Linux
Monthly
Information disclosure and buffer corruption in the Linux kernel's Qualcomm GENI serial driver (qcom_geni) allows leakage of stale TX buffer contents over the UART line when uart_flush_buffer() races a pending DMA-completion IRQ. On affected builds (6.3 through the fixed stable releases), a kfifo underflow drives kfifo->out past kfifo->in, so a subsequent start_tx_dma() transmits residual/stale buffer data rather than intended output. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the flaw is local-only and timing-dependent.
Local memory corruption in the Linux kernel's AMD Kernel Fusion Driver (amdkfd) stems from an integer overflow in the KFD debugger's get_queue_ids() routine, where num_queues * sizeof(uint32_t) can wrap on 32-bit size_t builds and produce an undersized allocation. A local user with access to the KFD debug interface can trigger kernel heap corruption impacting confidentiality, integrity, and availability. No public exploit is identified at time of analysis; EPSS is low (0.22%, 12th percentile) and it is not on CISA KEV, but a vendor patch has been released across multiple stable trees.
Local privilege escalation and memory corruption in the Linux kernel's AMD GPU (amdgpu) DRM driver arises from a race condition in amdgpu_hmm_range_get_pages, where the MMU notifier sequence was read more than once, allowing the driver to operate on stale or invalid page mappings. A local low-privileged user with GPU device access can exploit the timing window to disclose kernel memory or corrupt memory, matching the CVSS 7.8 high/high/high impact profile. There is no public exploit identified at time of analysis, and the EPSS score is low (0.20%, 10th percentile), consistent with a hard-to-time local race rather than a broadly weaponized flaw.
Stale TLB walk-cache entries in the Linux kernel on arm64 arise because huge_pmd_unshare() marks tlb->unshared_tables=true, but the aarch64 tlb_flush() logic only inspected tlb->freed_tables when deciding between a full invalidation (vae1is) and a leaf-only one (vale1is). As a result, unsharing a hugetlb PMD table leaves the obsolete PMD entry in the walk cache, allowing the MMU to perform incorrect page-table walks against freed/reassigned page-table memory - a potential path to information disclosure or memory corruption on affected 64-bit ARM systems. This is a config/architecture-specific kernel bug with no public exploit identified at time of analysis and a low EPSS (0.21%), and it is not listed in CISA KEV.
Denial of service and possible memory disclosure in the Linux kernel's MCTP-over-USB transport driver (net/mctp/usb) stems from a race between USB request block (urb) completion and cancellation of the rx_retry work during interface teardown. When the interface is brought down concurrently with an in-flight retry, a urb can remain queued and re-schedule already-cancelled work, leading to use-after-free-style memory corruption. This affects Linux 6.15 through the fixed stable releases; there is no public exploit identified at time of analysis, EPSS is low (0.15%, 5th percentile), and the flaw is not in CISA KEV.
Denial of service in the Linux kernel IPsec ESP stack (esp4/esp6) arises from a page fragment reference leak in esp_output_tail() when out-of-place crypto processing is used and the second skb_to_sgvec() call fails. On this error path the code jumps to error_free, freeing only the temporary scatterlist and the newly allocated page while leaking the original skb frag page references, allowing repeated failures to exhaust memory. No public exploit identified at time of analysis; EPSS is 0.14% (4th percentile), consistent with a low-likelihood, availability-only kernel bug fixed upstream in stable commits.
Use of uninitialized kernel memory in the Linux kernel's IEEE 802.15.4 6LoWPAN transmit path (lowpan_xmit) allows a local attacker to leak or corrupt kernel memory when a non-IPv6 packet (e.g., an ETH_P_AOE frame from the aoe driver) is queued on a 6LoWPAN interface. Because the 6LoWPAN header_create path skips initialization for non-IPv6 traffic, lowpan_xmit unconditionally reads a stale lowpan_addr_info structure from the skb headroom, yielding information disclosure and potential instability (tagged Information Disclosure). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV.
A shift-out-of-bounds (undefined behavior) exists in the Linux kernel's mac80211 wireless stack, in ieee80211_parse_tx_radiotap(), where an 8-bit IEEE80211_RADIOTAP_ANTENNA value from a userspace-injected frame is used directly as a BIT() shift count, allowing shifts of up to 255 on a 64-bit unsigned long. A local user able to inject frames on a monitor-mode interface can trigger the UB, flagged by UBSAN, with no public exploit identified at time of analysis and a low EPSS score (0.16%, 5th percentile). The realistic impact is undefined behavior / potential instability rather than the memory-corruption RCE implied by the assigned 7.6 CVSS.
Availability degradation in the Linux kernel's MPTCP (Multipath TCP) subsystem allows remote peers to trigger connection-level inconsistencies through a time-of-check-to-time-of-use (TOCTOU) race in the transmit path. The MPTCP output code reads the connection-level ack_seq locklessly and multiple times per packet, so the data_ack value placed in the DSS option can diverge from the value used to compute the announced receive window, confusing the remote peer and destabilizing the multipath connection. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and the flaw is not in CISA KEV.
Memory-safety defect in the Linux kernel's MediaTek mt76/mt7996 Wi-Fi driver leaves a stale WCID (wireless client ID) pointer behind when a station link is torn down in mt7996_mac_sta_deinit_link(), creating a dangling reference that can be dereferenced after the underlying station object is freed. The fix, released in stable kernels, explicitly clears the WCID pointer during link deinitialization. The NVD-assigned CVSS of 8.8 (AV:A) rates this high, though no public exploit has been identified and EPSS exploitation probability is very low (0.15%, 5th percentile).
Denial-of-service / kernel-stability defect in the Linux kernel BPF LSM subsystem allows a privileged BPF program author to attach sleepable LSM programs to the bpf_lsm_task_to_inode() and bpf_lsm_inet_conn_established() hooks, which execute in atomic contexts (under rcu_read_lock() and in softirq respectively) where sleeping is illegal. The upstream fix removes these two hooks from the sleepable-eligible set; there is no public exploit identified at time of analysis, EPSS is very low (0.16%, 6th percentile), and it is not in CISA KEV. Despite an NVD CVSS of 8.8 the real-world risk is modest because triggering requires local privilege to load BPF LSM programs.
Memory-safety corruption in the Linux kernel eBPF verifier (fixed in 6.19 / stable 7.0.10 / 7.1) arises because visit_tailcall_insn(), added by commit e40f5a6bf88a to correct stack liveness for tail calls, discards its return value so verifier errors are never propagated. An attacker able to load a crafted BPF program can cause the verifier to accept an invalid program, leading to high-impact confidentiality, integrity, and availability compromise (CVSS 8.4). This is tagged as Information Disclosure with no public exploit identified at time of analysis and a low EPSS of 0.14%.
Local denial of service in the Linux kernel's DRM GPU SVM helper (drm_gpusvm_helper) arises from an unbalanced notifier-lock release in drm_gpusvm_scan_mm(): an early jump to the err_free label reaches drm_gpusvm_notifier_unlock() before the matching lock is taken, tripping the kernel's 'bad unlock balance' detector. Affected recent kernels (7.0 series, fixed in 7.0.10 and 7.1) can hit this path during GPU shared-virtual-memory scanning, leading to lock-state corruption and likely a crash or hang. There is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile); the fix is upstream in the stable tree.
Out-of-bounds string handling in the Linux kernel RDMA subsystem (drivers/infiniband/core) allows a local actor with RDMA netlink access to trigger reads past the end of a supplied netlink attribute. The affected code declared configuration attributes as NLA_STRING and then passed them directly to strcmp()/%s formatting without guaranteeing a NUL terminator, so a crafted, unterminated attribute can cause the kernel to read adjacent memory, potentially leaking information or crashing the host. No public exploit identified at time of analysis; the fix simply switches the attributes to NLA_NUL_STRING to enforce termination.
Local privilege escalation and kernel-memory disclosure in the Linux kernel netfilter nf_tables subsystem arises from unsafe handling of basechain/flowtable hook deletions, where moving hooks off an RCU-protected hook_list during the transaction preparation phase races with concurrent netlink dump readers. A low-privileged local user with netfilter administration capability (typically CAP_NET_ADMIN, obtainable inside an unprivileged user namespace on many distros) can trigger the race to read or corrupt freed kernel memory. There is no public exploit identified at time of analysis, EPSS exploitation probability is low (0.14%, 4th percentile), and the issue is not in CISA KEV; the fix is available as upstream stable commits.
An uninitialized-memory read in the Airoha ethernet driver (airoha_dev_xmit) of the Linux kernel affects systems using MediaTek/Airoha EN7581-class networking SoCs, where the transmit loop reads a fragment address and length on its final iteration before that descriptor data is initialized. Although the read values are never consumed, the access itself is unsafe and can trigger a page fault, potentially crashing the kernel during packet transmission. EPSS is low (0.15%, 5th percentile), there is no public exploit identified at time of analysis, and it is not listed in CISA KEV. Note: the auto-assigned CVSS of 9.8 (AV:N/C:H/I:H/A:H) appears substantially inflated for what is a local transmit-path bug with availability-only impact.
Local privilege escalation and memory corruption in the Linux kernel's amdgpu VCN (Video Core Next) driver arises because VCN v2.0 encoder and decoder rings accept command-stream (CS) submissions carrying 64-bit user fence writes that the hardware does not actually support. A local user able to submit GPU work (via /dev/dri render nodes) can trigger the driver to perform unsupported fence writes, leading to high-impact confidentiality, integrity, and availability effects consistent with kernel memory corruption or information disclosure. There is no public exploit identified at time of analysis, EPSS is low (0.16%), and the issue is not on the CISA KEV list, so this is a locally-scoped hardening/correctness fix rather than a remotely exploitable emergency.
Local privilege escalation and memory corruption in the Linux kernel amdgpu driver stems from VCN (Video Core Next) v2.5 encoder/decoder rings accepting command-stream submissions that request 64-bit user fence writes, an operation the hardware does not support. A local user with render-node access to an AMD GPU can submit a crafted CS with a user fence, causing the kernel to write to an unsupported/attacker-influenced fence address. No public exploit is identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the flaw is not in CISA KEV.
Local privilege escalation and memory-corruption risk in the amdgpu driver's VCN (Video Core Next) v3.0 encoder/decoder rings allows an authenticated local user with GPU render-node access to submit command streams containing 64-bit user-fence writes that the hardware does not support, corrupting kernel memory. The fix marks these rings with no_user_fence so the kernel rejects any command submission carrying a user fence. This affects Linux kernels from 5.9 onward that ship the AMD VCN 3.0 support; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.16% (5th percentile).
Local privilege/impact flaw in the Linux kernel's amdgpu AMD GPU driver (VCN v4.0 video encode/decode rings) allowed userspace command submissions (CS) to include 64-bit user fences that the encoder/decoder ring hardware cannot correctly service. Before the fix, the driver accepted these submissions instead of rejecting them, so a local user with GPU render-node access could trigger unsupported fence writes with High confidentiality, integrity, and availability impact (CVSS 7.8). This is a fixed upstream stable-kernel issue tagged Information Disclosure; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.15%).
Local privilege-adjacent memory corruption in the Linux kernel's AMD GPU (amdgpu) VCN v4.0.3 driver arises because the video encode/decode rings accept command-stream submissions carrying 64-bit user fences that the hardware cannot honor. A local user with GPU/DRM access could submit crafted VCN jobs with user fences, leading to out-of-bounds fence writes and kernel memory corruption. No public exploit has been identified at the time of analysis, EPSS is low (0.16%, 5th percentile), and the flaw is not on the CISA KEV list; a vendor patch is available.
Local privilege escalation / memory corruption in the Linux kernel's AMD GPU driver (amdgpu VCN v4.0.5) allows an authenticated local user to submit command-stream (CS) requests carrying 64-bit user fences to VCN encoder/decoder rings that do not support them, corrupting kernel memory. The fix marks the affected rings with no_user_fence so the kernel rejects such submissions. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not on CISA KEV, but CVSS scores high impact (7.8) due to full C/I/A compromise from a local unprivileged-to-low-privileged vector.
Local privilege escalation and memory corruption in the Linux kernel's AMD GPU (amdgpu) VCN v5.0.0 driver arises because the video encode/decode rings do not support 64-bit user fence writes, yet command-stream (CS) submissions carrying user fences were accepted. A local user with render/DRI device access could submit crafted GPU jobs whose user-fence writes land outside the intended target, corrupting kernel-managed memory. The fix rejects such submissions by setting no_user_fence for the affected ring. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 6th percentile).
