Linux
Monthly
Privilege escalation in the Linux kernel CIFS/SMB client allows a local user with write access to a setuid or setgid binary on a CIFS mount to retain those elevated-execution bits on the server after a write operation that should have stripped them. The flaw exists in cifs_setattr_unix() and cifs_setattr_nounix(), which unconditionally dropped the ATTR_MODE flag when ATTR_KILL_SUID/ATTR_KILL_SGID was present, preventing the cleared mode from being propagated to the server when using cifsacl, modefromsid, SMB3.1.1 POSIX extensions, or SMB1 Unix extensions. An attacker who can write to a setuid binary on such a mount can subsequently execute it with unintended elevated privileges. No public exploit has been identified and EPSS is 0.21%, but vendor-confirmed patches are available in kernels 7.2.4, 6.18.51, and 7.3-rc1.
A use-after-free and memory leak in the Linux kernel's CIFS/SMB client (cifs_check_trans2 in the SMB1 TRANSACT2 reassembly path) can be triggered when a malicious or man-in-the-middle SMB server sends a malformed secondary TRANSACT2 response after a valid primary one. Because handle_mid() overwrites mid->resp_buf and skips clearing the server's smallbuf/bigbuf pointers when multiRsp is set, the demux thread later reuses a freed buffer, corrupting kernel memory. Despite a 9.8 CVSS rating, EPSS is only 0.20% and no public exploit is identified; the flaw is DoS/memory-corruption-leaning and requires the client to mount a share from an attacker-controlled server plus a demux-thread timing race.
Use-after-free in the Linux kernel's SMB/CIFS client DFS referral cache lets a dangling target-hint pointer be dereferenced after the backing structures are freed. In free_tgts(), all cache_dfs_tgt entries on ce->tlist are freed but ce->tgthint is left pointing at one of them, so a subsequent lookup of the preferred DFS target reads freed slab memory (CWE-416). The fix simply sets ce->tgthint to NULL after freeing the list. No public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), and it is not in CISA KEV.
A use-after-free in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated SMB client to trigger a slab-use-after-free write and likely kernel crash by abusing durable file-handle reconnection. When two sessions hold durable-v2 handles on the same file under different AppInstanceIds, ksmbd_reopen_durable_fd() rebinds every detached oplock on that inode to the reconnecting session instead of only the file's own, so one session adopts another's oplock without a session reference; after the adopted session is destroyed, ksmbd_close_fd_app_instance_id() dereferences the freed session. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), and the fix is present in kernels 7.2.4 and 7.3-rc1.
Denial of service and stale-memory disclosure in the Linux kernel SMB/CIFS client (cifs.ko) arise from an integer-overflow in symlink_data()'s error-context parsing loop. A previous fix (commit 7d9a7f1f96cd) checked the post-ALIGN() length against the remaining buffer, but ALIGN() itself overflows: an ErrorDataLength near UINT32_MAX (e.g. 0xFFFFFFF9) makes ALIGN(x,8) wrap to 0, so the bounds check passes and the loop advances by zero bytes, spinning indefinitely while 'p' points into stale data. A malicious or MITM SMB server can trigger this against a connecting client; no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile).
Out-of-bounds heap read and write in the Linux kernel's CIFS/SMB client (coalesce_t2() in fs/smb/client) allows a malicious or MITM SMB server to corrupt kernel memory or leak data by supplying a crafted Transaction2 DataOffset field. The function computes source and target data pointers directly from the server-controlled DataOffset with no bounds validation before a memcpy, so a small value overwrites header fields while a large value pushes the pointer past the buffer end. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; the fix adds lower- and upper-bound checks for both pointers.
Out-of-bounds read in the Linux kernel SMB client's reparse_buf_ptr() function allows a malicious or MITM-positioned SMB server to trigger a kernel-level OOB memory read by returning a crafted IOCTL response with OutputCount below 6 bytes. The function reads ReparseDataLength at byte offset 4-5 of struct reparse_data_buffer before verifying that count covers the full 8-byte fixed header, exposing unvalidated memory and potentially crashing the client kernel. No public exploit code exists and EPSS is 0.15%, consistent with the network-positioning requirement and absence of weaponized tooling.
Kernel-memory disclosure in the Linux kernel's SMB/CIFS client (cifs.ko) lets a malicious or compromised SMB server leak up to ~65535 bytes of adjacent slab memory to userspace. CIFSTCon() computes its string-parsing bound from the server-supplied ByteCount minus two; a ByteCount of 0 or 1 underflows to a negative int that converts to a huge size_t and wraps the __u16 bytes_left, so cifs_strndup_from_utf16() reads far past the ~16 KB cifs_req_poolp slab object, and the leaked bytes surface via tcon->nativeFileSystem in /proc/fs/cifs/DebugData. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Out-of-bounds read in the Linux kernel's SMB/CIFS client allows a malicious or compromised SMB server to trigger memory over-reads while the client processes oplock-break responses. A refactor (commit 83bfbd0bb902 removing the RFC1002 header from smb_hdr) mechanically rewrote a DataOffset bounds check in is_valid_oplock_break() into an expression that is identically zero, silently disabling the guard that commit 097f5863b1a0 originally added - so an attacker-supplied 32-bit DataOffset again escapes validation. No public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile).
Incomplete error-path cleanup in the Linux kernel HID custom sensor driver (`hid-sensor-custom`) creates a use-after-free condition: when `hid_sensor_custom_add_attributes()` fails partway through sysfs group creation, previously created groups are not removed and `sensor_inst->fields` can be freed while `enable_sensor` sysfs attributes retain stale pointers into that array. Systems running Linux kernel from commit 4a7de051 through versions prior to 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1 are affected wherever the `hid-sensor-custom` module is loaded. No public exploit code exists and no CISA KEV listing is present, but kernel-space use-after-free conditions carry inherent privilege-escalation potential.
Use-after-free in the Linux kernel's universal-pidff HID force-feedback driver allows a local attacker with low privileges to write into freed kernel memory by exploiting a missing cleanup path when force-feedback initialization fails after device start. When hid_pidff_init_with_quirks() returns an error, hid_hw_start() is never reversed, leaving the hidraw character device node alive and pointing to freed memory; with hdev->driver set to NULL, hid_device_remove() also skips hid_hw_stop(). Any subsequent open of the surviving /dev/hidrawX can trigger a UAF write via the transport spinlock callback, potentially escalating local privileges to root. No public exploit has been identified, but the detailed commit description supplies a ready trigger condition.
Write use-after-free in the Linux kernel HID mcp2221 driver allows a local low-privileged user to corrupt kernel memory via a dangling pointer left in the driver's rxbuf field after an I2C/SMBus read transfer ends. The mcp_i2c_smbus_read() function stores the caller-supplied buffer pointer in mcp->rxbuf for the transfer's lifetime but fails to clear it on any return path; a delayed or spurious MCP2221_I2C_GET_DATA USB HID report arriving after the caller frees or reuses the buffer causes mcp2221_raw_event() to memcpy device-controlled data into freed kernel memory. No public exploit has been identified and EPSS is 0.20%, but the kernel write primitive makes this a realistic local privilege escalation path on any system with an MCP2221 USB device attached.
Heap buffer overflow in the Linux kernel's Intel THC HID QuickSPI driver allows a local low-privileged user to corrupt kernel memory via the hidraw interface. The driver's write_cmd_to_txdma() function performs an unbounded memcpy from a caller-supplied HID report into a device-descriptor-derived heap buffer of only a few hundred bytes, while the HID core permits reports up to 16,384 bytes through SET_REPORT/SET_FEATURE ioctls - a size mismatch that lets an attacker overflow the buffer with attacker-controlled length and content, enabling potential local privilege escalation to root. Vendor-released patches are available in Linux 7.2.4, 7.3-rc1, and 6.18.50; no public exploit or active exploitation has been identified at time of analysis.
Buffer overflow in the Linux kernel's Intel Touch Host Controller QuickSPI HID driver allows a local user with hidraw device access to corrupt kernel memory using device-controlled content. The function `quickspi_get_report()` copies the full device-supplied response length into the caller's buffer without checking the caller-provided size bound, so a touch controller returning more bytes than allocated overflows the kernel buffer. No public exploit exists (EPSS 0.17%, no KEV), but the sibling intel-quicki2c driver already carried the correct fix, confirming the root cause is a missing bounds-check port.
Out-of-bounds memory access in the Linux kernel's ntfs3 filesystem driver during log replay allows a local attacker who can mount a crafted NTFS image to corrupt kernel memory, potentially achieving privilege escalation. The root cause is that check_rstbl() validates DIR_PAGE_ENTRY table bookkeeping but never verifies that the trailing page_lcns[] array actually fits within the entry's declared size, so a crafted lcns_follow field drives a memmove and subsequent replay passes past the entry boundary. No public exploit or CISA KEV listing exists; EPSS is 0.18%, consistent with the local mount-gated attack surface shared by sibling ntfs3 CVEs (CVE-2026-89610 through CVE-2026-89614).
Kernel memory disclosure in the Linux ntfs3 driver's ni_read_frame() function exposes uninitialized kernel heap content to userspace via a plain read(2) call on a crafted NTFS compressed file. The LZNT decompressor returns early when it encounters a zero chunk header, writing fewer bytes than frame_size, but the residual gap in the vmapped pages is never zeroed before being marked uptodate and copied to userspace - leaking whatever kernel memory previously occupied those pages. A crafted NTFS image containing a short-decompressing compressed stream is sufficient to recover kernel pointers and defeat KASLR, making this a viable first-stage primitive for a chained kernel privilege-escalation attack. No public exploit has been identified at time of analysis and EPSS stands at 0.17%.
Out-of-bounds array access in the Linux kernel ntfs3 filesystem driver allows an attacker who can cause a crafted NTFS image to be mounted to trigger kernel memory corruption via an overflow of the page_lcns[] array. The copy_lcns and redo-shorten loops index page_lcns[] at j+i where i is bounded by the log record's lcns_follow field rather than the target dirty-page entry's field, and because check_dp_table() validates the entry but not the copy_lcns record, and find_dp() bounds j but not i, a crafted record can overflow the array of an otherwise structurally valid entry. No public exploit has been identified at time of analysis, and EPSS is 0.18%, but siblings CVE-2026-89610 through CVE-2026-89613 affect the same ntfs3 code path in the same kernel fix wave.
Out-of-bounds slab read in the Linux kernel NTFS driver's cluster allocator lets a crafted NTFS image trigger a KASAN-detected memory read when a file on the volume is extended. The free-cluster bitmap array (vol->lcn_empty_bits_per_page) is sized from the volume's nr_clusters at mount, but ntfs_cluster_alloc() bounds its scan by the on-disk $Bitmap size instead; an image whose $Bitmap advertises more clusters than the volume actually has drives the allocator past the array. Reported through the Linux stable tree with an upstream fix; no public exploit identified at time of analysis and EPSS is low (0.16%).
Improper metadata validation in the Linux kernel's NTFS3 filesystem driver allows a crafted NTFS image to pass consistency checks when an attribute declares empty mapping pairs while carrying an inconsistent highest VCN and size. Parsing such an attribute can drive out-of-bounds memory access during runlist decoding, leading to memory corruption or a denial of service when the malicious image is mounted. The fix rejects attributes whose empty mapping pairs contradict their highest VCN/size fields; no public exploit identified at time of analysis and EPSS is low (0.20%).
Out-of-bounds memory access in the Linux kernel ntfs3 filesystem driver occurs because parse_ntfs_boot_sector() decodes the boot sector's unsigned 64-bit MFT and MFTMirr Logical Cluster Numbers (LCNs) into a signed s64. A crafted NTFS image with a high-bit-set LCN wraps to a negative value that slips past the existing upper-bound check and propagates into the MFT zone allocator, driving an out-of-bounds access to lcn_empty_bits_per_page. Exploitation requires mounting an attacker-supplied NTFS volume; there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Out-of-bounds kernel memory write in the Linux kernel ntfs3 driver allows a local attacker to corrupt memory by mounting a crafted NTFS image. ntfs_attr_update_meta() shifts an attribute name forward by eight bytes when converting a non-sparse attribute to sparse (to insert the compressed_size field), but the record validator never confirms name_offset is within bounds, that the name does not overlap the mapping pairs, or that eight free bytes exist after mapping_pairs_offset - so a malicious MFT record can force a write past the attribute boundary. No public exploit identified at time of analysis; EPSS is low at 0.15% (5th percentile) and the issue is fixed in kernel 7.2.4 and 7.3-rc1.
Out-of-bounds memory access in the Linux kernel's NTFS (ntfs3) driver arises because the mapping-pairs runlist decoder confirms that a run's starting LCN falls inside the volume but never checks that the run's end (lcn + length) also stays within nr_clusters. Mounting or parsing a crafted NTFS image can therefore drive the kernel to reference clusters beyond the volume boundary, corrupting memory and potentially escalating privilege. No public exploit has been identified and EPSS is low (0.20%), indicating this is a hardening/DoS-leaning fix rather than an imminent mass-exploitation threat.
Missing lock acquisition in the eCryptfs filesystem layer exposes the global message context list to concurrent modification during daemon teardown. In `ecryptfs_exorcise_daemon()`, queued message contexts are moved back to the free list without holding `ecryptfs_msg_ctx_lists_mux`, while `ecryptfs_msg_ctx_alloc_to_free()` and other list consumers require that lock - creating a race window for use-after-free or memory corruption reachable by a local user. No public exploit exists and EPSS is 0.21%, but C:H/I:H/A:H impact makes this a meaningful local privilege escalation candidate on systems using eCryptfs.
