_RESPONSE (0xffffffff), the 3-bit `nbars` and `bar_idx` fields both evaluate to 7, which exceeds the `barsz[]` array bound of 6 (PCI_SRIOV_NUM_BARS), triggering a UBSAN array-index-out-of-bounds kernel crash. Observed in production on NVIDIA RTX PRO 1000 (GB207GLM) hardware during a failed GC6 power-state exit; no public exploit code identified at time of analysis.
Use-after-free in the Linux kernel TCP Authentication Option (TCP-AO
Memory-safety out-of-bounds read in the virtio-rng driver of the Linux kernel allows a malicious or buggy hypervisor to leak adjacent slab memory into the guest’s hardware random number stream, potentially exposing kernel heap data. The flaw triggers automatically at device probe without guest user interaction, and while no active exploitation has been observed, the fix is a hardening priority for confidential computing environments. The EPSS score (0.22%) suggests low near-term exploitation likelihood.
Use-after-free in the Linux kernel's usbio (USB I/O bridge) driver allows a local, low-privileged attacker to corrupt kernel slab memory during USB device disconnect, potentially achieving privilege escalation or triggering a kernel panic. The bug lies in usbio_disconnect(), which iterates the client list in reverse using list_for_each_entry_reverse() - a macro that reads client->link.prev after the loop body, but auxiliary_device_uninit() can free the current client before that read, dereferencing freed slab memory. Patches are confirmed in Linux stable branches 6.18.39, 7.1.4, and 7.2-rc3; no public exploit or active exploitation is identified at time of analysis.
Use-after-free in the Linux kernel's 6LoWPAN NHC handler may allow network-adjacent attackers to execute arbitrary code or trigger denial of service by sending a malformed packet. Affects kernels with 6LoWPAN support from commit 92aa7c65d295 up to the patched versions. No active exploitation or public exploit code is known; EPSS probability is low at 0.22%.
Out-of-bounds slab read in the Linux kernel TIPC (Transparent Inter-Process Communication) protocol lets a malicious TIPC neighbour trigger a heap over-read by sending a single crafted broadcast PROTOCOL/STATE_MSG carrying a Gap ACK blocks record. Affecting kernels 5.8 through the fixed stable releases, the broadcast path (tipc_bcast_sync_rcv → tipc_link_advance_transmq) fails to bound the Gap ACK record against the actual message data size, so kmemdup() copies up to 1024 bytes past a ~704-byte skb, corrupting/leaking adjacent slab memory and crashing the host (KASAN slab-out-of-bounds). No public exploit is identified at time of analysis and EPSS is low (0.22%), consistent with a niche, non-default kernel subsystem.
Local privilege escalation in Linux kernel's vme_user staging driver via an out-of-bounds write in slave read/write helpers. A local attacker can overflow the fixed-size kern_buf when the VME window exceeds 128 KiB, leading to arbitrary code execution. No active exploitation or public exploit is known, but the vulnerability has been confirmed dynamically with KASAN; EPSS indicates low exploitation probability.
Out-of-bounds read in the Linux kernel's CIFS client during SMB2 message validation allows an unauthenticated remote attacker acting as a malicious server to leak kernel memory and crash the client before session authentication. The vulnerability, which affects the smb2_check_message() function, can be triggered during NEGOTIATE or SESSION_SETUP exchanges. No active exploitation has been reported, and the EPSS probability is low (0.22%).
Double-free and use-after-free memory corruption flaws in the Linux kernel's staging Intel IPU7 media driver allow a local low-privileged user to corrupt kernel heap memory during driver initialization error paths. Two functions - ipu7_isys_init() and ipu7_psys_init() - incorrectly call kfree(pdata) after device teardown has already freed the same allocation via the ipu7_bus_release() reference-count path, producing a CWE-415 double-free. A concurrent use-after-free also occurs when ERR_CAST() dereferences the already-freed adev pointer before the function returns. No public exploit code exists and exploitation probability is low (EPSS 0.21%), but the C:H/I:H/A:H impact reflects the theoretical kernel code execution or crash potential.
Heap buffer overflow in the Linux kernel's rtl8723bs staging WiFi driver (rtw_cfg80211_set_wpa_ie()) allows a local low-privileged user to corrupt kernel memory by one byte via a crafted nl80211 connect request, enabling potential privilege escalation to kernel context. The 256-byte supplicant_ie array in struct security_priv overflows when a WPA IE with length 255 is supplied, writing 257 bytes and clobbering the adjacent last_mic_err_time field; a flawed length check in rtw_parse_wpa_ie() using u8 narrowing silently permits the overflow. Patches are available across all active stable kernels; EPSS is 0.23% and no public exploit or CISA KEV listing exists at time of analysis.
Out-of-bounds read and integer underflow in the Linux kernel staging driver rtl8723bs (Realtek RTL8723BS SDIO Wi-Fi chipset) allows an adjacent network attacker to trigger kernel memory disclosure or crash via crafted 802.11 WEP authentication frames. Two distinct bugs in OnAuth() can be triggered without authentication: a length underflow that causes crc32_le() to read far beyond the frame buffer when the Privacy bit is set on a short frame, and a fixed 128-byte memcmp in the seq=3 path that ignores the actual IE length field. No public exploit code exists and EPSS is 0.26%, reflecting the combination of adjacent-network requirement, deprecated WEP protocol dependency, and niche SDIO chipset driver.
Out-of-bounds read in the Linux kernel's rtl8723bs staging driver allows adjacent network attackers to read sensitive kernel memory and cause denial of service via a malicious association response. Exploitation requires a rogue access point sending crafted IE data. Patches are available, and no active exploitation or public exploit has been reported.
Out-of-bounds read in the Linux kernel's staging rtl8723bs Wi-Fi driver can be triggered by a malicious Access Point sending a crafted Beacon frame, allowing an adjacent attacker to read sensitive kernel memory and potentially crash the system. Affected kernels from version 4.12 onwards that include the rtl8723bs driver; vendor patches are available.
Out-of-bounds reads in the Linux kernel's rtl8723bs staging WiFi driver allow an attacker-controlled access point to leak kernel memory or crash affected systems by sending beacon or probe-response frames with a truncated final information element. Two IE-parsing loops in issue_assocreq() and join_cmd_hdl() dereference pIE->length without first verifying that at least sizeof(*pIE) bytes remain in the buffer, so a one-byte stub IE at the end of AP-supplied data reads one byte past the buffer end. No public exploit has been identified at time of analysis, and EPSS sits at 0.22%, consistent with the adjacent-network attack vector and niche driver footprint.
Out-of-bounds reads in the Linux kernel's rtl8723bs staging WiFi driver allow an adjacent unauthenticated attacker to leak kernel memory or crash the system by sending crafted 802.11 management frames containing malformed WPA, WAPI, or WPS Information Elements. Three IE parsing functions - rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - lack bounds validation before reading multi-byte header fields and OUI comparisons, exposing raw kernel buffer contents to an adversary within WiFi range. No public exploit or active exploitation has been identified; vendor-released patches are available across all supported stable branches.
Out-of-bounds write in the Linux kernel's rtl8723bs staging Wi-Fi driver when processing a maliciously crafted 802.11 Association Response frame. An attacker within Wi-Fi range can send an oversized HT Capabilities IE, leading to up to 229 bytes of kernel memory corruption, resulting in high integrity and availability impact with no user interaction or authentication required. No public exploit or active exploitation is known; EPSS indicates very low exploitation probability (0.22%).
Use-after-free in the Linux kernel's crypto/krb5 helper library (introduced in 6.15) occurs when Kerberos AEAD encrypt/decrypt operations are backed by an asynchronous AEAD implementation. The synchronous helpers in rfc3961_simplified.c and rfc8009_aes2.c set a NULL completion callback and treat any negative return as terminal, so an async backend returning -EINPROGRESS causes the buffer to be freed with kfree_sensitive() while the backend worker still dereferences it. This is reachable through kernel consumers of krb5 crypto (rxrpc/rxgk, AFS cm_security, and Ceph), but only on systems where an async AEAD provider is bound to the krb5 enctype name; no public exploit identified at time of analysis and EPSS is low at 0.21%.
Use-after-free in the Linux kernel's Intel QuickAssist Technology (QAT) SR-IOV driver allows a local low-privileged attacker - including a VM tenant with a VF assigned - to corrupt host kernel memory by racing VF2PF workqueue processing against SR-IOV teardown in adf_disable_sriov(). The VF2PF interrupt handler enqueues work that holds raw pointers to per-VF state (struct adf_accel_vf_info); adf_disable_sriov() freed that state without draining in-flight workers, enabling a concurrent worker to deref freed memory. No public exploit is known at time of analysis, and EPSS is 0.22% (13th percentile), indicating negligible observed exploitation pressure despite the 8.8 CVSS score.
Use-after-free in the Linux kernel's ksmbd (SMB server) allows authenticated remote attackers to trigger memory corruption, potentially leading to arbitrary code execution or denial of service. The flaw occurs when an SMB2_CLOSE on a locked file is followed by an SMB2_CANCEL, causing a freed file_lock to be re-accessed. A patch is available for affected kernel versions, and while no active exploitation is confirmed, a proof-of-concept exists; EPSS indicates low exploitation likelihood.
Uninitialized memory read in the Linux kernel's PF_KEY IPComp implementation allows local unprivileged users to disclose kernel memory or cause a denial of service. The vulnerability arises from a missing initialization of the alg_key_len field in the xfrm_algo structure when adding IPComp security associations, leading to an out-of-bounds slab read during XFRM state migration. Affected are all Linux kernels since version 2.6.21, with patches backported to multiple stable series.