Local privilege/memory-safety flaw in the Linux kernel's amdgpu VCN (Video Core Next) v5.0.1 driver allows a local user with GPU render-node access to submit command-stream (CS) requests containing 64-bit user fences that the VCN encoder/decoder rings cannot handle, leading to high-impact corruption (CVSS 7.8, tagged Information Disclosure). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile). A vendor patch is available upstream in the kernel stable tree.
Local privilege-context memory corruption/information disclosure in the Linux kernel's AMD GPU (amdgpu) JPEG v2.0 driver arises because JPEG rings do not support 64-bit user fence writes, yet command-submission (CS) requests carrying user fences were accepted. A local authenticated user with GPU/DRM access could submit crafted jobs that trigger unsupported user-fence writes, leading to high confidentiality, integrity, and availability impact (CVSS 7.8). This is a resolved kernel bug with an upstream stable fix; no public exploit has been identified and EPSS exploitation probability is low (0.17%, 7th percentile).
Local privilege escalation potential in the Linux kernel's AMD GPU JPEG v2.5 driver (drm/amdgpu/jpeg) arises because JPEG rings do not support 64-bit user fence writes, yet command-submission (CS) requests carrying user fences were accepted rather than rejected. A local user with GPU access could submit crafted CS requests that trigger memory corruption impacting confidentiality, integrity, and availability. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.17%, 6th percentile), consistent with a hardware-gated local kernel driver bug rather than a mass-exploited flaw.
Local privilege escalation / memory-corruption risk in the Linux kernel's AMD GPU (amdgpu) JPEG v3.0 ring driver, where the ring was allowed to accept command-stream submissions containing 64-bit user fences that the JPEG hardware cannot actually write. The fix flags the JPEG v3.0 ring as no_user_fence and rejects such CS submissions, closing an unvalidated-write condition reachable by any local user with GPU device access. No public exploit identified at time of analysis; EPSS is low (0.17%) and this is not on CISA KEV.
Local memory-corruption/denial-of-service risk in the Linux kernel amdgpu JPEG v4.0 ring (drm/amdgpu/jpeg) arises because JPEG rings cannot perform 64-bit user-fence writes, yet command-stream (CS) submissions carrying user fences were accepted; the fix sets no_user_fence to reject them. A local user with access to the AMD GPU device can submit crafted CS jobs specifying a user fence, causing the ring to attempt a fence write it does not support. No public exploit has been identified and EPSS is low (0.17%, 7th percentile), but the CVSS 3.1 score is 7.8 with high confidentiality, integrity, and availability impact.
Local memory corruption in the Linux kernel's AMD GPU (amdgpu) JPEG v4.0.3 driver allows a user with GPU render-node access to escalate privileges or crash the system by submitting command-stream (CS) work with a 64-bit user fence, which the JPEG ring hardware cannot write correctly. The fix flags the ring with no_user_fence so the kernel rejects such submissions. EPSS is very low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis, so this is a hardening/robustness fix rather than an urgent externally-exploited threat.
Improper user-fence handling in the Linux kernel's AMDGPU JPEG v4.0.5 driver allows a local, low-privileged user to submit GPU command-stream (CS) jobs with 64-bit user fences to a JPEG ring that only supports narrower fence writes, potentially corrupting or disclosing kernel/GPU memory. The fix sets the no_user_fence flag so the driver rejects such CS submissions outright. Rated CVSS 7.8 (local), with no public exploit identified at time of analysis, a low EPSS of 0.17% (6th percentile), and no CISA KEV listing - this is a hardware-specific hardening fix rather than a broadly exploited flaw.
Local privilege escalation and memory corruption in the Linux kernel's amdgpu JPEG v5.0.0 driver allows a low-privileged local user with access to the GPU render node to submit command-stream (CS) requests carrying a 64-bit user fence that the JPEG ring cannot service, corrupting kernel/GPU-writable memory. The fix makes the driver set no_user_fence and reject such submissions. This is a CVSS 7.8 (AV:L) issue with a very low EPSS (0.17%, 6th percentile) and no public exploit identified at time of analysis; it is patched upstream.
Local privilege-adjacent memory corruption in the Linux kernel's AMD GPU JPEG engine (amdgpu driver, JPEG v5.0.1 ring) allows a local low-privileged user to submit command-stream (CS) submissions containing 64-bit user fences that the JPEG ring cannot service. Because the ring lacks support for user fence writes, accepting such submissions leads to high-impact confidentiality, integrity, and availability consequences (CVSS 7.8). No public exploit identified at time of analysis, and EPSS is very low (0.17%), consistent with a hardware-specific, locally-scoped GPU driver flaw rather than a mass-exploitation target.
Local privilege-adjacent memory corruption in the Linux kernel's AMD GPU (amdgpu) JPEG v5.3.0 driver arises because the ring did not set the no_user_fence flag, allowing command-stream (CS) submissions carrying 64-bit user fence writes that the JPEG ring cannot support. A local user with GPU/DRM device access can submit crafted CS with user fences, leading to undefined ring behavior and high impact on confidentiality, integrity, and availability. No public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%), but a vendor (upstream stable) patch is available.
Local privilege escalation in the Linux kernel NTFS3 filesystem driver allows an unprivileged user with a file on a writable ntfs3 mount to set the reserved $LXUID, $LXGID, $LXMOD and $LXDEV WSL-permission xattrs directly via setxattr(), planting root ownership and the S_ISUID bit on their own file so it executes with euid 0. The empty-prefix xattr handler failed to block userspace writes to these internal metadata names, which ntfs_get_wsl_perm() reloads into i_uid/i_gid/i_mode on inode reload. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and the issue is not on CISA KEV, but the outcome is full local root.
Memory corruption in the Linux kernel mt76 WiFi driver (mt7925 chipset support) occurs because mt76_sta_add reinitializes the wcid->poll_list even though mt7925_mac_sta_add has already published the wcid, corrupting the dev->sta_poll_list linked list during station association. The flaw manifests as list_add corruption (observed on kernel 7.1-rc4 with mt7925 hardware) reachable from the RX NAPI poll path when TX status frames are processed, typically leading to a kernel panic. This is a vendor-fixed Linux stable-tree issue with no public exploit identified at time of analysis and a low EPSS score (0.15%).
Memory corruption in the Linux kernel's mac802154 IEEE 802.15.4 link-layer security (llsec) subsystem allows an adjacent attacker to trigger a slab use-after-free and data corruption by sending 802.15.4 frames to a host with link-layer security enabled. The llsec encrypt/decrypt routines perform in-place crypto on socket buffer data that may be shared across skb clones, so modifying it corrupts memory still referenced by other clones. No public exploit has been identified at time of analysis; EPSS is low at 0.17% (7th percentile) and the issue is not in CISA KEV, but a vendor patch is available.
Improper page-cache modification in the Linux kernel's sk_msg (sockmap/BPF SK_MSG) subsystem allows an attacker who can attach SK_MSG BPF programs to expose externally-backed scatterlist pages as writable BPF ctx->data. Because the sg.copy ownership bitmap was not kept in sync when sk_msg entries are moved, split, shifted, or copied across transforms (BPF pull/push/pop, sk_msg_shift_left/right, sk_msg_xfer, and tls_split_open_record), a splice- or file-page-cache-backed entry could arrive at a new slot with a cleared copy bit and then be modified via BPF stores, corrupting the original page cache. There is no public exploit identified at time of analysis and the EPSS score is very low (0.16%), consistent with a subtle in-kernel logic bug rather than a widely-weaponized flaw.
Missing capability check in the Linux kernel's IPv4 GRE tunnel driver (ip_gre) lets a local user with CAP_NET_ADMIN in a device's network namespace reconfigure GRE/ERSPAN tunnels that actually live in a different namespace, crossing a namespace isolation boundary. The RTM_NEWLINK changelink path validated CAP_NET_ADMIN only against dev_net(dev) and never against the tunnel's own link netns (t->net), so an operator privileged in one container/netns could rewrite tunnels belonging to another. Patched upstream; EPSS is low (0.16%) and no public exploit is identified at time of analysis.
AppArmor connect mediation bypass in the Linux kernel lets a confined task open outbound TCP or MPTCP connections using TCP Fast Open (MSG_FASTOPEN on sendmsg()/sendto()) even when its profile grants send but denies connect. Because apparmor_socket_sendmsg() only checked AA_MAY_SEND, the implicit connect embedded in the SYN packet escaped policy enforcement, effectively an authentication/authorization bypass of the profile. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and this is not in CISA KEV, so risk is a targeted policy-enforcement gap rather than mass exploitation.
Local privilege-escalation-class memory corruption in the Linux kernel's AppArmor LSM affects the policy-replacement path (aa_replace_profiles) across a wide span of stable branches (5.10 through 7.1). During the rawdata deduplication loop, aa_get_profile_loaddata() performs an unconditional kref_get() on struct aa_loaddata entries whose pcount has already dropped to zero but which remain briefly on ns->rawdata_list before the deferred do_ploaddata_rmfs() workqueue frees them, producing a refcount 'addition on 0' use-after-free. Exploitation requires local access with the ability to load AppArmor policy and winning a narrow race; there is no public exploit identified at time of analysis and EPSS risk is low (0.16%, 6th percentile).
Out-of-bounds memory writes in the Linux kernel's gcov code-coverage instrumentation can corrupt memory and crash the system when inflate_fast() (zlib decompression) runs concurrently on multiple CPUs, most notably during IPComp/IPsec (xfrm_input) packet decompression. GCC merges the global GCOV branch counter with loop induction variables, so simultaneous execution reloads the shared counter mid-loop and computes an index that wrote ~3.4 MB past a 65 KB buffer. This only affects kernels built with GCOV profiling enabled; there is no public exploit identified at time of analysis and EPSS is very low (0.17%).
Local privilege-relevant memory corruption in the Linux kernel's KEYS subsystem allows an authenticated local user to overflow an internal output buffer via the keyctl() public-key operation path. The flaw stems from keyctl_pkey_params_get_2() sizing its internal output buffer using the caller-supplied length instead of the cryptographic primitive's maximum length, so a too-small buffer triggers a heap overflow. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not on CISA KEV, so risk is theoretical rather than actively exploited.
Local privilege escalation via a use-after-free in the Linux kernel's key management (keys) subsystem allows an unprivileged local user to corrupt kernel memory by racing a request_key() helper against KEYCTL_INSTANTIATE_IOV. The request_key_auth payload (rka) could be detached and freed by the key-request helper's completion path while a concurrent instantiate/reject operation was still dereferencing rka->target_key, yielding a UAF (CWE-416). It is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is low at 0.17% (6th percentile), and a vendor patch is available across multiple stable branches.
Local denial-of-service in the Linux kernel's f2fs filesystem lets an attacker who can mount a crafted f2fs image trigger a kernel panic (BUG_ON at fs/f2fs/file.c:845) during inode truncation. A corrupted inode containing a direct node whose footer reuses the inode's own ino/nid causes ADDRS_PER_PAGE to return an inode-sized address count (923), driving ofs_in_node into the out-of-bounds addr[923..1017] range and crashing the host. Discovered via syzkaller fuzzing; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile).
Local denial-of-service and out-of-bounds read in the Linux kernel F2FS filesystem allows an attacker who can mount a crafted image to panic the kernel via f2fs_recover_orphan_inodes(), which trusts an attacker-controlled orphan block entry_count. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK drives the recovery loop past the ino[] array, reading footer/adjacent data as inode numbers and tripping f2fs_bug_on(). No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not on CISA KEV.
Improper inode validation in the Linux kernel's F2FS filesystem allows a crafted or corrupted f2fs image to smuggle a directory entry referencing the synthetic compressed-cache inode number (max_nid), bypassing f2fs_check_nid_range() when the compress_cache mount option is disabled. Because is_meta_ino() unconditionally treats F2FS_COMPRESS_INO() as a meta inode, f2fs_iget() skips do_read_inode() and instantiates a fake internal inode instead of rejecting the out-of-range nid, enabling local memory-safety abuse. No public exploit identified at time of analysis; EPSS probability is low (0.17%, 7th percentile) and it is not on CISA KEV.
Local privilege-adjacent memory corruption in the Linux kernel's F2FS filesystem allows a low-privileged user with access to an F2FS-mounted volume to trigger a use-after-free on the atomic_inode structure. During garbage collection of an atomic (copy-on-write) file via ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE), a race with concurrent inode eviction lets the kernel dereference and populate the page mapping of an already-freed atomic_inode, corrupting kernel memory and typically causing a BUG_ON/crash. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and this is not on CISA KEV. A vendor fix that takes a reference on fi->atomic_inode before use has been merged upstream.