Out-of-bounds read in the Linux kernel's eCryptfs filesystem packet parser allows a local low-privileged attacker to leak kernel memory or trigger a denial of service by opening a crafted encrypted file with a version 1 header. The root cause is that ecryptfs_parse_packet_set() computes remaining buffer space using a fixed PAGE_SIZE - 8 formula instead of the actual packet-set buffer length, overstating available bytes for version 1 headers where the packet set begins later. Patches are available for stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation has been identified.
Two heap out-of-bounds writes in Linux kernel eCryptfs allow a local low-privileged user to corrupt kernel memory structures by supplying a crafted Tag 3 passphrase-encrypted session key packet with an oversized encrypted_key_size field. The vulnerability is exclusively triggered when AES-192 (cipher code 0x08) is used because that cipher sets crypt_stat->key_size=24 independently, permitting crypto_skcipher_setkey() to succeed while encrypted_key_size still exceeds the 64-byte ECRYPTFS_MAX_KEY_BYTES bound - overflowing into ecryptfs_auth_tok and corrupting root_iv, keysig_list, and mutexes in ecryptfs_crypt_stat. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.20% at the 10th percentile.
Integer underflow in the Linux kernel's eCryptfs filename-encryption parser allows a local attacker to trigger heap memory corruption by supplying a crafted tag 70 packet with a body shorter than the fixed metadata fields. The underflow causes ecryptfs_parse_tag_70_packet() to derive a wildly inflated encrypted-filename size, enabling out-of-bounds heap reads or writes with full confidentiality, integrity, and availability impact. No public exploit code exists and the CVSS score of 7.8 (AV:L) aligns with the local-only attack surface; vendor-confirmed patches are available across all supported stable branches.
Resource management failure in the Linux kernel eCryptfs subsystem allows a local authenticated user to trigger a message context leak - and potentially exploit a stale pointer condition - by inducing send failures to the eCryptfs userspace daemon. The ecryptfs_send_message_locked() function moves a context from the free list to the allocated list before calling ecryptfs_send_miscdev(); on failure, it omits the rollback, leaving the context permanently stranded and the caller holding a dangling reference. Vendor-released patches are available across stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit or CISA KEV listing has been identified at time of analysis.
Seccomp filter bypass in the Linux kernel entry path allows a low-privileged local process to execute syscalls blocked by a newly installed seccomp filter. The vulnerability arises because `syscall_trace_enter()` caches the `syscall_work` flags at entry; when a sibling thread installs a seccomp filter via `SECCOMP_FILTER_FLAG_TSYNC` while the first thread is ptrace-stopped, the `SYSCALL_WORK_SECCOMP` flag is set on the stopped thread but the stale cached variable never reflects it. When the ptrace tracer also modifies the syscall number during the stop (e.g., substituting `execve`), the resumed thread bypasses the filter entirely. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.18%.
Heap out-of-bounds write in the Linux kernel erofs compressed filesystem driver corrupts kernel memory when a global buffer pool resize fails mid-way and is retried. During the retry, a temporary pointer array is allocated to the (smaller) intermediate target size, then populated with all existing pointers from a larger-than-expected buffer - writing past the end of the allocation. A separate retry path also triggers spurious -ENOMEM from alloc_pages_bulk() when no new pages are needed. No active exploitation is recorded (not in CISA KEV), and EPSS is 0.20% at the 10th percentile. Vendor-released patches are available in Linux 6.18.51, 7.2.4, and 7.3-rc1.
Silent inode metadata loss in the Linux kernel ext2 filesystem affects all systems using ext2 with IS_SYNC inodes: calls to `sync_inode_metadata()` in `ext2_setsize()` and `ext2_xattr_set2()` were guarded by an IS_SYNC branch that skipped `mark_inode_dirty()`, meaning that if the inode was not already dirty, the sync was a no-op and metadata changes were silently discarded. Affected operations include file truncation and extended attribute writes on synchronous ext2 mounts. No public exploit code exists and EPSS is 0.15%, consistent with a data-integrity correctness fix rather than a security-critical attack surface.
Use-after-free in the Linux kernel fanotify subsystem (introduced in 6.14) copies stale kernel stack memory to userspace and may enable local privilege escalation on unpatched 6.18.x and 7.x kernels. When a signal interrupts the triggering task precisely after the event reader sets FAN_EVENT_REPORTED but before it finishes preparing the file descriptor, fanotify_get_response() unwinds the stack-allocated file_range frame while the reader retains a dangling pointer to range.pos; the subsequent copy_range_info_to_user() dereferences freed stack memory, confirmed by KASAN. No public exploit code exists and EPSS is very low (0.17%), but vendor patches are available in 6.18.50, 7.2.4, and 7.3-rc1.
Uninitialized mutex race condition in the Linux kernel's omapfb DSI command-mode panel driver (panel-dsi-cm) exposes OMAP SoC systems to kernel panic or memory corruption. dsicm_probe() calls omapdss_register_display() to publish the display device before executing mutex_init() on ddata->lock, creating a window where any concurrently-invoked dsicm callback can attempt to acquire an uninitialized mutex with undefined results. No public exploit exists and EPSS sits at 0.17% (6th percentile), accurately reflecting the extreme niche of OMAP hardware in current deployments. Vendor-released patches are available across affected stable branches.
Incomplete error-path cleanup in the Linux kernel uvesafb framebuffer driver leaves a stale v86d connector callback registered when platform driver initialization fails, creating a potential use-after-free condition in kernel memory. All Linux kernel versions from 2.6.24 onward that include the uvesafb driver are affected; the issue was found through static analysis and is patched in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit exists; EPSS is 0.20% (10th percentile), reflecting the narrow and difficult-to-trigger conditions required.
Out-of-bounds read and write in the Linux kernel's forcedeth NVIDIA ethernet driver triggers on every S3 suspend/resume cycle due to an off-by-one loop terminator in nv_suspend() and nv_resume(). The loop runs one iteration past the end of the saved_config_space[] array, overwriting adjacent kernel memory (np->name_rx[]) and issuing a stray MMIO write one dword beyond the ioremap'd hardware window; with CONFIG_UBSAN_TRAP=y the kernel aborts during the suspend path. The bug has existed since Linux 2.6.27 but was only surfaced by UBSAN on Apple Macmini3,1 (MCP79) hardware during S3 cycling. No public exploit has been identified at time of analysis.
Kernel crash exposure in the OMAP SSI/HSI driver stems from a missing DMA mask initialization on the synthetic HSI controller device allocated via hsi_alloc_controller(), which bypasses the normal OF/platform device setup path and leaves the embedded struct device without a valid dma_mask. Following DMA API hardening changes in the kernel, dma_map_sg() and related helpers enforce the presence of a valid mask before proceeding, causing warnings or kernel panics on any OMAP SoC system where the driver attempts DMA mapping. The vulnerability is tightly hardware-gated to Texas Instruments OMAP-based platforms; patches are confirmed available in kernel stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1, and no public exploit or KEV listing exists.
Hugetlb reservation accounting in the Linux kernel underflows when a huge-page folio shared between a parent and child process (after fork) is unmapped by the parent first. Since commit df7a6d1f6405 introduced reservation adjustment logic into `__unmap_hugepage_range()`, the function decrements the reservation counter without verifying that the folio's mapcount has reached zero, leaving the child's mapping unaccounted and the counter in an arbitrarily large (underflowed) state until the child unmaps. Affected kernels from 6.9 through the fix commits expose systems using hugetlb-backed workloads to integrity corruption (overcommit of huge pages) and availability risk (kernel memory management instability). No public exploit or active exploitation is identified at time of analysis.
Out-of-bounds read in Linux kernel ACPI APEI GHES ARM hardware error handler arises from using pointer size instead of structure size when accounting for remaining CPER buffer after skipping the cper_sec_proc_arm header. Affected are stable branches 6.12.x through 6.12.109, 6.18.x through 6.18.50, 7.x through 7.2.4, and pre-7.3-rc1, on ARM systems with ACPI APEI support. No public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), and there is no CISA KEV listing, consistent with a low automated exploitation probability.
Stack buffer overflow in the Linux kernel's ACPI Platform Firmware Runtime Update (pfr_update) driver allows a local low-privileged attacker to corrupt kernel stack memory via oversized ACPI DSM buffer responses. The flaw exists in query_capability() where memcpy uses firmware-supplied buffer.length without bounds checking against fixed-size u8[16] destination fields in the stack-allocated struct pfru_update_cap_info, enabling writes up to 44 bytes past the end of the structure. KASAN confirmed exploitation on 7.2-rc6 producing three distinct stack-out-of-bounds reports; vendor-released patches are available in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit code exists and EPSS probability is low at 0.18%, but successful exploitation could yield arbitrary kernel code execution on affected systems.
TRIM/discard is completely broken on 4Kn (4096-byte native sector) block devices in the Linux kernel's libata-scsi layer, causing every ATA DSM TRIM command to fail with 'Parameter list length error' and trigger WARN_ON() splats on each attempt. The bug is in ata_scsi_write_same_xlat(): ata_format_dsm_trim_descr() caps its output at 2048 bytes (ATA_SCSI_RBUF_SIZE), but the caller compares this return value against the logical sector size - on 4Kn devices (sector_size=4096), this equality check always fails and every TRIM is rejected. No public exploit exists; this is a deterministic functional regression on specific hardware. Vendor-released patches are available in stable kernels 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Use-after-free in the Linux kernel's auxdisplay charlcd driver allows a local, low-privileged attacker to potentially corrupt kernel memory when charlcd_register() fails after bl_work has already been scheduled. The root cause is that charlcd_init() schedules a delayed backlight work item referencing the charlcd object before misc_register() is called; if registration fails, the caller frees the object while the work item's reference remains valid, creating a classic UAF condition. No public exploit exists and EPSS is 0.20% (10th percentile), reflecting the niche hardware footprint and non-default kernel configuration required.
Missing DMA alignment validation in the Linux kernel block layer allows a local unprivileged user to submit misaligned I/O vectors that bypass per-device alignment checks during bio construction from iov_iter, potentially triggering memory corruption, data leakage, or kernel crashes. Bio-based drivers lack alignment-split checks and stacking block drivers may silently mis-handle misalignment detected only after bio submission, making the window for exploitation broader than a single driver path. No public exploit has been identified and EPSS places this at the 9th percentile, though the high-C/I/A CVSS score reflects genuine kernel memory-safety consequences.
Out-of-bounds read in the Linux kernel Bluetooth subsystem's eir_get_service_data() leaks kernel heap memory into userspace for ISO broadcast sink configurations. When an ISO broadcast sink processes periodic advertising (PA) reports from a remote Bluetooth broadcaster, a PA payload packed with multiple mismatching Service Data fields causes eir_len to undercount by 2 bytes per field iteration - the subtraction uses only the data length (dlen), omitting the 2-byte length+type header - so the pointer eventually reads past hcon->le_per_adv_data[] into the surrounding struct hci_conn; a drifted field matching the BAA UUID causes those bytes to be copied into iso_pi(sk)->base, recoverable by a local or remote-assisted userspace process via getsockopt(BT_ISO_BASE). No public exploit or CISA KEV listing exists; EPSS of 0.17% (6th percentile) reflects low opportunistic risk, though the Bluetooth adjacent-network constraint caps mass exploitation potential.
Incorrect REX prefix encoding in the Linux kernel's BPF x86-64 JIT compiler drops the high bit of extended destination registers (R8-R15) during per-CPU address resolution, causing GS-segment offsets to be applied to the wrong register. The affected registers alias as R5→RAX, R7→RBP, R8→RSI, R9→RDI, leaving actual per-CPU pointers unadjusted and clobbering scratch registers or the frame pointer, reliably producing kernel panics and theoretically enabling memory corruption. Vendor-released patches are available in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV listing exists and EPSS is 0.17%.
Out-of-bounds kernel memory write in Linux kernel BPF stack unwinding (`__bpf_get_stack`) exposes CONFIG_PREEMPT systems to local privilege escalation. On fully preemptible kernels, a non-sleepable BPF raw tracepoint program runs under `migrate_disable()` but not `preempt_disable()`, creating a scheduler preemption window between per-CPU callchain buffer release and consumer memcpy; a concurrent task can overwrite `trace->nr`, inflating `copy_len` past the caller's buffer boundary. The vulnerability affects Linux 4.18 through stable branches preceding 6.12.109/6.18.50/7.2.4/7.3-rc1; no public exploit exists and EPSS is 0.17%, but the C:H/I:H/A:H impact ratings reflect kernel memory corruption potential.
Local privilege escalation in the Linux kernel BPF bloom filter implementation (bloom_map_alloc) affects 32-bit x86 kernels via two compounding integer arithmetic bugs: a BITS_TO_BYTES(U32_MAX) wrap at allocation time causes under-allocation of the bitset, and a u32-to-signed-long sign-extension in set_bit/test_bit causes negative bit offsets, enabling out-of-bounds kernel heap reads and writes. Exploitation requires a process holding CAP_BPF on a 32-bit x86 kernel; 64-bit kernels are entirely unaffected. No public exploit identified at time of analysis; EPSS at 0.20% reflects the narrow attack surface imposed by the 32-bit-only constraint.
