Linux
Monthly
Kernel memory corruption path in Linux's tunnel metadata subsystem (`tun_dst_unclone`) triggers a FORTIFY_SOURCE memcpy overflow warning when the kernel is built with clang, due to the `__counted_by` annotation on a flexible array member being evaluated as zero at copy time. Systems using GENEVE tunneling on clang-built kernels with source fortification enabled may experience kernel availability disruption if the warning escalates to a panic. No public exploit has been identified; EPSS of 0.17% at the 7th percentile reflects low exploitation probability, and the vulnerability is not listed in CISA KEV.
NULL pointer dereference in the Linux kernel's EMAC (Ethernet MAC) network driver during device probe can crash the kernel, resulting in complete system availability loss on affected hardware. The fault lies in `emac_probe()` where `devm_request_irq()` is called before `dev->emacp` is mapped via `devm_platform_ioremap_resource()`, leaving a race window during initialization in which any hardware interrupt invoking `emac_irq()` will dereference a NULL pointer and trigger a kernel panic. No public exploit code exists and the vulnerability is absent from CISA KEV; patches have been released across multiple Linux stable branches.
Use-after-free in the Linux kernel's veth driver XDP error path allows a local attacker with network interface configuration privileges to corrupt kernel memory, potentially achieving privilege escalation. The flaw stems from an off-by-one error in the rollback loop during XDP enablement: when xdp_rxq_info_reg() or xdp_rxq_info_reg_mem_model() fails, the loop skips netif_napi_del() for the failing queue index, leaving a dangling napi_struct in the device's napi_list. On subsequent device teardown, the freed - and potentially reallocated - queue memory is traversed via the stale NAPI list, resulting in UAF with full C/I/A impact. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS is 0.17% (7th percentile), reflecting low current exploitation probability.
Metadata corruption in the Linux kernel's lightweight tunnel (LWT) subsystem affects forwarded packets that carry XDP/TC skb metadata when they pass through LWT encapsulation (seg6, rpl, ila, mpls, ioam6, or BPF LWT xmit). Because encapsulation prepends outer headers over the skb headroom where metadata lives, non-BPF encaps silently overwrite it while BPF LWT xmit triggers a skb_data_move() WARNING and clears it; the fix drops metadata at the three LWT dispatch chokepoints before handing the skb to the encap op. There is no public exploit identified at time of analysis, EPSS is low (0.15%), and the nominal CVSS 9.8 appears substantially overstated for what is fundamentally a kernel data-path robustness fix.
Out-of-bounds memory access in the Linux kernel's qede network driver (QLogic FastLinQ/QL4xxx Ethernet) occurs because the driver reads into cqe->len_list[] before validating the index, allowing a crafted or malformed completion-queue entry to trigger reads past the array bounds. The flaw affects multiple stable branches (5.15, 6.1, 6.6, 6.12, 6.17/6.18) on systems that load the qede driver, with a vendor fix that reorders the bounds check before element access. There is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile).
Use-after-free race condition in the Linux kernel's amdxdna AMD AI accelerator driver allows a local low-privileged user to trigger kernel memory corruption by racing device removal against GEM object deallocation, potentially achieving full kernel privilege escalation. The flaw is specific to deployments where force_iova mode is enabled in the amdxdna driver, limiting the real-world exposure to systems with AMD XDna-capable hardware. No CISA KEV listing and no public proof-of-concept exist; EPSS of 0.15% (5th percentile) confirms this remains a theoretical priority rather than an active exploitation concern.
Lock mode mismatch in the Linux kernel's DRM XE GPU driver allows a local low-privileged user to trigger a kernel WARN_ON assertion via the xe_vm_bind_ioctl interface on systems compiled with the debug option CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y. The vulnerability arises because xe_pt_svm_userptr_pre_commit() acquires the SVM notifier_lock for read, but the injected test path calls into drm_gpusvm_unmap_pages() expecting a write-mode hold, causing the assertion to fire and potentially destabilizing the kernel. No public exploit has been identified and an EPSS of 0.18% (7th percentile) reflects minimal real-world threat, with impact confined entirely to debug kernel builds.
Out-of-bounds read in the Linux kernel HID subsystem (hid_get_report) allows an adjacent, unauthenticated attacker to trigger a kernel panic or leak kernel memory by submitting a zero-length numbered HID report via a crafted Bluetooth or USB device. The vulnerability affects multiple stable kernel branches from 5.10.x through 7.1.x, with patches backported across all supported trees. No public exploit has been identified at time of analysis, and EPSS remains very low at 0.18% (7th percentile), indicating limited threat actor awareness thus far.
Out-of-bounds read in the Linux kernel's netfilter nf_conntrack_irc connection-tracking helper (parse_dcc) allows a one-byte stale read past the IRC DCC parse buffer, potentially producing an incorrect DCC IP or port in the resulting conntrack expectation. The flaw stems from parse_dcc() treating data_end as an inclusive pointer while its caller passes an exclusive one-past-the-end limit; the read currently cannot fault because irc_buffer is over-allocated by one byte and datalen is capped at MAX_SEARCH_SIZE. It affects only systems with the nf_conntrack_irc helper active, and there is no public exploit identified at time of analysis (not in CISA KEV; EPSS 0.18%).
Use-after-free in the Linux kernel's batman-adv mesh networking gateway module exposes systems on batman-adv mesh segments to kernel memory corruption via crafted Ethernet frames. The flaw occurs because pskb_may_pull(), called within batadv_get_vid(), can reallocate the socket buffer backing store, leaving the ethernet header pointer stale; the code then dereferences this freed pointer before the fix reassigns it. No public exploit exists and EPSS sits at 0.18% (7th percentile) with no CISA KEV listing, but kernel-level UAF carries theoretical escalation-to-privilege-or-crash potential on any system actively running batman-adv.