Out-of-bounds kernel memory read in the Linux kernel's f2fs filesystem driver allows an attacker who can get a crafted f2fs image mounted to leak kernel memory and crash the system. When the flexible_inline_xattr feature is enabled, do_read_inode() trusts the on-disk i_inline_xattr_size for inodes that carry inline dentries or inline data but lack the FI_INLINE_XATTR flag, so an unvalidated, attacker-controlled size drives inode geometry negative and produces an out-of-bounds read in f2fs_fill_dentries() when the inline directory is read. EPSS is low (0.16%, 5th percentile) and there is no public exploit identified at time of analysis nor CISA KEV listing; a vendor patch is available.
Out-of-bounds heap read in the Linux kernel's F2FS filesystem lets a local low-privileged user disclose adjacent kernel memory or crash the system by reading POSIX ACLs from a maliciously crafted f2fs image. The flaw lives in f2fs_acl_from_disk() (fs/f2fs/acl.c), which dereferences an ACL entry's e_id before confirming a full f2fs_acl_entry fits in the xattr buffer. It is fixed upstream, carries CVSS 7.8, and shows a very low EPSS (0.17%, 6th percentile); there is a KASAN crash reproducer in the report but no public weaponized exploit and no CISA KEV listing - no public exploit identified at time of analysis.
Memory corruption in the Linux kernel's F2FS filesystem lets a local low-privileged user trigger LRU list corruption and a kernel panic (denial of service) by driving garbage collection on a nearly-full F2FS partition via fallocate. The bug is a use-after-free-class race introduced by commit 9609dd704725 in move_data_block(), where a folio is dropped from the page cache and later split, leaving a tail page freed back to the allocator while still linked in the LRU; the fix is a revert of that commit. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low (0.15%, 5th percentile).
Filesystem cache-consistency flaw in the Linux kernel's F2FS (Flash-Friendly File System) driver leaves a stale 'largest extent' entry cached when __destroy_extent_node() sets the FI_NO_EXTENT inode flag without resetting the extent length or updating the inode folio, causing the extent tree to diverge from on-disk metadata. Affected are local users of F2FS-formatted volumes across many stable kernel lines (6.6.x through 6.18.x and 7.x pre-releases); the bug surfaces as a sanity_check_extent_cache error (reproduced by xfstests generic/388) and, per source tagging, carries an information-disclosure angle because stale block mappings can point reads at the wrong physical blocks. No public exploit identified at time of analysis; EPSS is 0.16% (5th percentile), and it is not on CISA KEV.
Memory corruption in the Linux kernel's cgroup BPF sysctl filtering path allows a local privileged user to corrupt kernel memory and potentially escalate privileges. The bug is a mismatched allocator/deallocator: proc_sys_call_handler() allocates the temporary sysctl buffer with kvzalloc() (which falls back to vmalloc() for large writes) but the replacement path in __cgroup_bpf_run_filter_sysctl() frees it with kfree(), which is invalid for vmalloc-backed memory. It carries a CVSS of 7.8 (High) with a local vector; EPSS is very low (0.19%, 9th percentile) and there is no public exploit identified at time of analysis, consistent with a memory-safety fix flagged by an experimental static-analysis tool rather than in-the-wild abuse.
Memory corruption in the Linux kernel's exFAT filesystem driver allows a crafted exFAT image to trigger a use-after-free in exfat_find_dir_entry(): the buffer_head backing the directory entry (bh) is released via brelse() before the fall-through TYPE_EXTEND branch still reads through the ep pointer into bh->b_data. Any system that mounts an attacker-supplied exFAT volume (e.g. a USB stick or disk image with a long filename engineered to force same-hash collisions down the TYPE_EXTEND path) is affected; the stale dereference can fault or corrupt kernel memory. No public exploit identified at time of analysis, and the input CVSS 9.8/AV:N score is not credible for a local filesystem-parsing bug that the reporter could only trigger under instrumentation (KASAN + DEBUG_PAGEALLOC with a debug invalidate_bdev()).
Out-of-bounds read in the Linux kernel's KVM x86 shadow MMU allows a malicious or misbehaving guest to trigger a host kernel page fault (crash) during hugepage recovery. The flaw occurs when the KVM host recovers hugepages and queries the max mapping level for a direct shadow page whose base gfn falls outside the target memslot, causing an out-of-bounds access into the vmalloc'd lpage_info array. Rated CVSS 8.8 (local, scope-changed) but with low real-world exploitation probability (EPSS 0.17%); no public exploit and no CISA KEV listing - no public exploit identified at time of analysis.
Guest-to-host denial of service in the Linux kernel's x86 KVM ioeventfd datamatch handling allows a malicious VM to crash the hypervisor host via a reachable BUG_ON(). A guest that issues an unaligned store spanning a page boundary and hitting a datamatch-enabled ioeventfd at offset 0 of the second page triggers an alignment assertion in ioeventfd_write(), panicking the host kernel. The defect has existed since 2009 (kernel 2.6.32); EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis, though the commit message includes a working reproducer trace.
A local privilege-context memory corruption in the Linux kernel's IBM PowerPC 'nx' hardware crypto driver (drivers/crypto/nx) causes a kernel oops when userspace uses the AF_ALG socket interface for shash hashing. nx_crypto_ctx_shash_exit passed a wrong pointer type (an nx_crypto_ctx* treated as a crypto_tfm*) into nx_crypto_ctx_exit, producing a bad-address kernel access (observed at 0xc0403effffffffc8) during teardown, reachable by any local user - e.g. hardlink(1) opportunistically selecting AF_ALG. No public exploit is identified at time of analysis; EPSS is low (0.17%) and this is not on CISA KEV, so real-world risk is a local denial-of-service (kernel crash) on affected NX-capable POWER systems rather than confirmed code execution.
Local privilege escalation or denial of service in the Linux kernel's GFS2 filesystem is possible via a use-after-free in gfs2_qd_dealloc(), where an RCU callback dereferences the superblock (sdp) through qd->qd_sbd after gfs2_put_super() may have already freed it via free_sbd() during unmount. The race is exploitable when GFS2 quota cleanup RCU callbacks outlive the 60-second sd_kill_wait timeout or are re-scheduled by gfs2_gl_hash_clear(). No public exploit has been identified at time of analysis, and EPSS is low (0.17%, 6th percentile), consistent with a hard-to-win kernel race rather than a mass-exploited flaw.
Local privilege escalation via kernel use-after-free in the Linux kernel's hdlc_ppp WAN driver allows a user able to configure synchronous HDLC/PPP network devices to corrupt kernel memory. The bug stems from per-protocol LCP/IPCP/IPV6CP timers embedded in the hdlc->state (struct ppp) allocation being freed with kfree() during device teardown or protocol re-attach without synchronizing a possibly-running timer callback, so an in-flight ppp_timer dereferences freed memory. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; not listed in CISA KEV.
Local privilege-escalation-capable memory corruption in the Linux kernel's blk-cgroup (block I/O controller) subsystem allows a local user to trigger a use-after-free in __blkcg_rstat_flush() by concurrently releasing multiple block cgroups (blkgs) within the same blkcg. Affected kernels span 6.4 through the fixed 6.6.144 / 6.12.95 / 6.18.38 / 7.1.3 / 7.2-rc1 line; the flaw carries CVSS 7.8 (local, low-privilege) and is fixed upstream. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Use-after-free (KASAN slab-use-after-free read) in the Linux kernel's TIPC cryptographic subsystem allows freed per-netns tipc_crypto state to be dereferenced by an asynchronous decrypt completion callback. When TIPC encryption is enabled and crypto_aead_decrypt() is offloaded asynchronously (e.g. via the SIMD/cryptd wrapper), tipc_aead_decrypt() never takes a netns reference, so if the bearer's network namespace is torn down mid-flight the cryptd worker's tipc_aead_decrypt_done() reads freed memory (aead->crypto->stats, ->net, ->aead[] and the node table). There is no public exploit identified at time of analysis and it is not in CISA KEV; it was surfaced by 0sec automated security-research tooling with a KASAN reproducer, and CVSS is rated 8.8.
Use-after-free in the Linux kernel pNFS (parallel NFS) client, specifically in pnfs_update_layout(), lets a stale layout header (lo) be read by a tracepoint after pnfs_put_layout_hdr() has already freed it when execution takes the NFS_LAYOUT_RETURN branch. The flaw affects Linux NFS clients that mount pNFS-backed exports across a wide range of stable series (5.4.x, 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x and 7.x-rc). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the tags label it Information Disclosure, consistent with a tracepoint reading freed memory. The published CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) appears inflated for what is a client-side, race-dependent memory-safety bug.
Local memory corruption in the Linux kernel scheduler's per-mm concurrency-ID (mm_cid) subsystem lets an unprivileged task trigger a deterministic out-of-bounds single-bit clear in kernel memory. The flaw lives in mm_cid_fixup_cpus_to_tasks(), where a task whose CID is still the MM_CID_UNSET sentinel (BIT(31)) is wrongly marked in-transit and later fed to clear_bit(), clearing a bit 256 MiB past the mm_struct CID bitmap. It was surfaced by syzkaller as a KASAN use-after-free in __schedule; no public weaponized exploit and no CISA KEV listing exist at time of analysis.
Use-after-free in the Linux kernel's rpmsg character device driver (rpmsg_char) allows local attackers on rpmsg-enabled platforms to trigger access to freed endpoint memory during a probe-failure race. The flaw exists because rpmsg_chrdev_probe() publishes the newly allocated eptdev in the default endpoint's priv pointer before rpmsg_chrdev_eptdev_add() completes, so a failed add frees eptdev while the default endpoint can still dispatch callbacks against the stale pointer. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list; it is a defensive stable-tree fix rather than an observed in-the-wild vulnerability.
Out-of-bounds memory access in the Linux kernel's OCFS2 cluster filesystem allows a crafted on-disk group descriptor to trigger a use-after-free/OOB read during suballocator bitmap operations. The bug lives in ocfs2_validate_gd_parent(), which only checked bg_bits against the parent allocator's chain geometry and not against the bytes that physically fit in the group descriptor block, so a malicious bg_size/bg_bits pair drives later bitmap scans (ocfs2_find_max_contig_free_bits / ocfs2_block_group_set_bits) past bg_bitmap. It was found via KASAN and fixed upstream; no public exploit has been identified at time of analysis.
Use-after-free and refcount underflow in the Linux kernel's 9p (Plan 9) filesystem client allows a local attacker interacting with a 9p mount to corrupt kernel memory, potentially escalating privileges or crashing the system. The flaw lives in p9_client_walk(): when called with clone=false the new fid aliases oldfid, and a failed multi-component walk incorrectly drops oldfid's reference via the clunk_fid error path, freeing a fid the caller still holds. No public exploit is identified at time of analysis (a reproducer exists only 'on request'), and it is not listed in CISA KEV; the vendor-supplied CVSS of 10.0 appears substantially overstated for a bug requiring an active 9p mount.
Out-of-bounds heap write in the AMD SEV debug-encrypt path (sev_dbg_crypt/__sev_dbg_encrypt_user) of the Linux kernel's KVM/SVM code (kvm_amd) lets a local, privileged VMM process corrupt kernel slab memory by up to 15 bytes past a single-page buffer. The per-iteration transfer length is bounded by the source page offset but not the destination page offset, so when d_off > s_off the PSP command and a following memcpy()/copy_from_user() spill beyond the 4096-byte dst_tpage allocation. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but a KASAN slab-use-after-free splat is included in the report, confirming reliable reproducibility.
Local information disclosure and use-after-free in the Linux kernel NTFS filesystem driver lets a low-privileged local user read freed kernel memory by racing the FS_IOC_GETFSLABEL and FS_IOC_SETFSLABEL ioctls against a mounted NTFS volume. Because vol->volume_label is copied to userspace via copy_to_user without serialization, a concurrent SETFSLABEL that replaces the label can free the buffer mid-read, leaking kernel data or crashing the system. No public exploit is identified at time of analysis and it is not in CISA KEV; a vendor patch is available in Linux 7.1.3 and 7.2-rc1.
Kernel memory disclosure in the Linux kernel fbcon (framebuffer console) subsystem allows a local low-privileged attacker to trigger an out-of-bounds read by exploiting incomplete error-path rollback in fbcon_do_set_font(). When a font-set operation fails partway (e.g., vc_resize() allocation failure under memory pressure), the hi_font_mask and screen buffer are left desynchronized from the reverted 256-character font array, causing the VT subsystem to render character indices above 255 against undersized data. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available across multiple stable branches.
