Linux
Monthly
Integer overflow in Linux kernel io_uring subsystem allows local authenticated users to trigger slab-out-of-bounds memory reads and denial of service. The vulnerability stems from improper type casting of user-supplied length values in network bundled receive/send operations, where values exceeding INT_MAX cause negative overflow leading to infinite loops and out-of-bounds array access. EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation. Vendor patches available for affected stable kernel branches (6.12.81, 6.18.22, 6.19.12, 7.0), making this a straightforward patching priority for systems running vulnerable versions with io_uring enabled.
Incorrect authentication labeling in Linux kernel's Bluetooth SMP legacy pairing allows adjacent attackers to bypass security controls and gain high-level access without proper authentication. The flaw affects the Short Term Key (STK) derivation in Just Works/Confirm pairing modes, where keys are incorrectly marked as authenticated even when Man-in-the-Middle (MITM) protection was not established. With CVSS 8.8 (AV:A/AC:L/PR:N/UI:N), this enables adjacent network attackers to exploit Bluetooth pairing flows without authentication. EPSS score of 0.05% suggests low widespread exploitation likelihood. Vendor patches available across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0).
Stack buffer overflow in Linux kernel Bluetooth subsystem allows local authenticated attackers to achieve code execution, privilege escalation, or denial of service through malformed ISO socket parameters. The vulnerability occurs when binding an ISO Bluetooth socket with up to 31 BIS entries while the hci_le_big_create_sync() function only allocates stack space for 17 entries, resulting in a 14-byte overflow that corrupts adjacent stack memory. Patches are available across multiple kernel versions (6.12.81, 6.18.22, 6.19.12, 7.0), with EPSS indicating 0.02% exploitation probability and no active exploitation confirmed.
Out-of-bounds memory read in Linux kernel Bluetooth HCI event processing allows adjacent network attackers to disclose kernel memory or trigger denial of service without authentication. The vulnerability stems from premature wake reason storage before per-event payload length validation, enabling crafted short HCI event frames to reach bacpy() operations before bounds checking. EPSS score is low (0.02%, 6th percentile) with no evidence of active exploitation or public POC at time of analysis. Vendor patches available for kernel versions 5.10+ through 6.19.12 and mainline 7.0.
Use-after-free in Linux kernel GPIB subsystem allows local authenticated attackers with low privileges to execute arbitrary code, escalate privileges, or crash the system. The vulnerability occurs in IBRD, IBWRT, IBCMD, and IBWAIT ioctl handlers when concurrent IBCLOSEDEV calls free descriptors still in use by I/O operations. EPSS probability is very low (0.02%, 4th percentile), indicating minimal observed exploitation activity. Vendor patches available for stable branches 6.18.22, 6.19.12, and mainline 7.0 via commits cae26eff, 28c75dd1, and d1857f82.
Improper Direct Memory Access (DMA) handling in the Linux kernel's ti-adc161s626 Industrial I/O (IIO) analog-to-digital converter driver allows local attackers with low privileges to trigger memory corruption or information disclosure. The vulnerability stems from using stack-allocated memory for SPI read operations instead of DMA-safe buffers, violating SPI subsystem requirements. Patches are available across multiple stable kernel versions (6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and mainline 7.0). EPSS score of 0.02% indicates very low exploitation probability, and no public exploits or active exploitation (not in CISA KEV) have been identified.
Integer overflow in AMD GPU driver's user queue doorbell handling allows local authenticated users to corrupt kernel memory and potentially escalate privileges. The amdgpu driver fails to validate user-supplied doorbell_offset values before calculating buffer offsets, enabling out-of-bounds writes to kernel doorbell space. Patches available in Linux 6.18.22, 6.19.12, and 7.0. EPSS score of 0.02% (4th percentile) indicates low probability of mass exploitation, though CVSS 7.1 reflects serious local privilege escalation potential. No active exploitation confirmed; attack requires local authenticated access to systems with AMD GPU hardware.
Out-of-bounds array access in the st_lsm6dsx IMU driver allows local authenticated users with low privileges to achieve high-impact code execution, data disclosure, or denial of service. The vulnerability exists in the buffer sampling frequency sysfs handler, which fails to validate sensor type before indexing a 2-entry array with sensor IDs beyond accelerometer and gyroscope. Exploitation requires write access to sysfs attributes for non-standard sensor types in the driver. EPSS exploitation probability is very low (0.02%, 5th percentile), no active exploitation confirmed, and vendor patches are available for Linux 6.19.12 and 7.0.
Race condition in the Linux kernel MPU3050 gyroscope driver allows local attackers with low privileges to potentially achieve code execution, data corruption, or information disclosure. The vulnerability stems from premature registration of the IIO device before complete initialization in the probe function, creating a window where userspace can interact with incompletely configured hardware. While CVSS rates this 7.8 HIGH with local attack vector, EPSS score of 0.02% (7th percentile) indicates extremely low probability of active exploitation. Patches available across all maintained kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). No evidence of active exploitation (not in CISA KEV) or public proof-of-concept code.
Double-free memory corruption in Linux kernel USB ULPI subsystem allows local authenticated attackers with low privileges to potentially achieve arbitrary code execution, denial of service, or information disclosure. The flaw exists in ulpi_register_interface() error handling since kernel 4.2 (commit 289fcff4b), where device_register() failure triggers cleanup via put_device() followed by redundant kfree(), corrupting kernel memory. Patches available across stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% suggests low likelihood of mass exploitation despite high CVSS 7.8, likely due to local attack vector and requirement for device registration failure conditions.
Use-after-free condition in Linux kernel USB Test and Measurement Class (USBTMC) driver allows local authenticated attackers to execute arbitrary code with elevated privileges. The vulnerability occurs when the usbtmc_release function fails to properly flush pending anchored URBs, leaving dangling references that can be exploited in the HCD giveback path. Vendor patches are available across multiple stable kernel versions (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0). Despite the high CVSS score of 7.8, the EPSS exploitation probability is very low at 0.02% (7th percentile), indicating limited real-world targeting, and no active exploitation or public POC has been identified.
Buffer overflow in Linux kernel COMEDI me_daq driver allows local authenticated users to achieve arbitrary code execution with kernel privileges. The me2600_xilinx_download() function fails to validate firmware file length before reading data streams, enabling out-of-bounds memory access during firmware loading operations. Patches available across multiple stable kernel versions (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% (7th percentile) indicates low probability of widespread exploitation despite high CVSS 7.8 rating, and no active exploitation or public exploit code identified at time of analysis.
Out-of-bounds write in Linux kernel comedi me4000 driver firmware loader allows local authenticated users to achieve high-impact code execution, data corruption, or system crash. The me4000_xilinx_download() function blindly trusts firmware file format headers without validating buffer boundaries, reading a length field from the first 4 bytes and then reading that many bytes from offset 16 without checking total file size. Patch available across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% (7th percentile) indicates very low observed exploitation probability despite CVSS 7.8 rating. No public exploit code or active exploitation confirmed.
Double-free memory corruption in the Linux kernel reset-gpio subsystem allows local authenticated users to escalate privileges or crash the system. The vulnerability exists in reset_add_gpio_aux_device() error handling since commit 5fc4e4cf7a22, where auxiliary_device_uninit() triggers a release callback that frees memory, but the error path then calls kfree() on the same pointer. Patches available for kernel versions 6.19.12+ and 7.0+. EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation. Not listed in CISA KEV; no public exploit identified at time of analysis.
Memory corruption in the Linux kernel zynqmp_nvmem driver allows local authenticated users to achieve privilege escalation through undersized DMA buffer exploitation. The vulnerability stems from incorrect buffer size calculations in dma_alloc_coherent and memcpy operations, enabling heap or memory corruption that can lead to complete system compromise. With a 7.8 CVSS score but only 0.02% EPSS (5th percentile), this represents a high-severity issue affecting specific Xilinx Zynq UltraScale+ deployments rather than a widespread exploitation target. Patches available across multiple stable kernel branches (6.12.81, 6.18.22, 6.19.12, 7.0) with upstream fixes confirmed in git commits.
Memory corruption in the Linux kernel virtual terminal (vt) subsystem allows local authenticated users to trigger kernel crashes and potentially escalate privileges. When a console switches to an alternate screen and then gets resized, the saved Unicode buffer retains stale dimensions. Upon returning to the primary screen, operations like screen clearing (csi_J) access memory out of bounds using current dimensions against the old buffer, causing kernel oops. EPSS exploitation probability is low (0.02%, 4th percentile), no active exploitation confirmed, but vendor patches are available across multiple stable kernel branches (5.x, 6.18.x, 6.19.x).
Missing CRYPTO_ALG_ASYNC flag in Linux kernel's Tegra crypto driver causes the crypto API to incorrectly select asynchronous algorithms for synchronous-only requests, resulting in system crashes. This affects Tegra-based Linux systems (typically NVIDIA Jetson devices) running kernel versions 6.10 through early 7.0 development branches. Vendor patches are available across stable branches (6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% (5th percentile) indicates minimal observed exploitation probability, and no active exploitation or public POC has been identified. The CVSS vector (AV:N/AC:L/PR:L/UI:N) suggests network-based exploitation requiring authenticated access, though this conflicts with the technical nature of a local driver configuration bug.
Linux kernel IOMMU page table unmapping operations fail to invalidate extended memory regions when unmapping lands mid-entry in large/contiguous mappings, causing stale TLB entries. Affects kernel 6.19 through pre-7.0 versions with IOMMU subsystem enabled. Local authenticated attackers with low privileges can potentially access unmapped memory or escalate privileges by exploiting incomplete invalidations during IOMMU unmap operations. EPSS score of 0.02% (5th percentile) suggests minimal real-world exploitation likelihood. No public exploit identified at time of analysis, though vendor acknowledges theoretical risk is low as 'nothing relies on unmapping a large entry.' Vendor-released patches available for stable branches.
Use-after-free in Linux kernel thermal subsystem allows local attackers with low privileges to execute arbitrary code, escalate privileges, or crash the system. The vulnerability stems from race conditions between thermal zone removal and power management resume operations, where delayed work items can continue executing after thermal zone objects are freed. EPSS score of 0.02% (5th percentile) suggests low probability of mass exploitation despite high CVSS severity. Vendor patches available across multiple stable kernel branches (6.12.83, 6.18.22, 6.19.12, 7.0) via upstream commits. No active exploitation confirmed in CISA KEV at time of analysis.
Double-free memory corruption in the Linux kernel's fastrpc driver allows local attackers with low privileges to achieve high-impact code execution, privilege escalation, or denial of service. The vulnerability occurs when fastrpc_init_create_static_process() fails to nullify a freed heap pointer (cctx->remote_heap) in its error path, enabling fastrpc_rpmsg_remove() to free the same memory twice during device removal. Patches available across kernel versions 6.6.134, 6.12.81, 6.18.22, 6.19.12, and mainline 7.0. EPSS score of 0.02% indicates low observed exploitation probability, with no active exploitation confirmed at time of analysis.
Out-of-bounds array access in Linux kernel UCSI (USB Type-C Connector System Software Interface) driver allows local authenticated attackers to achieve arbitrary code execution or system crash. A malicious USB-C device or compromised firmware can send a crafted CCI (Connector Change Indicator) message with an invalid connector number (0-127) that exceeds the allocated connector array bounds (typically 2-4 entries), triggering memory corruption in ucsi_connector_change(). Vendor patches available for kernel 6.12.81, 6.18.22, 6.19.12, and mainline 7.0. EPSS score of 0.02% (5th percentile) indicates very low observed exploitation probability, and no active exploitation or public POC currently identified.
Local privilege escalation via stack out-of-bounds write affects the f_uac1_legacy USB Audio Class 1.0 gadget driver in the Linux kernel, where f_audio_complete() memcpy's a host-controlled req->length into a fixed 4-byte stack variable without validation. A device operating in USB gadget/peripheral mode can be driven by a malicious or crafted USB host to corrupt kernel stack memory, yielding CVSS 7.8 (High) with full confidentiality, integrity and availability impact. No public exploit is identified at time of analysis and EPSS is negligible (0.02%), but the flaw is upstream-patched across many stable trees.
Uninitialized variable use in Linux kernel CIFS replay logic allows local authenticated attackers to potentially access sensitive kernel memory, corrupt data, or trigger denial of service. The vulnerability exists in CIFS request replay code paths where certain local variables lack proper reinitialization after replay labels, potentially causing undefined behavior during SMB session recovery operations. Patches available for kernel versions 6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0. EPSS score of 0.02% indicates minimal observed exploitation activity, consistent with the local access requirement and specialized triggering conditions.