Use-after-free in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) distributed ARP table (DAT) code lets an attacker on the same mesh corrupt kernel memory: batadv_get_vid() calls pskb_may_pull(), which can reallocate the skb buffer, leaving the previously-cached ARP hardware-source pointer dangling and later dereferenced. The flaw affects systems running batman-adv mesh networking across numerous stable kernel branches; a vendor fix reorders the pointer acquisition to occur after the realloc. No public exploit is identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not on CISA KEV.
Out-of-bounds read in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking subsystem exposes adjacent-network attackers to kernel memory disclosure and system crash. The vulnerability exists in batadv_dat_get_vid() within the Distributed ARP Table (DAT) component, which calls batadv_get_vid() to access the proto field of an ethernet header without first verifying that the underlying data is accessible - an obligation other call sites fulfill but this path omits. A network-adjacent unauthenticated attacker can send a crafted Layer 2 frame to trigger the flaw, yielding High confidentiality impact (kernel memory disclosure) and High availability impact (kernel panic). EPSS is 0.18% (7th percentile) and the flaw is not in CISA KEV, indicating no public exploitation at time of analysis.
Out-of-bounds read in the Linux kernel's ntfs3 LZNT decompression handler allows a local attacker with low privileges to trigger kernel memory access violations by mounting a specially crafted NTFS3 filesystem image. Affected stable branches span 5.15 through 7.x, with patched releases available across all branches. No public exploit code has been identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low predicted exploitation probability despite the high CVSS score of 7.8.
The Linux kernel ims-pcu USB driver exposes sysfs device attributes on the secondary data interface in addition to the intended primary control interface, allowing local users to trigger kernel crashes or undefined behavior by accessing those attributes on the data interface, which lacks the descriptors and internal state the driver requires. Affected systems must have an IMS Passenger Control Unit USB device physically connected and run a kernel version between commit 204d18a7a0c67352857dee1bbac517ed63f01d8e and the respective fix commits. No public exploit code exists, and the EPSS score of 0.17% (6th percentile) reflects the extreme hardware rarity required for exploitation; no CISA KEV listing exists.
Out-of-bounds read in the Linux kernel's asus_atk0110 hardware monitoring driver allows a malformed ACPI GGRP firmware package to trigger kernel memory corruption. Systems running ASUS ATK0110-equipped hardware with a BIOS that returns zero-count sub-packages in its GGRP management group response are affected across a wide range of Long-Term Support and mainline kernel versions from 2.6.32 onward. Exploitation is contingent on a specific hardware/firmware defect condition rather than a direct user action, but the resulting out-of-bounds read in kernel space carries high potential impact across confidentiality, integrity, and availability. No public exploit or CISA KEV listing exists; EPSS is 0.18% (7th percentile), reflecting the niche hardware prerequisite.
Corrupted xattr entry handling in the Linux kernel's f2fs filesystem driver exposes local users to kernel memory disclosure and potential corruption. When f2fs_listxattr() processes a crafted or corrupted filesystem image containing malformed extended attribute entries that fall outside the valid xattr storage area, the kernel previously returned a partial success result without validating entry boundaries. This flaw affects a wide range of kernel stable branches from the commit introducing the bug (688078e7f36c293dae25b338ddc9e0a2790f6e06) through the backported fixes. No public exploit code exists and EPSS is 0.18% (7th percentile), indicating low exploitation probability at time of analysis.
Kernel panic vulnerability in the Linux kernel's IP fragment reassembly path allows an unprivileged user in their own user namespace to crash the host kernel by writing two specially crafted packets with GSO (Generic Segmentation Offload) metadata to a tun/tap device. The flaw exists because inet_frag_queue_insert() - shared by IPv4, IPv6, nf_conntrack_reasm, and 6lowpan reassembly - fails to strip GSO state from fragments before queuing, causing the reassembled skb to reach skb_segment() with SKB_GSO_DODGY state and trigger BUG_ON() assertions. The vulnerability is also reachable with CAP_NET_RAW in a netns where a defrag point precedes a GSO point, and from a guest VM whose VMM forwards virtio_net_hdr to a host tap; KEV status is unconfirmed and EPSS is low at 0.18% (7th percentile), though the CVE description contains a working reproducer.
Use-after-free in the Linux kernel block layer occurs when a disk whose driver probe fails before add_disk() is released: disk_release() calls blk_mq_exit_queue() without stopping the request_queue timeout timer, so the request_queue is freed while still linked in a timer-wheel bucket. NVMe reaches this path because nvme_update_ns_info() issues Report Zones or FDP io-mgmt-recv I/O on the namespace queue before the disk is added, and a later failure (concurrent reset setting NVME_CTRL_FROZEN, or device_add_disk() failing) leaves the timer armed on freed memory. The flaw was found by the FuzzNvme fuzzer and produces a KASAN slab-use-after-free (write) during timer teardown; no public exploit is identified at time of analysis and it is not in CISA KEV.
Memory exhaustion in the Linux kernel's MPTCP (Multipath TCP) subsystem allows unauthenticated remote attackers to drive forward-allocated memory growth without bound, resulting in kernel memory exhaustion and denial of service. The flaw is a regression introduced by commit 9db5b3cec4ec, which added forward-memory borrowing from MPTCP subflows but omitted the corresponding reclaim step when socket buffers are dropped before reaching the receive queue. Stable-branch patches have been released across the 6.18.x and 7.1.x series; no active exploitation or public exploit code has been identified.
Improper handling of incoming MPTCP suboptions in the Linux kernel's Multipath TCP (mptcp) implementation lets a remote peer send option combinations that RFC 8684 treats as mutually exclusive and that the parsing code does not expect, potentially causing inconsistent internal state when malformed or malicious combinations (e.g. MP_CAPABLE with MP_JOIN, or MP_FASTCLOSE with a DSS) are processed on the receive path. The fix mirrors the output-side restrictions in mptcp_write_options so conflicting suboptions are ignored rather than acted upon. No public exploit identified at time of analysis, and the issue is only reachable on hosts where MPTCP is enabled and in use; the supplied CVSS of 9.8 appears automated and likely overstates real-world impact.
