Linux
Monthly
TX-completion memory mishandling in the Linux kernel's Intel igc (I225/I226 2.5GbE) driver stems from igc_fpe_init_smd_frame() failing to set the tx-buffer type on SMD (Frame Preemption) frames, so a reused igc_tx_buffer can retain a stale XDP or XSK type and be freed through the wrong cleanup path. This affects local systems running an igc NIC with Frame Preemption active, and the realistic impact is memory corruption or a driver crash rather than remote compromise. No public exploit identified at time of analysis; EPSS is very low (0.17%, 6th percentile) and it is not in CISA KEV, despite the NVD-assigned 9.8 CVSS.
Kernel memory corruption in the Linux MANA (Microsoft Azure Network Adapter) driver lets a malicious or compromised hypervisor bypass a bounds check via a time-of-check/time-of-use double-fetch of hwc_msg_id from a shared DMA buffer. In a Confidential VM (SEV-SNP/TDX), DMA-coherent memory is unencrypted and host-visible, so the host can alter the message ID after mana_hwc_rx_event_handler() validates it but before mana_hwc_handle_resp() re-reads it for test_bit() and pointer arithmetic, driving an out-of-bounds access in guest kernel memory. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and it is not in CISA KEV.
Use-after-free in the Linux kernel's RDMA/rtrs (RDMA Transport) server module allows corruption of freed memory during the error-cleanup path of rtrs_srv_create_path_files(). When sysfs path-file creation partially fails, cleanup calls kobject_put() (which can free srv_path via the rtrs_srv_release callback) before rtrs_srv_destroy_once_sysfs_root_folders() dereferences that now-freed structure. Reported upstream by Linux/kernel maintainers with a vendor patch available; there is no public exploit identified and EPSS exploitation probability is low (0.17%, 7th percentile), consistent with a hard-to-reach error path in a niche subsystem rather than a broadly weaponizable flaw.
Use-after-free in the Linux kernel's bridge multicast (br_multicast) subsystem lets a local user with network-configuration capability crash the host or potentially execute code by toggling global multicast snooping while per-VLAN multicast snooping is enabled on a VLAN-filtering bridge. The flawed logic can leave both per-port and per-{port, VLAN} multicast contexts active simultaneously, so a per-port context (including its query timer) survives after the bridge port is freed, yielding a UAF confirmed by kernel debug tooling (ODEBUG free-active). No public exploit has been identified and EPSS is low (0.17%), but a deterministic reproducer is included in the fix, and the CVSS is 7.8 (High).
Local privilege escalation / memory-corruption potential in the Linux kernel's EROFS filesystem arises from a managed-cache race condition affecting unaligned compressed extents. When two threads process the same Z_EROFS_PREALLOCATED_FOLIO for different pclusters, one thread can call filemap_add_folio() a second time on a folio whose private state was not yet cleared, corrupting the managed page cache. Rated CVSS 7.8 (AV:L), it affects EROFS images built with unaligned data compression (e.g. -E48bit with zstd); EPSS is low (0.17%, 6th percentile), it is not in CISA KEV, and no public exploit identified at time of analysis.
Remote kernel crash in the Linux kernel's mac80211 WiFi stack affects WiFi 7 (802.11be) clients: the ieee80211_ml_epcs() handler fails to bounds-check the 4-bit link_id (0-15) extracted from an EPCS PER_STA_PROFILE subelement, but sdata->link[] holds only 15 entries (indices 0-14), so link_id=15 reads out of bounds. A connected access point can send an EPCS Enable Response action frame with link_id=15 to read a garbage pointer that bypasses the NULL check and is dereferenced in ieee80211_sta_wmm_params(), crashing the kernel. There is no public exploit identified at time of analysis, EPSS is low (0.17%), and this is a denial-of-service (kernel panic) rather than the code-execution/data-disclosure implied by the vendor CVSS.
Local privilege-escalation-capable memory corruption in the Linux kernel's ALSA sequencer UMP (MIDI 2.0) client code allows a local user with access to the sound sequencer to trigger a use-after-free. seq_ump_process_event() borrows client->out_rfile.output without synchronizing against the ALSA sequencer output open/close transitions, so a last-close can free the rawmidi substream and its runtime while an in-flight event_input callback is still executing snd_rawmidi_kernel_write(). The race is confirmed reproducible under KASAN as a slab-use-after-free, but there is no public exploit identified at time of analysis and EPSS risk is low (0.17%, 6th percentile).
Use-after-free in the Linux kernel's net shaper subsystem allows a local, low-privileged attacker to trigger memory corruption via a race condition in the network shaper API's XArray-based entry tracking. Because XArray 'VALID' marks are not stored atomically with their entries, a reader can observe a VALID slot, be preempted while a writer replaces the entry, and then dereference a stale pointer that net_shaper_rollback() has already freed, enabling potential privilege escalation or information disclosure. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 6th percentile).
Local information disclosure and memory corruption in the Linux kernel's rxrpc (AF_RXRPC/AFS) subsystem allows a local user of an encrypted rxrpc socket to trigger pagecache corruption because DATA packets were decrypted in-place on shared sk_buffs while splice() referenced the same pages. This is a hardening follow-up to CVE-2026-43500, replacing in-place decryption with a per-call bounce buffer so recvmsg() copies clean data and the sk_buff is never mutated. No public exploit identified at time of analysis, EPSS is low (0.17%, 6th percentile), and it is not listed in CISA KEV, consistent with a niche kernel subsystem rather than a mass-exploitation target.
Use-after-free in the Linux kernel's BPF sockmap (skmsg) receive path arises when a socket is added to a BPF_SK_SKB_VERDICT sockmap before kernel TLS (kTLS) RX is configured, letting sk_psock_verdict_data_ready() drain the TCP receive queue that the TLS strparser believes it owns. The mismatch leaves the strparser's frag_list pointing at freed, psock-owned skbs, which tls_decrypt_sg() then walks, corrupting kernel memory. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis, but a kernel-space UAF with high confidentiality, integrity, and availability impact makes this a meaningful local privilege-escalation and denial-of-service risk on affected builds.
Predictable TCP Initial Sequence Number (ISN) generation in the Linux kernel's TCP stack (introduced in 6.10) stems from a stale per-CPU tcp_tw_isn value leaking between packets. A regression moved the TIME_WAIT-derived ISN from the per-skb control block to a per-CPU variable on the assumption it would always be consumed by the same packet; when that packet is instead dropped on any of several intermediate paths, the value persists and the next SYN handled on that CPU inherits a non-zero, potentially predictable ISN, weakening TCP connection integrity. NVD assigns CVSS 9.4, but EPSS is low at 0.17% (6th percentile), there is no public exploit identified at time of analysis, and it is not in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel GPIO aggregator driver (gpio-aggregator) arises from a use-after-free on the error-handling path, where `aggr->lookups->dev_id` is freed before the lookup entry is removed from the table. A concurrent thread calling `gpiod_find()` can then dereference the freed `dev_id` via `strcmp()` in `gpiod_match_lookup_table()`, yielding a UAF that a low-privileged local attacker could leverage for code execution or DoS. There is no public exploit identified at time of analysis, and EPSS is low (0.17%), consistent with a race-condition kernel bug requiring local access rather than a mass-exploitation candidate.
Memory (kmalloc) leak in the Linux kernel's nvme-pci driver allows exhaustion of kernel memory over time on hosts using NVMe peer-to-peer (P2P) DMA. Because P2P memory is never unmapped, the driver has no need to track it, yet the dma_vec allocation used for tracking was never freed on I/O completion, leaking on every affected request. The flaw affects kernel 6.17 and is fixed in stable; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%).
Out-of-bounds array access in the Linux kernel's Microsoft Azure Network Adapter (mana) driver lets a malicious hypervisor corrupt guest kernel memory within Confidential VMs. In mana_hwc_rx_event_handler(), the rx_req_idx index is read from host-shared DMA-coherent memory (a WQE's sge->address) without a bounds check, so in SEV-SNP/TDX guests the untrusted host can steer the index to read/write past the reqs[] array. There is no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a defense-in-depth hardening fix for the confidential-computing threat model rather than an actively exploited flaw.
Local privilege-escalation-class memory corruption in the Linux kernel's blk-mq multi-queue block layer allows a local low-privileged user to trigger a use-after-free when submitting a bio: if the task sleeps after peeking a cached request but before popping it, the plug flush frees the cached_rqs, leaving a dangling pointer. The flaw affects mainline and multiple stable trees (6.1.x, 6.5.x, 6.6.x, 6.7) and carries CVSS 7.8 (high CIA impact). There is no public exploit identified at time of analysis, and the very low EPSS (0.15%, 5th percentile) reflects the difficulty of winning the required timing race rather than low structural severity.
Kernel use-after-free in ksmbd, the Linux in-kernel SMB3 server, occurs when a durable handle reconnect succeeds but smb2_open() then hits a later error path. The cleanup logic double-frees the same ksmbd_file (once via ksmbd_fd_put and again via the non-session-aware ksmbd_put_durable_fd), freeing the file object while its volatile-id entry remains published in the session table. This dangling entry can be reused, giving a remote SMB client a path to kernel memory corruption; it is not in CISA KEV and no public exploit identified at time of analysis, with EPSS at a low 0.17%.
Use-after-free in the Linux kernel keyring subsystem (security/keys) allows a local low-privileged user to read freed memory because find_key_to_update() calls assoc_array_find() without holding the RCU read lock, racing against assoc_array_gc() which frees nodes after an RCU grace period. The flaw is exercised specifically through the persistent-keyring path, which does not rely on the keyring semaphore that masks the issue for regular keys. No public exploit identified at time of analysis; EPSS probability is low (0.17%, 7th percentile) and it is not listed in CISA KEV.
Local privilege escalation risk arises from a use-after-free in the Linux kernel's NFC LLCP subsystem, where llcp_sock_release() unconditionally unlinks a socket from the local sockets list even when the socket is still in the connecting state and actually resides on the connecting list. A local user able to open NFC LLCP sockets can trigger memory corruption during socket release, with high confidentiality, integrity and availability impact per the CVSS 7.8 rating. No public exploit identified at time of analysis, and EPSS is low (0.18%), consistent with a local-only, hardware-gated attack surface.
Use-after-free in the Linux kernel NFC LLCP subsystem allows an adjacent attacker to corrupt kernel memory by racing a connection-complete (CC) packet against socket release in nfc_llcp_recv_cc(). Affected are kernels using the NFC Logical Link Control Protocol stack; successful exploitation of the race can yield kernel memory corruption leading to potential privilege escalation or denial of service. No public exploit identified at time of analysis, and EPSS probability is low (0.18%), consistent with a memory-safety race that is hard to trigger and requires NFC proximity.
Local privilege-scoped memory corruption in the Linux kernel's IPsec/xfrm subsystem allows a low-privileged user with network-configuration capability to trigger a massive out-of-bounds kernel write. The xfrm_state_mtu() helper computes an ESP MTU in unsigned modulo-2^32 arithmetic; by installing an IPv4 ESP tunnel SA with an oversized truncated auth key, a tiny interface MTU, and a large XFRMA_TFCPAD value, an attacker forces the result to underflow, and esp_output() later treats it as a negative signed length passed to memset() — producing a near-16 EB write of zeroes at the skb tail. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and the flaw is not in CISA KEV, but the ubiquity of the Linux kernel makes patching important.
Local privilege escalation via use-after-free in the Linux kernel accel/rocket driver (Rockchip NPU accelerator) allows an authenticated local user with access to the accel device node to dereference freed slab memory. The flaw stems from rocket_ioctl_create_bo() registering a GEM handle in the file IDR before fallible operations (sgt allocation, drm_mm insert, iommu_map); on failure the object is freed while the handle stays live, and any later PREP_BO/FINI_BO/SUBMIT ioctl triggers the UAF. No public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile).
Kernel memory corruption in the Linux netfilter SYNPROXY module (synproxy_tstamp_adjust) lets remote hosts trigger a use-after-free write against systems that deploy the SYNPROXY target for TCP SYN-flood mitigation. When processing a cloned or non-linear packet, skb_ensure_writable() reallocates and frees the old skb->head, but the code then writes the recomputed TCP checksum through a stale header pointer - landing in freed slab memory or leaving a wrong on-wire checksum. Rated CVSS 9.8 by the automated feed, but EPSS is only 0.18% (7th percentile), it is not in CISA KEV, and no public exploit identified at time of analysis.
Memory corruption in the Linux kernel's SMC (Shared Memory Communications) networking subsystem arises because smc_init() re-runs INIT_HLIST_HEAD() on the smc_v1/smc_v2 hashtables after they may already hold live hash entries, resetting the list heads and corrupting an in-use linked list. A local user able to trigger SMC socket activity during the vulnerable window can cause list corruption leading to high confidentiality, integrity, and availability impact per the CVSS 7.8 (AV:L) rating. This is not actively exploited - no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.18%.