Local privilege escalation and kernel memory corruption in the Linux kernel's omap2 framebuffer driver (omapfb) arises from a use-after-free race between omapfb_mmap() and the OMAPFB_SETUP_PLANE/OMAPFB_SETUP_MEM ioctls. Because fb_mmap() holds only mm_lock while the ioctl path holds only fb_info->lock, a local user on a TI OMAP2 device can reassign a framebuffer region mid-mmap so that the map_count of the freed region is never incremented, leaving userspace with a mapping to freed physical memory. This is an information-disclosure/corruption primitive (tagged 'Information Disclosure') with no public exploit identified at time of analysis; the upstream fix is merged and a patched release exists.
Local privilege escalation and denial of service in the Linux kernel's I2C core subsystem arises because an I2C adapter is added to the global IDR lookup table before its embedded struct device is fully initialised. Because i2c_get_adapter() and the i2c-dev chardev (registered via a bus notifier) can look up an adapter by id and take a reference to that device during this window, a concurrent caller can access uninitialised data, leading to NULL-pointer dereference or use-after-free. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; the fix has been merged and backported across stable trees.
Use-after-free in the Linux kernel NFS server (nfsd) pNFS layout code allows an NFSv4.1+ client to leave a freed layout state ID published in the client's IDR when nfsd4_layout_setlease() fails, so any later IDR walk (states_show, client teardown) dereferences a dangling slab pointer. The affected component is the pNFS block/SCSI/flexfiles layout server path on kernels between commit c5c707f96fc9 and the fixed stable releases. No public exploit has been identified and it is not in CISA KEV; the practical impact is kernel memory corruption leading to crash (DoS) and possible information disclosure per the vendor tag, though the auto-assigned CVSS of 9.8 significantly overstates real-world exploitability.
Improper error-path cleanup in the Linux kernel NFS server (nfsd) lets a remote NFSv4 client crash or potentially corrupt server memory by sending a truncated SECINFO_NO_NAME operation. Because nfsd4_decode_secinfo_no_name() initializes sin_exp only after decoding sin_style, a bad-XDR failure leaves sin_exp holding stale union data from a prior operation, which the error path then passes to exp_put(). No public exploit has been identified at time of analysis; the NVD-assigned 9.8 score overstates the realistic impact, which is primarily denial of service.
Denial of service in the Linux kernel's NFS server (nfsd) ACL handling allows remote clients to leak kernel memory by sending SETACL requests that fail decoding partway through. When nfsaclsvc_decode_setaclargs() (NFSv2 ACL) or nfs3svc_decode_setaclargs() (NFSv3 ACL) successfully decodes the NFS_ACL entry but then fails on the NFS_DFACL entry, the already-allocated posix_acl is orphaned for the server's lifetime because the wired pc_release handlers only performed fh_put() and svc_process() skips the proc function (where cleanup lived) on decode failure. There is no public exploit identified at time of analysis and this is not in CISA KEV; the impact is gradual memory exhaustion rather than code execution or data disclosure.
Denial of service and an ACL enforcement flaw in the Linux kernel's NFSv4 server (nfsd) allow an authenticated NFS client to leak kernel memory and bypass RFC-mandated attribute validation. The nfsd4_create_file() path silently discards the return value of nfsd4_acl_to_attr(), so a CREATE supplying an unsupported/unconvertible ACL succeeds with NFS4_OK and no ACL applied, and a failing start_creating() (e.g. an over-length filename) leaks posix_acl allocations on every attempt. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; the fix has been merged upstream.
Remote denial of service in the Linux kernel NFS server (nfsd) allows an NFSv4 client to leak kernel memory by sending CREATE requests that encode both a native NFSv4 ACL (FATTR4_WORD0_ACL) and POSIX default/access ACLs (FATTR4_WORD2) in the same fattr bitmap. A dead conflict-guard in nfsd4_create() fails to release the original posix_acl objects when nfsd4_acl_to_attr() overwrites them, leaking two posix_acl slab objects per request; repeated requests drive unbounded slab exhaustion. There is no public exploit identified at time of analysis, this is not on CISA KEV, and the impact is availability only (CVSS 7.5, A:H) despite the input tag labelling it 'Information Disclosure'.
Memory exhaustion in the Linux kernel NFS server (nfsd) arises from a leak of a pre-allocated openowner structure in find_or_alloc_open_stateowner() when handling NFSv4.0 OPEN retries. When an unconfirmed owner is encountered, release_openowner() runs and control falls through the `if (oo)` cleanup guard, so a previously allocated `new` state-owner (slab object plus owner-name buffer) is silently overwritten and leaked. Remote clients that can reach the NFS service can, under a specific race, repeatedly trigger this leak to degrade or exhaust server memory. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; impact is availability-only (no data disclosure despite the mislabeled tag).
Remote denial-of-service in the Linux kernel NFSv4 flexfiles (pNFS) client allows a malicious or compromised NFS server to crash a mounting client via a malformed flexfiles layout that declares a zero filehandle-version count. The flaw stems from ff_layout_alloc_lseg() accepting fh_count == 0, which produces a ZERO_SIZE_PTR that is later dereferenced during layoutreturn encoding, triggering a null-pointer-deref and kernel panic. No public exploit identified at time of analysis, though the commit includes a QEMU/KASAN reproducer; CVSS 7.5 reflects availability-only impact (A:H) with no confidentiality or integrity effect.
Remote denial of service in the Linux kernel's NFSv4/pNFS flexfiles client allows a malicious or compromised NFS metadata server to crash any mounted client by returning a GETDEVICEINFO response containing a zero-length r_addr or r_netid opaque. The decoder nfs4_decode_mp_ds_addr() only checks for negative lengths, so a zero-length value leaves the buffer pointer NULL and the subsequent strrchr(NULL, '.') triggers a kernel NULL-pointer dereference and panic. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a targeted server-side trust attack rather than mass exploitation.
Heap out-of-bounds read in the Linux kernel's in-kernel SMB server (ksmbd) lets an authenticated SMB client leak kernel heap memory or crash the server on shares that use ACL xattrs. The flaw lives in smb_check_perm_dacl(), which validates an ACE header and caps sub-authority count but never confirms the ACE is large enough to hold those sub-authorities before compare_sids() dereferences them. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a memory-disclosure/DoS bug rather than a mass-exploited RCE.
Use-after-free in the Linux kernel's TCP Authentication Option (TCP-AO) subsystem lets a local low-privileged user leak freed slab memory by adding a signing key with set_current/set_rnext=1 while a socket is in CLOSE state, transitioning it to LISTEN, then deleting the key asynchronously and reading TCP_AO_INFO. The del_async cleanup path fails to clear the dangling current_key/rnext_key pointers, so a later getsockopt(TCP_AO_INFO) dereferences freed key memory (CVSS 7.8, tagged Information Disclosure). No public exploit identified at time of analysis and EPSS probability is low (0.17%), making this a patchable memory-safety defect rather than an actively exploited threat.
Use-after-free in the Linux kernel's FUSE (Filesystem in Userspace) subsystem allows a local low-privileged attacker to access or corrupt freed kernel memory by racing a request abort against the page-cache folio replacement path in fuse_try_move_folio(). Because the function unlocks the request on entry but fails to re-lock it on the success path, fuse_chan_abort() can end the request and free the fuse_io_args (e.g., via fuse_readpages_end()) while the subsequent copy-chain logic still dereferences that structure. Rated CVSS 7.8 (local, high C/I/A impact); no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile).
Out-of-bounds array read in the Linux kernel's IIO veml6075 UV light sensor driver allows a local low-privileged user reading the sensor's integration-time data to trigger access past the 5-element veml6075_it_ms lookup table. The VEML6075_CONF_IT register field can decode to index values 0-7, but only indices 0-4 are valid; a reserved value (5-7) drives the driver to read beyond the array. This is a hardening fix against faulty hardware, device misprogramming, or bus corruption rather than a directly attacker-controllable memory-corruption primitive; no public exploit identified at time of analysis and EPSS risk is low (0.17%, 6th percentile).
Out-of-bounds array read in the Linux kernel's TI ADS1298 IIO ADC driver (ti-ads1298) lets a local, low-privileged actor read past the 7-element ads1298_pga_settings table when a channel's PGA field decodes to the reserved value 7 (0b111). Affected are systems running the ti-ads1298 driver against a TI ADS1298 biopotential/ECG analog front end; the upstream fix adds a bounds check that returns -EINVAL. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile), consistent with a niche, hardware-dependent code path rather than a broadly weaponizable flaw.
Use-after-free in the Linux kernel's 8250_dw (Synopsys DesignWare) serial driver arises when dw8250_probe() fails during clk_notifier_register(): the already-registered 8250 port is left occupying its slot while its devm-allocated driver data is freed, leaving stale private_data and serial_in/serial_out callbacks that reference freed memory. The flaw affects kernels from 5.9 through the fixed stable releases and is tagged as an information-disclosure risk; there is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile). Despite an NVD CVSS of 9.8, exploitation is gated by a probe-failure error path in a specific UART driver, so real-world reachability is far narrower than the score implies.
Denial of service in the Linux kernel in-kernel SMB3 server (ksmbd) lets remote, unauthenticated clients crash the ksmbd worker via a crafted COMPOUND request. Because smb2_check_user_session() skips the SMB2_SESSION_VALID state check for non-first compound operations and treats a SessionId of 0xFFFFFFFFFFFFFFFF as automatically valid, a TREE_CONNECT chained onto a half-open session (created by an NTLM Type-1 negotiate blob, sess->user still NULL) reaches ksmbd_ipc_tree_connect_request() and dereferences a NULL pointer, wedging the worker for all clients. EPSS is low (0.23%, 13th percentile) and there is no public exploit identified at time of analysis.
Local privilege escalation and memory corruption in the Linux kernel's virtiofs (virtio-fs) driver arises from a use-after-free triggered when an auto-submount is unmounted, where iput() called from fuse_release_end() can dereference an already-destroyed superblock. Because the FUSE num_waiting counter is per-connection rather than per-superblock, the shutdown wait only protects the last submount instance, leaving earlier submounts exposed. The fix reverts virtiofs auto_submounts to synchronous release requests; no public exploit is identified at time of analysis and EPSS risk is low (0.19%).
Local privilege escalation and kernel memory disclosure in the Linux kernel's Renesas RZ/V2H IVC media driver (rzv2h-ivc) stems from a race condition where rzv2h_ivc_transfer_buffer() calls list_del() on the shared buffer queue from a workqueue context without holding the protecting spinlock. On affected embedded systems using the RZ/V2H SoC, a local low-privileged user can concurrently modify the buffer list to corrupt kernel memory, potentially leaking data or achieving code execution. EPSS is low (0.14%, 4th percentile) and there is no public exploit identified at time of analysis; the flaw is fixed upstream in the stable kernel tree.
Local privilege escalation / memory corruption in the Linux kernel's amdgpu VCE (Video Compression Engine) driver allows an unprivileged local user with access to the AMD DRM render node to trigger a bad address being written into VCE firmware. The flaw stems from the command-buffer address-patching routine accepting a partially-valid relocation where only the low or high half of an address is present, producing a malformed pointer handed to firmware. No public exploit is identified at time of analysis (EPSS 0.16%, not in CISA KEV), and vendor stable-tree patches are available across all maintained branches.
Improper memory initialization in the Linux kernel's AMD GPU driver (drm/amdgpu) allows a stale, uninitialized GART page-table entry to be speculatively loaded into the GPU TLB, causing the GPU to reference the wrong physical memory. Affected are systems running AMD GPUs on kernels before 6.1.175, 6.6.140, 6.12.90, 6.18.32 and 7.0.9; a low-privileged local user with GPU access could potentially trigger disclosure of adjacent memory or corrupt GPU address translation. No public exploit identified at time of analysis, and EPSS is low (0.16%), consistent with a hardware-specific correctness flaw rather than a mass-exploitable bug.
Improper error handling in the Linux kernel's memory management VMA subsystem (mm/vma) allows a local low-privileged user to trigger a kernel warning and potential instability when an mmap() error path attempts to unmap an already-detached VMA. The flaw affects the mmap_prepare hook compatibility layer used by 'stacked' drivers such as overlayfs and shm in Linux 6.19 (and related stable branches), where a not-fully-established VMA pointer is passed to the caller. No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile), and it is not on CISA KEV, indicating a robustness/correctness fix rather than an actively exploited weakness despite the high NVD CVSS score.