Uninitialized-data exposure in the Linux kernel's MPTCP (Multipath TCP) option parser lets a remote peer send a malformed DSS suboption with an incorrect size, followed by a second DSS or MPC+Data, causing the first suboption to be ignored while leaving stale fields populated. The kernel then acts on inconsistent or uninitialized memory when handling the MPTCP connection. The upstream fix explicitly resets the affected DSS fields; vendor stable patches are available, this maps to CWE-908/CWE-457 (use of uninitialized resource), and there is no public exploit identified at time of analysis.
Kernel-state confusion in the Linux MPTCP subsystem allows a remote peer to leave stale Multipath TCP Fast Open (MPTFO) state on a passively-opened socket by sending a valid-cookie TCP Fast Open SYN that carries no payload. Because mptcp_fastopen_subflow_synack_set_params() set the is_mptfo flag before verifying that data was actually queued, a data-less TFO SYN triggers a WARN and, if non-fatal, leaves the subflow in an inconsistent state that can later be tripped inside check_fully_established(). The upstream fix marks the subflow as MPTFO only after an SKB is confirmed queued and returns quietly on an empty receive queue. No public exploit identified at time of analysis; the input carries the inflated CVSS 9.4 typical of automated kernel-CVE scoring rather than a demonstrated high-impact primitive.
Heap buffer overflow in the Linux kernel's s390/qeth driver exposes IBM System z hosts to local kernel memory corruption via malformed SNMP and ARP query ioctl calls. Affected systems run Linux kernel versions from 2.6.26 through the last unfixed stable releases across eight stable branches, with patches available in 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2. An attacker supplying a zero or undersized udata_len value to qeth_snmp_command() or qeth_l3_arp_query() triggers a u32 integer underflow in the callback bounds check, allowing memcpy to write past the kernel heap allocation and potentially achieve kernel code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds memory write in the Linux kernel's ASoC lpass-tx-macro audio codec driver allows a local low-privileged user to corrupt kernel memory via misconfigured ALSA enum kcontrol access, with potential for privilege escalation. The driver's get and put handlers for DEC0-DEC7 MODE controls incorrectly access the 8-byte integer union field instead of the 4-byte enumerated union field, writing 4 bytes beyond the intended boundary on 64-bit systems. No public exploit code has been identified at time of analysis, but the pattern mirrors two previously fixed sibling drivers (rx-macro, va-macro), confirming the root cause is well-understood.
PMD huge page mapping boundary violation in the Linux kernel's drm/shmem_helper subsystem allows local users with low privileges to trigger out-of-bounds memory mappings via the DRM ->huge_fault handler. The handler installs PMD-level Transparent Huge Page mappings without verifying they remain within Virtual Memory Area boundaries, triggering a VM_BUG_ON_VMA() assertion when the mapping subsequently reaches copy_pmd_range() during fork or remap operations. Patches have been committed to Linux 7.1.10 and 7.2 stable branches; no public exploit has been identified at time of analysis.
Out-of-bounds kernel memory write in the Linux framebuffer device (fbdev) subsystem exposes systems to potential privilege escalation by local low-privileged users. The flaw resides in show_modes(), which accumulates unchecked snprintf() return values while building sysfs output, allowing the write offset to advance beyond the PAGE_SIZE sysfs buffer when a display device has a sufficiently long modelist. No public exploit has been identified at time of analysis; patched kernel versions 7.1.10 and 7.2 are available via the stable kernel tree.
Use-after-free in the Linux kernel's fbdev framebuffer subsystem allows a local low-privileged user to trigger a stale pointer dereference with potential for information disclosure, memory corruption, or privilege escalation. When userspace issues FBIOPUT_VSCREENINFO with FB_ACTIVATE_INV_MODE via the fb_set_var() path, a videomode entry may be deleted from the modelist while fb_info->mode still holds a dangling pointer to the freed entry; a subsequent sysfs read via show_mode() then dereferences freed kernel memory. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Out-of-bounds hardware I/O reads in the Linux kernel's fbdev framebuffer subsystem allow low-privileged local users to read memory beyond valid hardware bounds, with high confidentiality and availability impact. The flaw in fb_io_read() stems from pointer desynchronization after a partial copy_to_user() transfer: the hardware source pointer advances by the full original chunk size while count is only decremented by successfully copied bytes, causing subsequent loop iterations to read from incorrect, over-advanced offsets. No public exploit or CISA KEV listing exists at time of analysis; patches are available across multiple stable kernel branches.
Missing bounds validation in the amdgpu DRM driver's GFX ring command submission path allows a local low-privileged user to submit oversized Indirect Buffer (IB) requests that corrupt adjacent control bits in GPU ring packet fields, destabilizing command submission and potentially achieving kernel memory corruption with scope-changing impact. Affected systems must have AMD GPU hardware and the amdgpu kernel module loaded; the vulnerability is present across multiple stable branches prior to Linux 6.12.105, 7.1.10, 6.18.46, and 7.2. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available for all affected stable branches.
Out-of-bounds memory access in the Linux kernel's cs40l50-vibra haptic driver allows a local low-privileged user to read or write beyond allocated kernel buffers by submitting a crafted force-feedback effect via EVIOCSFF ioctl. The driver's cs40l50_add() function fails to validate user-supplied custom_len before dereferencing custom_data[0] and custom_data[1], and an integer sign-wrap in bank type handling permits negative array indexing into vib->dsp.banks[]. Three distinct code paths are exploitable: zero-length allocation returning ZERO_SIZE_PTR, single-word allocation followed by a two-word read, and s16 overflow enabling out-of-bounds bank array access. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Out-of-bounds kernel heap write in the Linux kernel's Focaltech touchpad input driver allows local attackers to corrupt kernel memory through a signed integer underflow in the finger index variable. The `focaltech_process_rel_packet` function incorrectly handles a packet reporting finger index 0: subtracting 1 from a signed variable produces -1 rather than wrapping to a large unsigned value, bypassing the FOC_MAX_FINGERS bounds check and writing to `state->fingers[-1]`. Affected kernel versions span multiple stable branches from Linux 4.0 through the pre-patch revisions of 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, and 7.2; no CISA KEV listing and no public proof-of-concept exploit exist at time of analysis.
