Linux
Monthly
Use-after-free race condition in the Linux kernel RDMA/ucma subsystem allows a local attacker with access to the userspace connection manager interface to corrupt kernel memory and achieve privilege escalation. The flaw exists in ucma_set_ib_path(), which invokes ucma_event_handler() without holding the handler lock that serializes access to ctx->file; a concurrent ucma_migrate_id() call can swap ctx->file between reads inside the handler, causing an event to be enqueued on file B's list while only file A's mutex is held - a condition confirmed by a KASAN slab-use-after-free trace in the upstream commit. Patches are available for all actively supported stable kernel branches (6.12.109, 6.18.50, 7.2.4, 7.3-rc1); no public exploit or active exploitation has been identified.
A race condition in the Linux kernel's RDMA/ucma subsystem allows an unprivileged local user to corrupt kernel data structures and deadlock a mutex by racing ucma_write_cm_event() against ucma_migrate_id(). The device /dev/infiniband/rdma_cm carries world-readable/writable permissions (0666), and the kernel description explicitly states no physical RDMA hardware is required to reach the vulnerable code path, making this accessible to any local user on an affected system. The race causes ctx->file to be swapped mid-sequence across four dereferences - resulting in a kernel BUG at lib/list_debug.c, a permanently held mutex wedging subsequent writers in uninterruptible D-state, and a stranded uevent that outlives its owning context. No public exploit has been identified at time of analysis.
Dangling pointer in the Linux kernel AS3722 PMIC regulator driver leaves `pdev->dev.of_node` referencing freed memory after `of_node_put()` prematurely drops the reference acquired by `of_get_child_by_name()` during Device Tree parsing in `as3722_get_regulator_dt_data()`. Systems running the ams AS3722 Power Management IC driver - predominantly NVIDIA Tegra-based embedded platforms - are affected across all kernel versions since Linux 3.13. If the stale pointer is subsequently dereferenced by regulator framework operations, kernel memory corruption, information disclosure, or local privilege escalation may result; no public exploit code has been identified at time of analysis.
Memory order mismatch in the Linux kernel ring-buffer subsystem exposes a race condition between ring_buffer_alloc_read_page() and ring_buffer_subbuf_order_set() that can corrupt the bpage->order metadata field relative to actual allocated memory size. When subbuf_order changes mid-allocation, subsequent operations using bpage->order to calculate buffer boundaries may read or write outside the allocated slab region, enabling a low-privileged local attacker with access to tracefs/debugfs interfaces to potentially disclose kernel memory contents or destabilize the kernel. No public exploit code exists and EPSS is low at 0.20%, indicating limited exploitation interest despite the fix being available in stable kernel releases.
Linux kernel ring-buffer subsystem exposes a race condition between subbuffer resize and page allocation/free operations, enabling local privilege escalation. When ring_buffer_subbuf_order_set() clears cpu_buffer->free_page without holding the cpu_buffer->lock, a concurrent ring_buffer_alloc_read_page() or ring_buffer_free_read_page() call can operate on a stale or freed page, producing kernel memory corruption. No public exploit code exists and EPSS is 0.20%, but the CVSS 7.8 C:H/I:H/A:H vector reflects full kernel-level impact potential once the race is won.
Memory management order mismatch in the Linux kernel ring-buffer tracing subsystem allows a local low-privileged user to corrupt kernel memory or crash the system by triggering a ring buffer resize concurrently with cached reader page discard. The root cause is that cpu_buffer::free_page stores only a page address without preserving the allocation order; after a resize changes cpu_buffer->subbuf_order, free_pages() is invoked with the new order rather than the original, corrupting the buddy allocator's state. Vendor-released patches exist in Linux 6.18.51, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV listing exists, and EPSS stands at 0.20%.
Page-list corruption in the Linux kernel ring-buffer subsystem allows a local low-privileged attacker to trigger undefined memory behavior by exploiting improper handling of a failed remote reader page swap. When the tracing ring-buffer's `swap_reader_page` callback returns `-EBUSY` - which occurs during an event storm on a small buffer - `__rb_get_reader_page_from_remote()` incorrectly proceeds as though the swap succeeded, splicing the same physical page as both the previous and new reader entry simultaneously. This corrupted page-list state can result in confidentiality loss from stale kernel memory reads, integrity violations from writes to a doubly-referenced page, or kernel panic. No public exploit or active KEV listing exists; EPSS is 0.15%, consistent with a low-likelihood local kernel race condition.
Heap buffer overflow in the Linux kernel orangefs client debug-mask parser allows a local low-privileged attacker to corrupt kernel heap memory and potentially escalate privileges. The flaw originates in `orangefs_prepare_cdm_array()`, where buffer sizing via `strcspn()` and subsequent parsing via `sscanf %s` diverge in how they handle leading whitespace - a crafted debug mask entry prefixed with a space causes an undersized allocation that `sscanf` then overwrites. Vendor-released patches are available across all active stable branches (6.12.109, 6.18.50, 7.2.4, 7.3-rc1); no public exploit or active exploitation is identified.
Heap out-of-bounds write in the Linux kernel's ocfs2 o2dlm (distributed lock manager) allows a malicious cluster member to corrupt or panic peer nodes. The dlm_migrate_request_handler() accepts a peer-supplied name-length field (migrate->namelen) from a DLM_MIGRATE_REQUEST message without bounds-checking and passes it to dlm_init_mle(), which memcpy()s up to ~215 attacker-controlled bytes past the 32-byte mname[] field of an o2dlm_mle slab object. Any node that has joined the DLM domain can trigger it; there is no public exploit and it is not in CISA KEV, with EPSS at just 0.20%.
Kernel memory corruption in the Linux kernel's OCFS2 cluster filesystem distributed lock manager (o2dlm) allows any node in a DLM domain to crash or corrupt the heap of a peer node. The dlm_mig_lockres_handler for DLM_MIG_LOCKRES recovery messages trusts the peer-supplied num_locks and lockname_len fields without validation, producing an out-of-bounds read that ends in a BUG_ON panic and a heap out-of-bounds write into a fixed 32-byte lockname slab object. No public exploit identified at time of analysis; EPSS is low at 0.20% (10th percentile), and the fix is available across multiple stable kernel branches.
Out-of-bounds read and write in the Linux kernel's ocfs2 refcount block validator allows a local privileged attacker to corrupt kernel memory via a crafted or corrupted filesystem image. The `ocfs2_validate_refcount_block()` function fails to validate `rl_used` and `rl_count` fields against the actual fixed per-block capacity before refcount/reflink/CoW operations walk the record array, allowing a crafted `rl_used == 0xffff` to drive the loop 65534 iterations past the end of the 4096-byte metadata block. A subsequent `memmove()` of up to ~1 MiB from an already out-of-bounds offset in `ocfs2_insert_refcount_rec()` can corrupt arbitrary kernel memory. No public exploit and no KEV listing; EPSS is 0.20% reflecting realistic low exploitation probability.
Slab out-of-bounds read in the Linux kernel's ocfs2 filesystem lets a crafted on-disk image trigger memory disclosure once mounted. The indexed-directory validators ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check ECC and signature but never bound the ocfs2_dx_entry_list de_num_used/de_count counts against the 4KB metadata block capacity, so ocfs2_dx_dir_search() walks up to 0xffff entries far past the block. Any path lookup, stat(), or open() on an indexed directory in a malicious image reads adjacent slab memory. EPSS is low (0.20%, 10th percentile); no public exploit identified at time of analysis and it is not in CISA KEV.
Arbitrary kernel memory read/write in the Linux kernel's OpenRISC architecture syscall handler allows an unprivileged local process to overwrite kernel structures such as the sys_call_table and achieve kernel-context code execution. The `sys_or1k_atomic()` function (syscall 244 in the or1k ABI) performs a hand-written assembly atomic word swap between two user-supplied pointers without calling `access_ok()`, and its four memory-access instructions lack exception table entries - meaning any kernel address passed by a caller is directly dereferenced without fault isolation. Patches are confirmed in stable series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation is identified.
Use-after-free in the Linux kernel's OpenVSwitch connection tracking (CT) limit subsystem allows a low-privileged local user with access to user and network namespaces to trigger a slab-use-after-free in ovs_ct_execute() during network namespace teardown. The race condition arises because the CT limit pointer was freed under ovs_mutex without first removing it from RCU-protected packet processing paths or waiting for a grace period, enabling concurrent packet processing threads to dereference already-freed memory. No public exploit or CISA KEV listing exists; EPSS is 0.17%, reflecting low observed exploitation activity at the time of analysis.
OpenVSwitch packet forwarding in the Linux kernel exposes a page-cache write primitive ("Fragnesia") when MSG_ZEROCOPY packets are processed through the userspace upcall error path. When `queue_userspace_packet()` fails and calls `skb_tx_error()` on a still-live, still-forwarded skb, it strips `SKBFL_SHARED_FRAG` via `skb_zcopy_clear()`. A subsequent local ESP-in-UDP delivery then invokes `esp_input()` without `skb_cow_data()` copy-on-write protection, causing in-place AEAD decryption over page-cache pages the low-privileged sender does not own. Patches are available for stable series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or KEV listing exists at time of analysis.
Use-after-free in the Linux kernel IPMI message handler allows a local low-privileged user to corrupt kernel memory by racing `_ipmi_destroy_user()` against concurrent RCU readers in `find_cmd_rcvr()` and `handle_ipmb_get_msg_cmd()`. A regression introduced by commit 9e91f8a6c868 removed the `synchronize_rcu()` grace period that previously ensured no readers held live pointers to `cmd_rcvr` structures before `kfree()` was called, while the `cmd_rcvrs` list continues to be walked under plain RCU. No public exploit code has been identified at time of analysis; patched stable kernel versions are available.
Use-after-free in the Linux kernel's lockd (NFS Network Lock Manager) service allows freed-memory access during hash-bucket file traversal. The nlm_traverse_files() iterator pinned the current file but not the saved 'next' pointer across a mutex_unlock window, so a concurrent nlm_release_file() could kfree the next file and cause the iterator to dereference freed memory on its next step. Fixed across stable kernels; no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a hard-to-time race rather than a turnkey exploit.
Uninitialized kernel memory disclosure in the Linux kernel NVMe subsystem affects all kernels from commit 530436c45ef2 through fixed releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. When a discard (TRIM/DSM) operation is issued and the GFP_ATOMIC allocation for the 4096-byte DSM payload fails under memory pressure, the kernel falls back to the per-controller ctrl->discard_page, which was allocated with alloc_page(GFP_KERNEL) in nvme_init_ctrl() but never zeroed - causing up to 4080 bytes of stale kernel data (vmemmap struct page pointers and other heap residue) to be transmitted to the NVMe controller. No public exploit exists and EPSS is 0.20%; the input CVSS vector AV:N/AC:L/PR:N significantly overstates exploitability for what requires local privileged access under specific memory pressure conditions.
Kernel memory corruption in the Linux NVMe/TCP host driver (nvme-tcp) allows a malicious or compromised NVMe-over-TCP target to trigger a wild-memory-access write on the connecting host. The receive path gated C2HData PDUs on blk_rq_payload_bytes() alone; for a REQ_OP_WRITE_ZEROES command (no physical segments but non-zero byte count) the request iterator is never initialized, so an attacker-supplied C2HData is copied into whatever stale, driver-private iterator the previous command on that tag left behind. Fixed across stable trees; no public exploit identified at time of analysis and EPSS is low (0.20%).
Kernel memory disclosure in the Linux kernel's nvme-tcp driver allows a malicious or compromised NVMe-TCP storage controller to exfiltrate arbitrary stale kernel memory pages from a connected host. The flaw in `nvme_tcp_handle_r2t()` - which fails to validate that an incoming R2T (Ready to Transfer) PDU corresponds to a WRITE command - causes the host to respond to R2T PDUs targeting READ commands by transmitting the READ destination buffer (uninitialized kernel memory) back to the controller via H2CData PDUs. Exploitation produces no error log and the READ command completes normally, making the disclosure silent. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.17%, consistent with the infrastructure-level attacker positioning required.
Information disclosure in the Linux kernel's NVMe-over-TCP (nvme-tcp) transport driver allows a malicious or compromised NVMe-TCP storage controller to serve a truncated read response - for example, answering a 4 096-byte read with only 512 bytes while asserting DATA_SUCCESS - causing the kernel to complete the request without detecting the shortfall and deliver a buffer whose unfilled portion contains stale kernel page contents to userspace. Affected kernels include all releases from the introduction of nvme-tcp support (commit 3f2304f8c6d6ed97849057bd16fee99e434ca796) through Linux 6.12.108, 6.18.49, and 7.2.3. No public exploit or CISA KEV listing has been identified; EPSS is 0.17 % at the 6th percentile, reflecting low community exploitation activity at time of analysis.
A remotely triggerable use-after-free in the Linux kernel SCTP stack (net/sctp) lets a malicious SCTP peer free an association and its transports mid-processing, then have the kernel operate on the freed memory. By bundling COOKIE ECHO, SHUTDOWN, and SHUTDOWN ACK chunks in one packet, the peer creates an association and immediately drives it to sctp_sf_do_9_2_final(), freeing it; a subsequent chunk in the same packet then writes to the freed transport (last_time_heard) and passes the freed association to sctp_do_sm(). No public exploit is identified at time of analysis and EPSS is low (0.17%, 6th percentile), consistent with a memory-corruption bug in a non-default subsystem rather than a mass-exploited flaw.
