Linux
Monthly
Use-After-Free in the Linux kernel HID letsketch driver allows local exploitation during device unbind, potentially enabling kernel memory corruption and privilege escalation on affected systems. The letsketch_probe() function arms a per-device kernel timer (inrange_timer) with a 100 ms timeout, but no .remove callback exists to drain the timer before devm cleanup frees letsketch_data and input_dev structures on USB unplug or rmmod, producing a UAF read/write into freed kernel memory. Patches are backported across six stable kernel branches; no public exploit code exists and EPSS is 0.21% (12th percentile), reflecting the niche device requirement and race-condition complexity.
Out-of-bounds bit manipulation in the Linux kernel HID multitouch driver allows an attacker with a crafted USB or Bluetooth multitouch device to corrupt adjacent kernel data structures and panic the kernel. The driver uses mt_io_flags - a single unsigned long - as a variable-length per-slot bitmap indexed by slot number, which is bounded only by the device-reported ContactCountMaximum (up to 255). When that value exceeds BITS_PER_LONG, set_bit()/clear_bit() operations in mt_release_contacts() overwrite adjacent struct mt_device members, zeroing the td->applications list head and causing a null-pointer dereference in softirq context. No local privileges are required; physically connecting a crafted device is sufficient. No public exploit code has been identified at time of analysis.
Use-after-free in the Linux kernel HID appleir driver allows a local attacker to corrupt kernel memory during device removal, potentially achieving privilege escalation. The race condition exists between the key_up_timer callback (armed by appleir_raw_event() on each keydown/key-repeat) and hid_hw_stop(), which frees the underlying input_dev before the timer is drained. A second race window, where a USB URB completion during hid_hw_stop() can re-arm the timer via mod_timer(), means a simple teardown reorder is insufficient — the fix introduces a spinlock-gated 'removing' flag combined with timer_shutdown_sync() to permanently disable further callbacks. No public exploit has been identified at time of analysis, and EPSS is 0.22% (13th percentile).
Use-after-free in the Linux kernel HID lg-g15 driver allows a local attacker to trigger kernel memory corruption by racing device input events against USB keyboard removal. The driver allocates lg_g15_data via devm and schedules work items from HID report handlers (backlight cycle key on G15, G15 v2, G510), but lacked a remove callback to cancel pending work before devres freed the allocation. On kernel versions from approximately 5.5 through the unfixed stable branches, unplugging the keyboard while a work item is pending causes the worker to dereference freed memory via container_of, potentially enabling local privilege escalation. No public exploit has been identified and EPSS is 0.22% (13th percentile), indicating no observed widespread exploitation.
Integer wrap-around in the Linux kernel's HFS/HFS+ filesystem driver allows a local low-privileged user to bypass a critical bounds check, triggering a memmove that reads approximately 4GB past a node buffer in kernel memory. The flaw originates in check_and_correct_requested_length(), where u32 arithmetic on off+len wraps silently when len arrives as a large underflowed value from hfs_brec_remove(); the wrapped result passes the node_size guard and proceeds to an out-of-bounds memory operation. No public exploit has been identified at time of analysis, and EPSS stands at 0.22%, reflecting low real-world exploitation expectation despite full C:H/I:H/A:H impact ratings.
An out-of-bounds memory access in the Linux kernel's BPF devmap broadcast redirect for XDP frames, introduced in version 5.14, can be triggered by remote unauthenticated attackers sending specially crafted fragmented network packets. This could lead to kernel memory corruption and arbitrary code execution. Though CVSS rates this as critical (9.8), no public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.21%).
Arbitrary code execution in the Linux kernel's BPF BTF parser allows local privilege escalation. Malformed BTF data can cause an integer overflow in the repeated field count calculation, bypassing a capacity check and leading to a heap buffer overflow. With low EPSS score (0.21%), widespread exploitation is currently unlikely, but unprivileged local users who can load BPF programs are at risk of complete system compromise.
Incorrect RCU lock annotations in the Linux kernel's BPF LPM trie map implementation (`kernel/bpf/lpm_trie.c`) cause lockdep false positives on debug kernels when sleepable BPF programs access `BPF_MAP_TYPE_LPM_TRIE` maps via lookup, update, or delete operations. The mismatch arises because sleepable BPF programs hold `rcu_read_lock_trace()` while the trie code asserts `rcu_read_lock_bh_held()` or `rcu_read_lock_held()`, producing repeated 'suspicious RCU usage' kernel warnings per distinct callsite. The Linux kernel developers explicitly state no actual use-after-free occurs, since Tasks Trace RCU already serializes against trie node reclaim; however, the incorrect annotation undermines lockdep's ability to detect future regressions and is increasingly impactful as sleepable BPF LSM programs become common in production security tooling. No public exploit exists and no CISA KEV listing has been issued.
Use-after-free and memory leak in the Linux kernel's EHCI and FOTG210 USB isochronous submit paths expose systems running kernel versions from 2.6.15 through 7.1.3 to local kernel memory corruption by a low-privileged user. When an isochronous URB submission fails before the staged schedule handoff - either because the host controller becomes inaccessible or usb_hcd_link_urb_to_ep() returns an error - the ehci_iso_sched allocation is not freed and urb->hcpriv retains a dangling pointer, creating a UAF condition. No public exploit exists and the EPSS score is 0.21% (12th percentile), but vendor-released patches across multiple stable branches are available and should be applied to eliminate the risk.
Use-after-free in the Linux kernel USB gadget UDC subsystem exposes systems with DWC3-based USB controllers to a race condition between usb_del_gadget() and gadget_match_driver(), enabling a NULL pointer dereference that can crash the kernel or enable privilege escalation on unpatched systems. The flaw affects all major Linux stable branches from 5.15.x through 7.1.x prior to the patched releases, and is particularly relevant for embedded Linux, Android-based devices, and IoT hardware that use USB gadget/device mode. No public exploit has been identified at time of analysis, and EPSS remains at 0.21% (12th percentile), reflecting current low exploitation interest.
Use-after-free in the Linux kernel's idmouse USB fingerprint driver allows a low-privileged local attacker to corrupt kernel memory by racing a device disconnect against a file-descriptor release, potentially enabling local privilege escalation to root. The bug stems from `mutex_unlock()` accessing the freed driver-data structure after the lock is released, a documented non-atomic behavior; the fix introduces a `kref` reference counter to correctly manage object lifetime. Patches are available across all active stable branches; no active exploitation or public exploit has been reported.
Use-after-free in the Linux kernel's USB ldusb driver allows a local unprivileged user to corrupt kernel memory by racing disconnect() against release() on a connected USB device. The root cause is that mutex_unlock() is documented as non-atomic and may access the mutex object after it logically releases the lock, creating a window where the driver data structure can be freed while still in use. No public exploit has been identified at time of analysis, and EPSS is low (0.22%), but the C:H/I:H/A:H CVSS impact vector reflects the potential for full kernel privilege escalation if successfully triggered.
Use-after-free in the Linux kernel's USB iowarrior driver exposes systems with Code Mercantile IO-Warrior USB devices to kernel memory corruption, potentially enabling local privilege escalation to root. The defect exists because submitted write URBs are not cancelled during close(), leaving them in-flight at disconnect time; the completion handler then fires against already-freed device structures. No public exploit code has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects minimal observed exploitation pressure, though the C:H/I:H/A:H CVSS impact reflects genuine kernel-level consequence.
Use-after-free in the Linux kernel USB iowarrior driver allows a local unprivileged user to corrupt kernel memory when a USB device disconnect races with a file release operation. The root cause is that mutex_unlock() is documented as non-atomic and may access the mutex structure after releasing the lock, meaning the driver data object can be freed while mutex_unlock() is still executing. An attacker who can trigger the race - by opening the iowarrior device and simultaneously provoking a USB disconnect - may achieve kernel memory corruption leading to privilege escalation. No public exploit code exists and EPSS is low (0.21%), but the impact class is standard kernel UAF.
The Linux kernel's legousbtower USB driver contains a use-after-free race condition between the release() and disconnect() code paths, present since Linux 2.6.25. An authenticated local user with a LEGO USB Tower device attached can trigger the race at disconnect time to corrupt freed kernel memory, potentially gaining elevated privileges or crashing the system. Patches have been issued across all active stable branches (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1); no public exploit code or CISA KEV listing exists at time of analysis.
Slab out-of-bounds read in the Linux kernel usbio USB driver (drivers/usb/misc/usbio) leaks adjacent kernel heap memory to local unprivileged processes via the i2c subsystem. The flaw lies in usbio_bulk_msg(), which validates the device-supplied payload length against the TX buffer size rather than the smaller RX buffer size, allowing a malicious USB device with mismatched endpoint wMaxPacketSize values to drive memcpy() past the end of the rxbuf slab object. Over-read kernel heap bytes propagate through the i2c layer to userspace via i2c-dev, and under KASAN-enabled kernels the bug is reported as a slab-out-of-bounds crash. No public exploit has been identified at time of analysis; the bug was found by code review and confirmed with a userspace AddressSanitizer model and a USB raw-gadget plus dummy_hcd kernel reproducer.
Local privilege escalation in the Linux kernel's digi_acceleport USB serial driver allows authenticated local users to corrupt kernel memory and execute arbitrary code as root. The vulnerability arises from a race condition in the digi_write_inb_command() function that mishandles timeouts and incorrectly updates transfer buffers, leading to write buffer corruption. No active exploitation has been reported, and publicly available exploit code has not been identified; a vendor patch is available across multiple stable kernel branches.
Out-of-bounds array read in the Linux kernel's USB Type-C Port Manager (TCPM) svdm_consume_modes() function allows a physically connected malicious USB-C partner device to read kernel memory beyond the svids[] array boundary and force registration of an arbitrary, attacker-chosen SVID via typec_partner_register_altmode(). The vulnerability arises because pmdata->svid_index - which is incremented in response to partner-supplied SVDM messages - is never validated against SVID_DISCOVERY_MAX (16) before indexing pmdata->svids[]. Patches are confirmed available across eight stable kernel branches (5.10 through 7.2-rc3); no public exploit or CISA KEV listing exists at time of analysis.
Use-after-free in the Linux kernel's USB Type-C UCSI CCG driver allows a local attacker with low privileges to corrupt kernel memory, potentially achieving arbitrary kernel code execution. The flaw exists in the module teardown path of the Cypress CCG UCSI driver: ucsi_ccg_remove() calls ucsi_destroy() - which kfree()s the ucsi object - before calling free_irq(), leaving a window in which the threaded IRQ handler ccg_irq_handler() can access the freed ucsi struct via ucsi_notify_common(). No public exploit code exists and the bug was discovered by static analysis; EPSS is 0.22% (13th percentile), reflecting no observed in-the-wild activity.
Local denial of service in the Linux kernel UDF filesystem allows an unprivileged local user to panic the system by truncating a file on a crafted UDF media. On desktop systems where polkit permits unprivileged mounting of removable media, an attacker can trigger this reliably. The vulnerability has public patches with exact fixed versions and a low EPSS exploitation probability (0.21%).
Out-of-bounds read in the Linux kernel's UDF filesystem driver allows a local low-privileged attacker to leak kernel memory or cause a denial of service by mounting a crafted UDF image with a malicious Virtual Allocation Table (VAT) header. The vulnerability resides in the udf_load_vat() function, which fails to validate the attacker-controlled VAT header length against the inode size, leading to a large out-of-bounds read index. No active exploitation or public proof-of-concept has been identified; EPSS predicts a very low exploitation probability (0.22%).