Use-after-free race condition in the Linux kernel BYD PS/2 mouse driver allows a local low-privileged user to corrupt kernel memory by racing a device disconnect event against in-flight timer callbacks. Affected systems must run an unpatched Linux kernel with BYD PS/2 touchpad hardware present and the byd module loaded, spanning stable branches from approximately kernel 4.6 through pre-fix releases ahead of 6.18.46, 7.1.10, and 7.2. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.
Heap buffer overflow in the Linux kernel synaptics-rmi4 driver allows local low-privileged users to overwrite kernel heap memory by exploiting stale state in the F54 diagnostics function. Affected systems must have Synaptics RMI4 touchpad hardware present and the driver loaded; exploitation involves manipulating V4L2 buffer sizes to trigger the overflow after an error condition leaves f54->report_size containing a stale value from a prior successful operation. Patches are available across all supported stable branches; no public exploit or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Out-of-bounds memory write in the Linux kernel's synaptics-rmi4 input driver allows a local attacker with access to a malicious or malfunctioning RMI4 touchpad device to corrupt kernel memory, potentially enabling privilege escalation or information disclosure. The root cause is a mismatch between the F54 report buffer allocation size (derived from F54 electrode counts) and the transfer size computed from F55 electrode counts - both sourced directly from device queries with no cross-validation. Vendor patches are confirmed across multiple stable kernel branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap buffer overflow in the Linux kernel's synaptics-rmi4 driver allows a local low-privileged user to trigger memory corruption by issuing VIDIOC_S_INPUT while the V4L2 diagnostic queue is actively streaming. The F54 function allocates V4L2 buffers sized to the report type at stream start; switching the input mid-stream to a larger report type overflows those buffers, enabling potential privilege escalation to root. Patches have been released across all active stable kernel branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect error-path logic in the Linux kernel's Qualcomm Crypto Engine (QCE) driver allows a local attacker with low privileges on Qualcomm SoC-based hardware to potentially trigger memory corruption via a use-after-free or improper resource release condition. The flaw resides in `devm_qce_register_algs`, where a failed `ops->register_algs()` call causes the cleanup loop to repeatedly invoke `ops->unregister_algs()` on the failed slot rather than iterating over previously successfully registered algorithm slots - leaving registered algorithms unreleased and potentially double-freeing or corrupting state. No public exploit identified at time of analysis, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.
Slab-out-of-bounds reads in the Linux kernel's libceph client (cls_lock_client.c decode_locker()) allow a malicious or compromised Ceph OSD to read kernel memory past a validated buffer when a client parses lock information. Any kernel Ceph/RBD client that issues the lock.get_info class method - for example during RBD exclusive lock acquisition - is affected across a wide range of stable branches. The input assigns CVSS 9.8, but no public exploit identified at time of analysis and the flaw is an out-of-bounds read (information disclosure / crash) rather than confirmed code execution, so the practical impact is narrower than the score suggests.
Local privilege escalation in the Linux kernel's OpenRISC signal return path allows any unprivileged local user to disable the Data MMU and gain arbitrary physical memory read/write access. The flaw exists in restore_sigcontext() on the OpenRISC (or1k) architecture, which fails to filter privileged Supervision Register (SR) bits copied from a user-controlled signal frame on sigreturn. Patched stable releases are available across all maintained kernel branches (5.10 through 7.2); no public exploit identified at time of analysis, though a verification proof-of-concept is documented in the fix description.
Race condition and error-path corruption in the Linux kernel sur40 input driver allow a local low-privileged user with access to an attached Samsung SUR40 multi-touch device to crash the kernel or corrupt input core state. The driver registers the input device in sur40_probe() before V4L2 video and vb2_queue components are fully initialized; any userspace process opening the input node immediately after registration can trigger the sur40_poll() worker thread, which dereferences the still-uninitialized vb2_queue and causes a data race leading to a potential system crash. A secondary error-path bug calls input_free_device() on an already-registered device instead of input_unregister_device(), corrupting input subsystem state if V4L2 initialization subsequently fails. No public exploit is identified at time of analysis.
Out-of-bounds memory access in the Linux kernel's libceph client (net/ceph) allows a malicious or corrupted Ceph osdmap to steer requests toward a non-existent OSD index. The flaw stems from an unvalidated osd index taken from the osdmap's primary_temp mapping, which is used to index the fixed-size osd_state, osd_weight, and osd_addr arrays. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed across multiple stable trees.
Out-of-bounds kernel memory read in the Linux kernel's libceph client (decode_watchers()) lets a malicious or compromised Ceph OSD trigger a 4-byte read past a validated buffer when it returns an obj_list_watch_response_t reply with struct_len=0. Any kernel client issuing CEPH_OSD_OP_LIST_WATCHERS is affected; the leaked garbage value is then used as a watcher count for allocation, risking information disclosure or unstable allocation behavior. Tagged as Information Disclosure with no public exploit identified at time of analysis and no CISA KEV listing, despite an NVD CVSS of 9.8.
Use-after-free race condition in the Linux kernel atmel-mci MMC/SD controller driver allows a local privileged user to corrupt freed kernel memory by racing module removal against queued bottom-half work items. Systems running Linux on Atmel AT91 or AVR32 SoC hardware with the atmel-mci driver loaded are exclusively affected; x86/x64 deployments are unaffected by design. Patch commits are confirmed available for stable branches 6.12.x, 6.18.x, 7.1.x, and 7.2, with no public exploit identified at time of analysis.