Use-after-free in the Linux kernel SCTP stack (net/sctp) allows a peer in an established, authenticated SCTP association to trigger a stale transport reference by removing an IP address via ASCONF DEL-IP while an inbound packet is still being processed. sctp_rcv() caches the resolved transport in chunk->transport, but a concurrent sctp_assoc_rm_peer()/sctp_transport_free() can free it during the backlog window or before bh_lock_sock(), after which a delayed SACK causes sctp_outq_select_transport() to read freed memory. Fix drops such chunks in sctp_inq_push(); no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
NULL pointer dereference in the Linux kernel's SCTP stream reconfiguration handler causes a kernel panic (DoS) reachable from the network. Three SCTP processing functions - sctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out(), and sctp_process_strreset_resp() - dereference chunk->transport to stop the reconf timer when completing a stream reset, but a chunk published in asoc->strreset_chunk before transmission has a NULL transport pointer. This yields two distinct attack paths: a local unprivileged process that removes the association's last IP address then requests a stream reset, or a remote peer that crafts a RECONF chunk carrying Incoming SSN Reset, Outgoing SSN Reset, and Response sub-elements in a single packet, triggering the deref in softirq context. No public exploit code has been identified at time of analysis, and EPSS is 0.17%, but the remote network-unauthenticated path warrants prompt patching.
Integer underflow in the Linux kernel's SCTP stream reconfiguration (RECONF) handler allows a remote SCTP peer to crash the kernel by sending duplicate RECONF response chunks. When a cached RECONF chunk contains an ADD_OUT request alongside other parameters, a duplicate response causes the kernel to roll back `stream->outcnt` twice - the second decrement underflows the unsigned counter and can trigger a kernel panic. EPSS exploitation probability is 0.20% (10th percentile), no public exploit exists, and no CISA KEV listing has been issued, indicating no known active exploitation at time of analysis.
Use-after-free in the Linux kernel charger-manager power supply driver exposes local low-privileged users to kernel memory corruption and potential privilege escalation. The driver's probe path registers power_supply sysfs attributes before acquiring regulator handles, and its remove path frees regulator consumer handles before tearing down sysfs - creating two overlapping windows where a write to the externally_control attribute, or the remove path's own try_charger_enable() call, dereferences already-freed memory. No public exploit exists and EPSS is 0.20%, but the bug was discovered by static analysis rather than observed in-the-wild attacks, and patches are available in stable kernel trees 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Slab out-of-bounds write in the Linux kernel's cros_usbpd-charger driver allows a malfunctioning, malicious, or compromised Chrome Embedded Controller (EC) to corrupt kernel heap memory during device probe. The driver accepts EC-reported USB PD port counts as loop bounds without validating them against EC_USB_PD_MAX_PORTS (8), so an EC returning any count N > 8 - up to the u8 maximum of 255 - writes N pointers into an 8-entry slab-allocated array, overflowing by up to 247 entries (~1976 bytes). No public exploit exists and EPSS is 0.17%, reflecting the high-complexity attack path that requires prior EC firmware compromise.
Out-of-bounds write in the Linux kernel's cros_usbpd-charger driver allows kernel memory corruption when a malicious or compromised ChromeOS Embedded Controller (EC) returns a falsified USB PD port count. Kernels from approximately v4.20 through unpatched 6.12.x, 6.18.x, and 7.2.x stable branches fail to clamp the EC-supplied charger port count to EC_USB_PD_MAX_PORTS before iterating, enabling heap corruption with potential for privilege escalation or system crash. No public exploit exists (EPSS 0.17%, 6th percentile), and patches have been released in 6.12.109, 6.18.50, and 7.2.4.
Use-after-free in the Linux kernel's LP8727 battery charger driver allows local exploitation via a race condition in lp8727_release_irq() that can corrupt kernel memory. The defect exists because lp8727_release_irq() cancelled the delayed work before freeing the IRQ, leaving a window where a concurrently delivered IRQ could cause the threaded handler lp8727_isr_func() to re-arm the work via schedule_delayed_work(); after the .remove path returned and the devm layer freed pchg, lp8727_delayed_func() could still execute and dereference the freed structure. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17%, consistent with a static-analysis-detected defect with no known weaponization.
Missing null termination in the Qualcomm battery manager driver (qcom_battmgr) causes the kernel to read beyond a string buffer boundary when firmware on SC8280XP-based devices returns a string that exactly fills the BATTMGR_STRING_LEN field. The three contiguous string fields - model_number, serial_number, and oem_info - are exposed to userspace via the power supply sysfs interface using a bare "%s" format, meaning an unterminated firmware string causes the kernel to traverse into adjacent struct members and leak their contents to unprivileged local readers. No public exploit has been identified at time of analysis; patches are confirmed for stable branches 6.12.109, 6.18.50, and 7.2.4.
Use-after-free vulnerability in the Linux kernel's rt9455 power supply driver allows local exploitation through a race condition between delayed workqueue callbacks and driver teardown. The rt9455_remove() function cancels work items in an order that permits batt_presence_work to re-queue max_charging_time_work after the latter has already been cancelled, resulting in a callback executing against already-freed rt9455_info memory. Identical UAF exposure exists in the probe error path if rt9455_hw_init() fails after the IRQ is registered. No public exploit exists and EPSS is 0.17% (6th percentile); the vulnerability was identified by static analysis rather than observed in exploitation.
Register corruption in Linux kernel s390/percpu silently drops the `mviy` instruction on kernels compiled with GNU binutils prior to 2.39, leaving the per-CPU address register unrepaired after CPU migration following an interrupt. Affected kernels are limited to IBM s390/zSeries architecture builds in the 7.2 lineage using the older toolchain. With C:H/I:H/A:H in the CVSS vector, successful exploitation by a local attacker could lead to privilege escalation via corrupted per-CPU data, though no public exploit or KEV listing exists and EPSS is 0.15%.
Silent data corruption in the Linux kernel's s390/dasd subsystem causes local processes to silently receive zeroed data for the unread portion of partially-completed ESE (Extent Space Efficient) disk reads that pass through the ERP (Error Recovery Procedure) chain. The root cause is dasd_default_erp_postaction() omitting the proc_bytes field when copying per-request state back from the ERP request to the originating request, which causes __dasd_cleanup_cqr() to treat the request as fully satisfied and return without requeuing the unread remainder. No public exploit code exists and no active exploitation is confirmed; vendor-released patches are available across multiple stable branches.
Dangling pointer vulnerability in the Linux kernel's Qualcomm MSM IOMMU driver (iommu/msm) can lead to kernel memory corruption on systems running Qualcomm MSM/Snapdragon SoCs. The msm_iommu_probe() function registers its devm-managed IOMMU object in the global qcom_iommu_devices list prior to completing sysfs and IOMMU core registration; if either iommu_device_sysfs_add() or iommu_device_register() fails, the devm framework releases the backing memory while the stale list entry remains, producing a dangling pointer that subsequent kernel list walks may dereference. Fixes are available in stable branches 6.18.50 and 7.2.4; no public exploit code has been identified and EPSS sits at 0.20% (10th percentile).
IOMMU Stream ID aliasing in the Linux kernel's Tegra241 CMDQV driver allows a guest-controlled VMM to break IOMMU isolation by supplying an oversized virtual Stream ID. The bounds check in tegra241_vintf_init_vsid() only rejects values exceeding UINT_MAX, but the SID_MATCH register's VIRT_SID field is only 20 bits wide; the 'virt_sid << 1 | 0x1' encoding silently truncates bits above position 20, causing a value like 0x80000000 to alias SID_MATCH to vSID 0 and route the IOMMU entry to the wrong DMA Stream ID. Because vdev->virt_id is guest-controlled under CMDQV virtualization, an attacker with guest VM access can break tenant isolation and gain C:H/I:H/A:H access across the IOMMU boundary to host memory and devices. No public exploit is identified at time of analysis; EPSS is 0.17%, consistent with the narrow Tegra241 hardware-specific attack surface.
A DMA-isolation misconfiguration in the Linux kernel's Intel VT-d IOMMU driver (iommu/vt-d) allows Access Control Services (ACS) to remain disabled while the IOMMU is force-enabled by tboot. The detect_intel_iommu() routine did not account for trusted-boot state, so when a user opt disabled ACS but tboot_force_iommu() later forced the IOMMU on, peer-to-peer DMA isolation could be silently weaker than the platform intended. The fix adds a tboot check so ACS is requested whenever tboot is active. No public exploit identified at time of analysis; EPSS is 0.17% (6th percentile).
Use-after-free in the Linux kernel's iommufd selftest IOPF reporting enables local privilege escalation from low-privileged users to kernel-level code execution. The race condition exists between TRIGGER_IOPF's unsynchronized borrow of a PASID attach handle and a concurrent PASID detach that frees the backing iommufd_attach_handle struct, leaving iommu_report_device_fault() dereferencing freed memory. No public exploit code exists and EPSS is low (0.20%), but kernel UAF primitives of this class are routinely leveraged for privilege escalation on affected systems.
Out-of-bounds read in the Linux kernel's Intel Speed Select Technology (ISST) platform driver allows a local low-privileged user to disclose sensitive kernel memory or crash the system via malformed ioctl input. The functions isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() accept a user-controlled level value and pass it as an array index into perf_levels[] without validating it against max_level bounds, unlike adjacent helper functions that perform this check. No public exploit is identified at time of analysis, and patches have been released for stable kernel branches 6.12.109, 6.18.50, and 7.2.4.
Two compounding flaws in the Linux kernel's Intel Speed Select Technology (ISST) ioctl handler allow a local low-privileged user to trigger out-of-bounds memory access or NULL pointer dereference in kernel space. The `isst_if_clos_assoc()` function applies an off-by-one validator (`>` instead of `>=`) against the `sst_inst[]` array boundary, permitting socket_id equal to `topology_max_packages()` to index one entry past the allocated array; a second path omits a NULL check for valid in-range socket IDs whose package has no bound TPMI SST instance, both dereferences reaching `map_partition_power_domain_id()`. Patched kernel versions 6.12.109, 6.18.50, and 7.2.4 are available; no public exploit has been identified at time of analysis and EPSS (0.20%, 10th percentile) reflects very low observed exploitation activity.
Use-after-free in the Linux kernel's via-sdmmc MMC host controller driver allows a local attacker to corrupt kernel memory during device removal. The driver's remove path (`via_sd_remove()`) frees the host structure while a previously-queued `carddet_work` work item can still dereference that freed memory via `container_of()` and MMIO base pointer access, creating a race-window that leads to memory corruption with C:H/I:H/A:H impact. No public exploit exists and EPSS sits at 0.17%, but the VIA chipset attack surface is real on older embedded and budget hardware still running affected kernels.
Use-after-free memory corruption in the Linux kernel's VIA SDMMC host controller driver (mmc/via-sdmmc) can cause kernel instability and potentially enable local privilege escalation on systems equipped with VIA SD card controllers. During driver probe failure, the card-detect interrupt and pending work item (carddet_work) are not cleaned up, leaving the interrupt handler and work queue running against already-freed memory; via_sdc_isr() dereferences the freed sdhost structure while via_sdc_card_detect() performs a container_of() dereference against freed memory. No public exploit or active exploitation has been identified; the issue was discovered through in-house static analysis and manual code review.
Heap buffer overflow in the Linux kernel's panasonic-laptop platform driver allows a local low-privileged user on affected Panasonic hardware to corrupt kernel heap memory, potentially escalating privileges. The flaw resides in acpi_pcc_retrieve_biosdata(), which writes a trailing sentinel one element past the end of the allocated pcc->sinf[] array when num_sifr equals hkey->package.count - a condition that arises specifically on Panasonic hardware where the BIOS SQTY field reports one fewer SINF entries than the actual package, triggering the driver's existing off-by-one workaround. Vendor-released patches are available in Linux 7.2.4 and 7.3-rc1; no public exploit code or active exploitation has been identified.
Out-of-bounds read and write in the Linux kernel's Chrome EC sensorhub driver exposes Chromebook-class systems to kernel heap corruption via an unvalidated 8-bit sensor number in EC FIFO events. The cros_ec_sensor_ring_process_event() function indexes batch_state[] using the sensor_num field from embedded-controller events without checking it against the allocated array size, allowing any event carrying sensor_num >= sensorhub->sensor_num to access arbitrary adjacent kernel heap memory. No public exploit or CISA KEV listing exists; EPSS is 0.20%, but the C:H/I:H/A:H CIA impact reflects the potential for kernel memory corruption on affected Chrome EC hardware.
Uninitialized physical address use in the AMD PMC driver (`amd_stb_s2d_init()`) causes the Linux kernel to call `devm_ioremap()` with physical address zero when the SMU rejects a command with error 0xff, mapping the first 16 MB of physical RAM into kernel virtual address space. Affected systems are AMD-based Linux hosts where the System Management Unit returns an error during S2D (System Trace Buffer) initialization at driver probe time. No public exploit exists and EPSS is 0.20%, consistent with the hardware-gated trigger; fixes are available in Linux 6.18.50 and 7.2.4 stable branches.