Out-of-bounds read and write in the Linux kernel's UDF filesystem driver allows a local attacker with the ability to mount a crafted UDF image to escalate privileges to root. The vulnerability stems from the sparing table length being validated as a byte count but consumed as an entry count, leading to memory corruption. No active exploitation (KEV) or public proof-of-concept is currently known, and EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Heap-based out-of-bounds read in the Linux kernel's nvmet discovery log page handler allows unauthenticated remote attackers to leak kernel memory or crash the host. Any system acting as an NVMe over Fabrics target with a discovery service exposed via TCP, RDMA, or FC is vulnerable. No active exploitation or public exploit code is reported at this time, and EPSS probability is low (0.25%), but the impact and ease of exploitation make remediation urgent for affected storage targets.
Out-of-bounds heap read in the Linux kernel's nvmet-auth module allows pre-authentication remote attackers to read up to 526 bytes of heap memory beyond a crafted DHCHAP_REPLY message. By sending an NVMe-oF authentication reply with a small transfer length but inflated hash and DH value length fields, an unauthenticated attacker can extract sensitive data or cause a denial-of-service. Patches are available in upstream stable kernels.
We are tasked with synthesizing data from multiple sources about CVE-2026-64318 into a comprehensive analysis, returning a JSON object with specified fields. Let's carefully parse the provided information. CVE-2026-64318: In the Linux kernel, a vulnerability in the AIX partition handling. The description: "aix_partition() reads the physical volume descriptor... pp_count is unvalidated, so a crafted AIX image with pp_count > 1016 drives an out-of-bounds read... bound the scan to array size." From description: - Product: Linux kernel, specifically the partition handling for AIX disks (block/partitions/aix.c). So product_name: "Linux Kernel". - CVSS Score: 7.1, Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - CWE: N/A - EPSS: 0.22% (percentile 13%) - Patch: Available from vendor - Tags: Linux, IBM, Information Disclosure - KEV status: not mentioned (likely not KEV). POC? Not mentioned. So no active exploitation or public exploit identified from data. - CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (but note: Linux kernel is typically "o:linux:linux_kernel", but given as "a" application? The data says "cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*". We'll use it as is, but product_name Linux kernel is correct.) - Affected versions: We have a list of git commit ranges and patches. We can extract the fix versions: mention specific stable versions patched: 7.1.4, 6.18.39, 5.15.212, 5.10.261, 7.2-rc1, 6.6.145, 6.12.96, 6.1.178, and the initial commit from 3.11. So the vulnerability was introduced long ago (Linux 3.11) and fixed in multiple stable branches. The description mentions "Linux 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 < ..." which is the commit that fixed it? Possibly the fix commit. The EUVD entries give commit ranges where the vulnerability exists. We'll synthesize: Affected: Linux kernel versions from 3.11 up to before the fix in the 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1, 7.2 series. So we can say "Linux kernel versions prior to the patched releases: 5.10.261, 5.1
Information disclosure in the Linux kernel's isofs filesystem driver allows a local attacker to leak up to 255 bytes of kernel heap memory to userspace by mounting a crafted ISO 9660 image. Because
Information disclosure in the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver can expose cryptographic key material via debug logs when CONFIG_DYNAMIC_DEBUG is enabled. A local attacker with low privileges could capture hex dumps of keys from kernel ring buffer, leading to full compromise of confidentiality, integrity, and availability. Patches are available in multiple stable kernel branches; no active exploitation or public exploit code has been identified.
Incorrect carry overflow in the Linux kernel's ECC vli multiplication allows adjacent network attackers to cause incorrect ECDH shared secret derivation, potentially enabling man-in-the-middle attacks against ECDH-based protocols such as IPsec, TLS, and Wi-Fi WPA3. The vulnerability, introduced in kernel 4.8, can be exploited without authentication or user interaction if ECDH is enabled. No active exploitation or public exploit has been identified, but the bug fundamentally weakens cryptographic guarantees.
Denial of service in the Linux kernel's pcrypt crypto template allows remote unauthenticated attackers to crash the system by triggering a faulty fallback path. When the parallel execution via padata fails (e.g., due to resource pressure), the pcrypt module does not restore the original callback, leading to unsafe execution of the parallel-only completion routine and kernel memory corruption. The vulnerability has a low EPSS score (0.22%, 13th percentile), no public exploit or active exploitation, and patches are available in multiple stable kernel series.
Use-after-free and missing forward security in the loongson-rng crypto driver of the Linux kernel allow a local, low-privilege attacker to corrupt memory and potentially execute arbitrary code, compromise system integrity, or read sensitive information. Affected systems are primarily Loongson-based machines running kernels between v6.18 and the respective fix versions; the driver itself is unused by any in‑kernel consumer and is being removed entirely rather than patched. No active exploitation or public exploit code is known, and the EPSS exploitation probability is low (0.21%).
Use-after-free and list corruption in the Linux kernel's Intel QuickAssist Technology (QAT) crypto driver allows a local low-privileged attacker to trigger kernel memory corruption by racing concurrent service registration and device lifecycle operations. The crypto/qat subsystem's service_table linked list is guarded by service_lock only during insertions and deletions, but seven device-state functions iterate the list unprotected, enabling a concurrent adf_service_register() or adf_service_unregister() call to mutate the list mid-traversal. Exploiting this race can result in kernel crash, arbitrary kernel memory read, or local privilege escalation to root. No public exploit code has been identified and EPSS stands at 0.21% (11th percentile), but the impact class is high for systems running QAT-capable Intel hardware.
Out-of-bounds write in the Linux kernel Intel QAT (Quick Assist Technology) RSA CRT driver corrupts kernel DMA memory when a local attacker supplies an RSA private key with CRT components larger than half the modulus size. The QAT driver's qat_rsa_setkey_crt() allocates DMA buffers at key_sz/2 but the right-alignment expression `dst + half_key_sz - len` wraps on unsigned underflow when len > half_key_sz, directing memcpy to write attacker-controlled bytes past the DMA allocation. No public exploit code exists at time of analysis; EPSS is 0.22% and the bug has been present since Linux 4.8 across all maintained stable branches.
Use-after-free vulnerability in the Linux kernel's fsl-lpspi SPI driver can lead to memory corruption or arbitrary code execution with kernel privileges. A local attacker with high privileges on systems using the affected driver can trigger this flaw, potentially causing a kernel panic or full system compromise. At time of analysis, no public exploit or active exploitation is identified, and EPSS indicates low exploitation probability (0.22%).
Page use-after-free in the Linux kernel perf/aux subsystem allows a local authenticated attacker to read or write freed kernel memory, potentially achieving privilege escalation. The flaw arises because map_range() accesses rb->aux_pages[], rb->aux_nr_pages, and rb->aux_pgoff while holding only the per-event mmap_mutex, whereas those fields are serialised by the ring-buffer-level rb->aux_mutex; two events sharing one ring buffer via PERF_EVENT_IOC_SET_OUTPUT can therefore race rb_alloc_aux() against map_range(), leaving a VM_PFNMAP mapping pointing to a freed physical frame. No public exploit has been identified at time of analysis, and EPSS exploitation probability is very low at 0.21% (11th percentile).
Out-of-bounds slab read in the Linux kernel tracing subsystem allows a local attacker with access to the trace event filter interface to leak kernel slab memory or crash the kernel. The flaw exists because `regex_match_glob()` ignores the bounded length passed by filter predicate functions and calls the NUL-terminated-string-only `glob_match()`, which scans past the end of non-NUL-terminated dynamic string fields - exemplified by XFS namespace tracepoints whose dynamic char arrays are copied without a trailing NUL. EPSS is 0.22% (13th percentile); no public exploit code exists and the vulnerability is not listed in CISA KEV.
Unauthorized file truncation in the Linux kernel's NFSv4 client allows local attackers to bypass write permission checks when opening a file with O_RDONLY|O_TRUNC. By exploiting a missing MAY_WRITE permission mask during cached delegated opens, an attacker without write access can truncate files, causing data loss. No public exploit or active exploitation has been identified, and EPSS indicates a 0.22% exploitation probability.
Out-of-bounds read and write in the Linux kernel exFAT filesystem driver's `exfat_find_dir_entry()` allows a local attacker with low privileges to corrupt kernel heap memory or read adjacent kernel data by mounting or triggering access to a crafted exFAT filesystem image. The bug arises because the `uniname` output pointer advances by a fixed stride of `EXFAT_FILE_NAME_LEN` (15 code units) per TYPE_EXTEND directory entry regardless of actual content length, while the loop guard only checks accumulated `name_len` — a discrepancy a malicious image can exploit indefinitely. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS is 0.22%.
We are tasked to synthesize a comprehensive analysis for CVE-2026-64293. Need to output JSON. Given data: - CVE ID: CVE-2026-64293 - Description: long description about iommufd veventq read bug with sizeof(hdr) vs sizeof(*hdr). On 32-bit, under-counts header size, leading to buffer overflow past user-supplied buffer. - CVSS: 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CWE: N/A (but we can infer CWE-131: Incorrect Calculation of Buffer Size? Or maybe CWE-682: Incorrect Calculation? Not given.) - EPSS: 0.21% (percentile 11%) — low exploitation probability. - Patch: Available from vendor. - Reported by: Linux (likely Linux kernel) - CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (all versions) - Tags: Linux, Information Disclosure (though the vulnerability is actually a buffer overflow, but tags say Information Disclosure; perhaps they are generic tags, not precise) - ENISA EUVD ID: EUVD-2026-49005 - Affected versions (EUVD): weird entries: "Linux patch: 7.1.4", "Linux 6.15", "Linux patch: 0", "Linux patch: 7.2-rc1", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <be93d186ae88a92e7aa77e122d4e661fa57b1e39", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <0cdbb97a4dbd69abdd2ab998b4fbc7803d4b0b72", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <04a177f91160ee18da98f5689482cf0f589ec869", "Linux patch: 6.18.39" - Looks like commit ranges and patch references. Need to interpret. - References: three kernel git commits, NVD link, vuldb link. Analysis: Product name: Linux kernel (specifically iommufd subsystem). So product_name: "Linux Kernel". Summary: Must not copy description, write original synthesis. Buffer overflow in Linux kernel's iommufd subsystem, specifically in veventq read path due to sizeof(hdr) using pointer size instead of structure size, leading to potential memory corruption on 32-bit systems. Allowing local attackers with low privileges to gain elevated privileges or cause system compromise. CVSS 7.8 indicates local vector, low complexity, high im
Privilege escalation in the Linux kernel's KVM on ARM64 with pKVM allows a host with root privileges to corrupt hypervisor memory via an out-of-bounds list register index, potentially leading to full hypervisor compromise. The vulnerability arises from missing bounds clamping of the used_lrs field when copying vGIC state from host to hyp, enabling a malicious host to read or write beyond the implemented list registers. A patch is available across several stable kernel branches; the EPSS score is low (0.21%) and no public exploit or active exploitation is known at time of analysis.
Privilege escalation in the Linux kernel's
Incomplete dirty-page tracking in KVM's VMX fastpath userspace exit handling can lead to data corruption or availability loss in virtual machines. A local attacker with low privileges and the ability to run a KVM guest can trigger missed guest memory dirty markings, causing integrity and availability impacts on the host. No active exploitation is known, but vendor patches are available.
