Linux
Monthly
Out-of-bounds read in the Linux kernel's AMD IOMMU debugfs subsystem exposes local users with standard privileges to potential kernel memory disclosure or denial of service via a sign-extension defect. The functions iommu_mmio_write() and iommu_capability_write() declare offset variables as signed int but populate them with kstrtou32_from_user(), allowing values in the range 0x80000000-0xFFFFFFFF to wrap negative and theoretically index before the intended MMIO region. The vulnerability description explicitly characterizes it as latent, acknowledging that three pre-existing defensive layers already prevent exploitation in practice; the fix replaces the unsigned parser with kstrtos32_from_user() and adds explicit negativity checks. No public exploit exists, no KEV listing is present, and EPSS sits at 0.15% (5th percentile).
Memory-management corruption in the Linux kernel (introduced in 6.18) affects x86 32-bit systems with Transparent Huge Pages (THP) enabled, where __vm_normal_page() fails to recognize the huge zero PMD because pmd_special()/pud_special() are gated behind CONFIG_ARCH_SUPPORTS_PMD_PFNMAP, which is never set on any 32-bit architecture. A local user allocating THP mappings can trigger VM_WARN warnings, bad rss-counter and bad page state conditions, and mis-accounting of the huge zero folio as file-backed THP. No public exploit has been identified and EPSS is low (0.16%), consistent with a niche, non-default trigger condition.
Use-after-free read in the Linux kernel Bluetooth BNEP subsystem allows a local privileged user (CAP_NET_ADMIN) to read freed net_device memory by winning a race against concurrent teardown. Affected kernels span from 2.6.12 through the 6.x/7.x stable series until the fixed releases (e.g. 6.12.92, 6.6.142, 6.1.175, 5.15.209, 5.10.258, 6.18.34, 7.0.11, 7.1). The upstream maintainers explicitly characterize this as low practical security interest; there is no public exploit identified at time of analysis and EPSS is very low (0.17%, 6th percentile).
Denial-of-service in the Linux kernel iwlwifi mvm WiFi driver affects older Intel wireless adapters such as the 7265D, where a regression in TX-rate encoding sets TX_CMD rates incorrectly. When the device reports these malformed rates back, the driver can emit warnings and, for beacon rates, trigger a firmware assert/crash that disrupts wireless connectivity. This is a fixed regression with no public exploit identified at time of analysis and a low EPSS score (0.15%), indicating negligible real-world exploitation interest.
Denial of service in the Linux kernel's Intel iwlwifi 'mld' Wi-Fi driver allows a firmware crash on Intel BE201/Wi-Fi 7 adapters to spiral into sustained resource exhaustion. Because iwl_mld_tx_from_txq() failed to check the in_hw_restart flag, TX frames kept being dequeued and pushed to dead firmware, each returning -EIO and being freed in a tight loop that burns CPU and churns skb allocations, causing slab fragmentation and memory pressure. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 6th percentile), and the issue is not on CISA KEV; it is a reliability/availability bug that manifests under real load, not an attacker-driven remote exploit.
Denial of service in the Linux kernel's KVM/SVM AVIC (Advanced Virtual Interrupt Controller) IPI virtualization affects Hygon Family 18h hosts, where a hardware erratum (#1235, shared with AMD Zen1 Family 17h) lets the CPU read a stale IsRunning bit during ICR write emulation and skip the expected AVIC_IPI_FAILURE_TARGET_NOT_RUNNING VM-Exit. As a result KVM misses the wakeup of a blocking target vCPU, causing hung vCPUs and unbounded stalls in guest execution. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; the fix disables AVIC IPI virtualization on these CPUs so every non-self IPI is correctly emulated via VM-Exit.
Incorrect spinlock initialization ordering in the Linux kernel's idpf network driver (Intel Infrastructure Data Path Function) causes the PTP auxiliary worker to acquire the read_dev_clk_lock before spin_lock_init() has run, producing a lockdep 'non-static key' warning and a race on an uninitialized lock during device init/reset. This is a local kernel-driver initialization bug affecting systems using the idpf driver with PTP enabled, not a remotely reachable code-execution flaw; no public exploit identified at time of analysis and the EPSS score is negligible (0.15%). Despite an automated CVSS of 9.8, the real-world security impact is minimal and confined to hosts running specific Intel networking hardware.
Data-race tearing in the Linux kernel's netfs library allows the ->remote_i_size and ->zero_point fields to be read or written non-atomically, potentially yielding torn/inconsistent file-size values for network filesystems built on netfslib (e.g., AFS, Ceph, 9p, cifs/SMB). The fix mirrors the existing i_size_read()/i_size_write() pattern, reusing the i_size seqcount under i_lock to serialize updates. Despite an input CVSS of 9.8, this is a local race-condition hardening fix with no public exploit identified at time of analysis and a low EPSS (0.16%, 6th percentile); the tag set even reclassifies impact as Information Disclosure rather than RCE.
Improper handling of write streaming in the Linux kernel's netfs subsystem (network filesystem caching layer) allows a local, low-privileged user to trigger reads of stale, dirty-but-not-uptodate page cache data on network-backed filesystems. Introduced around kernel 6.8, the flaw stems from netfs caching dirty data in folios that are not marked uptodate; concurrent reads (e.g., via mmap or a separate read-only fd) could return incorrect or stale content, an information-disclosure/integrity concern (tagged 'Information Disclosure'). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is very low (0.11%, 2nd percentile), indicating negligible mass-exploitation likelihood.
Incorrect error-handling in the Qualcomm MSM DRM/GPU driver (drm/msm) of the Linux kernel mishandles the return value of iommu_map_sgtable(), which was changed upstream to return a signed ssize_t with negative error codes instead of a size_t/zero. On the failure path the driver triggered a WARN rather than propagating the error, so a local user able to reach the GPU IOMMU mapping code can provoke a kernel warning and a poorly-handled error condition. This is a robustness/error-path correctness fix reported through the kernel stable process; no public exploit and no active exploitation are known (EPSS 0.18%, 8th percentile).
Improper error-path handling in the Linux kernel IOMMU subsystem allows unbalanced debug-tracking operations when CONFIG_IOMMU_DEBUG is enabled and an IOMMU map operation fails partway. When iommu_map_nosync() hits an error, the cleanup path invoked iommu_unmap()/iommu_debug_unmap_begin()/end() against a mapping the debug layer never recorded via iommu_debug_map(), corrupting internal tracking state and producing spurious unmatched trace records. The fix lifts unmap error handling into iommu_map_nosync() and reorders it so trace_map()/iommu_debug_map() records the partial mapping before immediately unmapping it. This is a locally-scoped, debug-configuration-dependent issue with no public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and it is not in CISA KEV.
Local privilege-boundary weakness in the Linux kernel's iommupt (IOMMU generic page-table) code allows a driver-constructed iommu_domain that omits PAGE_SIZE from its pgsize_bitmap to take an unintended fast path in page-table handling. The upstream fix lifts a PT_WARN_ON into a branch check and skips the fast path when PAGE_SIZE is absent. No public exploit identified at time of analysis; EPSS probability is very low (0.15%, 5th percentile) and this is a design-hardening fix rather than a demonstrated attack primitive.
Improper lock/softirq release ordering in the Linux kernel's netfilter nft_inner component allows a local privileged user to trigger lock imbalance and softirq state corruption via the error path, where local_bh_enable() runs before local_unlock_nested_bh(). Affected are Linux stable branches around 6.16 through pre-patch 6.18.x/7.0.x, fixed by three stable commits; no public exploit identified at time of analysis and EPSS is very low (0.17%, 6th percentile) despite the auto-assigned 9.8 CVSS. This is a defensive locking-correctness fix rather than an evidenced remote code execution primitive.
Improper error handling in the Linux kernel's pds_core driver (AMD Pensando Distributed Services Card core driver) causes pdsc_devcmd_wait() to return stale success from the completion register when firmware crashes or a device command times out, instead of propagating -ENXIO or -ETIMEDOUT. Because the error path is bypassed, the driver fails to queue health_work recovery, leaving the device in an inconsistent state and producing an availability (denial-of-service) condition. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and the issue is not on the CISA KEV list.
Memory leak in the Linux kernel's wilc1000 WiFi driver exposes systems with Microchip WILC1000 adapters to kernel heap exhaustion. The function wilc_wlan_firmware_download() allocates a DMA buffer via kmalloc() but an early-return path after the first acquire_bus() call bypasses the established cleanup label, leaking the buffer unconditionally on bus acquire failures. No public exploit has been identified and EPSS probability is extremely low (0.17%, 6th percentile), but repeated triggering on affected embedded hardware could degrade system stability. Upstream stable fixes are available as confirmed kernel commits targeting 6.18.x, 7.0.x, and 7.1.
Use-after-free in the Linux kernel's ksmbd (in-kernel SMB3 server) durable-handle scavenger allows a remote client interacting with SMB2 durable handles to corrupt kernel memory and free a file object still referenced by concurrent m_fp_list walkers. The flaw stems from two related races in ksmbd_durable_scavenger() - a list_head reuse that corrupts f_ci->m_fp_list and a refcount/unlink race that leaves a freed handle reachable by rename and share-mode lookups. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not in CISA KEV, so exploitation is unproven despite the NVD 9.8 rating.
Remote denial of service in the Linux kernel's ksmbd in-kernel SMB3 server allows an attacker to trigger a NULL-pointer dereference and kernel panic during SMB2 CREATE lease processing. After a SESSION_LOGOFF, a stale opinfo remains linked in the per-ClientGuid lease list with its conn pointer cleared; a subsequent session reusing the same ClientGuid and taking a lease on a different inode causes compare_guid_key() to dereference the NULL conn->ClientGUID. Exploitation requires only a successful SMB2 SESSION_SETUP against a share with 'durable handles = yes'; no public exploit is identified at time of analysis and EPSS risk is low (0.17%).
Kernel-panic denial of service in the Linux kernel's in-kernel SMB server (ksmbd) allows the file-pointer table to retain a durable-handle file object with a NULL tcon after a client issues SMB2 SESSION_LOGOFF; any subsequent read of /proc/fs/ksmbd/files then dereferences the NULL fp->tcon in proc_show_files() and crashes the host. Affected are kernels running ksmbd on shares configured with 'durable handles = yes'. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile), consistent with a stability/robustness bug rather than a weaponizable RCE.
Out-of-bounds memory access in the Linux kernel's ksmbd (in-kernel SMB3 server) occurs during ACL inheritance, where Owner and Group SIDs read from a parent directory's NT Security Descriptor were used without bounds validation. An authenticated SMB user able to write to a share can craft or place a malformed security descriptor so that a subsequent create operation reads past buffer boundaries, enabling kernel information disclosure and potential denial of service. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 6th percentile).
Local credential disclosure in the Linux kernel CIFS/SMB client (kernel 5.11 and later) stems from the CIFS_GENL generic-netlink family exposing the SWN (witness-notify) command and its CIFS_GENL_MCGRP_SWN multicast group without capability enforcement. Any unprivileged local process can join the multicast group to receive witness Register messages that, for NTLM-authenticated mounts, contain the session username, domain, and cleartext password, and can also inject spoofed RESOURCE_CHANGE or CLIENT_MOVE notifications into the in-kernel witness handler. No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a local-only issue.
Refcount race in the Linux kernel SMB/CIFS client (smb2_find_smb_sess_tcon_unlocked) leaves a tc_count increment unprotected by tc_lock, so concurrent tree-connect lookups can corrupt the tcon reference count and lead to premature free / use-after-free of the tcon object. It affects hosts that mount SMB2/SMB3 shares via the in-kernel cifs client and is a regression introduced by commit 96c4af418586 which converted tc_count locking from cifs_tcp_ses_lock to tc_lock but missed this one increment site. No public exploit is identified at time of analysis and EPSS is low (0.18%); the vendor-carried CVSS of 9.8 is auto-generated boilerplate that is not well supported by the actual local, race-conditioned nature of the bug.
Denial of service in the Linux kernel ALSA PCM subsystem allows a local low-privileged user with sound-device access to crash the system on RISC-V hardware. During the transition to iov_iter for PCM data transfer, the silencing path (data = NULL) reused the interleaved iov_iter setup, producing a bogus iterator that triggers a NULL pointer dereference; on most other architectures it was benign, but RISC-V faults. No public exploit is identified at time of analysis, and EPSS risk is low at 0.17% (6th percentile). The kernel tags flag potential information disclosure, though the concretely described symptom is a crash.
Out-of-bounds array read in the Linux kernel's ALSA ASIHPI (AudioScience HPI) sound driver allows a local, low-privileged user to trigger memory disclosure or a kernel crash by requesting a cached control info entry with an unchecked index. The find_control() helper indexed its cache array with a caller-supplied index without bounds validation; the fix adds a sanity check. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%), and it is not listed in CISA KEV, so this is a routine defense-in-depth hardening fix rather than an urgent threat.