Memory leak in the Linux kernel s390/vfio_ccw subsystem enables a guest VM user to exhaust host kernel memory by submitting crafted channel programs that trigger cp_init() failure paths, leaving ccwchain segments unfreed. Affected deployments are IBM s390 (mainframe) KVM hosts that have vfio channel command word (CCW) device passthrough configured, making the attack surface highly specific. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; CVSS 7.1 with S:C reflects the guest-to-host cross-boundary availability impact.
Uncontrolled recursion in the Linux kernel's s390 vfio-ccw driver lets a local actor on IBM Z (s390) hosts submit a channel program containing an unbounded number of chained CCW/Transfer-in-Channel (TIC) segments, which are processed recursively and can exhaust the kernel stack. Affected are s390 systems using vfio-ccw device passthrough to KVM guests; the impact is host instability and potential kernel memory corruption. No public exploit is identified at time of analysis, it is not in CISA KEV, and no EPSS score was provided.
Use-after-free in the Linux kernel's s390/vfio_ccw subsystem allows a local low-privileged user on IBM Z hardware to corrupt freed kernel memory by triggering workqueue dispatch after the owning private struct has been released. Affected systems are those running KVM guests with VFIO CCW I/O channel passthrough on s390 architecture, spanning kernel versions from 4.12 through multiple unpatched stable branches. No public exploit or CISA KEV entry exists at time of analysis, but the scope-changing CVSS vector reflects the potential to compromise the host kernel or co-resident VMs.
Out-of-bounds region index access in the Linux kernel's s390/vfio_ccw subsystem exposes systems to potential guest-to-host privilege escalation on IBM mainframe KVM deployments. The read/write region handlers lack the bounds clamping that was applied to the capability chain regions, allowing a low-privileged local attacker - typically a KVM guest with vfio_ccw passthrough access - to trigger out-of-bounds memory access with a CVSS Scope:Changed impact. Vendor-released patches are available across multiple stable kernel branches, and no public exploit has been identified at time of analysis.
Host-side memory corruption/information disclosure in the Linux kernel s390 vfio_ccw driver allows a malicious or compromised KVM guest on IBM Z mainframes to exploit a double-fetch race when the driver reads a guest-supplied IDAL (Indirect Data Address List). Because the first IDAW is read separately to size the transfer buffer, a guest that changes that address between reads can desynchronize the buffer size from the actual IDAW set, corrupting or leaking host memory (S:C, C:H/I:H/A:H, CVSS 9.3). No public exploit identified at time of analysis and the issue is not in CISA KEV; the fix (verifying the first IDAW is unchanged between reads) is available upstream via stable kernel commits.
Out-of-bounds read in the Linux kernel's s390/vfio_ccw subsystem exposes host kernel memory to guest VM users, caused by an off-by-one error in the CCW chain length validation loop within `ccwchain_calc_length()`. Affected versions span from Linux 4.12 across multiple stable branches, with vendor-released patches confirmed in 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV; however, the guest-to-host scope change and high confidentiality impact warrant prioritized patching in any s390/IBM Z virtualization environment using vfio_ccw device passthrough.
Improper lock-aware cleanup in the s390/vfio_ccw subsystem of the Linux kernel exposes host systems to memory corruption when a virtualized channel device transitions to a non-operational state. The fsm_notoper() routine, invoked asynchronously upon device loss, performs private->cp resource cleanup while potentially holding the CIO subchannel lock, creating a lock inversion or use-after-free condition that crosses the VM-to-host boundary (CVSS S:C). The affected code path is specific to IBM Z (s390) architectures using vfio_ccw for channel I/O device passthrough to guests. No public exploit code has been identified at time of analysis, and vendor-released patches are available across multiple stable kernel branches.
Race conditions in the s390/vfio_ccw subsystem of the Linux kernel arise from an insufficiently scoped io_mutex that serialized io_regions but left other I/O operations unserialized, creating exploitable synchronization windows. Local low-privilege users inside guest VMs on IBM s390/zSeries hosts running vfio_ccw can exploit these races to achieve scope-changed privilege escalation into the host kernel, with full confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified; vendor patches are confirmed across stable branches 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2.
Race condition in the Linux kernel's s390/vfio_ccw CRW (Channel Report Word) subsystem allows low-privileged local attackers on IBM mainframe KVM hosts to read incoherent CRW payload state, with CVSS-assessed potential for high confidentiality, integrity, and availability impact including scope change into the hypervisor. The root cause is an absent lock on the CRW payload list, which receives exclusively asynchronous hardware events and was therefore never protected for concurrent access. No public exploit code or CISA KEV listing exists; patches have been backported across multiple stable kernel branches including 6.12.105, 6.18.46, 7.1.10, and 7.2.
Integer overflow and missing input validation flaws in the Linux kernel's s390/zcrypt subsystem allow a local low-privileged user to trigger kernel buffer overflows and uninitialized memory reads, yielding full confidentiality, integrity, and availability impact. The vulnerable function `xcrb_msg_to_type6cprb_msgx()` fails to validate CPRBX structure sizes before copying from userspace, performs signed integer arithmetic subject to overflow during alignment, and does not detect overflow when summing control and data block sizes. Upstream patches are confirmed in stable branches 7.1.10 and 7.2; no public exploit or CISA KEV listing is confirmed at time of analysis.
Multiple input validation failures in the Linux kernel s390/zcrypt driver's `xcrb_msg_to_type6_ep11cprb_msgx()` function allow a local unprivileged user on IBM Z/s390 systems with EP11 cryptographic coprocessors to trigger kernel-level buffer overflows. Three compounding weaknesses exist: missing minimum size validation before copying ep11_cprb structures from userspace, arithmetic overflow in CEIL4 alignment that can wrap around and bypass size checks, and unsafe C struct overlay on ASN.1-encoded payload without proper parsing. The official CVSS score of 7.8 (AV:L/AC:L/PR:L) reflects a realistic local privilege escalation path with full C/I/A impact. No public exploit has been identified at time of analysis, and patches are available in Linux 7.1.10 and 7.2.