Double-free vulnerability in Linux kernel Xen privcmd driver allows local authenticated attackers to corrupt memory and potentially execute arbitrary code or cause denial of service. When userspace performs partial munmap() on privcmd mappings, VMA splitting creates duplicate pointers to the same memory pages array, leading to kvfree() being called twice on the same allocation during VMA cleanup. Xen Security Advisory XSA-487 confirms this issue affects virtualization hosts running Xen paravirtualized domains. No public exploit identified at time of analysis, with EPSS score of 0.03% indicating low predicted exploitation probability. Vendor-released patches available for stable kernel versions 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.26, and 7.0.3.
Buffer overflow in Linux kernel Xen hypervisor interface allows local authenticated users to achieve arbitrary code execution with high privilege escalation impact. The vulnerability stems from improper handling of non-NUL-terminated build ID data from HYPERVISOR_xen_version(XENVER_build_id) in drivers/xen/sys-hypervisor.c, where sprintf reads past buffer boundaries seeking a NUL terminator. Affects Linux kernel versions from 5.10 through 7.0 series when running as Xen domain. Vendor-released patches available across all affected stable branches (5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.26, 7.0.3). EPSS score of 0.08% (23rd percentile) indicates low probability of mass exploitation despite high CVSS 7.8, reflecting specialized Xen-only attack surface. No public exploit identified at time of analysis.
Buffer overflow in TH1520 AON firmware protocol driver allows local authenticated attackers with low privileges to execute arbitrary code and gain elevated system access. The vulnerability stems from unsafe pointer arithmetic when accessing the 'mode' field through the 'resource' pointer with unchecked offsets in the T-HEAD firmware driver. Patches available across stable kernel branches (6.18.23, 6.19.13, 7.0) with low EPSS score (0.02%) indicating minimal observed exploitation attempts, though CVSS 7.8 reflects high impact if exploited on affected T-HEAD TH1520 systems.
Use-after-free in Linux kernel driver core allows local authenticated users to execute arbitrary code, escalate privileges, or crash the system via race condition in device-driver binding operations. The vulnerability stems from inconsistent locking in driver_match_device() function calls, specifically affecting driver_override functionality where device_lock was not held during bind_store() and __driver_attach() operations. EPSS probability is very low (0.02%, 5th percentile), indicating minimal real-world exploitation observed. No active exploitation confirmed - no CISA KEV listing identified. Patch available in kernel 7.0+ and backport commit dc23806a7c47.
Double-free memory corruption in the Linux kernel's KASAN shadow-teardown path (mm/kasan) affects kernels built with KASAN on architectures where page-table pages are not struct-page aligned - notably PowerPC with 64K page size, where the PUD table is allocated from the pgtable-2^9 slab cache. When device-managed memory is unmapped (e.g. unbinding a PMEM/nvdimm device via ndctl), kasan_remove_zero_shadow() frees the same slab object twice, corrupting the slab allocator. This is a local, KASAN-build-only defect with no public exploit identified at time of analysis; EPSS is negligible (0.02%) and it is not in CISA KEV.
Out-of-bounds memory access in the Linux kernel's netfilter ip6t_eui64 IPv6 match module allows a malformed Ethernet/MAC header to reach eth_hdr(skb) before validation, leading to information disclosure or a kernel crash. The prior guard in eui64_mt6() only rejected an invalid MAC header when par->fragoff != 0, so non-fragmented packets (fragoff == 0) with an invalid MAC header could still be dereferenced. Exploitation requires an administrator to have configured an ip6tables rule using the eui64 match; no public exploit identified at time of analysis and EPSS is very low (0.02%).
Local privilege escalation and memory corruption in the Linux kernel's batman-adv mesh networking module allows a low-privileged attacker to trigger an skb_put buffer overflow by exploiting a race in OGM (Originator Message) aggregation. When aggregation is toggled at runtime, a forwarded packet allocated with only packet_len bytes can later be selected for aggregation, causing an append past the socket buffer's tailroom. CVSS 7.8 (High); EPSS is very low at 0.02% (7th percentile) and there is no public exploit identified at time of analysis and no CISA KEV listing.
Out-of-bounds read in the Linux kernel's bridge neighbour-discovery proxy (br_nd_send) allows remote attackers to leak adjacent kernel memory or crash the host by sending crafted IPv6 Neighbor Solicitation packets whose ND option area lies in the non-linear (paged/fragmented) part of the socket buffer. The function parses ns->opt[] assuming options reside in the skb's linear region, but callers only guarantee the ICMPv6 header and target address are linear, so parsing reads past the linear buffer. EPSS is very low (0.03%, 8th percentile) and there is no public exploit identified at time of analysis, but the fix is shipping across all maintained stable trees and downstream vendors (Ubuntu USN-8490-1, Siemens).
Use-after-free in the Linux kernel IPv6 flowlabel subsystem lets a local user crash the system by racing a read of /proc/net/ip6_flowlabel against the early free of an exclusive flowlabel's option block. When fl_release() drops fl->users to zero it immediately kfree()s fl->opt, while the enclosing struct ip6_flowlabel stays visible in the global hash until later RCU garbage collection, so a concurrent ip6fl_seq_show() reader dereferences freed memory. There is no public exploit identified at time of analysis, and EPSS is 0.02% (7th percentile), consistent with a low-value local denial-of-service bug rather than a widely exploited flaw.
Kernel memory disclosure and denial of service in the Linux kernel's openvswitch (OVS) datapath arises because validate_set() accepted OVS_KEY_ATTR_MPLS as a variable-length payload for SET/SET_MASKED actions while the action handler expects the fixed-size struct ovs_key_mpls. A local low-privileged actor able to install OVS flow actions can supply an undersized or oversized MPLS key to trigger an out-of-bounds read (rated C:H, I:N, A:H), leaking adjacent kernel memory or crashing the datapath. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile), consistent with a niche, privilege-gated networking bug rather than a mass-exploitation candidate.
Local privilege escalation via a use-after-free race in the Linux kernel's Open vSwitch (openvswitch) module allows a local user with network-configuration capability to corrupt kernel memory. The flaw lives in ovs_netdev_tunnel_destroy(), which drops the tunnel netdev reference during teardown; when this runs after NETDEV_UNREGISTER has already detached the device, it races concurrent RCU readers that still observe vport->dev, producing a premature reference drop and stale-pointer access. The fix defers the netdev_put to the RCU release callback (vport_netdev_free), matching the non-tunnel path. There is no public exploit identified at time of analysis, and EPSS is negligible (0.02%, 7th percentile).
Denial of service in the Linux kernel's rxrpc (AF_RXRPC) subsystem allows remote attackers to disrupt service-side RxRPC connections by sending duplicate or late RESPONSE packets that re-run the connection setup path. The flaw stems from an unlocked, post-transition state test that permitted RESPONSE processing outside the RXRPC_CONN_SERVICE_CHALLENGING window; the fix gates processing on that state under state_lock. No public exploit has been identified and EPSS probability is very low (0.02%), but any kernel exposing an rxrpc service (e.g., kafs/AFS) is potentially reachable over the network without authentication.
Out-of-bounds kernel memory access in the Linux kernel's network emulation scheduler (sch_netem) allows a local, privileged user to corrupt kernel memory and likely panic the system. When a netem qdisc has packet corruption enabled and an AF_PACKET TX_RING transmits fully non-linear packets over an IPIP tunnel, skb_headlen(skb) is 0, causing get_random_u32_below(0) to return an unconstrained 32-bit offset that indexes past the linear skb->data area. There is no public exploit identified at time of analysis, EPSS risk is very low (0.02%), and it is not on CISA KEV; it is a locally-triggerable memory-safety bug rather than a remotely exploitable one.
Out-of-bounds kernel memory access in the Linux kernel's IPv6 netfilter ip6t_rt (Routing Header) match module allows a local user holding CAP_NET_ADMIN to install a crafted ip6tables rule whose addrnr field exceeds IP6T_RT_HOPS, causing rt_mt6() to read past the bounds of rtinfo->addrs[]. This can leak adjacent kernel memory (information disclosure) or crash the system (denial of service). No public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.02%, 7th percentile).
Kernel memory disclosure in the Linux kernel's AF_UNIX subsystem allows a local, low-privileged user to read stale or freed VFS data via the UNIX_DIAG_VFS netlink attribute. The sock_diag handler read a UNIX socket's u->path inode and device numbers without holding unix_state_lock, racing against unix_release_sock() which clears u->path under that lock before dropping the path reference. The fix reads the inode/device under unix_state_lock and emits the netlink attribute after unlocking; no public exploit identified at time of analysis and EPSS is negligible (0.02%).
Integer overflow in OP-TEE OS RSA signature encoding crashes the Trusted Execution Environment on platforms with RSA hardware acceleration. Affects versions 3.8.0 through 4.10 when attackers supply cryptographic operations with deliberately undersized RSA moduli, causing memset() to overwrite memory until the TEE crashes. This denial-of-service attack requires no authentication and can be triggered remotely (CVSS AV:N/PR:N), completely disabling the secure-world environment that protects cryptographic keys, biometric data, and DRM operations on affected Arm TrustZone systems. EPSS data not available; no active exploitation confirmed at time of analysis.
Kernel memory corruption in Linux's MPTCP subsystem allows a use-after-free in __inet_lookup_established affecting IPv6 subflow sockets. Because mptcp_subflow_init() copied tcpv6_prot before inet6_init() had registered its slab cache, MPTCP IPv6 child sockets were allocated from kmalloc-4k without the SLAB_TYPESAFE_BY_RCU guarantee, so lockless RCU ehash lookups could dereference freed socket memory. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%), but the flaw is remotely reachable via network traffic on hosts using MPTCP over IPv6.
Routing policy bypass in the Linux kernel's IPv6 Segment Routing (SRv6) seg6 lwtunnel implementation allows post-encapsulation SID lookups to be resolved from a stale, shared destination cache. Kernels from 4.10 onward that deploy seg6 encap routes shared a single dst_cache between seg6_input_core() and seg6_output_core(); whichever path executed first populated the cache and the other reused it blindly, bypassing its own routing lookup (e.g. ip rules matching the ingress interface or VRF table separation). Despite an NVD-assigned CVSS of 9.8 and a 'Authentication Bypass' tag, this is a routing-correctness/isolation defect rather than memory corruption or code execution; there is no public exploit identified at time of analysis and EPSS is negligible (0.02%, 7th percentile).
Improper lock ordering in the Linux kernel's uinput driver interacting with the force-feedback (ff-core) subsystem creates a circular locking dependency (ff->mutex → udev->mutex → input_mutex → dev->mutex → ff->mutex) that lockdep flags and that can deadlock kernel threads. It is reproducibly triggered by a local user exercising a force-feedback device through uinput - for example a Flydigi Vader 5 gamepad under Wine/Proton - and is fixed by replacing a mutex acquisition in uinput_request_send() with a leaf spinlock. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and the issue is not on CISA KEV; despite the 7.8 CVSS this is a reliability/locking correctness fix rather than a memory-corruption bug.
Local privilege-level extent tree corruption in the Linux kernel's Btrfs filesystem (versions 6.10 through the 6.18/6.19/7.0 development lines) arises because lookup_extent_data_ref() returns 0 (success) instead of -ENOENT after crossing to a new leaf whose first key does not match, causing callers to operate on the wrong extent tree item. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%), indicating negligible likelihood of opportunistic exploitation; this is a reliability/data-integrity defect rather than a remotely reachable RCE. CVSS 7.8 (AV:L/PR:L) reflects local access requirements, not network exposure.
Local privilege escalation and memory corruption in the Linux kernel's netfilter nf_tables conntrack (nft_ct) subsystem allows a local user with network-admin capability to trigger a use-after-free by destroying a conntrack timeout object while packets on other CPUs still reference it. The flaw stems from nft_ct_timeout_obj_destroy() calling kfree() immediately after nf_ct_untimeout() without waiting for an RCU grace period, leaving a dangling RCU-protected pointer read during nf_conntrack_tcp_packet(). No public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile), but a KASAN reproducer ('exploit' task) is described in the commit and the bug is a classic exploitable CWE-416 heap UAF.
Use-after-free race condition in the Linux kernel's IPsec (xfrm) transport-mode input path allows a local attacker to corrupt kernel memory and potentially escalate privileges. In xfrm_input_resume(), the network device reference (skb->dev) is dropped via dev_put() immediately on async-crypto re-entry, yet the pointer is still dereferenced inside NF_HOOK and its okfn, creating a window that races with device teardown. No public exploit identified at time of analysis, and EPSS probability is negligible (0.02%), consistent with a difficult-to-trigger race rather than a mass-exploited flaw.