Local denial of service in the Linux kernel's AF_IUCV networking stack allows any unprivileged user on an s390/IBM Z host to crash the machine by racing recvmsg() against getsockopt(SO_MSGSIZE) on a HiperSockets (HIPER) socket. The .getsockopt handler dereferenced iucv->hs_dev->mtu without holding lock_sock(), so a concurrent iucv_sock_close() (triggered from recvmsg) could set hs_dev to NULL between the check and the dereference, producing a NULL pointer dereference oops. EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis; the upstream fix wraps the entire getsockopt switch in lock_sock()/release_sock() to mirror the existing setsockopt locking.
Denial of service in the Linux kernel SCSI core allows a device removal process to hang when SCSI devices in a partially-removed state (SDEV_CANCEL) retain requeued requests that are never kicked. Because scsi_run_host_queues() relied on shost_for_each_device()/scsi_device_get(), which skips devices not in a runnable state, requests queued during host error recovery stayed stuck after recovery cleared. The fix broadens scsi_run_host_queues() to run queues for every device except those in SDEV_DEL or where a reference cannot be acquired. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile).
Use-after-free in the Linux kernel's IPv4 sysctl teardown path (ipv4_sysctl_exit_net) can corrupt kernel memory because net->ipv4.sysctl_local_reserved_ports is freed before unregister_net_sysctl_table(), leaving a window where threads accessing /proc/sys/net/ipv4/ip_local_reserved_ports reference freed memory. A local low-privileged attacker able to trigger network namespace teardown could leverage the dangling pointer for memory corruption, information disclosure, or potential privilege escalation. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the issue is not on CISA KEV, consistent with a fix delivered quietly through the kernel stable process.
Out-of-bounds memory access in the Linux kernel's HSR (High-availability Seamless Redundancy) networking subsystem allows a crafted, truncated supervision frame to trigger an OOB read when the code accesses a TLV header that was not fully linearized into the socket buffer. The flaw affects systems running the net/hsr driver across numerous stable kernel branches (fixed in 6.1.176, 6.6.143, 6.12.93, 6.18.35 and others). No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a niche, protocol-specific attack surface rather than broad exploitation.
Out-of-bounds kernel write in the Linux kernel's ethtool CMIS CDB handling (cmis_cdb_process_reply) allows a malicious or buggy SFP/QSFP transceiver module to corrupt kernel memory by returning a CDB reply whose rpl_len exceeds the expected rpl_exp_len. Affected callers (password validation, module feature discovery, and firmware-management feature discovery) cast the reply payload to fixed-layout structs at fixed offsets, so an over-long reply writes past the kmalloc'd page buffer. There is no public exploit identified at time of analysis, EPSS risk is low (0.17%), and it is not on CISA KEV; the fix is a defensive exact-length check merged upstream and backported to stable trees.
Out-of-bounds kernel write in the Linux kernel's ethtool CMIS firmware-update path (cmis_fw_update_start_download) lets a malicious or malfunctioning pluggable transceiver module overflow a 112-byte stack/heap buffer by returning an oversized start_cmd_payload_size in its CDB FW Management Features reply. The value is used unchecked as a memcpy byte count, so any attacker able to present a crafted module-or corrupt its CDB response-can corrupt adjacent kernel memory. EPSS is very low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; the fix simply rejects payload sizes larger than the destination buffer.
Use-after-free in the Linux kernel IP tunnel path-MTU discovery code (iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6()) arises because ip_hdr()/ipv6_hdr() pointers were cached before an skb_cow() that can reallocate skb->head, leaving the code operating on freed memory when generating ICMP/ICMPv6 fragmentation-needed messages for tunnel traffic. On systems with IP tunnels configured, an attacker able to drive oversized traffic through the tunnel can trigger the freed-memory access, risking a kernel information leak (the issue is tagged Information Disclosure) or memory corruption/crash. No public exploit identified at time of analysis, EPSS probability is low (0.18%), and the fix is already merged across the stable trees.
Use-after-free in the Linux kernel's VXLAN tunnel driver (drivers/net/vxlan) arises because the transmit path caches the result of ip_hdr() into old_iph and reuses it after skb_tunnel_check_pmtu(), which may reallocate skb->head and invalidate that pointer. Affected are kernels from 5.9 through the fix commits (patched in 6.1.176, 6.6.143, 6.12.93, 5.15.210, 5.10.259, 6.18.35, 7.0.12 and 7.1) on hosts using VXLAN overlays; an attacker able to drive traffic through the tunnel can trigger memory corruption leading to information disclosure or a kernel crash. There is no public exploit identified at time of analysis and EPSS is low (0.18%, 7th percentile), so this is not currently associated with active exploitation despite the CVSS 9.8 rating.
Out-of-bounds memory access in the Linux kernel's IP tunnel path-MTU discovery code (iptunnel_pmtud_check_icmp) affects IPv4 tunnel interfaces where the function may run on packets whose skb transport header is unset, causing an ~65535-byte offset read past the linear buffer. Remote attackers can trigger this by sending crafted ICMP traffic to a tunnel endpoint, potentially leaking adjacent kernel memory or crashing the host (denial of service). This is a supplier-reported (Linux stable) fix with no public exploit identified at time of analysis and a low EPSS score of 0.18%.
Out-of-bounds heap write in the Linux kernel ethtool netlink coalesce interface allows a local privileged user (CAP_NET_ADMIN) to corrupt kernel memory beyond a 5-element IRQ moderation profile buffer, enabling privilege escalation, denial of service, or information disclosure. The flaw lives in ethnl_update_profile(), which trusts a fully user-controlled Netlink nest count while writing into a kmemdup()'d array sized at NET_DIM_PARAMS_NUM_PROFILES (5). This has been resolved upstream and is not known to be exploited; EPSS probability is low (0.17%, 6th percentile) and no public exploit has been identified at time of analysis.
Out-of-bounds read in the Linux kernel's ethtool module-EEPROM Netlink fallback path allows a local privileged user to read memory beyond the intended EEPROM buffer. The flaw lives in fallback_set_params(), which checks that the requested offset is below eeprom_len but never validates that offset + length also stays within bounds - a check the ioctl path (ethtool_get_any_eeprom()) has always enforced. A compounding issue is the use of plain kmalloc() instead of a zeroed allocation, so uninitialized kernel memory may be returned to the caller. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and it is not in CISA KEV.
Out-of-bounds heap corruption in the Linux kernel's IPv6 RPL Source Routing Header handling (net/ipv6/exthdrs.c) allows remote attackers to corrupt the routing header of forwarded packets by sending a crafted compressed SRH. The bug stems from a __u8 truncation of the computed hdrlen in ipv6_rpl_srh_decompress(): with n=127 segments the value (128*16)>>3 = 256 wraps to 0, causing the compressed header to overlap the decompressed region so ipv6_rpl_srh_compress() writes into kernel memory it should not. Rated CVSS 9.8 but EPSS is only 0.18% (7th percentile); no public exploit and no CISA KEV listing exist at time of analysis, and exploitation requires an unrealistic 127-segment header on a node with RPL source routing enabled.
Denial of service in the Linux kernel's net/handshake (TLS handshake) subsystem allows a CPU-local deadlock on hosts acting as NVMe-over-TCP (nvmet_tcp) targets with in-kernel TLS. The nvmet_tcp_state_change() socket callback runs in softirq/BH context and reaches handshake_req_cancel(), which took hn->hn_lock with a plain spin_lock(); if a process-context thread on the same CPU already holds hn_lock when the softirq fires, the lock attempt deadlocks and hangs the CPU. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not on CISA KEV, so this is a stability/availability hardening fix rather than an actively exploited threat.
Use-after-free in the Linux kernel net/handshake subsystem (kernel 6.4 through the fixed 7.x builds) lets a concurrent handshake consumer free a struct socket and its backing file while the netlink accept path (handshake_nl_accept_doit) is dereferencing them, producing a NULL pointer read or freed-memory access. The flaw is a race between handshake_req_next() dropping hn_lock and the accept side reaching FD_PREPARE(), during which tls_handshake_cancel() plus sockfd_put()/__fput_sync() can release the object. No CISA KEV listing and no public exploit identified at time of analysis; EPSS is low at 0.19% (9th percentile) and the tags classify the practical impact as Denial of Service.
Kernel memory corruption and resource leakage in the Linux net/handshake subsystem stems from reversed list_splice_init() arguments in handshake_net_exit(), so pending TLS/handshake requests are never drained when a network namespace is destroyed. Fixing the splice direction then exposes a list-corruption and use-after-free race between the namespace-exit drain path and a concurrent handshake_req_cancel() (e.g. sunrpc TLS timeout), which can free a socket-backed handshake_req while it is still linked on the drain list. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile), and the record is not in CISA KEV.
Use-after-free / NULL-pointer dereference in the Linux kernel zl3073x DPLL (digital phase-locked loop) driver allows a local attacker to crash the system or potentially corrupt kernel memory during DPLL device teardown. Introduced in kernel 6.18 and fixed in stable 7.0.12/7.1, the flaw stems from the change_work item being re-scheduled after cancel_work_sync(), causing the handler to dereference a freed or NULL dpll_dev pointer. No public exploit identified at time of analysis; EPSS probability is low (0.15%, 5th percentile) and it is not listed in CISA KEV.
Improper channel-identifier handling in the Linux kernel Bluetooth L2CAP stack lets an in-range peer forcibly tear down an established Enhanced Credit (ECRED) connection. Because l2cap_ecred_reconf_rsp() returns on success without clearing chan->ident, a remote peer that completed a reconfiguration can replay a failure response carrying the stale ident, causing the kernel to match and destroy the live channel with l2cap_chan_del(chan, ECONNRESET); the fix also hardens the failure path against a use-after-free. No public exploit is identified at time of analysis and EPSS risk is low (0.31%).
Denial-of-service (kernel crash) in the Linux kernel Bluetooth L2CAP subsystem lets an in-range attacker trigger memory corruption by sending a crafted Enhanced Credit-Based (ECRED) connection response that reuses an already-assigned destination CID, corrupting the list_for_each_entry_safe cursor during channel teardown. All Linux systems with Bluetooth enabled and processing LE CoC ECRED channels are affected until patched. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile); the issue is not listed in CISA KEV.
Denial-of-service and potential memory-corruption exposure in the Linux kernel Bluetooth stack (hci_sync) arises because hci_dev_close_sync() failed to set the HCI_CMD_DRAIN_WORKQUEUE flag during device close, allowing command timeouts to be queued while the hdev workqueue is being drained on the reset path. The fix, present in stable trees (6.12.93, 6.18.35, 7.0.12, 7.1), closes a race that a Bluetooth-adjacent attacker could trigger during controller reset. There is no public exploit identified at time of analysis, EPSS risk is low (0.20%), and it is not listed in CISA KEV.
Denial of service in the Linux kernel MANA (Microsoft Azure Network Adapter) Ethernet driver allows the port reset recovery path to trigger a NULL pointer dereference and kernel crash. The flaw occurs when mana_per_port_queue_reset_work_handler() runs after a prior detach succeeded but a subsequent attach failed, leaving apc->tx_qp and apc->rxqs freed; a second unconditional mana_detach() then dereferences NULL during queue teardown. No public exploit has been identified, EPSS is low (0.20%, 10th percentile), and the CVSS 3.1 score is 7.5 driven purely by availability impact.
Local privilege escalation and memory corruption in the Linux kernel SCTP subsystem stems from a race condition where sctp_wait_for_connect() fails to detect that an association was migrated to a new socket via SCTP_SOCKOPT_PEELOFF while the socket lock was released. An attacker with a local account and the ability to open SCTP sockets can race a connecting association against a peeloff getsockopt() call, causing the connect path to operate on asoc->base.sk under the wrong socket lock in sctp_datamsg_from_user(). This is a fixed upstream kernel bug (EUVD-2026-45744) with a vendor patch available; no public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.21% (11th percentile).
Local memory corruption in the Linux kernel's vsock/virtio transport (AF_VSOCK) arises from a reference-counting lifetime mismatch in the MSG_ZEROCOPY send path, affecting kernels from 6.7 onward. Because virtio_transport_send_pkt_info() reuses or allocates the zerocopy uarg before virtio_transport_alloc_skb() fills the skb, a rollback after a partial fixed-buffer vectored zerocopy attach frees an skb that is flagged SKBFL_MANAGED_FRAG_REFS but has no uarg, causing skb_release_data() to take the wrong unref path. The CVSS 7.8 rating reflects high confidentiality, integrity, and availability impact from local access; there is no public exploit identified at time of analysis and EPSS is low at 0.20%.