A data race condition in the Linux kernel's audit subsystem allows local attackers to cause denial of service and minimal integrity impact by exploiting unsynchronized reads of the audit queue length. The flaw affects kernel versions from 4.10 through the unpatched stable series, triggered when concurrent readers and writers access the queue without proper locking,
Use-after-free in the Linux kernel's Bluetooth L2CAP subsystem can be triggered by an adjacent attacker, potentially leading to arbitrary code execution or kernel memory corruption. The flaw occurs when a channel timeout callback races with connection teardown, allowing a freed connection object to be accessed. Patched kernels are available; no active exploitation is confirmed, but the vulnerability is remotely exploitable within Bluetooth range without authentication or user interaction.
Use-after-free in the Linux kernel Bluetooth MGMT subsystem allows a local attacker with low privileges to trigger kernel memory corruption via a race condition between add_device and remove_device operations. The flaw exists in add_device_complete(), which dereferences a hci_conn_params pointer without holding hci_dev_lock, while a concurrent MGMT_OP_REMOVE_DEVICE path frees the same object under that lock. KASAN confirms exploitation as slab-use-after-free; no public exploit or active exploitation (CISA KEV) has been identified, and patches have been released across multiple stable branches.
Heap-based out-of-bounds write in the Linux kernel's ntfs3 filesystem driver during journal replay allows local attackers to achieve kernel code execution by mounting a malicious NTFS image. The vulnerability exists because log_replay() does not validate Dirty Page Table capacity against attacker-controlled fields, leading to a slab corruption. No active exploitation or public exploit code has been identified, and the attack requires user interaction to mount a crafted filesystem.
Out-of-bounds memory write in the Linux kernel's legacy NTFS driver allows a local attacker with filesystem mount privileges to corrupt kernel heap memory via a crafted NTFS image. The flaw lives in `ntfs_icx_ib_sync_write()`, which unconditionally calls `post_write_mst_fixup()` even when `pre_write_mst_fixup()` has already rejected the index block as invalid - the caller does not distinguish between I/O errors and validation failures. By manipulating `usa_ofs` or `usa_count` fields in the NTFS index block, an attacker can drive both slab-out-of-bounds reads and writes into the kernel, as confirmed by KASAN traces in the bug report. No public exploit or CISA KEV listing exists; EPSS is 0.20%.
A denial-of-service flaw in the Linux kernel's NTB EPF driver can cause a kernel panic or system crash when the interrupt handler calls pci_irq_vector() in hardirq context. An attacker with local access to a system using this specialized hardware driver could trigger the issue. At the time of analysis, no public exploit or active exploitation has been reported, and EPSS indicates low exploitation probability (0.21%).
Use-after-free memory corruption in the Linux kernel's netpoll subsystem allows a local attacker or concurrent kernel path to access freed memory during the netpoll shutdown sequence. The flaw exists because cancel_delayed_work() - called from softirq context during __netpoll_cleanup() - does not block until the TX worker finishes, permitting queue_process() to dereference a kfree'd npinfo struct via container_of(). KASAN confirms the UAF; patches are available across multiple stable kernel branches, and no public exploit or KEV listing exists at time of analysis.
Use-after-free in the Linux kernel IPv4 IGMP subsystem allows a local low-privileged attacker to trigger kernel memory corruption or a system crash by racing network device destruction against concurrent multicast group lookups in softirq context. During ip_mc_destroy_dev(), multicast membership entries are scheduled for RCU reclamation via ip_ma_put() but are not unlinked from the per-device mc_hash table; concurrent softirq-path readers such as ip_check_mc_rcu() can then dereference a freed slab object, as confirmed by the embedded KASAN trace showing a read of freed memory during UDP packet processing. No public exploit code or CISA KEV listing exists at time of analysis; Ubuntu USN-8726/8727-1 and a Siemens ICS advisory confirm active patching across distributions.
Integer overflow in the Linux kernel's TCP networking subsystem (net/ipv4) allows a local user with network-namespace privileges to trigger an out-of-bounds read, potentially disclosing kernel memory or crashing the system. Writing a negative integer to the `net.ipv4.tcp_reordering` sysctl causes a silent type-coercion wrap when the value is copied into the `u32 tp->reordering` field, producing an enormous effective value. When `tcp_mtu_probing=2` is also active, this wrapped value overflows the `size_needed` computation in `tcp_mtu_probe()`, bypassing send-queue and window bounds checks entirely, leading to a CWE-190 integer overflow driving a subsequent out-of-bounds read. No public exploit and no KEV listing have been identified at time of analysis; EPSS is 0.23%.
Use-after-free memory corruption in the Linux kernel's NXP i.MX8 ISI (Image Sensing Interface) media driver is triggered during module removal (rmmod of imx8_isi), confirmed by KASAN slab-use-after-free reports. The root cause is an incorrect teardown order in mxc_isi_remove(): the crossbar cleanup frees media entity pads before the V4L2 cleanup has finished removing media links that reference those same pads, resulting in a dangling pointer dereference in __media_entity_remove_link(). No public exploit has been identified at time of analysis, and with EPSS at 0.21% (11th percentile), real-world weaponization appears unlikely despite the CVSS 7.8 score.
Use-after-free in the Linux kernel's cros_ec driver enables a local low-privileged attacker to potentially escalate privileges or compromise system integrity on devices with ChromeOS Embedded Controller hardware. The flaw stems from dev_set_drvdata() being called too early in ec_device_probe(), allowing sub-drivers like cros_ec_typec to access a stale pointer after probe failure. No public exploit code or active exploitation has been identified, and EPSS is low (0.22%).
A race condition in the Linux kernel's shrinker subsystem can cause use-after-free or double-free memory errors during memory cgroup creation and teardown. Local attackers with low privileges may exploit this to escalate privileges to kernel level, leading to full system compromise (confidentiality, integrity, and availability impact). Patches are available in multiple stable kernel branches; no active exploitation is reported (CISA KEV not listed), and the EPSS exploitation probability is low (0.21%).
Remote denial-of-service in Linux kernel netfilter allows unauthenticated attackers to crash the system by sending crafted network packets containing unreadable socket buffer fragments (e.g., from devmem TCP). Affected components include xt_u32, nfnetlink_queue, and nfnetlink_log, which mishandle the error return from sk
Memory corruption in the Linux kernel's netfilter ebtables module can occur from an uninitialized pointer free during chainstack array cleanup. The flaw is triggered only under rare, non-default conditions—a sparse CPU possible mask and a failed memory allocation—making real-world exploitation extremely unlikely. No active exploitation or public exploit is known.
Information disclosure and denial of service in the Linux kernel's netfilter ebtables subsystem allows a local attacker with low privileges to leak kernel memory or cause a system crash. The vulnerability arises from a missing null-termination check on module names before passing them to request_module(), potentially exposing uninitialized kernel memory. No public exploit or active exploitation has been identified, and the EPSS score indicates a low probability of widespread exploitation.
Stack buffer over-read in the Linux kernel's netfilter ebtables module allows a local attacker with low privileges to read kernel stack data and potentially crash the system. When updating ebtables counters, a 32-byte user-supplied table name is passed without NUL-termination to a kernel function that uses it in a module autoload request, causing vsnprintf to read beyond the stack buffer. No active exploitation or public exploit code is known, and EPSS indicates a low exploitation probability (0.22%).
Insufficient validation in the Linux kernel's netfilter flowtable hardware offload for IPIP tunnels could allow a remote attacker to cause information disclosure or denial of service. The flaw exists because the kernel would attempt to enqueue hardware offload work for IPIP tunnels despite no driver supporting it, leading to an unspecified impact when the unsupported configuration is processed. The issue is fixed by adding an early check to skip unsupported offload setup. No public exploit code is
Use-after-free race condition in the Linux kernel's Bluetooth BNEP subsystem allows an adjacent unauthenticated attacker to corrupt kernel memory or crash the system. During netdev registration via bnep_add_connection(), the L2CAP connection is read without holding the channel lock; if controller teardown occurs concurrently, the freed parent device is dereferenced by the network device registration path. The fix takes a reference to the L2CAP connection under the channel lock and retains it until register_netdev() secures its own parent device reference. No public exploit or CISA KEV listing has been identified at time of analysis, and the 0.22% EPSS score reflects low active exploitation probability.
Out-of-bounds memory read in the Linux kernel's btnxpuart Bluetooth driver exposes kernel memory to a malicious or compromised NXP Bluetooth UART controller. The vulnerability exists in nxp_recv_fw_req_v3(), which handles firmware download requests during v3 controller initialization: when the controller supplies a crafted 32-bit offset or 16-bit length value that pushes past the end of the firmware image, the driver reads arbitrary kernel memory and transmits it back to the controller over UART. The parallel v1 path (nxp_recv_fw_req_v1()) already contained the equivalent bounds check; the v3 path lacked it. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.21% (11th percentile), consistent with the narrow local/hardware attack surface.
Use-after-free in the Linux kernel Bluetooth subsystem's bt_accept_dequeue() function allows an attacker with local or adjacent Bluetooth access to corrupt kernel heap memory or crash the system during L2CAP listening socket teardown. The bug stems from a reference-count sequencing error: the temporary queue-walk reference is dropped before bt_accept_unlink() removes the socket from the accept queue and drops its own reference, so if that was the final reference, the subsequent sock_hold() call dereferences freed slab memory. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS is 0.22% (13th percentile), consistent with low opportunistic exploitation risk.