Denial of service in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem allows a duplicate or stale GRP_ACK_MSG to underflow the u16 bc_ackers counter to 65535, permanently wedging group broadcast on the affected socket until the TIPC group is torn down and recreated. The flaw affects the tipc_group_proto_rcv() handler across a wide range of kernel branches (4.15 through the 7.0 series). It is a pure availability issue (CVSS A:H, C:N/I:N); there is no public exploit identified at time of analysis and EPSS probability is negligible (0.02%).
Heap out-of-bounds write in the Linux kernel's batman-adv mesh routing subsystem lets a remote mesh originator corrupt kernel memory by advertising an oversized global translation table (TT). In batadv_tt_prepare_tvlv_global_data(), the allocation length is computed in 16-bit temporaries, so a large TT payload plus the VLAN header offset wraps past 65535 before kmalloc(), producing an undersized buffer that the full-table response path then overruns using the original (unwrapped) length. It is fixed across multiple stable kernel branches; there is no public exploit identified at time of analysis and EPSS is negligible (0.02%).
Use-after-free in Linux kernel batman-adv (B.A.T.M.A.N. Advanced mesh networking) allows remote network attackers to trigger memory corruption and potentially execute arbitrary code. The batadv_bla_add_claim() function can prematurely drop a gateway reference while readers still access the pointer, causing netlink dump and claim-check paths to dereference freed memory. Despite CVSS 9.8 critical rating, exploitation probability is low (EPSS 2%, 7th percentile), no active exploitation confirmed, and patches available across kernel stable branches 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, and mainline 7.0.
Local privilege escalation in the Linux kernel's i915 graphics driver allows authenticated users to trigger a use-after-free condition via a race between the heartbeat worker and intel_engine_park_heartbeat() function when releasing engine heartbeat requests. The vulnerability stems from a non-atomic pointer read-and-clear operation that permits double-free of the same request object, causing refcount underflow and potential arbitrary code execution with elevated privileges. Patches are available across multiple stable kernel branches (5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, 7.0). EPSS exploitation probability is low (0.02%, 7th percentile), and no public exploit or active exploitation has been identified at time of analysis.
Memory leak (with latent use-after-free risk) in the Linux kernel's DAMON monitoring subsystem (mm/damon/stat) allows a local, privileged user to leak damon_ctx objects and potentially trigger use-after-free by repeatedly toggling the DAMON_STAT 'enabled' control after a damon_call() failure. Affected are kernels on the 6.17-6.19 line prior to the stable fixes; the flaw is classified CWE-416 (Use After Free). There is no public exploit identified at time of analysis, and EPSS is negligible (0.02%, 4th percentile).
Local privilege-escalation potential via a use-after-free in the Linux kernel's vub300 MMC host-controller driver (drivers/mmc/host/vub300.c), affecting kernels built with CONFIG_MMC_VUB300 through 6.17 and stable branches prior to 6.18.23/6.19.13. Because the controller structure was allocated with device-managed (devm) memory while the driver keeps its own explicit reference count, the last reference can outlive driver unbind, letting the kernel dereference freed memory on disconnect or probe deferral. No public exploit identified at time of analysis, and EPSS is negligible (0.02%), consistent with the requirement that the uncommon vub300 USB-to-SDIO hardware be physically present.
Integer underflow in Linux kernel stmmac network driver allows kernel memory disclosure and potential corruption via crafted network packets. The flaw occurs in chain mode jumbo frame handling when packets have small linear data but large total length from page fragments, causing buffer offset calculations to wrap to ~0xFFFFxxxx. This triggers massive loop iterations that DMA-map arbitrary kernel memory to the network hardware. On typical stmmac deployments (IOMMU-less embedded SoCs), attackers can remotely read kernel memory contents and potentially corrupt memory through hardware DMA operations. EPSS exploitation probability is low (0.02%) with no confirmed active exploitation, but CVSS 9.8 reflects the theoretical remote unauthenticated attack surface. Vendor patches available across all supported stable kernel branches (5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, 7.0).
Race condition in Linux kernel memory management allows local attackers with low privileges to corrupt kernel page state, potentially achieving high-impact denial of service, data corruption, or privilege escalation. The vulnerability affects kernel versions 6.6.x through 7.0-rc3, with patches confirmed released for stable branches 6.6.135, 6.12.82, 6.18.23, 6.19.13, and mainline 7.0. EPSS exploitation probability is low (0.02%, 5th percentile), and no public exploit code or active exploitation has been identified at time of analysis. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates local access with low attack complexity, while the specific race condition requires precise timing between file mapping and inode size modification operations.
Use-after-free in Linux kernel's lan966x network driver allows local authenticated attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The flaw occurs in lan966x_fdma_reload() when RX buffer allocation fails - freed pages remain referenced by active DMA descriptors, causing hardware to write into memory now controlled by other kernel subsystems. Vendor patches available for stable branches 6.12.82, 6.18.23, 6.19.13, and mainline 7.0. EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation. No CISA KEV listing or public exploit identified at time of analysis, but successful exploitation grants kernel-level privileges to local attackers.
Heap buffer overflow in Linux kernel rxrpc subsystem allows local authenticated users to trigger memory corruption via crafted RxGK tokens. Exploitable through unprivileged add_key() system call when raw key/ticket lengths >= 0xfffffffd cause integer wraparound in round_up(), bypassing bounds checks while memcpy() copies up to 4 GiB into zero-sized heap allocation. Vendor patches available for stable branches 6.18.23, 6.19.13, and mainline 7.0. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability despite local privilege escalation potential with CVSS 7.8.
Linux kernel rxrpc subsystem allows remote denial of service via malformed RESP challenge packets due to incorrect serial number comparison logic. The rxrpc_post_response() function compares challenge serial numbers from the wrong packet structure, causing response queue corruption that can crash the kernel networking stack. This affects Linux kernel versions containing commit 5800b1cf3fd8 through the 6.16-6.19 and 7.0 series. Patches are available from kernel.org for affected stable branches. EPSS exploitation probability is very low (0.02%, 4th percentile) and no public exploits or active exploitation have been identified, suggesting limited real-world risk despite the network-accessible attack vector.
Null pointer dereference in Linux kernel rxrpc subsystem allows remote network attackers to crash the system by sending malformed packets to a client-side connection after a call has been torn down. The flaw affects Linux kernel versions 6.2 onward where the rxrpc client code unconditionally releases a call reference that was never acquired, converting a protocol error into a kernel panic. Vendor patches are available across stable branches (6.6.135, 6.12.82, 6.18.23, 6.19.13, 7.0). EPSS exploitation probability is low (0.02%, 5th percentile) and no public exploit has been identified at time of analysis.
Unauthenticated remote attackers can exploit a cryptographic validation bypass in the Linux kernel's RxRPC rxkad authentication handler to potentially execute arbitrary code or cause denial of service. The rxkad_decrypt_ticket() function fails to verify that RXKAD response ticket decryption succeeded before parsing the buffer contents, allowing malformed RESPONSE packets with non-block-aligned ticket lengths to drive the ticket parser with attacker-controlled ciphertext bytes. Despite the critical 9.8 CVSS score indicating network-exploitable attack with high impact across confidentiality, integrity, and availability, EPSS exploitation probability is low (0.02%, 5th percentile) and no active exploitation or public POC has been identified. Patches are available across multiple stable kernel versions (6.6.135, 6.12.82, 6.18.23, 6.19.13, 7.0).
Out-of-bounds read in Linux kernel's rxrpc rxgk authentication handler allows remote unauthenticated attackers to trigger information disclosure and denial of service via malformed RESPONSE authenticator packets. The vulnerability stems from incorrect pointer arithmetic in rxgk_verify_authenticator() that inflates the parser boundary check by a factor of four, allowing reads beyond kmalloc() buffer boundaries. Vendor patches available for kernel versions 6.18.23, 6.19.13, and 7.0. EPSS score of 0.02% (4th percentile) suggests low observed exploitation probability despite network attack vector, though KASAN reports confirm reproducibility.
Remote denial of service in Linux kernel rxrpc subsystem allows unauthenticated network attackers to trigger kernel crash via malformed rxgk RESPONSE packets. An inverted length check in rxgk_verify_response() accepts oversized authenticators, causing skb_to_sgvec() to hit BUG_ON() and panic the kernel. EPSS exploitation probability is very low (0.02%, 4th percentile), no active exploitation confirmed, and patches are available across stable kernel branches 6.18.23, 6.19.13, and 7.0.
Integer overflow in Linux kernel's rxrpc rxgk_verify_response() function allows remote unauthenticated attackers to bypass length validation checks and potentially achieve arbitrary code execution. The vulnerability exists in the rxrpc protocol implementation where token_len rounding occurs before validation, enabling buffer overflow conditions. With CVSS 9.8 (critical severity) and network attack vector requiring no authentication, this represents a significant exposure despite low EPSS score (0.02%, 4th percentile), suggesting limited real-world exploitation observed to date. Vendor patches are available across multiple stable kernel versions (6.18.23, 6.19.13, 7.0).
Buffer overread in Linux kernel's rxgk_do_verify_authenticator() function allows remote unauthenticated attackers to trigger information disclosure and high-availability denial of service through network-accessible RxGK authentication handling. The vulnerability stems from improper buffer size validation before nonce verification in the RxRPC subsystem. Patches are available from the Linux kernel stable tree (versions 6.19.13, 6.18.23, and 7.0). EPSS score of 0.02% (4th percentile) indicates very low observed exploitation probability, and no active exploitation or public POC has been identified. Despite the high CVSS base score of 8.2, real-world risk appears limited to environments using RxRPC with RxGK authentication.
Buffer overflow in Linux kernel's AF_RXRPC procfs address formatting allows local authenticated users to corrupt memory and potentially escalate privileges. The vulnerability affects rxrpc proc handlers that write IPv6 socket addresses into 50-byte stack buffers, but ISATAP-format IPv6 addresses with ports can require 51 bytes, causing single-byte overflow. EPSS exploitation probability is low (0.02%, 4th percentile), and patches are available from kernel.org for versions 6.18.23, 6.19.13, and mainline 7.0. No active exploitation confirmed (not in CISA KEV), and CVSS 7.8 reflects local-only attack vector requiring authenticated access.
Use-after-free in Linux kernel NFC LLCP implementation allows adjacent-network attackers to execute arbitrary code with kernel privileges. The flaw occurs when socket state is LLCP_CLOSED in nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), where missing return statements cause double release_sock() and refcount underflow, leading to memory corruption. Vendor-released patches available for stable kernels 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability, and no active exploitation or public POC confirmed at time of analysis.
Buffer overflow in Linux kernel's s3c24xx I2C driver allows local authenticated attackers to achieve arbitrary code execution with high privileges through malformed SMBUS block read messages. The driver fails to validate message length against I2C_SMBUS_BLOCK_MAX before processing, enabling out-of-bounds memory access. Vendor patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% suggests low observed exploitation activity, with no CISA KEV listing indicating targeted rather than widespread attacks. Attack requires local access and low-level user privileges (CVSS AV:L/PR:L), limiting practical exploitability compared to the high CVSS 7.8 base score.
Uninitialized memory read in Linux kernel's rtl8723bs Wi-Fi driver allows adjacent network attackers to cause denial of service or potentially corrupt integrity through malformed BIP (Broadcast/Multicast Integrity Protocol) frames. The vulnerability affects the staging rtl8723bs driver where only 6 bytes are copied into an 8-byte variable during BIP verification, leaving 2 bytes uninitialized. Patches available across multiple stable kernel versions (6.12.83, 6.18.24, 6.19.14, 7.0.1). EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability. Not listed in CISA KEV, and no public exploit identified at time of analysis.
Heap buffer overflow in Linux kernel NFC-A digital target driver allows adjacent-network attackers to corrupt memory and potentially execute code. A malicious NFC peer device can trigger unbounded cascade loops during anti-collision protocol, writing beyond the 10-byte nfcid1 buffer with each iteration. EPSS score of 0.02% (5th percentile) indicates low likelihood of mass exploitation, but the adjacent attack vector (AV:A) limits exposure to proximity-based attacks. Vendor patches available across multiple stable kernel branches (6.12.83, 6.18.24, 6.19.14, 7.0.1). No active exploitation confirmed (not in CISA KEV); no public exploit identified at time of analysis.
Out-of-bounds kernel heap read in the Linux kernel's CIFS/SMB client (check_wsl_eas() extended-attribute parser) lets a malicious or compromised SMB server leak up to 8 bytes of adjacent kernel heap into the WSL xattr name comparison, influencing which WSL extended attribute the returned data is interpreted as. The root cause is an off-by-8 bounds check (CWE-125) that measures the EA end from the struct base instead of ea->ea_data, so the trailing name and value bytes of the last EA are read past the end of the response iov. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.02%), and it is not on CISA KEV; patched kernels are already available.