Out-of-bounds kernel memory read in the Linux device-mapper dm-array subsystem allows a local attacker to trigger an OOB read from a dm-bufio buffer by presenting crafted dm-cache metadata with an oversized on-disk nr_entries field, exploitable during dm-cache activation. The flaw exists because array_block_check() validated only block number and checksum while omitting structural field bounds - unlike the sibling node_check() function - leaving dm_array_cursor_next() to bound its iteration directly from the unvalidated on-disk header and element_at() to perform unguarded pointer arithmetic past the buffer end. Vendor-released patches are available for stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit code exists and EPSS is 0.20% at the 10th percentile.
Out-of-bounds kernel memory access in the Linux kernel device-mapper (dm array) library allows a local attacker with crafted dm-cache metadata to trigger an 8-byte stride over 4-byte entries, computing element offsets up to 8160 bytes within a 4096-byte block. The root cause is that array_block_check() validates a block's internal self-consistency but never compares the stored value_size against the calling context's expected value_size; dm-cache's two persistent arrays (mappings at 8 bytes, hints at 4 bytes) share the same on-disk format, so a superblock pointing the mappings root at a hint block silently passes validation. Vendor-released patches are available; no public exploit exists and EPSS stands at 0.17%.
Out-of-bounds heap read in the Linux kernel CXL fwctl driver allows a local low-privileged user to leak kernel memory to a CXL device mailbox and crash the kernel. The root cause is cxlctl_fw_rpc() ignoring the in_len bound established by fwctl_cmd_rpc(), letting a user-controlled op_size value drive memcpy reads beyond the kvzalloc(in_len) allocation. With a sufficiently large op_size the read walks into unmapped memory, causing a kernel oops. No public exploit code has been identified and EPSS stands at 0.17%, indicating limited active exploitation interest.
NULL pointer dereference and use-after-free conditions in the Linux kernel's CXL (Compute Express Link) MCE notifier path allow a local attacker with low privileges to corrupt kernel memory or achieve privilege escalation on systems with CXL memory hardware and extended linear cache enabled. The notifier was incorrectly anchored to the memory device lifetime (`cxl_memdev_state`) rather than to the region lifetime (`cxl_region`), meaning the MCE interrupt handler could fire against freed or nulled objects during device or region teardown. No public exploit has been identified and EPSS sits at 0.17%, consistent with the niche hardware dependency. Vendor-released patches are available in Linux 6.18.51, 7.2.4, and 7.3-rc1.
Use-after-free in the Linux kernel Bluetooth RFCOMM subsystem allows an adjacent Bluetooth peer to trigger kernel memory corruption via a race condition in rfcomm_security_cfm(). The function looks up a session and iterates its DLC list without holding rfcomm_mutex, so a concurrent krfcommd teardown (which does hold the mutex) can free the session and its DLCs while hci_rx_work is still traversing them. KASAN confirmed slab-use-after-free at rfcomm_security_cfm+0x41c. No public exploit or CISA KEV entry exists at time of analysis, and EPSS is 0.20%.
Use-after-free in the Linux kernel's IPv4 and IPv6 multicast forwarding paths allows a local attacker to corrupt kernel memory by racing socket destruction against multicast skb forwarding. The flaw arises because `bpf_sk_assign()` and UDP early demux can associate a socket pointer (`skb->sk`) with a socket buffer without holding a counted reference; when `ip_mr_input()` or `ip6_mr_input()` forwards the original skb outside the RCU read section, a concurrently destroyed socket leaves `skb->sk` stale, and the eventual `sock_pfree()` call dereferences freed memory. No public exploit has been identified, and the EPSS score of 0.17% (7th percentile) confirms negligible observed exploitation activity at time of analysis.
Double-free vulnerability in the Linux kernel's IPv6 tunnel driver (ip6_tunnel) allows a local attacker with low privileges to corrupt kernel memory, potentially leading to privilege escalation or system crash. The flaw exists in ip6_tnl_xmit(), where skb_realloc_headroom() internally consumes the original socket buffer but error-handling paths in ip6_tnl_start_xmit() and IPv6 GRE callers subsequently attempt to free it again. No public exploit or active exploitation (CISA KEV) has been identified; EPSS stands at 0.18%.
Incorrect hardware header length computation in the Linux kernel's ip6_gre driver creates a memory layout miscalculation in NBMA IPv6 GRE tunnel configurations, exploitable locally by a low-privileged user to corrupt kernel memory and potentially achieve privilege escalation. The function ip6gre_tnl_link_config_route() incorrectly accumulates the lower device's hardware header length into dev->hard_header_len when header_ops is set, affecting both NBMA ip6gre tunnels and ip6gretap/ip6erspan devices across a wide range of kernel versions from 4.19 onward. No public exploit code or active CISA KEV exploitation has been identified; EPSS probability is 0.17% (6th percentile), reflecting low current exploitation interest.
NULL pointer dereference in the Linux kernel's IPv6 RPL source routing header handler (`ipv6_rpl_srh_rcv()`) enables a remote unauthenticated attacker to crash the kernel by delivering IPv6 RPL-header packets during a concurrent MTU-drop event on the receiving interface. The race exists because `idev` obtained from `__in6_dev_get()` is used without a NULL guard - `addrconf_ifdown()` can clear `dev->ip6_ptr` via `RCU_INIT_POINTER()` between the time `ip6_rcv_core()` validates idev and the time `ipv6_rpl_srh_rcv()` dereferences `idev->cnf.rpl_seg_enabled`. No public exploit or CISA KEV listing exists; EPSS is 0.17% (6th percentile), consistent with low current weaponization.
Landlock LSM in Linux kernel 5.13+ fails to enforce filesystem creation restrictions for whiteout objects across two distinct syscall paths, enabling a sandboxed process to escape its Landlock domain constraints. The renameat2(2) syscall with RENAME_WHITEOUT performs no Landlock MAKE_* access control check whatsoever, allowing any Landlock-restricted process to create whiteout directory entries even when all filesystem creation rights are denied; separately, mknod(2)-based whiteout creation was gated on the incorrect permission class (MAKE_CHAR instead of MAKE_REG). No public exploit exists, EPSS is 0.17%, and the vulnerability is not in CISA KEV, but the renameat2 bypass is a genuine Landlock sandbox escape present in kernels from 5.13 through 7.2.3/6.18.49.
Integer overflow in the Linux kernel's libnvdimm label-validation path allows a local low-privileged attacker with access to NVDIMM configuration commands (or crafted DIMM media) to trigger an out-of-bounds write in nd_label_data_init(). The on-media u32 field nslot, multiplied by sizeof_namespace_label() in 32-bit arithmetic introduced as a regression in Linux 4.13 (commit 564e871aa66f), wraps modulo 2^32 before the bounds check, causing a downstream memset() to overrun the config buffer. No public exploit code has been identified, and EPSS sits at 0.20% (10th percentile), reflecting realistic limited exposure given the niche hardware requirement.
Silent data corruption in the Linux kernel md/raid10 driver occurs when a device is recovered while another mirror in the same pair is still missing. A bool-conversion regression (commit fe6a19d40ceb) inverted the still_degraded flag in raid10_sync_request(), so md_bitmap_start_sync() is called with degraded=false and prematurely clears bitmap bits belonging to the still-absent device; that device is later marked In_sync while holding stale data. This is a data-integrity/reliability defect, not a remotely triggerable attack - no public exploit is identified at time of analysis and EPSS is low (0.20%).
Integer overflow in the Linux kernel's MD (software RAID) subsystem allows a local attacker who can supply or mount a crafted block device superblock to trigger an unchecked bit-shift overflow in super_1_load(), corrupting kernel memory and potentially escalating privileges. The flaw stems from sb->bblog_shift - an 8-bit on-disk value ranging 0-255 - being applied as a left-shift to a 64-bit sector variable without any upper-bound validation, allowing sector and count variables to wrap around and corrupt downstream badblocks API state. No public exploit code has been identified and EPSS sits at 0.20% (10th percentile), placing this in the low-probability-of-exploitation tier despite a CVSS score of 7.8.
Use-after-free in the Linux kernel MPLS forwarding path allows a crafted packet to trigger a slab read of freed memory during multipath nexthop selection. mpls_select_multipath()/mpls_multipath_hash() cache a header pointer, then call pskb_may_pull(), which can invoke pskb_expand_head() and free the old skb head - leaving the cached pointer dangling and read afterward. Confirmed by a KASAN slab-use-after-free report reproduced in 2 of 2 unpatched runs via a legal Geneve packet over a bareudp/MPLS multipath setup; no public weaponized exploit and no KEV listing, with EPSS at 0.20% (10th percentile).
Uninitialized memory use in the Linux kernel MPTCP subsystem allows a remote off-path peer to corrupt MPTCP subflow path manager bookkeeping by influencing a stale slab byte. Since Linux 5.9, mptcp_token_join_cookie_init_state() restores six fields from the SYN cookie entry during MP_JOIN 4th-ACK processing but omits local_id; subflow_ulp_clone() then reads whatever byte the SLAB_TYPESAFE_BY_RCU allocator left behind - a value an off-path attacker can steer by racing concurrent MP_JOIN SYNs against the slab recycler. The result is an incorrect address-ID on the joined subflow, corrupting path manager bookkeeping and potentially causing subflow teardown or misdirection. No public exploit is identified at time of analysis; EPSS is 0.21% (11th percentile).
Use-after-free in the Linux kernel's nouveau open-source NVIDIA GPU driver allows a local unprivileged user to corrupt kernel memory via a race between the GEM buffer object info ioctl and a concurrent GEM close operation. In the non-uvmm code path, the VMA (virtual memory area mapping) associated with a buffer object can be freed by the close path between the info ioctl's lookup and its subsequent dereference, creating a classic use-after-free condition with potential for kernel-level code execution or privilege escalation. No public exploit is identified at time of analysis; vendor-released patches are available across all active stable branches.
Memory-safety corruption in the Linux kernel SUNRPC layer allows a malicious NFS peer to trigger an unsigned integer underflow of the XDR stream length. When gss_krb5_unwrap_v2() decrypts a Kerberos-privacy (krb5p) message, it sets buf->len to a small wire-derived value while the underlying iovec lengths are at page scale; xdr_buf_trim() then subtracts more consumed bytes than buf->len records, wrapping the unsigned length to near UINT_MAX. That corrupted length becomes the authoritative bound for every downstream XDR decoder, enabling out-of-bounds reads and denial of service. A vendor patch is available; this is one of a cluster of related SUNRPC krb5 fixes. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Denial of service (and minor out-of-bounds read) in the Linux kernel's server-side SUNRPC GSS/krb5 code allows a client holding a valid Kerberos GSS context to crash an NFS server exporting with sec=krb5p. svcauth_gss_unwrap_priv() validated only an upper bound on the wire-supplied opaque token length, so a truncated sealed token (len 0-16) reached gss_krb5_unwrap_v2(), which read RFC 4121 header fields past the buffer and hit a divide-by-zero in _rotate_left() (shift %= buf->len with buf->len driven to zero). No public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile).
NFS server availability in the Linux kernel SUNRPC subsystem can be disrupted when svc_pool_for_cpu() routes incoming transports to CPU-affine service pools that contain no active threads. Affected deployments running nfsd in pernode or percpu pool mode with fewer configured threads than NUMA nodes (or CPUs) will silently enqueue inbound NFS transports on threadless pools, where they are never picked up - causing NFS connections to hang indefinitely. Patches are available in stable kernel series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit exists and EPSS is 0.21% (11th percentile).
Use-after-free in the Linux kernel SUNRPC cache management subsystem allows a local low-privileged user to potentially achieve kernel code execution or crash the system. The bug exists in `sunrpc_destroy_cache_detail()`, which skips `cancel_delayed_work_sync()` when `cache_list` is non-empty - a condition that is permanently true during per-netns teardown - leaving `cache_clean()` with a dangling pointer to the already-freed `cache_detail` structure. No public exploit has been identified and EPSS probability sits at 0.17%, indicating no current active exploitation.
Silent kernel memory corruption in the Linux kernel SUNRPC subsystem arises when percpu counter allocation fails undetected during RPC service creation. When `percpu_counter_init()` fails inside `__svc_create()`, the function returns a half-initialized `svc_serv` structure to nfsd, lockd, or the NFS callback service without error; subsequent hot-path increments in `svc_xprt_enqueue()`, `svc_handle_xprt()`, and `svc_pool_wake_idle_thread()` dereference the NULL per-cpu pointer, which resolves to offset zero of the running CPU's per-cpu area and silently overwrites arbitrary kernel memory. Triggering the flaw requires local administrator access plus memory pressure at RPC service startup; the description explicitly excludes remote induction. No public exploit or CISA KEV listing exists, and EPSS sits at 0.22% (13th percentile).
A use-after-free and reference/memory leak race in the Linux kernel SUNRPC backchannel allows a NFS callback backchannel request to be enqueued onto a svc_serv (sv_cb_list) that is being destroyed, or to leak an xprt reference, when a backchannel receive completes concurrently with callback-service teardown. The flaw affects Linux kernels using the SUNRPC/NFS callback backchannel and is resolved by closing the producer side (clearing xprt->bc_serv under bc_pa_lock via a new xprt_svc_shutdown_bc()) before callback threads are stopped and draining leftover sv_cb_list entries before svc_destroy(). No public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with a hard-to-win teardown race rather than a broadly weaponizable bug.
Use-after-free in the Linux kernel's SUNRPC server thread cleanup allows local attackers to trigger kernel heap reads of freed memory when RCU readers race with svc_exit_thread(). The root cause is an asymmetry in svc_rqst_free(): the rqstp struct is correctly deferred via kfree_rcu(), but rq_argp and rq_resp are freed synchronously before the RCU grace period expires - leaving a window where readers like nfsd_nl_rpc_status_get_dumpit() can dereference the freed pointers. No public exploit or KEV listing exists; EPSS is low at 0.20% (10th percentile), but the kernel UAF primitive carries realistic privilege-escalation potential in environments running NFS servers.