Memory safety flaws in the Linux kernel s390/zcrypt EP11 CPRB domain handler allow a local low-privileged user on IBM Z mainframe systems to achieve full privilege escalation via crafted cryptographic request blocks. The vulnerable function zcrypt_msgtype6_send_ep11_cprb() uses struct overlays to access EP11 payload domain fields without performing ASN.1 validation or bounds checks at each parsing step, creating conditions for out-of-bounds memory access and incorrect domain field manipulation - the latter consistent with the intelligence-tagged 'Authentication Bypass' impact on EP11 coprocessor domain isolation. Vendor-released patches are available in Linux 7.1.10 and 7.2; no public exploit code or CISA KEV confirmation has been identified at time of analysis.
Local privilege escalation and kernel panic in the Linux kernel AMDGPU DRM subsystem allows a low-privileged local user to crash the system or potentially corrupt kernel memory by submitting a crafted GEM_CREATE ioctl with invalid domain flag combinations. The AMDGPU_GEM_CREATE ioctl validated individual domain bits against AMDGPU_GEM_DOMAIN_MASK but failed to reject illegal combinations of CPU, GTT, or VRAM domains mixed with special-purpose domains (DOORBELL, GDS, GWS, OA), causing amdgpu_bo_placement_from_domain() to write past the AMDGPU_BO_MAX_PLACEMENTS array boundary and trigger BUG_ON(), resulting in a kernel panic. No public exploit code or CISA KEV listing has been identified at time of analysis; patches are available across all active stable kernel branches.
Integer overflow in the amdgpu DRM subsystem's UVD (Unified Video Decoder) component exposes systems running AMD GPUs to local privilege escalation. The minimum image size calculation incorrectly references the image width rather than the pitch value, and fails to reject pitch values exceeding 4096, allowing arithmetic overflow that produces an artificially small size bound. A low-privileged local user can submit a crafted UVD decode request to corrupt kernel memory and achieve full system compromise with high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Error propagation failure in the Linux kernel's XFS realtime filesystem subsystem corrupts filesystem state during xfs_growfs operations. The function xfs_rtginode_ensure() silently discards all non-ENOENT errors returned by xfs_rtginode_load(), leaving the realtime group inode pointer unset while growfs proceeds as though load succeeded - producing a null pointer dereference, kernel panic, or realtime subvolume metadata corruption. Patch commits targeting Linux 6.18.46, 7.1.10, and 7.2 are available via kernel.org stable branches; no public exploit or CISA KEV listing exists at time of analysis.
Slab-out-of-bounds write in the Linux kernel XFS real-time refcount B-tree (rtrefcountbt) subsystem allows a local attacker to trigger a kernel panic or potentially escalate privileges by mounting a crafted XFS filesystem image with the rtreflink feature set. The flaw is an off-by-one in on-disk root level validation - two check paths use '>' instead of '>=' - permitting an illegal bb_level that causes the cursor's bc_nlevels to exceed bc_maxlevels by one, indexing a 2-byte write 8 bytes past the end of a 216-byte slab object during the first B-tree operation. No public exploit or CISA KEV listing exists, but the guaranteed kernel panic and kernel heap write primitive make this a meaningful local risk on affected configurations.
Heap out-of-bounds write in the Linux kernel's XFS log recovery path allows an attacker supplying a crafted XFS filesystem image to corrupt adjacent kernel slab memory during mount-time log replay. The flaw resides in xlog_recover_do_reg_buffer(), where a memcpy() copying dirty buffer regions is bounded solely by an ASSERT() that compiles away on production kernels (CONFIG_XFS_DEBUG=n), leaving attacker-controlled offset and length values from the logged dirty bitmap completely unchecked against the buffer's actual allocated size. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, though KASAN-confirmed slab-out-of-bounds writes demonstrate the primitive is real and reliable on unpatched kernels.
Use-After-Free in the XFS filesystem online repair subsystem of the Linux kernel allows a local low-privileged user to potentially achieve full kernel memory corruption and privilege escalation to root. The flaw in `xrep_tempfile_create` leaves `sc->tempip` as a dangling pointer when tempfile creation fails partway through, enabling subsequent dereference of freed memory. No public exploit has been identified at time of analysis, but the AV:L/AC:L/PR:L/C:H/I:H/A:H CVSS vector indicates any authenticated local user on an XFS-backed system can attempt exploitation with low complexity.
Data corruption in the Linux kernel's XFS exchange-range subsystem allows a low-privileged local attacker to trigger incorrect reflink inode flag clearing, causing subsequent writes to bypass Copy-on-Write protection on shared extents. Affected are Linux kernel versions prior to 6.12.105, 7.1.10, and 7.2 on systems using XFS volumes with reflink support enabled. No public exploit or CISA KEV listing exists at time of analysis, but the low-complexity local vector and high integrity/confidentiality impact make this a meaningful priority for XFS-heavy enterprise deployments such as RHEL-based systems where XFS is the default filesystem.
Denial of service (kernel crash/oops) in the Linux kernel CephFS client affects systems mounting a Ceph filesystem alongside another journaling filesystem such as ext4. The ceph handle_reply() path stores a ceph_mds_request pointer in current->journal_info while prepopulating the inode/dentry cache from an MDS reply; if an allocation in that window enters direct reclaim and prunes dentries from an ext4 mount, JBD2 misinterprets the Ceph pointer as a journal handle and dereferences r_tid as h_transaction, causing a paging fault and kernel oops. No KEV listing and no public exploit identified at time of analysis; the reported impact class is Denial Of Service rather than the code execution implied by the supplied 9.8 score.