Incomplete error-path cleanup in the AMD PMC driver (`platform/x86/amd/pmc`) corrupts the kernel's global LPS0 s2idle linked list when `amd_stb_s2d_init()` fails during module probe, leaving a dangling registered handler whose backing `devm`-managed memory has been freed. On AMD-based x86 Linux systems running an affected kernel, this causes a kernel BUG (`list_add corruption`) upon module reload and a use-after-free condition on any subsequent suspend-to-idle (s2idle) transition. No public exploit exists and EPSS is 0.20% (10th percentile), but the failure condition can arise naturally on long-running systems or specific SMU firmware, making this a realistic local denial-of-service and a potential kernel code-execution path on vulnerable AMD hardware.
Off-by-one out-of-bounds NUL write in the Linux kernel's HP BIOS configuration driver (hp-bioscfg) corrupts kernel memory when hp_get_string_from_buffer() receives a BIOS attribute string whose length exactly matches the destination buffer size, causing the terminator write to land one byte past the allocation. The flaw affects multiple fixed-size kernel buffers - path[512], current_value[512], current_password/current_value[64], and the per-entry encodings[][512] and prerequisites[][512] arrays - exclusively on HP hardware with the hp-bioscfg module loaded. No public exploit code has been identified and EPSS stands at 0.17%, but the kernel write primitive carries theoretical privilege escalation potential alongside a realistic denial-of-service outcome.
Out-of-bounds heap read latency exists in the Linux kernel's `platform/x86/hp-bioscfg` ACPI package parser, where five `hp_populate_*_elements_from_package()` parsers derive their iteration bounds from `elements[0]->string.length` (the name field's byte length) rather than `obj->package.count` (the real package element count). Currently unexploitable because `hp_init_bios_package_attribute()` enforces a strict element-count pre-check, the flaw becomes reachable the moment an anticipated upstream relaxation of that check lands - at which point a local authenticated user on HP hardware could induce the parsers to read past the end of the ACPI `elements[]` array, disclosing kernel heap memory or crashing the kernel. Patches have been backported to stable series 6.12.109, 6.18.50, and 7.2.4; no public exploit exists (EPSS 0.17%).
Task context confusion in the Linux kernel's io_uring waitid subsystem allows a local low-privileged attacker to trigger __do_wait() execution from a kworker thread rather than the originating task, causing child process lookups and signal structure access to operate against the wrong process namespace. Affected kernels span from the commit introducing the vulnerable io_waitid_cb() behavior through version 7.2.3; fixes are confirmed in 7.2.4 and 7.3-rc1. No public exploit code and no KEV listing exist at time of analysis; EPSS of 0.17% reflects minimal observed exploitation activity.
Use-after-free in the Linux kernel's interconnect subsystem allows local low-privileged attackers to corrupt kernel heap memory, potentially enabling privilege escalation to root. The flaw resides in `icc_get()` and `of_icc_get_by_index()`: when `kasprintf()` fails to allocate memory for `path->name`, the error handler calls `kfree(path)` directly while the path's request structures are already linked into interconnect-node hash lists via `hlist_add_head()`, leaving dangling pointers that subsequent interconnect operations dereference. Patched kernel versions 6.12.109, 6.18.50, and 7.2.4 are available; no public exploit or CISA KEV listing exists at time of analysis.
Stack memory disclosure and integer underflow in the Linux kernel's IPMI ipmb subsystem allow a local low-privileged attacker with write access to the IPMB device node to read uninitialized kernel stack bytes and trigger a buffer length underflow in `ipmb_write()`. The root cause is that `ipmb_write()` parses message fields prior to validating the length byte, so a zero-length or undersized write crosses into adjacent stack memory. CVSS rates confidentiality impact as High (stack leak) and availability impact as High (SMBus block-write length underflow), while EPSS at 0.17% reflects the niche attack surface. No public exploit or active exploitation has been identified.
Use-after-free in the Linux kernel IPMI subsystem exposes freed kernel memory through a stale sysfs attribute left behind after a failed SMI registration. When ipmi_add_smi() encounters an error creating the maintenance_mode sysfs file, the nr_msgs attribute is not removed before the smi_info interface structure is freed, leaving a dangling sysfs entry backed by released memory. A local attacker with low privileges who can reach this error condition and then access the stale attribute may achieve arbitrary kernel memory read/write, creating a potential privilege escalation path to root. No public exploit exists and no active exploitation has been confirmed.
Memory corruption in the Linux kernel's IPMI message handler (ipmi/msghandler) stems from an incomplete error-path cleanup: when an IPMI interface encounters an error during startup, kernel workqueue items already scheduled for that interface are not canceled before the interface structure is freed, creating a use-after-free condition. Systems running kernel versions in the 6.18.20-6.18.49 and 7.0-7.2.3 ranges with IPMI-capable hardware are affected. Patches were released in stable updates 6.18.50 and 7.2.4; no public exploit exists and EPSS is very low at 0.20%.
Missing ingress-device validation in the Linux kernel's AF_IUCV HiperSockets receive path allows adjacent-network attackers on the same HiperSockets segment (VCHID) to deliver crafted ETH_P_AF_IUCV frames to sockets bound on different IQD devices, enabling accept-queue exhaustion, data injection into established connections, and attacker-controlled peer identity on newly accepted connections. A secondary local vector also exists: a process holding CAP_NET_RAW only within an unprivileged network namespace can send raw ETH_P_AF_IUCV frames over its loopback interface and have them matched against init_net sockets, bypassing namespace isolation. The fix - introduced in stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1 - adds a per-socket hs_dev check against the ingress netdev. No public exploit or CISA KEV listing is present at time of analysis.
Out-of-bounds heap write in the Linux kernel's XDP subsystem allows memory corruption when an AF_XDP zero-copy packet is redirected through cpumap. The xdp_convert_zc_to_xdp_frame() routine copies an XSK packet into an order-0 page but advertises the full PAGE_SIZE as usable and records zero headroom, letting the frame overrun the page tail reserved for skb_shared_info and triggering a KASAN slab-out-of-bounds write in skb_gro_receive during GRO processing. No public exploit identified at time of analysis and EPSS is low (0.17%); the vendor has released fixes across stable branches.
Use-after-free race condition in the Linux kernel SLIP driver's sl_sync() function exposes systems running kernels from 2.6.32 onward to local privilege escalation. The slip_devs[] global array stores bare net_device pointers without reference counting; when sl_sync() races with slip_close() teardown, a pointer can be read and dereferenced after netdev_run_todo() has already freed the backing structure because the RTNL semaphore is intentionally dropped during teardown. No public exploit or CISA KEV listing exists at time of analysis; EPSS stands at 0.20%, and the bug was surfaced by syzkaller fuzzing on kernel 6.1.134.
Memory corruption in the Linux kernel TUN/TAP driver allows a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges to root. The flaw exists in tun_get_user(), where an oversized headroom alignment value - most realistically propagated from Open vSwitch to a TUN or TAP device - causes an integer underflow in SKB_MAX_HEAD(align), producing a negative good_linear value that wraps to a massive size_t, causing tun_alloc_skb() to position skb->data outside the allocated skb head. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
TX queue stall in the Linux kernel's Broadcom bnxt network driver causes network transmission to halt on systems running software UDP Segmentation Offload (SW USO). Under burst traffic conditions, the `bnxt_sw_udp_gso_xmit` function can return early with NETDEV_TX_BUSY while leaving `txr->kick_pending` set to 1, meaning the driver has written Buffer Descriptors (BDs) but never rings the device doorbell - so the NIC never processes the queued packets and the completion event that would wake the TX queue never arrives. The stall was confirmed on a production system where a netdev TX watchdog triggered; no public exploit exists and no active exploitation has been identified.
Race condition in the Linux kernel's IPA (IP Accelerator) network driver permanently stalls the cellular modem TX queue on Qualcomm Snapdragon-based devices after a runtime power management resume cycle. The flaw occurs because the queue-wake work is dispatched during RPM_RESUMING state before RPM_ACTIVE is reached; the wake is consumed prematurely by a racing transmit, pm_runtime_get() returns -EINPROGRESS with no future wake scheduled, and the TX queue never recovers - blocking both outbound packets queued in qdisc and, through suspended endpoints, inbound RX as well. No public exploit exists and EPSS is 0.20%, but the failure manifests under normal cellular data usage without any adversarial trigger.
Use-after-free in the Linux kernel MCTP subsystem allows an unprivileged local user to corrupt kernel memory by racing mctp_route_lookup() against concurrent device teardown. The function accesses rt->dev without holding a reference, so mctp_dev_put() can kfree() mdev->addrs while mctp_saddr() is still reading rt->dev->addrs[0] - confirmed by a KASAN slab-use-after-free trace. No CAP_NET_RAW is required; any user who can open an AF_MCTP socket can reach this path, making it a low-barrier local privilege escalation candidate. No public exploit is identified at time of analysis, though the vulnerability reintroduces the CVE-2023-3439 use-after-free class and carries CVSS C:H/I:H/A:H.
Use-after-free in the Linux kernel's Open vSwitch (OVS) flow deletion path allows a local attacker with low privileges to crash the kernel or potentially escalate privileges. The bug exists in ovs_flow_cmd_del(): when a CMD_DEL netlink command removes a flow from the OVS table, flow->mask is scheduled for RCU-deferred free, but ovs_flow_cmd_fill_info() subsequently reads that pointer after the RCU grace period may have already freed it-a narrow but real race window confirmed by KASAN traces. Reported by Trend Micro's Zero Day Initiative as ZDI-CAN-32042; no public exploit or active exploitation is confirmed at time of analysis.
NULL and error pointer dereference in the Linux kernel's ravb (Renesas Ethernet AVB) driver allows a local attacker with low privileges to crash the kernel or potentially escalate privileges by querying PTP hardware clock state during an invalid lifecycle window. The flaw affects the ravb driver from Linux 4.2 onward, where priv->ptp.clock is either NULL before the first interface open or left holding an error pointer after a failed PTP clock registration. Fixes are confirmed across stable branches in kernels 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV listing exists.
Use-after-free in the Linux kernel's ravb (Renesas Ethernet AVB) PTP driver allows a local attacker with code execution to potentially escalate privileges or crash the system. The race condition between ravb_ptp_interrupt() and ravb_ptp_stop() permits the interrupt handler to invoke ptp_clock_event() on a clock pointer already freed by ptp_clock_unregister() during interface teardown. No public exploit has been identified at time of analysis, and EPSS is very low (0.20%, 10th percentile), consistent with a hardware-specific kernel bug affecting Renesas SoC deployments.
State machine corruption in the Linux kernel's Thunderbolt networking (tbnet) subsystem allows an adjacent attacker to trigger a double-teardown sequence that causes kernel panics or silently frees HopIDs still in use by other connections. The bug lies in tbnet_connected_work(): every failure path returns without clearing login_sent, so the connection appears established to tbnet_tear_down(), which then re-executes teardown on an already-unwound state - stopping rings already stopped (a dev_WARN, fatal under panic_on_warn) and potentially double-freeing net->remote_transmit_path on HopID mismatch paths. No public exploit code has been identified at time of analysis; EPSS stands at 0.20%.
Memory leak (skb leak) in the Linux kernel's NTB (Non-Transparent Bridge) transport subsystem allows an attacker reachable via the ntb_netdev virtual network interface to cause progressive kernel memory exhaustion and denial of service. The bug exists in ntb_process_tx(), which silently "handles" oversized TX buffers by invoking tx_handler() with a NULL data pointer and returning success - causing ntb_netdev to skip both its completion-callback free and its enqueue error path, permanently leaking the socket buffer. No public exploit has been identified at time of analysis; EPSS is 0.17% (6th percentile), indicating very low exploitation probability currently. Upstream patches have been released across multiple stable kernel branches.
Out-of-bounds read in the Linux kernel's SMC-Rv2 (Shared Memory Communications over RDMA v2) LLC handling occurs in smc_llc_save_add_link_rkeys(), where the peer rkey count is read from offset 94 of a 72-byte 'ADD LINK' message allocation whenever the RDMA device reports max_recv_sge == 1 and no shared v2 receive buffer exists. Any peer that initiates an SMC-Rv2 link addition triggers the over-read on every link addition, regardless of message contents, as demonstrated by a reproducible KASAN slab-out-of-bounds report. The flaw is fixed in stable kernels; no public exploit code or active exploitation has been identified, and EPSS is low at 0.20%.
Out-of-bounds buffer read in the Linux kernel SMC-Rv2 LLC message handler allows a malicious remote SMC peer to corrupt rtoken state by triggering reads from stale shared receive-buffer data. Specifically, smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() process a crafted DELETE_RKEY_V2 or ADD_LINK v2 message declaring up to 255 rkeys, reading the overflow portion from whatever a prior message left in lgr->wr_rx_buf_v2, potentially deleting valid registered memory keys or installing spurious ones. No public exploit code exists and EPSS is 0.20% (10th percentile), but the impact within SMC-R-enabled datacenter environments is real - disrupted RDMA sessions and hard-to-diagnose memory-token corruption.
Use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem, introduced circa v4.18, allows a local low-privileged user to corrupt kernel memory with full read, write, and availability impact. The race condition arises because smc_rx_pipe_buf_release() tests sk_state before acquiring the socket lock, permitting a concurrent smc_conn_free() call to release conn->rmb_desc and walk conn->lgr between the test and the lock - both of which smc_rx_pipe_buf_release() then dereferences, triggering use-after-free. Vendor-released patches are available for stable branches 6.12.109, 7.2.4, and 6.18.50; EPSS at 0.20% (10th percentile) and no CISA KEV listing confirm no known active exploitation at time of analysis.