Out-of-bounds read in the Linux kernel's Bluetooth L2CAP configuration option parser allows an adjacent attacker to crash the system or leak up to 4 bytes of kernel memory. The vulnerability arises from a validate-after-use bug where an attacker-controlled option length is dereferenced before checking bounds, affecting all Bluetooth-enabled kernels prior to the fix
Out-of-bounds write in the Linux kernel's CoreSight ultrasoc-smb driver when used as a perf AUX sink allows a local attacker to elevate privileges. The vulnerability arises from improper page index normalization in smb_sync_perf_buffer(), leading to a heap buffer overflow. Although no active exploitation or public proof-of-concept is known, the weakness has been patched upstream and carries an EPSS score of 0.21%.
Local privilege escalation in the Linux kernel's SMB client witness notification handler allows a low-privileged attacker to exploit a use-after-free condition. Affected are Linux kernel versions 5.11 and later that have the CIFS witness feature enabled. Successful exploitation can lead to arbitrary code execution with elevated privileges, fully compromising the system.
Path traversal bypass in the Linux kernel's ksmbd SMB server allows authenticated users with write access to a share to create zero-length files or directories outside the exported share boundary. The flaw exists only when the share is configured with case-insensitive (caseless) filename handling. Patches are available; the vulnerability is not known to be actively exploited, has a low EPSS score (0.26%), and no public exploit has been identified.
Improper authorization in the Linux kernel's ksmbd (in-kernel SMB3 server) lets an authenticated SMB client overwrite destination file data it should not be able to write. The FSCTL_DUPLICATE_EXTENTS_TO_FILE branch of smb2_ioctl() performs a server-side block clone via vfs_clone_file_range() but omits the share-level writable check and the per-handle access check that every other write-bearing ioctl arm enforces, so data can be overwritten on a read-only share or through a handle opened with only FILE_WRITE_ATTRIBUTES. This is an integrity/authorization bug (not memory corruption); there is no public exploit identified at time of analysis and EPSS is low (0.21%).
Data zeroing attack in the Linux kernel's ksmbd SMB server allows an authenticated client to destroy file contents without requiring FILE_WRITE_DATA permission. A handle opened with only FILE_WRITE_ATTRIBUTES is sufficient to send FSCTL_SET_ZERO_DATA, bypassing the missing per-handle access check. Publicly available exploit code exists, and vendor patches have been released.
Use-after-free vulnerability in the Linux kernel's ksmbd SMB server allows remote attackers to execute arbitrary code. All kernel versions with ksmbd enabled from early commits up to the patched releases are affected, and the issue can be triggered by concurrent QUERY_DIRECTORY requests on the same file handle. A fix is available via multiple stable kernel branches, no active exploitation is reported in KEV, and EPSS indicates a low probability of widespread exploitation (0.21%).
Use-after-free in Linux kernel’s ksmbd SMB server occurs during deferred byte-range lock cancellation, allowing an authenticated attacker to potentially execute arbitrary code or crash the system. The vulnerability affects ksmbd versions prior to the released fixes (6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, 7.2-rc1). No active exploitation has been confirmed (no CISA KEV listing), and EPSS indicates a low probability of widespread exploitation.
Unauthorized information disclosure in Linux kernel's ksmbd module allows remote unauthenticated attackers to copy arbitrary file contents on SMB shares by exploiting a missing access check on the FSCTL_DUPLICATE_EXTENTS_TO_FILE operation. Attackers with only attribute access to a source file can read its contents without requiring the FILE_READ_DATA permission. No public exploit or active exploitation has been identified, though the vulnerability is patchable via kernel updates.
Authorization bypass in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated network client to rewrite any accessible file's security descriptor - including DACL and owner - without holding WRITE_DAC or WRITE_OWNER rights on the file handle. A client opening a handle with only FILE_WRITE_ATTRIBUTES can issue SMB2 SET_INFO with InfoType SMB2_O_INFO_SECURITY to invoke set_info_sec(), which rewrites POSIX ACLs, ownership via notify_change(), and (on KSMBD_SHARE_FLAG_ACL_XATTR shares) the Windows SD xattr, all without any fp->daccess gate. No public exploit has been identified; EPSS is 0.22%, and patches are confirmed in kernel stable series 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1.
Unauthorized file modification in the Linux kernel's ksmbd SMB server allows remote attackers to modify file data and attributes by exploiting a credential confusion in SMB2 SET_INFO handlers. The vulnerability arises because the VFS operations used after permission checks run with the ksmbd worker credentials rather than the opener's credentials, effectively bypassing ownership and permission restrictions. No public exploit is known and EPSS is low (0.21%), but the network-accessible, low-complexity nature makes critical
Filesystem permission bypass in the Linux kernel's in-kernel SMB server (ksmbd) allows an authenticated SMB client to delete base files and Alternate Data Stream (ADS) xattrs it should not be permitted to remove. When a delete-on-close is finalized during deferred or durable handle teardown - a code path with no associated request work - the unlink and ADS removal executed with the ksmbd worker's credentials rather than the opening user's, skipping the fsuid/fsgid/supplementary-group/capability checks. No public exploit is identified at time of analysis; EPSS is low (0.22%, 13th percentile) and it is not in CISA KEV.
Unauthorized read/write of Alternate Data Streams in Linux ksmbd allows remote attackers to access or modify file extended attributes. The vulnerability, present in Linux kernel versions with ksmbd up to before patches 6.18.39, 6.12.96, 7.1.4
Memory corruption in the Linux kernel's ksmbd SMB server allows authenticated remote code execution. A race condition in byte-range lock ownership tracking can lead to use-after-free when SMB3 multichannel is enabled, enabling an attacker with low privileges to escalate to full system compromise. No public exploit or active exploitation is known, and EPSS indicates low exploitation probability.
Session key corruption in the Linux kernel's ksmbd SMB server allows a network attacker to overwrite an existing session's NTLMv2 session key (`sess->sess_key`) despite a failed authentication attempt. The flaw lies in the SMB3 multichannel binding path: `ksmbd_auth_ntlmv2()` derives the base session key into `sess->sess_key` before verifying the NTLMv2 proof, and the binding session error path does not expire the binding session, so a crafted SESSION_SETUP with a bad NT proof plus KEY_XCH arc4_crypt payload corrupts the live session key before `STATUS_LOGON_FAILURE` is returned. No public exploit has been identified at time of analysis; EPSS is 0.25% (16th percentile), consistent with a race-and-config-gated server-side flaw.
Silent ownership update failure in the Linux kernel's SMB/CIFS client allows local users mounting SMB3 shares with POSIX Extensions to have chown/chgrp operations silently dropped by the kernel unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID flags are also explicitly set. The root cause is a missing posix_extensions check in cifs_setattr_nounix() that prevented id_mode_to_cifs_acl() from being invoked to relay ownership changes to the server. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% (10th percentile) reflects low exploitation likelihood for what is primarily a logic/correctness defect.
Double-free memory corruption in the Linux kernel SMB client when processing SMB2 QUERY_DIRECTORY responses. A remote attacker acting as a malicious SMB server can trigger the issue during directory enumeration, potentially leading to arbitrary code execution or denial of service on any unpatched Linux system that mounts an attacker-controlled share. The vulnerability is not known to be actively exploited, but patches are available across multiple stable kernel branches.
Double free in the Linux kernel's SMB client due to improper cleanup of response buffers when a reply error is replayed. An attacker controlling an SMB server can trigger memory corruption, potentially leading to code execution or a system crash, when a vulnerable client connects and processes a crafted response. Patches are available in multiple stable kernel branches, but no active exploitation or public exploit has been reported.
Double-free vulnerability in the Linux kernel's SMB client (cifs) allows remote code execution via crafted SMB2_ioctl replies. An attacker hosting a malicious SMB server can trigger a replay path memory double-free, leading to full system compromise. No active exploitation or public exploit has been identified at this time; EPSS score is low (0.21%).
Denial-of-service (kernel memory corruption) in the Linux kernel's cifs/smb client affects the SMB2 CHANGE_NOTIFY replay path. When a response-bearing notify attempt returns a replayable error and frees its response buffer, stale resp_buftype/rsp_iov bookkeeping is retained across attempts; if SMB2_notify_init() then fails before the next send, cleanup frees the already-freed response a second time (CWE-415 double-free). Exploitation requires a malicious or man-in-the-middle SMB server and winning a replay/retry-failure race, so real-world risk is DoS-leaning; no public exploit is identified and EPSS is low at 0.21%.
Double-free memory corruption in the Linux kernel's SMB client (cifs) affects the SMB2_flush() replay path across many stable branches prior to 6.6.145, 6.12.96, 6.18.39 and 7.1.4. When a mounted client receives a replayable flush response and the subsequent retry fails before cifs_send_recv() installs a replacement response, flush_exit frees the stale response buffer a second time, corrupting kernel slab memory and typically crashing the client. No public exploit is identified at time of analysis (EPSS 0.21%, 11th percentile) and it is not in CISA KEV; exploitation requires a malicious or man-in-the-middle SMB server plus a replay/retry timing race, making it primarily a denial-of-service concern despite the 9.8 rating.
Double-free in the Linux kernel SMB client's SMB2_open() replay handler allows remote attackers to corrupt memory by inducing a user to mount a malicious SMB share. The flaw affects unpatched kernel versions with the cifs module loaded and can lead to arbitrary code execution, information disclosure, or denial of service. No active exploitation has been reported (not in CISA KEV), and EPSS score is 0.21%, indicating low exploitation probability; official kernel patches are available.
Memory leak in the Linux kernel's SMB client encrypted receive path (receive_encrypted_standard()) allows a local low-privileged user or a cooperative malicious SMB server to exhaust kernel heap memory, with potential for heap grooming-based privilege escalation. The bug was introduced with commit b24df3e30cbf and affects multiple stable kernel series from 4.19 onward. No public exploit code exists and EPSS is 0.22%, but the kernel team's classification of CWE-787 and a C:H/I:H/A:H CVSS score reflect the Linux security team's assessment that the leaked kernel buffer is exploitable beyond simple resource exhaustion.