Integer overflow in the Linux kernel's KVM guest_memfd memslot binding logic allows a local attacker with low privileges to bypass a critical bounds check, potentially enabling memory corruption with high confidentiality, integrity, and availability impact. The flaw, introduced because offset and size were stored as signed loff_t rather than unsigned uoff_t values, causes the sum of a large positive offset and a valid size to silently wrap into a negative 64-bit value, which always satisfies the less-than comparison against the positive inode size. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low at 0.22% (13th percentile), but successful exploitation on an affected KVM host or guest would be severe.
Persistent denial-of-service condition in the Linux kernel's svcrdma transport occurs when a remote disconnect causes server worker threads to hang indefinitely during transport shutdown, pinning resources and preventing normal teardown. Attackers can trigger this without authentication, leading to resource exhaustion and complete service unavailability for NFS-over-RDMA. No active exploitation is known, and the EPSS exploitation probability is low (0.20%).
An integer truncation vulnerability in the Linux kernel's FPGA DFL-AFU driver allows a local attacker with low privileges to trigger memory corruption by sending a crafted DMA map ioctl. The issue arises from a missing upper bound check on a 64-bit length parameter from userspace, leading to an undersized pin of memory pages and potential out-of-bounds access. This can result in privilege escalation to root, impacting systems with the dfl-afu module loaded. No active exploitation or public exploit code has been identified at time of analysis.
Local privilege escalation in the Linux kernel's I2C subsystem allows a low-privileged local attacker to compromise system integrity, confidentiality, and availability via a race condition during I2C adapter deregistration. The vulnerability affects kernel versions from 2.6.31 up to unpatched releases, with fixes available in stable trees 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1. No public exploit code or active exploitation is currently reported, and EPSS indicates a low exploitation probability (0.21%).
Out-of-bounds read and write in the Linux kernel's synaptics-rmi4 F3A GPIO driver allows local low-privileged users to leak adjacent kernel slab memory to userspace or perform a controlled heap write via the evdev ioctl interface. The root cause is a size mismatch: gpio_key_map is allocated for at most 6 entries while input->keycodemax is set to the full device-reported gpio_count (up to 127), causing the input core's EVIOCGKEYCODE and EVIOCSKEYCODE ioctls to index past the allocation. No public exploit has been identified at time of analysis; EPSS is 0.22%.
Out-of-bounds read and write in the Linux kernel synaptics-rmi4 input driver allows a local attacker with low privileges to gain full root access by exploiting a bound-check flaw in the F30 GPIO/LED interrupt handler. Affects kernels where gpioled_count exceeds 6 and GPIO support is enabled, leading to memory corruption through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls. No known active exploitation, no public exploit code, and EPSS risk is very low (0.22%).
Stack out-of-bounds write in the Linux kernel Goodix touchscreen driver allows kernel stack memory corruption through a malicious, counterfeit, or physically tampered Goodix I2C touchscreen controller that advertises more than the supported maximum of 10 contact points. All Linux kernel versions from 4.1 through the pre-patch stable series are affected on systems equipped with Goodix GT-series touchscreen hardware; patched releases are available across all active stable branches. No public exploit code exists and no active exploitation has been reported (absent from CISA KEV), with EPSS placing exploitation probability at 0.22%.
Out-of-bounds heap write in the Linux kernel iforce force-feedback input driver allows a physically connected malicious device to corrupt kernel memory. The iforce driver's status packet handler blindly uses a device-supplied effect index masked only to 0-127 as an array subscript into a 32-entry array, enabling `test_and_set_bit`/`test_and_clear_bit` operations up to 95 entries past the array boundary and into trailing kzalloc'd structure members. No confirmed active exploitation exists (not in CISA KEV), and EPSS probability is very low at 0.22% (13th percentile), but successful exploitation against an unpatched kernel yields high confidentiality, integrity, and availability impact at the kernel heap level.
Touch event indexing in the Linux kernel mms114 driver misaligns reads for MMS134S and MMS136 controllers, which pack events at 6-byte intervals while the driver iterates at 8-byte struct offsets. On systems physically equipped with these MELFAS touch controllers, a locally privileged attacker can trigger multi-touch input processing that causes the driver to read kernel memory from incorrect offsets, potentially exposing sensitive data or corrupting kernel state. No public exploit or active exploitation has been identified; EPSS stands at 0.21%, reflecting negligible widespread exploitation risk at time of analysis.
Heap out-of-bounds write in the Linux kernel's touchwin serial touchscreen driver allows a malicious, malfunctioning, or counterfeit Touchwindow peripheral to corrupt kernel heap memory one attacker-chosen byte at a time, potentially enabling local privilege escalation or kernel crash. The flaw exists since Linux 2.6.19 and affects all stable branches through 7.1.3 and pre-7.2-rc1; patched versions have been released across six stable series (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4). EPSS is 0.22% (13th percentile) and no public exploit or CISA KEV listing has been identified, reflecting the niche hardware prerequisite that sharply limits real-world exposure.
Stack out-of-bounds write in the Linux kernel's mms114 touchscreen driver allows a physically-positioned attacker with access to the I2C bus - or the ability to substitute a malicious or counterfeit controller - to overwrite the IRQ-thread stack, corrupting the stack canary, saved registers, and return address for potential kernel-level code execution. Affected systems include Linux kernel builds from version 3.6 onward that load the mms114 driver on hardware incorporating the Melfas MMS114 touchscreen controller. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at just 0.21%, consistent with the narrow hardware-specific attack surface.
Host memory disclosure to a remote RDMA peer in the Linux kernel's RDMA/rtrs-srv (RTRS server) transport allows a connected peer to read beyond a mapped chunk buffer. When answering an RTRS READ, rdma_write_sg() set the outbound RDMA-Write source-SGE length directly from the attacker-controlled wire descriptor field desc[0].len, which was only rejected when zero, and used the PD-wide local_dma_lkey rather than the chunk's own MR, so the verbs layer never constrained the transfer to max_chunk_size. A peer advertising a length larger than the chunk can force the posted RDMA write to read past the chunk into adjacent host memory (disclosed back to the peer under passthrough/no-IOMMU configs) or trigger a translation fault that aborts the connection. No public exploit identified at time of analysis and EPSS is low (0.21%).
Out-of-bounds write in the Linux kernel's siw RDMA driver allows a remote attacker on an established iWARP connection to cause memory corruption and potential code execution by sending a crafted sequence of Read Response segments that exceed the read request's buffer length. Affects all Linux kernel versions with the siw driver since 5.3. No public exploit is known, and EPSS score is low (0.22%), but the CVSS rating is Critical (9.8).
A use-after-free in the FUSE subsystem of the Linux kernel allows a local attacker with permission to mount a FUSE filesystem to escalate privileges or crash the system. The vulnerability exists in fuse_ref_folio() due to improper request locking, and affects kernel versions from 2.6.35 through unpatched longterm branches. Patches are available, and no active exploitation or public exploit code has been identified.
Local privilege escalation in the Linux kernel FUSE subsystem allows a low-privileged attacker to corrupt kernel memory
Local privilege escalation in the Linux kernel's fuse-uring subsystem allows a local attacker to trigger a use-after-free condition by racing with the async stop queues function, potentially resulting in arbitrary code execution and complete system compromise. The vulnerability affects Linux kernel versions 6.14 through 6.18.x (patched in 6.18.39, 7.1.4,
A race condition in the Linux kernel's fuse-uring subsystem allows a local user to achieve privilege escalation and full system compromise. The vulnerability, triggered by concurrent operations on the queue->stopped flag outside of locking, leads to a use-after
Use-after-free in the Linux kernel’s fuse-uring subsystem allows a local authenticated attacker to escalate privileges. The race condition occurs when a malicious userspace sends a commit SQE before the kernel completes the memcpy of request data, triggering a freed fuse_req to be reused. CVSS base score is 7.8 but EPSS probability is low (0.21%), and no public exploit or active exploitation has been reported.
Memory exposure and denial of service in the Linux kernel SMB client allows remote attackers to read kernel memory or crash the system via crafted SMB2 responses. The vulnerability exists in versions prior to the patched releases, affecting all systems mounting SMB shares from untrusted servers. No authentication or user interaction is required, and while no active exploitation is reported, the high CVSS score reflects the serious confidentiality and availability impact.
Out-of-bounds memory access in the Linux kernel’s iwlwifi wireless driver allows a remote attacker on the same WiFi network to corrupt kernel memory, potentially leading to code execution or system crash. The flaw occurs in Block Acknowledgment session handlers where the sta_mask field is not checked before being used to index an array, causing a wrap-around when the mask is zero. Affected are kernel versions prior to 6.18.38 and 7.1.3; no active exploitation or public exploit code is known at this time, and EPSS indicates a low probability of exploitation.
Use-after-free in the Linux kernel's power sequence (pwrseq) debugfs seq_file handler allows a local attacker with low privileges to achieve privilege escalation or system compromise. The flaw arises from incorrect device reference counting in the seq_next callback, leading to reuse of a freed pointer. Affected kernels include versions since commit 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c; no active exploitation or public exploit has been confirmed at the time of analysis.
Use-after-free in the Linux kernel FPGA region subsystem allows a local authenticated attacker with low privileges to corrupt kernel memory, potentially achieving full confidentiality, integrity, and availability impact. The flaw in `child_regions_with_firmware()` stems from `of_node_put(child_region)` freeing the node before `pr_err()` dereferences the same pointer on an error path - a deterministic UAF triggered by a specific error condition in FPGA device tree enumeration. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), placing this firmly as a maintenance-priority fix for most environments rather than an emergency response item.
Out-of-bounds read in KVM's x86 Hyper-V paravirtualization layer allows a guest attacker with L2 nested VM control to read host kernel memory or trigger a hypervisor crash. The VP (Virtual Processor) ID field from the enlightened VMCS is used without bounds validation in `hv_is_vp_in_sparse_set()` when servicing paravirtual TLB flush hypercalls for L2 guests; the TLFS defines a maximum of 4096 VP IDs (64 banks × 64 vCPUs), but an L2 guest can supply an arbitrary value, causing an out-of-bounds array read confirmed by a KASAN use-after-free splat in the commit. No public exploit code exists at time of analysis, and EPSS sits at 0.16% (5th percentile), reflecting niche real-world exposure.
Use-after-free in the Linux kernel's linkstation-poweroff driver exposes systems running affected kernel versions on Buffalo LinkStation NAS hardware to local privilege escalation. The flaw resides in linkstation_poweroff_init(), where of_node_put(dn) was called before of_match_node() finished using the pointer, producing a kernel-space use-after-free that can corrupt slab-allocated memory. No public exploit has been identified and the EPSS score of 0.16% (6th percentile) indicates very low observed exploitation probability, though the official CVSS base severity is 7.8 (High) with confirmed high impact to confidentiality, integrity, and availability.
Use-after-free in the Linux kernel fbdev subsystem's fb_find_mode() function allows a local attacker with low privileges to read freed kernel heap memory, potentially achieving information disclosure, memory corruption, or privilege escalation. The flaw exists when mode_option is NULL: a heap-allocated buffer (mode_option_buf) is freed while the local alias name still references it during the name_matches() comparison loop. Patched versions are available across multiple stable branches (6.6.144, 6.12.95, 6.18.38, 7.1.3, 7.2-rc1). No public exploit exists and EPSS sits at the 6th percentile, but the CVSS 7.8 High score correctly reflects the maximum-impact potential of kernel-level heap memory corruption.
Improper bounds checking in the Linux kernel's ASoC simple-mux driver allows a local attacker with low privileges to cause an out-of-bounds array index, leading to kernel memory disclosure and system crash. The driver erroneously accepts the maximum enum value (2) as valid for a two-entry mux, enabling an invalid mux state to propagate into GPIO and DAPM operations. Vendor patches are available for affected stable kernels, and no public exploit or active exploitation is known at this time.