Four coupled error-path defects in the Linux kernel's SUNRPC RPCSEC_GSS option-array XDR decoder (`gssx_dec_option_array`) enable kernel NULL-pointer dereference, a `group_info` refcount leak, and a latent use-after-free during GSS security-context acceptance. Systems acting as NFS servers or clients with Kerberos authentication (sec=krb5/krb5i/krb5p) are in the affected code path; triggering the NULL deref via a failed allocation or malformed GSS response causes a kernel crash (denial-of-service). No public exploit code exists and EPSS sits at the 10th percentile, indicating low current exploitation probability.
Denial of service (and short out-of-bounds read) in the Linux kernel's SUNRPC RPCSEC_GSS Kerberos privacy layer affects gss_krb5_unwrap_v2(), which parses the EC/RRC fields at ptr+4/ptr+6 before confirming the token is at least the 16-byte GSS_KRB5_TOK_HDR_LEN. A malicious NFS-with-krb5p peer supplying a sub-16-byte or malformed wrap token triggers an OOB header read, an unsigned wrap in rotate_left()/xdr_buf_subsegment(), a divide-by-zero in the modulo shift, and a dead BUG_ON that fails to stop a movelen underflow driving a ~UINT_MAX-byte memmove(). There is no public exploit identified at time of analysis; EPSS is 0.17% (6th percentile). The upstream fix adds four defense-in-depth length guards.
Out-of-bounds reads in the Linux kernel SUNRPC RPCSEC_GSS privacy (krb5p) receive path allow a malicious or compromised NFS server to crash or leak memory from a connecting client. The function gss_unwrap_resp_priv() validated the opaque token length with a single u32 addition (offset + opaque_len) and no lower bound, so a crafted reply with opaque_len near 0xffffffff wraps the sum below rcv_buf->len and passes the check, while any length below GSS_KRB5_TOK_HDR_LEN is forwarded to gss_krb5_unwrap_v2(), whose pre-decrypt header reads at ptr+4/ptr+6 then run past the token. There is no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a config-gated, DoS-leaning memory-safety bug rather than a broadly weaponizable RCE.
Linux kernel SUNRPC subsystem exposes a race condition between proc entry publication and mutex initialization in the GSS proxy path, allowing a local attacker with write access to /proc/net/rpc/use-gss-proxy to exploit an uninitialized mutex during the narrow window when auth_rpcgss loads. On a production kernel without debug options, two concurrent writers racing through set_gssp_clnt() can shut down an RPC client structure while it is still in active use, resulting in a resource leak and potential use-after-free with full kernel memory integrity and availability impact. Vendor-released patches are available across stable branches; no public exploit or KEV listing exists at time of analysis.
Denial-of-service / buffer-state corruption in the Linux kernel SUNRPC GSS-API layer allows a peer holding a valid Kerberos v2 (RPCSEC_GSS krb5) security context to submit a structurally malformed wrap token whose 16-bit 'extra count' (ec) field exceeds the plaintext length, leaving the xdr_buf in a semantically inconsistent state (zero length, mismatched iov lengths). The flaw affects kernels using krb5 RPC security (e.g. NFS with sec=krb5p) and is fixed in 6.12.109, 6.18.50, 7.2.4 and 7.3-rc1. No public exploit identified at time of analysis; EPSS is low at 0.20% (10th percentile).
Out-of-bounds slab read in the Linux kernel SUNRPC Kerberos GSS layer allows a malicious NFS peer to make gss_krb5_verify_mic_v2() read past an undersized buffer when verifying an RFC 4121 MIC token. The function dereferences the token header, flags, and padding and builds a scatterlist over the checksum without ever checking that the wire-supplied token is at least GSS_KRB5_TOK_HDR_LEN (16) plus the enctype checksum length; all callers only enforce loose upper bounds, so a short checksum opaque produces a small allocation the verifier reads beyond. Exploitation is limited to deployments using RPCSEC_GSS Kerberos (NFS sec=krb5); there is no public exploit identified at time of analysis and EPSS is low (0.19%).
A use-after-free race condition in the Linux kernel's SUNRPC client-side TLS handshake path (introduced in 6.5) allows the lower RPC transport to be freed while the xs_tls_handshake_done() completion callback is still running. When a synchronous handshake waiter times out or is signaled and tls_handshake_cancel() loses the race to handshake completion, the waiter drops the callback-owned reference, freeing the transport before the callback stores xprt_err or releases its own reference. Exploitation requires RPC-over-TLS client configuration (e.g. NFS mounted with xprtsec=tls/mtls) and winning a narrow timing race; no public exploit identified at time of analysis and EPSS is low at 0.20%.
Use-after-free in the Linux kernel's svcrdma (NFS-over-RDMA server transport) arises from incorrect teardown ordering in svc_rdma_free(): rdma_destroy_id() frees sc_cm_id while the transport's sc_rn notification entry remains registered in the device's rd_xa xarray, leaving a dangling reference that a concurrent ib_unregister_device walk can dereference via svc_rdma_xprt_done(). Exploitation requires an NFS-over-RDMA server configuration with RDMA hardware and a race between transport teardown and device unregistration. No public exploit or CISA KEV listing exists; EPSS is 0.20%, consistent with a niche, timing-dependent kernel race.
Use-after-free in the Linux kernel NFS-over-RDMA server (svcrdma) allows an adjacent-network attacker to trigger kernel memory corruption when an RDMA_CM_EVENT_ADDR_CHANGE event coincides with a replacement listener cm_id allocation failure, leaving sc_cm_id pointing to a destroyed object. Subsequent kernel operations that dereference sc_cm_id - most immediately rdma_disconnect() in svc_rdma_detach() - read or write freed kernel memory, with potential impacts on confidentiality, integrity, and availability. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.15% (5th percentile), consistent with the niche NFS-over-RDMA server attack surface.
Denial-of-service (and potential memory corruption) in the Linux kernel's NFS-over-RDMA server (svcrdma) arises from offset arithmetic defects in svc_rdma_read_chunk_range(). A malicious or malformed RDMA client can craft Read-chunk segment lists whose offset/length values trigger a u32 underflow, producing a near-UINT_MAX per-segment length that propagates an enormous nr_bvec into svc_rdma_build_read_segment() and a multi-MiB kmalloc_array_node() allocation, while also silently dropping bytes from rebuilt chunks. Affected kernels are those with NFS-over-RDMA serving enabled from v5.11 onward; there is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Remote out-of-bounds read and general protection fault in the Linux kernel's svcrdma (RPC-over-RDMA server) code allows a connected RDMA client to crash the kernel by advertising a Write or Reply chunk with zero segments. The pcl_for_each_segment iteration macro computed an inclusive upper bound of &ch_segments[ch_segcount - 1]; with a u32 ch_segcount of 0 this underflows to 0xFFFFFFFF, walking far past the flex array until it faults when svc_rdma_get_inv_rkey() dereferences segment->rs_handle. Fixed upstream; EPSS is low (0.17%, 6th percentile) and no public exploit is identified at time of analysis.
Out-of-bounds heap write in the Linux kernel's server-side RPC-over-RDMA transport (svcrdma), used by the in-kernel NFS server, allows a malicious RPC-over-RDMA client to corrupt slab memory. When a client requests a reply (such as an NFS READ payload) without supplying a Write list or Reply chunk, and that reply needs more scatter/gather entries than the RDMA device's Send Queue supports, svc_rdma_pull_up_reply_msg() linearizes the entire reply into the fixed sc_max_req_size buffer; because the reply size is bounded only by the client request, the copy runs past the buffer and the oversized length is also posted to the device. There is no public exploit identified at time of analysis, and EPSS is low (0.17%).
NULL pointer dereference in the Linux kernel svcrdma subsystem (NFS over RDMA) allows unauthenticated remote clients to crash the kernel by sending a crafted RDMA Read list whose cumulative segment lengths overflow the rq_pages page array. The vulnerability bypasses per-segment length validation by exploiting an edge case where a single segment fills the page array exactly, causing the loop guard to exit prematurely; a subsequent segment then dereferences the NULL sentinel slot at rq_pages[rq_maxpages] during DMA mapping, triggering a kernel panic. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS is low at 0.21%, but the network-exposed crash vector warrants patching on any host running NFS-over-RDMA.
Out-of-bounds slab memory disclosure in the Linux kernel's svcrdma (NFS-over-RDMA server) transport allows a connected RDMA client to leak adjacent kernel heap contents. The RPC/RDMA Read chunk position field is taken verbatim from the remote client and only alignment-checked, never bounded against the received inline body length, so a malicious client can drive kvec/gap-length integer underflows that expose adjacent slab memory to the XDR decoder or copy past the receive buffer into reply pages returned to the client. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile), and a vendor patch is available in the stable trees.
Integer underflow in the ath6kl WiFi driver's ath6kl_cfg80211_connect_event() allows an adjacent-network attacker controlling a rogue access point to trigger disclosure of kernel slab memory to userspace via nl80211. When a crafted association response shorter than 6 bytes (or request shorter than 4 bytes) is received from firmware, the u8 length fields wrap around to approximately 250, causing cfg80211_connect_result() or cfg80211_roamed() to copy ~250 bytes of adjacent slab data through netlink to any listening userspace process. Patches are available across all active stable branches; no public exploit exists at time of analysis.
Use-after-free race condition in the Linux kernel's mt76/mt7925 MediaTek Wi-Fi 7 driver allows a local attacker with low privileges to corrupt kernel memory or trigger execution of stale MCU commands. The driver's mlo_pm_work delayed work item lacks cancellation in teardown and suspend paths (reset recovery, PCIe unbind, PCIe/mac80211/USB suspend), creating a window where the work executes after vif/bss structures are freed or firmware becomes unavailable. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17% (7th percentile), consistent with a race-condition kernel driver flaw of limited public interest.
Use-after-free in the Linux kernel's staging Intel IPU7 media driver allows a local attacker to corrupt kernel memory and potentially escalate privileges. The `isys_probe()` error path registers the V4L2 async notifier but fails to unregister it on subsequent probe failures, leaving a dangling pointer in the global `notifier_list` after `devres` frees the enclosing `struct ipu7_isys`. Any subsequent walk of that list - an event driven by normal kernel media subsystem activity - reads freed memory, creating exploitable heap corruption. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS is 0.17% at the 7th percentile.
Race condition in Linux kernel's core scheduler pick_next_task() path allows a local low-privileged attacker to exploit a TOCTOU window when pick_task() releases the rq (run queue) lock mid-selection, potentially leaking information across SMT sibling threads, corrupting forceidle accounting, and destabilizing the scheduler. The vulnerability breaks the cookie-based SMT isolation guarantee of Core Scheduling: an uncookied task can be committed as the sibling of a cookied task during the lock-release window, violating the trust boundary the feature is designed to enforce. No public exploit exists (EPSS 0.19%), and fixes are available in Linux 7.2.4, 7.3-rc1, and 6.19.
Lock confusion in the Linux kernel's core scheduling subsystem (sched/core) exposes systems with SMT/hyperthreading and CONFIG_SCHED_CORE enabled to a local privilege escalation path from a low-privileged user. During pick_next_task() under the shared core-wide lock, a ->pick_task() implementation that momentarily drops the per-rq lock creates a window where __sched_core_flip(false) can complete and rebind rq_lockp(), causing the scheduler to operate on sibling run-queue state without holding the correct locks - __schedule() then releases a lock it never acquired while leaking the one it holds. No public exploit code exists and EPSS is 0.20%, but vendor-released patches are confirmed in Linux 6.18.51, 7.2.4, and 7.3-rc1.
Integer overflow in RISC-V KVM's SBI PMU EVENT_GET_INFO handler allows a guest VM to trigger out-of-bounds heap reads and writes on the host kernel, with scope-changed impact (C:H/I:H/A:H). A malicious or compromised guest on a RISC-V host running KVM can supply a crafted num_events value (e.g., 0x10000001 on RV64) that overflows a 32-bit multiplication, causing under-allocation of the event-info array while the subsequent loop iterates over the original large count - resulting in slab-out-of-bounds memory corruption confirmed by KASAN traces. No public exploit code exists and EPSS is 0.15%, but the scope change to the host kernel makes this a VM-escape class finding for RISC-V KVM deployments.
Kernel panic via NULL pointer dereference in the Linux kernel qede Ethernet driver (used by QLogic/Marvell FastLinQ NICs) can be triggered under memory pressure conditions during TPA (Transparent Packet Aggregation) fragment processing. A regression introduced by commit 8a8633978b84 omitted the assignment of tpa_info->buffer.data in qede_tpa_start(), causing a 'ghost' buffer descriptor with a NULL data pointer to be reinserted into the active Rx ring upon SKB allocation failure. When hardware subsequently uses the poisoned ring slot, qede_fill_frag_skb() dereferences the NULL pointer, panicking the kernel. No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile).