A use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem allows the server-side link-addition path (smc_llc_srv_add_link() in net/smc/smc_llc.c) to read a freed LLC queue entry. smc_llc_flow_qentry_del() kfree()s the qentry, but on links without a shared v2 receive buffer the already-freed add_llc pointer is subsequently passed to smc_llc_save_add_link_rkeys(), producing a slab-use-after-free. Affects kernels since 6.14 through the fix in 6.18.50 / 7.2.4 / 7.3-rc1; no public exploit identified at time of analysis and EPSS is low (0.20%), and the KASAN report shows it manifests as a kernel crash rather than a demonstrated code-execution primitive.
A data race in the Linux kernel's net/smc (Shared Memory Communications) subsystem allows concurrent stores to the killed, freed, and out_of_sync connection-state flags to clobber one another because all three single-bit bitfields share one byte of struct smc_connection. The receive tasklet (smc_cdc_msg_validate) and process context (smc_conn_kill) write these flags without a common lock, so each write is a read-modify-write that can silently revert a neighbouring flag, potentially corrupting connection teardown/free state. The fix gives each flag its own byte; there is no public exploit identified and EPSS is 0.20%.
Use-after-free in the Linux kernel SMC (Shared Memory Communications) subsystem allows a low-privileged local attacker to trigger a race condition during connection teardown, resulting in memory corruption with potential for privilege escalation. The flaw exists in smc_conn_free() and smc_lgr_terminate_sched(): when a link group is unlinked before connection cleanup completes, the device can re-arm the receive tasklet after tasklet_kill() returns, causing the tasklet to dereference an already-freed send buffer on the DMB-nocopy path. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17%.
Integer overflow in the Linux kernel IP tunnel subsystem allows a local low-privilege attacker to stack user-created tunnel devices until the cumulative advertised `needed_headroom` exceeds the 16-bit skb header offset capacity. When IP output subsequently reserves that headroom, the offset arithmetic wraps around, producing a kernel memory corruption condition with potential for local privilege escalation to root. No public exploit has been identified at time of analysis, and EPSS reports a 0.17% exploitation probability; patches are available across multiple stable kernel branches.
Shared zerocopy state corruption in the Linux kernel networking stack allows a local low-privileged attacker - via Open vSwitch - to cause kernel memory corruption leading to privilege escalation. When skb_tx_error() is called on a cloned socket buffer (skb), it unconditionally clears shared zerocopy flags in skb_shinfo(), which all clones reference. In OVS deployments using non-last OVS_ACTION_ATTR_RECIRC, a flow miss on the clone strips the SKBFL_SHARED_FRAG marker from the still-in-flight original, and subsequent local ESP/IPsec delivery decrypts in-place over memory pages it does not privately own. No public exploit has been identified at time of analysis; EPSS is 0.17%.
Out-of-bounds kernel memory read in the Linux kernel's IPv6 Segment Routing (SRv6/seg6) local processing allows a local unprivileged user to leak adjacent slab memory and potentially crash the host. After decap_and_validate() strips outer SRv6 headers for End.DX6/End.DT6 behaviors, the IPv6 control block (IP6CB) retains a stale nhoff from the outer packet, causing ip6_protocol_deliver_rcu() to read beyond the skb head on the inner packet (KASAN slab-out-of-bounds). There is no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a locally-reachable kernel bug rather than a mass-exploitable remote flaw.
Stack memory corruption in the Linux kernel's qnap-mcu MFD driver allows a local low-privileged user on QNAP hardware to corrupt kernel stack memory, potentially enabling privilege escalation. The driver's qnap_mcu_exec() publishes an on-stack receive buffer to the serdev receive path, which runs asynchronously; when a command times out and the function returns, reply->data still points at the deallocated stack frame. A late MCU reply or unsolicited MCU message then overwrites whatever occupies that stack memory next, yielding C:H/I:H/A:H impact. No public exploit exists and EPSS is 0.20% (10th percentile), consistent with a kernel driver bug requiring physical or local QNAP hardware access.
Use-after-free in the Linux kernel ALSA bcd2000 USB MIDI driver allows a local attacker with low privileges to corrupt kernel memory, potentially achieving privilege escalation or system crash. When a BCD2000 USB device is disconnected while a MIDI rawmidi substream remains open, bcd2000_midi_send() and bcd2000_input_complete() continue to read and write previously freed URB structures, as the pointers are not nulled after usb_free_urb(). KASAN confirmed the slab-use-after-free on Linux 7.2.0-rc5 (arm64), and patches have been released across all active stable branches. No public exploit or KEV listing exists; EPSS is 0.20%.
Uninitialized mutex use-before-initialization in the Linux kernel's ALSA pcxhr driver exposes systems with Digigram PCXHR audio hardware to a race condition during driver probe. The pcxhr_probe() function calls request_threaded_irq() before mgr->lock is initialized; if an interrupt fires during the probe window, the threaded IRQ handler attempts to acquire an uninitialized mutex, resulting in undefined kernel behavior ranging from panic to memory corruption. Patch commits are available across multiple stable kernel branches; no public exploit or active exploitation (CISA KEV) has been identified, and EPSS is 0.20% at the 10th percentile.
Out-of-bounds read and write in the Linux kernel's dm-pcache (device mapper persistent cache) module allow a local attacker with CAP_SYS_ADMIN to corrupt kernel memory by loading a device mapper table backed by a crafted cache device containing malformed geometry metadata. The root cause is that cache_segs_init() and get_seg_id() consume on-disk cache_info fields - specifically n_segs and per-segment next_seg link IDs - without range validation before indexing into kernel-allocated arrays, and the only integrity protection on this metadata is a CRC computed with a fixed, public seed that offers no adversarial resistance. No public exploit or active exploitation has been identified; EPSS is 0.20% at the 10th percentile, consistent with the constrained attack prerequisites.
Out-of-bounds memory reads in the Linux kernel dm-pcache device-mapper subsystem allow a CAP_SYS_ADMIN-privileged local attacker to disclose adjacent persistent memory contents to userspace and corrupt the cache replay tree, with potential for kernel panic. Two input-validation gaps exist: kset key_num is not bounded against PCACHE_KSET_KEYS_MAX before buffer iteration, and per-key intra-segment offset+length pairs are accepted verbatim, allowing crafted on-media cache device images to trigger OOB reads that surface into caller bio buffers. No public exploit exists and EPSS sits at 0.20% (10th percentile), consistent with the elevated privilege requirement gating this attack surface.
Out-of-bounds memory access in the Linux kernel's dm-pcache (device-mapper persistent cache) subsystem allows a local privileged attacker to read past segment data boundaries. The `cache_pos_decode()` function loads `key_tail` and `dirty_tail` segment offsets (`seg_off`) directly from the cache device without validating them against the segment's `data_size`, so a crafted cache device with an oversized `seg_off` causes the kernel to address memory beyond the segment buffer. Exploitation requires CAP_SYS_ADMIN to supply the device. No public exploit or CISA KEV listing exists; EPSS is low at 0.17%.
Out-of-bounds read in the Linux kernel dm-pcache subsystem allows a local low-privileged user to read past segment data boundaries into adjacent control areas, exposing sensitive kernel memory and potentially crashing the kernel. Specifically, cache_replay(), the writeback worker, and the GC worker all miscalculate the tail-kset read length using PCACHE_SEG_SIZE minus the segment offset rather than the actual data-region remainder via cache_seg_remain(). This affects Linux 6.18.x (before 6.18.50), 7.2.x (before 7.2.4), and pre-release 7.3-rc1. No public exploit or active exploitation has been identified; EPSS is 0.17% (6th percentile).
Use-after-free and invalid segment operations in the Linux kernel's dm-pcache subsystem allow a local low-privileged attacker to corrupt kernel memory, potentially achieving privilege escalation. The flaw exists in kset_replay() where cache_key_put(key) frees key memory, yet the subsequent code dereferences key->cache_pos.cache_seg - a classic UAF pattern in kernel mempool-managed memory. No public exploit code has been identified and EPSS is 0.20%, though the local CVSS 7.8 (C:H/I:H/A:H) vector reflects the severity of kernel-level memory corruption.
Unlocked dereference of dev->desc in the Linux kernel's i3c subsystem exposes systems with i3c-capable hardware to potential use-after-free or null pointer dereference conditions when a local low-privileged user races device descriptor teardown against calls to i3c_device_get_supported_xfer_mode(). The function accesses dev->desc to resolve the master controller without holding the required bus->lock, meaning a concurrent device detachment can free or null that pointer mid-access, leading to kernel memory corruption with CVSS-assessed C:H/I:H/A:H impact. No public exploit code or active exploitation (KEV) has been identified at time of analysis; vendor-supplied patch commits are available for stable kernel branches.
Use-before-initialization race condition in the ADI I3C master driver of the Linux kernel allows a hardware interrupt to acquire an uninitialized spinlock during device probe. Specifically, adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR before the transfer queue lock and IBI state are initialized, so an early CMDR interrupt can invoke adi_i3c_master_irq() and attempt to take master->xferqueue.lock against an uninitialized dynamic key. No public exploit has been identified and EPSS is 0.20%, but the fix is confirmed in stable trees 6.18.50 and 7.2.4.
Stack information disclosure and use-after-free in the Linux kernel i3c master driver allow a local, low-privileged user to leak kernel stack contents through the sysfs modalias interface during device unregistration. The defect exists from kernel 5.0 onward through 6.12.108, 6.18.49, and 7.2.3: i3cdev->dev->desc is zeroed before device_unregister() completes, so racing calls to i3c_device_uevent() and modalias_show() read a NULL descriptor and fall back to an uninitialized stack struct i3c_device_info, exposing raw kernel stack bytes in the generated uevent string. No public exploit code has been identified at time of analysis; patches are available in stable releases 6.12.109, 6.18.50, 7.2.4, and the 7.3-rc1 mainline tree.
Use-after-free in the Renesas I3C driver allows a local attacker with low privileges to crash the kernel or potentially escalate privileges on systems equipped with Renesas I3C hardware. The flaw stems from a race between a timed-out transfer cleanup path, which frees the transfer struct, and a late-arriving interrupt whose handler dereferences that now-freed memory. No public exploit has been identified, and exploitation requires specific hardware, but the UAF primitive theoretically supports memory corruption beyond a simple crash.
Use-after-free in the rtl8xxxu WiFi driver allows a local authenticated attacker to corrupt kernel memory during device teardown. The flaw exists in two races within the rx_urb_wq work queue shutdown path: schedule_work() is called outside the shutdown lock, and the worker can submit URBs after usb_kill_anchored_urbs() has returned, both permitting the worker to dereference the freed priv structure after ieee80211_free_hw() releases it. Exploitation requires specific hardware (Realtek RTL8XXXU USB WiFi adapter), active RX traffic, and a concurrent disconnect event. No public exploit exists; this was discovered by static analysis with an EPSS of 0.20%.
Decompression result corruption in the Linux kernel's Intel IAA (In-Memory Analytics Accelerator) crypto driver (iaa_crypto) occurs when a hardware analytics error forces a software fallback that writes the destination buffer with the CPU while it is still mapped DMA_FROM_DEVICE; with SWIOTLB active, the subsequent dma_unmap_sg() overwrites req->dst with the stale bounce buffer, corrupting the decompressed output. The issue was resolved upstream and affects kernels from ~6.8 through the fixed releases. No public exploit identified at time of analysis, and EPSS is low at 0.20%.
Stack corruption in the Linux kernel mwifiex WiFi driver allows a local low-privileged user to corrupt kernel stack memory and trigger a kernel panic, with potential for arbitrary code execution in kernel context. The driver's synchronous firmware command path stores caller-provided stack-allocated buffers in cmd_node->data_buf; when wait_event_interruptible_timeout() is interrupted, the caller returns and reclaims its stack frame while the in-flight command node retains a stale pointer - a late firmware VERSION_EXT response then writes firmware string data through that freed stack address. The issue is confirmed reproducible on i.MX8MP/88W8997 hardware via documented kernel panics, with no public exploit code identified at time of analysis (EPSS 0.17%).
Out-of-bounds array indexing in the Linux kernel's rtl8192du Wi-Fi driver allows network-adjacent unauthenticated attackers to trigger kernel memory corruption or a crash. The driver's `rtl92du_tx_fill_desc()` function passes a raw 802.11 QoS TID value (range 0-15) as an index into `sta_entry->tids[]`, which is only allocated with MAX_TID_COUNT=9 entries; TID values 9-15 index past the array boundary. UBSAN confirms index-10 access on `rtl_tid_data [9]`. No public exploit exists and EPSS is 0.17%, indicating low real-world exploitation pressure at time of analysis.
Unchecked device-controlled address in the mt7915 WiFi driver's EEPROM copy path allows a malicious or compromised MT7915 MCU to trigger a 16-byte out-of-bounds heap write in the host kernel. The driver's mt7915_mcu_get_eeprom() trusts the MCU response field res->addr (a device-supplied __le32) as a destination offset into eeprom.data without validating it against the buffer's bounds, enabling arbitrary kernel heap corruption. No public exploit has been identified at time of analysis, and EPSS probability is 0.20%; however, successful exploitation of the OOB write could yield kernel code execution or denial of service on any Linux host equipped with an MT7915-based adapter.