Use-after-free in the Linux kernel's IPv6 In-situ OAM (IOAM) hop-by-hop option handler (ipv6_hop_ioam) lets a crafted IPv6 packet trigger access to a freed skb data buffer on hosts configured as IOAM nodes. After skb_ensure_writable() reallocates the socket buffer via pskb_expand_head(), the code refreshes the trace pointer but leaves the stale hdr pointer, so hdr->opt_len is later read from freed memory when calling ioam6_event(), enabling potential information disclosure or kernel crash. This is a resolved upstream fix with no public exploit identified at time of analysis and a low EPSS score (0.18%, 7th percentile).
Out-of-bounds slab read in the Linux kernel Bluetooth management (MGMT) subsystem lets a privileged local user leak adjacent kernel heap memory via the MGMT_OP_ADD_EXT_ADV_DATA command. The handler trusts attacker-supplied adv_data_len and scan_rsp_len fields without confirming those bytes actually fit within the received command payload, so a short command drives an out-of-bounds pointer into tlv_data_is_valid() and can copy past-the-buffer bytes into an advertising instance that the caller then reads back via MGMT_OP_GET_ADV_INSTANCE. Exploitation requires CAP_NET_ADMIN in the initial user namespace; no public exploit identified at time of analysis, and EPSS is low at 0.18%.
Denial-of-service and memory corruption in the Linux kernel's Broadcom GENET (bcmgenet) Ethernet driver occurs when RBUF_EEE_EN and RBUF_PM_EN are set in RBUF_ENERGY_CTRL and MAC Energy-Efficient Ethernet becomes active, silently halting the RX path while the link stays up and, on some boards, triggering a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit. It affects Linux systems using Broadcom GENET NICs (e.g. Raspberry Pi 4B/BCM2711, Broadcom 4908-family SoCs), and is triggered by default now that phy_support_eee() enables EEE automatically, or on older kernels once TX LPI is enabled via ethtool. No public exploit identified at time of analysis; EPSS is low at 0.18% (8th percentile), and the CISA-KEV / attacker-controlled framing implied by the CVSS 9.8 does not match the local hardware-interaction nature of the bug.
Out-of-bounds kernel memory access in the Linux kernel's devmem TCP subsystem (net/devmem) allows a local, low-privileged user who can bind a dma-buf to a socket to read one slot past the tx_vec array and to desynchronize net_iov accounting from the underlying gen_pool region. The root cause is that net_devmem_bind_dmabuf() trusts dmabuf->size and sg_dma_len() to be PAGE_SIZE multiples without validating them, so a dma-buf sized N*PAGE_SIZE+r lets a sendmsg() at offset N*PAGE_SIZE pass the bounds check yet index tx_vec[N]. No public exploit is identified at time of analysis and the EPSS score is very low (0.17%, 6th percentile); the fix (reject non-page-aligned size or SG length with -EINVAL) is shipped in vendor-released patches.
Slab use-after-free in the Linux kernel's HSR (High-availability Seamless Redundancy) networking subsystem lets a local attacker read freed heap memory. Generic-netlink node-list/node-status operations walk hsr->node_db under rcu_read_lock(), but RTM_DELLINK teardown (hsr_dellink -> hsr_del_nodes) removed nodes with a plain list_del() and freed each hsr_node immediately, so a concurrent reader could dereference a freed node and copy node->macaddress_A. No public exploit is identified at time of analysis and EPSS is low (0.17%, 7th percentile); the flaw is a race-window read primarily affecting confidentiality and stability rather than a remote RCE.
Kernel-memory use-after-free in the Linux mlx5e Ethernet driver (NVIDIA/Mellanox ConnectX mlx5_core) occurs when mlx5e_tx_reporter_timeout_recover() dereferences sq->netdev after mlx5e_safe_reopen_channels() has already freed the channel and its embedded send queues during TX-timeout health recovery. Systems using mlx5 NICs are affected; the freed-pointer read can corrupt kernel state, leak kernel memory, or crash the host. No public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not in CISA KEV, so this is a reliability/hardening fix rather than an actively exploited threat despite the NVD 9.8 score.
Slab out-of-bounds read in the Linux kernel IFB (Intermediate Functional Block) network driver exposes adjacent kernel memory and risks system instability when a local user with low privileges queries ethtool statistics on an asymmetrically configured IFB device. The root cause is a queue-count mismatch: ethtool stat callbacks size and walk per-queue data using real_num_rx_queues and real_num_tx_queues, while the underlying tx_private allocation is sized only to num_tx_queues - creating an over-read when RX queue count exceeds TX queue count. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), though patch availability across multiple stable branches confirms vendor acknowledgment and active remediation.
Memory-corruption (double free) in the Linux kernel's qed driver (QLogic FastLinQ 40/100G Ethernet) occurs when a PF/VF CID bitmap allocation fails during qed_cxt_tables_alloc(): the error path in qed_cid_map_alloc() frees already-allocated bitmaps, and the subsequent qed_cxt_mngr_free() cleanup frees them a second time. The bug is present from the driver's introduction through v7.1-rc3 and was surfaced by an experimental kernel memory-analysis tool; no public exploit identified at time of analysis and it is not in CISA KEV. Exploitation requires the specific hardware and a triggered allocation failure, so despite the CVSS 8.4 the practical risk is limited to local denial of service on affected NIC hosts.
Memory corruption (slab use-after-free) in the Linux kernel's mac80211 wireless stack allows an adjacent attacker on an 802.11s mesh network to trigger a KASAN-detected use-after-free in the fast-RX receive path. When a unicast frame is forwarded by mesh_data and hits the no-route path, the shared skb->cb storage is freed (or zeroed) before the RX_QUEUED handler reads rate statistics from it via sta_stats_encode_rate, corrupting kernel memory. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 6th percentile); the issue is a fixed upstream bug rather than an actively exploited one.
Denial of service in the Linux kernel's IPv6 In-situ OAM (IOAM) processing path allows remote attackers to crash the system via a NULL pointer dereference in ipv6_hop_ioam(). The function dereferences the result of __in6_dev_get(skb->dev) to read cnf.ioam6_enabled without checking for NULL, so a packet carrying an IOAM Hop-by-Hop option that arrives while addrconf_ifdown() concurrently clears dev->ip6_ptr via RCU can trigger a kernel panic. EPSS is low (0.18%), no public exploit or CISA KEV entry exists, and the fix ships in multiple stable kernel releases; the availability-only impact (CVSS 7.5, A:H) reflects a crash rather than code execution or data exposure.
Local privilege-escalation-class use-after-free in the Linux kernel's VMware VMCI vsock transport (vsock/vmci) allows a local attacker to corrupt freed socket memory by resetting a connection during the vsock handshake. When a peer sends a VMCI RST packet, vmci_transport_recv_connecting_server() incorrectly returned success (err=0), so vsock_transport_recv_listen() skipped removing the pending socket; a deferred vsock_pending_work() then double-dropped the socket reference, freeing it and writing into the freed object (KASAN slab-use-after-free). CVSS is 8.8 with a scope change, but EPSS is low (0.18%, 8th percentile) and there is no public exploit identified at time of analysis and it is not in CISA KEV.
Local denial-of-service in the Linux kernel's IPv4 raw socket path allows a caller holding CAP_NET_RAW to crash the host by sending an IP_HDRINCL packet whose self-reported header length (ihl) is below the RFC 791 minimum of 5. raw_send_hdrinc() checks that the header fits within the message but never rejects ihl < 5, so the malformed header is injected into the output path where downstream consumers such as ah_output() compute a negative header size, cast it to size_t, and perform an OOB memcpy of nearly SIZE_MAX bytes, panicking the kernel. It affects all maintained kernel branches and is reachable from an unprivileged process inside a user+net namespace (CONFIG_USER_NS=y) or a rootless Docker container with NET_ADMIN; no public exploit identified at time of analysis and EPSS risk is low (0.18%).
Use-after-free in the Linux kernel's ixgbevf driver (Intel 82599 SR-IOV virtual-function NIC driver) occurs when the VEPA multicast source-pruning workaround frees an skb and continues the receive loop without resetting the shared skb pointer to NULL, so the next descriptor iteration calls ixgbevf_add_rx_frag() on freed memory in NAPI softirq context. The flaw is present in ixgbevf's ixgbevf_clean_rx_irq() and affects VFs running in VEPA mode on hosts using the 82599/X520 family. There is no public exploit identified at time of analysis - the bug was located by static analysis (scan_drop_continue_loops.py / semgrep) and the UAF was confirmed under KASAN only via a synthetic test module reproducing the code pattern, not against real hardware; EPSS is low (0.18%, 7th percentile) and it is not on CISA KEV.
Local privilege-holder-triggered use-after-free in the Linux kernel's RADOS block device (rbd) driver allows a kernel crash and potential memory corruption when a Ceph rbd image is unmapped concurrently with in-flight I/O. A TOCTOU race in the exclusive-lock delayed-work (lock_dwork) draining logic lets rbd_acquire_lock() run after the device has been released and its structures freed or reset, violating internal assertions such as rbd_image_format_valid() in rbd_dev_header_info(). No public exploit identified at time of analysis; EPSS is low (0.17%), consistent with a hard-to-win kernel race rather than a broadly weaponizable flaw.
Local privilege/security-policy bypass in the Linux kernel's LSM (Linux Security Module) infrastructure arises because lsm_set_self_attr() failed to hold cred_guard_mutex before invoking the LSM hook, unlike the equivalent proc_pid_attr_write() path. On SELinux- or AppArmor-enforced systems, this allows a local low-privileged process to race the ptrace-based checks that gate a security-context transition, potentially performing a domain/type transition that policy would otherwise deny. EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis; the fix is already merged into stable kernels.
Use-after-free read in the Linux kernel's AF_UNIX stream socket handler (unix_stream_data_wait()) lets a local user leak or corrupt kernel memory state and potentially crash the system by racing a peeking recv() against a normal recv() on the same socket. The flaw affects kernels from ~6.5 onward, where unix_stream_data_wait() dereferences tail->len from an SKB read via skb_peek_tail() without a lock preventing that SKB from being concurrently dequeued and freed. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis, though the fix commit includes a race reproducer; the issue is fixed in stable releases.
Use-after-free / dangling dentry reference in the Linux kernel's CIFS (SMB) client allows a local user to leave a filesystem dentry in use after unmount, triggering a 'still in use' warning and potential memory corruption. Introduced by commit 340cea84f691c ('cifs: open files should not hold ref on superblock'), the flaw affects multiple stable series (6.1.x, 6.6.x, 6.12.x, 6.18.x, 6.19.x, 7.0.x) where a deferred CIFS close work item can run after the superblock is torn down. No public exploit has been identified, though a crash reproducer is published in the kernel bugzilla, and EPSS is low (0.17%, 7th percentile) with no CISA KEV listing.
Out-of-bounds host memory access in the Linux kernel's arm64 KVM virtual ITS (vgic-its) subsystem allows a local user driving the VM migration/restore path to disclose kernel memory and crash the host. The flaw lets userspace restore an ITS Device Table Entry (DTE) whose Size field encodes more EventID bits than the virtual ITS supports; vgic_its_restore_dte() stores this out-of-range num_eventid_bits, which later produces an oversized scan_its_table() range. It carries a high CVSS (9.0) but a very low EPSS (0.18%), with no public exploit identified at time of analysis and no CISA KEV listing.
Information disclosure in the Linux kernel's SEV-SNP guest driver (virt/sev-guest) allows memory pages left in an indeterminate encryption state to be reclaimed by the buddy allocator, potentially exposing plaintext guest data to later allocations. When set_memory_encrypted()/set_memory_decrypted() fail partway, the caller cannot tell where they failed, so pages that may still be unencrypted were being freed for general reuse; the fix instead calls snp_leak_pages() to permanently retain them. Rated CVSS 8.7 (local, low-privilege); EPSS is low at 0.17% (7th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
Use-after-free in the Linux kernel ISCI (Intel SAS) driver's device removal path allows a local attacker with low privileges to corrupt kernel memory by racing the completion tasklet against driver teardown, potentially enabling privilege escalation. Systems running affected kernel versions with Intel ISCI SAS hardware are vulnerable across multiple stable branches, with vendor-released fixes available in 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit has been identified and EPSS of 0.18% (7th percentile) confirms no observed widespread exploitation, though the KASAN-verified reproduction documented in the fix commit confirms the failure class is reliably triggerable under controlled conditions.
Out-of-bounds kernel memory read in the Linux kernel's Soft-iWARP (siw) RDMA driver lets a malicious connected iWARP peer send an MPA FPDU whose 16-bit length field is smaller than the fixed DDP/RDMAP header, triggering a signed-integer underflow that propagates a negative length into skb_copy_bits() as a huge size_t, producing a multi-gigabyte use-after-free read. Affected are kernels from 5.3 up to the fixed stable releases wherever the siw module is loaded; the primary outcome is a kernel crash (denial of service) with potential exposure of adjacent kernel memory. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.18% (7th percentile), consistent with the niche siw attack surface despite the high CVSS.