Use-after-free in the Linux kernel's RDMA/cxgb4 driver (Chelsio T4/T5/T6 RDMA support) allows a local low-privileged attacker to trigger kernel heap memory corruption by racing device removal against deferred RDMA device registration work. The driver's `c4iw_remove()` teardown path frees `ctx->dev` while a `reg_work` work item queued by `c4iw_uld_state_change()` may still be executing, leaving `c4iw_register_device()` operating on freed memory. No public exploit or active exploitation has been identified; vendor-released patches are available in stable kernel series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Privilege escalation in the Linux kernel CIFS/SMB client allows a local user with write access to a setuid or setgid binary on a CIFS mount to retain those elevated-execution bits on the server after a write operation that should have stripped them. The flaw exists in cifs_setattr_unix() and cifs_setattr_nounix(), which unconditionally dropped the ATTR_MODE flag when ATTR_KILL_SUID/ATTR_KILL_SGID was present, preventing the cleared mode from being propagated to the server when using cifsacl, modefromsid, SMB3.1.1 POSIX extensions, or SMB1 Unix extensions. An attacker who can write to a setuid binary on such a mount can subsequently execute it with unintended elevated privileges. No public exploit has been identified and EPSS is 0.21%, but vendor-confirmed patches are available in kernels 7.2.4, 6.18.51, and 7.3-rc1.
A use-after-free and memory leak in the Linux kernel's CIFS/SMB client (cifs_check_trans2 in the SMB1 TRANSACT2 reassembly path) can be triggered when a malicious or man-in-the-middle SMB server sends a malformed secondary TRANSACT2 response after a valid primary one. Because handle_mid() overwrites mid->resp_buf and skips clearing the server's smallbuf/bigbuf pointers when multiRsp is set, the demux thread later reuses a freed buffer, corrupting kernel memory. Despite a 9.8 CVSS rating, EPSS is only 0.20% and no public exploit is identified; the flaw is DoS/memory-corruption-leaning and requires the client to mount a share from an attacker-controlled server plus a demux-thread timing race.
Use-after-free in the Linux kernel's SMB/CIFS client DFS referral cache lets a dangling target-hint pointer be dereferenced after the backing structures are freed. In free_tgts(), all cache_dfs_tgt entries on ce->tlist are freed but ce->tgthint is left pointing at one of them, so a subsequent lookup of the preferred DFS target reads freed slab memory (CWE-416). The fix simply sets ce->tgthint to NULL after freeing the list. No public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), and it is not in CISA KEV.
A use-after-free in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated SMB client to trigger a slab-use-after-free write and likely kernel crash by abusing durable file-handle reconnection. When two sessions hold durable-v2 handles on the same file under different AppInstanceIds, ksmbd_reopen_durable_fd() rebinds every detached oplock on that inode to the reconnecting session instead of only the file's own, so one session adopts another's oplock without a session reference; after the adopted session is destroyed, ksmbd_close_fd_app_instance_id() dereferences the freed session. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), and the fix is present in kernels 7.2.4 and 7.3-rc1.
Denial of service and stale-memory disclosure in the Linux kernel SMB/CIFS client (cifs.ko) arise from an integer-overflow in symlink_data()'s error-context parsing loop. A previous fix (commit 7d9a7f1f96cd) checked the post-ALIGN() length against the remaining buffer, but ALIGN() itself overflows: an ErrorDataLength near UINT32_MAX (e.g. 0xFFFFFFF9) makes ALIGN(x,8) wrap to 0, so the bounds check passes and the loop advances by zero bytes, spinning indefinitely while 'p' points into stale data. A malicious or MITM SMB server can trigger this against a connecting client; no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile).
Out-of-bounds heap read and write in the Linux kernel's CIFS/SMB client (coalesce_t2() in fs/smb/client) allows a malicious or MITM SMB server to corrupt kernel memory or leak data by supplying a crafted Transaction2 DataOffset field. The function computes source and target data pointers directly from the server-controlled DataOffset with no bounds validation before a memcpy, so a small value overwrites header fields while a large value pushes the pointer past the buffer end. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; the fix adds lower- and upper-bound checks for both pointers.
Out-of-bounds read in the Linux kernel SMB client's reparse_buf_ptr() function allows a malicious or MITM-positioned SMB server to trigger a kernel-level OOB memory read by returning a crafted IOCTL response with OutputCount below 6 bytes. The function reads ReparseDataLength at byte offset 4-5 of struct reparse_data_buffer before verifying that count covers the full 8-byte fixed header, exposing unvalidated memory and potentially crashing the client kernel. No public exploit code exists and EPSS is 0.15%, consistent with the network-positioning requirement and absence of weaponized tooling.
Kernel-memory disclosure in the Linux kernel's SMB/CIFS client (cifs.ko) lets a malicious or compromised SMB server leak up to ~65535 bytes of adjacent slab memory to userspace. CIFSTCon() computes its string-parsing bound from the server-supplied ByteCount minus two; a ByteCount of 0 or 1 underflows to a negative int that converts to a huge size_t and wraps the __u16 bytes_left, so cifs_strndup_from_utf16() reads far past the ~16 KB cifs_req_poolp slab object, and the leaked bytes surface via tcon->nativeFileSystem in /proc/fs/cifs/DebugData. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Out-of-bounds read in the Linux kernel's SMB/CIFS client allows a malicious or compromised SMB server to trigger memory over-reads while the client processes oplock-break responses. A refactor (commit 83bfbd0bb902 removing the RFC1002 header from smb_hdr) mechanically rewrote a DataOffset bounds check in is_valid_oplock_break() into an expression that is identically zero, silently disabling the guard that commit 097f5863b1a0 originally added - so an attacker-supplied 32-bit DataOffset again escapes validation. No public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile).
Incomplete error-path cleanup in the Linux kernel HID custom sensor driver (`hid-sensor-custom`) creates a use-after-free condition: when `hid_sensor_custom_add_attributes()` fails partway through sysfs group creation, previously created groups are not removed and `sensor_inst->fields` can be freed while `enable_sensor` sysfs attributes retain stale pointers into that array. Systems running Linux kernel from commit 4a7de051 through versions prior to 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1 are affected wherever the `hid-sensor-custom` module is loaded. No public exploit code exists and no CISA KEV listing is present, but kernel-space use-after-free conditions carry inherent privilege-escalation potential.
Use-after-free in the Linux kernel's universal-pidff HID force-feedback driver allows a local attacker with low privileges to write into freed kernel memory by exploiting a missing cleanup path when force-feedback initialization fails after device start. When hid_pidff_init_with_quirks() returns an error, hid_hw_start() is never reversed, leaving the hidraw character device node alive and pointing to freed memory; with hdev->driver set to NULL, hid_device_remove() also skips hid_hw_stop(). Any subsequent open of the surviving /dev/hidrawX can trigger a UAF write via the transport spinlock callback, potentially escalating local privileges to root. No public exploit has been identified, but the detailed commit description supplies a ready trigger condition.
Write use-after-free in the Linux kernel HID mcp2221 driver allows a local low-privileged user to corrupt kernel memory via a dangling pointer left in the driver's rxbuf field after an I2C/SMBus read transfer ends. The mcp_i2c_smbus_read() function stores the caller-supplied buffer pointer in mcp->rxbuf for the transfer's lifetime but fails to clear it on any return path; a delayed or spurious MCP2221_I2C_GET_DATA USB HID report arriving after the caller frees or reuses the buffer causes mcp2221_raw_event() to memcpy device-controlled data into freed kernel memory. No public exploit has been identified and EPSS is 0.20%, but the kernel write primitive makes this a realistic local privilege escalation path on any system with an MCP2221 USB device attached.
Heap buffer overflow in the Linux kernel's Intel THC HID QuickSPI driver allows a local low-privileged user to corrupt kernel memory via the hidraw interface. The driver's write_cmd_to_txdma() function performs an unbounded memcpy from a caller-supplied HID report into a device-descriptor-derived heap buffer of only a few hundred bytes, while the HID core permits reports up to 16,384 bytes through SET_REPORT/SET_FEATURE ioctls - a size mismatch that lets an attacker overflow the buffer with attacker-controlled length and content, enabling potential local privilege escalation to root. Vendor-released patches are available in Linux 7.2.4, 7.3-rc1, and 6.18.50; no public exploit or active exploitation has been identified at time of analysis.
Buffer overflow in the Linux kernel's Intel Touch Host Controller QuickSPI HID driver allows a local user with hidraw device access to corrupt kernel memory using device-controlled content. The function `quickspi_get_report()` copies the full device-supplied response length into the caller's buffer without checking the caller-provided size bound, so a touch controller returning more bytes than allocated overflows the kernel buffer. No public exploit exists (EPSS 0.17%, no KEV), but the sibling intel-quicki2c driver already carried the correct fix, confirming the root cause is a missing bounds-check port.
Out-of-bounds memory access in the Linux kernel's ntfs3 filesystem driver during log replay allows a local attacker who can mount a crafted NTFS image to corrupt kernel memory, potentially achieving privilege escalation. The root cause is that check_rstbl() validates DIR_PAGE_ENTRY table bookkeeping but never verifies that the trailing page_lcns[] array actually fits within the entry's declared size, so a crafted lcns_follow field drives a memmove and subsequent replay passes past the entry boundary. No public exploit or CISA KEV listing exists; EPSS is 0.18%, consistent with the local mount-gated attack surface shared by sibling ntfs3 CVEs (CVE-2026-89610 through CVE-2026-89614).
Kernel memory disclosure in the Linux ntfs3 driver's ni_read_frame() function exposes uninitialized kernel heap content to userspace via a plain read(2) call on a crafted NTFS compressed file. The LZNT decompressor returns early when it encounters a zero chunk header, writing fewer bytes than frame_size, but the residual gap in the vmapped pages is never zeroed before being marked uptodate and copied to userspace - leaking whatever kernel memory previously occupied those pages. A crafted NTFS image containing a short-decompressing compressed stream is sufficient to recover kernel pointers and defeat KASLR, making this a viable first-stage primitive for a chained kernel privilege-escalation attack. No public exploit has been identified at time of analysis and EPSS stands at 0.17%.
Out-of-bounds array access in the Linux kernel ntfs3 filesystem driver allows an attacker who can cause a crafted NTFS image to be mounted to trigger kernel memory corruption via an overflow of the page_lcns[] array. The copy_lcns and redo-shorten loops index page_lcns[] at j+i where i is bounded by the log record's lcns_follow field rather than the target dirty-page entry's field, and because check_dp_table() validates the entry but not the copy_lcns record, and find_dp() bounds j but not i, a crafted record can overflow the array of an otherwise structurally valid entry. No public exploit has been identified at time of analysis, and EPSS is 0.18%, but siblings CVE-2026-89610 through CVE-2026-89613 affect the same ntfs3 code path in the same kernel fix wave.
Out-of-bounds slab read in the Linux kernel NTFS driver's cluster allocator lets a crafted NTFS image trigger a KASAN-detected memory read when a file on the volume is extended. The free-cluster bitmap array (vol->lcn_empty_bits_per_page) is sized from the volume's nr_clusters at mount, but ntfs_cluster_alloc() bounds its scan by the on-disk $Bitmap size instead; an image whose $Bitmap advertises more clusters than the volume actually has drives the allocator past the array. Reported through the Linux stable tree with an upstream fix; no public exploit identified at time of analysis and EPSS is low (0.16%).
Improper metadata validation in the Linux kernel's NTFS3 filesystem driver allows a crafted NTFS image to pass consistency checks when an attribute declares empty mapping pairs while carrying an inconsistent highest VCN and size. Parsing such an attribute can drive out-of-bounds memory access during runlist decoding, leading to memory corruption or a denial of service when the malicious image is mounted. The fix rejects attributes whose empty mapping pairs contradict their highest VCN/size fields; no public exploit identified at time of analysis and EPSS is low (0.20%).
Out-of-bounds memory access in the Linux kernel ntfs3 filesystem driver occurs because parse_ntfs_boot_sector() decodes the boot sector's unsigned 64-bit MFT and MFTMirr Logical Cluster Numbers (LCNs) into a signed s64. A crafted NTFS image with a high-bit-set LCN wraps to a negative value that slips past the existing upper-bound check and propagates into the MFT zone allocator, driving an out-of-bounds access to lcn_empty_bits_per_page. Exploitation requires mounting an attacker-supplied NTFS volume; there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Out-of-bounds kernel memory write in the Linux kernel ntfs3 driver allows a local attacker to corrupt memory by mounting a crafted NTFS image. ntfs_attr_update_meta() shifts an attribute name forward by eight bytes when converting a non-sparse attribute to sparse (to insert the compressed_size field), but the record validator never confirms name_offset is within bounds, that the name does not overlap the mapping pairs, or that eight free bytes exist after mapping_pairs_offset - so a malicious MFT record can force a write past the attribute boundary. No public exploit identified at time of analysis; EPSS is low at 0.15% (5th percentile) and the issue is fixed in kernel 7.2.4 and 7.3-rc1.
Out-of-bounds memory access in the Linux kernel's NTFS (ntfs3) driver arises because the mapping-pairs runlist decoder confirms that a run's starting LCN falls inside the volume but never checks that the run's end (lcn + length) also stays within nr_clusters. Mounting or parsing a crafted NTFS image can therefore drive the kernel to reference clusters beyond the volume boundary, corrupting memory and potentially escalating privilege. No public exploit has been identified and EPSS is low (0.20%), indicating this is a hardening/DoS-leaning fix rather than an imminent mass-exploitation threat.
Missing lock acquisition in the eCryptfs filesystem layer exposes the global message context list to concurrent modification during daemon teardown. In `ecryptfs_exorcise_daemon()`, queued message contexts are moved back to the free list without holding `ecryptfs_msg_ctx_lists_mux`, while `ecryptfs_msg_ctx_alloc_to_free()` and other list consumers require that lock - creating a race window for use-after-free or memory corruption reachable by a local user. No public exploit exists and EPSS is 0.21%, but C:H/I:H/A:H impact makes this a meaningful local privilege escalation candidate on systems using eCryptfs.