Use-after-free race condition in the Linux kernel RDMA/ucma subsystem allows a local attacker with access to the userspace connection manager interface to corrupt kernel memory and achieve privilege escalation. The flaw exists in ucma_set_ib_path(), which invokes ucma_event_handler() without holding the handler lock that serializes access to ctx->file; a concurrent ucma_migrate_id() call can swap ctx->file between reads inside the handler, causing an event to be enqueued on file B's list while only file A's mutex is held - a condition confirmed by a KASAN slab-use-after-free trace in the upstream commit. Patches are available for all actively supported stable kernel branches (6.12.109, 6.18.50, 7.2.4, 7.3-rc1); no public exploit or active exploitation has been identified.
A race condition in the Linux kernel's RDMA/ucma subsystem allows an unprivileged local user to corrupt kernel data structures and deadlock a mutex by racing ucma_write_cm_event() against ucma_migrate_id(). The device /dev/infiniband/rdma_cm carries world-readable/writable permissions (0666), and the kernel description explicitly states no physical RDMA hardware is required to reach the vulnerable code path, making this accessible to any local user on an affected system. The race causes ctx->file to be swapped mid-sequence across four dereferences - resulting in a kernel BUG at lib/list_debug.c, a permanently held mutex wedging subsequent writers in uninterruptible D-state, and a stranded uevent that outlives its owning context. No public exploit has been identified at time of analysis.
Dangling pointer in the Linux kernel AS3722 PMIC regulator driver leaves `pdev->dev.of_node` referencing freed memory after `of_node_put()` prematurely drops the reference acquired by `of_get_child_by_name()` during Device Tree parsing in `as3722_get_regulator_dt_data()`. Systems running the ams AS3722 Power Management IC driver - predominantly NVIDIA Tegra-based embedded platforms - are affected across all kernel versions since Linux 3.13. If the stale pointer is subsequently dereferenced by regulator framework operations, kernel memory corruption, information disclosure, or local privilege escalation may result; no public exploit code has been identified at time of analysis.
Memory order mismatch in the Linux kernel ring-buffer subsystem exposes a race condition between ring_buffer_alloc_read_page() and ring_buffer_subbuf_order_set() that can corrupt the bpage->order metadata field relative to actual allocated memory size. When subbuf_order changes mid-allocation, subsequent operations using bpage->order to calculate buffer boundaries may read or write outside the allocated slab region, enabling a low-privileged local attacker with access to tracefs/debugfs interfaces to potentially disclose kernel memory contents or destabilize the kernel. No public exploit code exists and EPSS is low at 0.20%, indicating limited exploitation interest despite the fix being available in stable kernel releases.
Linux kernel ring-buffer subsystem exposes a race condition between subbuffer resize and page allocation/free operations, enabling local privilege escalation. When ring_buffer_subbuf_order_set() clears cpu_buffer->free_page without holding the cpu_buffer->lock, a concurrent ring_buffer_alloc_read_page() or ring_buffer_free_read_page() call can operate on a stale or freed page, producing kernel memory corruption. No public exploit code exists and EPSS is 0.20%, but the CVSS 7.8 C:H/I:H/A:H vector reflects full kernel-level impact potential once the race is won.
Memory management order mismatch in the Linux kernel ring-buffer tracing subsystem allows a local low-privileged user to corrupt kernel memory or crash the system by triggering a ring buffer resize concurrently with cached reader page discard. The root cause is that cpu_buffer::free_page stores only a page address without preserving the allocation order; after a resize changes cpu_buffer->subbuf_order, free_pages() is invoked with the new order rather than the original, corrupting the buddy allocator's state. Vendor-released patches exist in Linux 6.18.51, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV listing exists, and EPSS stands at 0.20%.
Page-list corruption in the Linux kernel ring-buffer subsystem allows a local low-privileged attacker to trigger undefined memory behavior by exploiting improper handling of a failed remote reader page swap. When the tracing ring-buffer's `swap_reader_page` callback returns `-EBUSY` - which occurs during an event storm on a small buffer - `__rb_get_reader_page_from_remote()` incorrectly proceeds as though the swap succeeded, splicing the same physical page as both the previous and new reader entry simultaneously. This corrupted page-list state can result in confidentiality loss from stale kernel memory reads, integrity violations from writes to a doubly-referenced page, or kernel panic. No public exploit or active KEV listing exists; EPSS is 0.15%, consistent with a low-likelihood local kernel race condition.
Heap buffer overflow in the Linux kernel orangefs client debug-mask parser allows a local low-privileged attacker to corrupt kernel heap memory and potentially escalate privileges. The flaw originates in `orangefs_prepare_cdm_array()`, where buffer sizing via `strcspn()` and subsequent parsing via `sscanf %s` diverge in how they handle leading whitespace - a crafted debug mask entry prefixed with a space causes an undersized allocation that `sscanf` then overwrites. Vendor-released patches are available across all active stable branches (6.12.109, 6.18.50, 7.2.4, 7.3-rc1); no public exploit or active exploitation is identified.
Heap out-of-bounds write in the Linux kernel's ocfs2 o2dlm (distributed lock manager) allows a malicious cluster member to corrupt or panic peer nodes. The dlm_migrate_request_handler() accepts a peer-supplied name-length field (migrate->namelen) from a DLM_MIGRATE_REQUEST message without bounds-checking and passes it to dlm_init_mle(), which memcpy()s up to ~215 attacker-controlled bytes past the 32-byte mname[] field of an o2dlm_mle slab object. Any node that has joined the DLM domain can trigger it; there is no public exploit and it is not in CISA KEV, with EPSS at just 0.20%.
Kernel memory corruption in the Linux kernel's OCFS2 cluster filesystem distributed lock manager (o2dlm) allows any node in a DLM domain to crash or corrupt the heap of a peer node. The dlm_mig_lockres_handler for DLM_MIG_LOCKRES recovery messages trusts the peer-supplied num_locks and lockname_len fields without validation, producing an out-of-bounds read that ends in a BUG_ON panic and a heap out-of-bounds write into a fixed 32-byte lockname slab object. No public exploit identified at time of analysis; EPSS is low at 0.20% (10th percentile), and the fix is available across multiple stable kernel branches.
Out-of-bounds read and write in the Linux kernel's ocfs2 refcount block validator allows a local privileged attacker to corrupt kernel memory via a crafted or corrupted filesystem image. The `ocfs2_validate_refcount_block()` function fails to validate `rl_used` and `rl_count` fields against the actual fixed per-block capacity before refcount/reflink/CoW operations walk the record array, allowing a crafted `rl_used == 0xffff` to drive the loop 65534 iterations past the end of the 4096-byte metadata block. A subsequent `memmove()` of up to ~1 MiB from an already out-of-bounds offset in `ocfs2_insert_refcount_rec()` can corrupt arbitrary kernel memory. No public exploit and no KEV listing; EPSS is 0.20% reflecting realistic low exploitation probability.
Slab out-of-bounds read in the Linux kernel's ocfs2 filesystem lets a crafted on-disk image trigger memory disclosure once mounted. The indexed-directory validators ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check ECC and signature but never bound the ocfs2_dx_entry_list de_num_used/de_count counts against the 4KB metadata block capacity, so ocfs2_dx_dir_search() walks up to 0xffff entries far past the block. Any path lookup, stat(), or open() on an indexed directory in a malicious image reads adjacent slab memory. EPSS is low (0.20%, 10th percentile); no public exploit identified at time of analysis and it is not in CISA KEV.
Arbitrary kernel memory read/write in the Linux kernel's OpenRISC architecture syscall handler allows an unprivileged local process to overwrite kernel structures such as the sys_call_table and achieve kernel-context code execution. The `sys_or1k_atomic()` function (syscall 244 in the or1k ABI) performs a hand-written assembly atomic word swap between two user-supplied pointers without calling `access_ok()`, and its four memory-access instructions lack exception table entries - meaning any kernel address passed by a caller is directly dereferenced without fault isolation. Patches are confirmed in stable series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation is identified.
Use-after-free in the Linux kernel's OpenVSwitch connection tracking (CT) limit subsystem allows a low-privileged local user with access to user and network namespaces to trigger a slab-use-after-free in ovs_ct_execute() during network namespace teardown. The race condition arises because the CT limit pointer was freed under ovs_mutex without first removing it from RCU-protected packet processing paths or waiting for a grace period, enabling concurrent packet processing threads to dereference already-freed memory. No public exploit or CISA KEV listing exists; EPSS is 0.17%, reflecting low observed exploitation activity at the time of analysis.
OpenVSwitch packet forwarding in the Linux kernel exposes a page-cache write primitive ("Fragnesia") when MSG_ZEROCOPY packets are processed through the userspace upcall error path. When `queue_userspace_packet()` fails and calls `skb_tx_error()` on a still-live, still-forwarded skb, it strips `SKBFL_SHARED_FRAG` via `skb_zcopy_clear()`. A subsequent local ESP-in-UDP delivery then invokes `esp_input()` without `skb_cow_data()` copy-on-write protection, causing in-place AEAD decryption over page-cache pages the low-privileged sender does not own. Patches are available for stable series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or KEV listing exists at time of analysis.
Use-after-free in the Linux kernel IPMI message handler allows a local low-privileged user to corrupt kernel memory by racing `_ipmi_destroy_user()` against concurrent RCU readers in `find_cmd_rcvr()` and `handle_ipmb_get_msg_cmd()`. A regression introduced by commit 9e91f8a6c868 removed the `synchronize_rcu()` grace period that previously ensured no readers held live pointers to `cmd_rcvr` structures before `kfree()` was called, while the `cmd_rcvrs` list continues to be walked under plain RCU. No public exploit code has been identified at time of analysis; patched stable kernel versions are available.
Use-after-free in the Linux kernel's lockd (NFS Network Lock Manager) service allows freed-memory access during hash-bucket file traversal. The nlm_traverse_files() iterator pinned the current file but not the saved 'next' pointer across a mutex_unlock window, so a concurrent nlm_release_file() could kfree the next file and cause the iterator to dereference freed memory on its next step. Fixed across stable kernels; no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a hard-to-time race rather than a turnkey exploit.
Uninitialized kernel memory disclosure in the Linux kernel NVMe subsystem affects all kernels from commit 530436c45ef2 through fixed releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. When a discard (TRIM/DSM) operation is issued and the GFP_ATOMIC allocation for the 4096-byte DSM payload fails under memory pressure, the kernel falls back to the per-controller ctrl->discard_page, which was allocated with alloc_page(GFP_KERNEL) in nvme_init_ctrl() but never zeroed - causing up to 4080 bytes of stale kernel data (vmemmap struct page pointers and other heap residue) to be transmitted to the NVMe controller. No public exploit exists and EPSS is 0.20%; the input CVSS vector AV:N/AC:L/PR:N significantly overstates exploitability for what requires local privileged access under specific memory pressure conditions.
Kernel memory corruption in the Linux NVMe/TCP host driver (nvme-tcp) allows a malicious or compromised NVMe-over-TCP target to trigger a wild-memory-access write on the connecting host. The receive path gated C2HData PDUs on blk_rq_payload_bytes() alone; for a REQ_OP_WRITE_ZEROES command (no physical segments but non-zero byte count) the request iterator is never initialized, so an attacker-supplied C2HData is copied into whatever stale, driver-private iterator the previous command on that tag left behind. Fixed across stable trees; no public exploit identified at time of analysis and EPSS is low (0.20%).
Kernel memory disclosure in the Linux kernel's nvme-tcp driver allows a malicious or compromised NVMe-TCP storage controller to exfiltrate arbitrary stale kernel memory pages from a connected host. The flaw in `nvme_tcp_handle_r2t()` - which fails to validate that an incoming R2T (Ready to Transfer) PDU corresponds to a WRITE command - causes the host to respond to R2T PDUs targeting READ commands by transmitting the READ destination buffer (uninitialized kernel memory) back to the controller via H2CData PDUs. Exploitation produces no error log and the READ command completes normally, making the disclosure silent. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.17%, consistent with the infrastructure-level attacker positioning required.
Information disclosure in the Linux kernel's NVMe-over-TCP (nvme-tcp) transport driver allows a malicious or compromised NVMe-TCP storage controller to serve a truncated read response - for example, answering a 4 096-byte read with only 512 bytes while asserting DATA_SUCCESS - causing the kernel to complete the request without detecting the shortfall and deliver a buffer whose unfilled portion contains stale kernel page contents to userspace. Affected kernels include all releases from the introduction of nvme-tcp support (commit 3f2304f8c6d6ed97849057bd16fee99e434ca796) through Linux 6.12.108, 6.18.49, and 7.2.3. No public exploit or CISA KEV listing has been identified; EPSS is 0.17 % at the 6th percentile, reflecting low community exploitation activity at time of analysis.
A remotely triggerable use-after-free in the Linux kernel SCTP stack (net/sctp) lets a malicious SCTP peer free an association and its transports mid-processing, then have the kernel operate on the freed memory. By bundling COOKIE ECHO, SHUTDOWN, and SHUTDOWN ACK chunks in one packet, the peer creates an association and immediately drives it to sctp_sf_do_9_2_final(), freeing it; a subsequent chunk in the same packet then writes to the freed transport (last_time_heard) and passes the freed association to sctp_do_sm(). No public exploit is identified at time of analysis and EPSS is low (0.17%, 6th percentile), consistent with a memory-corruption bug in a non-default subsystem rather than a mass-exploited flaw.