Out-of-bounds heap read in Linux kernel SMB client allows malicious SMB servers to leak kernel memory to userspace via crafted symlink error responses. When processing STATUS_STOPPED_ON_SYMLINK errors in SMB 3.1.1, inadequate bounds checking in smb2_check_message() and symlink_data() allows server-controlled ErrorDataLength values to trigger reads beyond buffer boundaries. The leaked heap bytes are UTF-16-decoded into the symlink target and exposed through readlink(2) syscalls (confidentiality impact), with potential for denial-of-service through memory corruption (availability impact). CVSS 8.1 (High) requires user interaction. EPSS score is very low at 0.02% (5th percentile), indicating minimal observed exploitation activity. Patches available in kernel versions 6.18.24, 6.19.14, and 7.0.1.
Information disclosure in Linux kernel's ksmbd SMB server allows remote unauthenticated attackers to leak uninitialized heap memory via malformed SMB2 requests. The vulnerability exists in smb2_get_ea() which fails to validate EaNameLength from client requests before using it in strncmp(), enabling heap content extraction. With EPSS score of 0.02% and no KEV listing, exploitation likelihood remains low despite CVSS 7.5 rating. Patches available across kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1.
Out-of-bounds read in Linux kernel's ksmbd SMB server allows remote unauthenticated attackers to manipulate file permissions by crafting malicious ACE SIDs with insufficient sub-authorities, triggering parse_dacl() to read 4 bytes past the ACL buffer boundary and apply those arbitrary bytes as POSIX file mode bits. EPSS exploitation probability is very low (0.02%, 5th percentile) with no public exploit identified at time of analysis. Vendor-released patches available across stable kernel branches (6.12.83, 6.18.24, 6.19.14, 7.0.1).
Double-free memory corruption in the Linux kernel SMB client (smbd) allows remote unauthenticated attackers to achieve arbitrary code execution, confidentiality breach, and denial of service. The vulnerability occurs when smbd_free_send_io() is erroneously called twice after smbd_send_batch_flush() operations, creating use-after-free conditions. Exploitation probability is low (EPSS 0.02%, 4th percentile) with no confirmed active exploitation or public POC, but the critical CVSS 9.8 score reflects the severe potential impact if network-accessible SMB client operations are triggered. Vendor patches available for kernel versions 6.18.24, 6.19.14, and 7.0.1.
A double-free vulnerability in the Linux kernel's SMB Direct (RDMA transport) server implementation allows remote unauthenticated attackers to trigger memory corruption with high CVSS 9.8 severity. The flaw occurs when smb_direct_free_sendmsg() is called twice on the same memory region after smb_direct_flush_send_list() moves messages to a batch list. Vendor patches available across kernel versions 6.18.24, 6.19.14, and 7.0.1, with upstream commits confirmed in stable branches. Despite critical CVSS scoring, EPSS probability remains very low at 0.02% (4th percentile) and no active exploitation or public POC identified, suggesting limited real-world targeting of this SMB Direct RDMA feature.
Heap buffer overflow in Linux kernel USB/IP client allows malicious USB/IP servers to execute arbitrary code with kernel privileges via crafted RET_SUBMIT responses. A rogue server can specify a larger number_of_packets value than originally submitted, causing out-of-bounds writes when processing isochronous USB transfers. Patched in kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% (5th percentile) suggests low probability of widespread exploitation despite CVSS 9.8 criticality, indicating this is primarily a risk in environments using USB/IP with untrusted servers rather than a general internet-facing threat.
Memory access violation in Linux kernel ALSA ctxfi driver allows local authenticated users to trigger kernel page faults and potential privilege escalation. The flaw affects CT20K2 audio hardware drivers (snd_ctxfi module) where virtual memory mapping logic incorrectly accesses beyond allocated page table pages when aggregate memory allocations exceed 2MB on AMD64 systems. EPSS exploitation probability is very low (0.02%, 5th percentile) and no public exploit or active exploitation is confirmed. Vendor-released patches available across multiple stable kernel branches (6.12.83, 6.18.24, 6.19.14, 7.0.1).
Kernel panic in Linux arm64 memory management causes system crash when handling invalid large leaf page table mappings during DMA bounce buffer operations. ARM64 systems running Linux 7.0-rc4 and earlier (specifically kernels with commit a166563e7ec37 that introduced large block mapping support) crash with translation faults when components like SWIOTLB, secretmem, kfence, or realm DMA attempt to invalidate large leaf mappings. Exploitation requires no special privileges as this is triggered by normal kernel operations during boot or DMA activity. Vendor patches available across stable branches (6.18.24, 6.19.14, 7.0.1). EPSS score is 1st percentile (0.01%) indicating extremely low observed exploitation probability, consistent with this being an availability issue requiring specific ARM64 hardware configurations rather than a remotely exploitable vulnerability.
Kernel deadlock in Linux OCFS2 filesystem allows remote denial of service through lock ordering violation between unlink and direct I/O operations. OCFS2's orphan directory locking in ocfs2_unlink and ocfs2_dio_end_io_write acquire ip_alloc_sem and inode_lock in opposite orders (ABBA pattern), enabling concurrent operations to deadlock the system. Affects mainline Linux kernel through 6.19.14 with patches available in 6.12.83, 6.18.24, 7.0.1, and 6.19.14. EPSS score of 0.02% suggests minimal real-world exploitation likelihood despite CVSS 7.5 score, and no active exploitation or public POC identified.
Use-after-free in Linux kernel OCFS2 filesystem enables local attackers with low privileges to achieve arbitrary code execution, privilege escalation, or denial of service. The vulnerability occurs when filemap_fault() drops mmap_lock before returning VM_FAULT_RETRY, allowing concurrent munmap() to free the vm_area_struct while ocfs2_fault() still holds a dangling pointer. Vendor patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS exploitation probability is very low (0.02%, 5th percentile) with no public exploit identified at time of analysis.
Use-after-free in Linux kernel memory management allows remote code execution when the folio_unmap_invalidate() function incorrectly accesses freed mapping structures. Kernel versions between 1da177e4c3f4 and patches 6.19.14/7.0.1 are affected. Exploitation probability is low (EPSS 2%, percentile 5%), with no confirmed active exploitation or public POC at time of analysis. Despite the critical CVSS 9.8 score indicating network-based unauthenticated attack, the description suggests this is a kernel memory corruption bug requiring local kernel code paths to trigger, not direct remote network exploitation - CVSS vector conflicts with technical nature and should be validated against vendor guidance.
Use-after-free in Linux kernel KVM x86 MMIO emulation allows local authenticated users with low privileges to potentially execute arbitrary code, escalate privileges, or cause denial of service. The flaw occurs when KVM's emulator initiates MMIO writes using on-stack variables that cross page boundaries between two MMIO pages, creating dangling pointers when fragments are processed across separate KVM_RUN calls, especially when different tasks handle subsequent runs. EPSS exploitation probability is very low (0.02%, 5th percentile), and vendor patches are available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. No active exploitation or public POC identified at time of analysis.
Use-after-free in Linux kernel q6apm audio driver allows local authenticated attackers with low privileges to achieve arbitrary code execution, denial of service, or information disclosure with high impact to confidentiality, integrity, and availability. The flaw affects Qualcomm ASoC q6apm component registration code used in devices like Lenovo 21N2ZC5PUS laptops. Vendor-released patches are available across multiple kernel version branches (6.12.83, 6.18.24, 6.19.14, 7.0.1). EPSS score of 0.02% (5th percentile) indicates low probability of mass exploitation despite high CVSS 7.8, with no confirmed active exploitation or public POC identified at time of analysis.
Use-after-free in Linux kernel blk-cgroup subsystem allows local authenticated users to potentially execute arbitrary code, escalate privileges, or crash the system. The vulnerability occurs in cgwb_release_workfn() when releasing cgroup writeback structures, where a CSS reference is dropped before subsequent dereference, creating a race condition. Meta reports sporadic crashes in production across multiple kernel versions. Patches available for stable branches 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% suggests low widespread exploitation probability, and no active exploitation or public POC identified at time of analysis.
Use-after-free in Linux kernel MediaTek video encoder allows local authenticated users to corrupt memory and potentially execute arbitrary code. The flaw affects the vcodec driver's encoder release path where ctx memory is freed before canceling scheduled workqueue tasks, enabling race conditions between cleanup and worker threads that may dereference freed memory. KASAN-confirmed exploitation requires local access with low privileges (CVSS AV:L/PR:L). Patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% (5th percentile) indicates very low probability of automated exploitation, with no public exploit identified at time of analysis.
Local privilege escalation and denial of service in the Linux kernel's em28xx USB media driver arises from a use-after-free (CWE-416) in em28xx_v4l2_open(), which reads dev->v4l2 without holding dev->lock. A local attacker who can open the V4L2 device node during a race with the driver's init error path or teardown can trigger a use-after-free on the embedded video_device (via v4l2_fh_init accessing vdev->ctrl_handler) or a NULL dereference in em28xx_resolution_set(). No public exploit identified at time of analysis, and EPSS is very low (0.02%), consistent with a hard-to-win kernel race requiring physical/local USB device presence.
Local privilege-relevant memory corruption in the Linux kernel's powerz hwmon driver (ChargerLAB POWER-Z USB power monitor) allows a local user to trigger a use-after-free by racing a sysfs read against USB device disconnect, dereferencing a freed URB pointer. The bug affects kernels prior to the stable fixes (7.0.1, 6.19.14, 6.18.24, 6.12.83) and carries CVSS 7.8, but with EPSS at just 0.02% (5th percentile) and no public exploit identified at time of analysis, real-world exploitation risk is low. It is not listed in CISA KEV.
Local privilege escalation via a use-after-free in the Linux kernel's ALSA driver for the TerraTec DMX 6Fire USB audio interface (sound/usb/6fire) lets a local attacker corrupt freed slab memory when the device is disconnected. The flaw is a CVSS 7.8 (CVSS:3.1 AV:L/PR:L) memory-corruption bug with publicly available proof-of-concept code, though EPSS is negligible (0.02%) and it is not on CISA KEV. usb6fire_chip_abort() writes chip->card = NULL after snd_card_free_when_closed() may have already freed the card-owned chip struct, giving an attacker a window to hijack freed kernel memory.
Local privilege escalation and denial of service in the Linux kernel's bcache subsystem stems from a use-after-free of the cached_dev.sb_bio structure; if a cached backing device is stopped while a superblock write is in flight, the freed bio is dereferenced at I/O completion (endio), corrupting kernel memory. Affected systems are those running bcache-backed block devices (observed crashing via librbd/libceph rbd workloads), where a local user with the ability to trigger device teardown during superblock activity can crash the host or potentially corrupt kernel memory. This carries no public exploit identified at time of analysis and an EPSS of just 0.02%, consistent with a hard-to-time race rather than a readily weaponized flaw.
Use-after-free and double-free in the Linux kernel's as102 DVB-T USB media driver (drivers/media/usb/as102) allows a local user to corrupt kernel memory by racing an open() of the device node against an error path in as102_usb_probe(). Because the probe error path frees the as102_dev_t structure immediately after usb_register_dev()/usb_deregister_dev() while a userspace file descriptor may still hold a reference, the later .release() path re-accesses and re-frees that structure. CVSS is 7.8 (local, low-privilege); EPSS is negligible (0.02%), no public exploit is identified, and it is not in CISA KEV.
Local privilege escalation and kernel memory corruption in the Linux kernel's HackRF Software-Defined Radio media (V4L2) driver arises from a use-after-free and double-free in the hackrf_probe() error path. When probe fails after v4l2_device_register() has already exposed the device node, the driver frees the hackrf_dev structure directly with kfree() while an already-open file descriptor still holds a reference, so subsequent ioctl() or close() calls dereference and re-free freed memory. There is no public exploit identified at time of analysis; EPSS is 0.02% (5th percentile) and it is not listed in CISA KEV.
Out-of-bounds heap write in Linux kernel CAN gateway CRC8 checksum processing allows adjacent network attackers to corrupt kernel memory and potentially achieve code execution. The cgw_csum_crc8_rel() function in the CAN gateway subsystem uses raw negative index values instead of bounds-checked variables when accessing canfd_frame data, enabling writes up to 56 bytes before the heap object. Exploitation requires CAP_NET_ADMIN capability to configure CAN gateway CRC8 checksums. EPSS exploitation probability is very low (0.02%, 7th percentile) and no active exploitation has been reported. Vendor patches available across multiple kernel versions (5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, 7.0).