Local privilege escalation and memory corruption in the Linux kernel's drm/v3d GPU driver (Broadcom VideoCore, used in Raspberry Pi and similar SoCs) stems from a use-after-free on the CPU-job ioctl error path, where kvfree() reads the cpu_job structure after v3d_job_cleanup() has already dropped its last reference and freed it. The same faulty path also causes a NULL-pointer dereference on early init failure and leaks a drm_syncobj reference per query. No public exploit is identified at time of analysis, EPSS is low (0.18%), and it is not in CISA KEV, but a kernel UAF reachable by a local unprivileged user with GPU access carries high impact (CVSS 7.8).
Denial of service and potential dma_resv fence-list corruption in the Linux kernel's virtio-gpu DRM driver (drm/virtio) affects Linux guests using virtio graphics, where virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() ignore the return value of virtio_gpu_array_lock_resv(). When the lock acquisition fails with -EINTR (signal during wait) or -ENOMEM (fence-slot allocation), the code proceeds to call dma_resv_add_fence() on an unheld lock, tripping a lockdep WARNING and racing concurrent readers/writers of the fence list. There is no public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and the issue was found by syzbot via fault injection rather than in-the-wild abuse.
Out-of-bounds read in the AMD display (amdgpu) driver of the Linux kernel occurs when the GPIO pin table parsers get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() trust the VBIOS table_header.structuresize field and iterate over gpio_pin[] entries without confirming the full claimed size is mapped. On a system with a malformed or oversized VBIOS structuresize, the loop reads past the end of the BIOS image, potentially disclosing adjacent kernel memory or crashing the driver. There is no public exploit identified at time of analysis, EPSS is low (0.17%), and the issue is not listed in CISA KEV; a vendor patch is available across multiple stable trees.
Use-after-free in the Linux kernel's batman-adv (B.A.T.M.A.N. mesh routing) multicast code lets an adjacent attacker on the mesh trigger access to freed orig_node memory, potentially disclosing kernel memory or crashing the node. The flaw stems from batadv_mcast_purge_orig() removing entries from RCU-protected hlists without waiting for a grace period, so concurrent RCU readers dereference already-freed multicast node references. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV.
Denial-of-service (and minor state corruption) in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced mesh routing) bridge-loop-avoidance (BLA) subsystem allows an adjacent mesh participant to trigger a race condition in the bla.num_requests reference counter. Because the request_sent state check and the atomic increment/decrement of num_requests are not performed under a common lock, concurrent contexts (batadv_bla_send_request(), batadv_handle_announce(), backbone purge, and periodic work) can double-decrement the counter, corrupting BLA state and potentially crashing the kernel. There is no public exploit identified at time of analysis and EPSS risk is low (0.18%, 7th percentile); the fix serializes state and counter updates under a lock and adds a 'stopped' backbone_gw state.
Use-after-free race condition in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh-networking throughput meter (tp_meter) can corrupt kernel memory when a sender timer is re-armed after its backing reference has already been freed during cleanup. The flaw affects systems that load the batman-adv module and run tp_meter sessions; an adjacent mesh peer's ACK can race the shutdown path (batadv_tp_sender_shutdown) so that batadv_tp_reset_sender_timer() re-arms a timer whose object is gone. CVSS is rated 8.8 (AV:A), but with EPSS at 0.21% (11th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is low.
Heap buffer overflow in the Linux kernel's batman-adv mesh networking subsystem (translation-table TVLV generation) lets the number of non-empty VLANs grow between a pre-allocation size check and the buffer fill, so a VLAN that gained its first TT entry during that window is written past the allocated buffer. The flaw affects nodes running batman-adv mesh with VLANs and can corrupt kernel heap memory, most realistically causing a crash or information leak (tagged Information Disclosure). It is not in CISA KEV, has no public exploit identified at time of analysis, and carries a low EPSS of 0.18% (8th percentile) despite the automated CVSS 9.8.
Kernel memory disclosure in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking module arises from an integer wraparound in the translation-table (TT) code, where last_changeset_len was a signed s16 that wraps negative once a changeset exceeds 32767 bytes; batadv_send_my_tt_response() then sign-extends that value and batadv_tt_prepare_tvlv_local_data() allocates a full-sized TVLV buffer while filling only a small part, emitting the uninitialized remainder onto the mesh. A remote mesh peer can thereby receive stale kernel heap contents in TT response frames, tagged by the source as Information Disclosure. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the issue is not in CISA KEV; a vendor patch is available.
Uninitialized kernel-memory disclosure in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh-routing module allows an adjacent mesh peer to receive leaked kernel heap contents inside translation-table (TT) response frames. The batadv_orig_node::tt_buff_len field was typed as s16 and wraps negative when a changeset exceeds 32767 bytes, so batadv_tt_prepare_tvlv_global_data() allocates a full-size buffer but populates only a small portion, transmitting the uninitialized remainder over the mesh. No public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), consistent with a niche, non-default kernel feature rather than a broadly weaponized flaw.
Out-of-bounds memory access in the Linux kernel's hwmon pmbus/adm1266 driver lets a malicious or malfunctioning ADM1266 PMBus device on the I2C bus trigger a one-byte write past the end of the driver's fixed read_buf array, plus a corresponding out-of-bounds read during the PEC comparison. The read_buf field is sized ADM1266_PMBUS_BLOCK_MAX+1 (256 bytes) while the i2c transaction is programmed for ADM1266_PMBUS_BLOCK_MAX+2 (257 bytes), so a maximum-length block response (255 payload bytes plus a PEC byte) overruns the buffer. No public exploit identified at time of analysis and EPSS risk is low (0.18%, 8th percentile); the flaw is fixed across multiple stable trees.
Out-of-bounds heap write in the Linux kernel's ADM1266 PMBus power-sequencer hwmon driver allows a locally-privileged attacker - aided by a malicious or non-compliant ADM1266 device - to overflow kernel heap memory by up to 191 bytes, potentially achieving privilege escalation or kernel code execution. The root cause is a size-contract violation between adm1266_pmbus_block_xfer() (which trusts device-supplied lengths up to 255 bytes) and adm1266_nvmem_read_blackbox() (which allocates only 64-byte strides). No public exploit code has been identified at time of analysis; EPSS is 0.18%, consistent with low in-the-wild interest.
Out-of-bounds read and write in the Linux kernel's hwmon PMBus ADM1266 driver (adm1266_gpio_get_multiple) lets a local low-privileged user with access to the driver's GPIO interface corrupt adjacent kernel/caller stack memory, potentially leading to privilege escalation or a crash. The flaw stems from an incorrect loop bound (the PMBus command code 0xE9/233 was used instead of the 25-pin ADM1266_PDIO_NR limit), so the scan walks up to 242 bits and reads/writes past the caller-supplied mask and bits arrays. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile) and the CVE is not on CISA KEV.
Kernel stack information disclosure and register-state corruption affects the Linux kernel's RISC-V 32-bit compat layer, where compat_riscv_gpr_set() (the PTRACE_SETREGSET handler) and compat_restore_sigcontext() (the compat sigreturn path) call cregs_to_regs() even after the user copy fails, writing an uninitialized stack buffer into the target task's pt_regs. A local low-privileged attacker running a 32-bit process on a riscv64 kernel can force the copy to fail and leak uninitialized kernel stack contents into user-visible registers while corrupting the task's register state. There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), consistent with the narrow RISC-V compat attack surface.
Out-of-bounds read and oversized memory allocation in the Linux kernel's Arm Firmware Framework for A-profile (FF-A) driver (drivers/firmware/arm_ffa) arises from unvalidated offset and size fields in framework notification messages placed in the shared RX buffer. Malformed firmware-supplied data can drive an OOB read during UUID parsing or an oversized kmemdup() allocation, affecting kernels from 6.15 onward on Arm systems using FF-A. Rated CVSS 8.4 (local vector); no public exploit is identified and EPSS is low (0.17%), consistent with a firmware-trust-boundary issue rather than a broadly exploitable remote flaw.
Kernel memory corruption in the Linux arm_ffa (Arm Firmware Framework for A-profile) driver allows a local attacker to trigger a use-after-free by racing notifier unregistration against active notification delivery, affecting Arm systems running kernels from 6.15 up to the fixed 6.18.34/7.0.11 releases. Both the framework and non-framework notification handlers looked up a callback under notify_lock, dropped the lock, then dereferenced a notifier entry that a concurrent unregister could have already freed. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and it is not listed in CISA KEV.
Memory corruption in the Linux kernel netfilter x_tables subsystem lets a local user with network-admin capability trigger a use-after-free during table module removal (rmmod) while userspace performs concurrent set/getsockopt operations on the same table. The fix introduces a two-stage teardown (xtables_unregister_table_exit) that unlinks the table from the dying list, frees hook ops, and emits the audit notification, replacing the racy single-stage xt_unregister_table(). Rated CVSS 7.8 (local, high CIA impact); EPSS is low (0.17%), it is not in CISA KEV, and no public exploit has been identified at time of analysis.
Local privilege escalation and memory disclosure in the Linux kernel's netfilter ebtables subsystem stems from a table-removal race that could expose a partially-initialized ebt_table structure before its ops pointer is assigned. On affected kernels (5.15 through the fixes in 6.18.34, 7.0.11 and 7.1), a local user with network-administration capability manipulating ebtables can trigger the window between allocation and full initialization, corrupting or reading kernel memory. No public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile), consistent with a race-condition bug requiring local access rather than mass exploitation.
Local privilege escalation and memory-safety exposure in the Linux kernel netfilter bridge ebtables subsystem stems from a module-initialization race where nf_register_sockopt() runs before ebtables data structures are fully initialized, exposing the setsockopt/getsockopt interface globally too early. On affected kernels (5.13 through builds before the 6.18.34 / 7.0.11 / 7.1 stable fixes), a local low-privileged actor with the ability to reach ebtables sockopts during the init window can trigger operations on uninitialized state, risking high confidentiality, integrity, and availability impact (CVSS 7.8). There is no public exploit identified at time of analysis and EPSS is low (0.17%), so this is a code-correctness fix rather than an actively exploited threat.
Use-after-free in the Linux kernel's fprobe subsystem exposes kernel memory to corruption when a fprobe is released immediately after unregistration without waiting for an RCU grace period. The flaw was introduced by commit 4346ba1604093, which rewrote fprobe on the function-graph tracer and placed struct fprobe on an RCU-protected hlist but omitted the required synchronize_rcu() call in unregister_fprobe(), leaving a window where in-flight RCU readers may dereference freed memory. BPF users of fprobe are explicitly unaffected because BPF defers deallocation through the bpf_link_defer_dealloc_rcu_gp() RCU callback; affected paths are fprobe events and sample module code.
Local privilege-adjacent memory corruption in the Linux kernel's fs/statmount subsystem allows an authenticated local user to trigger a 1-byte NULL out-of-bounds write on a dynamically allocated seq buffer. The flaw lives in statmount_mnt_idmap(), which manually advances seq->count after seq_printf(); on overflow this desynchronizes the buffer accounting so seq_has_overflowed() misses the overflow and a later 'seq->buf[seq->count++] = 0' writes past the slab allocation. Rated CVSS 7.8 (High); EPSS is low (0.17%, 6th percentile), no public exploit or CISA KEV listing exists at time of analysis, and a vendor fix is available.
Use-after-free in the Linux kernel's irq_work subsystem allows a local attacker on a PREEMPT_RT (real-time) kernel to corrupt memory by racing irq_work_sync() against irq_work_single(). After the BUSY flag is cleared via atomic_cmpxchg(), the work object is still dereferenced for irq_work_is_hard() and rcuwait_wake_up(), while a concurrent irq_work_sync() caller on another CPU can observe BUSY==0, return, and free the object before those accesses complete. Rated CVSS 7.8 (High); no public exploit identified at time of analysis and EPSS probability is low (0.19%, 8th percentile).
Use-after-free (CWE-416) in the Linux kernel nvme-pci driver allows a local attacker or triggerable hardware condition to crash the kernel or potentially corrupt memory. The nvme_free_host_mem() function frees dev->hmb_sgt but never clears the pointer, so a double-call during an error path in nvme_probe() dereferences the freed and zeroed DMA structure, causing a NULL pointer dereference in iommu_dma_free_noncontiguous(). Observed reliably on Thunderbolt-attached NVMe devices with PCIe link instability; no public exploit or active exploitation identified at time of analysis.
Improper error-path cleanup in the Linux kernel's netfs read subsystem (the netfslib helper used by network filesystem clients such as CIFS/SMB, AFS, Ceph and 9p) mishandles reference counting when preparation of a direct-I/O (DIO) or single-read subrequest fails after being added to the stream's subrequest list. Because the failed subrequest can still be observed by the collector while holding two outstanding references, this leads to reference mismanagement and potential use-after-free/memory disorder on the read failure path, tagged as an information-disclosure risk. The fix has been merged upstream and backported; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.17%).