Denial of service in the Linux kernel's IPv6 routing stack allows remote attackers to trigger an infinite loop in fib6_select_path(), hanging a CPU in softirq context and causing a system-wide hang or hard lockup. The flaw exists because writers holding tb6_lock can list_del_rcu() a route's fib6_siblings entry without waiting for RCU readers, leaving the softirq-side path-selection walker traversing a stale sibling ring that never reaches its list terminator. A vendor patch is available; EPSS is low (0.21%) and there is no public exploit identified at time of analysis, but the network-triggerable, no-privilege CVSS 7.5 vector makes it a meaningful availability risk on multipath IPv6 deployments.
Kernel panic (denial of service) in the Linux kernel's mm/vmalloc subsystem occurs because __get_vm_area_node() calls BUG_ON(in_interrupt()), and in_interrupt() also returns true when bottom halves (softirqs) are merely disabled rather than in a genuine interrupt context. A legitimate network-bridge path (br_fdb_add_local under spin_lock_bh) reaches vmalloc while BH is disabled, tripping the BUG() and crashing the kernel. NVD scores this A:H (availability only) with no public exploit identified at time of analysis; EPSS is low at 0.19% (9th percentile) and it is not in CISA KEV.
Local denial-of-service in the Linux kernel's HPFS (High Performance File System) driver allows a crash when hpfs_map_dnode_bitmap fails and the code subsequently calls hpfs_brelse4 on an uninitialized quad buffer head. Affected are Linux kernels prior to the fixed stable releases (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1) when an HPFS filesystem is mounted. There is no public exploit identified at time of analysis, KEV does not list it, and EPSS is very low (0.21%), consistent with a niche legacy-filesystem bug rather than a broadly weaponizable flaw.
Protection-mechanism bypass in the Linux kernel's memfd file-sealing subsystem lets a local low-privileged process hold writable mappings on a memfd while still applying SEAL_WRITE via the SEAL_EXEC path, defeating the immutability guarantee that consumers rely on. Because the implied SEAL_WRITE was set after the mapping_deny_writable() check rather than before, an attacker can hand a victim (e.g. a sandbox or loader) a memfd that reports as write-sealed yet remains arbitrarily modifiable. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and this is not on CISA KEV.
Local privilege escalation or denial of service in the Linux kernel's zram block device (writeback path) stems from a use-after-free in zram_writeback_endio, where the bio completion handler calls wake_up() on wb_ctl->done_wait after the writeback task may have already observed num_inflight reach zero and freed wb_ctl via release_wb_ctl(). Affecting kernels around 6.19/7.0 with zram writeback in use, a local attacker who can drive zram writeback activity may trigger the race to corrupt kernel memory, crashing the system or potentially escalating privileges. There is no public exploit identified at time of analysis and EPSS is low (0.21%), consistent with a hard-to-win kernel race rather than a trivially weaponizable bug.
Memory-management memory corruption in the Linux kernel's reverse-mapping (rmap) code lets a local, low-privileged user crash the system by corrupting folio refcount/mapcount state. The flaw lives in try_to_unmap_one() (mm/rmap.c), where the nr_pages counter is not reset to 1 at the start of each page-table-walk iteration, so a stale batch count from a prior lazyfree folio unmap is reused against a device-exclusive PTE. No public exploit identified at time of analysis and EPSS is low (0.20%, 10th percentile); the demonstrated userspace-visible effect is a kernel crash (denial of service).
Out-of-bounds read in the Linux kernel Bluetooth HIDP (Human Interface Device Protocol) subsystem lets a paired, malicious Bluetooth peripheral send a truncated interrupt frame that hidp_input_report() parses without validating skb->len, causing the handler to read past valid skb data. The stale bytes are interpreted as phantom keystrokes or spurious mouse movement, giving an adjacent attacker a limited local input-injection/info-leak primitive. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), consistent with a niche Bluetooth-range issue rather than mass exploitation; a vendor patch is available across multiple stable branches.
Memory corruption in the Linux kernel Bluetooth ISO (Isochronous Channels) subsystem allows an attacker within Bluetooth range to trigger a use-after-free on a socket structure via a race in iso_recv_frame(), where conn->sk is read under iso_conn_lock but dereferenced after the lock drops while a concurrent iso_sock_kill() frees the socket. Successful exploitation can corrupt kernel memory when accessing sk->sk_state and sock_queue_rcv_skb(), enabling denial of service and potentially privilege escalation or code execution in kernel context. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile).
Local privilege escalation or denial of service in the Linux kernel Bluetooth ISO (Isochronous Channels) subsystem arises from a race condition where iso_sock_close() calls iso_sock_clear_timer() before taking the socket lock, letting a concurrent iso_conn_del() free the connection object and trigger a NULL pointer dereference or use-after-free. Any local user able to open and close AF_BLUETOOTH ISO sockets can race the two code paths; UAF of a kernel connection structure can escalate from a crash to memory corruption. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and the issue is not in CISA KEV.
Use-after-free in the Linux kernel Bluetooth HCI subsystem (hci_sync) lets a concurrent Bluetooth disconnect free an hci_conn object that hci_le_create_cis_sync() then reads via a stale pointer, producing a use-after-free read during Connected Isochronous Stream (CIS) setup. The affected code path handles LE isochronous channel creation, and the flawed cancellation logic (queuing work with data=NULL while dequeuing with data=conn) means the pending work item is never cancelled, leaving the race exploitable. There is no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is not in CISA KEV.
Privilege-independent local crash in the Linux kernel's parport (parallel port) subsystem allows a race between port registration and client-driver attachment, where drivers such as lp bind to ports that are not yet fully initialised or are being torn down, causing a NULL/use-after-free style kernel crash. Affects systems where parport_pc and lp are built as modules and loaded concurrently during boot with PC-style parallel-port hardware present. No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and it is not listed in CISA KEV, consistent with the vendor 'Denial Of Service' tag rather than code execution.
Improper vector-length capping in the Linux kernel's KVM arm64 SVE handling lets a nested (L2) guest under a VHE guest hypervisor access Scalable Vector Extension vector lengths beyond its configured limit. When a guest hypervisor updates ZCR_EL2 indirectly via the untrapped ZCR_EL1 accessor, KVM restores the raw value into the physical ZCR_EL2 without capping, breaking the vector-length confinement policy. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.19%, 9th percentile); a vendor fix is available via the stable git tree.
Improper handling of zero-length Port I/O (PIO) requests in the Linux kernel's KVM AMD SEV/SEV-ES support allows a malicious confidential-computing guest to reach a length-underflow path when the hypervisor sets up the GHCB software scratch area. No public exploit has been identified at time of analysis and it is not on CISA KEV, though a vendor (upstream) patch is available. Despite a headline CVSS of 9.3, EPSS is only 0.20% (10th percentile), and the fix itself is a defensive hardening that ignores len/count '0' PIO to prevent length underflow.
Host-side buffer overflow in the Linux kernel's KVM AMD SEV/SEV-ES support (arch/x86/kvm/svm/sev.c GHCB handling) lets a malicious or compromised confidential guest corrupt host memory by abusing Page State Change (PSC) requests. KVM miscomputes the maximum length of the in-GHCB scratch area, treating the guest-supplied @len as the buffer's full size when for PSC it is only a minimum, allowing a guest to drive writes past the shared GHCB buffer. Rated CVSS 9.3 for a scope-changed guest-to-host escape; no public exploit is identified at time of analysis and EPSS is low (0.22%), but a vendor patch is available across multiple stable branches.
Out-of-bounds memory access in the Linux kernel's KVM AMD SEV-SNP subsystem allows a malicious or compromised confidential-computing guest to read or corrupt host hypervisor memory by supplying a Page State Change (PSC) request whose buffer pointer is not aligned to the start of the GHCB shared buffer. The flaw affects KVM hosts running SEV-SNP guests on kernels from 6.11 onward and carries a high CVSS of 9.3 (AV:L/S:C) reflecting a guest-to-host boundary crossing. EPSS is low (0.20%, 10th percentile), it is not on CISA KEV, and no public exploit has been identified at time of analysis; a vendor fix is available in the stable trees.
Time-of-check-to-time-of-use race condition in the Linux kernel's KVM AMD SEV code allows a malicious or misbehaving encrypted guest to corrupt the host's processing of Page State Change (PSC) requests by mutating the guest-accessible PSC buffer while KVM reads entries and indices from it. Because KVM read the buffer without READ_ONCE(), the compiler could reload values mid-processing, enabling a TOCTOU exploit path with a CVSS-rated scope-changed impact affecting the host beyond the guest. No public exploit has been identified at time of analysis, and the EPSS score is low (0.20%); the fix hardens the reads with READ_ONCE() to make the guest's writes irrelevant to already-validated values.
Local privilege escalation and memory corruption in the Linux kernel's Industrial I/O (IIO) buffer hardware-consumer subsystem stems from a use-after-free in the error-handling path of iio_hw_consumer_alloc(). When buffer allocation fails, the cleanup routine iterated the buffer list with the unsafe list_for_each_entry() macro while iio_buffer_put() could free the current buffer, causing the loop to dereference freed memory. CVSS is 7.8 (High) with local vector and low privileges; EPSS is low at 0.21% (11th percentile), and there is no public exploit identified at time of analysis, consistent with this being a defect reachable only in a rare allocation-failure path.
Local denial-of-service (and potential information disclosure) in the Linux kernel's dwc2 USB host controller driver, where debug code dereferences the 'urb' structure after it has already been handed back via usb_hcd_giveback_urb(), causing a use-after-free read of freed memory. The flaw affects systems using the DesignWare HS OTG USB 2.0 controller driver (common on ARM SoCs such as Raspberry Pi). It is patched upstream, has no public exploit identified at time of analysis, and carries a low EPSS score (0.21%).
Memory corruption in the Linux kernel's BPF sockmap subsystem allows a local actor to produce an inconsistent scatterlist layout via bpf_msg_push_data(). When a BPF sk_msg program inserts data into a non-first scatterlist entry, the right-fragment offset is over-advanced by the message-global insertion point instead of the fragment-local delta (start - offset), corrupting the split-buffer layout and enabling information disclosure or further memory corruption. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%, 11th percentile), and it is not listed in CISA KEV.
MACsec replay-protection bypass in the Linux kernel allows an adjacent attacker to indefinitely replay a captured frame on Extended Packet Numbering (XPN) associations. Because macsec_post_decrypt() computes pn + 1 on a u32, the value 0xFFFFFFFF wraps to 0 and fails to advance next_pn_halves, so lowest_pn never rises and the same IV keeps validating. EPSS is low (0.21%, 11th percentile) and there is no public exploit identified at time of analysis, but the CVSS of 8.1 reflects high integrity and availability impact against encrypted L2 links.
Memory-corruption/stale-pointer flaw in the Linux kernel's IPv6 extension-header processing (net/ipv6/exthdrs.c) where the network-header pointer is not refreshed after ipv6_hop_jumbo() invokes pskb_trim_rcsum(), which can reallocate or relocate the socket buffer. Affects the IPv6 hop-by-hop jumbogram code path across a very broad range of kernel versions from 2.6.12 onward, and is reachable by remote attackers sending crafted IPv6 packets; NVD scores it CVSS 9.8 but EPSS is only 0.21% (11th percentile) and there is no public exploit identified at time of analysis. The upstream fix is merged and backported to stable trees (e.g., 6.6.143, 6.1.176, 6.12.93, 5.15.210, 5.10.259).
Kernel-level out-of-bounds write in the Linux octeontx2-af driver (Marvell OcteonTX2 admin function) lets a low-privileged VF whose parent PF is in switchdev representor mode corrupt kernel memory. The rvu_mbox_handler_rep_event_notify() handler queues a sender-controlled REP_EVENT_NOTIFY body whose nested event->pcifunc is never bounds-checked, so an out-of-range index reaches rvu_get_pfvf()/rvu_get_pf() and, on RVU_EVENT_MAC_ADDR_CHANGE, becomes a six-byte attacker-chosen OOB ether_addr_copy() write in the AF worker (KASAN slab-out-of-bounds in rvu_rep_wq_handler). No public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with niche Marvell SmartNIC hardware rather than mass exposure.
Out-of-bounds/stale-pointer read in the Linux kernel's IPv6 extension-header parser (net/ipv6/exthdrs.c) affects systems processing IPv6 Destination Options containing the Home Address Option (HAO). After ipv6_dest_hao() invokes pskb_expand_head() on a cloned skb - which can relocate the packet buffer - ip6_parse_tlv() continues using a stale cached network-header pointer, causing trailing padding/TLVs to be parsed from freed or moved memory. This is an information-disclosure/memory-safety defect (Linux CNA tag: Information Disclosure); there is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and it is not in CISA KEV.
Cross-tenant network traffic redirection in the Linux kernel's IPv6 Virtual Tunnel Interface (vti6) affects hosts running IPv6 VTI/IPsec tunnels, particularly multi-tenant container platforms. A local attacker with a user namespace can move a vti6 tunnel into their own netns via IFLA_NET_NS_FD and then issue SIOCCHGTUNNEL, exploiting an inconsistency where vti6_siocdevprivate() performs its collision lookup against dev_net(dev) while vti6_update() mutates the original creation netns hash, letting the attacker prepend their controlled device at the head of another tenant's hash bucket so that xfrm-matched packets are delivered through a device they control. It is reachable from an unprivileged user namespace and no public exploit has been identified at time of analysis; EPSS is low at 0.22%.