Integer overflow in Linux kernel io_uring subsystem allows local authenticated users to trigger slab-out-of-bounds memory reads and denial of service. The vulnerability stems from improper type casting of user-supplied length values in network bundled receive/send operations, where values exceeding INT_MAX cause negative overflow leading to infinite loops and out-of-bounds array access. EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation. Vendor patches available for affected stable kernel branches (6.12.81, 6.18.22, 6.19.12, 7.0), making this a straightforward patching priority for systems running vulnerable versions with io_uring enabled.
Incorrect authentication labeling in Linux kernel's Bluetooth SMP legacy pairing allows adjacent attackers to bypass security controls and gain high-level access without proper authentication. The flaw affects the Short Term Key (STK) derivation in Just Works/Confirm pairing modes, where keys are incorrectly marked as authenticated even when Man-in-the-Middle (MITM) protection was not established. With CVSS 8.8 (AV:A/AC:L/PR:N/UI:N), this enables adjacent network attackers to exploit Bluetooth pairing flows without authentication. EPSS score of 0.05% suggests low widespread exploitation likelihood. Vendor patches available across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0).
Stack buffer overflow in Linux kernel Bluetooth subsystem allows local authenticated attackers to achieve code execution, privilege escalation, or denial of service through malformed ISO socket parameters. The vulnerability occurs when binding an ISO Bluetooth socket with up to 31 BIS entries while the hci_le_big_create_sync() function only allocates stack space for 17 entries, resulting in a 14-byte overflow that corrupts adjacent stack memory. Patches are available across multiple kernel versions (6.12.81, 6.18.22, 6.19.12, 7.0), with EPSS indicating 0.02% exploitation probability and no active exploitation confirmed.
Out-of-bounds memory read in Linux kernel Bluetooth HCI event processing allows adjacent network attackers to disclose kernel memory or trigger denial of service without authentication. The vulnerability stems from premature wake reason storage before per-event payload length validation, enabling crafted short HCI event frames to reach bacpy() operations before bounds checking. EPSS score is low (0.02%, 6th percentile) with no evidence of active exploitation or public POC at time of analysis. Vendor patches available for kernel versions 5.10+ through 6.19.12 and mainline 7.0.
Use-after-free in Linux kernel GPIB subsystem allows local authenticated attackers with low privileges to execute arbitrary code, escalate privileges, or crash the system. The vulnerability occurs in IBRD, IBWRT, IBCMD, and IBWAIT ioctl handlers when concurrent IBCLOSEDEV calls free descriptors still in use by I/O operations. EPSS probability is very low (0.02%, 4th percentile), indicating minimal observed exploitation activity. Vendor patches available for stable branches 6.18.22, 6.19.12, and mainline 7.0 via commits cae26eff, 28c75dd1, and d1857f82.
Improper Direct Memory Access (DMA) handling in the Linux kernel's ti-adc161s626 Industrial I/O (IIO) analog-to-digital converter driver allows local attackers with low privileges to trigger memory corruption or information disclosure. The vulnerability stems from using stack-allocated memory for SPI read operations instead of DMA-safe buffers, violating SPI subsystem requirements. Patches are available across multiple stable kernel versions (6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and mainline 7.0). EPSS score of 0.02% indicates very low exploitation probability, and no public exploits or active exploitation (not in CISA KEV) have been identified.
Integer overflow in AMD GPU driver's user queue doorbell handling allows local authenticated users to corrupt kernel memory and potentially escalate privileges. The amdgpu driver fails to validate user-supplied doorbell_offset values before calculating buffer offsets, enabling out-of-bounds writes to kernel doorbell space. Patches available in Linux 6.18.22, 6.19.12, and 7.0. EPSS score of 0.02% (4th percentile) indicates low probability of mass exploitation, though CVSS 7.1 reflects serious local privilege escalation potential. No active exploitation confirmed; attack requires local authenticated access to systems with AMD GPU hardware.
Out-of-bounds array access in the st_lsm6dsx IMU driver allows local authenticated users with low privileges to achieve high-impact code execution, data disclosure, or denial of service. The vulnerability exists in the buffer sampling frequency sysfs handler, which fails to validate sensor type before indexing a 2-entry array with sensor IDs beyond accelerometer and gyroscope. Exploitation requires write access to sysfs attributes for non-standard sensor types in the driver. EPSS exploitation probability is very low (0.02%, 5th percentile), no active exploitation confirmed, and vendor patches are available for Linux 6.19.12 and 7.0.
Race condition in the Linux kernel MPU3050 gyroscope driver allows local attackers with low privileges to potentially achieve code execution, data corruption, or information disclosure. The vulnerability stems from premature registration of the IIO device before complete initialization in the probe function, creating a window where userspace can interact with incompletely configured hardware. While CVSS rates this 7.8 HIGH with local attack vector, EPSS score of 0.02% (7th percentile) indicates extremely low probability of active exploitation. Patches available across all maintained kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). No evidence of active exploitation (not in CISA KEV) or public proof-of-concept code.
Double-free memory corruption in Linux kernel USB ULPI subsystem allows local authenticated attackers with low privileges to potentially achieve arbitrary code execution, denial of service, or information disclosure. The flaw exists in ulpi_register_interface() error handling since kernel 4.2 (commit 289fcff4b), where device_register() failure triggers cleanup via put_device() followed by redundant kfree(), corrupting kernel memory. Patches available across stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% suggests low likelihood of mass exploitation despite high CVSS 7.8, likely due to local attack vector and requirement for device registration failure conditions.
Use-after-free condition in Linux kernel USB Test and Measurement Class (USBTMC) driver allows local authenticated attackers to execute arbitrary code with elevated privileges. The vulnerability occurs when the usbtmc_release function fails to properly flush pending anchored URBs, leaving dangling references that can be exploited in the HCD giveback path. Vendor patches are available across multiple stable kernel versions (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0). Despite the high CVSS score of 7.8, the EPSS exploitation probability is very low at 0.02% (7th percentile), indicating limited real-world targeting, and no active exploitation or public POC has been identified.
Buffer overflow in Linux kernel COMEDI me_daq driver allows local authenticated users to achieve arbitrary code execution with kernel privileges. The me2600_xilinx_download() function fails to validate firmware file length before reading data streams, enabling out-of-bounds memory access during firmware loading operations. Patches available across multiple stable kernel versions (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% (7th percentile) indicates low probability of widespread exploitation despite high CVSS 7.8 rating, and no active exploitation or public exploit code identified at time of analysis.
Out-of-bounds write in Linux kernel comedi me4000 driver firmware loader allows local authenticated users to achieve high-impact code execution, data corruption, or system crash. The me4000_xilinx_download() function blindly trusts firmware file format headers without validating buffer boundaries, reading a length field from the first 4 bytes and then reading that many bytes from offset 16 without checking total file size. Patch available across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% (7th percentile) indicates very low observed exploitation probability despite CVSS 7.8 rating. No public exploit code or active exploitation confirmed.
Double-free memory corruption in the Linux kernel reset-gpio subsystem allows local authenticated users to escalate privileges or crash the system. The vulnerability exists in reset_add_gpio_aux_device() error handling since commit 5fc4e4cf7a22, where auxiliary_device_uninit() triggers a release callback that frees memory, but the error path then calls kfree() on the same pointer. Patches available for kernel versions 6.19.12+ and 7.0+. EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation. Not listed in CISA KEV; no public exploit identified at time of analysis.
Memory corruption in the Linux kernel zynqmp_nvmem driver allows local authenticated users to achieve privilege escalation through undersized DMA buffer exploitation. The vulnerability stems from incorrect buffer size calculations in dma_alloc_coherent and memcpy operations, enabling heap or memory corruption that can lead to complete system compromise. With a 7.8 CVSS score but only 0.02% EPSS (5th percentile), this represents a high-severity issue affecting specific Xilinx Zynq UltraScale+ deployments rather than a widespread exploitation target. Patches available across multiple stable kernel branches (6.12.81, 6.18.22, 6.19.12, 7.0) with upstream fixes confirmed in git commits.
Memory corruption in the Linux kernel virtual terminal (vt) subsystem allows local authenticated users to trigger kernel crashes and potentially escalate privileges. When a console switches to an alternate screen and then gets resized, the saved Unicode buffer retains stale dimensions. Upon returning to the primary screen, operations like screen clearing (csi_J) access memory out of bounds using current dimensions against the old buffer, causing kernel oops. EPSS exploitation probability is low (0.02%, 4th percentile), no active exploitation confirmed, but vendor patches are available across multiple stable kernel branches (5.x, 6.18.x, 6.19.x).
Missing CRYPTO_ALG_ASYNC flag in Linux kernel's Tegra crypto driver causes the crypto API to incorrectly select asynchronous algorithms for synchronous-only requests, resulting in system crashes. This affects Tegra-based Linux systems (typically NVIDIA Jetson devices) running kernel versions 6.10 through early 7.0 development branches. Vendor patches are available across stable branches (6.12.81, 6.18.22, 6.19.12, 7.0). EPSS score of 0.02% (5th percentile) indicates minimal observed exploitation probability, and no active exploitation or public POC has been identified. The CVSS vector (AV:N/AC:L/PR:L/UI:N) suggests network-based exploitation requiring authenticated access, though this conflicts with the technical nature of a local driver configuration bug.
Linux kernel IOMMU page table unmapping operations fail to invalidate extended memory regions when unmapping lands mid-entry in large/contiguous mappings, causing stale TLB entries. Affects kernel 6.19 through pre-7.0 versions with IOMMU subsystem enabled. Local authenticated attackers with low privileges can potentially access unmapped memory or escalate privileges by exploiting incomplete invalidations during IOMMU unmap operations. EPSS score of 0.02% (5th percentile) suggests minimal real-world exploitation likelihood. No public exploit identified at time of analysis, though vendor acknowledges theoretical risk is low as 'nothing relies on unmapping a large entry.' Vendor-released patches available for stable branches.
Use-after-free in Linux kernel thermal subsystem allows local attackers with low privileges to execute arbitrary code, escalate privileges, or crash the system. The vulnerability stems from race conditions between thermal zone removal and power management resume operations, where delayed work items can continue executing after thermal zone objects are freed. EPSS score of 0.02% (5th percentile) suggests low probability of mass exploitation despite high CVSS severity. Vendor patches available across multiple stable kernel branches (6.12.83, 6.18.22, 6.19.12, 7.0) via upstream commits. No active exploitation confirmed in CISA KEV at time of analysis.
Double-free memory corruption in the Linux kernel's fastrpc driver allows local attackers with low privileges to achieve high-impact code execution, privilege escalation, or denial of service. The vulnerability occurs when fastrpc_init_create_static_process() fails to nullify a freed heap pointer (cctx->remote_heap) in its error path, enabling fastrpc_rpmsg_remove() to free the same memory twice during device removal. Patches available across kernel versions 6.6.134, 6.12.81, 6.18.22, 6.19.12, and mainline 7.0. EPSS score of 0.02% indicates low observed exploitation probability, with no active exploitation confirmed at time of analysis.
Out-of-bounds array access in Linux kernel UCSI (USB Type-C Connector System Software Interface) driver allows local authenticated attackers to achieve arbitrary code execution or system crash. A malicious USB-C device or compromised firmware can send a crafted CCI (Connector Change Indicator) message with an invalid connector number (0-127) that exceeds the allocated connector array bounds (typically 2-4 entries), triggering memory corruption in ucsi_connector_change(). Vendor patches available for kernel 6.12.81, 6.18.22, 6.19.12, and mainline 7.0. EPSS score of 0.02% (5th percentile) indicates very low observed exploitation probability, and no active exploitation or public POC currently identified.
Local privilege escalation via stack out-of-bounds write affects the f_uac1_legacy USB Audio Class 1.0 gadget driver in the Linux kernel, where f_audio_complete() memcpy's a host-controlled req->length into a fixed 4-byte stack variable without validation. A device operating in USB gadget/peripheral mode can be driven by a malicious or crafted USB host to corrupt kernel stack memory, yielding CVSS 7.8 (High) with full confidentiality, integrity and availability impact. No public exploit is identified at time of analysis and EPSS is negligible (0.02%), but the flaw is upstream-patched across many stable trees.
Uninitialized variable use in Linux kernel CIFS replay logic allows local authenticated attackers to potentially access sensitive kernel memory, corrupt data, or trigger denial of service. The vulnerability exists in CIFS request replay code paths where certain local variables lack proper reinitialization after replay labels, potentially causing undefined behavior during SMB session recovery operations. Patches available for kernel versions 6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0. EPSS score of 0.02% indicates minimal observed exploitation activity, consistent with the local access requirement and specialized triggering conditions.