Memory corruption in the Linux kernel's netfs library (introduced around v6.10) arises because netfs_retry_read_subrequests() and netfs_retry_write_stream() add new subrequests to stream->subrequests without holding the stream lock, creating a race on the shared list during I/O retry. The flaw affects systems using netfs-backed network filesystems (e.g. AFS, Ceph, CIFS/SMB, 9p) and can lead to list corruption, information disclosure, or a crash when concurrent retries mutate the list. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.15%), consistent with a hard-to-trigger local kernel race rather than a remotely weaponizable bug.
Memory-ordering defect in the Linux kernel's netfs (network filesystem helper) subsystem allows the lockless readers netfs_collect_read_results() and netfs_collect_write_results() to observe a subrequest pointer before the NETFS_SREQ_IN_PROGRESS flag and other subreq state are guaranteed visible, causing races on stream->subrequests. The flaw affects kernels from 6.10 onward that use netfs-backed filesystems (CIFS/SMB, AFS, Ceph, 9p) and can lead to stale-state reads, information disclosure, or instability during concurrent I/O collection. There is no public exploit identified at time of analysis, EPSS is very low (0.15%, 5th percentile), and it is not on CISA KEV; the upstream fix is available in stable git.
A missing back-pressure flaw in the Linux kernel's netfs read path (netfs_read_to_pagecache()) fails to pause generation of new read subrequests after an already-issued subrequest fails, affecting network/cached filesystems (e.g. AFS, Ceph, CIFS/SMB, 9p, and fscache-backed mounts) built on the netfs helper library. The upstream fix has been merged and backported to stable trees; EPSS is very low (0.17%, 6th percentile) and no public exploit or CISA KEV listing exists, so this is no public exploit identified at time of analysis. Despite an NVD/CNA CVSS of 9.8, the change is a reliability/correctness fix and the supplied tag characterizes real impact as Information Disclosure rather than remote code execution.
Memory corruption in the Linux kernel netfs subsystem allows local authenticated users to corrupt kernel heap state via a crafted sequence of streaming write operations on network-backed filesystems, potentially enabling local privilege escalation to root. The bug resides in netfs_perform_write(): when a subsequent write fully overwrites a partially-dirty streaming-write folio, the netfs_folio struct that tracks the dirty byte region is neither freed nor correctly updated, leaving stale or inconsistent metadata that drives out-of-bounds writes (CWE-787) during later writeback processing. Patched versions are available across all active stable branches (6.12.92, 7.0.11, 7.1, 6.18.34); no public exploit or active exploitation has been identified at time of analysis.
Use-after-free memory corruption in the Linux kernel's netfs subsystem (netfs_read_gaps()) allows local activity on network filesystem mounts (notably the cifs/SMB client) to write into a prematurely-freed sink folio. The bug arises because the sink page backing an ITER_BVEC iterator is released before the outstanding read op completes, letting the cifsd receive thread copy incoming socket data into freed memory - reproduced by KASAN on the generic/075 xfstest. There is no public exploit identified at time of analysis and EPSS risk is low (0.17%); the vendor-supplied CVSS of 9.8 (AV:N) appears inflated for what is fundamentally a local, race-dependent kernel flaw.
Local information disclosure and memory corruption in the Linux kernel's netfs subsystem arises because netfs_read_folio() does not wait for in-flight writeback to complete before trusting the folio dirty flag and the folio->private data, which the writeback collector may free before it clears the writeback flag. Hosts using network/cache-backed filesystems (9p, AFS, Ceph, CIFS/SMB, and fscache-backed mounts) can hit a race where a read consumes stale or freed metadata. There is no public exploit identified at time of analysis and the EPSS probability is low (0.17%, 6th percentile); the fix is merged in stable releases 6.18.34, 7.0.11, and 7.1.
Improper locking in the Linux kernel AFS (Andrew File System) client's symbolic link handling (afs_get_link()) allows a local attacker on a host mounting an AFS volume to trigger race conditions that leak kernel memory and can expose stale or freed symlink buffers. The flaw affects kernels from roughly 6.14 up to the fixed 7.0.11/7.1 stable series and stems from a missing validate_lock, absent RCU barriering during lockless pathwalk, and unsynchronized access when a symlink is concurrently updated on the server. No public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and it is not on CISA KEV.
Data corruption and cross-port information disclosure affects the Linux kernel's Cortina Gemini (gmac) ethernet driver, where a single static local SKB used to reassemble fragmented RX packets in gmac_rx() is shared across the SoC's two ethernet ports. On devices actively using both ports simultaneously, concurrent RX processing can race on this shared buffer, mixing packet fragments between ports; the fix makes the RX SKB a per-port structure member. EPSS is low (0.18%, 8th percentile) with no public exploit identified at time of analysis and no CISA KEV listing, indicating this is a correctness/hardening fix rather than a practically weaponizable flaw despite its assigned CVSS of 9.8.
Malformed packet assembly in the Linux kernel's Cortina Gemini 'gmac' Ethernet driver (drivers/net/ethernet/cortina) occurs because the RX fragment counter (frag_nr) is reset to zero between NAPI poll invocations when the RX ring buffer empties mid-assembly, leaving a partially built SKB. The realistic impact is corrupted or partially-assembled receive buffers on affected ARM SoC platforms, tagged as Information Disclosure, potentially leaking stale buffer contents or destabilizing the receive path. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the issue is not in CISA KEV, and the NVD-supplied CVSS 9.8 is almost certainly an automated over-score inconsistent with a driver-internal RX race.
Double-free memory corruption in the Linux kernel's net/shaper subsystem allows a local attacker with CAP_NET_ADMIN capability to corrupt the kernel heap by submitting a crafted GROUP netlink request containing duplicate leaf handles. Affected kernels span from the introduction of the net shaper subsystem (~6.13) through multiple stable branches, with fixes backported to 6.18.34, 7.0.11, and 7.1. No public exploit or active exploitation has been identified; vendor-released patches are available via kernel.org and distribution advisories such as Ubuntu USN-8593-1.
Out-of-bounds kernel memory read in the Linux kernel block layer (block integrity subsystem) stems from bio_integrity_copy_user() overwriting bip_vcnt with nr_vecs after bio_integrity_add_page() had already set it to 1 for the bounce segment. On WRITE this breaks the bip_vcnt <= bip_max_vcnt invariant (bip_max_vcnt is 1), causing gap-merge checks in block/blk.h to read past the bip_vec[] flex array; on READ, in-bounds access lands on a saved user bvec instead of the bounce. A local low-privileged user issuing I/O with user-supplied integrity metadata can trigger information disclosure and instability; there is no public exploit identified at time of analysis and EPSS is very low (0.17%, 6th percentile).
Local privilege-escalation via kernel memory corruption in the Linux accel/qaic driver (Qualcomm Cloud AI 100 accelerator) lets a user with access to the qaic device trigger a use-after-free by mapping a GEM buffer object (BO) larger than its VMA. The qaic_gem_object_mmap path called remap_pfn_range without bounding it to the VMA size, so an oversized BO mapped pages past the VMA; a later munmap() unmaps only the VMA and leaves stale mappings to freed pages. EPSS is low (0.17%, 6th percentile) with no public exploit and no KEV listing, but the C:H/I:H/A:H impact makes it a valid local escalation primitive on affected hardware.
Use-after-free in the Linux kernel's Qualcomm MSM Display Processing Unit (DPU) DRM driver arises because dpu_writeback_init() mixes device-managed (devm_) and DRM-managed (drmm_) allocation lifetimes. On driver teardown, the writeback connector's data is freed via devm while userspace still holds a reference to the drm device and can interact with the drmm-backed connector, creating a dangling pointer a local user can exploit. Rated CVSS 7.8 (local, low-privilege); EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis.
Remote denial of service in the Linux kernel's SMC-D (Shared Memory Communications over ISM) client allows a malicious peer to crash the system via a null-pointer dereference during SMC-Dv2 connection setup. When a client sends an SMC-Dv2-only proposal and no SMC-Dv1 device is selected, a peer that replies with an ACCEPT containing CHID value 0 matches the reserved empty slot 0 of the ism_dev[] array, causing a null-ptr-deref on ism_dev[0]->lgr_lock in smc_conn_create(). No public exploit identified at time of analysis; EPSS is low (0.17%) and it is not listed in CISA KEV, but the fix is upstream in the kernel stable tree.
Memory-safety off-by-one in the Linux kernel's TLS (kTLS) data path miscounts scatterlist entries when an sk_msg scatterlist ring wraps (sg.end < sg.start), causing tls_push_record() to place the sg_chain() continuation pointer at data[MAX_SKB_FRAGS] instead of the true last entry. On affected 5.5-through-7.x stable kernels this can corrupt or misdirect the scatterlist handed to the crypto API during TLS record transmission, with the potential for information disclosure (as tagged) or a crash. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the issue is not in CISA KEV.
Malformed scatterlist chaining in the Linux kernel TLS (kTLS) plaintext send path can hand illegal 'chain-after-chain' input to the crypto subsystem when the ring's end index is 0 while start is non-zero, because the sg_next iterator does not recursively resolve consecutive chain links. This affects the kernel's in-kernel TLS offload used by processes with TLS sockets, and is tagged as an information-disclosure issue. It is not in CISA KEV and no public exploit has been identified; EPSS is low at 0.18% (7th percentile), and a fix is available across multiple stable kernel branches.
Use-after-free in the Linux kernel's in-kernel OpenVPN data channel offload (ovpn) TCP transport allows a local attacker to corrupt kernel memory by racing a TCP socket close against peer removal. The flaw lives in ovpn_tcp_close(), which caches a peer pointer under an RCU read lock but then escapes and dereferences sock->peer after the lock is dropped and without holding lock_sock(), so ovpn_socket_release() can free the socket concurrently. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but the CVSS 8.4 rating reflects full high impact to confidentiality, integrity, and availability if the race is won. A vendor patch is available.
Use-after-free in the Linux kernel's in-kernel OpenVPN data-channel module (ovpn) lets a local operator who can create VPN peers over TCP trigger memory corruption when the CMD_NEW_PEER netlink command hits its error path. The flaw affects kernels from 6.16 onward and stems from the error path calling the peer destructor directly instead of dropping the kref, so a concurrent TCP syscall caller (e.g. a recvmsg blocked on the peer's queue) can operate on freed memory. No public exploit identified at time of analysis; EPSS is low (0.21%) and it is not in CISA KEV, but the CVSS 7.8 reflects high confidentiality/integrity/availability impact from local memory corruption.
Improper resource validation in the Linux kernel's vfio/pci DMABUF export path (vfio/pci) allows a local user holding a VFIO device file descriptor to export and access PCI BAR (MMIO) resources that were never successfully reserved, enabling disclosure of adjacent device memory. The flaw stems from the DMABUF-creation path exporting BAR access without first confirming the resources were reserved at startup. There is no public exploit identified at time of analysis, EPSS is low (0.19%), and it is not listed in CISA KEV; the fix has been merged upstream.
Local privilege escalation and memory corruption in the Linux kernel's ASoC fs210x audio codec driver arises from a misused strscpy() call in fs210x_effect_scene_info(), where the copy length was derived from the source string (strlen(SRC)+1) rather than the destination buffer size, allowing an overwrite when the source is at least as long as the destination. The flaw affects Linux 6.18 through the fixed stable releases and carries a CVSS of 7.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile), consistent with a local-only kernel driver bug rather than a mass-exploited network flaw.
Information disclosure and denial-of-service in the Linux kernel's drm/msm display snapshot subsystem allows a local low-privileged user to read out-of-bounds register data and trigger a 16x memory overallocation during device state dumps. The flaw stems from the snapshot code force-aligning data segments to 16 bytes, which mishandles unaligned regions such as the 4-byte-shifted DSI data, causing inaccurate register reads. No public exploit identified at time of analysis; EPSS probability is low (0.21%), and it is not listed in CISA KEV.
Kernel memory corruption in the Linux iwlwifi 'mld' Wi-Fi driver occurs when AMSDU is disabled for a traffic ID and the TSO segmentation path (iwl_mld_tx_tso_segment) fails to detect the sentinel value max_tid_amsdu_len == 1, producing gso_size = 0 and exploding a single GSO skb into ~32,000 tiny segments that flood the TX ring and trigger a use-after-free (refcount underflow) in TCP's retransmit queue. Only the newer 'mld' driver is affected; the legacy 'mvm' driver is immune because it checks amsdu_enabled first. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 6th percentile), and a vendor patch is available.
Local privilege-context memory corruption in the Linux kernel's cgroup/rstat subsystem allows a process holding CAP_BPF and CAP_PERFMON to trigger an out-of-bounds array access by passing an unvalidated CPU index to the css_rstat_updated() BPF kfunc. Because the caller-supplied cpu argument is used for per-cpu rstat lookups without a possible-CPU bounds check, a value such as 0x7fffffff drives an array-index-out-of-bounds condition (confirmed on UBSAN kernels) inside kernel/cgroup/rstat.c. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; exploitation requires elevated BPF-related capabilities, which sharply narrows the realistic attacker set.