Double free corruption in the Linux kernel's net2280 USB gadget driver probe error path enables local low-privilege users to corrupt kernel heap memory, potentially escalating privileges or triggering a system crash. The flaw affects all Linux kernel stable branches from 5.10 through 7.x prior to their respective patch releases (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, 7.1). Discovered by static analysis rather than active exploitation - no public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.17% (6th percentile), consistent with the niche hardware dependency of the affected driver.
Use-after-free in the Linux kernel DAMON (Data Access Monitor) sysfs subsystem allows a local, low-privileged user with sysfs write access to corrupt kernel memory structures, potentially escalating to full kernel-level code execution. The DAMOS tried-region directory removal function (damon_sysfs_scheme_regions_rm_dirs()) decrements kobject reference counts but omits removing region objects from the tracking linked list; asynchronous execution of the kobj release callback leaves dangling list entries that a concurrent list rebuild can write into freed memory. No public exploit or active exploitation has been identified - EPSS is 0.16% (5th percentile) and the vulnerability is absent from CISA KEV - consistent with a hardening fix rather than an actively weaponized flaw.
Out-of-bounds read in the Linux kernel elan_i2c touchpad driver allows a local authenticated user to leak kernel memory or crash the system by supplying a malformed firmware blob. The driver fails to validate that the firmware file is large enough to contain the expected number of pages plus the trailing signature before accessing them, affecting all stable kernel branches from 5.10.x through 7.x prior to their respective fix versions. No active exploitation is confirmed (not in CISA KEV), and EPSS is very low at 0.17% (6th percentile), indicating this is a local hardware-driver concern rather than an imminent widespread threat.
Denial of service in the Linux kernel's x86/ftrace dynamic trampoline mechanism causes a kernel panic when CONFIG_CALL_DEPTH_TRACKING is enabled on retbleed-affected platforms (e.g., Skylake) using retbleed=stuff. An attacker with local privileged access to configure ftrace can trigger a crash by setting up a kprobe event and invoking the traced function. No active exploitation or public exploit has been reported, and the EPSS probability is 0.16% (5th percentile), indicating low real-world risk.
A kernel crash (BUG_ON) in the block layer's integrity segment handling can be triggered on systems using dm-multipath over NVMe/RDMA with data integrity protection. The vulnerability arises when a cloned request inherits an incorrect nr_integrity_segments count from the upper queue, causing a mismatch that panics the kernel during dispatch. Only local authenticated users with the ability to issue I/O to the affected stacked device can exploit this, leading to a denial of service.
Local privilege escalation in the Linux kernel's sched_ext subsystem allows a low-privileged local attacker to achieve root access via a use-after-free error in the scx_root_enable_workfn() initialization failure path. The vulnerability is fixed by reordering the put_task_struct() call after scx_error() to prevent premature freeing of the task structure. No active exploitation or public exploit has been reported, and EPSS indicates low exploitation likelihood.
Out-of-bounds array access in the Linux kernel's OcteonTX2 CGX network driver exposes kernel memory to read or corruption when hardware firmware returns an unexpected link speed index value. The `cgx_speed_mbps` array holds 13 entries (indices 0-12) but the `RESP_LINKSTAT_SPEED` firmware response field can produce values 0-15, causing indices 13-15 to access memory beyond the array boundary. No public exploit has been identified at time of analysis; EPSS sits at 0.18% (7th percentile) with no CISA KEV listing, though patches are now available across multiple stable kernel branches.
Double free memory corruption in the Linux kernel's OcteonTX2 PF representor driver allows a local low-privileged user on hardware-equipped systems to corrupt kernel slab allocator state via rvu_rep_rsrc_init(), potentially enabling privilege escalation to root. The defect was identified by an experimental static analysis tool during review of v6.13-rc1 and confirmed present through v7.1-rc3 via manual inspection. No active exploitation is confirmed (not in CISA KEV), no public exploit code exists, and vendor-released patches are available across multiple stable kernel branches.
Out-of-bounds heap read in the Linux kernel mac80211 WiFi stack allows an adjacent wireless attacker with no authentication to trigger a slab-out-of-bounds read by sending a crafted 802.11be negotiated TTLM element with a sparse link-map presence bitmap. Affected kernels from 6.9 through 6.12.91, 6.18.33, and 7.0.10 advance the TTLM parser cursor for every TID regardless of whether a presence bit is set, reading past the validated element allocation. The raw read bytes are gated by valid_links before any driver state change, limiting direct policy impact; the primary risk is kernel crash (availability). No public exploit or CISA KEV listing exists; EPSS is 0.17%.
Double free in the Linux kernel's octeontx2-pf driver allows a local attacker with low privileges to corrupt kernel memory, potentially leading to privilege escalation or system crash. The flaw is in the error-handling paths of otx2_pool_aq_init() and cn20k_pool_aq_init(), where a freed stack pointer is not set to NULL and is subsequently freed again during cleanup. Exploitation requires a system with OcteonTX2 or
Local privilege escalation in the Linux kernel's ti-qspi SPI driver results from a use-after-free when DMA setup fails, allowing a local attacker to potentially execute arbitrary code or crash the system. The vulnerability affects Linux kernels from version 4.12 up to the patched stable releases 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No active exploitation has been confirmed (CISA KEV not listed), and the EPSS probability is low (0.18%), indicating limited real-world likelihood.
A stack buffer overflow in the AMD display driver (dc_process_dmub_aux_transfer_async) within the Linux kernel allows a local authenticated attacker with low privileges to potentially execute arbitrary code or crash the system. The flaw arises from missing bounds checks on payload length and link_index, impacting all kernels before the patched versions. While no active exploitation or public proof-of-concept is reported, the issue affects a wide range of systems with AMD GPUs.
Use-after-free in the Linux kernel's batman-adv BLA backbone gateway purging allows local attackers to escalate privileges. When stale backbone_gw entries are freed without properly synchronizing or canceling their pending `report_work` items, a race condition can cause the worker to access freed memory, leading to memory corruption and potential code execution with kernel privileges. Exploitation requires local low-privilege access and a system running the batman-adv module with backbone gateways active; no public exploit or active exploitation has been identified.
Out-of-bounds write in the Linux kernel's netfs subsystem enables a local, low-privileged attacker to corrupt kernel memory by crafting network filesystem I/O operations that cause iov_iter_extract_pages() to overfill the pages[] array in netfs_extract_user_iter(). The memory corruption occurs before any bounds guard is applied, making this a CWE-787 write-past-end condition with kernel privilege escalation potential. No public exploit code exists and the CVE is absent from the CISA KEV catalog; EPSS is 0.17% (6th percentile), consistent with no observed active exploitation.
Use-after-free in the Linux kernel’s netfs library allows a local attacker to escalate privileges or cause denial of service. The race condition occurs when unlocking abandoned read folios after a netfs request completes, potentially corrupting kernel memory. No active exploitation or public exploit is known at this time.
Unlocked concurrent writes to the mlx5e ICOSQ (Internal Completion Queue Send Queue) in the Linux kernel's AF_XDP path allow a race condition during CPU affinity changes to corrupt work-queue state, producing bad CQEs and kernel warnings observed in production on Mellanox/NVIDIA ConnectX interfaces. Two distinct races exist: mlx5e_trigger_irq() racing with mlx5e_xsk_alloc_rx_mpwqe() across CPUs after NAPI completion, and mlx5e_trigger_irq() racing with mlx5e_trigger_napi_icosq() on the same path. The vulnerability manifests as an availability impact - corrupt ICOSQ entries trigger hardware-level error CQEs - with no public exploit code and EPSS at 0.15% (5th percentile), reflecting its operational rather than adversarial trigger.
Out-of-bounds read in the Qualcomm QMP USB-C PHY driver (`phy: qcom: qmp-usbc`) of the Linux kernel allows a local low-privileged user to read kernel memory beyond the bounds of the `swing_tbl` and `pre_emphasis_tbl` DisplayPort signal-tuning arrays, risking kernel memory disclosure or a kernel panic. The root cause is an off-by-one error where the boundary guard uses `> 4` instead of `>= 4`, permitting array index 4 on 4-element (0-3) rows. Exploitation is constrained to Qualcomm SoC hardware with USB-C DisplayPort capability; EPSS at 0.15% (5th percentile) and the absence of a KEV listing indicate no public exploit and very low current exploitation probability.
A remote denial-of-service vulnerability in the Linux kernel's AF_RXRPC subsystem allows unauthenticated attackers to crash the system by sending malicious RxGK-secured DATA packets. The flaw stems from missing length checks in the Kerberos 5 crypto library before message decryption or verification. While the CVSS score is 7.5 (High), no active exploitation or public proof-of-concept exists, and EPSS predicts a low exploitation probability (0.17%), suggesting limited immediate real-world risk.
Information disclosure and potential data corruption in the Linux kernel's XFS filesystem can allow a local attacker with low privileges to achieve high integrity, confidentiality, and availability impact. The vulnerability resides in the reflink copy-on-write logic where stale data fork mappings are used after cycling the ILOCK, leading to inaccurate shared-extent tracking. No active exploitation or public exploit code has been identified at time of analysis, and a vendor patch is available.
Deadlock in the Linux kernel Bluetooth L2CAP subsystem during connection teardown can be triggered by an adjacent attacker via crafted Bluetooth traffic, leading to a denial of service. The vulnerability arises from an incorrect mutex acquisition order in l2cap_conn_del() and process_pending_rx(), as confirmed by a provided proof-of-concept and static analysis. While the official CVSS score indicates full compromise, the exploit only demonstrates a deadlock; no public exploitation outside of the PoC has been identified, and EPSS probability is low (0.16%).
Stack out-of-bounds read/write in the Linux kernel i2c-stub driver allows a local user with access to /dev/i2c-* to corrupt kernel stack memory by issuing an I2C_SMBUS ioctl with an oversized block length. The i2c-stub driver's stub_xfer() implements .smbus_xfer directly, bypassing the I2C_SMBUS_BLOCK_MAX (32-byte) length validation applied in the generic i2c_smbus_xfer_emulated() path, meaning data->block[0] values above 32 are accepted and used as a loop bound, reading or writing past the end of the 34-byte union i2c_smbus_data.block buffer onto the kernel stack. No public exploit has been identified at time of analysis and EPSS is 0.17%, but the KASAN trace in the description confirms the crash path is reachable.
Use-after-free in the Linux kernel netfilter ipset subsystem allows a local user with Netlink privilege to corrupt kernel memory by racing dump operations against a concurrent ip_set_list array resize. The dump callbacks ip_set_dump_do() and ip_set_dump_done() dereference the inst->ip_set_list array pointer outside any RCU read-side critical section; a concurrent ip_set_create() publishes a new array, calls synchronize_net(), and then frees the old array - but synchronize_net() does not wait for the unprotected dump readers, resulting in a slab use-after-free. No public exploit has been confirmed at time of analysis, though the KASAN trace embedded in the CVE description references a task named 'exploit/150', indicating a functional proof-of-concept was used to produce the report during responsible disclosure.
Use-after-free in the Linux kernel's Qualcomm rmnet networking driver allows a local attacker with low privileges to escalate to kernel-level code execution. The flaw occurs when the rmnet endpoint is freed while still being referenced by concurrent receive path handlers, leading to memory corruption. No active exploitation or public exploit code has been identified, but the high CVSS score reflects a significant local privilege escalation risk.