Information disclosure (slab-out-of-bounds read) in the Linux kernel IPv6 datagram stack lets a local unprivileged attacker leak adjacent kernel slab memory and potentially crash the system. The flaw lives in ip6_datagram_recv_specific_ctl(), which trusts the on-wire extension-header length byte when building IPV6_HOPOPTS/DSTOPTS/RTHDR control messages; because nftables is reachable from an unprivileged user namespace, an attacker can rewrite that length after parse-time validation and force put_cmsg() to copy up to 2040 bytes from an 8-byte header. There is no public exploit and it is not in CISA KEV (EPSS 0.21%), so risk is credible but not yet demonstrated at scale.
Use-after-free in the Linux kernel IPsec transport-mode input path (xfrm) allows a struct net pointer cached in skb->cb to be dereferenced after the associated network namespace has been torn down, because deferred reinjection via xfrm_trans_reinject() did not hold a netns reference. On affected kernels (5.6 through the fixed stable releases) this can corrupt kernel memory or crash the host when IPsec transport-mode traffic is processed during namespace destruction. No public exploit identified at time of analysis; EPSS is low (0.23%, 13th percentile) and the issue is not listed in CISA KEV.
Local privilege-boundary memory corruption in the Linux kernel L2TP subsystem (net/l2tp) arises because l2tp_session_get_by_ifname() took its reference with a bare refcount_inc() instead of refcount_inc_not_zero(), letting an RCU reader acquire a session whose refcount already hit zero and dereference freed slab memory. Affected kernels include the 6.12.x and 6.18.x stable series (fixed in 6.12.93, 6.18.35, 7.0.12 and 7.1), and the flaw is a race between the IDR/RCU lookup and l2tp_session_free()->kfree_rcu() that is genuinely reachable on PREEMPT_RT builds. There is no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a hard-to-win local race rather than a widely weaponized bug.
Use-after-free memory corruption in the Linux kernel's IPv6 VTI (Virtual Tunnel Interface, vti6) tunnel driver allows a local attacker with access to unprivileged user namespaces to corrupt kernel memory and crash the host or potentially escalate. The flaw arises when a vti6 tunnel device is moved between network namespaces and then reconfigured; the driver tracks the wrong namespace, leaving a stale hash entry that cleanup_net() later dereferences as freed memory. No public exploit identified at time of analysis and EPSS probability is low (0.21%), but the cross-tenant reachability on container hosts makes it a meaningful risk in multi-tenant environments.
Out-of-bounds kernel write in the Linux `wacom` HID driver affects the `wacom_hid_set_device_mode()` routine across long-lived kernel branches (5.10 through 7.x). The driver wrongly assumes the HID_DG_INPUTMODE usage always lives in the report's first field, so a HID device (Wacom-class or a device spoofing one) that places that usage in a later field with a smaller report_count triggers a write past the bounds of `r->field[0]->value`, corrupting kernel memory. No public exploit is identified at time of analysis and EPSS risk is low (0.21%, 11th percentile), consistent with a bug that requires attacker-supplied hardware rather than remote reachability.
Out-of-bounds heap read and remote kernel panic in the Linux kernel NFC HCI/HCP stack (nfc_hci_recv_from_llc() and nci_hci_data_received_cb()) let an adjacent malicious NFC peer send a crafted 0-byte HCP frame that reaches these handlers before any length check, reading packet->header past the buffer and, when the frame is queued as a non-final fragment, underflowing msg_len to UINT_MAX and forcing skb_over_panic(). No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the flaw is not in CISA KEV, so this is a proximity-limited DoS/info-leak affecting any NFC-enabled Linux device, fixed by the maintainers. Exploitation requires NFC radio range and an active NFC/HCI stack, which sharply narrows the real attack surface versus the raw 8.8 score.
Cross-network-namespace information disclosure in the Linux kernel's XFRM/IPsec subsystem allows XFRM_MSG_MIGRATE (IKEv2 MOBIKE) notifications to leak between namespaces because xfrm_send_migrate() and pfkey_send_migrate() hardcode init_net for their multicast. An IKE daemon (e.g. strongSwan) listening on init_net's XFRMNLGRP_MIGRATE / pfkey BROADCAST_ALL groups receives migration events — including IPsec selectors and old/new endpoint addresses — that originated in other, isolated network namespaces. There is no public exploit identified at time of analysis and EPSS probability is low (0.21%); the fix is upstream in stable trees.
Improper TCP connection teardown in the Linux kernel netfilter conntrack subsystem lets remote attackers prematurely terminate active NAT/connection-tracked sessions by injecting an RST packet with an invalid sequence number after a SYN, without the state machine verifying packet direction. The flaw affects the nf_conntrack TCP state machine across numerous stable kernel branches and primarily threatens availability of tracked connections. EPSS is low (0.23%, 13th percentile) and there is no public exploit identified at time of analysis; a vendor patch is available across multiple stable trees.
Out-of-bounds memory access in the Linux kernel IPsec ESP output path (xfrm/esp) occurs when the out-of-place fast path appends the ESP trailer in esp_output_head() but the head-side length gate checks skb->data_len and tailen separately, while esp_output_tail() later allocates a single destination page fragment from the combined post-trailer skb->data_len. When the combined aligned length exceeds one page, skb_page_frag_refill() may return a single page while the destination scatterlist still spans the larger combined length, producing a scatter-gather over-read/over-write. Affected are kernels using ESP transforms for both IPv4 and IPv6; the fix restores the combined-length page gate. No public exploit is identified at time of analysis and EPSS risk is low (0.21%, 11th percentile).
Local privilege escalation and memory corruption in the Linux kernel's XFRM IP-TFS (IPTFS) tunnel subsystem (introduced in 6.14) arises because iptfs_clone_state() shallow-copies runtime state via kmemdup() during IPsec SA cloning. If xfrm_state_migrate() fails after the clone but before re-initialization, the garbage collector can free skbs still owned by the original SA queue, yielding use-after-free and double-free. A local low-privileged actor able to drive IPsec SA migration on an IPTFS-configured tunnel can trigger the flaw; there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Local privilege-boundary memory corruption in the Linux kernel dma-buf subsystem allows a local user to trigger a slab-use-after-free via a race in the dma_buf_fd() tracepoint (DMA_BUF_TRACE). After the FD_ADD() conversion, a thread sharing the file descriptor table can close() the freshly installed dma-buf fd before the tracepoint dereferences dmabuf->name_lock, freeing the object under the trace. Fixed in stable 7.0.12 and 7.1; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.19%.
Heap out-of-bounds read in the Linux kernel's ksmbd in-kernel SMB3 server allows an authenticated remote user to read 2 bytes past the pntsd allocation during SMB2_CREATE handling, potentially leaking adjacent heap memory or crashing the kernel. The flaw is a regression: commit d07b26f39246 introduced a transposed bounds check in smb_check_perm_dacl() that always evaluates false, turning the ACE-size guard into dead code and re-opening a previously fixed OOB. No public exploit identified at time of analysis, and EPSS risk is low (0.21%, 12th percentile); it is not on CISA KEV.
Memory corruption in the Linux kernel's USB MUSB OMAP2430 glue driver (drivers/usb/musb/omap2430.c) stems from a use-after-free in omap2430_probe(), where of_node_put() releases the device-tree node reference before the node is last accessed. On affected TI OMAP2430-class platforms an attacker able to influence driver probe (device bind/unbind, hotplug, or device-tree handling) could trigger access to freed kernel memory, potentially corrupting kernel state. EPSS is low (0.21%, 11th percentile) and there is no public exploit identified at time of analysis; the fix is merged upstream across multiple stable branches.
Local privilege-boundary memory corruption in the Linux kernel USB gadget FunctionFS (f_fs) driver lets a process with access to the FunctionFS control node trigger a use-after-free by racing a DMABUF request completion against a FUNCTIONFS_DMABUF_DETACH ioctl or the file-close path. The completion frees the usb_request but leaves the priv->req back-pointer dangling, so the cancel path passes freed memory to usb_ep_dequeue(), corrupting kernel memory on SG-capable UDCs (chipidea, cdnsp) that dereference the request immediately. EPSS is low (0.20%, 10th percentile) and there is no public exploit identified at time of analysis; a vendor patch is available across stable trees.
Out-of-bounds kernel memory read in the Linux kernel Thunderbolt (thunderbolt) driver's XDomain property parser lets a malicious directly-connected Thunderbolt/USB4 peer leak kernel memory contents. The flaw stems from a u32 integer wrap in tb_property_entry_valid(), where a crafted property entry (value=0xffffff00, length=0x100) wraps the bounds check and causes tb_property_parse() to read attacker-directed memory far past the property block allocation; leaked bytes for TEXT-typed 'deviceid'/'vendorid' keys become readable via the per-XDomain device_name/vendor_name sysfs attributes. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, and EPSS is low (0.21%), consistent with a physical-access adjacent-only information-disclosure bug.
Denial-of-service in the Linux kernel's generic Fibre Channel transport (scsi_transport_fc) lets an adjacent fabric actor hang a host driving an lpfc (Emulex) or qla2xxx (QLogic) FC HBA. By sending a crafted FPIN ELS frame whose 32-bit pname_count exceeds 255, an attacker wraps a u8 loop counter in the Link-Integrity and Peer-Congestion descriptor walkers, producing a non-terminating loop (non-return) in kernel context. No public exploit is identified at time of analysis and EPSS is low (0.20%), but the flaw is remotely triggerable without authentication from within the SAN fabric.
Remote denial-of-service and slab corruption in the Linux kernel iSCSI target (LIO) subsystem affects the Text-phase command handler iscsit_handle_text_cmd(), where two latent bugs have existed since the original LIO integration (commit e48354ce078c). A CRC32C overread reads four bytes past a kzalloc'd buffer on every Text PDU when DataDigest=CRC32C is negotiated, and a stale cmd->text_in_ptr causes a double-free on ErrorRecoveryLevel>0 bad-DataDigest drops and at session teardown. On distro kernels built with CONFIG_SLAB_FREELIST_HARDENED=y (the default) the double-free becomes a remote kernel BUG(); on non-hardened builds it corrupts the slab freelist. No public exploit identified at time of analysis, though the flaw is directly reproducible under KASAN; not listed in CISA KEV and EPSS is low (0.22%).
Heap buffer overflow in the Linux kernel iSCSI target (LIO/TCM) subsystem lets a remote attacker who can reach the target's login service corrupt kernel memory during login text-key negotiation. The iscsi_encode_text_output() path performs unbounded sprintf() concatenation of "key=NotUnderstood" response records into a fixed 8 KiB login->rsp_buf, and a single Login PDU packed with ~2048 minimal unknown key/value pairs expands to roughly 32 KiB of output, producing a ~24 KiB overrun in the kmalloc-8k slab. CVSS is rated 9.8, but EPSS is low (0.22%, 13th percentile); no public exploit is identified at time of analysis and it is not on CISA KEV.
Heap out-of-bounds write in the Linux kernel iSCSI target (LIO) driver lets a remote attacker overflow the heap-allocated client_digest buffer by supplying an over-length BASE64-encoded CHAP_R response during login. chap_server_compute_hash() decodes up to 127 base64 characters (95 bytes) into a buffer sized to the digest (32 bytes for SHA-256, 16 for MD5), overflowing it by 63-79 bytes before the too-late length check at line 344. The input assigns CVSS 9.8; however EPSS is low (0.21%, 11th percentile), it is not in CISA KEV, and no public exploit was identified - indicating a serious memory-corruption bug that is not yet being exploited.
Local privilege escalation potential in the Linux kernel's DRM/GEM (Direct Rendering Manager Graphics Execution Manager) subsystem stems from a use-after-free triggered by a race in the drm_gem_change_handle_ioctl path. A local user with access to a DRM device node can race a GEM_CLOSE against a handle-change operation to drop a GEM object's reference count to zero and free it while another handle's IDR entry still points at it, yielding a dangling kernel pointer. No public exploit has been identified at time of analysis and it is not in CISA KEV; EPSS is low (0.20%, 10th percentile), consistent with a local-only race that is non-trivial to weaponize.
Local privilege escalation or denial of service in the Linux kernel's Intel i915 GPU driver stems from a use-after-free in the TTM object purge path (i915_ttm_purge), where the bo->ttm page-vector container can be replaced by ttm_bo_validate() during eviction, leaving a stale i915_tt pointer that is later dereferenced. A user on DG2 (Intel Arc/discrete) hardware reproduced this as a general protection fault under heavy GPU load during buffer-object eviction. There is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS (0.21%), but the CVSS 7.8 local vector reflects high confidentiality, integrity, and availability impact if the freed memory is groomed and reclaimed.