Double-free vulnerability in Linux kernel Xen privcmd driver allows local authenticated attackers to corrupt memory and potentially execute arbitrary code or cause denial of service. When userspace performs partial munmap() on privcmd mappings, VMA splitting creates duplicate pointers to the same memory pages array, leading to kvfree() being called twice on the same allocation during VMA cleanup. Xen Security Advisory XSA-487 confirms this issue affects virtualization hosts running Xen paravirtualized domains. No public exploit identified at time of analysis, with EPSS score of 0.03% indicating low predicted exploitation probability. Vendor-released patches available for stable kernel versions 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.26, and 7.0.3.
Buffer overflow in Linux kernel Xen hypervisor interface allows local authenticated users to achieve arbitrary code execution with high privilege escalation impact. The vulnerability stems from improper handling of non-NUL-terminated build ID data from HYPERVISOR_xen_version(XENVER_build_id) in drivers/xen/sys-hypervisor.c, where sprintf reads past buffer boundaries seeking a NUL terminator. Affects Linux kernel versions from 5.10 through 7.0 series when running as Xen domain. Vendor-released patches available across all affected stable branches (5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.26, 7.0.3). EPSS score of 0.08% (23rd percentile) indicates low probability of mass exploitation despite high CVSS 7.8, reflecting specialized Xen-only attack surface. No public exploit identified at time of analysis.
Buffer overflow in TH1520 AON firmware protocol driver allows local authenticated attackers with low privileges to execute arbitrary code and gain elevated system access. The vulnerability stems from unsafe pointer arithmetic when accessing the 'mode' field through the 'resource' pointer with unchecked offsets in the T-HEAD firmware driver. Patches available across stable kernel branches (6.18.23, 6.19.13, 7.0) with low EPSS score (0.02%) indicating minimal observed exploitation attempts, though CVSS 7.8 reflects high impact if exploited on affected T-HEAD TH1520 systems.
Use-after-free in Linux kernel driver core allows local authenticated users to execute arbitrary code, escalate privileges, or crash the system via race condition in device-driver binding operations. The vulnerability stems from inconsistent locking in driver_match_device() function calls, specifically affecting driver_override functionality where device_lock was not held during bind_store() and __driver_attach() operations. EPSS probability is very low (0.02%, 5th percentile), indicating minimal real-world exploitation observed. No active exploitation confirmed - no CISA KEV listing identified. Patch available in kernel 7.0+ and backport commit dc23806a7c47.
Double-free memory corruption in the Linux kernel's KASAN shadow-teardown path (mm/kasan) affects kernels built with KASAN on architectures where page-table pages are not struct-page aligned - notably PowerPC with 64K page size, where the PUD table is allocated from the pgtable-2^9 slab cache. When device-managed memory is unmapped (e.g. unbinding a PMEM/nvdimm device via ndctl), kasan_remove_zero_shadow() frees the same slab object twice, corrupting the slab allocator. This is a local, KASAN-build-only defect with no public exploit identified at time of analysis; EPSS is negligible (0.02%) and it is not in CISA KEV.
Out-of-bounds memory access in the Linux kernel's netfilter ip6t_eui64 IPv6 match module allows a malformed Ethernet/MAC header to reach eth_hdr(skb) before validation, leading to information disclosure or a kernel crash. The prior guard in eui64_mt6() only rejected an invalid MAC header when par->fragoff != 0, so non-fragmented packets (fragoff == 0) with an invalid MAC header could still be dereferenced. Exploitation requires an administrator to have configured an ip6tables rule using the eui64 match; no public exploit identified at time of analysis and EPSS is very low (0.02%).
Local privilege escalation and memory corruption in the Linux kernel's batman-adv mesh networking module allows a low-privileged attacker to trigger an skb_put buffer overflow by exploiting a race in OGM (Originator Message) aggregation. When aggregation is toggled at runtime, a forwarded packet allocated with only packet_len bytes can later be selected for aggregation, causing an append past the socket buffer's tailroom. CVSS 7.8 (High); EPSS is very low at 0.02% (7th percentile) and there is no public exploit identified at time of analysis and no CISA KEV listing.
Out-of-bounds read in the Linux kernel's bridge neighbour-discovery proxy (br_nd_send) allows remote attackers to leak adjacent kernel memory or crash the host by sending crafted IPv6 Neighbor Solicitation packets whose ND option area lies in the non-linear (paged/fragmented) part of the socket buffer. The function parses ns->opt[] assuming options reside in the skb's linear region, but callers only guarantee the ICMPv6 header and target address are linear, so parsing reads past the linear buffer. EPSS is very low (0.03%, 8th percentile) and there is no public exploit identified at time of analysis, but the fix is shipping across all maintained stable trees and downstream vendors (Ubuntu USN-8490-1, Siemens).
Use-after-free in the Linux kernel IPv6 flowlabel subsystem lets a local user crash the system by racing a read of /proc/net/ip6_flowlabel against the early free of an exclusive flowlabel's option block. When fl_release() drops fl->users to zero it immediately kfree()s fl->opt, while the enclosing struct ip6_flowlabel stays visible in the global hash until later RCU garbage collection, so a concurrent ip6fl_seq_show() reader dereferences freed memory. There is no public exploit identified at time of analysis, and EPSS is 0.02% (7th percentile), consistent with a low-value local denial-of-service bug rather than a widely exploited flaw.
Kernel memory disclosure and denial of service in the Linux kernel's openvswitch (OVS) datapath arises because validate_set() accepted OVS_KEY_ATTR_MPLS as a variable-length payload for SET/SET_MASKED actions while the action handler expects the fixed-size struct ovs_key_mpls. A local low-privileged actor able to install OVS flow actions can supply an undersized or oversized MPLS key to trigger an out-of-bounds read (rated C:H, I:N, A:H), leaking adjacent kernel memory or crashing the datapath. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile), consistent with a niche, privilege-gated networking bug rather than a mass-exploitation candidate.
Local privilege escalation via a use-after-free race in the Linux kernel's Open vSwitch (openvswitch) module allows a local user with network-configuration capability to corrupt kernel memory. The flaw lives in ovs_netdev_tunnel_destroy(), which drops the tunnel netdev reference during teardown; when this runs after NETDEV_UNREGISTER has already detached the device, it races concurrent RCU readers that still observe vport->dev, producing a premature reference drop and stale-pointer access. The fix defers the netdev_put to the RCU release callback (vport_netdev_free), matching the non-tunnel path. There is no public exploit identified at time of analysis, and EPSS is negligible (0.02%, 7th percentile).
Denial of service in the Linux kernel's rxrpc (AF_RXRPC) subsystem allows remote attackers to disrupt service-side RxRPC connections by sending duplicate or late RESPONSE packets that re-run the connection setup path. The flaw stems from an unlocked, post-transition state test that permitted RESPONSE processing outside the RXRPC_CONN_SERVICE_CHALLENGING window; the fix gates processing on that state under state_lock. No public exploit has been identified and EPSS probability is very low (0.02%), but any kernel exposing an rxrpc service (e.g., kafs/AFS) is potentially reachable over the network without authentication.
Out-of-bounds kernel memory access in the Linux kernel's network emulation scheduler (sch_netem) allows a local, privileged user to corrupt kernel memory and likely panic the system. When a netem qdisc has packet corruption enabled and an AF_PACKET TX_RING transmits fully non-linear packets over an IPIP tunnel, skb_headlen(skb) is 0, causing get_random_u32_below(0) to return an unconstrained 32-bit offset that indexes past the linear skb->data area. There is no public exploit identified at time of analysis, EPSS risk is very low (0.02%), and it is not on CISA KEV; it is a locally-triggerable memory-safety bug rather than a remotely exploitable one.
Out-of-bounds kernel memory access in the Linux kernel's IPv6 netfilter ip6t_rt (Routing Header) match module allows a local user holding CAP_NET_ADMIN to install a crafted ip6tables rule whose addrnr field exceeds IP6T_RT_HOPS, causing rt_mt6() to read past the bounds of rtinfo->addrs[]. This can leak adjacent kernel memory (information disclosure) or crash the system (denial of service). No public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.02%, 7th percentile).
Kernel memory disclosure in the Linux kernel's AF_UNIX subsystem allows a local, low-privileged user to read stale or freed VFS data via the UNIX_DIAG_VFS netlink attribute. The sock_diag handler read a UNIX socket's u->path inode and device numbers without holding unix_state_lock, racing against unix_release_sock() which clears u->path under that lock before dropping the path reference. The fix reads the inode/device under unix_state_lock and emits the netlink attribute after unlocking; no public exploit identified at time of analysis and EPSS is negligible (0.02%).
Integer overflow in OP-TEE OS RSA signature encoding crashes the Trusted Execution Environment on platforms with RSA hardware acceleration. Affects versions 3.8.0 through 4.10 when attackers supply cryptographic operations with deliberately undersized RSA moduli, causing memset() to overwrite memory until the TEE crashes. This denial-of-service attack requires no authentication and can be triggered remotely (CVSS AV:N/PR:N), completely disabling the secure-world environment that protects cryptographic keys, biometric data, and DRM operations on affected Arm TrustZone systems. EPSS data not available; no active exploitation confirmed at time of analysis.
Kernel memory corruption in Linux's MPTCP subsystem allows a use-after-free in __inet_lookup_established affecting IPv6 subflow sockets. Because mptcp_subflow_init() copied tcpv6_prot before inet6_init() had registered its slab cache, MPTCP IPv6 child sockets were allocated from kmalloc-4k without the SLAB_TYPESAFE_BY_RCU guarantee, so lockless RCU ehash lookups could dereference freed socket memory. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%), but the flaw is remotely reachable via network traffic on hosts using MPTCP over IPv6.
Routing policy bypass in the Linux kernel's IPv6 Segment Routing (SRv6) seg6 lwtunnel implementation allows post-encapsulation SID lookups to be resolved from a stale, shared destination cache. Kernels from 4.10 onward that deploy seg6 encap routes shared a single dst_cache between seg6_input_core() and seg6_output_core(); whichever path executed first populated the cache and the other reused it blindly, bypassing its own routing lookup (e.g. ip rules matching the ingress interface or VRF table separation). Despite an NVD-assigned CVSS of 9.8 and a 'Authentication Bypass' tag, this is a routing-correctness/isolation defect rather than memory corruption or code execution; there is no public exploit identified at time of analysis and EPSS is negligible (0.02%, 7th percentile).
Improper lock ordering in the Linux kernel's uinput driver interacting with the force-feedback (ff-core) subsystem creates a circular locking dependency (ff->mutex → udev->mutex → input_mutex → dev->mutex → ff->mutex) that lockdep flags and that can deadlock kernel threads. It is reproducibly triggered by a local user exercising a force-feedback device through uinput - for example a Flydigi Vader 5 gamepad under Wine/Proton - and is fixed by replacing a mutex acquisition in uinput_request_send() with a leaf spinlock. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and the issue is not on CISA KEV; despite the 7.8 CVSS this is a reliability/locking correctness fix rather than a memory-corruption bug.
Local privilege-level extent tree corruption in the Linux kernel's Btrfs filesystem (versions 6.10 through the 6.18/6.19/7.0 development lines) arises because lookup_extent_data_ref() returns 0 (success) instead of -ENOENT after crossing to a new leaf whose first key does not match, causing callers to operate on the wrong extent tree item. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%), indicating negligible likelihood of opportunistic exploitation; this is a reliability/data-integrity defect rather than a remotely reachable RCE. CVSS 7.8 (AV:L/PR:L) reflects local access requirements, not network exposure.
Local privilege escalation and memory corruption in the Linux kernel's netfilter nf_tables conntrack (nft_ct) subsystem allows a local user with network-admin capability to trigger a use-after-free by destroying a conntrack timeout object while packets on other CPUs still reference it. The flaw stems from nft_ct_timeout_obj_destroy() calling kfree() immediately after nf_ct_untimeout() without waiting for an RCU grace period, leaving a dangling RCU-protected pointer read during nf_conntrack_tcp_packet(). No public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile), but a KASAN reproducer ('exploit' task) is described in the commit and the bug is a classic exploitable CWE-416 heap UAF.
Use-after-free race condition in the Linux kernel's IPsec (xfrm) transport-mode input path allows a local attacker to corrupt kernel memory and potentially escalate privileges. In xfrm_input_resume(), the network device reference (skb->dev) is dropped via dev_put() immediately on async-crypto re-entry, yet the pointer is still dereferenced inside NF_HOOK and its okfn, creating a window that races with device teardown. No public exploit identified at time of analysis, and EPSS probability is negligible (0.02%), consistent with a difficult-to-trigger race rather than a mass-exploited flaw.