Out-of-bounds read in the Linux kernel's SMB/CIFS client POSIX SID parser allows a malicious or MITM SMB server to cause kernel memory disclosure and denial of service on connecting clients. The `posix_info_sid_size()` helper reads `sid[1]` (the SubAuthorityCount byte) after validating only one remaining byte, permitting a truncated server-supplied POSIX SID to trigger a one-byte OOB read - leaking a byte of kernel heap context (C:L) and risking a crash (A:H). No public exploit code exists and EPSS is 0.22%, but the vulnerability is client-facing and triggered entirely from the server side without client-side privilege. Patches are available across all maintained stable branches.
Improper mode masking in the Linux kernel SMB client when the modefromsid mount option is used allows a remote attacker to cause denial of service and limited integrity impact via a crafted SMB response. The vulnerability arises because parse_dacl() fails to mask server-provided mode bits to 07777, potentially setting unexpected permission bits on files. No public exploit is identified at time of analysis.
The Linux kernel writeback subsystem crashes with a use-after-free during container exit due to a race between cgroup_writeback_umount() and inode_switch_wbs(). An in-flight writeback-context switch can pass the SB_ACTIVE check and take an inode reference before the filesystem unmount clears SB_ACTIVE, but delay queuing its work item - causing the umount path to flush a workqueue that has nothing pending, destroy percpu counters via put_super(), and then have the deferred switch work invoke percpu_counter_dec() on freed memory, triggering a BUG_ON or silent UAF. No public exploit is identified at time of analysis; EPSS stands at 0.21% (12th percentile) with no CISA KEV listing.
Double-free memory corruption in the Linux kernel's Qualcomm CPU frequency hardware driver (qcom-cpufreq-hw) allows a local low-privileged attacker on Qualcomm SoC-based systems to trigger kernel heap corruption, potentially escalating privileges to root. The flaw originates in qcom_cpufreq_hw_cpu_exit(), which incorrectly calls kfree() on memory allocated via devm_kzalloc() - memory already tracked by the kernel's device resource management (devres) system. This results in a double-free when the platform device is subsequently detached and devres performs its own cleanup. No public exploit code exists and EPSS is low (0.21%), consistent with a static-analysis discovery rather than active exploitation.
Privilege escalation in the Linux kernel /proc filesystem allows a local attacker to bypass ptrace access restrictions when reading symbolic links in /proc/[pid]/fd/. By racing the task lookup and access check, an unauthenticated local user can gain unauthorized read and write access to sensitive file descriptors of other processes, potentially leading to full system compromise. The vulnerability affects a wide range of kernel versions and has a patch released by the Linux kernel project.
Linux kernel real-time scheduling on non-PREEMPT_RT builds (kernel 4.1 through multiple stable branches) can be livelocked on large multi-CPU systems via the RT_PUSH_IPI mechanism. When a CPU is saturated with softirqs in hardirq context and simultaneously targeted by repeated IPIs from other CPUs attempting to pull overloaded RT tasks, the IPI flood degrades softirq performance until the CPU can never return to task context, permanently removing it from the scheduler. No public exploit exists; EPSS is 0.22% (13th percentile), and no KEV listing is present, reflecting the workload-specific nature of the condition.
Local privilege escalation in the Linux kernel's pcc-cpufreq driver allows a low-privileged user to gain full root privileges. The vulnerability is a use-after-free and double-free flaw when evaluating ACPI _OSC negotiation, affecting all kernel versions from 2.6.34 until the fixed stable releases (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1). No active exploitation or public exploit has been identified, and EPSS indicates a low probability of widespread exploitation.
Memory disclosure in the Linux kernel's SLUB allocator allows local attackers to read uninitialized kernel memory when specific slab debugging options are enabled. The issue occurs when red zoning is active without store_user tracking, causing krealloc() to violate the __GFP_ZERO contract and return partially zeroed allocations. This can leak sensitive data, with an EPSS probability of 0.21% and no known active exploitation, though a vendor patch is available.
Local privilege escalation via stack buffer overflow in the Linux kernel's hid-goodix-spi driver allows a user with access to a Goodix SPI HID device node to corrupt kernel stack memory and achieve full system compromise. The goodix_hid_set_raw_report() function copies caller-supplied report data into a fixed 128-byte stack buffer without bounds checking, so a hidraw SET_REPORT ioctl carrying more than ~116 bytes overflows it. There is no public exploit identified at time of analysis, and the low EPSS score (0.23%) plus the local-only, hardware-specific attack surface indicate limited real-world exposure despite the high 7.8 CVSS.
Out-of-bounds write in the Linux kernel's HID wacom driver allows an adjacent attacker to corrupt kernel memory, potentially achieving code execution or crashing the system. The flaw, present in kernels from commit 5e013ad2... up to the fixed versions 6.18.39, 7.1.4, and 7.2-rc1, stems from a missing emptiness check that causes the FIFO to read stale data and bypass the buffer size guard. No active exploitation or public exploit code has been identified, and EPSS predicts a low exploitation probability (0.22%).
Use-after-free in the Linux kernel net/handshake subsystem allows a struct socket to be torn down while the handshake netlink accept path still holds a pointer to it. The submit path only took a sock_hold(), which keeps struct sock alive via sk_refcnt but does not pin the struct socket (owned by sock->file); once the userspace handshake agent releases the last file reference, sock_release() destroys the socket, leaving handshake_nl_accept_doit() dereferencing freed memory. Fixed versions are available (6.12.93, 7.0.12, 7.1); EPSS is low at 0.21% and no public exploit is identified at time of analysis.
State-counter underflow in the Linux kernel's mlx5e (NVIDIA/Mellanox ConnectX) IPsec offload driver lets the eswitch mode-block reference counter (esw->offloads.num_block_mode) be decremented without a matching increment when a temporary acquire-flow security association is installed. The affected code is the mlx5e_xfrm_add_state() acquire-SA path, which skips hardware offload but still falls through to the common success label that unconditionally calls mlx5_eswitch_unblock_mode(). Fixed upstream in the stable kernel series; no public exploit identified at time of analysis and EPSS probability is low (0.21%).
Local privilege escalation in the Linux kernel's ARM FFA firmware interface allows an unprivileged local attacker to achieve arbitrary code execution by triggering an out-of-bounds write when processing PARTITION_INFO_GET descriptors. The kernel fails to validate firmware-supplied indices, enabling a heap buffer overflow that can corrupt memory. Patches are available, no public exploit exists, and EPSS indicates low exploitation probability (0.21%).
Out-of-bounds access in the Linux kernel amdgpu VCE 1 driver allows a low-privileged local attacker on systems with older AMD GPU hardware to potentially corrupt kernel memory and escalate privileges. The drm/amdgpu/vce1 driver failed to account for the firmware offset when sizing the VCPU Buffer Object, omitted alignment of stack and data offsets to the 32K TLB boundary, and lacked bounds checks ensuring firmware microcode fits reserved space - creating conditions for OOB read/write in kernel space. No public exploit code exists and EPSS stands at 0.20%, placing this in the 10th percentile for exploitation probability despite the high CVSS score.
Heap-based information disclosure and denial of service in the Linux kernel's mac80211 WiFi subsystem can be triggered by adjacent network attackers. The vulnerability arises from incorrect pointer usage during MLE defragmentation, potentially leading to kernel heap memory over-read and exposure of sensitive data, as well as system crashes. Affected kernels from version 6.9 are vulnerable until patched; no public exploit is known and EPSS indicates a low exploitation probability (0.21%).
Use-after-free vulnerability in the Linux kernel's ACPI NFIT driver allows a local attacker with low privileges to trigger a Machine Check Exception, leading to a dangling pointer dereference that can cause memory corruption, privilege escalation, or denial of service. Affected are kernel versions from commit a61fe6f7902ec (4.6-rc1) up
Heap corruption in the Linux kernel's IIO ad_sigma_delta driver allows a local attacker with low privileges to overflow the kernel heap, potentially achieving privilege escalation or causing denial of service. The flaw stems from improper handling of registerless sigma‑delta ADC devices when no ready GPIO is assigned and the reset clock count is zero. EPSS modelling indicates low exploitation likelihood (0.21%), and no active exploitation is reported; patches are available from the vendor.
Improper handling of SPI chip select and bus locking in the Linux kernel's ad_sigma_delta IIO ADC driver allows a local attacker with low privileges to leave the SPI bus in an inconsistent state. This can cause denial of service through bus contention and potential data corruption. Affected kernels include versions before specific stable patches (e.g., 6.14, 7.2-rc1), with no known active exploitation but a low EPSS score indicating minor real-world risk.
Kernel memory leak in the Linux kernel's IIO event subsystem allows local attackers to read kernel memory via a race condition. A local unauthenticated attacker with low privileges can exploit a race between file descriptor installation and FIFO reset to trigger an out-of-bounds read, potentially leaking sensitive kernel data. No active exploitation or public exploit code is currently known, and the EPSS likelihood is low (0.22%).
Out-of-bounds read/write in the Linux kernel's ALSA virtio sound driver allows a malicious hypervisor to corrupt guest memory, potentially leading to code execution or information disclosure. Affected are Linux kernel versions with the CONFIG_SND_VIRTIO option enabled, where the driver trusts device-supplied control metadata without validation. Exploitation requires a compromised or malicious host with local access to the virtualized guest; no public exploit or active exploitation has been identified.