TX-completion memory mishandling in the Linux kernel's Intel igc (I225/I226 2.5GbE) driver stems from igc_fpe_init_smd_frame() failing to set the tx-buffer type on SMD (Frame Preemption) frames, so a reused igc_tx_buffer can retain a stale XDP or XSK type and be freed through the wrong cleanup path. This affects local systems running an igc NIC with Frame Preemption active, and the realistic impact is memory corruption or a driver crash rather than remote compromise. No public exploit identified at time of analysis; EPSS is very low (0.17%, 6th percentile) and it is not in CISA KEV, despite the NVD-assigned 9.8 CVSS.
Kernel memory corruption in the Linux MANA (Microsoft Azure Network Adapter) driver lets a malicious or compromised hypervisor bypass a bounds check via a time-of-check/time-of-use double-fetch of hwc_msg_id from a shared DMA buffer. In a Confidential VM (SEV-SNP/TDX), DMA-coherent memory is unencrypted and host-visible, so the host can alter the message ID after mana_hwc_rx_event_handler() validates it but before mana_hwc_handle_resp() re-reads it for test_bit() and pointer arithmetic, driving an out-of-bounds access in guest kernel memory. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and it is not in CISA KEV.
Use-after-free in the Linux kernel's RDMA/rtrs (RDMA Transport) server module allows corruption of freed memory during the error-cleanup path of rtrs_srv_create_path_files(). When sysfs path-file creation partially fails, cleanup calls kobject_put() (which can free srv_path via the rtrs_srv_release callback) before rtrs_srv_destroy_once_sysfs_root_folders() dereferences that now-freed structure. Reported upstream by Linux/kernel maintainers with a vendor patch available; there is no public exploit identified and EPSS exploitation probability is low (0.17%, 7th percentile), consistent with a hard-to-reach error path in a niche subsystem rather than a broadly weaponizable flaw.
Use-after-free in the Linux kernel's bridge multicast (br_multicast) subsystem lets a local user with network-configuration capability crash the host or potentially execute code by toggling global multicast snooping while per-VLAN multicast snooping is enabled on a VLAN-filtering bridge. The flawed logic can leave both per-port and per-{port, VLAN} multicast contexts active simultaneously, so a per-port context (including its query timer) survives after the bridge port is freed, yielding a UAF confirmed by kernel debug tooling (ODEBUG free-active). No public exploit has been identified and EPSS is low (0.17%), but a deterministic reproducer is included in the fix, and the CVSS is 7.8 (High).
Local privilege escalation / memory-corruption potential in the Linux kernel's EROFS filesystem arises from a managed-cache race condition affecting unaligned compressed extents. When two threads process the same Z_EROFS_PREALLOCATED_FOLIO for different pclusters, one thread can call filemap_add_folio() a second time on a folio whose private state was not yet cleared, corrupting the managed page cache. Rated CVSS 7.8 (AV:L), it affects EROFS images built with unaligned data compression (e.g. -E48bit with zstd); EPSS is low (0.17%, 6th percentile), it is not in CISA KEV, and no public exploit identified at time of analysis.
Remote kernel crash in the Linux kernel's mac80211 WiFi stack affects WiFi 7 (802.11be) clients: the ieee80211_ml_epcs() handler fails to bounds-check the 4-bit link_id (0-15) extracted from an EPCS PER_STA_PROFILE subelement, but sdata->link[] holds only 15 entries (indices 0-14), so link_id=15 reads out of bounds. A connected access point can send an EPCS Enable Response action frame with link_id=15 to read a garbage pointer that bypasses the NULL check and is dereferenced in ieee80211_sta_wmm_params(), crashing the kernel. There is no public exploit identified at time of analysis, EPSS is low (0.17%), and this is a denial-of-service (kernel panic) rather than the code-execution/data-disclosure implied by the vendor CVSS.
Local privilege-escalation-capable memory corruption in the Linux kernel's ALSA sequencer UMP (MIDI 2.0) client code allows a local user with access to the sound sequencer to trigger a use-after-free. seq_ump_process_event() borrows client->out_rfile.output without synchronizing against the ALSA sequencer output open/close transitions, so a last-close can free the rawmidi substream and its runtime while an in-flight event_input callback is still executing snd_rawmidi_kernel_write(). The race is confirmed reproducible under KASAN as a slab-use-after-free, but there is no public exploit identified at time of analysis and EPSS risk is low (0.17%, 6th percentile).
Use-after-free in the Linux kernel's net shaper subsystem allows a local, low-privileged attacker to trigger memory corruption via a race condition in the network shaper API's XArray-based entry tracking. Because XArray 'VALID' marks are not stored atomically with their entries, a reader can observe a VALID slot, be preempted while a writer replaces the entry, and then dereference a stale pointer that net_shaper_rollback() has already freed, enabling potential privilege escalation or information disclosure. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 6th percentile).
Local information disclosure and memory corruption in the Linux kernel's rxrpc (AF_RXRPC/AFS) subsystem allows a local user of an encrypted rxrpc socket to trigger pagecache corruption because DATA packets were decrypted in-place on shared sk_buffs while splice() referenced the same pages. This is a hardening follow-up to CVE-2026-43500, replacing in-place decryption with a per-call bounce buffer so recvmsg() copies clean data and the sk_buff is never mutated. No public exploit identified at time of analysis, EPSS is low (0.17%, 6th percentile), and it is not listed in CISA KEV, consistent with a niche kernel subsystem rather than a mass-exploitation target.
Use-after-free in the Linux kernel's BPF sockmap (skmsg) receive path arises when a socket is added to a BPF_SK_SKB_VERDICT sockmap before kernel TLS (kTLS) RX is configured, letting sk_psock_verdict_data_ready() drain the TCP receive queue that the TLS strparser believes it owns. The mismatch leaves the strparser's frag_list pointing at freed, psock-owned skbs, which tls_decrypt_sg() then walks, corrupting kernel memory. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis, but a kernel-space UAF with high confidentiality, integrity, and availability impact makes this a meaningful local privilege-escalation and denial-of-service risk on affected builds.
Predictable TCP Initial Sequence Number (ISN) generation in the Linux kernel's TCP stack (introduced in 6.10) stems from a stale per-CPU tcp_tw_isn value leaking between packets. A regression moved the TIME_WAIT-derived ISN from the per-skb control block to a per-CPU variable on the assumption it would always be consumed by the same packet; when that packet is instead dropped on any of several intermediate paths, the value persists and the next SYN handled on that CPU inherits a non-zero, potentially predictable ISN, weakening TCP connection integrity. NVD assigns CVSS 9.4, but EPSS is low at 0.17% (6th percentile), there is no public exploit identified at time of analysis, and it is not in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel GPIO aggregator driver (gpio-aggregator) arises from a use-after-free on the error-handling path, where `aggr->lookups->dev_id` is freed before the lookup entry is removed from the table. A concurrent thread calling `gpiod_find()` can then dereference the freed `dev_id` via `strcmp()` in `gpiod_match_lookup_table()`, yielding a UAF that a low-privileged local attacker could leverage for code execution or DoS. There is no public exploit identified at time of analysis, and EPSS is low (0.17%), consistent with a race-condition kernel bug requiring local access rather than a mass-exploitation candidate.
Memory (kmalloc) leak in the Linux kernel's nvme-pci driver allows exhaustion of kernel memory over time on hosts using NVMe peer-to-peer (P2P) DMA. Because P2P memory is never unmapped, the driver has no need to track it, yet the dma_vec allocation used for tracking was never freed on I/O completion, leaking on every affected request. The flaw affects kernel 6.17 and is fixed in stable; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%).
Out-of-bounds array access in the Linux kernel's Microsoft Azure Network Adapter (mana) driver lets a malicious hypervisor corrupt guest kernel memory within Confidential VMs. In mana_hwc_rx_event_handler(), the rx_req_idx index is read from host-shared DMA-coherent memory (a WQE's sge->address) without a bounds check, so in SEV-SNP/TDX guests the untrusted host can steer the index to read/write past the reqs[] array. There is no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a defense-in-depth hardening fix for the confidential-computing threat model rather than an actively exploited flaw.
Local privilege-escalation-class memory corruption in the Linux kernel's blk-mq multi-queue block layer allows a local low-privileged user to trigger a use-after-free when submitting a bio: if the task sleeps after peeking a cached request but before popping it, the plug flush frees the cached_rqs, leaving a dangling pointer. The flaw affects mainline and multiple stable trees (6.1.x, 6.5.x, 6.6.x, 6.7) and carries CVSS 7.8 (high CIA impact). There is no public exploit identified at time of analysis, and the very low EPSS (0.15%, 5th percentile) reflects the difficulty of winning the required timing race rather than low structural severity.
Kernel use-after-free in ksmbd, the Linux in-kernel SMB3 server, occurs when a durable handle reconnect succeeds but smb2_open() then hits a later error path. The cleanup logic double-frees the same ksmbd_file (once via ksmbd_fd_put and again via the non-session-aware ksmbd_put_durable_fd), freeing the file object while its volatile-id entry remains published in the session table. This dangling entry can be reused, giving a remote SMB client a path to kernel memory corruption; it is not in CISA KEV and no public exploit identified at time of analysis, with EPSS at a low 0.17%.
Use-after-free in the Linux kernel keyring subsystem (security/keys) allows a local low-privileged user to read freed memory because find_key_to_update() calls assoc_array_find() without holding the RCU read lock, racing against assoc_array_gc() which frees nodes after an RCU grace period. The flaw is exercised specifically through the persistent-keyring path, which does not rely on the keyring semaphore that masks the issue for regular keys. No public exploit identified at time of analysis; EPSS probability is low (0.17%, 7th percentile) and it is not listed in CISA KEV.
Local privilege escalation risk arises from a use-after-free in the Linux kernel's NFC LLCP subsystem, where llcp_sock_release() unconditionally unlinks a socket from the local sockets list even when the socket is still in the connecting state and actually resides on the connecting list. A local user able to open NFC LLCP sockets can trigger memory corruption during socket release, with high confidentiality, integrity and availability impact per the CVSS 7.8 rating. No public exploit identified at time of analysis, and EPSS is low (0.18%), consistent with a local-only, hardware-gated attack surface.
Use-after-free in the Linux kernel NFC LLCP subsystem allows an adjacent attacker to corrupt kernel memory by racing a connection-complete (CC) packet against socket release in nfc_llcp_recv_cc(). Affected are kernels using the NFC Logical Link Control Protocol stack; successful exploitation of the race can yield kernel memory corruption leading to potential privilege escalation or denial of service. No public exploit identified at time of analysis, and EPSS probability is low (0.18%), consistent with a memory-safety race that is hard to trigger and requires NFC proximity.
Local privilege-scoped memory corruption in the Linux kernel's IPsec/xfrm subsystem allows a low-privileged user with network-configuration capability to trigger a massive out-of-bounds kernel write. The xfrm_state_mtu() helper computes an ESP MTU in unsigned modulo-2^32 arithmetic; by installing an IPv4 ESP tunnel SA with an oversized truncated auth key, a tiny interface MTU, and a large XFRMA_TFCPAD value, an attacker forces the result to underflow, and esp_output() later treats it as a negative signed length passed to memset() — producing a near-16 EB write of zeroes at the skb tail. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and the flaw is not in CISA KEV, but the ubiquity of the Linux kernel makes patching important.
Local privilege escalation via use-after-free in the Linux kernel accel/rocket driver (Rockchip NPU accelerator) allows an authenticated local user with access to the accel device node to dereference freed slab memory. The flaw stems from rocket_ioctl_create_bo() registering a GEM handle in the file IDR before fallible operations (sgt allocation, drm_mm insert, iommu_map); on failure the object is freed while the handle stays live, and any later PREP_BO/FINI_BO/SUBMIT ioctl triggers the UAF. No public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile).
Kernel memory corruption in the Linux netfilter SYNPROXY module (synproxy_tstamp_adjust) lets remote hosts trigger a use-after-free write against systems that deploy the SYNPROXY target for TCP SYN-flood mitigation. When processing a cloned or non-linear packet, skb_ensure_writable() reallocates and frees the old skb->head, but the code then writes the recomputed TCP checksum through a stale header pointer - landing in freed slab memory or leaving a wrong on-wire checksum. Rated CVSS 9.8 by the automated feed, but EPSS is only 0.18% (7th percentile), it is not in CISA KEV, and no public exploit identified at time of analysis.
Memory corruption in the Linux kernel's SMC (Shared Memory Communications) networking subsystem arises because smc_init() re-runs INIT_HLIST_HEAD() on the smc_v1/smc_v2 hashtables after they may already hold live hash entries, resetting the list heads and corrupting an in-use linked list. A local user able to trigger SMC socket activity during the vulnerable window can cause list corruption leading to high confidentiality, integrity, and availability impact per the CVSS 7.8 (AV:L) rating. This is not actively exploited - no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.18%.