Use-after-free in the Linux kernel SCTP stack (net/sctp) allows a peer in an established, authenticated SCTP association to trigger a stale transport reference by removing an IP address via ASCONF DEL-IP while an inbound packet is still being processed. sctp_rcv() caches the resolved transport in chunk->transport, but a concurrent sctp_assoc_rm_peer()/sctp_transport_free() can free it during the backlog window or before bh_lock_sock(), after which a delayed SACK causes sctp_outq_select_transport() to read freed memory. Fix drops such chunks in sctp_inq_push(); no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
NULL pointer dereference in the Linux kernel's SCTP stream reconfiguration handler causes a kernel panic (DoS) reachable from the network. Three SCTP processing functions - sctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out(), and sctp_process_strreset_resp() - dereference chunk->transport to stop the reconf timer when completing a stream reset, but a chunk published in asoc->strreset_chunk before transmission has a NULL transport pointer. This yields two distinct attack paths: a local unprivileged process that removes the association's last IP address then requests a stream reset, or a remote peer that crafts a RECONF chunk carrying Incoming SSN Reset, Outgoing SSN Reset, and Response sub-elements in a single packet, triggering the deref in softirq context. No public exploit code has been identified at time of analysis, and EPSS is 0.17%, but the remote network-unauthenticated path warrants prompt patching.
Integer underflow in the Linux kernel's SCTP stream reconfiguration (RECONF) handler allows a remote SCTP peer to crash the kernel by sending duplicate RECONF response chunks. When a cached RECONF chunk contains an ADD_OUT request alongside other parameters, a duplicate response causes the kernel to roll back `stream->outcnt` twice - the second decrement underflows the unsigned counter and can trigger a kernel panic. EPSS exploitation probability is 0.20% (10th percentile), no public exploit exists, and no CISA KEV listing has been issued, indicating no known active exploitation at time of analysis.
Use-after-free in the Linux kernel charger-manager power supply driver exposes local low-privileged users to kernel memory corruption and potential privilege escalation. The driver's probe path registers power_supply sysfs attributes before acquiring regulator handles, and its remove path frees regulator consumer handles before tearing down sysfs - creating two overlapping windows where a write to the externally_control attribute, or the remove path's own try_charger_enable() call, dereferences already-freed memory. No public exploit exists and EPSS is 0.20%, but the bug was discovered by static analysis rather than observed in-the-wild attacks, and patches are available in stable kernel trees 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Slab out-of-bounds write in the Linux kernel's cros_usbpd-charger driver allows a malfunctioning, malicious, or compromised Chrome Embedded Controller (EC) to corrupt kernel heap memory during device probe. The driver accepts EC-reported USB PD port counts as loop bounds without validating them against EC_USB_PD_MAX_PORTS (8), so an EC returning any count N > 8 - up to the u8 maximum of 255 - writes N pointers into an 8-entry slab-allocated array, overflowing by up to 247 entries (~1976 bytes). No public exploit exists and EPSS is 0.17%, reflecting the high-complexity attack path that requires prior EC firmware compromise.
Out-of-bounds write in the Linux kernel's cros_usbpd-charger driver allows kernel memory corruption when a malicious or compromised ChromeOS Embedded Controller (EC) returns a falsified USB PD port count. Kernels from approximately v4.20 through unpatched 6.12.x, 6.18.x, and 7.2.x stable branches fail to clamp the EC-supplied charger port count to EC_USB_PD_MAX_PORTS before iterating, enabling heap corruption with potential for privilege escalation or system crash. No public exploit exists (EPSS 0.17%, 6th percentile), and patches have been released in 6.12.109, 6.18.50, and 7.2.4.
Use-after-free in the Linux kernel's LP8727 battery charger driver allows local exploitation via a race condition in lp8727_release_irq() that can corrupt kernel memory. The defect exists because lp8727_release_irq() cancelled the delayed work before freeing the IRQ, leaving a window where a concurrently delivered IRQ could cause the threaded handler lp8727_isr_func() to re-arm the work via schedule_delayed_work(); after the .remove path returned and the devm layer freed pchg, lp8727_delayed_func() could still execute and dereference the freed structure. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17%, consistent with a static-analysis-detected defect with no known weaponization.
Missing null termination in the Qualcomm battery manager driver (qcom_battmgr) causes the kernel to read beyond a string buffer boundary when firmware on SC8280XP-based devices returns a string that exactly fills the BATTMGR_STRING_LEN field. The three contiguous string fields - model_number, serial_number, and oem_info - are exposed to userspace via the power supply sysfs interface using a bare "%s" format, meaning an unterminated firmware string causes the kernel to traverse into adjacent struct members and leak their contents to unprivileged local readers. No public exploit has been identified at time of analysis; patches are confirmed for stable branches 6.12.109, 6.18.50, and 7.2.4.
Use-after-free vulnerability in the Linux kernel's rt9455 power supply driver allows local exploitation through a race condition between delayed workqueue callbacks and driver teardown. The rt9455_remove() function cancels work items in an order that permits batt_presence_work to re-queue max_charging_time_work after the latter has already been cancelled, resulting in a callback executing against already-freed rt9455_info memory. Identical UAF exposure exists in the probe error path if rt9455_hw_init() fails after the IRQ is registered. No public exploit exists and EPSS is 0.17% (6th percentile); the vulnerability was identified by static analysis rather than observed in exploitation.
Register corruption in Linux kernel s390/percpu silently drops the `mviy` instruction on kernels compiled with GNU binutils prior to 2.39, leaving the per-CPU address register unrepaired after CPU migration following an interrupt. Affected kernels are limited to IBM s390/zSeries architecture builds in the 7.2 lineage using the older toolchain. With C:H/I:H/A:H in the CVSS vector, successful exploitation by a local attacker could lead to privilege escalation via corrupted per-CPU data, though no public exploit or KEV listing exists and EPSS is 0.15%.
Silent data corruption in the Linux kernel's s390/dasd subsystem causes local processes to silently receive zeroed data for the unread portion of partially-completed ESE (Extent Space Efficient) disk reads that pass through the ERP (Error Recovery Procedure) chain. The root cause is dasd_default_erp_postaction() omitting the proc_bytes field when copying per-request state back from the ERP request to the originating request, which causes __dasd_cleanup_cqr() to treat the request as fully satisfied and return without requeuing the unread remainder. No public exploit code exists and no active exploitation is confirmed; vendor-released patches are available across multiple stable branches.
Dangling pointer vulnerability in the Linux kernel's Qualcomm MSM IOMMU driver (iommu/msm) can lead to kernel memory corruption on systems running Qualcomm MSM/Snapdragon SoCs. The msm_iommu_probe() function registers its devm-managed IOMMU object in the global qcom_iommu_devices list prior to completing sysfs and IOMMU core registration; if either iommu_device_sysfs_add() or iommu_device_register() fails, the devm framework releases the backing memory while the stale list entry remains, producing a dangling pointer that subsequent kernel list walks may dereference. Fixes are available in stable branches 6.18.50 and 7.2.4; no public exploit code has been identified and EPSS sits at 0.20% (10th percentile).
IOMMU Stream ID aliasing in the Linux kernel's Tegra241 CMDQV driver allows a guest-controlled VMM to break IOMMU isolation by supplying an oversized virtual Stream ID. The bounds check in tegra241_vintf_init_vsid() only rejects values exceeding UINT_MAX, but the SID_MATCH register's VIRT_SID field is only 20 bits wide; the 'virt_sid << 1 | 0x1' encoding silently truncates bits above position 20, causing a value like 0x80000000 to alias SID_MATCH to vSID 0 and route the IOMMU entry to the wrong DMA Stream ID. Because vdev->virt_id is guest-controlled under CMDQV virtualization, an attacker with guest VM access can break tenant isolation and gain C:H/I:H/A:H access across the IOMMU boundary to host memory and devices. No public exploit is identified at time of analysis; EPSS is 0.17%, consistent with the narrow Tegra241 hardware-specific attack surface.
A DMA-isolation misconfiguration in the Linux kernel's Intel VT-d IOMMU driver (iommu/vt-d) allows Access Control Services (ACS) to remain disabled while the IOMMU is force-enabled by tboot. The detect_intel_iommu() routine did not account for trusted-boot state, so when a user opt disabled ACS but tboot_force_iommu() later forced the IOMMU on, peer-to-peer DMA isolation could be silently weaker than the platform intended. The fix adds a tboot check so ACS is requested whenever tboot is active. No public exploit identified at time of analysis; EPSS is 0.17% (6th percentile).
Use-after-free in the Linux kernel's iommufd selftest IOPF reporting enables local privilege escalation from low-privileged users to kernel-level code execution. The race condition exists between TRIGGER_IOPF's unsynchronized borrow of a PASID attach handle and a concurrent PASID detach that frees the backing iommufd_attach_handle struct, leaving iommu_report_device_fault() dereferencing freed memory. No public exploit code exists and EPSS is low (0.20%), but kernel UAF primitives of this class are routinely leveraged for privilege escalation on affected systems.
Out-of-bounds read in the Linux kernel's Intel Speed Select Technology (ISST) platform driver allows a local low-privileged user to disclose sensitive kernel memory or crash the system via malformed ioctl input. The functions isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() accept a user-controlled level value and pass it as an array index into perf_levels[] without validating it against max_level bounds, unlike adjacent helper functions that perform this check. No public exploit is identified at time of analysis, and patches have been released for stable kernel branches 6.12.109, 6.18.50, and 7.2.4.
Two compounding flaws in the Linux kernel's Intel Speed Select Technology (ISST) ioctl handler allow a local low-privileged user to trigger out-of-bounds memory access or NULL pointer dereference in kernel space. The `isst_if_clos_assoc()` function applies an off-by-one validator (`>` instead of `>=`) against the `sst_inst[]` array boundary, permitting socket_id equal to `topology_max_packages()` to index one entry past the allocated array; a second path omits a NULL check for valid in-range socket IDs whose package has no bound TPMI SST instance, both dereferences reaching `map_partition_power_domain_id()`. Patched kernel versions 6.12.109, 6.18.50, and 7.2.4 are available; no public exploit has been identified at time of analysis and EPSS (0.20%, 10th percentile) reflects very low observed exploitation activity.
Use-after-free in the Linux kernel's via-sdmmc MMC host controller driver allows a local attacker to corrupt kernel memory during device removal. The driver's remove path (`via_sd_remove()`) frees the host structure while a previously-queued `carddet_work` work item can still dereference that freed memory via `container_of()` and MMIO base pointer access, creating a race-window that leads to memory corruption with C:H/I:H/A:H impact. No public exploit exists and EPSS sits at 0.17%, but the VIA chipset attack surface is real on older embedded and budget hardware still running affected kernels.
Use-after-free memory corruption in the Linux kernel's VIA SDMMC host controller driver (mmc/via-sdmmc) can cause kernel instability and potentially enable local privilege escalation on systems equipped with VIA SD card controllers. During driver probe failure, the card-detect interrupt and pending work item (carddet_work) are not cleaned up, leaving the interrupt handler and work queue running against already-freed memory; via_sdc_isr() dereferences the freed sdhost structure while via_sdc_card_detect() performs a container_of() dereference against freed memory. No public exploit or active exploitation has been identified; the issue was discovered through in-house static analysis and manual code review.
Heap buffer overflow in the Linux kernel's panasonic-laptop platform driver allows a local low-privileged user on affected Panasonic hardware to corrupt kernel heap memory, potentially escalating privileges. The flaw resides in acpi_pcc_retrieve_biosdata(), which writes a trailing sentinel one element past the end of the allocated pcc->sinf[] array when num_sifr equals hkey->package.count - a condition that arises specifically on Panasonic hardware where the BIOS SQTY field reports one fewer SINF entries than the actual package, triggering the driver's existing off-by-one workaround. Vendor-released patches are available in Linux 7.2.4 and 7.3-rc1; no public exploit code or active exploitation has been identified.
Out-of-bounds read and write in the Linux kernel's Chrome EC sensorhub driver exposes Chromebook-class systems to kernel heap corruption via an unvalidated 8-bit sensor number in EC FIFO events. The cros_ec_sensor_ring_process_event() function indexes batch_state[] using the sensor_num field from embedded-controller events without checking it against the allocated array size, allowing any event carrying sensor_num >= sensorhub->sensor_num to access arbitrary adjacent kernel heap memory. No public exploit or CISA KEV listing exists; EPSS is 0.20%, but the C:H/I:H/A:H CIA impact reflects the potential for kernel memory corruption on affected Chrome EC hardware.
Uninitialized physical address use in the AMD PMC driver (`amd_stb_s2d_init()`) causes the Linux kernel to call `devm_ioremap()` with physical address zero when the SMU rejects a command with error 0xff, mapping the first 16 MB of physical RAM into kernel virtual address space. Affected systems are AMD-based Linux hosts where the System Management Unit returns an error during S2D (System Trace Buffer) initialization at driver probe time. No public exploit exists and EPSS is 0.20%, consistent with the hardware-gated trigger; fixes are available in Linux 6.18.50 and 7.2.4 stable branches.