Out-of-bounds read in the Linux kernel's eCryptfs filesystem packet parser allows a local low-privileged attacker to leak kernel memory or trigger a denial of service by opening a crafted encrypted file with a version 1 header. The root cause is that ecryptfs_parse_packet_set() computes remaining buffer space using a fixed PAGE_SIZE - 8 formula instead of the actual packet-set buffer length, overstating available bytes for version 1 headers where the packet set begins later. Patches are available for stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation has been identified.
Two heap out-of-bounds writes in Linux kernel eCryptfs allow a local low-privileged user to corrupt kernel memory structures by supplying a crafted Tag 3 passphrase-encrypted session key packet with an oversized encrypted_key_size field. The vulnerability is exclusively triggered when AES-192 (cipher code 0x08) is used because that cipher sets crypt_stat->key_size=24 independently, permitting crypto_skcipher_setkey() to succeed while encrypted_key_size still exceeds the 64-byte ECRYPTFS_MAX_KEY_BYTES bound - overflowing into ecryptfs_auth_tok and corrupting root_iv, keysig_list, and mutexes in ecryptfs_crypt_stat. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.20% at the 10th percentile.
Integer underflow in the Linux kernel's eCryptfs filename-encryption parser allows a local attacker to trigger heap memory corruption by supplying a crafted tag 70 packet with a body shorter than the fixed metadata fields. The underflow causes ecryptfs_parse_tag_70_packet() to derive a wildly inflated encrypted-filename size, enabling out-of-bounds heap reads or writes with full confidentiality, integrity, and availability impact. No public exploit code exists and the CVSS score of 7.8 (AV:L) aligns with the local-only attack surface; vendor-confirmed patches are available across all supported stable branches.
Resource management failure in the Linux kernel eCryptfs subsystem allows a local authenticated user to trigger a message context leak - and potentially exploit a stale pointer condition - by inducing send failures to the eCryptfs userspace daemon. The ecryptfs_send_message_locked() function moves a context from the free list to the allocated list before calling ecryptfs_send_miscdev(); on failure, it omits the rollback, leaving the context permanently stranded and the caller holding a dangling reference. Vendor-released patches are available across stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit or CISA KEV listing has been identified at time of analysis.
Seccomp filter bypass in the Linux kernel entry path allows a low-privileged local process to execute syscalls blocked by a newly installed seccomp filter. The vulnerability arises because `syscall_trace_enter()` caches the `syscall_work` flags at entry; when a sibling thread installs a seccomp filter via `SECCOMP_FILTER_FLAG_TSYNC` while the first thread is ptrace-stopped, the `SYSCALL_WORK_SECCOMP` flag is set on the stopped thread but the stale cached variable never reflects it. When the ptrace tracer also modifies the syscall number during the stop (e.g., substituting `execve`), the resumed thread bypasses the filter entirely. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.18%.
Heap out-of-bounds write in the Linux kernel erofs compressed filesystem driver corrupts kernel memory when a global buffer pool resize fails mid-way and is retried. During the retry, a temporary pointer array is allocated to the (smaller) intermediate target size, then populated with all existing pointers from a larger-than-expected buffer - writing past the end of the allocation. A separate retry path also triggers spurious -ENOMEM from alloc_pages_bulk() when no new pages are needed. No active exploitation is recorded (not in CISA KEV), and EPSS is 0.20% at the 10th percentile. Vendor-released patches are available in Linux 6.18.51, 7.2.4, and 7.3-rc1.
Silent inode metadata loss in the Linux kernel ext2 filesystem affects all systems using ext2 with IS_SYNC inodes: calls to `sync_inode_metadata()` in `ext2_setsize()` and `ext2_xattr_set2()` were guarded by an IS_SYNC branch that skipped `mark_inode_dirty()`, meaning that if the inode was not already dirty, the sync was a no-op and metadata changes were silently discarded. Affected operations include file truncation and extended attribute writes on synchronous ext2 mounts. No public exploit code exists and EPSS is 0.15%, consistent with a data-integrity correctness fix rather than a security-critical attack surface.
Use-after-free in the Linux kernel fanotify subsystem (introduced in 6.14) copies stale kernel stack memory to userspace and may enable local privilege escalation on unpatched 6.18.x and 7.x kernels. When a signal interrupts the triggering task precisely after the event reader sets FAN_EVENT_REPORTED but before it finishes preparing the file descriptor, fanotify_get_response() unwinds the stack-allocated file_range frame while the reader retains a dangling pointer to range.pos; the subsequent copy_range_info_to_user() dereferences freed stack memory, confirmed by KASAN. No public exploit code exists and EPSS is very low (0.17%), but vendor patches are available in 6.18.50, 7.2.4, and 7.3-rc1.
Uninitialized mutex race condition in the Linux kernel's omapfb DSI command-mode panel driver (panel-dsi-cm) exposes OMAP SoC systems to kernel panic or memory corruption. dsicm_probe() calls omapdss_register_display() to publish the display device before executing mutex_init() on ddata->lock, creating a window where any concurrently-invoked dsicm callback can attempt to acquire an uninitialized mutex with undefined results. No public exploit exists and EPSS sits at 0.17% (6th percentile), accurately reflecting the extreme niche of OMAP hardware in current deployments. Vendor-released patches are available across affected stable branches.
Incomplete error-path cleanup in the Linux kernel uvesafb framebuffer driver leaves a stale v86d connector callback registered when platform driver initialization fails, creating a potential use-after-free condition in kernel memory. All Linux kernel versions from 2.6.24 onward that include the uvesafb driver are affected; the issue was found through static analysis and is patched in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit exists; EPSS is 0.20% (10th percentile), reflecting the narrow and difficult-to-trigger conditions required.
Out-of-bounds read and write in the Linux kernel's forcedeth NVIDIA ethernet driver triggers on every S3 suspend/resume cycle due to an off-by-one loop terminator in nv_suspend() and nv_resume(). The loop runs one iteration past the end of the saved_config_space[] array, overwriting adjacent kernel memory (np->name_rx[]) and issuing a stray MMIO write one dword beyond the ioremap'd hardware window; with CONFIG_UBSAN_TRAP=y the kernel aborts during the suspend path. The bug has existed since Linux 2.6.27 but was only surfaced by UBSAN on Apple Macmini3,1 (MCP79) hardware during S3 cycling. No public exploit has been identified at time of analysis.
Kernel crash exposure in the OMAP SSI/HSI driver stems from a missing DMA mask initialization on the synthetic HSI controller device allocated via hsi_alloc_controller(), which bypasses the normal OF/platform device setup path and leaves the embedded struct device without a valid dma_mask. Following DMA API hardening changes in the kernel, dma_map_sg() and related helpers enforce the presence of a valid mask before proceeding, causing warnings or kernel panics on any OMAP SoC system where the driver attempts DMA mapping. The vulnerability is tightly hardware-gated to Texas Instruments OMAP-based platforms; patches are confirmed available in kernel stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1, and no public exploit or KEV listing exists.
Hugetlb reservation accounting in the Linux kernel underflows when a huge-page folio shared between a parent and child process (after fork) is unmapped by the parent first. Since commit df7a6d1f6405 introduced reservation adjustment logic into `__unmap_hugepage_range()`, the function decrements the reservation counter without verifying that the folio's mapcount has reached zero, leaving the child's mapping unaccounted and the counter in an arbitrarily large (underflowed) state until the child unmaps. Affected kernels from 6.9 through the fix commits expose systems using hugetlb-backed workloads to integrity corruption (overcommit of huge pages) and availability risk (kernel memory management instability). No public exploit or active exploitation is identified at time of analysis.
Out-of-bounds read in Linux kernel ACPI APEI GHES ARM hardware error handler arises from using pointer size instead of structure size when accounting for remaining CPER buffer after skipping the cper_sec_proc_arm header. Affected are stable branches 6.12.x through 6.12.109, 6.18.x through 6.18.50, 7.x through 7.2.4, and pre-7.3-rc1, on ARM systems with ACPI APEI support. No public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), and there is no CISA KEV listing, consistent with a low automated exploitation probability.
Stack buffer overflow in the Linux kernel's ACPI Platform Firmware Runtime Update (pfr_update) driver allows a local low-privileged attacker to corrupt kernel stack memory via oversized ACPI DSM buffer responses. The flaw exists in query_capability() where memcpy uses firmware-supplied buffer.length without bounds checking against fixed-size u8[16] destination fields in the stack-allocated struct pfru_update_cap_info, enabling writes up to 44 bytes past the end of the structure. KASAN confirmed exploitation on 7.2-rc6 producing three distinct stack-out-of-bounds reports; vendor-released patches are available in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit code exists and EPSS probability is low at 0.18%, but successful exploitation could yield arbitrary kernel code execution on affected systems.
TRIM/discard is completely broken on 4Kn (4096-byte native sector) block devices in the Linux kernel's libata-scsi layer, causing every ATA DSM TRIM command to fail with 'Parameter list length error' and trigger WARN_ON() splats on each attempt. The bug is in ata_scsi_write_same_xlat(): ata_format_dsm_trim_descr() caps its output at 2048 bytes (ATA_SCSI_RBUF_SIZE), but the caller compares this return value against the logical sector size - on 4Kn devices (sector_size=4096), this equality check always fails and every TRIM is rejected. No public exploit exists; this is a deterministic functional regression on specific hardware. Vendor-released patches are available in stable kernels 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Use-after-free in the Linux kernel's auxdisplay charlcd driver allows a local, low-privileged attacker to potentially corrupt kernel memory when charlcd_register() fails after bl_work has already been scheduled. The root cause is that charlcd_init() schedules a delayed backlight work item referencing the charlcd object before misc_register() is called; if registration fails, the caller frees the object while the work item's reference remains valid, creating a classic UAF condition. No public exploit exists and EPSS is 0.20% (10th percentile), reflecting the niche hardware footprint and non-default kernel configuration required.
Missing DMA alignment validation in the Linux kernel block layer allows a local unprivileged user to submit misaligned I/O vectors that bypass per-device alignment checks during bio construction from iov_iter, potentially triggering memory corruption, data leakage, or kernel crashes. Bio-based drivers lack alignment-split checks and stacking block drivers may silently mis-handle misalignment detected only after bio submission, making the window for exploitation broader than a single driver path. No public exploit has been identified and EPSS places this at the 9th percentile, though the high-C/I/A CVSS score reflects genuine kernel memory-safety consequences.
Out-of-bounds read in the Linux kernel Bluetooth subsystem's eir_get_service_data() leaks kernel heap memory into userspace for ISO broadcast sink configurations. When an ISO broadcast sink processes periodic advertising (PA) reports from a remote Bluetooth broadcaster, a PA payload packed with multiple mismatching Service Data fields causes eir_len to undercount by 2 bytes per field iteration - the subtraction uses only the data length (dlen), omitting the 2-byte length+type header - so the pointer eventually reads past hcon->le_per_adv_data[] into the surrounding struct hci_conn; a drifted field matching the BAA UUID causes those bytes to be copied into iso_pi(sk)->base, recoverable by a local or remote-assisted userspace process via getsockopt(BT_ISO_BASE). No public exploit or CISA KEV listing exists; EPSS of 0.17% (6th percentile) reflects low opportunistic risk, though the Bluetooth adjacent-network constraint caps mass exploitation potential.
Incorrect REX prefix encoding in the Linux kernel's BPF x86-64 JIT compiler drops the high bit of extended destination registers (R8-R15) during per-CPU address resolution, causing GS-segment offsets to be applied to the wrong register. The affected registers alias as R5→RAX, R7→RBP, R8→RSI, R9→RDI, leaving actual per-CPU pointers unadjusted and clobbering scratch registers or the frame pointer, reliably producing kernel panics and theoretically enabling memory corruption. Vendor-released patches are available in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV listing exists and EPSS is 0.17%.
Out-of-bounds kernel memory write in Linux kernel BPF stack unwinding (`__bpf_get_stack`) exposes CONFIG_PREEMPT systems to local privilege escalation. On fully preemptible kernels, a non-sleepable BPF raw tracepoint program runs under `migrate_disable()` but not `preempt_disable()`, creating a scheduler preemption window between per-CPU callchain buffer release and consumer memcpy; a concurrent task can overwrite `trace->nr`, inflating `copy_len` past the caller's buffer boundary. The vulnerability affects Linux 4.18 through stable branches preceding 6.12.109/6.18.50/7.2.4/7.3-rc1; no public exploit exists and EPSS is 0.17%, but the C:H/I:H/A:H impact ratings reflect kernel memory corruption potential.
Local privilege escalation in the Linux kernel BPF bloom filter implementation (bloom_map_alloc) affects 32-bit x86 kernels via two compounding integer arithmetic bugs: a BITS_TO_BYTES(U32_MAX) wrap at allocation time causes under-allocation of the bitset, and a u32-to-signed-long sign-extension in set_bit/test_bit causes negative bit offsets, enabling out-of-bounds kernel heap reads and writes. Exploitation requires a process holding CAP_BPF on a 32-bit x86 kernel; 64-bit kernels are entirely unaffected. No public exploit identified at time of analysis; EPSS at 0.20% reflects the narrow attack surface imposed by the 32-bit-only constraint.