Local denial of service in the Linux kernel's AF_IUCV networking stack allows any unprivileged user on an s390/IBM Z host to crash the machine by racing recvmsg() against getsockopt(SO_MSGSIZE) on a HiperSockets (HIPER) socket. The .getsockopt handler dereferenced iucv->hs_dev->mtu without holding lock_sock(), so a concurrent iucv_sock_close() (triggered from recvmsg) could set hs_dev to NULL between the check and the dereference, producing a NULL pointer dereference oops. EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis; the upstream fix wraps the entire getsockopt switch in lock_sock()/release_sock() to mirror the existing setsockopt locking.
Denial of service in the Linux kernel SCSI core allows a device removal process to hang when SCSI devices in a partially-removed state (SDEV_CANCEL) retain requeued requests that are never kicked. Because scsi_run_host_queues() relied on shost_for_each_device()/scsi_device_get(), which skips devices not in a runnable state, requests queued during host error recovery stayed stuck after recovery cleared. The fix broadens scsi_run_host_queues() to run queues for every device except those in SDEV_DEL or where a reference cannot be acquired. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile).
Use-after-free in the Linux kernel's IPv4 sysctl teardown path (ipv4_sysctl_exit_net) can corrupt kernel memory because net->ipv4.sysctl_local_reserved_ports is freed before unregister_net_sysctl_table(), leaving a window where threads accessing /proc/sys/net/ipv4/ip_local_reserved_ports reference freed memory. A local low-privileged attacker able to trigger network namespace teardown could leverage the dangling pointer for memory corruption, information disclosure, or potential privilege escalation. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the issue is not on CISA KEV, consistent with a fix delivered quietly through the kernel stable process.
Out-of-bounds memory access in the Linux kernel's HSR (High-availability Seamless Redundancy) networking subsystem allows a crafted, truncated supervision frame to trigger an OOB read when the code accesses a TLV header that was not fully linearized into the socket buffer. The flaw affects systems running the net/hsr driver across numerous stable kernel branches (fixed in 6.1.176, 6.6.143, 6.12.93, 6.18.35 and others). No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a niche, protocol-specific attack surface rather than broad exploitation.
Out-of-bounds kernel write in the Linux kernel's ethtool CMIS CDB handling (cmis_cdb_process_reply) allows a malicious or buggy SFP/QSFP transceiver module to corrupt kernel memory by returning a CDB reply whose rpl_len exceeds the expected rpl_exp_len. Affected callers (password validation, module feature discovery, and firmware-management feature discovery) cast the reply payload to fixed-layout structs at fixed offsets, so an over-long reply writes past the kmalloc'd page buffer. There is no public exploit identified at time of analysis, EPSS risk is low (0.17%), and it is not on CISA KEV; the fix is a defensive exact-length check merged upstream and backported to stable trees.
Out-of-bounds kernel write in the Linux kernel's ethtool CMIS firmware-update path (cmis_fw_update_start_download) lets a malicious or malfunctioning pluggable transceiver module overflow a 112-byte stack/heap buffer by returning an oversized start_cmd_payload_size in its CDB FW Management Features reply. The value is used unchecked as a memcpy byte count, so any attacker able to present a crafted module-or corrupt its CDB response-can corrupt adjacent kernel memory. EPSS is very low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; the fix simply rejects payload sizes larger than the destination buffer.
Use-after-free in the Linux kernel IP tunnel path-MTU discovery code (iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6()) arises because ip_hdr()/ipv6_hdr() pointers were cached before an skb_cow() that can reallocate skb->head, leaving the code operating on freed memory when generating ICMP/ICMPv6 fragmentation-needed messages for tunnel traffic. On systems with IP tunnels configured, an attacker able to drive oversized traffic through the tunnel can trigger the freed-memory access, risking a kernel information leak (the issue is tagged Information Disclosure) or memory corruption/crash. No public exploit identified at time of analysis, EPSS probability is low (0.18%), and the fix is already merged across the stable trees.
Use-after-free in the Linux kernel's VXLAN tunnel driver (drivers/net/vxlan) arises because the transmit path caches the result of ip_hdr() into old_iph and reuses it after skb_tunnel_check_pmtu(), which may reallocate skb->head and invalidate that pointer. Affected are kernels from 5.9 through the fix commits (patched in 6.1.176, 6.6.143, 6.12.93, 5.15.210, 5.10.259, 6.18.35, 7.0.12 and 7.1) on hosts using VXLAN overlays; an attacker able to drive traffic through the tunnel can trigger memory corruption leading to information disclosure or a kernel crash. There is no public exploit identified at time of analysis and EPSS is low (0.18%, 7th percentile), so this is not currently associated with active exploitation despite the CVSS 9.8 rating.
Out-of-bounds memory access in the Linux kernel's IP tunnel path-MTU discovery code (iptunnel_pmtud_check_icmp) affects IPv4 tunnel interfaces where the function may run on packets whose skb transport header is unset, causing an ~65535-byte offset read past the linear buffer. Remote attackers can trigger this by sending crafted ICMP traffic to a tunnel endpoint, potentially leaking adjacent kernel memory or crashing the host (denial of service). This is a supplier-reported (Linux stable) fix with no public exploit identified at time of analysis and a low EPSS score of 0.18%.
Out-of-bounds heap write in the Linux kernel ethtool netlink coalesce interface allows a local privileged user (CAP_NET_ADMIN) to corrupt kernel memory beyond a 5-element IRQ moderation profile buffer, enabling privilege escalation, denial of service, or information disclosure. The flaw lives in ethnl_update_profile(), which trusts a fully user-controlled Netlink nest count while writing into a kmemdup()'d array sized at NET_DIM_PARAMS_NUM_PROFILES (5). This has been resolved upstream and is not known to be exploited; EPSS probability is low (0.17%, 6th percentile) and no public exploit has been identified at time of analysis.
Out-of-bounds read in the Linux kernel's ethtool module-EEPROM Netlink fallback path allows a local privileged user to read memory beyond the intended EEPROM buffer. The flaw lives in fallback_set_params(), which checks that the requested offset is below eeprom_len but never validates that offset + length also stays within bounds - a check the ioctl path (ethtool_get_any_eeprom()) has always enforced. A compounding issue is the use of plain kmalloc() instead of a zeroed allocation, so uninitialized kernel memory may be returned to the caller. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and it is not in CISA KEV.
Out-of-bounds heap corruption in the Linux kernel's IPv6 RPL Source Routing Header handling (net/ipv6/exthdrs.c) allows remote attackers to corrupt the routing header of forwarded packets by sending a crafted compressed SRH. The bug stems from a __u8 truncation of the computed hdrlen in ipv6_rpl_srh_decompress(): with n=127 segments the value (128*16)>>3 = 256 wraps to 0, causing the compressed header to overlap the decompressed region so ipv6_rpl_srh_compress() writes into kernel memory it should not. Rated CVSS 9.8 but EPSS is only 0.18% (7th percentile); no public exploit and no CISA KEV listing exist at time of analysis, and exploitation requires an unrealistic 127-segment header on a node with RPL source routing enabled.
Denial of service in the Linux kernel's net/handshake (TLS handshake) subsystem allows a CPU-local deadlock on hosts acting as NVMe-over-TCP (nvmet_tcp) targets with in-kernel TLS. The nvmet_tcp_state_change() socket callback runs in softirq/BH context and reaches handshake_req_cancel(), which took hn->hn_lock with a plain spin_lock(); if a process-context thread on the same CPU already holds hn_lock when the softirq fires, the lock attempt deadlocks and hangs the CPU. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not on CISA KEV, so this is a stability/availability hardening fix rather than an actively exploited threat.
Use-after-free in the Linux kernel net/handshake subsystem (kernel 6.4 through the fixed 7.x builds) lets a concurrent handshake consumer free a struct socket and its backing file while the netlink accept path (handshake_nl_accept_doit) is dereferencing them, producing a NULL pointer read or freed-memory access. The flaw is a race between handshake_req_next() dropping hn_lock and the accept side reaching FD_PREPARE(), during which tls_handshake_cancel() plus sockfd_put()/__fput_sync() can release the object. No CISA KEV listing and no public exploit identified at time of analysis; EPSS is low at 0.19% (9th percentile) and the tags classify the practical impact as Denial of Service.
Kernel memory corruption and resource leakage in the Linux net/handshake subsystem stems from reversed list_splice_init() arguments in handshake_net_exit(), so pending TLS/handshake requests are never drained when a network namespace is destroyed. Fixing the splice direction then exposes a list-corruption and use-after-free race between the namespace-exit drain path and a concurrent handshake_req_cancel() (e.g. sunrpc TLS timeout), which can free a socket-backed handshake_req while it is still linked on the drain list. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile), and the record is not in CISA KEV.
Use-after-free / NULL-pointer dereference in the Linux kernel zl3073x DPLL (digital phase-locked loop) driver allows a local attacker to crash the system or potentially corrupt kernel memory during DPLL device teardown. Introduced in kernel 6.18 and fixed in stable 7.0.12/7.1, the flaw stems from the change_work item being re-scheduled after cancel_work_sync(), causing the handler to dereference a freed or NULL dpll_dev pointer. No public exploit identified at time of analysis; EPSS probability is low (0.15%, 5th percentile) and it is not listed in CISA KEV.
Improper channel-identifier handling in the Linux kernel Bluetooth L2CAP stack lets an in-range peer forcibly tear down an established Enhanced Credit (ECRED) connection. Because l2cap_ecred_reconf_rsp() returns on success without clearing chan->ident, a remote peer that completed a reconfiguration can replay a failure response carrying the stale ident, causing the kernel to match and destroy the live channel with l2cap_chan_del(chan, ECONNRESET); the fix also hardens the failure path against a use-after-free. No public exploit is identified at time of analysis and EPSS risk is low (0.31%).
Denial-of-service (kernel crash) in the Linux kernel Bluetooth L2CAP subsystem lets an in-range attacker trigger memory corruption by sending a crafted Enhanced Credit-Based (ECRED) connection response that reuses an already-assigned destination CID, corrupting the list_for_each_entry_safe cursor during channel teardown. All Linux systems with Bluetooth enabled and processing LE CoC ECRED channels are affected until patched. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile); the issue is not listed in CISA KEV.
Denial-of-service and potential memory-corruption exposure in the Linux kernel Bluetooth stack (hci_sync) arises because hci_dev_close_sync() failed to set the HCI_CMD_DRAIN_WORKQUEUE flag during device close, allowing command timeouts to be queued while the hdev workqueue is being drained on the reset path. The fix, present in stable trees (6.12.93, 6.18.35, 7.0.12, 7.1), closes a race that a Bluetooth-adjacent attacker could trigger during controller reset. There is no public exploit identified at time of analysis, EPSS risk is low (0.20%), and it is not listed in CISA KEV.
Denial of service in the Linux kernel MANA (Microsoft Azure Network Adapter) Ethernet driver allows the port reset recovery path to trigger a NULL pointer dereference and kernel crash. The flaw occurs when mana_per_port_queue_reset_work_handler() runs after a prior detach succeeded but a subsequent attach failed, leaving apc->tx_qp and apc->rxqs freed; a second unconditional mana_detach() then dereferences NULL during queue teardown. No public exploit has been identified, EPSS is low (0.20%, 10th percentile), and the CVSS 3.1 score is 7.5 driven purely by availability impact.
Local privilege escalation and memory corruption in the Linux kernel SCTP subsystem stems from a race condition where sctp_wait_for_connect() fails to detect that an association was migrated to a new socket via SCTP_SOCKOPT_PEELOFF while the socket lock was released. An attacker with a local account and the ability to open SCTP sockets can race a connecting association against a peeloff getsockopt() call, causing the connect path to operate on asoc->base.sk under the wrong socket lock in sctp_datamsg_from_user(). This is a fixed upstream kernel bug (EUVD-2026-45744) with a vendor patch available; no public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.21% (11th percentile).
Local memory corruption in the Linux kernel's vsock/virtio transport (AF_VSOCK) arises from a reference-counting lifetime mismatch in the MSG_ZEROCOPY send path, affecting kernels from 6.7 onward. Because virtio_transport_send_pkt_info() reuses or allocates the zerocopy uarg before virtio_transport_alloc_skb() fills the skb, a rollback after a partial fixed-buffer vectored zerocopy attach frees an skb that is flagged SKBFL_MANAGED_FRAG_REFS but has no uarg, causing skb_release_data() to take the wrong unref path. The CVSS 7.8 rating reflects high confidentiality, integrity, and availability impact from local access; there is no public exploit identified at time of analysis and EPSS is low at 0.20%.