Information disclosure and buffer corruption in the Linux kernel's Qualcomm GENI serial driver (qcom_geni) allows leakage of stale TX buffer contents over the UART line when uart_flush_buffer() races a pending DMA-completion IRQ. On affected builds (6.3 through the fixed stable releases), a kfifo underflow drives kfifo->out past kfifo->in, so a subsequent start_tx_dma() transmits residual/stale buffer data rather than intended output. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the flaw is local-only and timing-dependent.
Local memory corruption in the Linux kernel's AMD Kernel Fusion Driver (amdkfd) stems from an integer overflow in the KFD debugger's get_queue_ids() routine, where num_queues * sizeof(uint32_t) can wrap on 32-bit size_t builds and produce an undersized allocation. A local user with access to the KFD debug interface can trigger kernel heap corruption impacting confidentiality, integrity, and availability. No public exploit is identified at time of analysis; EPSS is low (0.22%, 12th percentile) and it is not on CISA KEV, but a vendor patch has been released across multiple stable trees.
Local privilege escalation and memory corruption in the Linux kernel's AMD GPU (amdgpu) DRM driver arises from a race condition in amdgpu_hmm_range_get_pages, where the MMU notifier sequence was read more than once, allowing the driver to operate on stale or invalid page mappings. A local low-privileged user with GPU device access can exploit the timing window to disclose kernel memory or corrupt memory, matching the CVSS 7.8 high/high/high impact profile. There is no public exploit identified at time of analysis, and the EPSS score is low (0.20%, 10th percentile), consistent with a hard-to-time local race rather than a broadly weaponized flaw.
Stale TLB walk-cache entries in the Linux kernel on arm64 arise because huge_pmd_unshare() marks tlb->unshared_tables=true, but the aarch64 tlb_flush() logic only inspected tlb->freed_tables when deciding between a full invalidation (vae1is) and a leaf-only one (vale1is). As a result, unsharing a hugetlb PMD table leaves the obsolete PMD entry in the walk cache, allowing the MMU to perform incorrect page-table walks against freed/reassigned page-table memory - a potential path to information disclosure or memory corruption on affected 64-bit ARM systems. This is a config/architecture-specific kernel bug with no public exploit identified at time of analysis and a low EPSS (0.21%), and it is not listed in CISA KEV.
Denial of service and possible memory disclosure in the Linux kernel's MCTP-over-USB transport driver (net/mctp/usb) stems from a race between USB request block (urb) completion and cancellation of the rx_retry work during interface teardown. When the interface is brought down concurrently with an in-flight retry, a urb can remain queued and re-schedule already-cancelled work, leading to use-after-free-style memory corruption. This affects Linux 6.15 through the fixed stable releases; there is no public exploit identified at time of analysis, EPSS is low (0.15%, 5th percentile), and the flaw is not in CISA KEV.
Denial of service in the Linux kernel IPsec ESP stack (esp4/esp6) arises from a page fragment reference leak in esp_output_tail() when out-of-place crypto processing is used and the second skb_to_sgvec() call fails. On this error path the code jumps to error_free, freeing only the temporary scatterlist and the newly allocated page while leaking the original skb frag page references, allowing repeated failures to exhaust memory. No public exploit identified at time of analysis; EPSS is 0.14% (4th percentile), consistent with a low-likelihood, availability-only kernel bug fixed upstream in stable commits.
Use of uninitialized kernel memory in the Linux kernel's IEEE 802.15.4 6LoWPAN transmit path (lowpan_xmit) allows a local attacker to leak or corrupt kernel memory when a non-IPv6 packet (e.g., an ETH_P_AOE frame from the aoe driver) is queued on a 6LoWPAN interface. Because the 6LoWPAN header_create path skips initialization for non-IPv6 traffic, lowpan_xmit unconditionally reads a stale lowpan_addr_info structure from the skb headroom, yielding information disclosure and potential instability (tagged Information Disclosure). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV.
A shift-out-of-bounds (undefined behavior) exists in the Linux kernel's mac80211 wireless stack, in ieee80211_parse_tx_radiotap(), where an 8-bit IEEE80211_RADIOTAP_ANTENNA value from a userspace-injected frame is used directly as a BIT() shift count, allowing shifts of up to 255 on a 64-bit unsigned long. A local user able to inject frames on a monitor-mode interface can trigger the UB, flagged by UBSAN, with no public exploit identified at time of analysis and a low EPSS score (0.16%, 5th percentile). The realistic impact is undefined behavior / potential instability rather than the memory-corruption RCE implied by the assigned 7.6 CVSS.
Availability degradation in the Linux kernel's MPTCP (Multipath TCP) subsystem allows remote peers to trigger connection-level inconsistencies through a time-of-check-to-time-of-use (TOCTOU) race in the transmit path. The MPTCP output code reads the connection-level ack_seq locklessly and multiple times per packet, so the data_ack value placed in the DSS option can diverge from the value used to compute the announced receive window, confusing the remote peer and destabilizing the multipath connection. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and the flaw is not in CISA KEV.
Memory-safety defect in the Linux kernel's MediaTek mt76/mt7996 Wi-Fi driver leaves a stale WCID (wireless client ID) pointer behind when a station link is torn down in mt7996_mac_sta_deinit_link(), creating a dangling reference that can be dereferenced after the underlying station object is freed. The fix, released in stable kernels, explicitly clears the WCID pointer during link deinitialization. The NVD-assigned CVSS of 8.8 (AV:A) rates this high, though no public exploit has been identified and EPSS exploitation probability is very low (0.15%, 5th percentile).
Denial-of-service / kernel-stability defect in the Linux kernel BPF LSM subsystem allows a privileged BPF program author to attach sleepable LSM programs to the bpf_lsm_task_to_inode() and bpf_lsm_inet_conn_established() hooks, which execute in atomic contexts (under rcu_read_lock() and in softirq respectively) where sleeping is illegal. The upstream fix removes these two hooks from the sleepable-eligible set; there is no public exploit identified at time of analysis, EPSS is very low (0.16%, 6th percentile), and it is not in CISA KEV. Despite an NVD CVSS of 8.8 the real-world risk is modest because triggering requires local privilege to load BPF LSM programs.
Memory-safety corruption in the Linux kernel eBPF verifier (fixed in 6.19 / stable 7.0.10 / 7.1) arises because visit_tailcall_insn(), added by commit e40f5a6bf88a to correct stack liveness for tail calls, discards its return value so verifier errors are never propagated. An attacker able to load a crafted BPF program can cause the verifier to accept an invalid program, leading to high-impact confidentiality, integrity, and availability compromise (CVSS 8.4). This is tagged as Information Disclosure with no public exploit identified at time of analysis and a low EPSS of 0.14%.
Local denial of service in the Linux kernel's DRM GPU SVM helper (drm_gpusvm_helper) arises from an unbalanced notifier-lock release in drm_gpusvm_scan_mm(): an early jump to the err_free label reaches drm_gpusvm_notifier_unlock() before the matching lock is taken, tripping the kernel's 'bad unlock balance' detector. Affected recent kernels (7.0 series, fixed in 7.0.10 and 7.1) can hit this path during GPU shared-virtual-memory scanning, leading to lock-state corruption and likely a crash or hang. There is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile); the fix is upstream in the stable tree.
Out-of-bounds string handling in the Linux kernel RDMA subsystem (drivers/infiniband/core) allows a local actor with RDMA netlink access to trigger reads past the end of a supplied netlink attribute. The affected code declared configuration attributes as NLA_STRING and then passed them directly to strcmp()/%s formatting without guaranteeing a NUL terminator, so a crafted, unterminated attribute can cause the kernel to read adjacent memory, potentially leaking information or crashing the host. No public exploit identified at time of analysis; the fix simply switches the attributes to NLA_NUL_STRING to enforce termination.
Local privilege escalation and kernel-memory disclosure in the Linux kernel netfilter nf_tables subsystem arises from unsafe handling of basechain/flowtable hook deletions, where moving hooks off an RCU-protected hook_list during the transaction preparation phase races with concurrent netlink dump readers. A low-privileged local user with netfilter administration capability (typically CAP_NET_ADMIN, obtainable inside an unprivileged user namespace on many distros) can trigger the race to read or corrupt freed kernel memory. There is no public exploit identified at time of analysis, EPSS exploitation probability is low (0.14%, 4th percentile), and the issue is not in CISA KEV; the fix is available as upstream stable commits.
An uninitialized-memory read in the Airoha ethernet driver (airoha_dev_xmit) of the Linux kernel affects systems using MediaTek/Airoha EN7581-class networking SoCs, where the transmit loop reads a fragment address and length on its final iteration before that descriptor data is initialized. Although the read values are never consumed, the access itself is unsafe and can trigger a page fault, potentially crashing the kernel during packet transmission. EPSS is low (0.15%, 5th percentile), there is no public exploit identified at time of analysis, and it is not listed in CISA KEV. Note: the auto-assigned CVSS of 9.8 (AV:N/C:H/I:H/A:H) appears substantially inflated for what is a local transmit-path bug with availability-only impact.
Local privilege escalation and memory corruption in the Linux kernel's amdgpu VCN (Video Core Next) driver arises because VCN v2.0 encoder and decoder rings accept command-stream (CS) submissions carrying 64-bit user fence writes that the hardware does not actually support. A local user able to submit GPU work (via /dev/dri render nodes) can trigger the driver to perform unsupported fence writes, leading to high-impact confidentiality, integrity, and availability effects consistent with kernel memory corruption or information disclosure. There is no public exploit identified at time of analysis, EPSS is low (0.16%), and the issue is not on the CISA KEV list, so this is a locally-scoped hardening/correctness fix rather than a remotely exploitable emergency.
Local privilege escalation and memory corruption in the Linux kernel amdgpu driver stems from VCN (Video Core Next) v2.5 encoder/decoder rings accepting command-stream submissions that request 64-bit user fence writes, an operation the hardware does not support. A local user with render-node access to an AMD GPU can submit a crafted CS with a user fence, causing the kernel to write to an unsupported/attacker-influenced fence address. No public exploit is identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the flaw is not in CISA KEV.
Local privilege escalation and memory-corruption risk in the amdgpu driver's VCN (Video Core Next) v3.0 encoder/decoder rings allows an authenticated local user with GPU render-node access to submit command streams containing 64-bit user-fence writes that the hardware does not support, corrupting kernel memory. The fix marks these rings with no_user_fence so the kernel rejects any command submission carrying a user fence. This affects Linux kernels from 5.9 onward that ship the AMD VCN 3.0 support; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.16% (5th percentile).
Local privilege/impact flaw in the Linux kernel's amdgpu AMD GPU driver (VCN v4.0 video encode/decode rings) allowed userspace command submissions (CS) to include 64-bit user fences that the encoder/decoder ring hardware cannot correctly service. Before the fix, the driver accepted these submissions instead of rejecting them, so a local user with GPU render-node access could trigger unsupported fence writes with High confidentiality, integrity, and availability impact (CVSS 7.8). This is a fixed upstream stable-kernel issue tagged Information Disclosure; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.15%).
Local privilege-adjacent memory corruption in the Linux kernel's AMD GPU (amdgpu) VCN v4.0.3 driver arises because the video encode/decode rings accept command-stream submissions carrying 64-bit user fences that the hardware cannot honor. A local user with GPU/DRM access could submit crafted VCN jobs with user fences, leading to out-of-bounds fence writes and kernel memory corruption. No public exploit has been identified at the time of analysis, EPSS is low (0.16%, 5th percentile), and the flaw is not on the CISA KEV list; a vendor patch is available.
Local privilege escalation / memory corruption in the Linux kernel's AMD GPU driver (amdgpu VCN v4.0.5) allows an authenticated local user to submit command-stream (CS) requests carrying 64-bit user fences to VCN encoder/decoder rings that do not support them, corrupting kernel memory. The fix marks the affected rings with no_user_fence so the kernel rejects such submissions. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not on CISA KEV, but CVSS scores high impact (7.8) due to full C/I/A compromise from a local unprivileged-to-low-privileged vector.
Local privilege escalation and memory corruption in the Linux kernel's AMD GPU (amdgpu) VCN v5.0.0 driver arises because the video encode/decode rings do not support 64-bit user fence writes, yet command-stream (CS) submissions carrying user fences were accepted. A local user with render/DRI device access could submit crafted GPU jobs whose user-fence writes land outside the intended target, corrupting kernel-managed memory. The fix rejects such submissions by setting no_user_fence for the affected ring. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 6th percentile).