Incomplete error-path cleanup in the AMD PMC driver (`platform/x86/amd/pmc`) corrupts the kernel's global LPS0 s2idle linked list when `amd_stb_s2d_init()` fails during module probe, leaving a dangling registered handler whose backing `devm`-managed memory has been freed. On AMD-based x86 Linux systems running an affected kernel, this causes a kernel BUG (`list_add corruption`) upon module reload and a use-after-free condition on any subsequent suspend-to-idle (s2idle) transition. No public exploit exists and EPSS is 0.20% (10th percentile), but the failure condition can arise naturally on long-running systems or specific SMU firmware, making this a realistic local denial-of-service and a potential kernel code-execution path on vulnerable AMD hardware.
Off-by-one out-of-bounds NUL write in the Linux kernel's HP BIOS configuration driver (hp-bioscfg) corrupts kernel memory when hp_get_string_from_buffer() receives a BIOS attribute string whose length exactly matches the destination buffer size, causing the terminator write to land one byte past the allocation. The flaw affects multiple fixed-size kernel buffers - path[512], current_value[512], current_password/current_value[64], and the per-entry encodings[][512] and prerequisites[][512] arrays - exclusively on HP hardware with the hp-bioscfg module loaded. No public exploit code has been identified and EPSS stands at 0.17%, but the kernel write primitive carries theoretical privilege escalation potential alongside a realistic denial-of-service outcome.
Out-of-bounds heap read latency exists in the Linux kernel's `platform/x86/hp-bioscfg` ACPI package parser, where five `hp_populate_*_elements_from_package()` parsers derive their iteration bounds from `elements[0]->string.length` (the name field's byte length) rather than `obj->package.count` (the real package element count). Currently unexploitable because `hp_init_bios_package_attribute()` enforces a strict element-count pre-check, the flaw becomes reachable the moment an anticipated upstream relaxation of that check lands - at which point a local authenticated user on HP hardware could induce the parsers to read past the end of the ACPI `elements[]` array, disclosing kernel heap memory or crashing the kernel. Patches have been backported to stable series 6.12.109, 6.18.50, and 7.2.4; no public exploit exists (EPSS 0.17%).
Task context confusion in the Linux kernel's io_uring waitid subsystem allows a local low-privileged attacker to trigger __do_wait() execution from a kworker thread rather than the originating task, causing child process lookups and signal structure access to operate against the wrong process namespace. Affected kernels span from the commit introducing the vulnerable io_waitid_cb() behavior through version 7.2.3; fixes are confirmed in 7.2.4 and 7.3-rc1. No public exploit code and no KEV listing exist at time of analysis; EPSS of 0.17% reflects minimal observed exploitation activity.
Use-after-free in the Linux kernel's interconnect subsystem allows local low-privileged attackers to corrupt kernel heap memory, potentially enabling privilege escalation to root. The flaw resides in `icc_get()` and `of_icc_get_by_index()`: when `kasprintf()` fails to allocate memory for `path->name`, the error handler calls `kfree(path)` directly while the path's request structures are already linked into interconnect-node hash lists via `hlist_add_head()`, leaving dangling pointers that subsequent interconnect operations dereference. Patched kernel versions 6.12.109, 6.18.50, and 7.2.4 are available; no public exploit or CISA KEV listing exists at time of analysis.
Stack memory disclosure and integer underflow in the Linux kernel's IPMI ipmb subsystem allow a local low-privileged attacker with write access to the IPMB device node to read uninitialized kernel stack bytes and trigger a buffer length underflow in `ipmb_write()`. The root cause is that `ipmb_write()` parses message fields prior to validating the length byte, so a zero-length or undersized write crosses into adjacent stack memory. CVSS rates confidentiality impact as High (stack leak) and availability impact as High (SMBus block-write length underflow), while EPSS at 0.17% reflects the niche attack surface. No public exploit or active exploitation has been identified.
Use-after-free in the Linux kernel IPMI subsystem exposes freed kernel memory through a stale sysfs attribute left behind after a failed SMI registration. When ipmi_add_smi() encounters an error creating the maintenance_mode sysfs file, the nr_msgs attribute is not removed before the smi_info interface structure is freed, leaving a dangling sysfs entry backed by released memory. A local attacker with low privileges who can reach this error condition and then access the stale attribute may achieve arbitrary kernel memory read/write, creating a potential privilege escalation path to root. No public exploit exists and no active exploitation has been confirmed.
Memory corruption in the Linux kernel's IPMI message handler (ipmi/msghandler) stems from an incomplete error-path cleanup: when an IPMI interface encounters an error during startup, kernel workqueue items already scheduled for that interface are not canceled before the interface structure is freed, creating a use-after-free condition. Systems running kernel versions in the 6.18.20-6.18.49 and 7.0-7.2.3 ranges with IPMI-capable hardware are affected. Patches were released in stable updates 6.18.50 and 7.2.4; no public exploit exists and EPSS is very low at 0.20%.
Missing ingress-device validation in the Linux kernel's AF_IUCV HiperSockets receive path allows adjacent-network attackers on the same HiperSockets segment (VCHID) to deliver crafted ETH_P_AF_IUCV frames to sockets bound on different IQD devices, enabling accept-queue exhaustion, data injection into established connections, and attacker-controlled peer identity on newly accepted connections. A secondary local vector also exists: a process holding CAP_NET_RAW only within an unprivileged network namespace can send raw ETH_P_AF_IUCV frames over its loopback interface and have them matched against init_net sockets, bypassing namespace isolation. The fix - introduced in stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1 - adds a per-socket hs_dev check against the ingress netdev. No public exploit or CISA KEV listing is present at time of analysis.
Out-of-bounds heap write in the Linux kernel's XDP subsystem allows memory corruption when an AF_XDP zero-copy packet is redirected through cpumap. The xdp_convert_zc_to_xdp_frame() routine copies an XSK packet into an order-0 page but advertises the full PAGE_SIZE as usable and records zero headroom, letting the frame overrun the page tail reserved for skb_shared_info and triggering a KASAN slab-out-of-bounds write in skb_gro_receive during GRO processing. No public exploit identified at time of analysis and EPSS is low (0.17%); the vendor has released fixes across stable branches.
Use-after-free race condition in the Linux kernel SLIP driver's sl_sync() function exposes systems running kernels from 2.6.32 onward to local privilege escalation. The slip_devs[] global array stores bare net_device pointers without reference counting; when sl_sync() races with slip_close() teardown, a pointer can be read and dereferenced after netdev_run_todo() has already freed the backing structure because the RTNL semaphore is intentionally dropped during teardown. No public exploit or CISA KEV listing exists at time of analysis; EPSS stands at 0.20%, and the bug was surfaced by syzkaller fuzzing on kernel 6.1.134.
Memory corruption in the Linux kernel TUN/TAP driver allows a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges to root. The flaw exists in tun_get_user(), where an oversized headroom alignment value - most realistically propagated from Open vSwitch to a TUN or TAP device - causes an integer underflow in SKB_MAX_HEAD(align), producing a negative good_linear value that wraps to a massive size_t, causing tun_alloc_skb() to position skb->data outside the allocated skb head. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
TX queue stall in the Linux kernel's Broadcom bnxt network driver causes network transmission to halt on systems running software UDP Segmentation Offload (SW USO). Under burst traffic conditions, the `bnxt_sw_udp_gso_xmit` function can return early with NETDEV_TX_BUSY while leaving `txr->kick_pending` set to 1, meaning the driver has written Buffer Descriptors (BDs) but never rings the device doorbell - so the NIC never processes the queued packets and the completion event that would wake the TX queue never arrives. The stall was confirmed on a production system where a netdev TX watchdog triggered; no public exploit exists and no active exploitation has been identified.
Race condition in the Linux kernel's IPA (IP Accelerator) network driver permanently stalls the cellular modem TX queue on Qualcomm Snapdragon-based devices after a runtime power management resume cycle. The flaw occurs because the queue-wake work is dispatched during RPM_RESUMING state before RPM_ACTIVE is reached; the wake is consumed prematurely by a racing transmit, pm_runtime_get() returns -EINPROGRESS with no future wake scheduled, and the TX queue never recovers - blocking both outbound packets queued in qdisc and, through suspended endpoints, inbound RX as well. No public exploit exists and EPSS is 0.20%, but the failure manifests under normal cellular data usage without any adversarial trigger.
Use-after-free in the Linux kernel MCTP subsystem allows an unprivileged local user to corrupt kernel memory by racing mctp_route_lookup() against concurrent device teardown. The function accesses rt->dev without holding a reference, so mctp_dev_put() can kfree() mdev->addrs while mctp_saddr() is still reading rt->dev->addrs[0] - confirmed by a KASAN slab-use-after-free trace. No CAP_NET_RAW is required; any user who can open an AF_MCTP socket can reach this path, making it a low-barrier local privilege escalation candidate. No public exploit is identified at time of analysis, though the vulnerability reintroduces the CVE-2023-3439 use-after-free class and carries CVSS C:H/I:H/A:H.
Use-after-free in the Linux kernel's Open vSwitch (OVS) flow deletion path allows a local attacker with low privileges to crash the kernel or potentially escalate privileges. The bug exists in ovs_flow_cmd_del(): when a CMD_DEL netlink command removes a flow from the OVS table, flow->mask is scheduled for RCU-deferred free, but ovs_flow_cmd_fill_info() subsequently reads that pointer after the RCU grace period may have already freed it-a narrow but real race window confirmed by KASAN traces. Reported by Trend Micro's Zero Day Initiative as ZDI-CAN-32042; no public exploit or active exploitation is confirmed at time of analysis.
NULL and error pointer dereference in the Linux kernel's ravb (Renesas Ethernet AVB) driver allows a local attacker with low privileges to crash the kernel or potentially escalate privileges by querying PTP hardware clock state during an invalid lifecycle window. The flaw affects the ravb driver from Linux 4.2 onward, where priv->ptp.clock is either NULL before the first interface open or left holding an error pointer after a failed PTP clock registration. Fixes are confirmed across stable branches in kernels 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV listing exists.
Use-after-free in the Linux kernel's ravb (Renesas Ethernet AVB) PTP driver allows a local attacker with code execution to potentially escalate privileges or crash the system. The race condition between ravb_ptp_interrupt() and ravb_ptp_stop() permits the interrupt handler to invoke ptp_clock_event() on a clock pointer already freed by ptp_clock_unregister() during interface teardown. No public exploit has been identified at time of analysis, and EPSS is very low (0.20%, 10th percentile), consistent with a hardware-specific kernel bug affecting Renesas SoC deployments.
State machine corruption in the Linux kernel's Thunderbolt networking (tbnet) subsystem allows an adjacent attacker to trigger a double-teardown sequence that causes kernel panics or silently frees HopIDs still in use by other connections. The bug lies in tbnet_connected_work(): every failure path returns without clearing login_sent, so the connection appears established to tbnet_tear_down(), which then re-executes teardown on an already-unwound state - stopping rings already stopped (a dev_WARN, fatal under panic_on_warn) and potentially double-freeing net->remote_transmit_path on HopID mismatch paths. No public exploit code has been identified at time of analysis; EPSS stands at 0.20%.
Memory leak (skb leak) in the Linux kernel's NTB (Non-Transparent Bridge) transport subsystem allows an attacker reachable via the ntb_netdev virtual network interface to cause progressive kernel memory exhaustion and denial of service. The bug exists in ntb_process_tx(), which silently "handles" oversized TX buffers by invoking tx_handler() with a NULL data pointer and returning success - causing ntb_netdev to skip both its completion-callback free and its enqueue error path, permanently leaking the socket buffer. No public exploit has been identified at time of analysis; EPSS is 0.17% (6th percentile), indicating very low exploitation probability currently. Upstream patches have been released across multiple stable kernel branches.
Out-of-bounds read in the Linux kernel's SMC-Rv2 (Shared Memory Communications over RDMA v2) LLC handling occurs in smc_llc_save_add_link_rkeys(), where the peer rkey count is read from offset 94 of a 72-byte 'ADD LINK' message allocation whenever the RDMA device reports max_recv_sge == 1 and no shared v2 receive buffer exists. Any peer that initiates an SMC-Rv2 link addition triggers the over-read on every link addition, regardless of message contents, as demonstrated by a reproducible KASAN slab-out-of-bounds report. The flaw is fixed in stable kernels; no public exploit code or active exploitation has been identified, and EPSS is low at 0.20%.
Out-of-bounds buffer read in the Linux kernel SMC-Rv2 LLC message handler allows a malicious remote SMC peer to corrupt rtoken state by triggering reads from stale shared receive-buffer data. Specifically, smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() process a crafted DELETE_RKEY_V2 or ADD_LINK v2 message declaring up to 255 rkeys, reading the overflow portion from whatever a prior message left in lgr->wr_rx_buf_v2, potentially deleting valid registered memory keys or installing spurious ones. No public exploit code exists and EPSS is 0.20% (10th percentile), but the impact within SMC-R-enabled datacenter environments is real - disrupted RDMA sessions and hard-to-diagnose memory-token corruption.
Use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem, introduced circa v4.18, allows a local low-privileged user to corrupt kernel memory with full read, write, and availability impact. The race condition arises because smc_rx_pipe_buf_release() tests sk_state before acquiring the socket lock, permitting a concurrent smc_conn_free() call to release conn->rmb_desc and walk conn->lgr between the test and the lock - both of which smc_rx_pipe_buf_release() then dereferences, triggering use-after-free. Vendor-released patches are available for stable branches 6.12.109, 7.2.4, and 6.18.50; EPSS at 0.20% (10th percentile) and no CISA KEV listing confirm no known active exploitation at time of analysis.