Denial of service in the Linux kernel's IPv6 routing stack allows remote attackers to trigger an infinite loop in fib6_select_path(), hanging a CPU in softirq context and causing a system-wide hang or hard lockup. The flaw exists because writers holding tb6_lock can list_del_rcu() a route's fib6_siblings entry without waiting for RCU readers, leaving the softirq-side path-selection walker traversing a stale sibling ring that never reaches its list terminator. A vendor patch is available; EPSS is low (0.21%) and there is no public exploit identified at time of analysis, but the network-triggerable, no-privilege CVSS 7.5 vector makes it a meaningful availability risk on multipath IPv6 deployments.
Kernel panic (denial of service) in the Linux kernel's mm/vmalloc subsystem occurs because __get_vm_area_node() calls BUG_ON(in_interrupt()), and in_interrupt() also returns true when bottom halves (softirqs) are merely disabled rather than in a genuine interrupt context. A legitimate network-bridge path (br_fdb_add_local under spin_lock_bh) reaches vmalloc while BH is disabled, tripping the BUG() and crashing the kernel. NVD scores this A:H (availability only) with no public exploit identified at time of analysis; EPSS is low at 0.19% (9th percentile) and it is not in CISA KEV.
Local denial-of-service in the Linux kernel's HPFS (High Performance File System) driver allows a crash when hpfs_map_dnode_bitmap fails and the code subsequently calls hpfs_brelse4 on an uninitialized quad buffer head. Affected are Linux kernels prior to the fixed stable releases (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1) when an HPFS filesystem is mounted. There is no public exploit identified at time of analysis, KEV does not list it, and EPSS is very low (0.21%), consistent with a niche legacy-filesystem bug rather than a broadly weaponizable flaw.
Protection-mechanism bypass in the Linux kernel's memfd file-sealing subsystem lets a local low-privileged process hold writable mappings on a memfd while still applying SEAL_WRITE via the SEAL_EXEC path, defeating the immutability guarantee that consumers rely on. Because the implied SEAL_WRITE was set after the mapping_deny_writable() check rather than before, an attacker can hand a victim (e.g. a sandbox or loader) a memfd that reports as write-sealed yet remains arbitrarily modifiable. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and this is not on CISA KEV.
Local privilege escalation or denial of service in the Linux kernel's zram block device (writeback path) stems from a use-after-free in zram_writeback_endio, where the bio completion handler calls wake_up() on wb_ctl->done_wait after the writeback task may have already observed num_inflight reach zero and freed wb_ctl via release_wb_ctl(). Affecting kernels around 6.19/7.0 with zram writeback in use, a local attacker who can drive zram writeback activity may trigger the race to corrupt kernel memory, crashing the system or potentially escalating privileges. There is no public exploit identified at time of analysis and EPSS is low (0.21%), consistent with a hard-to-win kernel race rather than a trivially weaponizable bug.
Memory-management memory corruption in the Linux kernel's reverse-mapping (rmap) code lets a local, low-privileged user crash the system by corrupting folio refcount/mapcount state. The flaw lives in try_to_unmap_one() (mm/rmap.c), where the nr_pages counter is not reset to 1 at the start of each page-table-walk iteration, so a stale batch count from a prior lazyfree folio unmap is reused against a device-exclusive PTE. No public exploit identified at time of analysis and EPSS is low (0.20%, 10th percentile); the demonstrated userspace-visible effect is a kernel crash (denial of service).
Out-of-bounds read in the Linux kernel Bluetooth HIDP (Human Interface Device Protocol) subsystem lets a paired, malicious Bluetooth peripheral send a truncated interrupt frame that hidp_input_report() parses without validating skb->len, causing the handler to read past valid skb data. The stale bytes are interpreted as phantom keystrokes or spurious mouse movement, giving an adjacent attacker a limited local input-injection/info-leak primitive. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), consistent with a niche Bluetooth-range issue rather than mass exploitation; a vendor patch is available across multiple stable branches.
Memory corruption in the Linux kernel Bluetooth ISO (Isochronous Channels) subsystem allows an attacker within Bluetooth range to trigger a use-after-free on a socket structure via a race in iso_recv_frame(), where conn->sk is read under iso_conn_lock but dereferenced after the lock drops while a concurrent iso_sock_kill() frees the socket. Successful exploitation can corrupt kernel memory when accessing sk->sk_state and sock_queue_rcv_skb(), enabling denial of service and potentially privilege escalation or code execution in kernel context. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile).
Local privilege escalation or denial of service in the Linux kernel Bluetooth ISO (Isochronous Channels) subsystem arises from a race condition where iso_sock_close() calls iso_sock_clear_timer() before taking the socket lock, letting a concurrent iso_conn_del() free the connection object and trigger a NULL pointer dereference or use-after-free. Any local user able to open and close AF_BLUETOOTH ISO sockets can race the two code paths; UAF of a kernel connection structure can escalate from a crash to memory corruption. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and the issue is not in CISA KEV.
Use-after-free in the Linux kernel Bluetooth HCI subsystem (hci_sync) lets a concurrent Bluetooth disconnect free an hci_conn object that hci_le_create_cis_sync() then reads via a stale pointer, producing a use-after-free read during Connected Isochronous Stream (CIS) setup. The affected code path handles LE isochronous channel creation, and the flawed cancellation logic (queuing work with data=NULL while dequeuing with data=conn) means the pending work item is never cancelled, leaving the race exploitable. There is no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is not in CISA KEV.
Privilege-independent local crash in the Linux kernel's parport (parallel port) subsystem allows a race between port registration and client-driver attachment, where drivers such as lp bind to ports that are not yet fully initialised or are being torn down, causing a NULL/use-after-free style kernel crash. Affects systems where parport_pc and lp are built as modules and loaded concurrently during boot with PC-style parallel-port hardware present. No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and it is not listed in CISA KEV, consistent with the vendor 'Denial Of Service' tag rather than code execution.
Improper vector-length capping in the Linux kernel's KVM arm64 SVE handling lets a nested (L2) guest under a VHE guest hypervisor access Scalable Vector Extension vector lengths beyond its configured limit. When a guest hypervisor updates ZCR_EL2 indirectly via the untrapped ZCR_EL1 accessor, KVM restores the raw value into the physical ZCR_EL2 without capping, breaking the vector-length confinement policy. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.19%, 9th percentile); a vendor fix is available via the stable git tree.
Improper handling of zero-length Port I/O (PIO) requests in the Linux kernel's KVM AMD SEV/SEV-ES support allows a malicious confidential-computing guest to reach a length-underflow path when the hypervisor sets up the GHCB software scratch area. No public exploit has been identified at time of analysis and it is not on CISA KEV, though a vendor (upstream) patch is available. Despite a headline CVSS of 9.3, EPSS is only 0.20% (10th percentile), and the fix itself is a defensive hardening that ignores len/count '0' PIO to prevent length underflow.
Host-side buffer overflow in the Linux kernel's KVM AMD SEV/SEV-ES support (arch/x86/kvm/svm/sev.c GHCB handling) lets a malicious or compromised confidential guest corrupt host memory by abusing Page State Change (PSC) requests. KVM miscomputes the maximum length of the in-GHCB scratch area, treating the guest-supplied @len as the buffer's full size when for PSC it is only a minimum, allowing a guest to drive writes past the shared GHCB buffer. Rated CVSS 9.3 for a scope-changed guest-to-host escape; no public exploit is identified at time of analysis and EPSS is low (0.22%), but a vendor patch is available across multiple stable branches.
Out-of-bounds memory access in the Linux kernel's KVM AMD SEV-SNP subsystem allows a malicious or compromised confidential-computing guest to read or corrupt host hypervisor memory by supplying a Page State Change (PSC) request whose buffer pointer is not aligned to the start of the GHCB shared buffer. The flaw affects KVM hosts running SEV-SNP guests on kernels from 6.11 onward and carries a high CVSS of 9.3 (AV:L/S:C) reflecting a guest-to-host boundary crossing. EPSS is low (0.20%, 10th percentile), it is not on CISA KEV, and no public exploit has been identified at time of analysis; a vendor fix is available in the stable trees.
Time-of-check-to-time-of-use race condition in the Linux kernel's KVM AMD SEV code allows a malicious or misbehaving encrypted guest to corrupt the host's processing of Page State Change (PSC) requests by mutating the guest-accessible PSC buffer while KVM reads entries and indices from it. Because KVM read the buffer without READ_ONCE(), the compiler could reload values mid-processing, enabling a TOCTOU exploit path with a CVSS-rated scope-changed impact affecting the host beyond the guest. No public exploit has been identified at time of analysis, and the EPSS score is low (0.20%); the fix hardens the reads with READ_ONCE() to make the guest's writes irrelevant to already-validated values.
Local privilege escalation and memory corruption in the Linux kernel's Industrial I/O (IIO) buffer hardware-consumer subsystem stems from a use-after-free in the error-handling path of iio_hw_consumer_alloc(). When buffer allocation fails, the cleanup routine iterated the buffer list with the unsafe list_for_each_entry() macro while iio_buffer_put() could free the current buffer, causing the loop to dereference freed memory. CVSS is 7.8 (High) with local vector and low privileges; EPSS is low at 0.21% (11th percentile), and there is no public exploit identified at time of analysis, consistent with this being a defect reachable only in a rare allocation-failure path.
Local denial-of-service (and potential information disclosure) in the Linux kernel's dwc2 USB host controller driver, where debug code dereferences the 'urb' structure after it has already been handed back via usb_hcd_giveback_urb(), causing a use-after-free read of freed memory. The flaw affects systems using the DesignWare HS OTG USB 2.0 controller driver (common on ARM SoCs such as Raspberry Pi). It is patched upstream, has no public exploit identified at time of analysis, and carries a low EPSS score (0.21%).
Memory corruption in the Linux kernel's BPF sockmap subsystem allows a local actor to produce an inconsistent scatterlist layout via bpf_msg_push_data(). When a BPF sk_msg program inserts data into a non-first scatterlist entry, the right-fragment offset is over-advanced by the message-global insertion point instead of the fragment-local delta (start - offset), corrupting the split-buffer layout and enabling information disclosure or further memory corruption. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%, 11th percentile), and it is not listed in CISA KEV.
MACsec replay-protection bypass in the Linux kernel allows an adjacent attacker to indefinitely replay a captured frame on Extended Packet Numbering (XPN) associations. Because macsec_post_decrypt() computes pn + 1 on a u32, the value 0xFFFFFFFF wraps to 0 and fails to advance next_pn_halves, so lowest_pn never rises and the same IV keeps validating. EPSS is low (0.21%, 11th percentile) and there is no public exploit identified at time of analysis, but the CVSS of 8.1 reflects high integrity and availability impact against encrypted L2 links.
Memory-corruption/stale-pointer flaw in the Linux kernel's IPv6 extension-header processing (net/ipv6/exthdrs.c) where the network-header pointer is not refreshed after ipv6_hop_jumbo() invokes pskb_trim_rcsum(), which can reallocate or relocate the socket buffer. Affects the IPv6 hop-by-hop jumbogram code path across a very broad range of kernel versions from 2.6.12 onward, and is reachable by remote attackers sending crafted IPv6 packets; NVD scores it CVSS 9.8 but EPSS is only 0.21% (11th percentile) and there is no public exploit identified at time of analysis. The upstream fix is merged and backported to stable trees (e.g., 6.6.143, 6.1.176, 6.12.93, 5.15.210, 5.10.259).
Kernel-level out-of-bounds write in the Linux octeontx2-af driver (Marvell OcteonTX2 admin function) lets a low-privileged VF whose parent PF is in switchdev representor mode corrupt kernel memory. The rvu_mbox_handler_rep_event_notify() handler queues a sender-controlled REP_EVENT_NOTIFY body whose nested event->pcifunc is never bounds-checked, so an out-of-range index reaches rvu_get_pfvf()/rvu_get_pf() and, on RVU_EVENT_MAC_ADDR_CHANGE, becomes a six-byte attacker-chosen OOB ether_addr_copy() write in the AF worker (KASAN slab-out-of-bounds in rvu_rep_wq_handler). No public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with niche Marvell SmartNIC hardware rather than mass exposure.
Out-of-bounds/stale-pointer read in the Linux kernel's IPv6 extension-header parser (net/ipv6/exthdrs.c) affects systems processing IPv6 Destination Options containing the Home Address Option (HAO). After ipv6_dest_hao() invokes pskb_expand_head() on a cloned skb - which can relocate the packet buffer - ip6_parse_tlv() continues using a stale cached network-header pointer, causing trailing padding/TLVs to be parsed from freed or moved memory. This is an information-disclosure/memory-safety defect (Linux CNA tag: Information Disclosure); there is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and it is not in CISA KEV.
Cross-tenant network traffic redirection in the Linux kernel's IPv6 Virtual Tunnel Interface (vti6) affects hosts running IPv6 VTI/IPsec tunnels, particularly multi-tenant container platforms. A local attacker with a user namespace can move a vti6 tunnel into their own netns via IFLA_NET_NS_FD and then issue SIOCCHGTUNNEL, exploiting an inconsistency where vti6_siocdevprivate() performs its collision lookup against dev_net(dev) while vti6_update() mutates the original creation netns hash, letting the attacker prepend their controlled device at the head of another tenant's hash bucket so that xfrm-matched packets are delivered through a device they control. It is reachable from an unprivileged user namespace and no public exploit has been identified at time of analysis; EPSS is low at 0.22%.