Local privilege/memory-safety flaw in the Linux kernel's amdgpu VCN (Video Core Next) v5.0.1 driver allows a local user with GPU render-node access to submit command-stream (CS) requests containing 64-bit user fences that the VCN encoder/decoder rings cannot handle, leading to high-impact corruption (CVSS 7.8, tagged Information Disclosure). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile). A vendor patch is available upstream in the kernel stable tree.
Local privilege-context memory corruption/information disclosure in the Linux kernel's AMD GPU (amdgpu) JPEG v2.0 driver arises because JPEG rings do not support 64-bit user fence writes, yet command-submission (CS) requests carrying user fences were accepted. A local authenticated user with GPU/DRM access could submit crafted jobs that trigger unsupported user-fence writes, leading to high confidentiality, integrity, and availability impact (CVSS 7.8). This is a resolved kernel bug with an upstream stable fix; no public exploit has been identified and EPSS exploitation probability is low (0.17%, 7th percentile).
Local privilege escalation potential in the Linux kernel's AMD GPU JPEG v2.5 driver (drm/amdgpu/jpeg) arises because JPEG rings do not support 64-bit user fence writes, yet command-submission (CS) requests carrying user fences were accepted rather than rejected. A local user with GPU access could submit crafted CS requests that trigger memory corruption impacting confidentiality, integrity, and availability. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.17%, 6th percentile), consistent with a hardware-gated local kernel driver bug rather than a mass-exploited flaw.
Local privilege escalation / memory-corruption risk in the Linux kernel's AMD GPU (amdgpu) JPEG v3.0 ring driver, where the ring was allowed to accept command-stream submissions containing 64-bit user fences that the JPEG hardware cannot actually write. The fix flags the JPEG v3.0 ring as no_user_fence and rejects such CS submissions, closing an unvalidated-write condition reachable by any local user with GPU device access. No public exploit identified at time of analysis; EPSS is low (0.17%) and this is not on CISA KEV.
Local memory-corruption/denial-of-service risk in the Linux kernel amdgpu JPEG v4.0 ring (drm/amdgpu/jpeg) arises because JPEG rings cannot perform 64-bit user-fence writes, yet command-stream (CS) submissions carrying user fences were accepted; the fix sets no_user_fence to reject them. A local user with access to the AMD GPU device can submit crafted CS jobs specifying a user fence, causing the ring to attempt a fence write it does not support. No public exploit has been identified and EPSS is low (0.17%, 7th percentile), but the CVSS 3.1 score is 7.8 with high confidentiality, integrity, and availability impact.
Local memory corruption in the Linux kernel's AMD GPU (amdgpu) JPEG v4.0.3 driver allows a user with GPU render-node access to escalate privileges or crash the system by submitting command-stream (CS) work with a 64-bit user fence, which the JPEG ring hardware cannot write correctly. The fix flags the ring with no_user_fence so the kernel rejects such submissions. EPSS is very low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis, so this is a hardening/robustness fix rather than an urgent externally-exploited threat.
Improper user-fence handling in the Linux kernel's AMDGPU JPEG v4.0.5 driver allows a local, low-privileged user to submit GPU command-stream (CS) jobs with 64-bit user fences to a JPEG ring that only supports narrower fence writes, potentially corrupting or disclosing kernel/GPU memory. The fix sets the no_user_fence flag so the driver rejects such CS submissions outright. Rated CVSS 7.8 (local), with no public exploit identified at time of analysis, a low EPSS of 0.17% (6th percentile), and no CISA KEV listing - this is a hardware-specific hardening fix rather than a broadly exploited flaw.
Local privilege escalation and memory corruption in the Linux kernel's amdgpu JPEG v5.0.0 driver allows a low-privileged local user with access to the GPU render node to submit command-stream (CS) requests carrying a 64-bit user fence that the JPEG ring cannot service, corrupting kernel/GPU-writable memory. The fix makes the driver set no_user_fence and reject such submissions. This is a CVSS 7.8 (AV:L) issue with a very low EPSS (0.17%, 6th percentile) and no public exploit identified at time of analysis; it is patched upstream.
Local privilege-adjacent memory corruption in the Linux kernel's AMD GPU JPEG engine (amdgpu driver, JPEG v5.0.1 ring) allows a local low-privileged user to submit command-stream (CS) submissions containing 64-bit user fences that the JPEG ring cannot service. Because the ring lacks support for user fence writes, accepting such submissions leads to high-impact confidentiality, integrity, and availability consequences (CVSS 7.8). No public exploit identified at time of analysis, and EPSS is very low (0.17%), consistent with a hardware-specific, locally-scoped GPU driver flaw rather than a mass-exploitation target.
Local privilege-adjacent memory corruption in the Linux kernel's AMD GPU (amdgpu) JPEG v5.3.0 driver arises because the ring did not set the no_user_fence flag, allowing command-stream (CS) submissions carrying 64-bit user fence writes that the JPEG ring cannot support. A local user with GPU/DRM device access can submit crafted CS with user fences, leading to undefined ring behavior and high impact on confidentiality, integrity, and availability. No public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%), but a vendor (upstream stable) patch is available.
Local privilege escalation in the Linux kernel NTFS3 filesystem driver allows an unprivileged user with a file on a writable ntfs3 mount to set the reserved $LXUID, $LXGID, $LXMOD and $LXDEV WSL-permission xattrs directly via setxattr(), planting root ownership and the S_ISUID bit on their own file so it executes with euid 0. The empty-prefix xattr handler failed to block userspace writes to these internal metadata names, which ntfs_get_wsl_perm() reloads into i_uid/i_gid/i_mode on inode reload. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and the issue is not on CISA KEV, but the outcome is full local root.
Memory corruption in the Linux kernel mt76 WiFi driver (mt7925 chipset support) occurs because mt76_sta_add reinitializes the wcid->poll_list even though mt7925_mac_sta_add has already published the wcid, corrupting the dev->sta_poll_list linked list during station association. The flaw manifests as list_add corruption (observed on kernel 7.1-rc4 with mt7925 hardware) reachable from the RX NAPI poll path when TX status frames are processed, typically leading to a kernel panic. This is a vendor-fixed Linux stable-tree issue with no public exploit identified at time of analysis and a low EPSS score (0.15%).
Memory corruption in the Linux kernel's mac802154 IEEE 802.15.4 link-layer security (llsec) subsystem allows an adjacent attacker to trigger a slab use-after-free and data corruption by sending 802.15.4 frames to a host with link-layer security enabled. The llsec encrypt/decrypt routines perform in-place crypto on socket buffer data that may be shared across skb clones, so modifying it corrupts memory still referenced by other clones. No public exploit has been identified at time of analysis; EPSS is low at 0.17% (7th percentile) and the issue is not in CISA KEV, but a vendor patch is available.
Improper page-cache modification in the Linux kernel's sk_msg (sockmap/BPF SK_MSG) subsystem allows an attacker who can attach SK_MSG BPF programs to expose externally-backed scatterlist pages as writable BPF ctx->data. Because the sg.copy ownership bitmap was not kept in sync when sk_msg entries are moved, split, shifted, or copied across transforms (BPF pull/push/pop, sk_msg_shift_left/right, sk_msg_xfer, and tls_split_open_record), a splice- or file-page-cache-backed entry could arrive at a new slot with a cleared copy bit and then be modified via BPF stores, corrupting the original page cache. There is no public exploit identified at time of analysis and the EPSS score is very low (0.16%), consistent with a subtle in-kernel logic bug rather than a widely-weaponized flaw.
Missing capability check in the Linux kernel's IPv4 GRE tunnel driver (ip_gre) lets a local user with CAP_NET_ADMIN in a device's network namespace reconfigure GRE/ERSPAN tunnels that actually live in a different namespace, crossing a namespace isolation boundary. The RTM_NEWLINK changelink path validated CAP_NET_ADMIN only against dev_net(dev) and never against the tunnel's own link netns (t->net), so an operator privileged in one container/netns could rewrite tunnels belonging to another. Patched upstream; EPSS is low (0.16%) and no public exploit is identified at time of analysis.
AppArmor connect mediation bypass in the Linux kernel lets a confined task open outbound TCP or MPTCP connections using TCP Fast Open (MSG_FASTOPEN on sendmsg()/sendto()) even when its profile grants send but denies connect. Because apparmor_socket_sendmsg() only checked AA_MAY_SEND, the implicit connect embedded in the SYN packet escaped policy enforcement, effectively an authentication/authorization bypass of the profile. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and this is not in CISA KEV, so risk is a targeted policy-enforcement gap rather than mass exploitation.
Local privilege-escalation-class memory corruption in the Linux kernel's AppArmor LSM affects the policy-replacement path (aa_replace_profiles) across a wide span of stable branches (5.10 through 7.1). During the rawdata deduplication loop, aa_get_profile_loaddata() performs an unconditional kref_get() on struct aa_loaddata entries whose pcount has already dropped to zero but which remain briefly on ns->rawdata_list before the deferred do_ploaddata_rmfs() workqueue frees them, producing a refcount 'addition on 0' use-after-free. Exploitation requires local access with the ability to load AppArmor policy and winning a narrow race; there is no public exploit identified at time of analysis and EPSS risk is low (0.16%, 6th percentile).
Out-of-bounds memory writes in the Linux kernel's gcov code-coverage instrumentation can corrupt memory and crash the system when inflate_fast() (zlib decompression) runs concurrently on multiple CPUs, most notably during IPComp/IPsec (xfrm_input) packet decompression. GCC merges the global GCOV branch counter with loop induction variables, so simultaneous execution reloads the shared counter mid-loop and computes an index that wrote ~3.4 MB past a 65 KB buffer. This only affects kernels built with GCOV profiling enabled; there is no public exploit identified at time of analysis and EPSS is very low (0.17%).
Local privilege-relevant memory corruption in the Linux kernel's KEYS subsystem allows an authenticated local user to overflow an internal output buffer via the keyctl() public-key operation path. The flaw stems from keyctl_pkey_params_get_2() sizing its internal output buffer using the caller-supplied length instead of the cryptographic primitive's maximum length, so a too-small buffer triggers a heap overflow. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not on CISA KEV, so risk is theoretical rather than actively exploited.
Local privilege escalation via a use-after-free in the Linux kernel's key management (keys) subsystem allows an unprivileged local user to corrupt kernel memory by racing a request_key() helper against KEYCTL_INSTANTIATE_IOV. The request_key_auth payload (rka) could be detached and freed by the key-request helper's completion path while a concurrent instantiate/reject operation was still dereferencing rka->target_key, yielding a UAF (CWE-416). It is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is low at 0.17% (6th percentile), and a vendor patch is available across multiple stable branches.
Local denial-of-service in the Linux kernel's f2fs filesystem lets an attacker who can mount a crafted f2fs image trigger a kernel panic (BUG_ON at fs/f2fs/file.c:845) during inode truncation. A corrupted inode containing a direct node whose footer reuses the inode's own ino/nid causes ADDRS_PER_PAGE to return an inode-sized address count (923), driving ofs_in_node into the out-of-bounds addr[923..1017] range and crashing the host. Discovered via syzkaller fuzzing; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile).
Local denial-of-service and out-of-bounds read in the Linux kernel F2FS filesystem allows an attacker who can mount a crafted image to panic the kernel via f2fs_recover_orphan_inodes(), which trusts an attacker-controlled orphan block entry_count. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK drives the recovery loop past the ino[] array, reading footer/adjacent data as inode numbers and tripping f2fs_bug_on(). No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not on CISA KEV.
Improper inode validation in the Linux kernel's F2FS filesystem allows a crafted or corrupted f2fs image to smuggle a directory entry referencing the synthetic compressed-cache inode number (max_nid), bypassing f2fs_check_nid_range() when the compress_cache mount option is disabled. Because is_meta_ino() unconditionally treats F2FS_COMPRESS_INO() as a meta inode, f2fs_iget() skips do_read_inode() and instantiates a fake internal inode instead of rejecting the out-of-range nid, enabling local memory-safety abuse. No public exploit identified at time of analysis; EPSS probability is low (0.17%, 7th percentile) and it is not on CISA KEV.
Local privilege-adjacent memory corruption in the Linux kernel's F2FS filesystem allows a low-privileged user with access to an F2FS-mounted volume to trigger a use-after-free on the atomic_inode structure. During garbage collection of an atomic (copy-on-write) file via ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE), a race with concurrent inode eviction lets the kernel dereference and populate the page mapping of an already-freed atomic_inode, corrupting kernel memory and typically causing a BUG_ON/crash. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and this is not on CISA KEV. A vendor fix that takes a reference on fi->atomic_inode before use has been merged upstream.