Use-After-Free in the Linux kernel HID letsketch driver allows local exploitation during device unbind, potentially enabling kernel memory corruption and privilege escalation on affected systems. The letsketch_probe() function arms a per-device kernel timer (inrange_timer) with a 100 ms timeout, but no .remove callback exists to drain the timer before devm cleanup frees letsketch_data and input_dev structures on USB unplug or rmmod, producing a UAF read/write into freed kernel memory. Patches are backported across six stable kernel branches; no public exploit code exists and EPSS is 0.21% (12th percentile), reflecting the niche device requirement and race-condition complexity.
Out-of-bounds bit manipulation in the Linux kernel HID multitouch driver allows an attacker with a crafted USB or Bluetooth multitouch device to corrupt adjacent kernel data structures and panic the kernel. The driver uses mt_io_flags - a single unsigned long - as a variable-length per-slot bitmap indexed by slot number, which is bounded only by the device-reported ContactCountMaximum (up to 255). When that value exceeds BITS_PER_LONG, set_bit()/clear_bit() operations in mt_release_contacts() overwrite adjacent struct mt_device members, zeroing the td->applications list head and causing a null-pointer dereference in softirq context. No local privileges are required; physically connecting a crafted device is sufficient. No public exploit code has been identified at time of analysis.
Use-after-free in the Linux kernel HID appleir driver allows a local attacker to corrupt kernel memory during device removal, potentially achieving privilege escalation. The race condition exists between the key_up_timer callback (armed by appleir_raw_event() on each keydown/key-repeat) and hid_hw_stop(), which frees the underlying input_dev before the timer is drained. A second race window, where a USB URB completion during hid_hw_stop() can re-arm the timer via mod_timer(), means a simple teardown reorder is insufficient — the fix introduces a spinlock-gated 'removing' flag combined with timer_shutdown_sync() to permanently disable further callbacks. No public exploit has been identified at time of analysis, and EPSS is 0.22% (13th percentile).
Use-after-free in the Linux kernel HID lg-g15 driver allows a local attacker to trigger kernel memory corruption by racing device input events against USB keyboard removal. The driver allocates lg_g15_data via devm and schedules work items from HID report handlers (backlight cycle key on G15, G15 v2, G510), but lacked a remove callback to cancel pending work before devres freed the allocation. On kernel versions from approximately 5.5 through the unfixed stable branches, unplugging the keyboard while a work item is pending causes the worker to dereference freed memory via container_of, potentially enabling local privilege escalation. No public exploit has been identified and EPSS is 0.22% (13th percentile), indicating no observed widespread exploitation.
Integer wrap-around in the Linux kernel's HFS/HFS+ filesystem driver allows a local low-privileged user to bypass a critical bounds check, triggering a memmove that reads approximately 4GB past a node buffer in kernel memory. The flaw originates in check_and_correct_requested_length(), where u32 arithmetic on off+len wraps silently when len arrives as a large underflowed value from hfs_brec_remove(); the wrapped result passes the node_size guard and proceeds to an out-of-bounds memory operation. No public exploit has been identified at time of analysis, and EPSS stands at 0.22%, reflecting low real-world exploitation expectation despite full C:H/I:H/A:H impact ratings.
An out-of-bounds memory access in the Linux kernel's BPF devmap broadcast redirect for XDP frames, introduced in version 5.14, can be triggered by remote unauthenticated attackers sending specially crafted fragmented network packets. This could lead to kernel memory corruption and arbitrary code execution. Though CVSS rates this as critical (9.8), no public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.21%).
Arbitrary code execution in the Linux kernel's BPF BTF parser allows local privilege escalation. Malformed BTF data can cause an integer overflow in the repeated field count calculation, bypassing a capacity check and leading to a heap buffer overflow. With low EPSS score (0.21%), widespread exploitation is currently unlikely, but unprivileged local users who can load BPF programs are at risk of complete system compromise.
Incorrect RCU lock annotations in the Linux kernel's BPF LPM trie map implementation (`kernel/bpf/lpm_trie.c`) cause lockdep false positives on debug kernels when sleepable BPF programs access `BPF_MAP_TYPE_LPM_TRIE` maps via lookup, update, or delete operations. The mismatch arises because sleepable BPF programs hold `rcu_read_lock_trace()` while the trie code asserts `rcu_read_lock_bh_held()` or `rcu_read_lock_held()`, producing repeated 'suspicious RCU usage' kernel warnings per distinct callsite. The Linux kernel developers explicitly state no actual use-after-free occurs, since Tasks Trace RCU already serializes against trie node reclaim; however, the incorrect annotation undermines lockdep's ability to detect future regressions and is increasingly impactful as sleepable BPF LSM programs become common in production security tooling. No public exploit exists and no CISA KEV listing has been issued.
Use-after-free and memory leak in the Linux kernel's EHCI and FOTG210 USB isochronous submit paths expose systems running kernel versions from 2.6.15 through 7.1.3 to local kernel memory corruption by a low-privileged user. When an isochronous URB submission fails before the staged schedule handoff - either because the host controller becomes inaccessible or usb_hcd_link_urb_to_ep() returns an error - the ehci_iso_sched allocation is not freed and urb->hcpriv retains a dangling pointer, creating a UAF condition. No public exploit exists and the EPSS score is 0.21% (12th percentile), but vendor-released patches across multiple stable branches are available and should be applied to eliminate the risk.
Use-after-free in the Linux kernel USB gadget UDC subsystem exposes systems with DWC3-based USB controllers to a race condition between usb_del_gadget() and gadget_match_driver(), enabling a NULL pointer dereference that can crash the kernel or enable privilege escalation on unpatched systems. The flaw affects all major Linux stable branches from 5.15.x through 7.1.x prior to the patched releases, and is particularly relevant for embedded Linux, Android-based devices, and IoT hardware that use USB gadget/device mode. No public exploit has been identified at time of analysis, and EPSS remains at 0.21% (12th percentile), reflecting current low exploitation interest.
Use-after-free in the Linux kernel's idmouse USB fingerprint driver allows a low-privileged local attacker to corrupt kernel memory by racing a device disconnect against a file-descriptor release, potentially enabling local privilege escalation to root. The bug stems from `mutex_unlock()` accessing the freed driver-data structure after the lock is released, a documented non-atomic behavior; the fix introduces a `kref` reference counter to correctly manage object lifetime. Patches are available across all active stable branches; no active exploitation or public exploit has been reported.
Use-after-free in the Linux kernel's USB ldusb driver allows a local unprivileged user to corrupt kernel memory by racing disconnect() against release() on a connected USB device. The root cause is that mutex_unlock() is documented as non-atomic and may access the mutex object after it logically releases the lock, creating a window where the driver data structure can be freed while still in use. No public exploit has been identified at time of analysis, and EPSS is low (0.22%), but the C:H/I:H/A:H CVSS impact vector reflects the potential for full kernel privilege escalation if successfully triggered.
Use-after-free in the Linux kernel's USB iowarrior driver exposes systems with Code Mercantile IO-Warrior USB devices to kernel memory corruption, potentially enabling local privilege escalation to root. The defect exists because submitted write URBs are not cancelled during close(), leaving them in-flight at disconnect time; the completion handler then fires against already-freed device structures. No public exploit code has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects minimal observed exploitation pressure, though the C:H/I:H/A:H CVSS impact reflects genuine kernel-level consequence.
Use-after-free in the Linux kernel USB iowarrior driver allows a local unprivileged user to corrupt kernel memory when a USB device disconnect races with a file release operation. The root cause is that mutex_unlock() is documented as non-atomic and may access the mutex structure after releasing the lock, meaning the driver data object can be freed while mutex_unlock() is still executing. An attacker who can trigger the race - by opening the iowarrior device and simultaneously provoking a USB disconnect - may achieve kernel memory corruption leading to privilege escalation. No public exploit code exists and EPSS is low (0.21%), but the impact class is standard kernel UAF.
The Linux kernel's legousbtower USB driver contains a use-after-free race condition between the release() and disconnect() code paths, present since Linux 2.6.25. An authenticated local user with a LEGO USB Tower device attached can trigger the race at disconnect time to corrupt freed kernel memory, potentially gaining elevated privileges or crashing the system. Patches have been issued across all active stable branches (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1); no public exploit code or CISA KEV listing exists at time of analysis.
Slab out-of-bounds read in the Linux kernel usbio USB driver (drivers/usb/misc/usbio) leaks adjacent kernel heap memory to local unprivileged processes via the i2c subsystem. The flaw lies in usbio_bulk_msg(), which validates the device-supplied payload length against the TX buffer size rather than the smaller RX buffer size, allowing a malicious USB device with mismatched endpoint wMaxPacketSize values to drive memcpy() past the end of the rxbuf slab object. Over-read kernel heap bytes propagate through the i2c layer to userspace via i2c-dev, and under KASAN-enabled kernels the bug is reported as a slab-out-of-bounds crash. No public exploit has been identified at time of analysis; the bug was found by code review and confirmed with a userspace AddressSanitizer model and a USB raw-gadget plus dummy_hcd kernel reproducer.
Local privilege escalation in the Linux kernel's digi_acceleport USB serial driver allows authenticated local users to corrupt kernel memory and execute arbitrary code as root. The vulnerability arises from a race condition in the digi_write_inb_command() function that mishandles timeouts and incorrectly updates transfer buffers, leading to write buffer corruption. No active exploitation has been reported, and publicly available exploit code has not been identified; a vendor patch is available across multiple stable kernel branches.
Out-of-bounds array read in the Linux kernel's USB Type-C Port Manager (TCPM) svdm_consume_modes() function allows a physically connected malicious USB-C partner device to read kernel memory beyond the svids[] array boundary and force registration of an arbitrary, attacker-chosen SVID via typec_partner_register_altmode(). The vulnerability arises because pmdata->svid_index - which is incremented in response to partner-supplied SVDM messages - is never validated against SVID_DISCOVERY_MAX (16) before indexing pmdata->svids[]. Patches are confirmed available across eight stable kernel branches (5.10 through 7.2-rc3); no public exploit or CISA KEV listing exists at time of analysis.
Use-after-free in the Linux kernel's USB Type-C UCSI CCG driver allows a local attacker with low privileges to corrupt kernel memory, potentially achieving arbitrary kernel code execution. The flaw exists in the module teardown path of the Cypress CCG UCSI driver: ucsi_ccg_remove() calls ucsi_destroy() - which kfree()s the ucsi object - before calling free_irq(), leaving a window in which the threaded IRQ handler ccg_irq_handler() can access the freed ucsi struct via ucsi_notify_common(). No public exploit code exists and the bug was discovered by static analysis; EPSS is 0.22% (13th percentile), reflecting no observed in-the-wild activity.
Local denial of service in the Linux kernel UDF filesystem allows an unprivileged local user to panic the system by truncating a file on a crafted UDF media. On desktop systems where polkit permits unprivileged mounting of removable media, an attacker can trigger this reliably. The vulnerability has public patches with exact fixed versions and a low EPSS exploitation probability (0.21%).
Out-of-bounds read in the Linux kernel's UDF filesystem driver allows a local low-privileged attacker to leak kernel memory or cause a denial of service by mounting a crafted UDF image with a malicious Virtual Allocation Table (VAT) header. The vulnerability resides in the udf_load_vat() function, which fails to validate the attacker-controlled VAT header length against the inode size, leading to a large out-of-bounds read index. No active exploitation or public proof-of-concept has been identified; EPSS predicts a very low exploitation probability (0.22%).