The user asks for a comprehensive JSON analysis of CVE-2026-64485. I need to synthesize data from the provided sources. Let's examine the input carefully. CVE ID: CVE-2026-64485 Description: In the Linux kernel, ALSA: compress: Fix task creation error unwind. It details a resource leak when snd_compr_task_new() allocates driver task, and if subsequent steps fail, task_free() callback is not called, leaking driver resources. Also, an error in file descriptor allocation may not be reported correctly, leading to incorrect success reporting. CVSS: 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE: N/A EPSS: 0.21% (11th percentile) Patch: Available from vendor Reported by: Linux CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* Tags: Information Disclosure, Linux ENISA EUVD ID: EUVD-2026-48829 Affected versions (EUVD): a list of commit hashes and kernel versions. The patch refs are three git.kernel.org links. Now, I need to generate all fields as plain text strings. I'll go through each field requirement. product_name: "Linux kernel" (or "Linux Kernel"? The requirement: 1-3 words ONLY. The CVE is in the Linux kernel, specifically the ALSA compress subsystem. So "Linux Kernel" is appropriate. summary: Must be an original synthesis, 2-3 sentences. Not copying description. Start with specific impact verb and product. So: "Local privilege escalation in the Linux kernel's ALSA compress driver subsystem allows a local authenticated attacker to trigger a resource leak and potentially escalate privileges due to improper cleanup when creating an audio compress task. The vulnerability affects Linux kernels with the snd-compress module (versions as specified), and can lead to memory leaks and denial of service or arbitrary code execution. Although no public exploit is identified at time of analysis, the issue is addressed in upstream patches." I'll incorporate that the vulnerability leads to resource leak and eventually could lead to other issues. But the description doesn't explicitly men
Local privilege escalation in the Linux kernel’s cs35l41_hda audio driver allows a low-privileged user to corrupt kernel memory and execute arbitrary code. The flaw arises when firmware autostart is disabled and a firmware load work item is queued, then
Missing VGA arbiter client cleanup on vfio/pci registration failure in the Linux kernel leaves a stale callback registered against a freed vdev cookie. The displaced vfio_pci_vga_init() call in vfio_pci_core_register_device() was never paired with an unwind handler, so any failure after VGA arbiter registration exits without releasing the arbiter client. While currently mostly benign because the existing vfio_pci_set_decode() callback only dereferences pci_dev state, the stale registration becomes a live use-after-free vector once any code path makes the callback follow drvdata to the freed vfio device structure. No public exploit has been identified and EPSS is 0.22%, consistent with a latent defect rather than an actively targeted flaw.
Local privilege escalation to root via a use-after-free race condition in the Linux kernel's binder driver allows a low-privileged attacker to exploit a flaw in binder_thread_release() when a thread exit races with a parallel process death. The vulnerability affects Linux kernel versions since commit 7a4408c6bd3e and can lead to full system compromise. EPSS exploitation probability is low (0.22%), and no public exploit or active exploitation is known at time of analysis.
Local privilege escalation in the Linux kernel's binder driver allows a low-privileged attacker to execute arbitrary code with kernel rights. The vulnerability arises from a race condition in binder_free_transaction() where a freed target process can still be accessed, leading to a use-after-free. No active exploitation or public exploit code is currently known, and vendor patches are available across multiple stable kernel branches.
Reference-count corruption in the Linux kernel's rust_binder IPC driver on 32-bit kernels allows a local, low-privileged user to over-decrement binder object reference counts by submitting transactions with a crafted offsets array. The allocation cleanup path uses usize (32-bit on 32-bit kernels) as the stride and read width for 8-byte binder_size_t entries, causing an N-entry array to be walked 2N times and the object at offset 0 to receive N spurious release operations. This corrupts binder reference accounting, can produce premature BR_RELEASE notifications to object owners, and may lead to use-after-free conditions enabling privilege escalation or kernel instability. No public exploit and no CISA KEV listing identified at time of analysis; EPSS is 0.21%.
Elevation of privilege in the Linux kernel's tcpci_rt1711h USB Type-C port controller driver allows a local attacker with low privileges to potentially achieve full system compromise. The driver fails to unregister the TCPCI port when an interrupt request or alert enable step fails during device probe, leaving a stale resource that can be exploited for code execution. No active exploitation or public exploit code is known; EPSS probability is low (0.21%).
Out-of-bounds array access in the Linux kernel PCI SR-IOV subsystem crashes the kernel when a GPU or other PCIe device becomes unresponsive during a power-state restore. Inside `sriov_restore_vf_rebar_state()` (drivers/pci/iov.c:948), if the VF Resizable BAR Control register returns PCI_ERROR_RESPONSE (0xffffffff), the 3-bit `nbars` and `bar_idx` fields both evaluate to 7, which exceeds the `barsz[]` array bound of 6 (PCI_SRIOV_NUM_BARS), triggering a UBSAN array-index-out-of-bounds kernel crash. Observed in production on NVIDIA RTX PRO 1000 (GB207GLM) hardware during a failed GC6 power-state exit; no public exploit code identified at time of analysis.
Use-after-free in the Linux kernel TCP Authentication Option (TCP-AO
Memory-safety out-of-bounds read in the virtio-rng driver of the Linux kernel allows a malicious or buggy hypervisor to leak adjacent slab memory into the guest’s hardware random number stream, potentially exposing kernel heap data. The flaw triggers automatically at device probe without guest user interaction, and while no active exploitation has been observed, the fix is a hardening priority for confidential computing environments. The EPSS score (0.22%) suggests low near-term exploitation likelihood.
Use-after-free in the Linux kernel's usbio (USB I/O bridge) driver allows a local, low-privileged attacker to corrupt kernel slab memory during USB device disconnect, potentially achieving privilege escalation or triggering a kernel panic. The bug lies in usbio_disconnect(), which iterates the client list in reverse using list_for_each_entry_reverse() - a macro that reads client->link.prev after the loop body, but auxiliary_device_uninit() can free the current client before that read, dereferencing freed slab memory. Patches are confirmed in Linux stable branches 6.18.39, 7.1.4, and 7.2-rc3; no public exploit or active exploitation is identified at time of analysis.
Use-after-free in the Linux kernel's 6LoWPAN NHC handler may allow network-adjacent attackers to execute arbitrary code or trigger denial of service by sending a malformed packet. Affects kernels with 6LoWPAN support from commit 92aa7c65d295 up to the patched versions. No active exploitation or public exploit code is known; EPSS probability is low at 0.22%.
Out-of-bounds slab read in the Linux kernel TIPC (Transparent Inter-Process Communication) protocol lets a malicious TIPC neighbour trigger a heap over-read by sending a single crafted broadcast PROTOCOL/STATE_MSG carrying a Gap ACK blocks record. Affecting kernels 5.8 through the fixed stable releases, the broadcast path (tipc_bcast_sync_rcv → tipc_link_advance_transmq) fails to bound the Gap ACK record against the actual message data size, so kmemdup() copies up to 1024 bytes past a ~704-byte skb, corrupting/leaking adjacent slab memory and crashing the host (KASAN slab-out-of-bounds). No public exploit is identified at time of analysis and EPSS is low (0.22%), consistent with a niche, non-default kernel subsystem.
Local privilege escalation in Linux kernel's vme_user staging driver via an out-of-bounds write in slave read/write helpers. A local attacker can overflow the fixed-size kern_buf when the VME window exceeds 128 KiB, leading to arbitrary code execution. No active exploitation or public exploit is known, but the vulnerability has been confirmed dynamically with KASAN; EPSS indicates low exploitation probability.
Out-of-bounds read in the Linux kernel's CIFS client during SMB2 message validation allows an unauthenticated remote attacker acting as a malicious server to leak kernel memory and crash the client before session authentication. The vulnerability, which affects the smb2_check_message() function, can be triggered during NEGOTIATE or SESSION_SETUP exchanges. No active exploitation has been reported, and the EPSS probability is low (0.22%).
Double-free and use-after-free memory corruption flaws in the Linux kernel's staging Intel IPU7 media driver allow a local low-privileged user to corrupt kernel heap memory during driver initialization error paths. Two functions - ipu7_isys_init() and ipu7_psys_init() - incorrectly call kfree(pdata) after device teardown has already freed the same allocation via the ipu7_bus_release() reference-count path, producing a CWE-415 double-free. A concurrent use-after-free also occurs when ERR_CAST() dereferences the already-freed adev pointer before the function returns. No public exploit code exists and exploitation probability is low (EPSS 0.21%), but the C:H/I:H/A:H impact reflects the theoretical kernel code execution or crash potential.
Heap buffer overflow in the Linux kernel's rtl8723bs staging WiFi driver (rtw_cfg80211_set_wpa_ie()) allows a local low-privileged user to corrupt kernel memory by one byte via a crafted nl80211 connect request, enabling potential privilege escalation to kernel context. The 256-byte supplicant_ie array in struct security_priv overflows when a WPA IE with length 255 is supplied, writing 257 bytes and clobbering the adjacent last_mic_err_time field; a flawed length check in rtw_parse_wpa_ie() using u8 narrowing silently permits the overflow. Patches are available across all active stable kernels; EPSS is 0.23% and no public exploit or CISA KEV listing exists at time of analysis.
Out-of-bounds read and integer underflow in the Linux kernel staging driver rtl8723bs (Realtek RTL8723BS SDIO Wi-Fi chipset) allows an adjacent network attacker to trigger kernel memory disclosure or crash via crafted 802.11 WEP authentication frames. Two distinct bugs in OnAuth() can be triggered without authentication: a length underflow that causes crc32_le() to read far beyond the frame buffer when the Privacy bit is set on a short frame, and a fixed 128-byte memcmp in the seq=3 path that ignores the actual IE length field. No public exploit code exists and EPSS is 0.26%, reflecting the combination of adjacent-network requirement, deprecated WEP protocol dependency, and niche SDIO chipset driver.