Information disclosure (slab-out-of-bounds read) in the Linux kernel IPv6 datagram stack lets a local unprivileged attacker leak adjacent kernel slab memory and potentially crash the system. The flaw lives in ip6_datagram_recv_specific_ctl(), which trusts the on-wire extension-header length byte when building IPV6_HOPOPTS/DSTOPTS/RTHDR control messages; because nftables is reachable from an unprivileged user namespace, an attacker can rewrite that length after parse-time validation and force put_cmsg() to copy up to 2040 bytes from an 8-byte header. There is no public exploit and it is not in CISA KEV (EPSS 0.21%), so risk is credible but not yet demonstrated at scale.
Use-after-free in the Linux kernel IPsec transport-mode input path (xfrm) allows a struct net pointer cached in skb->cb to be dereferenced after the associated network namespace has been torn down, because deferred reinjection via xfrm_trans_reinject() did not hold a netns reference. On affected kernels (5.6 through the fixed stable releases) this can corrupt kernel memory or crash the host when IPsec transport-mode traffic is processed during namespace destruction. No public exploit identified at time of analysis; EPSS is low (0.23%, 13th percentile) and the issue is not listed in CISA KEV.
Local privilege-boundary memory corruption in the Linux kernel L2TP subsystem (net/l2tp) arises because l2tp_session_get_by_ifname() took its reference with a bare refcount_inc() instead of refcount_inc_not_zero(), letting an RCU reader acquire a session whose refcount already hit zero and dereference freed slab memory. Affected kernels include the 6.12.x and 6.18.x stable series (fixed in 6.12.93, 6.18.35, 7.0.12 and 7.1), and the flaw is a race between the IDR/RCU lookup and l2tp_session_free()->kfree_rcu() that is genuinely reachable on PREEMPT_RT builds. There is no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a hard-to-win local race rather than a widely weaponized bug.
Use-after-free memory corruption in the Linux kernel's IPv6 VTI (Virtual Tunnel Interface, vti6) tunnel driver allows a local attacker with access to unprivileged user namespaces to corrupt kernel memory and crash the host or potentially escalate. The flaw arises when a vti6 tunnel device is moved between network namespaces and then reconfigured; the driver tracks the wrong namespace, leaving a stale hash entry that cleanup_net() later dereferences as freed memory. No public exploit identified at time of analysis and EPSS probability is low (0.21%), but the cross-tenant reachability on container hosts makes it a meaningful risk in multi-tenant environments.
Out-of-bounds kernel write in the Linux `wacom` HID driver affects the `wacom_hid_set_device_mode()` routine across long-lived kernel branches (5.10 through 7.x). The driver wrongly assumes the HID_DG_INPUTMODE usage always lives in the report's first field, so a HID device (Wacom-class or a device spoofing one) that places that usage in a later field with a smaller report_count triggers a write past the bounds of `r->field[0]->value`, corrupting kernel memory. No public exploit is identified at time of analysis and EPSS risk is low (0.21%, 11th percentile), consistent with a bug that requires attacker-supplied hardware rather than remote reachability.
Out-of-bounds heap read and remote kernel panic in the Linux kernel NFC HCI/HCP stack (nfc_hci_recv_from_llc() and nci_hci_data_received_cb()) let an adjacent malicious NFC peer send a crafted 0-byte HCP frame that reaches these handlers before any length check, reading packet->header past the buffer and, when the frame is queued as a non-final fragment, underflowing msg_len to UINT_MAX and forcing skb_over_panic(). No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the flaw is not in CISA KEV, so this is a proximity-limited DoS/info-leak affecting any NFC-enabled Linux device, fixed by the maintainers. Exploitation requires NFC radio range and an active NFC/HCI stack, which sharply narrows the real attack surface versus the raw 8.8 score.
Cross-network-namespace information disclosure in the Linux kernel's XFRM/IPsec subsystem allows XFRM_MSG_MIGRATE (IKEv2 MOBIKE) notifications to leak between namespaces because xfrm_send_migrate() and pfkey_send_migrate() hardcode init_net for their multicast. An IKE daemon (e.g. strongSwan) listening on init_net's XFRMNLGRP_MIGRATE / pfkey BROADCAST_ALL groups receives migration events — including IPsec selectors and old/new endpoint addresses — that originated in other, isolated network namespaces. There is no public exploit identified at time of analysis and EPSS probability is low (0.21%); the fix is upstream in stable trees.
Improper TCP connection teardown in the Linux kernel netfilter conntrack subsystem lets remote attackers prematurely terminate active NAT/connection-tracked sessions by injecting an RST packet with an invalid sequence number after a SYN, without the state machine verifying packet direction. The flaw affects the nf_conntrack TCP state machine across numerous stable kernel branches and primarily threatens availability of tracked connections. EPSS is low (0.23%, 13th percentile) and there is no public exploit identified at time of analysis; a vendor patch is available across multiple stable trees.
Out-of-bounds memory access in the Linux kernel IPsec ESP output path (xfrm/esp) occurs when the out-of-place fast path appends the ESP trailer in esp_output_head() but the head-side length gate checks skb->data_len and tailen separately, while esp_output_tail() later allocates a single destination page fragment from the combined post-trailer skb->data_len. When the combined aligned length exceeds one page, skb_page_frag_refill() may return a single page while the destination scatterlist still spans the larger combined length, producing a scatter-gather over-read/over-write. Affected are kernels using ESP transforms for both IPv4 and IPv6; the fix restores the combined-length page gate. No public exploit is identified at time of analysis and EPSS risk is low (0.21%, 11th percentile).
Local privilege escalation and memory corruption in the Linux kernel's XFRM IP-TFS (IPTFS) tunnel subsystem (introduced in 6.14) arises because iptfs_clone_state() shallow-copies runtime state via kmemdup() during IPsec SA cloning. If xfrm_state_migrate() fails after the clone but before re-initialization, the garbage collector can free skbs still owned by the original SA queue, yielding use-after-free and double-free. A local low-privileged actor able to drive IPsec SA migration on an IPTFS-configured tunnel can trigger the flaw; there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Local privilege-boundary memory corruption in the Linux kernel dma-buf subsystem allows a local user to trigger a slab-use-after-free via a race in the dma_buf_fd() tracepoint (DMA_BUF_TRACE). After the FD_ADD() conversion, a thread sharing the file descriptor table can close() the freshly installed dma-buf fd before the tracepoint dereferences dmabuf->name_lock, freeing the object under the trace. Fixed in stable 7.0.12 and 7.1; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.19%.
Heap out-of-bounds read in the Linux kernel's ksmbd in-kernel SMB3 server allows an authenticated remote user to read 2 bytes past the pntsd allocation during SMB2_CREATE handling, potentially leaking adjacent heap memory or crashing the kernel. The flaw is a regression: commit d07b26f39246 introduced a transposed bounds check in smb_check_perm_dacl() that always evaluates false, turning the ACE-size guard into dead code and re-opening a previously fixed OOB. No public exploit identified at time of analysis, and EPSS risk is low (0.21%, 12th percentile); it is not on CISA KEV.
Memory corruption in the Linux kernel's USB MUSB OMAP2430 glue driver (drivers/usb/musb/omap2430.c) stems from a use-after-free in omap2430_probe(), where of_node_put() releases the device-tree node reference before the node is last accessed. On affected TI OMAP2430-class platforms an attacker able to influence driver probe (device bind/unbind, hotplug, or device-tree handling) could trigger access to freed kernel memory, potentially corrupting kernel state. EPSS is low (0.21%, 11th percentile) and there is no public exploit identified at time of analysis; the fix is merged upstream across multiple stable branches.
Local privilege-boundary memory corruption in the Linux kernel USB gadget FunctionFS (f_fs) driver lets a process with access to the FunctionFS control node trigger a use-after-free by racing a DMABUF request completion against a FUNCTIONFS_DMABUF_DETACH ioctl or the file-close path. The completion frees the usb_request but leaves the priv->req back-pointer dangling, so the cancel path passes freed memory to usb_ep_dequeue(), corrupting kernel memory on SG-capable UDCs (chipidea, cdnsp) that dereference the request immediately. EPSS is low (0.20%, 10th percentile) and there is no public exploit identified at time of analysis; a vendor patch is available across stable trees.
Out-of-bounds kernel memory read in the Linux kernel Thunderbolt (thunderbolt) driver's XDomain property parser lets a malicious directly-connected Thunderbolt/USB4 peer leak kernel memory contents. The flaw stems from a u32 integer wrap in tb_property_entry_valid(), where a crafted property entry (value=0xffffff00, length=0x100) wraps the bounds check and causes tb_property_parse() to read attacker-directed memory far past the property block allocation; leaked bytes for TEXT-typed 'deviceid'/'vendorid' keys become readable via the per-XDomain device_name/vendor_name sysfs attributes. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, and EPSS is low (0.21%), consistent with a physical-access adjacent-only information-disclosure bug.
Denial-of-service in the Linux kernel's generic Fibre Channel transport (scsi_transport_fc) lets an adjacent fabric actor hang a host driving an lpfc (Emulex) or qla2xxx (QLogic) FC HBA. By sending a crafted FPIN ELS frame whose 32-bit pname_count exceeds 255, an attacker wraps a u8 loop counter in the Link-Integrity and Peer-Congestion descriptor walkers, producing a non-terminating loop (non-return) in kernel context. No public exploit is identified at time of analysis and EPSS is low (0.20%), but the flaw is remotely triggerable without authentication from within the SAN fabric.
Remote denial-of-service and slab corruption in the Linux kernel iSCSI target (LIO) subsystem affects the Text-phase command handler iscsit_handle_text_cmd(), where two latent bugs have existed since the original LIO integration (commit e48354ce078c). A CRC32C overread reads four bytes past a kzalloc'd buffer on every Text PDU when DataDigest=CRC32C is negotiated, and a stale cmd->text_in_ptr causes a double-free on ErrorRecoveryLevel>0 bad-DataDigest drops and at session teardown. On distro kernels built with CONFIG_SLAB_FREELIST_HARDENED=y (the default) the double-free becomes a remote kernel BUG(); on non-hardened builds it corrupts the slab freelist. No public exploit identified at time of analysis, though the flaw is directly reproducible under KASAN; not listed in CISA KEV and EPSS is low (0.22%).
Heap buffer overflow in the Linux kernel iSCSI target (LIO/TCM) subsystem lets a remote attacker who can reach the target's login service corrupt kernel memory during login text-key negotiation. The iscsi_encode_text_output() path performs unbounded sprintf() concatenation of "key=NotUnderstood" response records into a fixed 8 KiB login->rsp_buf, and a single Login PDU packed with ~2048 minimal unknown key/value pairs expands to roughly 32 KiB of output, producing a ~24 KiB overrun in the kmalloc-8k slab. CVSS is rated 9.8, but EPSS is low (0.22%, 13th percentile); no public exploit is identified at time of analysis and it is not on CISA KEV.
Heap out-of-bounds write in the Linux kernel iSCSI target (LIO) driver lets a remote attacker overflow the heap-allocated client_digest buffer by supplying an over-length BASE64-encoded CHAP_R response during login. chap_server_compute_hash() decodes up to 127 base64 characters (95 bytes) into a buffer sized to the digest (32 bytes for SHA-256, 16 for MD5), overflowing it by 63-79 bytes before the too-late length check at line 344. The input assigns CVSS 9.8; however EPSS is low (0.21%, 11th percentile), it is not in CISA KEV, and no public exploit was identified - indicating a serious memory-corruption bug that is not yet being exploited.
Local privilege escalation potential in the Linux kernel's DRM/GEM (Direct Rendering Manager Graphics Execution Manager) subsystem stems from a use-after-free triggered by a race in the drm_gem_change_handle_ioctl path. A local user with access to a DRM device node can race a GEM_CLOSE against a handle-change operation to drop a GEM object's reference count to zero and free it while another handle's IDR entry still points at it, yielding a dangling kernel pointer. No public exploit has been identified at time of analysis and it is not in CISA KEV; EPSS is low (0.20%, 10th percentile), consistent with a local-only race that is non-trivial to weaponize.
Local privilege escalation or denial of service in the Linux kernel's Intel i915 GPU driver stems from a use-after-free in the TTM object purge path (i915_ttm_purge), where the bo->ttm page-vector container can be replaced by ttm_bo_validate() during eviction, leaving a stale i915_tt pointer that is later dereferenced. A user on DG2 (Intel Arc/discrete) hardware reproduced this as a general protection fault under heavy GPU load during buffer-object eviction. There is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS (0.21%), but the CVSS 7.8 local vector reflects high confidentiality, integrity, and availability impact if the freed memory is groomed and reclaimed.