A use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem allows the server-side link-addition path (smc_llc_srv_add_link() in net/smc/smc_llc.c) to read a freed LLC queue entry. smc_llc_flow_qentry_del() kfree()s the qentry, but on links without a shared v2 receive buffer the already-freed add_llc pointer is subsequently passed to smc_llc_save_add_link_rkeys(), producing a slab-use-after-free. Affects kernels since 6.14 through the fix in 6.18.50 / 7.2.4 / 7.3-rc1; no public exploit identified at time of analysis and EPSS is low (0.20%), and the KASAN report shows it manifests as a kernel crash rather than a demonstrated code-execution primitive.
A data race in the Linux kernel's net/smc (Shared Memory Communications) subsystem allows concurrent stores to the killed, freed, and out_of_sync connection-state flags to clobber one another because all three single-bit bitfields share one byte of struct smc_connection. The receive tasklet (smc_cdc_msg_validate) and process context (smc_conn_kill) write these flags without a common lock, so each write is a read-modify-write that can silently revert a neighbouring flag, potentially corrupting connection teardown/free state. The fix gives each flag its own byte; there is no public exploit identified and EPSS is 0.20%.
Use-after-free in the Linux kernel SMC (Shared Memory Communications) subsystem allows a low-privileged local attacker to trigger a race condition during connection teardown, resulting in memory corruption with potential for privilege escalation. The flaw exists in smc_conn_free() and smc_lgr_terminate_sched(): when a link group is unlinked before connection cleanup completes, the device can re-arm the receive tasklet after tasklet_kill() returns, causing the tasklet to dereference an already-freed send buffer on the DMB-nocopy path. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17%.
Integer overflow in the Linux kernel IP tunnel subsystem allows a local low-privilege attacker to stack user-created tunnel devices until the cumulative advertised `needed_headroom` exceeds the 16-bit skb header offset capacity. When IP output subsequently reserves that headroom, the offset arithmetic wraps around, producing a kernel memory corruption condition with potential for local privilege escalation to root. No public exploit has been identified at time of analysis, and EPSS reports a 0.17% exploitation probability; patches are available across multiple stable kernel branches.
Shared zerocopy state corruption in the Linux kernel networking stack allows a local low-privileged attacker - via Open vSwitch - to cause kernel memory corruption leading to privilege escalation. When skb_tx_error() is called on a cloned socket buffer (skb), it unconditionally clears shared zerocopy flags in skb_shinfo(), which all clones reference. In OVS deployments using non-last OVS_ACTION_ATTR_RECIRC, a flow miss on the clone strips the SKBFL_SHARED_FRAG marker from the still-in-flight original, and subsequent local ESP/IPsec delivery decrypts in-place over memory pages it does not privately own. No public exploit has been identified at time of analysis; EPSS is 0.17%.
Out-of-bounds kernel memory read in the Linux kernel's IPv6 Segment Routing (SRv6/seg6) local processing allows a local unprivileged user to leak adjacent slab memory and potentially crash the host. After decap_and_validate() strips outer SRv6 headers for End.DX6/End.DT6 behaviors, the IPv6 control block (IP6CB) retains a stale nhoff from the outer packet, causing ip6_protocol_deliver_rcu() to read beyond the skb head on the inner packet (KASAN slab-out-of-bounds). There is no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a locally-reachable kernel bug rather than a mass-exploitable remote flaw.
Stack memory corruption in the Linux kernel's qnap-mcu MFD driver allows a local low-privileged user on QNAP hardware to corrupt kernel stack memory, potentially enabling privilege escalation. The driver's qnap_mcu_exec() publishes an on-stack receive buffer to the serdev receive path, which runs asynchronously; when a command times out and the function returns, reply->data still points at the deallocated stack frame. A late MCU reply or unsolicited MCU message then overwrites whatever occupies that stack memory next, yielding C:H/I:H/A:H impact. No public exploit exists and EPSS is 0.20% (10th percentile), consistent with a kernel driver bug requiring physical or local QNAP hardware access.
Use-after-free in the Linux kernel ALSA bcd2000 USB MIDI driver allows a local attacker with low privileges to corrupt kernel memory, potentially achieving privilege escalation or system crash. When a BCD2000 USB device is disconnected while a MIDI rawmidi substream remains open, bcd2000_midi_send() and bcd2000_input_complete() continue to read and write previously freed URB structures, as the pointers are not nulled after usb_free_urb(). KASAN confirmed the slab-use-after-free on Linux 7.2.0-rc5 (arm64), and patches have been released across all active stable branches. No public exploit or KEV listing exists; EPSS is 0.20%.
Uninitialized mutex use-before-initialization in the Linux kernel's ALSA pcxhr driver exposes systems with Digigram PCXHR audio hardware to a race condition during driver probe. The pcxhr_probe() function calls request_threaded_irq() before mgr->lock is initialized; if an interrupt fires during the probe window, the threaded IRQ handler attempts to acquire an uninitialized mutex, resulting in undefined kernel behavior ranging from panic to memory corruption. Patch commits are available across multiple stable kernel branches; no public exploit or active exploitation (CISA KEV) has been identified, and EPSS is 0.20% at the 10th percentile.
Out-of-bounds read and write in the Linux kernel's dm-pcache (device mapper persistent cache) module allow a local attacker with CAP_SYS_ADMIN to corrupt kernel memory by loading a device mapper table backed by a crafted cache device containing malformed geometry metadata. The root cause is that cache_segs_init() and get_seg_id() consume on-disk cache_info fields - specifically n_segs and per-segment next_seg link IDs - without range validation before indexing into kernel-allocated arrays, and the only integrity protection on this metadata is a CRC computed with a fixed, public seed that offers no adversarial resistance. No public exploit or active exploitation has been identified; EPSS is 0.20% at the 10th percentile, consistent with the constrained attack prerequisites.
Out-of-bounds memory reads in the Linux kernel dm-pcache device-mapper subsystem allow a CAP_SYS_ADMIN-privileged local attacker to disclose adjacent persistent memory contents to userspace and corrupt the cache replay tree, with potential for kernel panic. Two input-validation gaps exist: kset key_num is not bounded against PCACHE_KSET_KEYS_MAX before buffer iteration, and per-key intra-segment offset+length pairs are accepted verbatim, allowing crafted on-media cache device images to trigger OOB reads that surface into caller bio buffers. No public exploit exists and EPSS sits at 0.20% (10th percentile), consistent with the elevated privilege requirement gating this attack surface.
Out-of-bounds memory access in the Linux kernel's dm-pcache (device-mapper persistent cache) subsystem allows a local privileged attacker to read past segment data boundaries. The `cache_pos_decode()` function loads `key_tail` and `dirty_tail` segment offsets (`seg_off`) directly from the cache device without validating them against the segment's `data_size`, so a crafted cache device with an oversized `seg_off` causes the kernel to address memory beyond the segment buffer. Exploitation requires CAP_SYS_ADMIN to supply the device. No public exploit or CISA KEV listing exists; EPSS is low at 0.17%.
Out-of-bounds read in the Linux kernel dm-pcache subsystem allows a local low-privileged user to read past segment data boundaries into adjacent control areas, exposing sensitive kernel memory and potentially crashing the kernel. Specifically, cache_replay(), the writeback worker, and the GC worker all miscalculate the tail-kset read length using PCACHE_SEG_SIZE minus the segment offset rather than the actual data-region remainder via cache_seg_remain(). This affects Linux 6.18.x (before 6.18.50), 7.2.x (before 7.2.4), and pre-release 7.3-rc1. No public exploit or active exploitation has been identified; EPSS is 0.17% (6th percentile).
Use-after-free and invalid segment operations in the Linux kernel's dm-pcache subsystem allow a local low-privileged attacker to corrupt kernel memory, potentially achieving privilege escalation. The flaw exists in kset_replay() where cache_key_put(key) frees key memory, yet the subsequent code dereferences key->cache_pos.cache_seg - a classic UAF pattern in kernel mempool-managed memory. No public exploit code has been identified and EPSS is 0.20%, though the local CVSS 7.8 (C:H/I:H/A:H) vector reflects the severity of kernel-level memory corruption.
Unlocked dereference of dev->desc in the Linux kernel's i3c subsystem exposes systems with i3c-capable hardware to potential use-after-free or null pointer dereference conditions when a local low-privileged user races device descriptor teardown against calls to i3c_device_get_supported_xfer_mode(). The function accesses dev->desc to resolve the master controller without holding the required bus->lock, meaning a concurrent device detachment can free or null that pointer mid-access, leading to kernel memory corruption with CVSS-assessed C:H/I:H/A:H impact. No public exploit code or active exploitation (KEV) has been identified at time of analysis; vendor-supplied patch commits are available for stable kernel branches.
Use-before-initialization race condition in the ADI I3C master driver of the Linux kernel allows a hardware interrupt to acquire an uninitialized spinlock during device probe. Specifically, adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR before the transfer queue lock and IBI state are initialized, so an early CMDR interrupt can invoke adi_i3c_master_irq() and attempt to take master->xferqueue.lock against an uninitialized dynamic key. No public exploit has been identified and EPSS is 0.20%, but the fix is confirmed in stable trees 6.18.50 and 7.2.4.
Stack information disclosure and use-after-free in the Linux kernel i3c master driver allow a local, low-privileged user to leak kernel stack contents through the sysfs modalias interface during device unregistration. The defect exists from kernel 5.0 onward through 6.12.108, 6.18.49, and 7.2.3: i3cdev->dev->desc is zeroed before device_unregister() completes, so racing calls to i3c_device_uevent() and modalias_show() read a NULL descriptor and fall back to an uninitialized stack struct i3c_device_info, exposing raw kernel stack bytes in the generated uevent string. No public exploit code has been identified at time of analysis; patches are available in stable releases 6.12.109, 6.18.50, 7.2.4, and the 7.3-rc1 mainline tree.
Use-after-free in the Renesas I3C driver allows a local attacker with low privileges to crash the kernel or potentially escalate privileges on systems equipped with Renesas I3C hardware. The flaw stems from a race between a timed-out transfer cleanup path, which frees the transfer struct, and a late-arriving interrupt whose handler dereferences that now-freed memory. No public exploit has been identified, and exploitation requires specific hardware, but the UAF primitive theoretically supports memory corruption beyond a simple crash.
Use-after-free in the rtl8xxxu WiFi driver allows a local authenticated attacker to corrupt kernel memory during device teardown. The flaw exists in two races within the rx_urb_wq work queue shutdown path: schedule_work() is called outside the shutdown lock, and the worker can submit URBs after usb_kill_anchored_urbs() has returned, both permitting the worker to dereference the freed priv structure after ieee80211_free_hw() releases it. Exploitation requires specific hardware (Realtek RTL8XXXU USB WiFi adapter), active RX traffic, and a concurrent disconnect event. No public exploit exists; this was discovered by static analysis with an EPSS of 0.20%.
Decompression result corruption in the Linux kernel's Intel IAA (In-Memory Analytics Accelerator) crypto driver (iaa_crypto) occurs when a hardware analytics error forces a software fallback that writes the destination buffer with the CPU while it is still mapped DMA_FROM_DEVICE; with SWIOTLB active, the subsequent dma_unmap_sg() overwrites req->dst with the stale bounce buffer, corrupting the decompressed output. The issue was resolved upstream and affects kernels from ~6.8 through the fixed releases. No public exploit identified at time of analysis, and EPSS is low at 0.20%.
Stack corruption in the Linux kernel mwifiex WiFi driver allows a local low-privileged user to corrupt kernel stack memory and trigger a kernel panic, with potential for arbitrary code execution in kernel context. The driver's synchronous firmware command path stores caller-provided stack-allocated buffers in cmd_node->data_buf; when wait_event_interruptible_timeout() is interrupted, the caller returns and reclaims its stack frame while the in-flight command node retains a stale pointer - a late firmware VERSION_EXT response then writes firmware string data through that freed stack address. The issue is confirmed reproducible on i.MX8MP/88W8997 hardware via documented kernel panics, with no public exploit code identified at time of analysis (EPSS 0.17%).
Out-of-bounds array indexing in the Linux kernel's rtl8192du Wi-Fi driver allows network-adjacent unauthenticated attackers to trigger kernel memory corruption or a crash. The driver's `rtl92du_tx_fill_desc()` function passes a raw 802.11 QoS TID value (range 0-15) as an index into `sta_entry->tids[]`, which is only allocated with MAX_TID_COUNT=9 entries; TID values 9-15 index past the array boundary. UBSAN confirms index-10 access on `rtl_tid_data [9]`. No public exploit exists and EPSS is 0.17%, indicating low real-world exploitation pressure at time of analysis.
Unchecked device-controlled address in the mt7915 WiFi driver's EEPROM copy path allows a malicious or compromised MT7915 MCU to trigger a 16-byte out-of-bounds heap write in the host kernel. The driver's mt7915_mcu_get_eeprom() trusts the MCU response field res->addr (a device-supplied __le32) as a destination offset into eeprom.data without validating it against the buffer's bounds, enabling arbitrary kernel heap corruption. No public exploit has been identified at time of analysis, and EPSS probability is 0.20%; however, successful exploitation of the OOB write could yield kernel code execution or denial of service on any Linux host equipped with an MT7915-based adapter.