Out-of-bounds kernel memory read in the Linux kernel's f2fs filesystem driver allows an attacker who can get a crafted f2fs image mounted to leak kernel memory and crash the system. When the flexible_inline_xattr feature is enabled, do_read_inode() trusts the on-disk i_inline_xattr_size for inodes that carry inline dentries or inline data but lack the FI_INLINE_XATTR flag, so an unvalidated, attacker-controlled size drives inode geometry negative and produces an out-of-bounds read in f2fs_fill_dentries() when the inline directory is read. EPSS is low (0.16%, 5th percentile) and there is no public exploit identified at time of analysis nor CISA KEV listing; a vendor patch is available.
Out-of-bounds heap read in the Linux kernel's F2FS filesystem lets a local low-privileged user disclose adjacent kernel memory or crash the system by reading POSIX ACLs from a maliciously crafted f2fs image. The flaw lives in f2fs_acl_from_disk() (fs/f2fs/acl.c), which dereferences an ACL entry's e_id before confirming a full f2fs_acl_entry fits in the xattr buffer. It is fixed upstream, carries CVSS 7.8, and shows a very low EPSS (0.17%, 6th percentile); there is a KASAN crash reproducer in the report but no public weaponized exploit and no CISA KEV listing - no public exploit identified at time of analysis.
Memory corruption in the Linux kernel's F2FS filesystem lets a local low-privileged user trigger LRU list corruption and a kernel panic (denial of service) by driving garbage collection on a nearly-full F2FS partition via fallocate. The bug is a use-after-free-class race introduced by commit 9609dd704725 in move_data_block(), where a folio is dropped from the page cache and later split, leaving a tail page freed back to the allocator while still linked in the LRU; the fix is a revert of that commit. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low (0.15%, 5th percentile).
Filesystem cache-consistency flaw in the Linux kernel's F2FS (Flash-Friendly File System) driver leaves a stale 'largest extent' entry cached when __destroy_extent_node() sets the FI_NO_EXTENT inode flag without resetting the extent length or updating the inode folio, causing the extent tree to diverge from on-disk metadata. Affected are local users of F2FS-formatted volumes across many stable kernel lines (6.6.x through 6.18.x and 7.x pre-releases); the bug surfaces as a sanity_check_extent_cache error (reproduced by xfstests generic/388) and, per source tagging, carries an information-disclosure angle because stale block mappings can point reads at the wrong physical blocks. No public exploit identified at time of analysis; EPSS is 0.16% (5th percentile), and it is not on CISA KEV.
Memory corruption in the Linux kernel's cgroup BPF sysctl filtering path allows a local privileged user to corrupt kernel memory and potentially escalate privileges. The bug is a mismatched allocator/deallocator: proc_sys_call_handler() allocates the temporary sysctl buffer with kvzalloc() (which falls back to vmalloc() for large writes) but the replacement path in __cgroup_bpf_run_filter_sysctl() frees it with kfree(), which is invalid for vmalloc-backed memory. It carries a CVSS of 7.8 (High) with a local vector; EPSS is very low (0.19%, 9th percentile) and there is no public exploit identified at time of analysis, consistent with a memory-safety fix flagged by an experimental static-analysis tool rather than in-the-wild abuse.
Memory corruption in the Linux kernel's exFAT filesystem driver allows a crafted exFAT image to trigger a use-after-free in exfat_find_dir_entry(): the buffer_head backing the directory entry (bh) is released via brelse() before the fall-through TYPE_EXTEND branch still reads through the ep pointer into bh->b_data. Any system that mounts an attacker-supplied exFAT volume (e.g. a USB stick or disk image with a long filename engineered to force same-hash collisions down the TYPE_EXTEND path) is affected; the stale dereference can fault or corrupt kernel memory. No public exploit identified at time of analysis, and the input CVSS 9.8/AV:N score is not credible for a local filesystem-parsing bug that the reporter could only trigger under instrumentation (KASAN + DEBUG_PAGEALLOC with a debug invalidate_bdev()).
Out-of-bounds read in the Linux kernel's KVM x86 shadow MMU allows a malicious or misbehaving guest to trigger a host kernel page fault (crash) during hugepage recovery. The flaw occurs when the KVM host recovers hugepages and queries the max mapping level for a direct shadow page whose base gfn falls outside the target memslot, causing an out-of-bounds access into the vmalloc'd lpage_info array. Rated CVSS 8.8 (local, scope-changed) but with low real-world exploitation probability (EPSS 0.17%); no public exploit and no CISA KEV listing - no public exploit identified at time of analysis.
Guest-to-host denial of service in the Linux kernel's x86 KVM ioeventfd datamatch handling allows a malicious VM to crash the hypervisor host via a reachable BUG_ON(). A guest that issues an unaligned store spanning a page boundary and hitting a datamatch-enabled ioeventfd at offset 0 of the second page triggers an alignment assertion in ioeventfd_write(), panicking the host kernel. The defect has existed since 2009 (kernel 2.6.32); EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis, though the commit message includes a working reproducer trace.
A local privilege-context memory corruption in the Linux kernel's IBM PowerPC 'nx' hardware crypto driver (drivers/crypto/nx) causes a kernel oops when userspace uses the AF_ALG socket interface for shash hashing. nx_crypto_ctx_shash_exit passed a wrong pointer type (an nx_crypto_ctx* treated as a crypto_tfm*) into nx_crypto_ctx_exit, producing a bad-address kernel access (observed at 0xc0403effffffffc8) during teardown, reachable by any local user - e.g. hardlink(1) opportunistically selecting AF_ALG. No public exploit is identified at time of analysis; EPSS is low (0.17%) and this is not on CISA KEV, so real-world risk is a local denial-of-service (kernel crash) on affected NX-capable POWER systems rather than confirmed code execution.
Local privilege escalation or denial of service in the Linux kernel's GFS2 filesystem is possible via a use-after-free in gfs2_qd_dealloc(), where an RCU callback dereferences the superblock (sdp) through qd->qd_sbd after gfs2_put_super() may have already freed it via free_sbd() during unmount. The race is exploitable when GFS2 quota cleanup RCU callbacks outlive the 60-second sd_kill_wait timeout or are re-scheduled by gfs2_gl_hash_clear(). No public exploit has been identified at time of analysis, and EPSS is low (0.17%, 6th percentile), consistent with a hard-to-win kernel race rather than a mass-exploited flaw.
Local privilege escalation via kernel use-after-free in the Linux kernel's hdlc_ppp WAN driver allows a user able to configure synchronous HDLC/PPP network devices to corrupt kernel memory. The bug stems from per-protocol LCP/IPCP/IPV6CP timers embedded in the hdlc->state (struct ppp) allocation being freed with kfree() during device teardown or protocol re-attach without synchronizing a possibly-running timer callback, so an in-flight ppp_timer dereferences freed memory. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; not listed in CISA KEV.
Local privilege-escalation-capable memory corruption in the Linux kernel's blk-cgroup (block I/O controller) subsystem allows a local user to trigger a use-after-free in __blkcg_rstat_flush() by concurrently releasing multiple block cgroups (blkgs) within the same blkcg. Affected kernels span 6.4 through the fixed 6.6.144 / 6.12.95 / 6.18.38 / 7.1.3 / 7.2-rc1 line; the flaw carries CVSS 7.8 (local, low-privilege) and is fixed upstream. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Use-after-free (KASAN slab-use-after-free read) in the Linux kernel's TIPC cryptographic subsystem allows freed per-netns tipc_crypto state to be dereferenced by an asynchronous decrypt completion callback. When TIPC encryption is enabled and crypto_aead_decrypt() is offloaded asynchronously (e.g. via the SIMD/cryptd wrapper), tipc_aead_decrypt() never takes a netns reference, so if the bearer's network namespace is torn down mid-flight the cryptd worker's tipc_aead_decrypt_done() reads freed memory (aead->crypto->stats, ->net, ->aead[] and the node table). There is no public exploit identified at time of analysis and it is not in CISA KEV; it was surfaced by 0sec automated security-research tooling with a KASAN reproducer, and CVSS is rated 8.8.
Use-after-free in the Linux kernel pNFS (parallel NFS) client, specifically in pnfs_update_layout(), lets a stale layout header (lo) be read by a tracepoint after pnfs_put_layout_hdr() has already freed it when execution takes the NFS_LAYOUT_RETURN branch. The flaw affects Linux NFS clients that mount pNFS-backed exports across a wide range of stable series (5.4.x, 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x and 7.x-rc). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the tags label it Information Disclosure, consistent with a tracepoint reading freed memory. The published CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) appears inflated for what is a client-side, race-dependent memory-safety bug.
Local memory corruption in the Linux kernel scheduler's per-mm concurrency-ID (mm_cid) subsystem lets an unprivileged task trigger a deterministic out-of-bounds single-bit clear in kernel memory. The flaw lives in mm_cid_fixup_cpus_to_tasks(), where a task whose CID is still the MM_CID_UNSET sentinel (BIT(31)) is wrongly marked in-transit and later fed to clear_bit(), clearing a bit 256 MiB past the mm_struct CID bitmap. It was surfaced by syzkaller as a KASAN use-after-free in __schedule; no public weaponized exploit and no CISA KEV listing exist at time of analysis.
Use-after-free in the Linux kernel's rpmsg character device driver (rpmsg_char) allows local attackers on rpmsg-enabled platforms to trigger access to freed endpoint memory during a probe-failure race. The flaw exists because rpmsg_chrdev_probe() publishes the newly allocated eptdev in the default endpoint's priv pointer before rpmsg_chrdev_eptdev_add() completes, so a failed add frees eptdev while the default endpoint can still dispatch callbacks against the stale pointer. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list; it is a defensive stable-tree fix rather than an observed in-the-wild vulnerability.
Out-of-bounds memory access in the Linux kernel's OCFS2 cluster filesystem allows a crafted on-disk group descriptor to trigger a use-after-free/OOB read during suballocator bitmap operations. The bug lives in ocfs2_validate_gd_parent(), which only checked bg_bits against the parent allocator's chain geometry and not against the bytes that physically fit in the group descriptor block, so a malicious bg_size/bg_bits pair drives later bitmap scans (ocfs2_find_max_contig_free_bits / ocfs2_block_group_set_bits) past bg_bitmap. It was found via KASAN and fixed upstream; no public exploit has been identified at time of analysis.
Use-after-free and refcount underflow in the Linux kernel's 9p (Plan 9) filesystem client allows a local attacker interacting with a 9p mount to corrupt kernel memory, potentially escalating privileges or crashing the system. The flaw lives in p9_client_walk(): when called with clone=false the new fid aliases oldfid, and a failed multi-component walk incorrectly drops oldfid's reference via the clunk_fid error path, freeing a fid the caller still holds. No public exploit is identified at time of analysis (a reproducer exists only 'on request'), and it is not listed in CISA KEV; the vendor-supplied CVSS of 10.0 appears substantially overstated for a bug requiring an active 9p mount.
Out-of-bounds heap write in the AMD SEV debug-encrypt path (sev_dbg_crypt/__sev_dbg_encrypt_user) of the Linux kernel's KVM/SVM code (kvm_amd) lets a local, privileged VMM process corrupt kernel slab memory by up to 15 bytes past a single-page buffer. The per-iteration transfer length is bounded by the source page offset but not the destination page offset, so when d_off > s_off the PSP command and a following memcpy()/copy_from_user() spill beyond the 4096-byte dst_tpage allocation. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but a KASAN slab-use-after-free splat is included in the report, confirming reliable reproducibility.
Local information disclosure and use-after-free in the Linux kernel NTFS filesystem driver lets a low-privileged local user read freed kernel memory by racing the FS_IOC_GETFSLABEL and FS_IOC_SETFSLABEL ioctls against a mounted NTFS volume. Because vol->volume_label is copied to userspace via copy_to_user without serialization, a concurrent SETFSLABEL that replaces the label can free the buffer mid-read, leaking kernel data or crashing the system. No public exploit is identified at time of analysis and it is not in CISA KEV; a vendor patch is available in Linux 7.1.3 and 7.2-rc1.
Kernel memory disclosure in the Linux kernel fbcon (framebuffer console) subsystem allows a local low-privileged attacker to trigger an out-of-bounds read by exploiting incomplete error-path rollback in fbcon_do_set_font(). When a font-set operation fails partway (e.g., vc_resize() allocation failure under memory pressure), the hi_font_mask and screen buffer are left desynchronized from the reverted 256-character font array, causing the VT subsystem to render character indices above 255 against undersized data. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available across multiple stable branches.