Out-of-bounds kernel memory read in the Linux device-mapper dm-array subsystem allows a local attacker to trigger an OOB read from a dm-bufio buffer by presenting crafted dm-cache metadata with an oversized on-disk nr_entries field, exploitable during dm-cache activation. The flaw exists because array_block_check() validated only block number and checksum while omitting structural field bounds - unlike the sibling node_check() function - leaving dm_array_cursor_next() to bound its iteration directly from the unvalidated on-disk header and element_at() to perform unguarded pointer arithmetic past the buffer end. Vendor-released patches are available for stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit code exists and EPSS is 0.20% at the 10th percentile.
Out-of-bounds kernel memory access in the Linux kernel device-mapper (dm array) library allows a local attacker with crafted dm-cache metadata to trigger an 8-byte stride over 4-byte entries, computing element offsets up to 8160 bytes within a 4096-byte block. The root cause is that array_block_check() validates a block's internal self-consistency but never compares the stored value_size against the calling context's expected value_size; dm-cache's two persistent arrays (mappings at 8 bytes, hints at 4 bytes) share the same on-disk format, so a superblock pointing the mappings root at a hint block silently passes validation. Vendor-released patches are available; no public exploit exists and EPSS stands at 0.17%.
Out-of-bounds heap read in the Linux kernel CXL fwctl driver allows a local low-privileged user to leak kernel memory to a CXL device mailbox and crash the kernel. The root cause is cxlctl_fw_rpc() ignoring the in_len bound established by fwctl_cmd_rpc(), letting a user-controlled op_size value drive memcpy reads beyond the kvzalloc(in_len) allocation. With a sufficiently large op_size the read walks into unmapped memory, causing a kernel oops. No public exploit code has been identified and EPSS stands at 0.17%, indicating limited active exploitation interest.
NULL pointer dereference and use-after-free conditions in the Linux kernel's CXL (Compute Express Link) MCE notifier path allow a local attacker with low privileges to corrupt kernel memory or achieve privilege escalation on systems with CXL memory hardware and extended linear cache enabled. The notifier was incorrectly anchored to the memory device lifetime (`cxl_memdev_state`) rather than to the region lifetime (`cxl_region`), meaning the MCE interrupt handler could fire against freed or nulled objects during device or region teardown. No public exploit has been identified and EPSS sits at 0.17%, consistent with the niche hardware dependency. Vendor-released patches are available in Linux 6.18.51, 7.2.4, and 7.3-rc1.
Use-after-free in the Linux kernel Bluetooth RFCOMM subsystem allows an adjacent Bluetooth peer to trigger kernel memory corruption via a race condition in rfcomm_security_cfm(). The function looks up a session and iterates its DLC list without holding rfcomm_mutex, so a concurrent krfcommd teardown (which does hold the mutex) can free the session and its DLCs while hci_rx_work is still traversing them. KASAN confirmed slab-use-after-free at rfcomm_security_cfm+0x41c. No public exploit or CISA KEV entry exists at time of analysis, and EPSS is 0.20%.
Use-after-free in the Linux kernel's IPv4 and IPv6 multicast forwarding paths allows a local attacker to corrupt kernel memory by racing socket destruction against multicast skb forwarding. The flaw arises because `bpf_sk_assign()` and UDP early demux can associate a socket pointer (`skb->sk`) with a socket buffer without holding a counted reference; when `ip_mr_input()` or `ip6_mr_input()` forwards the original skb outside the RCU read section, a concurrently destroyed socket leaves `skb->sk` stale, and the eventual `sock_pfree()` call dereferences freed memory. No public exploit has been identified, and the EPSS score of 0.17% (7th percentile) confirms negligible observed exploitation activity at time of analysis.
Double-free vulnerability in the Linux kernel's IPv6 tunnel driver (ip6_tunnel) allows a local attacker with low privileges to corrupt kernel memory, potentially leading to privilege escalation or system crash. The flaw exists in ip6_tnl_xmit(), where skb_realloc_headroom() internally consumes the original socket buffer but error-handling paths in ip6_tnl_start_xmit() and IPv6 GRE callers subsequently attempt to free it again. No public exploit or active exploitation (CISA KEV) has been identified; EPSS stands at 0.18%.
Incorrect hardware header length computation in the Linux kernel's ip6_gre driver creates a memory layout miscalculation in NBMA IPv6 GRE tunnel configurations, exploitable locally by a low-privileged user to corrupt kernel memory and potentially achieve privilege escalation. The function ip6gre_tnl_link_config_route() incorrectly accumulates the lower device's hardware header length into dev->hard_header_len when header_ops is set, affecting both NBMA ip6gre tunnels and ip6gretap/ip6erspan devices across a wide range of kernel versions from 4.19 onward. No public exploit code or active CISA KEV exploitation has been identified; EPSS probability is 0.17% (6th percentile), reflecting low current exploitation interest.
NULL pointer dereference in the Linux kernel's IPv6 RPL source routing header handler (`ipv6_rpl_srh_rcv()`) enables a remote unauthenticated attacker to crash the kernel by delivering IPv6 RPL-header packets during a concurrent MTU-drop event on the receiving interface. The race exists because `idev` obtained from `__in6_dev_get()` is used without a NULL guard - `addrconf_ifdown()` can clear `dev->ip6_ptr` via `RCU_INIT_POINTER()` between the time `ip6_rcv_core()` validates idev and the time `ipv6_rpl_srh_rcv()` dereferences `idev->cnf.rpl_seg_enabled`. No public exploit or CISA KEV listing exists; EPSS is 0.17% (6th percentile), consistent with low current weaponization.
Landlock LSM in Linux kernel 5.13+ fails to enforce filesystem creation restrictions for whiteout objects across two distinct syscall paths, enabling a sandboxed process to escape its Landlock domain constraints. The renameat2(2) syscall with RENAME_WHITEOUT performs no Landlock MAKE_* access control check whatsoever, allowing any Landlock-restricted process to create whiteout directory entries even when all filesystem creation rights are denied; separately, mknod(2)-based whiteout creation was gated on the incorrect permission class (MAKE_CHAR instead of MAKE_REG). No public exploit exists, EPSS is 0.17%, and the vulnerability is not in CISA KEV, but the renameat2 bypass is a genuine Landlock sandbox escape present in kernels from 5.13 through 7.2.3/6.18.49.
Integer overflow in the Linux kernel's libnvdimm label-validation path allows a local low-privileged attacker with access to NVDIMM configuration commands (or crafted DIMM media) to trigger an out-of-bounds write in nd_label_data_init(). The on-media u32 field nslot, multiplied by sizeof_namespace_label() in 32-bit arithmetic introduced as a regression in Linux 4.13 (commit 564e871aa66f), wraps modulo 2^32 before the bounds check, causing a downstream memset() to overrun the config buffer. No public exploit code has been identified, and EPSS sits at 0.20% (10th percentile), reflecting realistic limited exposure given the niche hardware requirement.
Silent data corruption in the Linux kernel md/raid10 driver occurs when a device is recovered while another mirror in the same pair is still missing. A bool-conversion regression (commit fe6a19d40ceb) inverted the still_degraded flag in raid10_sync_request(), so md_bitmap_start_sync() is called with degraded=false and prematurely clears bitmap bits belonging to the still-absent device; that device is later marked In_sync while holding stale data. This is a data-integrity/reliability defect, not a remotely triggerable attack - no public exploit is identified at time of analysis and EPSS is low (0.20%).
Integer overflow in the Linux kernel's MD (software RAID) subsystem allows a local attacker who can supply or mount a crafted block device superblock to trigger an unchecked bit-shift overflow in super_1_load(), corrupting kernel memory and potentially escalating privileges. The flaw stems from sb->bblog_shift - an 8-bit on-disk value ranging 0-255 - being applied as a left-shift to a 64-bit sector variable without any upper-bound validation, allowing sector and count variables to wrap around and corrupt downstream badblocks API state. No public exploit code has been identified and EPSS sits at 0.20% (10th percentile), placing this in the low-probability-of-exploitation tier despite a CVSS score of 7.8.
Use-after-free in the Linux kernel MPLS forwarding path allows a crafted packet to trigger a slab read of freed memory during multipath nexthop selection. mpls_select_multipath()/mpls_multipath_hash() cache a header pointer, then call pskb_may_pull(), which can invoke pskb_expand_head() and free the old skb head - leaving the cached pointer dangling and read afterward. Confirmed by a KASAN slab-use-after-free report reproduced in 2 of 2 unpatched runs via a legal Geneve packet over a bareudp/MPLS multipath setup; no public weaponized exploit and no KEV listing, with EPSS at 0.20% (10th percentile).
Uninitialized memory use in the Linux kernel MPTCP subsystem allows a remote off-path peer to corrupt MPTCP subflow path manager bookkeeping by influencing a stale slab byte. Since Linux 5.9, mptcp_token_join_cookie_init_state() restores six fields from the SYN cookie entry during MP_JOIN 4th-ACK processing but omits local_id; subflow_ulp_clone() then reads whatever byte the SLAB_TYPESAFE_BY_RCU allocator left behind - a value an off-path attacker can steer by racing concurrent MP_JOIN SYNs against the slab recycler. The result is an incorrect address-ID on the joined subflow, corrupting path manager bookkeeping and potentially causing subflow teardown or misdirection. No public exploit is identified at time of analysis; EPSS is 0.21% (11th percentile).
Use-after-free in the Linux kernel's nouveau open-source NVIDIA GPU driver allows a local unprivileged user to corrupt kernel memory via a race between the GEM buffer object info ioctl and a concurrent GEM close operation. In the non-uvmm code path, the VMA (virtual memory area mapping) associated with a buffer object can be freed by the close path between the info ioctl's lookup and its subsequent dereference, creating a classic use-after-free condition with potential for kernel-level code execution or privilege escalation. No public exploit is identified at time of analysis; vendor-released patches are available across all active stable branches.
Memory-safety corruption in the Linux kernel SUNRPC layer allows a malicious NFS peer to trigger an unsigned integer underflow of the XDR stream length. When gss_krb5_unwrap_v2() decrypts a Kerberos-privacy (krb5p) message, it sets buf->len to a small wire-derived value while the underlying iovec lengths are at page scale; xdr_buf_trim() then subtracts more consumed bytes than buf->len records, wrapping the unsigned length to near UINT_MAX. That corrupted length becomes the authoritative bound for every downstream XDR decoder, enabling out-of-bounds reads and denial of service. A vendor patch is available; this is one of a cluster of related SUNRPC krb5 fixes. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Denial of service (and minor out-of-bounds read) in the Linux kernel's server-side SUNRPC GSS/krb5 code allows a client holding a valid Kerberos GSS context to crash an NFS server exporting with sec=krb5p. svcauth_gss_unwrap_priv() validated only an upper bound on the wire-supplied opaque token length, so a truncated sealed token (len 0-16) reached gss_krb5_unwrap_v2(), which read RFC 4121 header fields past the buffer and hit a divide-by-zero in _rotate_left() (shift %= buf->len with buf->len driven to zero). No public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile).
NFS server availability in the Linux kernel SUNRPC subsystem can be disrupted when svc_pool_for_cpu() routes incoming transports to CPU-affine service pools that contain no active threads. Affected deployments running nfsd in pernode or percpu pool mode with fewer configured threads than NUMA nodes (or CPUs) will silently enqueue inbound NFS transports on threadless pools, where they are never picked up - causing NFS connections to hang indefinitely. Patches are available in stable kernel series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit exists and EPSS is 0.21% (11th percentile).
Use-after-free in the Linux kernel SUNRPC cache management subsystem allows a local low-privileged user to potentially achieve kernel code execution or crash the system. The bug exists in `sunrpc_destroy_cache_detail()`, which skips `cancel_delayed_work_sync()` when `cache_list` is non-empty - a condition that is permanently true during per-netns teardown - leaving `cache_clean()` with a dangling pointer to the already-freed `cache_detail` structure. No public exploit has been identified and EPSS probability sits at 0.17%, indicating no current active exploitation.
Silent kernel memory corruption in the Linux kernel SUNRPC subsystem arises when percpu counter allocation fails undetected during RPC service creation. When `percpu_counter_init()` fails inside `__svc_create()`, the function returns a half-initialized `svc_serv` structure to nfsd, lockd, or the NFS callback service without error; subsequent hot-path increments in `svc_xprt_enqueue()`, `svc_handle_xprt()`, and `svc_pool_wake_idle_thread()` dereference the NULL per-cpu pointer, which resolves to offset zero of the running CPU's per-cpu area and silently overwrites arbitrary kernel memory. Triggering the flaw requires local administrator access plus memory pressure at RPC service startup; the description explicitly excludes remote induction. No public exploit or CISA KEV listing exists, and EPSS sits at 0.22% (13th percentile).
A use-after-free and reference/memory leak race in the Linux kernel SUNRPC backchannel allows a NFS callback backchannel request to be enqueued onto a svc_serv (sv_cb_list) that is being destroyed, or to leak an xprt reference, when a backchannel receive completes concurrently with callback-service teardown. The flaw affects Linux kernels using the SUNRPC/NFS callback backchannel and is resolved by closing the producer side (clearing xprt->bc_serv under bc_pa_lock via a new xprt_svc_shutdown_bc()) before callback threads are stopped and draining leftover sv_cb_list entries before svc_destroy(). No public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with a hard-to-win teardown race rather than a broadly weaponizable bug.
Use-after-free in the Linux kernel's SUNRPC server thread cleanup allows local attackers to trigger kernel heap reads of freed memory when RCU readers race with svc_exit_thread(). The root cause is an asymmetry in svc_rqst_free(): the rqstp struct is correctly deferred via kfree_rcu(), but rq_argp and rq_resp are freed synchronously before the RCU grace period expires - leaving a window where readers like nfsd_nl_rpc_status_get_dumpit() can dereference the freed pointers. No public exploit or KEV listing exists; EPSS is low at 0.20% (10th percentile), but the kernel UAF primitive carries realistic privilege-escalation potential in environments running NFS servers.