Out-of-bounds read in the Linux kernel's rtl8723bs staging driver allows adjacent network attackers to read sensitive kernel memory and cause denial of service via a malicious association response. Exploitation requires a rogue access point sending crafted IE data. Patches are available, and no active exploitation or public exploit has been reported.
Out-of-bounds read in the Linux kernel's staging rtl8723bs Wi-Fi driver can be triggered by a malicious Access Point sending a crafted Beacon frame, allowing an adjacent attacker to read sensitive kernel memory and potentially crash the system. Affected kernels from version 4.12 onwards that include the rtl8723bs driver; vendor patches are available.
Out-of-bounds reads in the Linux kernel's rtl8723bs staging WiFi driver allow an attacker-controlled access point to leak kernel memory or crash affected systems by sending beacon or probe-response frames with a truncated final information element. Two IE-parsing loops in issue_assocreq() and join_cmd_hdl() dereference pIE->length without first verifying that at least sizeof(*pIE) bytes remain in the buffer, so a one-byte stub IE at the end of AP-supplied data reads one byte past the buffer end. No public exploit has been identified at time of analysis, and EPSS sits at 0.22%, consistent with the adjacent-network attack vector and niche driver footprint.
Out-of-bounds reads in the Linux kernel's rtl8723bs staging WiFi driver allow an adjacent unauthenticated attacker to leak kernel memory or crash the system by sending crafted 802.11 management frames containing malformed WPA, WAPI, or WPS Information Elements. Three IE parsing functions - rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - lack bounds validation before reading multi-byte header fields and OUI comparisons, exposing raw kernel buffer contents to an adversary within WiFi range. No public exploit or active exploitation has been identified; vendor-released patches are available across all supported stable branches.
Out-of-bounds write in the Linux kernel's rtl8723bs staging Wi-Fi driver when processing a maliciously crafted 802.11 Association Response frame. An attacker within Wi-Fi range can send an oversized HT Capabilities IE, leading to up to 229 bytes of kernel memory corruption, resulting in high integrity and availability impact with no user interaction or authentication required. No public exploit or active exploitation is known; EPSS indicates very low exploitation probability (0.22%).
Use-after-free in the Linux kernel's crypto/krb5 helper library (introduced in 6.15) occurs when Kerberos AEAD encrypt/decrypt operations are backed by an asynchronous AEAD implementation. The synchronous helpers in rfc3961_simplified.c and rfc8009_aes2.c set a NULL completion callback and treat any negative return as terminal, so an async backend returning -EINPROGRESS causes the buffer to be freed with kfree_sensitive() while the backend worker still dereferences it. This is reachable through kernel consumers of krb5 crypto (rxrpc/rxgk, AFS cm_security, and Ceph), but only on systems where an async AEAD provider is bound to the krb5 enctype name; no public exploit identified at time of analysis and EPSS is low at 0.21%.
Use-after-free in the Linux kernel's Intel QuickAssist Technology (QAT) SR-IOV driver allows a local low-privileged attacker - including a VM tenant with a VF assigned - to corrupt host kernel memory by racing VF2PF workqueue processing against SR-IOV teardown in adf_disable_sriov(). The VF2PF interrupt handler enqueues work that holds raw pointers to per-VF state (struct adf_accel_vf_info); adf_disable_sriov() freed that state without draining in-flight workers, enabling a concurrent worker to deref freed memory. No public exploit is known at time of analysis, and EPSS is 0.22% (13th percentile), indicating negligible observed exploitation pressure despite the 8.8 CVSS score.
Use-after-free in the Linux kernel's ksmbd (SMB server) allows authenticated remote attackers to trigger memory corruption, potentially leading to arbitrary code execution or denial of service. The flaw occurs when an SMB2_CLOSE on a locked file is followed by an SMB2_CANCEL, causing a freed file_lock to be re-accessed. A patch is available for affected kernel versions, and while no active exploitation is confirmed, a proof-of-concept exists; EPSS indicates low exploitation likelihood.
Uninitialized memory read in the Linux kernel's PF_KEY IPComp implementation allows local unprivileged users to disclose kernel memory or cause a denial of service. The vulnerability arises from a missing initialization of the alg_key_len field in the xfrm_algo structure when adding IPComp security associations, leading to an out-of-bounds slab read during XFRM state migration. Affected are all Linux kernels since version 2.6.21, with patches backported to multiple stable series.
A data race condition in the Linux kernel's audit subsystem allows local attackers to cause denial of service and minimal integrity impact by exploiting unsynchronized reads of the audit queue length. The flaw affects kernel versions from 4.10 through the unpatched stable series, triggered when concurrent readers and writers access the queue without proper locking,
Use-after-free in the Linux kernel's Bluetooth L2CAP subsystem can be triggered by an adjacent attacker, potentially leading to arbitrary code execution or kernel memory corruption. The flaw occurs when a channel timeout callback races with connection teardown, allowing a freed connection object to be accessed. Patched kernels are available; no active exploitation is confirmed, but the vulnerability is remotely exploitable within Bluetooth range without authentication or user interaction.
Use-after-free in the Linux kernel Bluetooth MGMT subsystem allows a local attacker with low privileges to trigger kernel memory corruption via a race condition between add_device and remove_device operations. The flaw exists in add_device_complete(), which dereferences a hci_conn_params pointer without holding hci_dev_lock, while a concurrent MGMT_OP_REMOVE_DEVICE path frees the same object under that lock. KASAN confirms exploitation as slab-use-after-free; no public exploit or active exploitation (CISA KEV) has been identified, and patches have been released across multiple stable branches.
Heap-based out-of-bounds write in the Linux kernel's ntfs3 filesystem driver during journal replay allows local attackers to achieve kernel code execution by mounting a malicious NTFS image. The vulnerability exists because log_replay() does not validate Dirty Page Table capacity against attacker-controlled fields, leading to a slab corruption. No active exploitation or public exploit code has been identified, and the attack requires user interaction to mount a crafted filesystem.
Out-of-bounds memory write in the Linux kernel's legacy NTFS driver allows a local attacker with filesystem mount privileges to corrupt kernel heap memory via a crafted NTFS image. The flaw lives in `ntfs_icx_ib_sync_write()`, which unconditionally calls `post_write_mst_fixup()` even when `pre_write_mst_fixup()` has already rejected the index block as invalid - the caller does not distinguish between I/O errors and validation failures. By manipulating `usa_ofs` or `usa_count` fields in the NTFS index block, an attacker can drive both slab-out-of-bounds reads and writes into the kernel, as confirmed by KASAN traces in the bug report. No public exploit or CISA KEV listing exists; EPSS is 0.20%.
A denial-of-service flaw in the Linux kernel's NTB EPF driver can cause a kernel panic or system crash when the interrupt handler calls pci_irq_vector() in hardirq context. An attacker with local access to a system using this specialized hardware driver could trigger the issue. At the time of analysis, no public exploit or active exploitation has been reported, and EPSS indicates low exploitation probability (0.21%).
Use-after-free memory corruption in the Linux kernel's netpoll subsystem allows a local attacker or concurrent kernel path to access freed memory during the netpoll shutdown sequence. The flaw exists because cancel_delayed_work() - called from softirq context during __netpoll_cleanup() - does not block until the TX worker finishes, permitting queue_process() to dereference a kfree'd npinfo struct via container_of(). KASAN confirms the UAF; patches are available across multiple stable kernel branches, and no public exploit or KEV listing exists at time of analysis.
Use-after-free in the Linux kernel IPv4 IGMP subsystem allows a local low-privileged attacker to trigger kernel memory corruption or a system crash by racing network device destruction against concurrent multicast group lookups in softirq context. During ip_mc_destroy_dev(), multicast membership entries are scheduled for RCU reclamation via ip_ma_put() but are not unlinked from the per-device mc_hash table; concurrent softirq-path readers such as ip_check_mc_rcu() can then dereference a freed slab object, as confirmed by the embedded KASAN trace showing a read of freed memory during UDP packet processing. No public exploit code or CISA KEV listing exists at time of analysis; Ubuntu USN-8726/8727-1 and a Siemens ICS advisory confirm active patching across distributions.
Integer overflow in the Linux kernel's TCP networking subsystem (net/ipv4) allows a local user with network-namespace privileges to trigger an out-of-bounds read, potentially disclosing kernel memory or crashing the system. Writing a negative integer to the `net.ipv4.tcp_reordering` sysctl causes a silent type-coercion wrap when the value is copied into the `u32 tp->reordering` field, producing an enormous effective value. When `tcp_mtu_probing=2` is also active, this wrapped value overflows the `size_needed` computation in `tcp_mtu_probe()`, bypassing send-queue and window bounds checks entirely, leading to a CWE-190 integer overflow driving a subsequent out-of-bounds read. No public exploit and no KEV listing have been identified at time of analysis; EPSS is 0.23%.
Use-after-free memory corruption in the Linux kernel's NXP i.MX8 ISI (Image Sensing Interface) media driver is triggered during module removal (rmmod of imx8_isi), confirmed by KASAN slab-use-after-free reports. The root cause is an incorrect teardown order in mxc_isi_remove(): the crossbar cleanup frees media entity pads before the V4L2 cleanup has finished removing media links that reference those same pads, resulting in a dangling pointer dereference in __media_entity_remove_link(). No public exploit has been identified at time of analysis, and with EPSS at 0.21% (11th percentile), real-world weaponization appears unlikely despite the CVSS 7.8 score.