Out-of-bounds read in the Linux kernel's AMD IOMMU debugfs subsystem exposes local users with standard privileges to potential kernel memory disclosure or denial of service via a sign-extension defect. The functions iommu_mmio_write() and iommu_capability_write() declare offset variables as signed int but populate them with kstrtou32_from_user(), allowing values in the range 0x80000000-0xFFFFFFFF to wrap negative and theoretically index before the intended MMIO region. The vulnerability description explicitly characterizes it as latent, acknowledging that three pre-existing defensive layers already prevent exploitation in practice; the fix replaces the unsigned parser with kstrtos32_from_user() and adds explicit negativity checks. No public exploit exists, no KEV listing is present, and EPSS sits at 0.15% (5th percentile).
Memory-management corruption in the Linux kernel (introduced in 6.18) affects x86 32-bit systems with Transparent Huge Pages (THP) enabled, where __vm_normal_page() fails to recognize the huge zero PMD because pmd_special()/pud_special() are gated behind CONFIG_ARCH_SUPPORTS_PMD_PFNMAP, which is never set on any 32-bit architecture. A local user allocating THP mappings can trigger VM_WARN warnings, bad rss-counter and bad page state conditions, and mis-accounting of the huge zero folio as file-backed THP. No public exploit has been identified and EPSS is low (0.16%), consistent with a niche, non-default trigger condition.
Use-after-free read in the Linux kernel Bluetooth BNEP subsystem allows a local privileged user (CAP_NET_ADMIN) to read freed net_device memory by winning a race against concurrent teardown. Affected kernels span from 2.6.12 through the 6.x/7.x stable series until the fixed releases (e.g. 6.12.92, 6.6.142, 6.1.175, 5.15.209, 5.10.258, 6.18.34, 7.0.11, 7.1). The upstream maintainers explicitly characterize this as low practical security interest; there is no public exploit identified at time of analysis and EPSS is very low (0.17%, 6th percentile).
Denial-of-service in the Linux kernel iwlwifi mvm WiFi driver affects older Intel wireless adapters such as the 7265D, where a regression in TX-rate encoding sets TX_CMD rates incorrectly. When the device reports these malformed rates back, the driver can emit warnings and, for beacon rates, trigger a firmware assert/crash that disrupts wireless connectivity. This is a fixed regression with no public exploit identified at time of analysis and a low EPSS score (0.15%), indicating negligible real-world exploitation interest.
Denial of service in the Linux kernel's Intel iwlwifi 'mld' Wi-Fi driver allows a firmware crash on Intel BE201/Wi-Fi 7 adapters to spiral into sustained resource exhaustion. Because iwl_mld_tx_from_txq() failed to check the in_hw_restart flag, TX frames kept being dequeued and pushed to dead firmware, each returning -EIO and being freed in a tight loop that burns CPU and churns skb allocations, causing slab fragmentation and memory pressure. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 6th percentile), and the issue is not on CISA KEV; it is a reliability/availability bug that manifests under real load, not an attacker-driven remote exploit.
Denial of service in the Linux kernel's KVM/SVM AVIC (Advanced Virtual Interrupt Controller) IPI virtualization affects Hygon Family 18h hosts, where a hardware erratum (#1235, shared with AMD Zen1 Family 17h) lets the CPU read a stale IsRunning bit during ICR write emulation and skip the expected AVIC_IPI_FAILURE_TARGET_NOT_RUNNING VM-Exit. As a result KVM misses the wakeup of a blocking target vCPU, causing hung vCPUs and unbounded stalls in guest execution. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; the fix disables AVIC IPI virtualization on these CPUs so every non-self IPI is correctly emulated via VM-Exit.
Incorrect spinlock initialization ordering in the Linux kernel's idpf network driver (Intel Infrastructure Data Path Function) causes the PTP auxiliary worker to acquire the read_dev_clk_lock before spin_lock_init() has run, producing a lockdep 'non-static key' warning and a race on an uninitialized lock during device init/reset. This is a local kernel-driver initialization bug affecting systems using the idpf driver with PTP enabled, not a remotely reachable code-execution flaw; no public exploit identified at time of analysis and the EPSS score is negligible (0.15%). Despite an automated CVSS of 9.8, the real-world security impact is minimal and confined to hosts running specific Intel networking hardware.
Data-race tearing in the Linux kernel's netfs library allows the ->remote_i_size and ->zero_point fields to be read or written non-atomically, potentially yielding torn/inconsistent file-size values for network filesystems built on netfslib (e.g., AFS, Ceph, 9p, cifs/SMB). The fix mirrors the existing i_size_read()/i_size_write() pattern, reusing the i_size seqcount under i_lock to serialize updates. Despite an input CVSS of 9.8, this is a local race-condition hardening fix with no public exploit identified at time of analysis and a low EPSS (0.16%, 6th percentile); the tag set even reclassifies impact as Information Disclosure rather than RCE.
Improper handling of write streaming in the Linux kernel's netfs subsystem (network filesystem caching layer) allows a local, low-privileged user to trigger reads of stale, dirty-but-not-uptodate page cache data on network-backed filesystems. Introduced around kernel 6.8, the flaw stems from netfs caching dirty data in folios that are not marked uptodate; concurrent reads (e.g., via mmap or a separate read-only fd) could return incorrect or stale content, an information-disclosure/integrity concern (tagged 'Information Disclosure'). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is very low (0.11%, 2nd percentile), indicating negligible mass-exploitation likelihood.
Incorrect error-handling in the Qualcomm MSM DRM/GPU driver (drm/msm) of the Linux kernel mishandles the return value of iommu_map_sgtable(), which was changed upstream to return a signed ssize_t with negative error codes instead of a size_t/zero. On the failure path the driver triggered a WARN rather than propagating the error, so a local user able to reach the GPU IOMMU mapping code can provoke a kernel warning and a poorly-handled error condition. This is a robustness/error-path correctness fix reported through the kernel stable process; no public exploit and no active exploitation are known (EPSS 0.18%, 8th percentile).
Improper error-path handling in the Linux kernel IOMMU subsystem allows unbalanced debug-tracking operations when CONFIG_IOMMU_DEBUG is enabled and an IOMMU map operation fails partway. When iommu_map_nosync() hits an error, the cleanup path invoked iommu_unmap()/iommu_debug_unmap_begin()/end() against a mapping the debug layer never recorded via iommu_debug_map(), corrupting internal tracking state and producing spurious unmatched trace records. The fix lifts unmap error handling into iommu_map_nosync() and reorders it so trace_map()/iommu_debug_map() records the partial mapping before immediately unmapping it. This is a locally-scoped, debug-configuration-dependent issue with no public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and it is not in CISA KEV.
Local privilege-boundary weakness in the Linux kernel's iommupt (IOMMU generic page-table) code allows a driver-constructed iommu_domain that omits PAGE_SIZE from its pgsize_bitmap to take an unintended fast path in page-table handling. The upstream fix lifts a PT_WARN_ON into a branch check and skips the fast path when PAGE_SIZE is absent. No public exploit identified at time of analysis; EPSS probability is very low (0.15%, 5th percentile) and this is a design-hardening fix rather than a demonstrated attack primitive.
Improper lock/softirq release ordering in the Linux kernel's netfilter nft_inner component allows a local privileged user to trigger lock imbalance and softirq state corruption via the error path, where local_bh_enable() runs before local_unlock_nested_bh(). Affected are Linux stable branches around 6.16 through pre-patch 6.18.x/7.0.x, fixed by three stable commits; no public exploit identified at time of analysis and EPSS is very low (0.17%, 6th percentile) despite the auto-assigned 9.8 CVSS. This is a defensive locking-correctness fix rather than an evidenced remote code execution primitive.
Improper error handling in the Linux kernel's pds_core driver (AMD Pensando Distributed Services Card core driver) causes pdsc_devcmd_wait() to return stale success from the completion register when firmware crashes or a device command times out, instead of propagating -ENXIO or -ETIMEDOUT. Because the error path is bypassed, the driver fails to queue health_work recovery, leaving the device in an inconsistent state and producing an availability (denial-of-service) condition. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and the issue is not on the CISA KEV list.
Memory leak in the Linux kernel's wilc1000 WiFi driver exposes systems with Microchip WILC1000 adapters to kernel heap exhaustion. The function wilc_wlan_firmware_download() allocates a DMA buffer via kmalloc() but an early-return path after the first acquire_bus() call bypasses the established cleanup label, leaking the buffer unconditionally on bus acquire failures. No public exploit has been identified and EPSS probability is extremely low (0.17%, 6th percentile), but repeated triggering on affected embedded hardware could degrade system stability. Upstream stable fixes are available as confirmed kernel commits targeting 6.18.x, 7.0.x, and 7.1.
Use-after-free in the Linux kernel's ksmbd (in-kernel SMB3 server) durable-handle scavenger allows a remote client interacting with SMB2 durable handles to corrupt kernel memory and free a file object still referenced by concurrent m_fp_list walkers. The flaw stems from two related races in ksmbd_durable_scavenger() - a list_head reuse that corrupts f_ci->m_fp_list and a refcount/unlink race that leaves a freed handle reachable by rename and share-mode lookups. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not in CISA KEV, so exploitation is unproven despite the NVD 9.8 rating.
Remote denial of service in the Linux kernel's ksmbd in-kernel SMB3 server allows an attacker to trigger a NULL-pointer dereference and kernel panic during SMB2 CREATE lease processing. After a SESSION_LOGOFF, a stale opinfo remains linked in the per-ClientGuid lease list with its conn pointer cleared; a subsequent session reusing the same ClientGuid and taking a lease on a different inode causes compare_guid_key() to dereference the NULL conn->ClientGUID. Exploitation requires only a successful SMB2 SESSION_SETUP against a share with 'durable handles = yes'; no public exploit is identified at time of analysis and EPSS risk is low (0.17%).
Kernel-panic denial of service in the Linux kernel's in-kernel SMB server (ksmbd) allows the file-pointer table to retain a durable-handle file object with a NULL tcon after a client issues SMB2 SESSION_LOGOFF; any subsequent read of /proc/fs/ksmbd/files then dereferences the NULL fp->tcon in proc_show_files() and crashes the host. Affected are kernels running ksmbd on shares configured with 'durable handles = yes'. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile), consistent with a stability/robustness bug rather than a weaponizable RCE.
Out-of-bounds memory access in the Linux kernel's ksmbd (in-kernel SMB3 server) occurs during ACL inheritance, where Owner and Group SIDs read from a parent directory's NT Security Descriptor were used without bounds validation. An authenticated SMB user able to write to a share can craft or place a malformed security descriptor so that a subsequent create operation reads past buffer boundaries, enabling kernel information disclosure and potential denial of service. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 6th percentile).
Local credential disclosure in the Linux kernel CIFS/SMB client (kernel 5.11 and later) stems from the CIFS_GENL generic-netlink family exposing the SWN (witness-notify) command and its CIFS_GENL_MCGRP_SWN multicast group without capability enforcement. Any unprivileged local process can join the multicast group to receive witness Register messages that, for NTLM-authenticated mounts, contain the session username, domain, and cleartext password, and can also inject spoofed RESOURCE_CHANGE or CLIENT_MOVE notifications into the in-kernel witness handler. No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a local-only issue.
Refcount race in the Linux kernel SMB/CIFS client (smb2_find_smb_sess_tcon_unlocked) leaves a tc_count increment unprotected by tc_lock, so concurrent tree-connect lookups can corrupt the tcon reference count and lead to premature free / use-after-free of the tcon object. It affects hosts that mount SMB2/SMB3 shares via the in-kernel cifs client and is a regression introduced by commit 96c4af418586 which converted tc_count locking from cifs_tcp_ses_lock to tc_lock but missed this one increment site. No public exploit is identified at time of analysis and EPSS is low (0.18%); the vendor-carried CVSS of 9.8 is auto-generated boilerplate that is not well supported by the actual local, race-conditioned nature of the bug.
Denial of service in the Linux kernel ALSA PCM subsystem allows a local low-privileged user with sound-device access to crash the system on RISC-V hardware. During the transition to iov_iter for PCM data transfer, the silencing path (data = NULL) reused the interleaved iov_iter setup, producing a bogus iterator that triggers a NULL pointer dereference; on most other architectures it was benign, but RISC-V faults. No public exploit is identified at time of analysis, and EPSS risk is low at 0.17% (6th percentile). The kernel tags flag potential information disclosure, though the concretely described symptom is a crash.
Out-of-bounds array read in the Linux kernel's ALSA ASIHPI (AudioScience HPI) sound driver allows a local, low-privileged user to trigger memory disclosure or a kernel crash by requesting a cached control info entry with an unchecked index. The find_control() helper indexed its cache array with a caller-supplied index without bounds validation; the fix adds a sanity check. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%), and it is not listed in CISA KEV, so this is a routine defense-in-depth hardening fix rather than an urgent threat.