Out-of-bounds read and write in the Linux kernel's UDF filesystem driver allows a local attacker with the ability to mount a crafted UDF image to escalate privileges to root. The vulnerability stems from the sparing table length being validated as a byte count but consumed as an entry count, leading to memory corruption. No active exploitation (KEV) or public proof-of-concept is currently known, and EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Heap-based out-of-bounds read in the Linux kernel's nvmet discovery log page handler allows unauthenticated remote attackers to leak kernel memory or crash the host. Any system acting as an NVMe over Fabrics target with a discovery service exposed via TCP, RDMA, or FC is vulnerable. No active exploitation or public exploit code is reported at this time, and EPSS probability is low (0.25%), but the impact and ease of exploitation make remediation urgent for affected storage targets.
Out-of-bounds heap read in the Linux kernel's nvmet-auth module allows pre-authentication remote attackers to read up to 526 bytes of heap memory beyond a crafted DHCHAP_REPLY message. By sending an NVMe-oF authentication reply with a small transfer length but inflated hash and DH value length fields, an unauthenticated attacker can extract sensitive data or cause a denial-of-service. Patches are available in upstream stable kernels.
We are tasked with synthesizing data from multiple sources about CVE-2026-64318 into a comprehensive analysis, returning a JSON object with specified fields. Let's carefully parse the provided information. CVE-2026-64318: In the Linux kernel, a vulnerability in the AIX partition handling. The description: "aix_partition() reads the physical volume descriptor... pp_count is unvalidated, so a crafted AIX image with pp_count > 1016 drives an out-of-bounds read... bound the scan to array size." From description: - Product: Linux kernel, specifically the partition handling for AIX disks (block/partitions/aix.c). So product_name: "Linux Kernel". - CVSS Score: 7.1, Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - CWE: N/A - EPSS: 0.22% (percentile 13%) - Patch: Available from vendor - Tags: Linux, IBM, Information Disclosure - KEV status: not mentioned (likely not KEV). POC? Not mentioned. So no active exploitation or public exploit identified from data. - CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (but note: Linux kernel is typically "o:linux:linux_kernel", but given as "a" application? The data says "cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*". We'll use it as is, but product_name Linux kernel is correct.) - Affected versions: We have a list of git commit ranges and patches. We can extract the fix versions: mention specific stable versions patched: 7.1.4, 6.18.39, 5.15.212, 5.10.261, 7.2-rc1, 6.6.145, 6.12.96, 6.1.178, and the initial commit from 3.11. So the vulnerability was introduced long ago (Linux 3.11) and fixed in multiple stable branches. The description mentions "Linux 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 < ..." which is the commit that fixed it? Possibly the fix commit. The EUVD entries give commit ranges where the vulnerability exists. We'll synthesize: Affected: Linux kernel versions from 3.11 up to before the fix in the 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1, 7.2 series. So we can say "Linux kernel versions prior to the patched releases: 5.10.261, 5.1
Information disclosure in the Linux kernel's isofs filesystem driver allows a local attacker to leak up to 255 bytes of kernel heap memory to userspace by mounting a crafted ISO 9660 image. Because
Information disclosure in the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver can expose cryptographic key material via debug logs when CONFIG_DYNAMIC_DEBUG is enabled. A local attacker with low privileges could capture hex dumps of keys from kernel ring buffer, leading to full compromise of confidentiality, integrity, and availability. Patches are available in multiple stable kernel branches; no active exploitation or public exploit code has been identified.
Incorrect carry overflow in the Linux kernel's ECC vli multiplication allows adjacent network attackers to cause incorrect ECDH shared secret derivation, potentially enabling man-in-the-middle attacks against ECDH-based protocols such as IPsec, TLS, and Wi-Fi WPA3. The vulnerability, introduced in kernel 4.8, can be exploited without authentication or user interaction if ECDH is enabled. No active exploitation or public exploit has been identified, but the bug fundamentally weakens cryptographic guarantees.
Denial of service in the Linux kernel's pcrypt crypto template allows remote unauthenticated attackers to crash the system by triggering a faulty fallback path. When the parallel execution via padata fails (e.g., due to resource pressure), the pcrypt module does not restore the original callback, leading to unsafe execution of the parallel-only completion routine and kernel memory corruption. The vulnerability has a low EPSS score (0.22%, 13th percentile), no public exploit or active exploitation, and patches are available in multiple stable kernel series.
Use-after-free and missing forward security in the loongson-rng crypto driver of the Linux kernel allow a local, low-privilege attacker to corrupt memory and potentially execute arbitrary code, compromise system integrity, or read sensitive information. Affected systems are primarily Loongson-based machines running kernels between v6.18 and the respective fix versions; the driver itself is unused by any in‑kernel consumer and is being removed entirely rather than patched. No active exploitation or public exploit code is known, and the EPSS exploitation probability is low (0.21%).
Use-after-free and list corruption in the Linux kernel's Intel QuickAssist Technology (QAT) crypto driver allows a local low-privileged attacker to trigger kernel memory corruption by racing concurrent service registration and device lifecycle operations. The crypto/qat subsystem's service_table linked list is guarded by service_lock only during insertions and deletions, but seven device-state functions iterate the list unprotected, enabling a concurrent adf_service_register() or adf_service_unregister() call to mutate the list mid-traversal. Exploiting this race can result in kernel crash, arbitrary kernel memory read, or local privilege escalation to root. No public exploit code has been identified and EPSS stands at 0.21% (11th percentile), but the impact class is high for systems running QAT-capable Intel hardware.
Out-of-bounds write in the Linux kernel Intel QAT (Quick Assist Technology) RSA CRT driver corrupts kernel DMA memory when a local attacker supplies an RSA private key with CRT components larger than half the modulus size. The QAT driver's qat_rsa_setkey_crt() allocates DMA buffers at key_sz/2 but the right-alignment expression `dst + half_key_sz - len` wraps on unsigned underflow when len > half_key_sz, directing memcpy to write attacker-controlled bytes past the DMA allocation. No public exploit code exists at time of analysis; EPSS is 0.22% and the bug has been present since Linux 4.8 across all maintained stable branches.
Use-after-free vulnerability in the Linux kernel's fsl-lpspi SPI driver can lead to memory corruption or arbitrary code execution with kernel privileges. A local attacker with high privileges on systems using the affected driver can trigger this flaw, potentially causing a kernel panic or full system compromise. At time of analysis, no public exploit or active exploitation is identified, and EPSS indicates low exploitation probability (0.22%).
Page use-after-free in the Linux kernel perf/aux subsystem allows a local authenticated attacker to read or write freed kernel memory, potentially achieving privilege escalation. The flaw arises because map_range() accesses rb->aux_pages[], rb->aux_nr_pages, and rb->aux_pgoff while holding only the per-event mmap_mutex, whereas those fields are serialised by the ring-buffer-level rb->aux_mutex; two events sharing one ring buffer via PERF_EVENT_IOC_SET_OUTPUT can therefore race rb_alloc_aux() against map_range(), leaving a VM_PFNMAP mapping pointing to a freed physical frame. No public exploit has been identified at time of analysis, and EPSS exploitation probability is very low at 0.21% (11th percentile).
Out-of-bounds slab read in the Linux kernel tracing subsystem allows a local attacker with access to the trace event filter interface to leak kernel slab memory or crash the kernel. The flaw exists because `regex_match_glob()` ignores the bounded length passed by filter predicate functions and calls the NUL-terminated-string-only `glob_match()`, which scans past the end of non-NUL-terminated dynamic string fields - exemplified by XFS namespace tracepoints whose dynamic char arrays are copied without a trailing NUL. EPSS is 0.22% (13th percentile); no public exploit code exists and the vulnerability is not listed in CISA KEV.
Unauthorized file truncation in the Linux kernel's NFSv4 client allows local attackers to bypass write permission checks when opening a file with O_RDONLY|O_TRUNC. By exploiting a missing MAY_WRITE permission mask during cached delegated opens, an attacker without write access can truncate files, causing data loss. No public exploit or active exploitation has been identified, and EPSS indicates a 0.22% exploitation probability.
Out-of-bounds read and write in the Linux kernel exFAT filesystem driver's `exfat_find_dir_entry()` allows a local attacker with low privileges to corrupt kernel heap memory or read adjacent kernel data by mounting or triggering access to a crafted exFAT filesystem image. The bug arises because the `uniname` output pointer advances by a fixed stride of `EXFAT_FILE_NAME_LEN` (15 code units) per TYPE_EXTEND directory entry regardless of actual content length, while the loop guard only checks accumulated `name_len` — a discrepancy a malicious image can exploit indefinitely. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS is 0.22%.
We are tasked to synthesize a comprehensive analysis for CVE-2026-64293. Need to output JSON. Given data: - CVE ID: CVE-2026-64293 - Description: long description about iommufd veventq read bug with sizeof(hdr) vs sizeof(*hdr). On 32-bit, under-counts header size, leading to buffer overflow past user-supplied buffer. - CVSS: 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CWE: N/A (but we can infer CWE-131: Incorrect Calculation of Buffer Size? Or maybe CWE-682: Incorrect Calculation? Not given.) - EPSS: 0.21% (percentile 11%) — low exploitation probability. - Patch: Available from vendor. - Reported by: Linux (likely Linux kernel) - CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (all versions) - Tags: Linux, Information Disclosure (though the vulnerability is actually a buffer overflow, but tags say Information Disclosure; perhaps they are generic tags, not precise) - ENISA EUVD ID: EUVD-2026-49005 - Affected versions (EUVD): weird entries: "Linux patch: 7.1.4", "Linux 6.15", "Linux patch: 0", "Linux patch: 7.2-rc1", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <be93d186ae88a92e7aa77e122d4e661fa57b1e39", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <0cdbb97a4dbd69abdd2ab998b4fbc7803d4b0b72", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <04a177f91160ee18da98f5689482cf0f589ec869", "Linux patch: 6.18.39" - Looks like commit ranges and patch references. Need to interpret. - References: three kernel git commits, NVD link, vuldb link. Analysis: Product name: Linux kernel (specifically iommufd subsystem). So product_name: "Linux Kernel". Summary: Must not copy description, write original synthesis. Buffer overflow in Linux kernel's iommufd subsystem, specifically in veventq read path due to sizeof(hdr) using pointer size instead of structure size, leading to potential memory corruption on 32-bit systems. Allowing local attackers with low privileges to gain elevated privileges or cause system compromise. CVSS 7.8 indicates local vector, low complexity, high im
Privilege escalation in the Linux kernel's KVM on ARM64 with pKVM allows a host with root privileges to corrupt hypervisor memory via an out-of-bounds list register index, potentially leading to full hypervisor compromise. The vulnerability arises from missing bounds clamping of the used_lrs field when copying vGIC state from host to hyp, enabling a malicious host to read or write beyond the implemented list registers. A patch is available across several stable kernel branches; the EPSS score is low (0.21%) and no public exploit or active exploitation is known at time of analysis.
Privilege escalation in the Linux kernel's
Incomplete dirty-page tracking in KVM's VMX fastpath userspace exit handling can lead to data corruption or availability loss in virtual machines. A local attacker with low privileges and the ability to run a KVM guest can trigger missed guest memory dirty markings, causing integrity and availability impacts on the host. No active exploitation is known, but vendor patches are available.