Four coupled error-path defects in the Linux kernel's SUNRPC RPCSEC_GSS option-array XDR decoder (`gssx_dec_option_array`) enable kernel NULL-pointer dereference, a `group_info` refcount leak, and a latent use-after-free during GSS security-context acceptance. Systems acting as NFS servers or clients with Kerberos authentication (sec=krb5/krb5i/krb5p) are in the affected code path; triggering the NULL deref via a failed allocation or malformed GSS response causes a kernel crash (denial-of-service). No public exploit code exists and EPSS sits at the 10th percentile, indicating low current exploitation probability.
Denial of service (and short out-of-bounds read) in the Linux kernel's SUNRPC RPCSEC_GSS Kerberos privacy layer affects gss_krb5_unwrap_v2(), which parses the EC/RRC fields at ptr+4/ptr+6 before confirming the token is at least the 16-byte GSS_KRB5_TOK_HDR_LEN. A malicious NFS-with-krb5p peer supplying a sub-16-byte or malformed wrap token triggers an OOB header read, an unsigned wrap in rotate_left()/xdr_buf_subsegment(), a divide-by-zero in the modulo shift, and a dead BUG_ON that fails to stop a movelen underflow driving a ~UINT_MAX-byte memmove(). There is no public exploit identified at time of analysis; EPSS is 0.17% (6th percentile). The upstream fix adds four defense-in-depth length guards.
Out-of-bounds reads in the Linux kernel SUNRPC RPCSEC_GSS privacy (krb5p) receive path allow a malicious or compromised NFS server to crash or leak memory from a connecting client. The function gss_unwrap_resp_priv() validated the opaque token length with a single u32 addition (offset + opaque_len) and no lower bound, so a crafted reply with opaque_len near 0xffffffff wraps the sum below rcv_buf->len and passes the check, while any length below GSS_KRB5_TOK_HDR_LEN is forwarded to gss_krb5_unwrap_v2(), whose pre-decrypt header reads at ptr+4/ptr+6 then run past the token. There is no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a config-gated, DoS-leaning memory-safety bug rather than a broadly weaponizable RCE.
Linux kernel SUNRPC subsystem exposes a race condition between proc entry publication and mutex initialization in the GSS proxy path, allowing a local attacker with write access to /proc/net/rpc/use-gss-proxy to exploit an uninitialized mutex during the narrow window when auth_rpcgss loads. On a production kernel without debug options, two concurrent writers racing through set_gssp_clnt() can shut down an RPC client structure while it is still in active use, resulting in a resource leak and potential use-after-free with full kernel memory integrity and availability impact. Vendor-released patches are available across stable branches; no public exploit or KEV listing exists at time of analysis.
Denial-of-service / buffer-state corruption in the Linux kernel SUNRPC GSS-API layer allows a peer holding a valid Kerberos v2 (RPCSEC_GSS krb5) security context to submit a structurally malformed wrap token whose 16-bit 'extra count' (ec) field exceeds the plaintext length, leaving the xdr_buf in a semantically inconsistent state (zero length, mismatched iov lengths). The flaw affects kernels using krb5 RPC security (e.g. NFS with sec=krb5p) and is fixed in 6.12.109, 6.18.50, 7.2.4 and 7.3-rc1. No public exploit identified at time of analysis; EPSS is low at 0.20% (10th percentile).
Out-of-bounds slab read in the Linux kernel SUNRPC Kerberos GSS layer allows a malicious NFS peer to make gss_krb5_verify_mic_v2() read past an undersized buffer when verifying an RFC 4121 MIC token. The function dereferences the token header, flags, and padding and builds a scatterlist over the checksum without ever checking that the wire-supplied token is at least GSS_KRB5_TOK_HDR_LEN (16) plus the enctype checksum length; all callers only enforce loose upper bounds, so a short checksum opaque produces a small allocation the verifier reads beyond. Exploitation is limited to deployments using RPCSEC_GSS Kerberos (NFS sec=krb5); there is no public exploit identified at time of analysis and EPSS is low (0.19%).
A use-after-free race condition in the Linux kernel's SUNRPC client-side TLS handshake path (introduced in 6.5) allows the lower RPC transport to be freed while the xs_tls_handshake_done() completion callback is still running. When a synchronous handshake waiter times out or is signaled and tls_handshake_cancel() loses the race to handshake completion, the waiter drops the callback-owned reference, freeing the transport before the callback stores xprt_err or releases its own reference. Exploitation requires RPC-over-TLS client configuration (e.g. NFS mounted with xprtsec=tls/mtls) and winning a narrow timing race; no public exploit identified at time of analysis and EPSS is low at 0.20%.
Use-after-free in the Linux kernel's svcrdma (NFS-over-RDMA server transport) arises from incorrect teardown ordering in svc_rdma_free(): rdma_destroy_id() frees sc_cm_id while the transport's sc_rn notification entry remains registered in the device's rd_xa xarray, leaving a dangling reference that a concurrent ib_unregister_device walk can dereference via svc_rdma_xprt_done(). Exploitation requires an NFS-over-RDMA server configuration with RDMA hardware and a race between transport teardown and device unregistration. No public exploit or CISA KEV listing exists; EPSS is 0.20%, consistent with a niche, timing-dependent kernel race.
Use-after-free in the Linux kernel NFS-over-RDMA server (svcrdma) allows an adjacent-network attacker to trigger kernel memory corruption when an RDMA_CM_EVENT_ADDR_CHANGE event coincides with a replacement listener cm_id allocation failure, leaving sc_cm_id pointing to a destroyed object. Subsequent kernel operations that dereference sc_cm_id - most immediately rdma_disconnect() in svc_rdma_detach() - read or write freed kernel memory, with potential impacts on confidentiality, integrity, and availability. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.15% (5th percentile), consistent with the niche NFS-over-RDMA server attack surface.
Denial-of-service (and potential memory corruption) in the Linux kernel's NFS-over-RDMA server (svcrdma) arises from offset arithmetic defects in svc_rdma_read_chunk_range(). A malicious or malformed RDMA client can craft Read-chunk segment lists whose offset/length values trigger a u32 underflow, producing a near-UINT_MAX per-segment length that propagates an enormous nr_bvec into svc_rdma_build_read_segment() and a multi-MiB kmalloc_array_node() allocation, while also silently dropping bytes from rebuilt chunks. Affected kernels are those with NFS-over-RDMA serving enabled from v5.11 onward; there is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Remote out-of-bounds read and general protection fault in the Linux kernel's svcrdma (RPC-over-RDMA server) code allows a connected RDMA client to crash the kernel by advertising a Write or Reply chunk with zero segments. The pcl_for_each_segment iteration macro computed an inclusive upper bound of &ch_segments[ch_segcount - 1]; with a u32 ch_segcount of 0 this underflows to 0xFFFFFFFF, walking far past the flex array until it faults when svc_rdma_get_inv_rkey() dereferences segment->rs_handle. Fixed upstream; EPSS is low (0.17%, 6th percentile) and no public exploit is identified at time of analysis.
Out-of-bounds heap write in the Linux kernel's server-side RPC-over-RDMA transport (svcrdma), used by the in-kernel NFS server, allows a malicious RPC-over-RDMA client to corrupt slab memory. When a client requests a reply (such as an NFS READ payload) without supplying a Write list or Reply chunk, and that reply needs more scatter/gather entries than the RDMA device's Send Queue supports, svc_rdma_pull_up_reply_msg() linearizes the entire reply into the fixed sc_max_req_size buffer; because the reply size is bounded only by the client request, the copy runs past the buffer and the oversized length is also posted to the device. There is no public exploit identified at time of analysis, and EPSS is low (0.17%).
NULL pointer dereference in the Linux kernel svcrdma subsystem (NFS over RDMA) allows unauthenticated remote clients to crash the kernel by sending a crafted RDMA Read list whose cumulative segment lengths overflow the rq_pages page array. The vulnerability bypasses per-segment length validation by exploiting an edge case where a single segment fills the page array exactly, causing the loop guard to exit prematurely; a subsequent segment then dereferences the NULL sentinel slot at rq_pages[rq_maxpages] during DMA mapping, triggering a kernel panic. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS is low at 0.21%, but the network-exposed crash vector warrants patching on any host running NFS-over-RDMA.
Out-of-bounds slab memory disclosure in the Linux kernel's svcrdma (NFS-over-RDMA server) transport allows a connected RDMA client to leak adjacent kernel heap contents. The RPC/RDMA Read chunk position field is taken verbatim from the remote client and only alignment-checked, never bounded against the received inline body length, so a malicious client can drive kvec/gap-length integer underflows that expose adjacent slab memory to the XDR decoder or copy past the receive buffer into reply pages returned to the client. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile), and a vendor patch is available in the stable trees.
Integer underflow in the ath6kl WiFi driver's ath6kl_cfg80211_connect_event() allows an adjacent-network attacker controlling a rogue access point to trigger disclosure of kernel slab memory to userspace via nl80211. When a crafted association response shorter than 6 bytes (or request shorter than 4 bytes) is received from firmware, the u8 length fields wrap around to approximately 250, causing cfg80211_connect_result() or cfg80211_roamed() to copy ~250 bytes of adjacent slab data through netlink to any listening userspace process. Patches are available across all active stable branches; no public exploit exists at time of analysis.
Use-after-free race condition in the Linux kernel's mt76/mt7925 MediaTek Wi-Fi 7 driver allows a local attacker with low privileges to corrupt kernel memory or trigger execution of stale MCU commands. The driver's mlo_pm_work delayed work item lacks cancellation in teardown and suspend paths (reset recovery, PCIe unbind, PCIe/mac80211/USB suspend), creating a window where the work executes after vif/bss structures are freed or firmware becomes unavailable. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17% (7th percentile), consistent with a race-condition kernel driver flaw of limited public interest.
Use-after-free in the Linux kernel's staging Intel IPU7 media driver allows a local attacker to corrupt kernel memory and potentially escalate privileges. The `isys_probe()` error path registers the V4L2 async notifier but fails to unregister it on subsequent probe failures, leaving a dangling pointer in the global `notifier_list` after `devres` frees the enclosing `struct ipu7_isys`. Any subsequent walk of that list - an event driven by normal kernel media subsystem activity - reads freed memory, creating exploitable heap corruption. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS is 0.17% at the 7th percentile.
Race condition in Linux kernel's core scheduler pick_next_task() path allows a local low-privileged attacker to exploit a TOCTOU window when pick_task() releases the rq (run queue) lock mid-selection, potentially leaking information across SMT sibling threads, corrupting forceidle accounting, and destabilizing the scheduler. The vulnerability breaks the cookie-based SMT isolation guarantee of Core Scheduling: an uncookied task can be committed as the sibling of a cookied task during the lock-release window, violating the trust boundary the feature is designed to enforce. No public exploit exists (EPSS 0.19%), and fixes are available in Linux 7.2.4, 7.3-rc1, and 6.19.
Lock confusion in the Linux kernel's core scheduling subsystem (sched/core) exposes systems with SMT/hyperthreading and CONFIG_SCHED_CORE enabled to a local privilege escalation path from a low-privileged user. During pick_next_task() under the shared core-wide lock, a ->pick_task() implementation that momentarily drops the per-rq lock creates a window where __sched_core_flip(false) can complete and rebind rq_lockp(), causing the scheduler to operate on sibling run-queue state without holding the correct locks - __schedule() then releases a lock it never acquired while leaking the one it holds. No public exploit code exists and EPSS is 0.20%, but vendor-released patches are confirmed in Linux 6.18.51, 7.2.4, and 7.3-rc1.
Integer overflow in RISC-V KVM's SBI PMU EVENT_GET_INFO handler allows a guest VM to trigger out-of-bounds heap reads and writes on the host kernel, with scope-changed impact (C:H/I:H/A:H). A malicious or compromised guest on a RISC-V host running KVM can supply a crafted num_events value (e.g., 0x10000001 on RV64) that overflows a 32-bit multiplication, causing under-allocation of the event-info array while the subsequent loop iterates over the original large count - resulting in slab-out-of-bounds memory corruption confirmed by KASAN traces. No public exploit code exists and EPSS is 0.15%, but the scope change to the host kernel makes this a VM-escape class finding for RISC-V KVM deployments.
Kernel panic via NULL pointer dereference in the Linux kernel qede Ethernet driver (used by QLogic/Marvell FastLinQ NICs) can be triggered under memory pressure conditions during TPA (Transparent Packet Aggregation) fragment processing. A regression introduced by commit 8a8633978b84 omitted the assignment of tpa_info->buffer.data in qede_tpa_start(), causing a 'ghost' buffer descriptor with a NULL data pointer to be reinserted into the active Rx ring upon SKB allocation failure. When hardware subsequently uses the poisoned ring slot, qede_fill_frag_skb() dereferences the NULL pointer, panicking the kernel. No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile).
Use-after-free in the Linux kernel's RDMA/cxgb4 driver (Chelsio T4/T5/T6 RDMA support) allows a local low-privileged attacker to trigger kernel heap memory corruption by racing device removal against deferred RDMA device registration work. The driver's `c4iw_remove()` teardown path frees `ctx->dev` while a `reg_work` work item queued by `c4iw_uld_state_change()` may still be executing, leaving `c4iw_register_device()` operating on freed memory. No public exploit or active exploitation has been identified; vendor-released patches are available in stable kernel series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.