Use-after-free in the Linux kernel's IPv6 In-situ OAM (IOAM) hop-by-hop option handler (ipv6_hop_ioam) lets a crafted IPv6 packet trigger access to a freed skb data buffer on hosts configured as IOAM nodes. After skb_ensure_writable() reallocates the socket buffer via pskb_expand_head(), the code refreshes the trace pointer but leaves the stale hdr pointer, so hdr->opt_len is later read from freed memory when calling ioam6_event(), enabling potential information disclosure or kernel crash. This is a resolved upstream fix with no public exploit identified at time of analysis and a low EPSS score (0.18%, 7th percentile).
Out-of-bounds slab read in the Linux kernel Bluetooth management (MGMT) subsystem lets a privileged local user leak adjacent kernel heap memory via the MGMT_OP_ADD_EXT_ADV_DATA command. The handler trusts attacker-supplied adv_data_len and scan_rsp_len fields without confirming those bytes actually fit within the received command payload, so a short command drives an out-of-bounds pointer into tlv_data_is_valid() and can copy past-the-buffer bytes into an advertising instance that the caller then reads back via MGMT_OP_GET_ADV_INSTANCE. Exploitation requires CAP_NET_ADMIN in the initial user namespace; no public exploit identified at time of analysis, and EPSS is low at 0.18%.
Denial-of-service and memory corruption in the Linux kernel's Broadcom GENET (bcmgenet) Ethernet driver occurs when RBUF_EEE_EN and RBUF_PM_EN are set in RBUF_ENERGY_CTRL and MAC Energy-Efficient Ethernet becomes active, silently halting the RX path while the link stays up and, on some boards, triggering a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit. It affects Linux systems using Broadcom GENET NICs (e.g. Raspberry Pi 4B/BCM2711, Broadcom 4908-family SoCs), and is triggered by default now that phy_support_eee() enables EEE automatically, or on older kernels once TX LPI is enabled via ethtool. No public exploit identified at time of analysis; EPSS is low at 0.18% (8th percentile), and the CISA-KEV / attacker-controlled framing implied by the CVSS 9.8 does not match the local hardware-interaction nature of the bug.
Out-of-bounds kernel memory access in the Linux kernel's devmem TCP subsystem (net/devmem) allows a local, low-privileged user who can bind a dma-buf to a socket to read one slot past the tx_vec array and to desynchronize net_iov accounting from the underlying gen_pool region. The root cause is that net_devmem_bind_dmabuf() trusts dmabuf->size and sg_dma_len() to be PAGE_SIZE multiples without validating them, so a dma-buf sized N*PAGE_SIZE+r lets a sendmsg() at offset N*PAGE_SIZE pass the bounds check yet index tx_vec[N]. No public exploit is identified at time of analysis and the EPSS score is very low (0.17%, 6th percentile); the fix (reject non-page-aligned size or SG length with -EINVAL) is shipped in vendor-released patches.
Slab use-after-free in the Linux kernel's HSR (High-availability Seamless Redundancy) networking subsystem lets a local attacker read freed heap memory. Generic-netlink node-list/node-status operations walk hsr->node_db under rcu_read_lock(), but RTM_DELLINK teardown (hsr_dellink -> hsr_del_nodes) removed nodes with a plain list_del() and freed each hsr_node immediately, so a concurrent reader could dereference a freed node and copy node->macaddress_A. No public exploit is identified at time of analysis and EPSS is low (0.17%, 7th percentile); the flaw is a race-window read primarily affecting confidentiality and stability rather than a remote RCE.
Kernel-memory use-after-free in the Linux mlx5e Ethernet driver (NVIDIA/Mellanox ConnectX mlx5_core) occurs when mlx5e_tx_reporter_timeout_recover() dereferences sq->netdev after mlx5e_safe_reopen_channels() has already freed the channel and its embedded send queues during TX-timeout health recovery. Systems using mlx5 NICs are affected; the freed-pointer read can corrupt kernel state, leak kernel memory, or crash the host. No public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not in CISA KEV, so this is a reliability/hardening fix rather than an actively exploited threat despite the NVD 9.8 score.
Slab out-of-bounds read in the Linux kernel IFB (Intermediate Functional Block) network driver exposes adjacent kernel memory and risks system instability when a local user with low privileges queries ethtool statistics on an asymmetrically configured IFB device. The root cause is a queue-count mismatch: ethtool stat callbacks size and walk per-queue data using real_num_rx_queues and real_num_tx_queues, while the underlying tx_private allocation is sized only to num_tx_queues - creating an over-read when RX queue count exceeds TX queue count. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), though patch availability across multiple stable branches confirms vendor acknowledgment and active remediation.
Memory-corruption (double free) in the Linux kernel's qed driver (QLogic FastLinQ 40/100G Ethernet) occurs when a PF/VF CID bitmap allocation fails during qed_cxt_tables_alloc(): the error path in qed_cid_map_alloc() frees already-allocated bitmaps, and the subsequent qed_cxt_mngr_free() cleanup frees them a second time. The bug is present from the driver's introduction through v7.1-rc3 and was surfaced by an experimental kernel memory-analysis tool; no public exploit identified at time of analysis and it is not in CISA KEV. Exploitation requires the specific hardware and a triggered allocation failure, so despite the CVSS 8.4 the practical risk is limited to local denial of service on affected NIC hosts.
Memory corruption (slab use-after-free) in the Linux kernel's mac80211 wireless stack allows an adjacent attacker on an 802.11s mesh network to trigger a KASAN-detected use-after-free in the fast-RX receive path. When a unicast frame is forwarded by mesh_data and hits the no-route path, the shared skb->cb storage is freed (or zeroed) before the RX_QUEUED handler reads rate statistics from it via sta_stats_encode_rate, corrupting kernel memory. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 6th percentile); the issue is a fixed upstream bug rather than an actively exploited one.
Denial of service in the Linux kernel's IPv6 In-situ OAM (IOAM) processing path allows remote attackers to crash the system via a NULL pointer dereference in ipv6_hop_ioam(). The function dereferences the result of __in6_dev_get(skb->dev) to read cnf.ioam6_enabled without checking for NULL, so a packet carrying an IOAM Hop-by-Hop option that arrives while addrconf_ifdown() concurrently clears dev->ip6_ptr via RCU can trigger a kernel panic. EPSS is low (0.18%), no public exploit or CISA KEV entry exists, and the fix ships in multiple stable kernel releases; the availability-only impact (CVSS 7.5, A:H) reflects a crash rather than code execution or data exposure.
Local privilege-escalation-class use-after-free in the Linux kernel's VMware VMCI vsock transport (vsock/vmci) allows a local attacker to corrupt freed socket memory by resetting a connection during the vsock handshake. When a peer sends a VMCI RST packet, vmci_transport_recv_connecting_server() incorrectly returned success (err=0), so vsock_transport_recv_listen() skipped removing the pending socket; a deferred vsock_pending_work() then double-dropped the socket reference, freeing it and writing into the freed object (KASAN slab-use-after-free). CVSS is 8.8 with a scope change, but EPSS is low (0.18%, 8th percentile) and there is no public exploit identified at time of analysis and it is not in CISA KEV.
Local denial-of-service in the Linux kernel's IPv4 raw socket path allows a caller holding CAP_NET_RAW to crash the host by sending an IP_HDRINCL packet whose self-reported header length (ihl) is below the RFC 791 minimum of 5. raw_send_hdrinc() checks that the header fits within the message but never rejects ihl < 5, so the malformed header is injected into the output path where downstream consumers such as ah_output() compute a negative header size, cast it to size_t, and perform an OOB memcpy of nearly SIZE_MAX bytes, panicking the kernel. It affects all maintained kernel branches and is reachable from an unprivileged process inside a user+net namespace (CONFIG_USER_NS=y) or a rootless Docker container with NET_ADMIN; no public exploit identified at time of analysis and EPSS risk is low (0.18%).
Use-after-free in the Linux kernel's ixgbevf driver (Intel 82599 SR-IOV virtual-function NIC driver) occurs when the VEPA multicast source-pruning workaround frees an skb and continues the receive loop without resetting the shared skb pointer to NULL, so the next descriptor iteration calls ixgbevf_add_rx_frag() on freed memory in NAPI softirq context. The flaw is present in ixgbevf's ixgbevf_clean_rx_irq() and affects VFs running in VEPA mode on hosts using the 82599/X520 family. There is no public exploit identified at time of analysis - the bug was located by static analysis (scan_drop_continue_loops.py / semgrep) and the UAF was confirmed under KASAN only via a synthetic test module reproducing the code pattern, not against real hardware; EPSS is low (0.18%, 7th percentile) and it is not on CISA KEV.
Local privilege-holder-triggered use-after-free in the Linux kernel's RADOS block device (rbd) driver allows a kernel crash and potential memory corruption when a Ceph rbd image is unmapped concurrently with in-flight I/O. A TOCTOU race in the exclusive-lock delayed-work (lock_dwork) draining logic lets rbd_acquire_lock() run after the device has been released and its structures freed or reset, violating internal assertions such as rbd_image_format_valid() in rbd_dev_header_info(). No public exploit identified at time of analysis; EPSS is low (0.17%), consistent with a hard-to-win kernel race rather than a broadly weaponizable flaw.
Local privilege/security-policy bypass in the Linux kernel's LSM (Linux Security Module) infrastructure arises because lsm_set_self_attr() failed to hold cred_guard_mutex before invoking the LSM hook, unlike the equivalent proc_pid_attr_write() path. On SELinux- or AppArmor-enforced systems, this allows a local low-privileged process to race the ptrace-based checks that gate a security-context transition, potentially performing a domain/type transition that policy would otherwise deny. EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis; the fix is already merged into stable kernels.
Use-after-free read in the Linux kernel's AF_UNIX stream socket handler (unix_stream_data_wait()) lets a local user leak or corrupt kernel memory state and potentially crash the system by racing a peeking recv() against a normal recv() on the same socket. The flaw affects kernels from ~6.5 onward, where unix_stream_data_wait() dereferences tail->len from an SKB read via skb_peek_tail() without a lock preventing that SKB from being concurrently dequeued and freed. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis, though the fix commit includes a race reproducer; the issue is fixed in stable releases.
Use-after-free / dangling dentry reference in the Linux kernel's CIFS (SMB) client allows a local user to leave a filesystem dentry in use after unmount, triggering a 'still in use' warning and potential memory corruption. Introduced by commit 340cea84f691c ('cifs: open files should not hold ref on superblock'), the flaw affects multiple stable series (6.1.x, 6.6.x, 6.12.x, 6.18.x, 6.19.x, 7.0.x) where a deferred CIFS close work item can run after the superblock is torn down. No public exploit has been identified, though a crash reproducer is published in the kernel bugzilla, and EPSS is low (0.17%, 7th percentile) with no CISA KEV listing.
Out-of-bounds host memory access in the Linux kernel's arm64 KVM virtual ITS (vgic-its) subsystem allows a local user driving the VM migration/restore path to disclose kernel memory and crash the host. The flaw lets userspace restore an ITS Device Table Entry (DTE) whose Size field encodes more EventID bits than the virtual ITS supports; vgic_its_restore_dte() stores this out-of-range num_eventid_bits, which later produces an oversized scan_its_table() range. It carries a high CVSS (9.0) but a very low EPSS (0.18%), with no public exploit identified at time of analysis and no CISA KEV listing.
Information disclosure in the Linux kernel's SEV-SNP guest driver (virt/sev-guest) allows memory pages left in an indeterminate encryption state to be reclaimed by the buddy allocator, potentially exposing plaintext guest data to later allocations. When set_memory_encrypted()/set_memory_decrypted() fail partway, the caller cannot tell where they failed, so pages that may still be unencrypted were being freed for general reuse; the fix instead calls snp_leak_pages() to permanently retain them. Rated CVSS 8.7 (local, low-privilege); EPSS is low at 0.17% (7th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
Use-after-free in the Linux kernel ISCI (Intel SAS) driver's device removal path allows a local attacker with low privileges to corrupt kernel memory by racing the completion tasklet against driver teardown, potentially enabling privilege escalation. Systems running affected kernel versions with Intel ISCI SAS hardware are vulnerable across multiple stable branches, with vendor-released fixes available in 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit has been identified and EPSS of 0.18% (7th percentile) confirms no observed widespread exploitation, though the KASAN-verified reproduction documented in the fix commit confirms the failure class is reliably triggerable under controlled conditions.
Out-of-bounds kernel memory read in the Linux kernel's Soft-iWARP (siw) RDMA driver lets a malicious connected iWARP peer send an MPA FPDU whose 16-bit length field is smaller than the fixed DDP/RDMAP header, triggering a signed-integer underflow that propagates a negative length into skb_copy_bits() as a huge size_t, producing a multi-gigabyte use-after-free read. Affected are kernels from 5.3 up to the fixed stable releases wherever the siw module is loaded; the primary outcome is a kernel crash (denial of service) with potential exposure of adjacent kernel memory. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.18% (7th percentile), consistent with the niche siw attack surface despite the high CVSS.