Integer overflow in the Linux kernel's KVM guest_memfd memslot binding logic allows a local attacker with low privileges to bypass a critical bounds check, potentially enabling memory corruption with high confidentiality, integrity, and availability impact. The flaw, introduced because offset and size were stored as signed loff_t rather than unsigned uoff_t values, causes the sum of a large positive offset and a valid size to silently wrap into a negative 64-bit value, which always satisfies the less-than comparison against the positive inode size. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low at 0.22% (13th percentile), but successful exploitation on an affected KVM host or guest would be severe.
Persistent denial-of-service condition in the Linux kernel's svcrdma transport occurs when a remote disconnect causes server worker threads to hang indefinitely during transport shutdown, pinning resources and preventing normal teardown. Attackers can trigger this without authentication, leading to resource exhaustion and complete service unavailability for NFS-over-RDMA. No active exploitation is known, and the EPSS exploitation probability is low (0.20%).
An integer truncation vulnerability in the Linux kernel's FPGA DFL-AFU driver allows a local attacker with low privileges to trigger memory corruption by sending a crafted DMA map ioctl. The issue arises from a missing upper bound check on a 64-bit length parameter from userspace, leading to an undersized pin of memory pages and potential out-of-bounds access. This can result in privilege escalation to root, impacting systems with the dfl-afu module loaded. No active exploitation or public exploit code has been identified at time of analysis.
Local privilege escalation in the Linux kernel's I2C subsystem allows a low-privileged local attacker to compromise system integrity, confidentiality, and availability via a race condition during I2C adapter deregistration. The vulnerability affects kernel versions from 2.6.31 up to unpatched releases, with fixes available in stable trees 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1. No public exploit code or active exploitation is currently reported, and EPSS indicates a low exploitation probability (0.21%).
Out-of-bounds read and write in the Linux kernel's synaptics-rmi4 F3A GPIO driver allows local low-privileged users to leak adjacent kernel slab memory to userspace or perform a controlled heap write via the evdev ioctl interface. The root cause is a size mismatch: gpio_key_map is allocated for at most 6 entries while input->keycodemax is set to the full device-reported gpio_count (up to 127), causing the input core's EVIOCGKEYCODE and EVIOCSKEYCODE ioctls to index past the allocation. No public exploit has been identified at time of analysis; EPSS is 0.22%.
Out-of-bounds read and write in the Linux kernel synaptics-rmi4 input driver allows a local attacker with low privileges to gain full root access by exploiting a bound-check flaw in the F30 GPIO/LED interrupt handler. Affects kernels where gpioled_count exceeds 6 and GPIO support is enabled, leading to memory corruption through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls. No known active exploitation, no public exploit code, and EPSS risk is very low (0.22%).
Stack out-of-bounds write in the Linux kernel Goodix touchscreen driver allows kernel stack memory corruption through a malicious, counterfeit, or physically tampered Goodix I2C touchscreen controller that advertises more than the supported maximum of 10 contact points. All Linux kernel versions from 4.1 through the pre-patch stable series are affected on systems equipped with Goodix GT-series touchscreen hardware; patched releases are available across all active stable branches. No public exploit code exists and no active exploitation has been reported (absent from CISA KEV), with EPSS placing exploitation probability at 0.22%.
Out-of-bounds heap write in the Linux kernel iforce force-feedback input driver allows a physically connected malicious device to corrupt kernel memory. The iforce driver's status packet handler blindly uses a device-supplied effect index masked only to 0-127 as an array subscript into a 32-entry array, enabling `test_and_set_bit`/`test_and_clear_bit` operations up to 95 entries past the array boundary and into trailing kzalloc'd structure members. No confirmed active exploitation exists (not in CISA KEV), and EPSS probability is very low at 0.22% (13th percentile), but successful exploitation against an unpatched kernel yields high confidentiality, integrity, and availability impact at the kernel heap level.
Touch event indexing in the Linux kernel mms114 driver misaligns reads for MMS134S and MMS136 controllers, which pack events at 6-byte intervals while the driver iterates at 8-byte struct offsets. On systems physically equipped with these MELFAS touch controllers, a locally privileged attacker can trigger multi-touch input processing that causes the driver to read kernel memory from incorrect offsets, potentially exposing sensitive data or corrupting kernel state. No public exploit or active exploitation has been identified; EPSS stands at 0.21%, reflecting negligible widespread exploitation risk at time of analysis.
Heap out-of-bounds write in the Linux kernel's touchwin serial touchscreen driver allows a malicious, malfunctioning, or counterfeit Touchwindow peripheral to corrupt kernel heap memory one attacker-chosen byte at a time, potentially enabling local privilege escalation or kernel crash. The flaw exists since Linux 2.6.19 and affects all stable branches through 7.1.3 and pre-7.2-rc1; patched versions have been released across six stable series (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4). EPSS is 0.22% (13th percentile) and no public exploit or CISA KEV listing has been identified, reflecting the niche hardware prerequisite that sharply limits real-world exposure.
Stack out-of-bounds write in the Linux kernel's mms114 touchscreen driver allows a physically-positioned attacker with access to the I2C bus - or the ability to substitute a malicious or counterfeit controller - to overwrite the IRQ-thread stack, corrupting the stack canary, saved registers, and return address for potential kernel-level code execution. Affected systems include Linux kernel builds from version 3.6 onward that load the mms114 driver on hardware incorporating the Melfas MMS114 touchscreen controller. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at just 0.21%, consistent with the narrow hardware-specific attack surface.
Host memory disclosure to a remote RDMA peer in the Linux kernel's RDMA/rtrs-srv (RTRS server) transport allows a connected peer to read beyond a mapped chunk buffer. When answering an RTRS READ, rdma_write_sg() set the outbound RDMA-Write source-SGE length directly from the attacker-controlled wire descriptor field desc[0].len, which was only rejected when zero, and used the PD-wide local_dma_lkey rather than the chunk's own MR, so the verbs layer never constrained the transfer to max_chunk_size. A peer advertising a length larger than the chunk can force the posted RDMA write to read past the chunk into adjacent host memory (disclosed back to the peer under passthrough/no-IOMMU configs) or trigger a translation fault that aborts the connection. No public exploit identified at time of analysis and EPSS is low (0.21%).
Out-of-bounds write in the Linux kernel's siw RDMA driver allows a remote attacker on an established iWARP connection to cause memory corruption and potential code execution by sending a crafted sequence of Read Response segments that exceed the read request's buffer length. Affects all Linux kernel versions with the siw driver since 5.3. No public exploit is known, and EPSS score is low (0.22%), but the CVSS rating is Critical (9.8).
A use-after-free in the FUSE subsystem of the Linux kernel allows a local attacker with permission to mount a FUSE filesystem to escalate privileges or crash the system. The vulnerability exists in fuse_ref_folio() due to improper request locking, and affects kernel versions from 2.6.35 through unpatched longterm branches. Patches are available, and no active exploitation or public exploit code has been identified.
Local privilege escalation in the Linux kernel FUSE subsystem allows a low-privileged attacker to corrupt kernel memory
Local privilege escalation in the Linux kernel's fuse-uring subsystem allows a local attacker to trigger a use-after-free condition by racing with the async stop queues function, potentially resulting in arbitrary code execution and complete system compromise. The vulnerability affects Linux kernel versions 6.14 through 6.18.x (patched in 6.18.39, 7.1.4,
A race condition in the Linux kernel's fuse-uring subsystem allows a local user to achieve privilege escalation and full system compromise. The vulnerability, triggered by concurrent operations on the queue->stopped flag outside of locking, leads to a use-after
Use-after-free in the Linux kernel’s fuse-uring subsystem allows a local authenticated attacker to escalate privileges. The race condition occurs when a malicious userspace sends a commit SQE before the kernel completes the memcpy of request data, triggering a freed fuse_req to be reused. CVSS base score is 7.8 but EPSS probability is low (0.21%), and no public exploit or active exploitation has been reported.
Memory exposure and denial of service in the Linux kernel SMB client allows remote attackers to read kernel memory or crash the system via crafted SMB2 responses. The vulnerability exists in versions prior to the patched releases, affecting all systems mounting SMB shares from untrusted servers. No authentication or user interaction is required, and while no active exploitation is reported, the high CVSS score reflects the serious confidentiality and availability impact.
Out-of-bounds memory access in the Linux kernel’s iwlwifi wireless driver allows a remote attacker on the same WiFi network to corrupt kernel memory, potentially leading to code execution or system crash. The flaw occurs in Block Acknowledgment session handlers where the sta_mask field is not checked before being used to index an array, causing a wrap-around when the mask is zero. Affected are kernel versions prior to 6.18.38 and 7.1.3; no active exploitation or public exploit code is known at this time, and EPSS indicates a low probability of exploitation.
Use-after-free in the Linux kernel's power sequence (pwrseq) debugfs seq_file handler allows a local attacker with low privileges to achieve privilege escalation or system compromise. The flaw arises from incorrect device reference counting in the seq_next callback, leading to reuse of a freed pointer. Affected kernels include versions since commit 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c; no active exploitation or public exploit has been confirmed at the time of analysis.
Use-after-free in the Linux kernel FPGA region subsystem allows a local authenticated attacker with low privileges to corrupt kernel memory, potentially achieving full confidentiality, integrity, and availability impact. The flaw in `child_regions_with_firmware()` stems from `of_node_put(child_region)` freeing the node before `pr_err()` dereferences the same pointer on an error path - a deterministic UAF triggered by a specific error condition in FPGA device tree enumeration. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), placing this firmly as a maintenance-priority fix for most environments rather than an emergency response item.
Out-of-bounds read in KVM's x86 Hyper-V paravirtualization layer allows a guest attacker with L2 nested VM control to read host kernel memory or trigger a hypervisor crash. The VP (Virtual Processor) ID field from the enlightened VMCS is used without bounds validation in `hv_is_vp_in_sparse_set()` when servicing paravirtual TLB flush hypercalls for L2 guests; the TLFS defines a maximum of 4096 VP IDs (64 banks × 64 vCPUs), but an L2 guest can supply an arbitrary value, causing an out-of-bounds array read confirmed by a KASAN use-after-free splat in the commit. No public exploit code exists at time of analysis, and EPSS sits at 0.16% (5th percentile), reflecting niche real-world exposure.
Use-after-free in the Linux kernel's linkstation-poweroff driver exposes systems running affected kernel versions on Buffalo LinkStation NAS hardware to local privilege escalation. The flaw resides in linkstation_poweroff_init(), where of_node_put(dn) was called before of_match_node() finished using the pointer, producing a kernel-space use-after-free that can corrupt slab-allocated memory. No public exploit has been identified and the EPSS score of 0.16% (6th percentile) indicates very low observed exploitation probability, though the official CVSS base severity is 7.8 (High) with confirmed high impact to confidentiality, integrity, and availability.
Use-after-free in the Linux kernel fbdev subsystem's fb_find_mode() function allows a local attacker with low privileges to read freed kernel heap memory, potentially achieving information disclosure, memory corruption, or privilege escalation. The flaw exists when mode_option is NULL: a heap-allocated buffer (mode_option_buf) is freed while the local alias name still references it during the name_matches() comparison loop. Patched versions are available across multiple stable branches (6.6.144, 6.12.95, 6.18.38, 7.1.3, 7.2-rc1). No public exploit exists and EPSS sits at the 6th percentile, but the CVSS 7.8 High score correctly reflects the maximum-impact potential of kernel-level heap memory corruption.
Improper bounds checking in the Linux kernel's ASoC simple-mux driver allows a local attacker with low privileges to cause an out-of-bounds array index, leading to kernel memory disclosure and system crash. The driver erroneously accepts the maximum enum value (2) as valid for a two-entry mux, enabling an invalid mux state to propagate into GPIO and DAPM operations. Vendor patches are available for affected stable kernels, and no public exploit or active exploitation is known at this time.