Use-after-free in the Linux kernel's cros_ec driver enables a local low-privileged attacker to potentially escalate privileges or compromise system integrity on devices with ChromeOS Embedded Controller hardware. The flaw stems from dev_set_drvdata() being called too early in ec_device_probe(), allowing sub-drivers like cros_ec_typec to access a stale pointer after probe failure. No public exploit code or active exploitation has been identified, and EPSS is low (0.22%).
A race condition in the Linux kernel's shrinker subsystem can cause use-after-free or double-free memory errors during memory cgroup creation and teardown. Local attackers with low privileges may exploit this to escalate privileges to kernel level, leading to full system compromise (confidentiality, integrity, and availability impact). Patches are available in multiple stable kernel branches; no active exploitation is reported (CISA KEV not listed), and the EPSS exploitation probability is low (0.21%).
Remote denial-of-service in Linux kernel netfilter allows unauthenticated attackers to crash the system by sending crafted network packets containing unreadable socket buffer fragments (e.g., from devmem TCP). Affected components include xt_u32, nfnetlink_queue, and nfnetlink_log, which mishandle the error return from sk
Memory corruption in the Linux kernel's netfilter ebtables module can occur from an uninitialized pointer free during chainstack array cleanup. The flaw is triggered only under rare, non-default conditions—a sparse CPU possible mask and a failed memory allocation—making real-world exploitation extremely unlikely. No active exploitation or public exploit is known.
Information disclosure and denial of service in the Linux kernel's netfilter ebtables subsystem allows a local attacker with low privileges to leak kernel memory or cause a system crash. The vulnerability arises from a missing null-termination check on module names before passing them to request_module(), potentially exposing uninitialized kernel memory. No public exploit or active exploitation has been identified, and the EPSS score indicates a low probability of widespread exploitation.
Stack buffer over-read in the Linux kernel's netfilter ebtables module allows a local attacker with low privileges to read kernel stack data and potentially crash the system. When updating ebtables counters, a 32-byte user-supplied table name is passed without NUL-termination to a kernel function that uses it in a module autoload request, causing vsnprintf to read beyond the stack buffer. No active exploitation or public exploit code is known, and EPSS indicates a low exploitation probability (0.22%).
Insufficient validation in the Linux kernel's netfilter flowtable hardware offload for IPIP tunnels could allow a remote attacker to cause information disclosure or denial of service. The flaw exists because the kernel would attempt to enqueue hardware offload work for IPIP tunnels despite no driver supporting it, leading to an unspecified impact when the unsupported configuration is processed. The issue is fixed by adding an early check to skip unsupported offload setup. No public exploit code is
Use-after-free race condition in the Linux kernel's Bluetooth BNEP subsystem allows an adjacent unauthenticated attacker to corrupt kernel memory or crash the system. During netdev registration via bnep_add_connection(), the L2CAP connection is read without holding the channel lock; if controller teardown occurs concurrently, the freed parent device is dereferenced by the network device registration path. The fix takes a reference to the L2CAP connection under the channel lock and retains it until register_netdev() secures its own parent device reference. No public exploit or CISA KEV listing has been identified at time of analysis, and the 0.22% EPSS score reflects low active exploitation probability.
Out-of-bounds memory read in the Linux kernel's btnxpuart Bluetooth driver exposes kernel memory to a malicious or compromised NXP Bluetooth UART controller. The vulnerability exists in nxp_recv_fw_req_v3(), which handles firmware download requests during v3 controller initialization: when the controller supplies a crafted 32-bit offset or 16-bit length value that pushes past the end of the firmware image, the driver reads arbitrary kernel memory and transmits it back to the controller over UART. The parallel v1 path (nxp_recv_fw_req_v1()) already contained the equivalent bounds check; the v3 path lacked it. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.21% (11th percentile), consistent with the narrow local/hardware attack surface.
Use-after-free in the Linux kernel Bluetooth subsystem's bt_accept_dequeue() function allows an attacker with local or adjacent Bluetooth access to corrupt kernel heap memory or crash the system during L2CAP listening socket teardown. The bug stems from a reference-count sequencing error: the temporary queue-walk reference is dropped before bt_accept_unlink() removes the socket from the accept queue and drops its own reference, so if that was the final reference, the subsequent sock_hold() call dereferences freed slab memory. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS is 0.22% (13th percentile), consistent with low opportunistic exploitation risk.
Out-of-bounds read in the Linux kernel's Bluetooth L2CAP configuration option parser allows an adjacent attacker to crash the system or leak up to 4 bytes of kernel memory. The vulnerability arises from a validate-after-use bug where an attacker-controlled option length is dereferenced before checking bounds, affecting all Bluetooth-enabled kernels prior to the fix
Out-of-bounds write in the Linux kernel's CoreSight ultrasoc-smb driver when used as a perf AUX sink allows a local attacker to elevate privileges. The vulnerability arises from improper page index normalization in smb_sync_perf_buffer(), leading to a heap buffer overflow. Although no active exploitation or public proof-of-concept is known, the weakness has been patched upstream and carries an EPSS score of 0.21%.
Local privilege escalation in the Linux kernel's SMB client witness notification handler allows a low-privileged attacker to exploit a use-after-free condition. Affected are Linux kernel versions 5.11 and later that have the CIFS witness feature enabled. Successful exploitation can lead to arbitrary code execution with elevated privileges, fully compromising the system.
Path traversal bypass in the Linux kernel's ksmbd SMB server allows authenticated users with write access to a share to create zero-length files or directories outside the exported share boundary. The flaw exists only when the share is configured with case-insensitive (caseless) filename handling. Patches are available; the vulnerability is not known to be actively exploited, has a low EPSS score (0.26%), and no public exploit has been identified.
Improper authorization in the Linux kernel's ksmbd (in-kernel SMB3 server) lets an authenticated SMB client overwrite destination file data it should not be able to write. The FSCTL_DUPLICATE_EXTENTS_TO_FILE branch of smb2_ioctl() performs a server-side block clone via vfs_clone_file_range() but omits the share-level writable check and the per-handle access check that every other write-bearing ioctl arm enforces, so data can be overwritten on a read-only share or through a handle opened with only FILE_WRITE_ATTRIBUTES. This is an integrity/authorization bug (not memory corruption); there is no public exploit identified at time of analysis and EPSS is low (0.21%).
Data zeroing attack in the Linux kernel's ksmbd SMB server allows an authenticated client to destroy file contents without requiring FILE_WRITE_DATA permission. A handle opened with only FILE_WRITE_ATTRIBUTES is sufficient to send FSCTL_SET_ZERO_DATA, bypassing the missing per-handle access check. Publicly available exploit code exists, and vendor patches have been released.
Use-after-free vulnerability in the Linux kernel's ksmbd SMB server allows remote attackers to execute arbitrary code. All kernel versions with ksmbd enabled from early commits up to the patched releases are affected, and the issue can be triggered by concurrent QUERY_DIRECTORY requests on the same file handle. A fix is available via multiple stable kernel branches, no active exploitation is reported in KEV, and EPSS indicates a low probability of widespread exploitation (0.21%).
Use-after-free in Linux kernel’s ksmbd SMB server occurs during deferred byte-range lock cancellation, allowing an authenticated attacker to potentially execute arbitrary code or crash the system. The vulnerability affects ksmbd versions prior to the released fixes (6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, 7.2-rc1). No active exploitation has been confirmed (no CISA KEV listing), and EPSS indicates a low probability of widespread exploitation.
Unauthorized information disclosure in Linux kernel's ksmbd module allows remote unauthenticated attackers to copy arbitrary file contents on SMB shares by exploiting a missing access check on the FSCTL_DUPLICATE_EXTENTS_TO_FILE operation. Attackers with only attribute access to a source file can read its contents without requiring the FILE_READ_DATA permission. No public exploit or active exploitation has been identified, though the vulnerability is patchable via kernel updates.
Authorization bypass in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated network client to rewrite any accessible file's security descriptor - including DACL and owner - without holding WRITE_DAC or WRITE_OWNER rights on the file handle. A client opening a handle with only FILE_WRITE_ATTRIBUTES can issue SMB2 SET_INFO with InfoType SMB2_O_INFO_SECURITY to invoke set_info_sec(), which rewrites POSIX ACLs, ownership via notify_change(), and (on KSMBD_SHARE_FLAG_ACL_XATTR shares) the Windows SD xattr, all without any fp->daccess gate. No public exploit has been identified; EPSS is 0.22%, and patches are confirmed in kernel stable series 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1.
Unauthorized file modification in the Linux kernel's ksmbd SMB server allows remote attackers to modify file data and attributes by exploiting a credential confusion in SMB2 SET_INFO handlers. The vulnerability arises because the VFS operations used after permission checks run with the ksmbd worker credentials rather than the opener's credentials, effectively bypassing ownership and permission restrictions. No public exploit is known and EPSS is low (0.21%), but the network-accessible, low-complexity nature makes critical
Filesystem permission bypass in the Linux kernel's in-kernel SMB server (ksmbd) allows an authenticated SMB client to delete base files and Alternate Data Stream (ADS) xattrs it should not be permitted to remove. When a delete-on-close is finalized during deferred or durable handle teardown - a code path with no associated request work - the unlink and ADS removal executed with the ksmbd worker's credentials rather than the opening user's, skipping the fsuid/fsgid/supplementary-group/capability checks. No public exploit is identified at time of analysis; EPSS is low (0.22%, 13th percentile) and it is not in CISA KEV.