Local privilege escalation and memory corruption in the Linux kernel's drm/v3d GPU driver (Broadcom VideoCore, used in Raspberry Pi and similar SoCs) stems from a use-after-free on the CPU-job ioctl error path, where kvfree() reads the cpu_job structure after v3d_job_cleanup() has already dropped its last reference and freed it. The same faulty path also causes a NULL-pointer dereference on early init failure and leaks a drm_syncobj reference per query. No public exploit is identified at time of analysis, EPSS is low (0.18%), and it is not in CISA KEV, but a kernel UAF reachable by a local unprivileged user with GPU access carries high impact (CVSS 7.8).
Denial of service and potential dma_resv fence-list corruption in the Linux kernel's virtio-gpu DRM driver (drm/virtio) affects Linux guests using virtio graphics, where virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() ignore the return value of virtio_gpu_array_lock_resv(). When the lock acquisition fails with -EINTR (signal during wait) or -ENOMEM (fence-slot allocation), the code proceeds to call dma_resv_add_fence() on an unheld lock, tripping a lockdep WARNING and racing concurrent readers/writers of the fence list. There is no public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and the issue was found by syzbot via fault injection rather than in-the-wild abuse.
Out-of-bounds read in the AMD display (amdgpu) driver of the Linux kernel occurs when the GPIO pin table parsers get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() trust the VBIOS table_header.structuresize field and iterate over gpio_pin[] entries without confirming the full claimed size is mapped. On a system with a malformed or oversized VBIOS structuresize, the loop reads past the end of the BIOS image, potentially disclosing adjacent kernel memory or crashing the driver. There is no public exploit identified at time of analysis, EPSS is low (0.17%), and the issue is not listed in CISA KEV; a vendor patch is available across multiple stable trees.
Use-after-free in the Linux kernel's batman-adv (B.A.T.M.A.N. mesh routing) multicast code lets an adjacent attacker on the mesh trigger access to freed orig_node memory, potentially disclosing kernel memory or crashing the node. The flaw stems from batadv_mcast_purge_orig() removing entries from RCU-protected hlists without waiting for a grace period, so concurrent RCU readers dereference already-freed multicast node references. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV.
Denial-of-service (and minor state corruption) in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced mesh routing) bridge-loop-avoidance (BLA) subsystem allows an adjacent mesh participant to trigger a race condition in the bla.num_requests reference counter. Because the request_sent state check and the atomic increment/decrement of num_requests are not performed under a common lock, concurrent contexts (batadv_bla_send_request(), batadv_handle_announce(), backbone purge, and periodic work) can double-decrement the counter, corrupting BLA state and potentially crashing the kernel. There is no public exploit identified at time of analysis and EPSS risk is low (0.18%, 7th percentile); the fix serializes state and counter updates under a lock and adds a 'stopped' backbone_gw state.
Use-after-free race condition in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh-networking throughput meter (tp_meter) can corrupt kernel memory when a sender timer is re-armed after its backing reference has already been freed during cleanup. The flaw affects systems that load the batman-adv module and run tp_meter sessions; an adjacent mesh peer's ACK can race the shutdown path (batadv_tp_sender_shutdown) so that batadv_tp_reset_sender_timer() re-arms a timer whose object is gone. CVSS is rated 8.8 (AV:A), but with EPSS at 0.21% (11th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is low.
Heap buffer overflow in the Linux kernel's batman-adv mesh networking subsystem (translation-table TVLV generation) lets the number of non-empty VLANs grow between a pre-allocation size check and the buffer fill, so a VLAN that gained its first TT entry during that window is written past the allocated buffer. The flaw affects nodes running batman-adv mesh with VLANs and can corrupt kernel heap memory, most realistically causing a crash or information leak (tagged Information Disclosure). It is not in CISA KEV, has no public exploit identified at time of analysis, and carries a low EPSS of 0.18% (8th percentile) despite the automated CVSS 9.8.
Kernel memory disclosure in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking module arises from an integer wraparound in the translation-table (TT) code, where last_changeset_len was a signed s16 that wraps negative once a changeset exceeds 32767 bytes; batadv_send_my_tt_response() then sign-extends that value and batadv_tt_prepare_tvlv_local_data() allocates a full-sized TVLV buffer while filling only a small part, emitting the uninitialized remainder onto the mesh. A remote mesh peer can thereby receive stale kernel heap contents in TT response frames, tagged by the source as Information Disclosure. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the issue is not in CISA KEV; a vendor patch is available.
Uninitialized kernel-memory disclosure in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh-routing module allows an adjacent mesh peer to receive leaked kernel heap contents inside translation-table (TT) response frames. The batadv_orig_node::tt_buff_len field was typed as s16 and wraps negative when a changeset exceeds 32767 bytes, so batadv_tt_prepare_tvlv_global_data() allocates a full-size buffer but populates only a small portion, transmitting the uninitialized remainder over the mesh. No public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), consistent with a niche, non-default kernel feature rather than a broadly weaponized flaw.
Out-of-bounds memory access in the Linux kernel's hwmon pmbus/adm1266 driver lets a malicious or malfunctioning ADM1266 PMBus device on the I2C bus trigger a one-byte write past the end of the driver's fixed read_buf array, plus a corresponding out-of-bounds read during the PEC comparison. The read_buf field is sized ADM1266_PMBUS_BLOCK_MAX+1 (256 bytes) while the i2c transaction is programmed for ADM1266_PMBUS_BLOCK_MAX+2 (257 bytes), so a maximum-length block response (255 payload bytes plus a PEC byte) overruns the buffer. No public exploit identified at time of analysis and EPSS risk is low (0.18%, 8th percentile); the flaw is fixed across multiple stable trees.
Out-of-bounds heap write in the Linux kernel's ADM1266 PMBus power-sequencer hwmon driver allows a locally-privileged attacker - aided by a malicious or non-compliant ADM1266 device - to overflow kernel heap memory by up to 191 bytes, potentially achieving privilege escalation or kernel code execution. The root cause is a size-contract violation between adm1266_pmbus_block_xfer() (which trusts device-supplied lengths up to 255 bytes) and adm1266_nvmem_read_blackbox() (which allocates only 64-byte strides). No public exploit code has been identified at time of analysis; EPSS is 0.18%, consistent with low in-the-wild interest.
Out-of-bounds read and write in the Linux kernel's hwmon PMBus ADM1266 driver (adm1266_gpio_get_multiple) lets a local low-privileged user with access to the driver's GPIO interface corrupt adjacent kernel/caller stack memory, potentially leading to privilege escalation or a crash. The flaw stems from an incorrect loop bound (the PMBus command code 0xE9/233 was used instead of the 25-pin ADM1266_PDIO_NR limit), so the scan walks up to 242 bits and reads/writes past the caller-supplied mask and bits arrays. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile) and the CVE is not on CISA KEV.
Kernel stack information disclosure and register-state corruption affects the Linux kernel's RISC-V 32-bit compat layer, where compat_riscv_gpr_set() (the PTRACE_SETREGSET handler) and compat_restore_sigcontext() (the compat sigreturn path) call cregs_to_regs() even after the user copy fails, writing an uninitialized stack buffer into the target task's pt_regs. A local low-privileged attacker running a 32-bit process on a riscv64 kernel can force the copy to fail and leak uninitialized kernel stack contents into user-visible registers while corrupting the task's register state. There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), consistent with the narrow RISC-V compat attack surface.
Out-of-bounds read and oversized memory allocation in the Linux kernel's Arm Firmware Framework for A-profile (FF-A) driver (drivers/firmware/arm_ffa) arises from unvalidated offset and size fields in framework notification messages placed in the shared RX buffer. Malformed firmware-supplied data can drive an OOB read during UUID parsing or an oversized kmemdup() allocation, affecting kernels from 6.15 onward on Arm systems using FF-A. Rated CVSS 8.4 (local vector); no public exploit is identified and EPSS is low (0.17%), consistent with a firmware-trust-boundary issue rather than a broadly exploitable remote flaw.
Kernel memory corruption in the Linux arm_ffa (Arm Firmware Framework for A-profile) driver allows a local attacker to trigger a use-after-free by racing notifier unregistration against active notification delivery, affecting Arm systems running kernels from 6.15 up to the fixed 6.18.34/7.0.11 releases. Both the framework and non-framework notification handlers looked up a callback under notify_lock, dropped the lock, then dereferenced a notifier entry that a concurrent unregister could have already freed. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and it is not listed in CISA KEV.
Memory corruption in the Linux kernel netfilter x_tables subsystem lets a local user with network-admin capability trigger a use-after-free during table module removal (rmmod) while userspace performs concurrent set/getsockopt operations on the same table. The fix introduces a two-stage teardown (xtables_unregister_table_exit) that unlinks the table from the dying list, frees hook ops, and emits the audit notification, replacing the racy single-stage xt_unregister_table(). Rated CVSS 7.8 (local, high CIA impact); EPSS is low (0.17%), it is not in CISA KEV, and no public exploit has been identified at time of analysis.
Local privilege escalation and memory disclosure in the Linux kernel's netfilter ebtables subsystem stems from a table-removal race that could expose a partially-initialized ebt_table structure before its ops pointer is assigned. On affected kernels (5.15 through the fixes in 6.18.34, 7.0.11 and 7.1), a local user with network-administration capability manipulating ebtables can trigger the window between allocation and full initialization, corrupting or reading kernel memory. No public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile), consistent with a race-condition bug requiring local access rather than mass exploitation.
Local privilege escalation and memory-safety exposure in the Linux kernel netfilter bridge ebtables subsystem stems from a module-initialization race where nf_register_sockopt() runs before ebtables data structures are fully initialized, exposing the setsockopt/getsockopt interface globally too early. On affected kernels (5.13 through builds before the 6.18.34 / 7.0.11 / 7.1 stable fixes), a local low-privileged actor with the ability to reach ebtables sockopts during the init window can trigger operations on uninitialized state, risking high confidentiality, integrity, and availability impact (CVSS 7.8). There is no public exploit identified at time of analysis and EPSS is low (0.17%), so this is a code-correctness fix rather than an actively exploited threat.
Use-after-free in the Linux kernel's fprobe subsystem exposes kernel memory to corruption when a fprobe is released immediately after unregistration without waiting for an RCU grace period. The flaw was introduced by commit 4346ba1604093, which rewrote fprobe on the function-graph tracer and placed struct fprobe on an RCU-protected hlist but omitted the required synchronize_rcu() call in unregister_fprobe(), leaving a window where in-flight RCU readers may dereference freed memory. BPF users of fprobe are explicitly unaffected because BPF defers deallocation through the bpf_link_defer_dealloc_rcu_gp() RCU callback; affected paths are fprobe events and sample module code.
Local privilege-adjacent memory corruption in the Linux kernel's fs/statmount subsystem allows an authenticated local user to trigger a 1-byte NULL out-of-bounds write on a dynamically allocated seq buffer. The flaw lives in statmount_mnt_idmap(), which manually advances seq->count after seq_printf(); on overflow this desynchronizes the buffer accounting so seq_has_overflowed() misses the overflow and a later 'seq->buf[seq->count++] = 0' writes past the slab allocation. Rated CVSS 7.8 (High); EPSS is low (0.17%, 6th percentile), no public exploit or CISA KEV listing exists at time of analysis, and a vendor fix is available.
Use-after-free in the Linux kernel's irq_work subsystem allows a local attacker on a PREEMPT_RT (real-time) kernel to corrupt memory by racing irq_work_sync() against irq_work_single(). After the BUSY flag is cleared via atomic_cmpxchg(), the work object is still dereferenced for irq_work_is_hard() and rcuwait_wake_up(), while a concurrent irq_work_sync() caller on another CPU can observe BUSY==0, return, and free the object before those accesses complete. Rated CVSS 7.8 (High); no public exploit identified at time of analysis and EPSS probability is low (0.19%, 8th percentile).
Use-after-free (CWE-416) in the Linux kernel nvme-pci driver allows a local attacker or triggerable hardware condition to crash the kernel or potentially corrupt memory. The nvme_free_host_mem() function frees dev->hmb_sgt but never clears the pointer, so a double-call during an error path in nvme_probe() dereferences the freed and zeroed DMA structure, causing a NULL pointer dereference in iommu_dma_free_noncontiguous(). Observed reliably on Thunderbolt-attached NVMe devices with PCIe link instability; no public exploit or active exploitation identified at time of analysis.
Improper error-path cleanup in the Linux kernel's netfs read subsystem (the netfslib helper used by network filesystem clients such as CIFS/SMB, AFS, Ceph and 9p) mishandles reference counting when preparation of a direct-I/O (DIO) or single-read subrequest fails after being added to the stream's subrequest list. Because the failed subrequest can still be observed by the collector while holding two outstanding references, this leads to reference mismanagement and potential use-after-free/memory disorder on the read failure path, tagged as an information-disclosure risk. The fix has been merged upstream and backported; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.17%).