Indefinite process hang in the Linux kernel Ceph filesystem client allows a remote Ceph cluster participant to cause a denial of service by triggering MDS capability revocation on a victim client. The flaw in `__ceph_get_caps()` causes a reading process to sleep forever on `i_cap_wq` when stale `cap->mds_wanted` state prevents the client from reacquiring FILE_RD without an external wake-up. No public exploit code has been identified at time of analysis; patches are available across multiple Linux stable branches.
Out-of-bounds array access in the Linux kernel's ASoC tas2562 audio driver allows local, low-privileged users to trigger kernel memory corruption by supplying unvalidated volume control values via the ALSA interface. The tas2562_volume_control_put() function accepts arbitrary userspace-supplied integers and uses them as unchecked array indices to look up a fixed-size table, potentially reading out-of-bounds kernel memory and writing that value to the TAS2562 hardware device over I2C. No public exploit code has been identified and the vulnerability is absent from CISA KEV; patched stable kernel releases are available across all affected branches.
The SpacemiT K3 clock driver in the Linux kernel fails to mark the HDMA clock as CLK_IS_CRITICAL, allowing the kernel's Common Clock Framework to gate it during power management. On SpacemiT K3 SoCs running an X100 RISC-V core, this produces an irrecoverable system hang whenever TCM-dependent operations - such as page fault handling triggered by vector instructions - are attempted while the HDMA clock is inactive. No public exploit has been identified at time of analysis and exposure is strictly bounded to SpacemiT K3 hardware; upstream fix commits are confirmed available for affected stable branches.
Out-of-bounds write in the Linux kernel's Tegra hardware crypto driver affects AES-GCM decrypt operations on NVIDIA Tegra SoC-based systems running kernel 6.10 and later. When a caller skips invocation of tegra_gcm_setauthsize() - leaving ctx->authsize at zero - the rctx->cryptlen calculation in tegra_gcm_do_one_req() produces an inflated length that causes a subsequent decrypt operation to write beyond the rctx->dst_sg scatter-gather buffer. A local attacker with low-privilege access to the kernel crypto API on affected Tegra hardware could trigger this to achieve privilege escalation or a kernel crash. No public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free race condition in the Linux kernel's AF_UNIX garbage collector (GC) allows a local user with low privileges to corrupt kernel heap memory with potential for privilege escalation. The race occurs between concurrent send() and close() operations on a crafted set of Unix domain sockets forming a Strongly Connected Component (SCC), causing unix_walk_scc_fast() to dereference a freed scc_entry when a partially-freed SCC is walked during the next GC cycle. The vulnerability is not in CISA KEV and no public exploit code has been identified at time of analysis; however, the CVSS 7.8 score and C:H/I:H/A:H impact triad reflect realistic kernel memory corruption severity.
NULL pointer dereference in the Linux kernel's in-kernel OpenVPN data-plane module (ovpn) allows a network-reachable peer to crash the kernel by triggering key removal against a crypto slot that is not populated. Affected kernels span the ovpn-enabled range from commit 89d3c0e4612afa1c6429ed68d298e35592fbe208 through versions prior to 6.18.46, 7.1.10, and 7.2. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation impact is full availability loss of the VPN gateway via kernel panic.
A use-after-free / lifetime race in the Linux kernel's ovpn (in-kernel OpenVPN data-channel offload) module lets crypto completion callbacks outlive the peer and netdev they depend on. Because the callback holds both key-slot and peer references, dropping the last peer reference too early can schedule an RCU callback backed by already-freed module text after ovpn_cleanup's rcu_barrier has run, corrupting kernel memory during peer teardown or module removal. There is no public exploit identified at time of analysis, and despite the input's 9.8 CVSS this is a teardown-path race, not a remote unauthenticated RCE.
Use-after-free in the Linux kernel perf subsystem allows a local low-privileged user to obtain a dangling pointer to a freed perf_event structure, enabling memory corruption with full confidentiality, integrity, and availability impact. Affected are stable kernel series 6.6.x, 6.12.x, 6.18.x (up to 6.18.46), and 7.1.x (up to 7.1.10). No public exploit code or CISA KEV listing exists at time of analysis, but the local privilege escalation primitive is significant on multi-tenant Linux systems.
Kernel memory corruption in the Linux SCTP stack allows a forged COOKIE_ECHO chunk to bypass validation of AUTH parameters when cookie authentication is disabled, letting an attacker who controls the echoed cookie bytes supply unchecked RANDOM lengths, HMAC identifiers, and CHUNKS lists. A forged RANDOM length yields out-of-bounds reads during key-vector construction, and a forged HMAC identifier drives a 32-byte write past a zero-length AUTH chunk - described by the reporter as a primitive for a local privilege escalation chain. No public exploit identified at time of analysis; the issue is fixed upstream in the mainline SCTP code.
Out-of-bounds read in the RISC-V ZBB-optimized strnlen() routine of the Linux kernel allows the aligned-word loop to load one machine word past the caller-supplied count boundary; when the source is aligned and count is a multiple of the register size, the extra load lands exactly at s+count and faults if that address sits on an unmapped page boundary. The affected code path only runs on RISC-V hardware exposing the Zbb bitmanip extension. This has been fixed upstream (stable commits e697e30f and 5d588c68); no public exploit identified at time of analysis, and the CNA's 9.4 network-vector scoring is inconsistent with an arch-local kernel string-length primitive.
Unsafe sleeping in atomic context within the Linux kernel's ovpn module can crash affected systems during VPN key slot teardown. When AEAD crypto transforms are freed via a plain RCU callback, implementations backed by asynchronous or hardware crypto accelerators may block inside crypto_free_aead - an operation forbidden in softirq/atomic context - triggering a kernel BUG or panic and denying service to the host. Systems running Linux 6.16 or unpatched stable branches with the ovpn kernel module active and a non-synchronous AEAD backend are at risk; no public exploit has been identified and the flaw is absent from CISA KEV.