Double free corruption in the Linux kernel's net2280 USB gadget driver probe error path enables local low-privilege users to corrupt kernel heap memory, potentially escalating privileges or triggering a system crash. The flaw affects all Linux kernel stable branches from 5.10 through 7.x prior to their respective patch releases (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, 7.1). Discovered by static analysis rather than active exploitation - no public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.17% (6th percentile), consistent with the niche hardware dependency of the affected driver.
Use-after-free in the Linux kernel DAMON (Data Access Monitor) sysfs subsystem allows a local, low-privileged user with sysfs write access to corrupt kernel memory structures, potentially escalating to full kernel-level code execution. The DAMOS tried-region directory removal function (damon_sysfs_scheme_regions_rm_dirs()) decrements kobject reference counts but omits removing region objects from the tracking linked list; asynchronous execution of the kobj release callback leaves dangling list entries that a concurrent list rebuild can write into freed memory. No public exploit or active exploitation has been identified - EPSS is 0.16% (5th percentile) and the vulnerability is absent from CISA KEV - consistent with a hardening fix rather than an actively weaponized flaw.
Out-of-bounds read in the Linux kernel elan_i2c touchpad driver allows a local authenticated user to leak kernel memory or crash the system by supplying a malformed firmware blob. The driver fails to validate that the firmware file is large enough to contain the expected number of pages plus the trailing signature before accessing them, affecting all stable kernel branches from 5.10.x through 7.x prior to their respective fix versions. No active exploitation is confirmed (not in CISA KEV), and EPSS is very low at 0.17% (6th percentile), indicating this is a local hardware-driver concern rather than an imminent widespread threat.
Denial of service in the Linux kernel's x86/ftrace dynamic trampoline mechanism causes a kernel panic when CONFIG_CALL_DEPTH_TRACKING is enabled on retbleed-affected platforms (e.g., Skylake) using retbleed=stuff. An attacker with local privileged access to configure ftrace can trigger a crash by setting up a kprobe event and invoking the traced function. No active exploitation or public exploit has been reported, and the EPSS probability is 0.16% (5th percentile), indicating low real-world risk.
A kernel crash (BUG_ON) in the block layer's integrity segment handling can be triggered on systems using dm-multipath over NVMe/RDMA with data integrity protection. The vulnerability arises when a cloned request inherits an incorrect nr_integrity_segments count from the upper queue, causing a mismatch that panics the kernel during dispatch. Only local authenticated users with the ability to issue I/O to the affected stacked device can exploit this, leading to a denial of service.
Local privilege escalation in the Linux kernel's sched_ext subsystem allows a low-privileged local attacker to achieve root access via a use-after-free error in the scx_root_enable_workfn() initialization failure path. The vulnerability is fixed by reordering the put_task_struct() call after scx_error() to prevent premature freeing of the task structure. No active exploitation or public exploit has been reported, and EPSS indicates low exploitation likelihood.
Out-of-bounds array access in the Linux kernel's OcteonTX2 CGX network driver exposes kernel memory to read or corruption when hardware firmware returns an unexpected link speed index value. The `cgx_speed_mbps` array holds 13 entries (indices 0-12) but the `RESP_LINKSTAT_SPEED` firmware response field can produce values 0-15, causing indices 13-15 to access memory beyond the array boundary. No public exploit has been identified at time of analysis; EPSS sits at 0.18% (7th percentile) with no CISA KEV listing, though patches are now available across multiple stable kernel branches.
Double free memory corruption in the Linux kernel's OcteonTX2 PF representor driver allows a local low-privileged user on hardware-equipped systems to corrupt kernel slab allocator state via rvu_rep_rsrc_init(), potentially enabling privilege escalation to root. The defect was identified by an experimental static analysis tool during review of v6.13-rc1 and confirmed present through v7.1-rc3 via manual inspection. No active exploitation is confirmed (not in CISA KEV), no public exploit code exists, and vendor-released patches are available across multiple stable kernel branches.
Out-of-bounds heap read in the Linux kernel mac80211 WiFi stack allows an adjacent wireless attacker with no authentication to trigger a slab-out-of-bounds read by sending a crafted 802.11be negotiated TTLM element with a sparse link-map presence bitmap. Affected kernels from 6.9 through 6.12.91, 6.18.33, and 7.0.10 advance the TTLM parser cursor for every TID regardless of whether a presence bit is set, reading past the validated element allocation. The raw read bytes are gated by valid_links before any driver state change, limiting direct policy impact; the primary risk is kernel crash (availability). No public exploit or CISA KEV listing exists; EPSS is 0.17%.
Double free in the Linux kernel's octeontx2-pf driver allows a local attacker with low privileges to corrupt kernel memory, potentially leading to privilege escalation or system crash. The flaw is in the error-handling paths of otx2_pool_aq_init() and cn20k_pool_aq_init(), where a freed stack pointer is not set to NULL and is subsequently freed again during cleanup. Exploitation requires a system with OcteonTX2 or
Local privilege escalation in the Linux kernel's ti-qspi SPI driver results from a use-after-free when DMA setup fails, allowing a local attacker to potentially execute arbitrary code or crash the system. The vulnerability affects Linux kernels from version 4.12 up to the patched stable releases 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No active exploitation has been confirmed (CISA KEV not listed), and the EPSS probability is low (0.18%), indicating limited real-world likelihood.
A stack buffer overflow in the AMD display driver (dc_process_dmub_aux_transfer_async) within the Linux kernel allows a local authenticated attacker with low privileges to potentially execute arbitrary code or crash the system. The flaw arises from missing bounds checks on payload length and link_index, impacting all kernels before the patched versions. While no active exploitation or public proof-of-concept is reported, the issue affects a wide range of systems with AMD GPUs.
Use-after-free in the Linux kernel's batman-adv BLA backbone gateway purging allows local attackers to escalate privileges. When stale backbone_gw entries are freed without properly synchronizing or canceling their pending `report_work` items, a race condition can cause the worker to access freed memory, leading to memory corruption and potential code execution with kernel privileges. Exploitation requires local low-privilege access and a system running the batman-adv module with backbone gateways active; no public exploit or active exploitation has been identified.
Out-of-bounds write in the Linux kernel's netfs subsystem enables a local, low-privileged attacker to corrupt kernel memory by crafting network filesystem I/O operations that cause iov_iter_extract_pages() to overfill the pages[] array in netfs_extract_user_iter(). The memory corruption occurs before any bounds guard is applied, making this a CWE-787 write-past-end condition with kernel privilege escalation potential. No public exploit code exists and the CVE is absent from the CISA KEV catalog; EPSS is 0.17% (6th percentile), consistent with no observed active exploitation.
Use-after-free in the Linux kernel’s netfs library allows a local attacker to escalate privileges or cause denial of service. The race condition occurs when unlocking abandoned read folios after a netfs request completes, potentially corrupting kernel memory. No active exploitation or public exploit is known at this time.
Unlocked concurrent writes to the mlx5e ICOSQ (Internal Completion Queue Send Queue) in the Linux kernel's AF_XDP path allow a race condition during CPU affinity changes to corrupt work-queue state, producing bad CQEs and kernel warnings observed in production on Mellanox/NVIDIA ConnectX interfaces. Two distinct races exist: mlx5e_trigger_irq() racing with mlx5e_xsk_alloc_rx_mpwqe() across CPUs after NAPI completion, and mlx5e_trigger_irq() racing with mlx5e_trigger_napi_icosq() on the same path. The vulnerability manifests as an availability impact - corrupt ICOSQ entries trigger hardware-level error CQEs - with no public exploit code and EPSS at 0.15% (5th percentile), reflecting its operational rather than adversarial trigger.
Out-of-bounds read in the Qualcomm QMP USB-C PHY driver (`phy: qcom: qmp-usbc`) of the Linux kernel allows a local low-privileged user to read kernel memory beyond the bounds of the `swing_tbl` and `pre_emphasis_tbl` DisplayPort signal-tuning arrays, risking kernel memory disclosure or a kernel panic. The root cause is an off-by-one error where the boundary guard uses `> 4` instead of `>= 4`, permitting array index 4 on 4-element (0-3) rows. Exploitation is constrained to Qualcomm SoC hardware with USB-C DisplayPort capability; EPSS at 0.15% (5th percentile) and the absence of a KEV listing indicate no public exploit and very low current exploitation probability.
A remote denial-of-service vulnerability in the Linux kernel's AF_RXRPC subsystem allows unauthenticated attackers to crash the system by sending malicious RxGK-secured DATA packets. The flaw stems from missing length checks in the Kerberos 5 crypto library before message decryption or verification. While the CVSS score is 7.5 (High), no active exploitation or public proof-of-concept exists, and EPSS predicts a low exploitation probability (0.17%), suggesting limited immediate real-world risk.
Information disclosure and potential data corruption in the Linux kernel's XFS filesystem can allow a local attacker with low privileges to achieve high integrity, confidentiality, and availability impact. The vulnerability resides in the reflink copy-on-write logic where stale data fork mappings are used after cycling the ILOCK, leading to inaccurate shared-extent tracking. No active exploitation or public exploit code has been identified at time of analysis, and a vendor patch is available.
Deadlock in the Linux kernel Bluetooth L2CAP subsystem during connection teardown can be triggered by an adjacent attacker via crafted Bluetooth traffic, leading to a denial of service. The vulnerability arises from an incorrect mutex acquisition order in l2cap_conn_del() and process_pending_rx(), as confirmed by a provided proof-of-concept and static analysis. While the official CVSS score indicates full compromise, the exploit only demonstrates a deadlock; no public exploitation outside of the PoC has been identified, and EPSS probability is low (0.16%).
Stack out-of-bounds read/write in the Linux kernel i2c-stub driver allows a local user with access to /dev/i2c-* to corrupt kernel stack memory by issuing an I2C_SMBUS ioctl with an oversized block length. The i2c-stub driver's stub_xfer() implements .smbus_xfer directly, bypassing the I2C_SMBUS_BLOCK_MAX (32-byte) length validation applied in the generic i2c_smbus_xfer_emulated() path, meaning data->block[0] values above 32 are accepted and used as a loop bound, reading or writing past the end of the 34-byte union i2c_smbus_data.block buffer onto the kernel stack. No public exploit has been identified at time of analysis and EPSS is 0.17%, but the KASAN trace in the description confirms the crash path is reachable.
Use-after-free in the Linux kernel netfilter ipset subsystem allows a local user with Netlink privilege to corrupt kernel memory by racing dump operations against a concurrent ip_set_list array resize. The dump callbacks ip_set_dump_do() and ip_set_dump_done() dereference the inst->ip_set_list array pointer outside any RCU read-side critical section; a concurrent ip_set_create() publishes a new array, calls synchronize_net(), and then frees the old array - but synchronize_net() does not wait for the unprotected dump readers, resulting in a slab use-after-free. No public exploit has been confirmed at time of analysis, though the KASAN trace embedded in the CVE description references a task named 'exploit/150', indicating a functional proof-of-concept was used to produce the report during responsible disclosure.
Use-after-free in the Linux kernel's Qualcomm rmnet networking driver allows a local attacker with low privileges to escalate to kernel-level code execution. The flaw occurs when the rmnet endpoint is freed while still being referenced by concurrent receive path handlers, leading to memory corruption. No active exploitation or public exploit code has been identified, but the high CVSS score reflects a significant local privilege escalation risk.