Memory corruption in the Linux kernel's netfs library (introduced around v6.10) arises because netfs_retry_read_subrequests() and netfs_retry_write_stream() add new subrequests to stream->subrequests without holding the stream lock, creating a race on the shared list during I/O retry. The flaw affects systems using netfs-backed network filesystems (e.g. AFS, Ceph, CIFS/SMB, 9p) and can lead to list corruption, information disclosure, or a crash when concurrent retries mutate the list. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.15%), consistent with a hard-to-trigger local kernel race rather than a remotely weaponizable bug.
Memory-ordering defect in the Linux kernel's netfs (network filesystem helper) subsystem allows the lockless readers netfs_collect_read_results() and netfs_collect_write_results() to observe a subrequest pointer before the NETFS_SREQ_IN_PROGRESS flag and other subreq state are guaranteed visible, causing races on stream->subrequests. The flaw affects kernels from 6.10 onward that use netfs-backed filesystems (CIFS/SMB, AFS, Ceph, 9p) and can lead to stale-state reads, information disclosure, or instability during concurrent I/O collection. There is no public exploit identified at time of analysis, EPSS is very low (0.15%, 5th percentile), and it is not on CISA KEV; the upstream fix is available in stable git.
A missing back-pressure flaw in the Linux kernel's netfs read path (netfs_read_to_pagecache()) fails to pause generation of new read subrequests after an already-issued subrequest fails, affecting network/cached filesystems (e.g. AFS, Ceph, CIFS/SMB, 9p, and fscache-backed mounts) built on the netfs helper library. The upstream fix has been merged and backported to stable trees; EPSS is very low (0.17%, 6th percentile) and no public exploit or CISA KEV listing exists, so this is no public exploit identified at time of analysis. Despite an NVD/CNA CVSS of 9.8, the change is a reliability/correctness fix and the supplied tag characterizes real impact as Information Disclosure rather than remote code execution.
Memory corruption in the Linux kernel netfs subsystem allows local authenticated users to corrupt kernel heap state via a crafted sequence of streaming write operations on network-backed filesystems, potentially enabling local privilege escalation to root. The bug resides in netfs_perform_write(): when a subsequent write fully overwrites a partially-dirty streaming-write folio, the netfs_folio struct that tracks the dirty byte region is neither freed nor correctly updated, leaving stale or inconsistent metadata that drives out-of-bounds writes (CWE-787) during later writeback processing. Patched versions are available across all active stable branches (6.12.92, 7.0.11, 7.1, 6.18.34); no public exploit or active exploitation has been identified at time of analysis.
Use-after-free memory corruption in the Linux kernel's netfs subsystem (netfs_read_gaps()) allows local activity on network filesystem mounts (notably the cifs/SMB client) to write into a prematurely-freed sink folio. The bug arises because the sink page backing an ITER_BVEC iterator is released before the outstanding read op completes, letting the cifsd receive thread copy incoming socket data into freed memory - reproduced by KASAN on the generic/075 xfstest. There is no public exploit identified at time of analysis and EPSS risk is low (0.17%); the vendor-supplied CVSS of 9.8 (AV:N) appears inflated for what is fundamentally a local, race-dependent kernel flaw.
Local information disclosure and memory corruption in the Linux kernel's netfs subsystem arises because netfs_read_folio() does not wait for in-flight writeback to complete before trusting the folio dirty flag and the folio->private data, which the writeback collector may free before it clears the writeback flag. Hosts using network/cache-backed filesystems (9p, AFS, Ceph, CIFS/SMB, and fscache-backed mounts) can hit a race where a read consumes stale or freed metadata. There is no public exploit identified at time of analysis and the EPSS probability is low (0.17%, 6th percentile); the fix is merged in stable releases 6.18.34, 7.0.11, and 7.1.
Improper locking in the Linux kernel AFS (Andrew File System) client's symbolic link handling (afs_get_link()) allows a local attacker on a host mounting an AFS volume to trigger race conditions that leak kernel memory and can expose stale or freed symlink buffers. The flaw affects kernels from roughly 6.14 up to the fixed 7.0.11/7.1 stable series and stems from a missing validate_lock, absent RCU barriering during lockless pathwalk, and unsynchronized access when a symlink is concurrently updated on the server. No public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and it is not on CISA KEV.
Data corruption and cross-port information disclosure affects the Linux kernel's Cortina Gemini (gmac) ethernet driver, where a single static local SKB used to reassemble fragmented RX packets in gmac_rx() is shared across the SoC's two ethernet ports. On devices actively using both ports simultaneously, concurrent RX processing can race on this shared buffer, mixing packet fragments between ports; the fix makes the RX SKB a per-port structure member. EPSS is low (0.18%, 8th percentile) with no public exploit identified at time of analysis and no CISA KEV listing, indicating this is a correctness/hardening fix rather than a practically weaponizable flaw despite its assigned CVSS of 9.8.
Malformed packet assembly in the Linux kernel's Cortina Gemini 'gmac' Ethernet driver (drivers/net/ethernet/cortina) occurs because the RX fragment counter (frag_nr) is reset to zero between NAPI poll invocations when the RX ring buffer empties mid-assembly, leaving a partially built SKB. The realistic impact is corrupted or partially-assembled receive buffers on affected ARM SoC platforms, tagged as Information Disclosure, potentially leaking stale buffer contents or destabilizing the receive path. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the issue is not in CISA KEV, and the NVD-supplied CVSS 9.8 is almost certainly an automated over-score inconsistent with a driver-internal RX race.
Double-free memory corruption in the Linux kernel's net/shaper subsystem allows a local attacker with CAP_NET_ADMIN capability to corrupt the kernel heap by submitting a crafted GROUP netlink request containing duplicate leaf handles. Affected kernels span from the introduction of the net shaper subsystem (~6.13) through multiple stable branches, with fixes backported to 6.18.34, 7.0.11, and 7.1. No public exploit or active exploitation has been identified; vendor-released patches are available via kernel.org and distribution advisories such as Ubuntu USN-8593-1.
Out-of-bounds kernel memory read in the Linux kernel block layer (block integrity subsystem) stems from bio_integrity_copy_user() overwriting bip_vcnt with nr_vecs after bio_integrity_add_page() had already set it to 1 for the bounce segment. On WRITE this breaks the bip_vcnt <= bip_max_vcnt invariant (bip_max_vcnt is 1), causing gap-merge checks in block/blk.h to read past the bip_vec[] flex array; on READ, in-bounds access lands on a saved user bvec instead of the bounce. A local low-privileged user issuing I/O with user-supplied integrity metadata can trigger information disclosure and instability; there is no public exploit identified at time of analysis and EPSS is very low (0.17%, 6th percentile).
Local privilege-escalation via kernel memory corruption in the Linux accel/qaic driver (Qualcomm Cloud AI 100 accelerator) lets a user with access to the qaic device trigger a use-after-free by mapping a GEM buffer object (BO) larger than its VMA. The qaic_gem_object_mmap path called remap_pfn_range without bounding it to the VMA size, so an oversized BO mapped pages past the VMA; a later munmap() unmaps only the VMA and leaves stale mappings to freed pages. EPSS is low (0.17%, 6th percentile) with no public exploit and no KEV listing, but the C:H/I:H/A:H impact makes it a valid local escalation primitive on affected hardware.
Use-after-free in the Linux kernel's Qualcomm MSM Display Processing Unit (DPU) DRM driver arises because dpu_writeback_init() mixes device-managed (devm_) and DRM-managed (drmm_) allocation lifetimes. On driver teardown, the writeback connector's data is freed via devm while userspace still holds a reference to the drm device and can interact with the drmm-backed connector, creating a dangling pointer a local user can exploit. Rated CVSS 7.8 (local, low-privilege); EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis.
Remote denial of service in the Linux kernel's SMC-D (Shared Memory Communications over ISM) client allows a malicious peer to crash the system via a null-pointer dereference during SMC-Dv2 connection setup. When a client sends an SMC-Dv2-only proposal and no SMC-Dv1 device is selected, a peer that replies with an ACCEPT containing CHID value 0 matches the reserved empty slot 0 of the ism_dev[] array, causing a null-ptr-deref on ism_dev[0]->lgr_lock in smc_conn_create(). No public exploit identified at time of analysis; EPSS is low (0.17%) and it is not listed in CISA KEV, but the fix is upstream in the kernel stable tree.
Memory-safety off-by-one in the Linux kernel's TLS (kTLS) data path miscounts scatterlist entries when an sk_msg scatterlist ring wraps (sg.end < sg.start), causing tls_push_record() to place the sg_chain() continuation pointer at data[MAX_SKB_FRAGS] instead of the true last entry. On affected 5.5-through-7.x stable kernels this can corrupt or misdirect the scatterlist handed to the crypto API during TLS record transmission, with the potential for information disclosure (as tagged) or a crash. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the issue is not in CISA KEV.
Malformed scatterlist chaining in the Linux kernel TLS (kTLS) plaintext send path can hand illegal 'chain-after-chain' input to the crypto subsystem when the ring's end index is 0 while start is non-zero, because the sg_next iterator does not recursively resolve consecutive chain links. This affects the kernel's in-kernel TLS offload used by processes with TLS sockets, and is tagged as an information-disclosure issue. It is not in CISA KEV and no public exploit has been identified; EPSS is low at 0.18% (7th percentile), and a fix is available across multiple stable kernel branches.
Use-after-free in the Linux kernel's in-kernel OpenVPN data channel offload (ovpn) TCP transport allows a local attacker to corrupt kernel memory by racing a TCP socket close against peer removal. The flaw lives in ovpn_tcp_close(), which caches a peer pointer under an RCU read lock but then escapes and dereferences sock->peer after the lock is dropped and without holding lock_sock(), so ovpn_socket_release() can free the socket concurrently. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but the CVSS 8.4 rating reflects full high impact to confidentiality, integrity, and availability if the race is won. A vendor patch is available.
Use-after-free in the Linux kernel's in-kernel OpenVPN data-channel module (ovpn) lets a local operator who can create VPN peers over TCP trigger memory corruption when the CMD_NEW_PEER netlink command hits its error path. The flaw affects kernels from 6.16 onward and stems from the error path calling the peer destructor directly instead of dropping the kref, so a concurrent TCP syscall caller (e.g. a recvmsg blocked on the peer's queue) can operate on freed memory. No public exploit identified at time of analysis; EPSS is low (0.21%) and it is not in CISA KEV, but the CVSS 7.8 reflects high confidentiality/integrity/availability impact from local memory corruption.
Improper resource validation in the Linux kernel's vfio/pci DMABUF export path (vfio/pci) allows a local user holding a VFIO device file descriptor to export and access PCI BAR (MMIO) resources that were never successfully reserved, enabling disclosure of adjacent device memory. The flaw stems from the DMABUF-creation path exporting BAR access without first confirming the resources were reserved at startup. There is no public exploit identified at time of analysis, EPSS is low (0.19%), and it is not listed in CISA KEV; the fix has been merged upstream.
Local privilege escalation and memory corruption in the Linux kernel's ASoC fs210x audio codec driver arises from a misused strscpy() call in fs210x_effect_scene_info(), where the copy length was derived from the source string (strlen(SRC)+1) rather than the destination buffer size, allowing an overwrite when the source is at least as long as the destination. The flaw affects Linux 6.18 through the fixed stable releases and carries a CVSS of 7.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile), consistent with a local-only kernel driver bug rather than a mass-exploited network flaw.
Information disclosure and denial-of-service in the Linux kernel's drm/msm display snapshot subsystem allows a local low-privileged user to read out-of-bounds register data and trigger a 16x memory overallocation during device state dumps. The flaw stems from the snapshot code force-aligning data segments to 16 bytes, which mishandles unaligned regions such as the 4-byte-shifted DSI data, causing inaccurate register reads. No public exploit identified at time of analysis; EPSS probability is low (0.21%), and it is not listed in CISA KEV.
Kernel memory corruption in the Linux iwlwifi 'mld' Wi-Fi driver occurs when AMSDU is disabled for a traffic ID and the TSO segmentation path (iwl_mld_tx_tso_segment) fails to detect the sentinel value max_tid_amsdu_len == 1, producing gso_size = 0 and exploding a single GSO skb into ~32,000 tiny segments that flood the TX ring and trigger a use-after-free (refcount underflow) in TCP's retransmit queue. Only the newer 'mld' driver is affected; the legacy 'mvm' driver is immune because it checks amsdu_enabled first. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 6th percentile), and a vendor patch is available.
Local privilege-context memory corruption in the Linux kernel's cgroup/rstat subsystem allows a process holding CAP_BPF and CAP_PERFMON to trigger an out-of-bounds array access by passing an unvalidated CPU index to the css_rstat_updated() BPF kfunc. Because the caller-supplied cpu argument is used for per-cpu rstat lookups without a possible-CPU bounds check, a value such as 0x7fffffff drives an array-index-out-of-bounds condition (confirmed on UBSAN kernels) inside kernel/cgroup/rstat.c. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; exploitation requires elevated BPF-related capabilities, which sharply narrows the realistic attacker set.