Local privilege escalation and kernel memory corruption in the Linux kernel's omap2 framebuffer driver (omapfb) arises from a use-after-free race between omapfb_mmap() and the OMAPFB_SETUP_PLANE/OMAPFB_SETUP_MEM ioctls. Because fb_mmap() holds only mm_lock while the ioctl path holds only fb_info->lock, a local user on a TI OMAP2 device can reassign a framebuffer region mid-mmap so that the map_count of the freed region is never incremented, leaving userspace with a mapping to freed physical memory. This is an information-disclosure/corruption primitive (tagged 'Information Disclosure') with no public exploit identified at time of analysis; the upstream fix is merged and a patched release exists.
Local privilege escalation and denial of service in the Linux kernel's I2C core subsystem arises because an I2C adapter is added to the global IDR lookup table before its embedded struct device is fully initialised. Because i2c_get_adapter() and the i2c-dev chardev (registered via a bus notifier) can look up an adapter by id and take a reference to that device during this window, a concurrent caller can access uninitialised data, leading to NULL-pointer dereference or use-after-free. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; the fix has been merged and backported across stable trees.
Use-after-free in the Linux kernel NFS server (nfsd) pNFS layout code allows an NFSv4.1+ client to leave a freed layout state ID published in the client's IDR when nfsd4_layout_setlease() fails, so any later IDR walk (states_show, client teardown) dereferences a dangling slab pointer. The affected component is the pNFS block/SCSI/flexfiles layout server path on kernels between commit c5c707f96fc9 and the fixed stable releases. No public exploit has been identified and it is not in CISA KEV; the practical impact is kernel memory corruption leading to crash (DoS) and possible information disclosure per the vendor tag, though the auto-assigned CVSS of 9.8 significantly overstates real-world exploitability.
Improper error-path cleanup in the Linux kernel NFS server (nfsd) lets a remote NFSv4 client crash or potentially corrupt server memory by sending a truncated SECINFO_NO_NAME operation. Because nfsd4_decode_secinfo_no_name() initializes sin_exp only after decoding sin_style, a bad-XDR failure leaves sin_exp holding stale union data from a prior operation, which the error path then passes to exp_put(). No public exploit has been identified at time of analysis; the NVD-assigned 9.8 score overstates the realistic impact, which is primarily denial of service.
Denial of service in the Linux kernel's NFS server (nfsd) ACL handling allows remote clients to leak kernel memory by sending SETACL requests that fail decoding partway through. When nfsaclsvc_decode_setaclargs() (NFSv2 ACL) or nfs3svc_decode_setaclargs() (NFSv3 ACL) successfully decodes the NFS_ACL entry but then fails on the NFS_DFACL entry, the already-allocated posix_acl is orphaned for the server's lifetime because the wired pc_release handlers only performed fh_put() and svc_process() skips the proc function (where cleanup lived) on decode failure. There is no public exploit identified at time of analysis and this is not in CISA KEV; the impact is gradual memory exhaustion rather than code execution or data disclosure.
Denial of service and an ACL enforcement flaw in the Linux kernel's NFSv4 server (nfsd) allow an authenticated NFS client to leak kernel memory and bypass RFC-mandated attribute validation. The nfsd4_create_file() path silently discards the return value of nfsd4_acl_to_attr(), so a CREATE supplying an unsupported/unconvertible ACL succeeds with NFS4_OK and no ACL applied, and a failing start_creating() (e.g. an over-length filename) leaks posix_acl allocations on every attempt. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; the fix has been merged upstream.
Remote denial of service in the Linux kernel NFS server (nfsd) allows an NFSv4 client to leak kernel memory by sending CREATE requests that encode both a native NFSv4 ACL (FATTR4_WORD0_ACL) and POSIX default/access ACLs (FATTR4_WORD2) in the same fattr bitmap. A dead conflict-guard in nfsd4_create() fails to release the original posix_acl objects when nfsd4_acl_to_attr() overwrites them, leaking two posix_acl slab objects per request; repeated requests drive unbounded slab exhaustion. There is no public exploit identified at time of analysis, this is not on CISA KEV, and the impact is availability only (CVSS 7.5, A:H) despite the input tag labelling it 'Information Disclosure'.
Memory exhaustion in the Linux kernel NFS server (nfsd) arises from a leak of a pre-allocated openowner structure in find_or_alloc_open_stateowner() when handling NFSv4.0 OPEN retries. When an unconfirmed owner is encountered, release_openowner() runs and control falls through the `if (oo)` cleanup guard, so a previously allocated `new` state-owner (slab object plus owner-name buffer) is silently overwritten and leaked. Remote clients that can reach the NFS service can, under a specific race, repeatedly trigger this leak to degrade or exhaust server memory. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; impact is availability-only (no data disclosure despite the mislabeled tag).
Remote denial-of-service in the Linux kernel NFSv4 flexfiles (pNFS) client allows a malicious or compromised NFS server to crash a mounting client via a malformed flexfiles layout that declares a zero filehandle-version count. The flaw stems from ff_layout_alloc_lseg() accepting fh_count == 0, which produces a ZERO_SIZE_PTR that is later dereferenced during layoutreturn encoding, triggering a null-pointer-deref and kernel panic. No public exploit identified at time of analysis, though the commit includes a QEMU/KASAN reproducer; CVSS 7.5 reflects availability-only impact (A:H) with no confidentiality or integrity effect.
Remote denial of service in the Linux kernel's NFSv4/pNFS flexfiles client allows a malicious or compromised NFS metadata server to crash any mounted client by returning a GETDEVICEINFO response containing a zero-length r_addr or r_netid opaque. The decoder nfs4_decode_mp_ds_addr() only checks for negative lengths, so a zero-length value leaves the buffer pointer NULL and the subsequent strrchr(NULL, '.') triggers a kernel NULL-pointer dereference and panic. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a targeted server-side trust attack rather than mass exploitation.
Heap out-of-bounds read in the Linux kernel's in-kernel SMB server (ksmbd) lets an authenticated SMB client leak kernel heap memory or crash the server on shares that use ACL xattrs. The flaw lives in smb_check_perm_dacl(), which validates an ACE header and caps sub-authority count but never confirms the ACE is large enough to hold those sub-authorities before compare_sids() dereferences them. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a memory-disclosure/DoS bug rather than a mass-exploited RCE.
Use-after-free in the Linux kernel's TCP Authentication Option (TCP-AO) subsystem lets a local low-privileged user leak freed slab memory by adding a signing key with set_current/set_rnext=1 while a socket is in CLOSE state, transitioning it to LISTEN, then deleting the key asynchronously and reading TCP_AO_INFO. The del_async cleanup path fails to clear the dangling current_key/rnext_key pointers, so a later getsockopt(TCP_AO_INFO) dereferences freed key memory (CVSS 7.8, tagged Information Disclosure). No public exploit identified at time of analysis and EPSS probability is low (0.17%), making this a patchable memory-safety defect rather than an actively exploited threat.
Use-after-free in the Linux kernel's FUSE (Filesystem in Userspace) subsystem allows a local low-privileged attacker to access or corrupt freed kernel memory by racing a request abort against the page-cache folio replacement path in fuse_try_move_folio(). Because the function unlocks the request on entry but fails to re-lock it on the success path, fuse_chan_abort() can end the request and free the fuse_io_args (e.g., via fuse_readpages_end()) while the subsequent copy-chain logic still dereferences that structure. Rated CVSS 7.8 (local, high C/I/A impact); no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile).
Out-of-bounds array read in the Linux kernel's IIO veml6075 UV light sensor driver allows a local low-privileged user reading the sensor's integration-time data to trigger access past the 5-element veml6075_it_ms lookup table. The VEML6075_CONF_IT register field can decode to index values 0-7, but only indices 0-4 are valid; a reserved value (5-7) drives the driver to read beyond the array. This is a hardening fix against faulty hardware, device misprogramming, or bus corruption rather than a directly attacker-controllable memory-corruption primitive; no public exploit identified at time of analysis and EPSS risk is low (0.17%, 6th percentile).
Out-of-bounds array read in the Linux kernel's TI ADS1298 IIO ADC driver (ti-ads1298) lets a local, low-privileged actor read past the 7-element ads1298_pga_settings table when a channel's PGA field decodes to the reserved value 7 (0b111). Affected are systems running the ti-ads1298 driver against a TI ADS1298 biopotential/ECG analog front end; the upstream fix adds a bounds check that returns -EINVAL. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile), consistent with a niche, hardware-dependent code path rather than a broadly weaponizable flaw.
Use-after-free in the Linux kernel's 8250_dw (Synopsys DesignWare) serial driver arises when dw8250_probe() fails during clk_notifier_register(): the already-registered 8250 port is left occupying its slot while its devm-allocated driver data is freed, leaving stale private_data and serial_in/serial_out callbacks that reference freed memory. The flaw affects kernels from 5.9 through the fixed stable releases and is tagged as an information-disclosure risk; there is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile). Despite an NVD CVSS of 9.8, exploitation is gated by a probe-failure error path in a specific UART driver, so real-world reachability is far narrower than the score implies.
Denial of service in the Linux kernel in-kernel SMB3 server (ksmbd) lets remote, unauthenticated clients crash the ksmbd worker via a crafted COMPOUND request. Because smb2_check_user_session() skips the SMB2_SESSION_VALID state check for non-first compound operations and treats a SessionId of 0xFFFFFFFFFFFFFFFF as automatically valid, a TREE_CONNECT chained onto a half-open session (created by an NTLM Type-1 negotiate blob, sess->user still NULL) reaches ksmbd_ipc_tree_connect_request() and dereferences a NULL pointer, wedging the worker for all clients. EPSS is low (0.23%, 13th percentile) and there is no public exploit identified at time of analysis.
Local privilege escalation and memory corruption in the Linux kernel's virtiofs (virtio-fs) driver arises from a use-after-free triggered when an auto-submount is unmounted, where iput() called from fuse_release_end() can dereference an already-destroyed superblock. Because the FUSE num_waiting counter is per-connection rather than per-superblock, the shutdown wait only protects the last submount instance, leaving earlier submounts exposed. The fix reverts virtiofs auto_submounts to synchronous release requests; no public exploit is identified at time of analysis and EPSS risk is low (0.19%).
Local privilege escalation and kernel memory disclosure in the Linux kernel's Renesas RZ/V2H IVC media driver (rzv2h-ivc) stems from a race condition where rzv2h_ivc_transfer_buffer() calls list_del() on the shared buffer queue from a workqueue context without holding the protecting spinlock. On affected embedded systems using the RZ/V2H SoC, a local low-privileged user can concurrently modify the buffer list to corrupt kernel memory, potentially leaking data or achieving code execution. EPSS is low (0.14%, 4th percentile) and there is no public exploit identified at time of analysis; the flaw is fixed upstream in the stable kernel tree.
Local privilege escalation / memory corruption in the Linux kernel's amdgpu VCE (Video Compression Engine) driver allows an unprivileged local user with access to the AMD DRM render node to trigger a bad address being written into VCE firmware. The flaw stems from the command-buffer address-patching routine accepting a partially-valid relocation where only the low or high half of an address is present, producing a malformed pointer handed to firmware. No public exploit is identified at time of analysis (EPSS 0.16%, not in CISA KEV), and vendor stable-tree patches are available across all maintained branches.
Improper memory initialization in the Linux kernel's AMD GPU driver (drm/amdgpu) allows a stale, uninitialized GART page-table entry to be speculatively loaded into the GPU TLB, causing the GPU to reference the wrong physical memory. Affected are systems running AMD GPUs on kernels before 6.1.175, 6.6.140, 6.12.90, 6.18.32 and 7.0.9; a low-privileged local user with GPU access could potentially trigger disclosure of adjacent memory or corrupt GPU address translation. No public exploit identified at time of analysis, and EPSS is low (0.16%), consistent with a hardware-specific correctness flaw rather than a mass-exploitable bug.
Improper error handling in the Linux kernel's memory management VMA subsystem (mm/vma) allows a local low-privileged user to trigger a kernel warning and potential instability when an mmap() error path attempts to unmap an already-detached VMA. The flaw affects the mmap_prepare hook compatibility layer used by 'stacked' drivers such as overlayfs and shm in Linux 6.19 (and related stable branches), where a not-fully-established VMA pointer is passed to the caller. No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile), and it is not on CISA KEV, indicating a robustness/correctness fix rather than an actively exploited weakness despite the high NVD CVSS score.