Denial of service in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem allows a duplicate or stale GRP_ACK_MSG to underflow the u16 bc_ackers counter to 65535, permanently wedging group broadcast on the affected socket until the TIPC group is torn down and recreated. The flaw affects the tipc_group_proto_rcv() handler across a wide range of kernel branches (4.15 through the 7.0 series). It is a pure availability issue (CVSS A:H, C:N/I:N); there is no public exploit identified at time of analysis and EPSS probability is negligible (0.02%).
Heap out-of-bounds write in the Linux kernel's batman-adv mesh routing subsystem lets a remote mesh originator corrupt kernel memory by advertising an oversized global translation table (TT). In batadv_tt_prepare_tvlv_global_data(), the allocation length is computed in 16-bit temporaries, so a large TT payload plus the VLAN header offset wraps past 65535 before kmalloc(), producing an undersized buffer that the full-table response path then overruns using the original (unwrapped) length. It is fixed across multiple stable kernel branches; there is no public exploit identified at time of analysis and EPSS is negligible (0.02%).
Use-after-free in Linux kernel batman-adv (B.A.T.M.A.N. Advanced mesh networking) allows remote network attackers to trigger memory corruption and potentially execute arbitrary code. The batadv_bla_add_claim() function can prematurely drop a gateway reference while readers still access the pointer, causing netlink dump and claim-check paths to dereference freed memory. Despite CVSS 9.8 critical rating, exploitation probability is low (EPSS 2%, 7th percentile), no active exploitation confirmed, and patches available across kernel stable branches 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, and mainline 7.0.
Local privilege escalation in the Linux kernel's i915 graphics driver allows authenticated users to trigger a use-after-free condition via a race between the heartbeat worker and intel_engine_park_heartbeat() function when releasing engine heartbeat requests. The vulnerability stems from a non-atomic pointer read-and-clear operation that permits double-free of the same request object, causing refcount underflow and potential arbitrary code execution with elevated privileges. Patches are available across multiple stable kernel branches (5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, 7.0). EPSS exploitation probability is low (0.02%, 7th percentile), and no public exploit or active exploitation has been identified at time of analysis.
Memory leak (with latent use-after-free risk) in the Linux kernel's DAMON monitoring subsystem (mm/damon/stat) allows a local, privileged user to leak damon_ctx objects and potentially trigger use-after-free by repeatedly toggling the DAMON_STAT 'enabled' control after a damon_call() failure. Affected are kernels on the 6.17-6.19 line prior to the stable fixes; the flaw is classified CWE-416 (Use After Free). There is no public exploit identified at time of analysis, and EPSS is negligible (0.02%, 4th percentile).
Local privilege-escalation potential via a use-after-free in the Linux kernel's vub300 MMC host-controller driver (drivers/mmc/host/vub300.c), affecting kernels built with CONFIG_MMC_VUB300 through 6.17 and stable branches prior to 6.18.23/6.19.13. Because the controller structure was allocated with device-managed (devm) memory while the driver keeps its own explicit reference count, the last reference can outlive driver unbind, letting the kernel dereference freed memory on disconnect or probe deferral. No public exploit identified at time of analysis, and EPSS is negligible (0.02%), consistent with the requirement that the uncommon vub300 USB-to-SDIO hardware be physically present.
Integer underflow in Linux kernel stmmac network driver allows kernel memory disclosure and potential corruption via crafted network packets. The flaw occurs in chain mode jumbo frame handling when packets have small linear data but large total length from page fragments, causing buffer offset calculations to wrap to ~0xFFFFxxxx. This triggers massive loop iterations that DMA-map arbitrary kernel memory to the network hardware. On typical stmmac deployments (IOMMU-less embedded SoCs), attackers can remotely read kernel memory contents and potentially corrupt memory through hardware DMA operations. EPSS exploitation probability is low (0.02%) with no confirmed active exploitation, but CVSS 9.8 reflects the theoretical remote unauthenticated attack surface. Vendor patches available across all supported stable kernel branches (5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, 7.0).
Race condition in Linux kernel memory management allows local attackers with low privileges to corrupt kernel page state, potentially achieving high-impact denial of service, data corruption, or privilege escalation. The vulnerability affects kernel versions 6.6.x through 7.0-rc3, with patches confirmed released for stable branches 6.6.135, 6.12.82, 6.18.23, 6.19.13, and mainline 7.0. EPSS exploitation probability is low (0.02%, 5th percentile), and no public exploit code or active exploitation has been identified at time of analysis. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates local access with low attack complexity, while the specific race condition requires precise timing between file mapping and inode size modification operations.
Use-after-free in Linux kernel's lan966x network driver allows local authenticated attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The flaw occurs in lan966x_fdma_reload() when RX buffer allocation fails - freed pages remain referenced by active DMA descriptors, causing hardware to write into memory now controlled by other kernel subsystems. Vendor patches available for stable branches 6.12.82, 6.18.23, 6.19.13, and mainline 7.0. EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation. No CISA KEV listing or public exploit identified at time of analysis, but successful exploitation grants kernel-level privileges to local attackers.
Heap buffer overflow in Linux kernel rxrpc subsystem allows local authenticated users to trigger memory corruption via crafted RxGK tokens. Exploitable through unprivileged add_key() system call when raw key/ticket lengths >= 0xfffffffd cause integer wraparound in round_up(), bypassing bounds checks while memcpy() copies up to 4 GiB into zero-sized heap allocation. Vendor patches available for stable branches 6.18.23, 6.19.13, and mainline 7.0. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability despite local privilege escalation potential with CVSS 7.8.
Linux kernel rxrpc subsystem allows remote denial of service via malformed RESP challenge packets due to incorrect serial number comparison logic. The rxrpc_post_response() function compares challenge serial numbers from the wrong packet structure, causing response queue corruption that can crash the kernel networking stack. This affects Linux kernel versions containing commit 5800b1cf3fd8 through the 6.16-6.19 and 7.0 series. Patches are available from kernel.org for affected stable branches. EPSS exploitation probability is very low (0.02%, 4th percentile) and no public exploits or active exploitation have been identified, suggesting limited real-world risk despite the network-accessible attack vector.
Null pointer dereference in Linux kernel rxrpc subsystem allows remote network attackers to crash the system by sending malformed packets to a client-side connection after a call has been torn down. The flaw affects Linux kernel versions 6.2 onward where the rxrpc client code unconditionally releases a call reference that was never acquired, converting a protocol error into a kernel panic. Vendor patches are available across stable branches (6.6.135, 6.12.82, 6.18.23, 6.19.13, 7.0). EPSS exploitation probability is low (0.02%, 5th percentile) and no public exploit has been identified at time of analysis.
Unauthenticated remote attackers can exploit a cryptographic validation bypass in the Linux kernel's RxRPC rxkad authentication handler to potentially execute arbitrary code or cause denial of service. The rxkad_decrypt_ticket() function fails to verify that RXKAD response ticket decryption succeeded before parsing the buffer contents, allowing malformed RESPONSE packets with non-block-aligned ticket lengths to drive the ticket parser with attacker-controlled ciphertext bytes. Despite the critical 9.8 CVSS score indicating network-exploitable attack with high impact across confidentiality, integrity, and availability, EPSS exploitation probability is low (0.02%, 5th percentile) and no active exploitation or public POC has been identified. Patches are available across multiple stable kernel versions (6.6.135, 6.12.82, 6.18.23, 6.19.13, 7.0).
Out-of-bounds read in Linux kernel's rxrpc rxgk authentication handler allows remote unauthenticated attackers to trigger information disclosure and denial of service via malformed RESPONSE authenticator packets. The vulnerability stems from incorrect pointer arithmetic in rxgk_verify_authenticator() that inflates the parser boundary check by a factor of four, allowing reads beyond kmalloc() buffer boundaries. Vendor patches available for kernel versions 6.18.23, 6.19.13, and 7.0. EPSS score of 0.02% (4th percentile) suggests low observed exploitation probability despite network attack vector, though KASAN reports confirm reproducibility.
Remote denial of service in Linux kernel rxrpc subsystem allows unauthenticated network attackers to trigger kernel crash via malformed rxgk RESPONSE packets. An inverted length check in rxgk_verify_response() accepts oversized authenticators, causing skb_to_sgvec() to hit BUG_ON() and panic the kernel. EPSS exploitation probability is very low (0.02%, 4th percentile), no active exploitation confirmed, and patches are available across stable kernel branches 6.18.23, 6.19.13, and 7.0.
Integer overflow in Linux kernel's rxrpc rxgk_verify_response() function allows remote unauthenticated attackers to bypass length validation checks and potentially achieve arbitrary code execution. The vulnerability exists in the rxrpc protocol implementation where token_len rounding occurs before validation, enabling buffer overflow conditions. With CVSS 9.8 (critical severity) and network attack vector requiring no authentication, this represents a significant exposure despite low EPSS score (0.02%, 4th percentile), suggesting limited real-world exploitation observed to date. Vendor patches are available across multiple stable kernel versions (6.18.23, 6.19.13, 7.0).
Buffer overread in Linux kernel's rxgk_do_verify_authenticator() function allows remote unauthenticated attackers to trigger information disclosure and high-availability denial of service through network-accessible RxGK authentication handling. The vulnerability stems from improper buffer size validation before nonce verification in the RxRPC subsystem. Patches are available from the Linux kernel stable tree (versions 6.19.13, 6.18.23, and 7.0). EPSS score of 0.02% (4th percentile) indicates very low observed exploitation probability, and no active exploitation or public POC has been identified. Despite the high CVSS base score of 8.2, real-world risk appears limited to environments using RxRPC with RxGK authentication.
Buffer overflow in Linux kernel's AF_RXRPC procfs address formatting allows local authenticated users to corrupt memory and potentially escalate privileges. The vulnerability affects rxrpc proc handlers that write IPv6 socket addresses into 50-byte stack buffers, but ISATAP-format IPv6 addresses with ports can require 51 bytes, causing single-byte overflow. EPSS exploitation probability is low (0.02%, 4th percentile), and patches are available from kernel.org for versions 6.18.23, 6.19.13, and mainline 7.0. No active exploitation confirmed (not in CISA KEV), and CVSS 7.8 reflects local-only attack vector requiring authenticated access.
Use-after-free in Linux kernel NFC LLCP implementation allows adjacent-network attackers to execute arbitrary code with kernel privileges. The flaw occurs when socket state is LLCP_CLOSED in nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), where missing return statements cause double release_sock() and refcount underflow, leading to memory corruption. Vendor-released patches available for stable kernels 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability, and no active exploitation or public POC confirmed at time of analysis.
Buffer overflow in Linux kernel's s3c24xx I2C driver allows local authenticated attackers to achieve arbitrary code execution with high privileges through malformed SMBUS block read messages. The driver fails to validate message length against I2C_SMBUS_BLOCK_MAX before processing, enabling out-of-bounds memory access. Vendor patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% suggests low observed exploitation activity, with no CISA KEV listing indicating targeted rather than widespread attacks. Attack requires local access and low-level user privileges (CVSS AV:L/PR:L), limiting practical exploitability compared to the high CVSS 7.8 base score.
Uninitialized memory read in Linux kernel's rtl8723bs Wi-Fi driver allows adjacent network attackers to cause denial of service or potentially corrupt integrity through malformed BIP (Broadcast/Multicast Integrity Protocol) frames. The vulnerability affects the staging rtl8723bs driver where only 6 bytes are copied into an 8-byte variable during BIP verification, leaving 2 bytes uninitialized. Patches available across multiple stable kernel versions (6.12.83, 6.18.24, 6.19.14, 7.0.1). EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability. Not listed in CISA KEV, and no public exploit identified at time of analysis.
Heap buffer overflow in Linux kernel NFC-A digital target driver allows adjacent-network attackers to corrupt memory and potentially execute code. A malicious NFC peer device can trigger unbounded cascade loops during anti-collision protocol, writing beyond the 10-byte nfcid1 buffer with each iteration. EPSS score of 0.02% (5th percentile) indicates low likelihood of mass exploitation, but the adjacent attack vector (AV:A) limits exposure to proximity-based attacks. Vendor patches available across multiple stable kernel branches (6.12.83, 6.18.24, 6.19.14, 7.0.1). No active exploitation confirmed (not in CISA KEV); no public exploit identified at time of analysis.
Out-of-bounds kernel heap read in the Linux kernel's CIFS/SMB client (check_wsl_eas() extended-attribute parser) lets a malicious or compromised SMB server leak up to 8 bytes of adjacent kernel heap into the WSL xattr name comparison, influencing which WSL extended attribute the returned data is interpreted as. The root cause is an off-by-8 bounds check (CWE-125) that measures the EA end from the struct base instead of ea->ea_data, so the trailing name and value bytes of the last EA are read past the end of the response iov. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.02%), and it is not on CISA KEV; patched kernels are already available.