Unauthorized read/write of Alternate Data Streams in Linux ksmbd allows remote attackers to access or modify file extended attributes. The vulnerability, present in Linux kernel versions with ksmbd up to before patches 6.18.39, 6.12.96, 7.1.4
Memory corruption in the Linux kernel's ksmbd SMB server allows authenticated remote code execution. A race condition in byte-range lock ownership tracking can lead to use-after-free when SMB3 multichannel is enabled, enabling an attacker with low privileges to escalate to full system compromise. No public exploit or active exploitation is known, and EPSS indicates low exploitation probability.
Session key corruption in the Linux kernel's ksmbd SMB server allows a network attacker to overwrite an existing session's NTLMv2 session key (`sess->sess_key`) despite a failed authentication attempt. The flaw lies in the SMB3 multichannel binding path: `ksmbd_auth_ntlmv2()` derives the base session key into `sess->sess_key` before verifying the NTLMv2 proof, and the binding session error path does not expire the binding session, so a crafted SESSION_SETUP with a bad NT proof plus KEY_XCH arc4_crypt payload corrupts the live session key before `STATUS_LOGON_FAILURE` is returned. No public exploit has been identified at time of analysis; EPSS is 0.25% (16th percentile), consistent with a race-and-config-gated server-side flaw.
Silent ownership update failure in the Linux kernel's SMB/CIFS client allows local users mounting SMB3 shares with POSIX Extensions to have chown/chgrp operations silently dropped by the kernel unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID flags are also explicitly set. The root cause is a missing posix_extensions check in cifs_setattr_nounix() that prevented id_mode_to_cifs_acl() from being invoked to relay ownership changes to the server. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% (10th percentile) reflects low exploitation likelihood for what is primarily a logic/correctness defect.
Double-free memory corruption in the Linux kernel SMB client when processing SMB2 QUERY_DIRECTORY responses. A remote attacker acting as a malicious SMB server can trigger the issue during directory enumeration, potentially leading to arbitrary code execution or denial of service on any unpatched Linux system that mounts an attacker-controlled share. The vulnerability is not known to be actively exploited, but patches are available across multiple stable kernel branches.
Double free in the Linux kernel's SMB client due to improper cleanup of response buffers when a reply error is replayed. An attacker controlling an SMB server can trigger memory corruption, potentially leading to code execution or a system crash, when a vulnerable client connects and processes a crafted response. Patches are available in multiple stable kernel branches, but no active exploitation or public exploit has been reported.
Double-free vulnerability in the Linux kernel's SMB client (cifs) allows remote code execution via crafted SMB2_ioctl replies. An attacker hosting a malicious SMB server can trigger a replay path memory double-free, leading to full system compromise. No active exploitation or public exploit has been identified at this time; EPSS score is low (0.21%).
Denial-of-service (kernel memory corruption) in the Linux kernel's cifs/smb client affects the SMB2 CHANGE_NOTIFY replay path. When a response-bearing notify attempt returns a replayable error and frees its response buffer, stale resp_buftype/rsp_iov bookkeeping is retained across attempts; if SMB2_notify_init() then fails before the next send, cleanup frees the already-freed response a second time (CWE-415 double-free). Exploitation requires a malicious or man-in-the-middle SMB server and winning a replay/retry-failure race, so real-world risk is DoS-leaning; no public exploit is identified and EPSS is low at 0.21%.
Double-free memory corruption in the Linux kernel's SMB client (cifs) affects the SMB2_flush() replay path across many stable branches prior to 6.6.145, 6.12.96, 6.18.39 and 7.1.4. When a mounted client receives a replayable flush response and the subsequent retry fails before cifs_send_recv() installs a replacement response, flush_exit frees the stale response buffer a second time, corrupting kernel slab memory and typically crashing the client. No public exploit is identified at time of analysis (EPSS 0.21%, 11th percentile) and it is not in CISA KEV; exploitation requires a malicious or man-in-the-middle SMB server plus a replay/retry timing race, making it primarily a denial-of-service concern despite the 9.8 rating.
Double-free in the Linux kernel SMB client's SMB2_open() replay handler allows remote attackers to corrupt memory by inducing a user to mount a malicious SMB share. The flaw affects unpatched kernel versions with the cifs module loaded and can lead to arbitrary code execution, information disclosure, or denial of service. No active exploitation has been reported (not in CISA KEV), and EPSS score is 0.21%, indicating low exploitation probability; official kernel patches are available.
Memory leak in the Linux kernel's SMB client encrypted receive path (receive_encrypted_standard()) allows a local low-privileged user or a cooperative malicious SMB server to exhaust kernel heap memory, with potential for heap grooming-based privilege escalation. The bug was introduced with commit b24df3e30cbf and affects multiple stable kernel series from 4.19 onward. No public exploit code exists and EPSS is 0.22%, but the kernel team's classification of CWE-787 and a C:H/I:H/A:H CVSS score reflect the Linux security team's assessment that the leaked kernel buffer is exploitable beyond simple resource exhaustion.
Out-of-bounds read in the Linux kernel's SMB/CIFS client POSIX SID parser allows a malicious or MITM SMB server to cause kernel memory disclosure and denial of service on connecting clients. The `posix_info_sid_size()` helper reads `sid[1]` (the SubAuthorityCount byte) after validating only one remaining byte, permitting a truncated server-supplied POSIX SID to trigger a one-byte OOB read - leaking a byte of kernel heap context (C:L) and risking a crash (A:H). No public exploit code exists and EPSS is 0.22%, but the vulnerability is client-facing and triggered entirely from the server side without client-side privilege. Patches are available across all maintained stable branches.
Improper mode masking in the Linux kernel SMB client when the modefromsid mount option is used allows a remote attacker to cause denial of service and limited integrity impact via a crafted SMB response. The vulnerability arises because parse_dacl() fails to mask server-provided mode bits to 07777, potentially setting unexpected permission bits on files. No public exploit is identified at time of analysis.
The Linux kernel writeback subsystem crashes with a use-after-free during container exit due to a race between cgroup_writeback_umount() and inode_switch_wbs(). An in-flight writeback-context switch can pass the SB_ACTIVE check and take an inode reference before the filesystem unmount clears SB_ACTIVE, but delay queuing its work item - causing the umount path to flush a workqueue that has nothing pending, destroy percpu counters via put_super(), and then have the deferred switch work invoke percpu_counter_dec() on freed memory, triggering a BUG_ON or silent UAF. No public exploit is identified at time of analysis; EPSS stands at 0.21% (12th percentile) with no CISA KEV listing.
Double-free memory corruption in the Linux kernel's Qualcomm CPU frequency hardware driver (qcom-cpufreq-hw) allows a local low-privileged attacker on Qualcomm SoC-based systems to trigger kernel heap corruption, potentially escalating privileges to root. The flaw originates in qcom_cpufreq_hw_cpu_exit(), which incorrectly calls kfree() on memory allocated via devm_kzalloc() - memory already tracked by the kernel's device resource management (devres) system. This results in a double-free when the platform device is subsequently detached and devres performs its own cleanup. No public exploit code exists and EPSS is low (0.21%), consistent with a static-analysis discovery rather than active exploitation.
Privilege escalation in the Linux kernel /proc filesystem allows a local attacker to bypass ptrace access restrictions when reading symbolic links in /proc/[pid]/fd/. By racing the task lookup and access check, an unauthenticated local user can gain unauthorized read and write access to sensitive file descriptors of other processes, potentially leading to full system compromise. The vulnerability affects a wide range of kernel versions and has a patch released by the Linux kernel project.
Linux kernel real-time scheduling on non-PREEMPT_RT builds (kernel 4.1 through multiple stable branches) can be livelocked on large multi-CPU systems via the RT_PUSH_IPI mechanism. When a CPU is saturated with softirqs in hardirq context and simultaneously targeted by repeated IPIs from other CPUs attempting to pull overloaded RT tasks, the IPI flood degrades softirq performance until the CPU can never return to task context, permanently removing it from the scheduler. No public exploit exists; EPSS is 0.22% (13th percentile), and no KEV listing is present, reflecting the workload-specific nature of the condition.
Local privilege escalation in the Linux kernel's pcc-cpufreq driver allows a low-privileged user to gain full root privileges. The vulnerability is a use-after-free and double-free flaw when evaluating ACPI _OSC negotiation, affecting all kernel versions from 2.6.34 until the fixed stable releases (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1). No active exploitation or public exploit has been identified, and EPSS indicates a low probability of widespread exploitation.
Memory disclosure in the Linux kernel's SLUB allocator allows local attackers to read uninitialized kernel memory when specific slab debugging options are enabled. The issue occurs when red zoning is active without store_user tracking, causing krealloc() to violate the __GFP_ZERO contract and return partially zeroed allocations. This can leak sensitive data, with an EPSS probability of 0.21% and no known active exploitation, though a vendor patch is available.
Local privilege escalation via stack buffer overflow in the Linux kernel's hid-goodix-spi driver allows a user with access to a Goodix SPI HID device node to corrupt kernel stack memory and achieve full system compromise. The goodix_hid_set_raw_report() function copies caller-supplied report data into a fixed 128-byte stack buffer without bounds checking, so a hidraw SET_REPORT ioctl carrying more than ~116 bytes overflows it. There is no public exploit identified at time of analysis, and the low EPSS score (0.23%) plus the local-only, hardware-specific attack surface indicate limited real-world exposure despite the high 7.8 CVSS.
Out-of-bounds write in the Linux kernel's HID wacom driver allows an adjacent attacker to corrupt kernel memory, potentially achieving code execution or crashing the system. The flaw, present in kernels from commit 5e013ad2... up to the fixed versions 6.18.39, 7.1.4, and 7.2-rc1, stems from a missing emptiness check that causes the FIFO to read stale data and bypass the buffer size guard. No active exploitation or public exploit code has been identified, and EPSS predicts a low exploitation probability (0.22%).