Out-of-bounds heap read in Linux kernel SMB client allows malicious SMB servers to leak kernel memory to userspace via crafted symlink error responses. When processing STATUS_STOPPED_ON_SYMLINK errors in SMB 3.1.1, inadequate bounds checking in smb2_check_message() and symlink_data() allows server-controlled ErrorDataLength values to trigger reads beyond buffer boundaries. The leaked heap bytes are UTF-16-decoded into the symlink target and exposed through readlink(2) syscalls (confidentiality impact), with potential for denial-of-service through memory corruption (availability impact). CVSS 8.1 (High) requires user interaction. EPSS score is very low at 0.02% (5th percentile), indicating minimal observed exploitation activity. Patches available in kernel versions 6.18.24, 6.19.14, and 7.0.1.
Information disclosure in Linux kernel's ksmbd SMB server allows remote unauthenticated attackers to leak uninitialized heap memory via malformed SMB2 requests. The vulnerability exists in smb2_get_ea() which fails to validate EaNameLength from client requests before using it in strncmp(), enabling heap content extraction. With EPSS score of 0.02% and no KEV listing, exploitation likelihood remains low despite CVSS 7.5 rating. Patches available across kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1.
Out-of-bounds read in Linux kernel's ksmbd SMB server allows remote unauthenticated attackers to manipulate file permissions by crafting malicious ACE SIDs with insufficient sub-authorities, triggering parse_dacl() to read 4 bytes past the ACL buffer boundary and apply those arbitrary bytes as POSIX file mode bits. EPSS exploitation probability is very low (0.02%, 5th percentile) with no public exploit identified at time of analysis. Vendor-released patches available across stable kernel branches (6.12.83, 6.18.24, 6.19.14, 7.0.1).
Double-free memory corruption in the Linux kernel SMB client (smbd) allows remote unauthenticated attackers to achieve arbitrary code execution, confidentiality breach, and denial of service. The vulnerability occurs when smbd_free_send_io() is erroneously called twice after smbd_send_batch_flush() operations, creating use-after-free conditions. Exploitation probability is low (EPSS 0.02%, 4th percentile) with no confirmed active exploitation or public POC, but the critical CVSS 9.8 score reflects the severe potential impact if network-accessible SMB client operations are triggered. Vendor patches available for kernel versions 6.18.24, 6.19.14, and 7.0.1.
A double-free vulnerability in the Linux kernel's SMB Direct (RDMA transport) server implementation allows remote unauthenticated attackers to trigger memory corruption with high CVSS 9.8 severity. The flaw occurs when smb_direct_free_sendmsg() is called twice on the same memory region after smb_direct_flush_send_list() moves messages to a batch list. Vendor patches available across kernel versions 6.18.24, 6.19.14, and 7.0.1, with upstream commits confirmed in stable branches. Despite critical CVSS scoring, EPSS probability remains very low at 0.02% (4th percentile) and no active exploitation or public POC identified, suggesting limited real-world targeting of this SMB Direct RDMA feature.
Heap buffer overflow in Linux kernel USB/IP client allows malicious USB/IP servers to execute arbitrary code with kernel privileges via crafted RET_SUBMIT responses. A rogue server can specify a larger number_of_packets value than originally submitted, causing out-of-bounds writes when processing isochronous USB transfers. Patched in kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% (5th percentile) suggests low probability of widespread exploitation despite CVSS 9.8 criticality, indicating this is primarily a risk in environments using USB/IP with untrusted servers rather than a general internet-facing threat.
Memory access violation in Linux kernel ALSA ctxfi driver allows local authenticated users to trigger kernel page faults and potential privilege escalation. The flaw affects CT20K2 audio hardware drivers (snd_ctxfi module) where virtual memory mapping logic incorrectly accesses beyond allocated page table pages when aggregate memory allocations exceed 2MB on AMD64 systems. EPSS exploitation probability is very low (0.02%, 5th percentile) and no public exploit or active exploitation is confirmed. Vendor-released patches available across multiple stable kernel branches (6.12.83, 6.18.24, 6.19.14, 7.0.1).
Kernel panic in Linux arm64 memory management causes system crash when handling invalid large leaf page table mappings during DMA bounce buffer operations. ARM64 systems running Linux 7.0-rc4 and earlier (specifically kernels with commit a166563e7ec37 that introduced large block mapping support) crash with translation faults when components like SWIOTLB, secretmem, kfence, or realm DMA attempt to invalidate large leaf mappings. Exploitation requires no special privileges as this is triggered by normal kernel operations during boot or DMA activity. Vendor patches available across stable branches (6.18.24, 6.19.14, 7.0.1). EPSS score is 1st percentile (0.01%) indicating extremely low observed exploitation probability, consistent with this being an availability issue requiring specific ARM64 hardware configurations rather than a remotely exploitable vulnerability.
Kernel deadlock in Linux OCFS2 filesystem allows remote denial of service through lock ordering violation between unlink and direct I/O operations. OCFS2's orphan directory locking in ocfs2_unlink and ocfs2_dio_end_io_write acquire ip_alloc_sem and inode_lock in opposite orders (ABBA pattern), enabling concurrent operations to deadlock the system. Affects mainline Linux kernel through 6.19.14 with patches available in 6.12.83, 6.18.24, 7.0.1, and 6.19.14. EPSS score of 0.02% suggests minimal real-world exploitation likelihood despite CVSS 7.5 score, and no active exploitation or public POC identified.
Use-after-free in Linux kernel OCFS2 filesystem enables local attackers with low privileges to achieve arbitrary code execution, privilege escalation, or denial of service. The vulnerability occurs when filemap_fault() drops mmap_lock before returning VM_FAULT_RETRY, allowing concurrent munmap() to free the vm_area_struct while ocfs2_fault() still holds a dangling pointer. Vendor patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS exploitation probability is very low (0.02%, 5th percentile) with no public exploit identified at time of analysis.
Use-after-free in Linux kernel memory management allows remote code execution when the folio_unmap_invalidate() function incorrectly accesses freed mapping structures. Kernel versions between 1da177e4c3f4 and patches 6.19.14/7.0.1 are affected. Exploitation probability is low (EPSS 2%, percentile 5%), with no confirmed active exploitation or public POC at time of analysis. Despite the critical CVSS 9.8 score indicating network-based unauthenticated attack, the description suggests this is a kernel memory corruption bug requiring local kernel code paths to trigger, not direct remote network exploitation - CVSS vector conflicts with technical nature and should be validated against vendor guidance.
Use-after-free in Linux kernel KVM x86 MMIO emulation allows local authenticated users with low privileges to potentially execute arbitrary code, escalate privileges, or cause denial of service. The flaw occurs when KVM's emulator initiates MMIO writes using on-stack variables that cross page boundaries between two MMIO pages, creating dangling pointers when fragments are processed across separate KVM_RUN calls, especially when different tasks handle subsequent runs. EPSS exploitation probability is very low (0.02%, 5th percentile), and vendor patches are available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. No active exploitation or public POC identified at time of analysis.
Use-after-free in Linux kernel q6apm audio driver allows local authenticated attackers with low privileges to achieve arbitrary code execution, denial of service, or information disclosure with high impact to confidentiality, integrity, and availability. The flaw affects Qualcomm ASoC q6apm component registration code used in devices like Lenovo 21N2ZC5PUS laptops. Vendor-released patches are available across multiple kernel version branches (6.12.83, 6.18.24, 6.19.14, 7.0.1). EPSS score of 0.02% (5th percentile) indicates low probability of mass exploitation despite high CVSS 7.8, with no confirmed active exploitation or public POC identified at time of analysis.
Use-after-free in Linux kernel blk-cgroup subsystem allows local authenticated users to potentially execute arbitrary code, escalate privileges, or crash the system. The vulnerability occurs in cgwb_release_workfn() when releasing cgroup writeback structures, where a CSS reference is dropped before subsequent dereference, creating a race condition. Meta reports sporadic crashes in production across multiple kernel versions. Patches available for stable branches 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% suggests low widespread exploitation probability, and no active exploitation or public POC identified at time of analysis.
Use-after-free in Linux kernel MediaTek video encoder allows local authenticated users to corrupt memory and potentially execute arbitrary code. The flaw affects the vcodec driver's encoder release path where ctx memory is freed before canceling scheduled workqueue tasks, enabling race conditions between cleanup and worker threads that may dereference freed memory. KASAN-confirmed exploitation requires local access with low privileges (CVSS AV:L/PR:L). Patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% (5th percentile) indicates very low probability of automated exploitation, with no public exploit identified at time of analysis.
Local privilege escalation and denial of service in the Linux kernel's em28xx USB media driver arises from a use-after-free (CWE-416) in em28xx_v4l2_open(), which reads dev->v4l2 without holding dev->lock. A local attacker who can open the V4L2 device node during a race with the driver's init error path or teardown can trigger a use-after-free on the embedded video_device (via v4l2_fh_init accessing vdev->ctrl_handler) or a NULL dereference in em28xx_resolution_set(). No public exploit identified at time of analysis, and EPSS is very low (0.02%), consistent with a hard-to-win kernel race requiring physical/local USB device presence.
Local privilege-relevant memory corruption in the Linux kernel's powerz hwmon driver (ChargerLAB POWER-Z USB power monitor) allows a local user to trigger a use-after-free by racing a sysfs read against USB device disconnect, dereferencing a freed URB pointer. The bug affects kernels prior to the stable fixes (7.0.1, 6.19.14, 6.18.24, 6.12.83) and carries CVSS 7.8, but with EPSS at just 0.02% (5th percentile) and no public exploit identified at time of analysis, real-world exploitation risk is low. It is not listed in CISA KEV.
Local privilege escalation via a use-after-free in the Linux kernel's ALSA driver for the TerraTec DMX 6Fire USB audio interface (sound/usb/6fire) lets a local attacker corrupt freed slab memory when the device is disconnected. The flaw is a CVSS 7.8 (CVSS:3.1 AV:L/PR:L) memory-corruption bug with publicly available proof-of-concept code, though EPSS is negligible (0.02%) and it is not on CISA KEV. usb6fire_chip_abort() writes chip->card = NULL after snd_card_free_when_closed() may have already freed the card-owned chip struct, giving an attacker a window to hijack freed kernel memory.
Local privilege escalation and denial of service in the Linux kernel's bcache subsystem stems from a use-after-free of the cached_dev.sb_bio structure; if a cached backing device is stopped while a superblock write is in flight, the freed bio is dereferenced at I/O completion (endio), corrupting kernel memory. Affected systems are those running bcache-backed block devices (observed crashing via librbd/libceph rbd workloads), where a local user with the ability to trigger device teardown during superblock activity can crash the host or potentially corrupt kernel memory. This carries no public exploit identified at time of analysis and an EPSS of just 0.02%, consistent with a hard-to-time race rather than a readily weaponized flaw.
Use-after-free and double-free in the Linux kernel's as102 DVB-T USB media driver (drivers/media/usb/as102) allows a local user to corrupt kernel memory by racing an open() of the device node against an error path in as102_usb_probe(). Because the probe error path frees the as102_dev_t structure immediately after usb_register_dev()/usb_deregister_dev() while a userspace file descriptor may still hold a reference, the later .release() path re-accesses and re-frees that structure. CVSS is 7.8 (local, low-privilege); EPSS is negligible (0.02%), no public exploit is identified, and it is not in CISA KEV.
Local privilege escalation and kernel memory corruption in the Linux kernel's HackRF Software-Defined Radio media (V4L2) driver arises from a use-after-free and double-free in the hackrf_probe() error path. When probe fails after v4l2_device_register() has already exposed the device node, the driver frees the hackrf_dev structure directly with kfree() while an already-open file descriptor still holds a reference, so subsequent ioctl() or close() calls dereference and re-free freed memory. There is no public exploit identified at time of analysis; EPSS is 0.02% (5th percentile) and it is not listed in CISA KEV.
Out-of-bounds heap write in Linux kernel CAN gateway CRC8 checksum processing allows adjacent network attackers to corrupt kernel memory and potentially achieve code execution. The cgw_csum_crc8_rel() function in the CAN gateway subsystem uses raw negative index values instead of bounds-checked variables when accessing canfd_frame data, enabling writes up to 56 bytes before the heap object. Exploitation requires CAP_NET_ADMIN capability to configure CAN gateway CRC8 checksums. EPSS exploitation probability is very low (0.02%, 7th percentile) and no active exploitation has been reported. Vendor patches available across multiple kernel versions (5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, 7.0).