Reference count corruption in the Linux kernel netfilter ipset subsystem allows a local low-privileged attacker to trigger a kernel panic via a race condition between list:set garbage collection and ip_set_swap(). The flaw exists because __ip_set_put_byindex() resolves a set index to a pointer under RCU but acquires ip_set_ref_lock only afterward to decrement the refcount, creating a window where ip_set_swap() can atomically reassign both the ip_set_list slot and the associated refcount before the lock is taken - causing the GC path to decrement a refcount that has already moved, hitting BUG_ON(set->ref == 0) and a fatal kernel panic. All Linux stable branches from 3.8 through pre-patch 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1, and 7.2 are affected; no public exploit has been identified at time of analysis.
Out-of-bounds memory access in the Linux kernel's IPVS subsystem allows a low-privileged local process to trigger kernel memory corruption via ip_vs_nat_icmp(). The flaw arises because the embedded IP header length field (ihl) is not revalidated after skb_ensure_writable() is called on ICMP packets processed through IPVS NAT, enabling a local process to supply a larger ihl value than was originally validated, causing ip_send_check() to access memory beyond intended bounds. With a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N), this represents a credible local privilege escalation path on any Linux system running IPVS in NAT mode. No public exploit code has been identified at time of analysis.
Use-after-free in the Linux kernel netfilter flowtable (nf_flow_table_offload) arises from an ordering bug in how connection-tracking tuple nodes are published to the rhashtable. Because nf_flow_table_iterate() treats only the original-direction node as the owning entry, publishing it before the reply node lets the garbage collector observe and free a flow while flow_offload_add() is still inserting the reply node, producing slab-use-after-free reads and writes reachable through rht_deferred_worker, jhash, flow_offload_del and flow_offload_lookup. The flaw affects systems using software/hardware flow offload; no public exploit identified at time of analysis, though the CNA-assigned CVSS is 9.8.
Deadlock vulnerability in the Linux kernel's bnxt (Broadcom NetXtreme) ethernet driver causes kernel hangs or crashes on systems with Broadcom bnxt NICs when an IRQ affinity notifier callback and the bnxt work-cancellation path simultaneously contend for the netdev instance lock. The affinity notifier callback acquires the lock to restart the queue while cancellation synchronously waits for that callback to finish - both paths block indefinitely, resulting in full availability loss for the affected network interface and potentially the host. No public exploit code exists and the vulnerability is absent from CISA KEV; the assigned CVSS vector (AV:N/PR:N) is inconsistent with the described kernel-local race and should be treated with skepticism.
Memory corruption in the Linux kernel ipvlan driver arises because ipvlan devices inherit hard_header_len but leave needed_headroom and needed_tailroom at zero, so upper layers under-reserve skb space when the lower physical device needs extra header/trailer room (macsec, IPsec, WireGuard, tunnels, or veth with rx headroom). Triggering the header-prepend or tailroom-append path can cause skb headroom underflow and KASAN-detected slab-use-after-free crashes. It is tagged as Denial of Service, has a vendor fix across multiple stable branches, and shows no public exploit or CISA KEV listing at time of analysis.
Memory corruption in the Linux kernel's macvlan driver occurs because macvlan devices fail to inherit needed_headroom and needed_tailroom from their underlying lower device, leaving both at 0. On systems where a macvlan is stacked on a lower device requiring extra header/trailer space (macsec, IPsec, WireGuard, tunnels, or veth with RX headroom), the upper layers under-reserve skb space, producing headroom underflows and KASAN slab-use-after-free crashes during header insertion. Tagged as Denial Of Service; a vendor patch is available and no public exploit has been identified at time of analysis.
Indefinite TX queue stall in the Linux kernel veth driver allows a denial-of-service condition against multi-queue virtual Ethernet interfaces running GRO without an XDP program attached. The root cause is that veth_poll() incorrectly uses rq->xdp_rxq.queue_index to determine which peer TX queue to wake - a field that is zero-initialized and only populated when XDP is active - causing all NAPI instances to wake peer TX queue 0 instead of the correct queue. In a multi-queue veth setup, a stopped TX queue (e.g., queue 1 halted due to ptr_ring saturation) is never woken, producing an indefinite transmit stall with no watchdog recovery because veth implements no ndo_tx_timeout. No public exploit is identified at time of analysis; reproduction scripts are publicly available from the reporter.
NULL pointer dereference in the Linux kernel ngbe (Wangxun) network driver crashes the kernel when the NIC operates in non-MSI-X interrupt mode (legacy INTx or single MSI). Systems running affected kernel versions with Wangxun WX1860-series NICs configured in non-MSI-X mode are exposed to a kernel panic, resulting in complete system availability loss. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, patch commits are available across multiple stable kernel branches.
Slab-out-of-bounds read in the Linux kernel's cls_u32 traffic classifier allows a local user with networking privileges to corrupt kernel heap memory and escalate to root. The flaw exists in u32_bind_class(), which unconditionally casts all objects enumerated by u32_walk() as tc_u_knode structures, even when the object is a tc_u_hnode (hash table), which lacks the tcf_result member - causing an out-of-bounds access to res->classid. Patches have been released across multiple stable kernel branches (6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, 7.2), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in the Linux kernel's TI AM65 CPSW NUSS Ethernet driver (am65-cpsw-nuss) allows sporadic kernel crashes because the driver treats the full 16-bit RX DMA descriptor Source Tag as the MAC port ID, when only the lower 8 bits are valid. On affected TI Sitara/K3 (AM65x-class) hardware, the arbitrary hardware-reserved upper 8 bits produce an invalid port_id that subsequent driver code uses to access out-of-bound memory, causing kernel panics. No public exploit is identified and it is not on CISA KEV; the vendor-tagged impact is Denial Of Service, not the remote code execution implied by the automated 9.8 score.
Traffic Control BPF classifier (cls_bpf) in the Linux kernel fails to validate that a hardware-offloaded SCHED_CLS program's bound network device matches the target TC classifier device, allowing a local attacker with CAP_NET_ADMIN to attach a program loaded for device A to device B via skip_sw. When device A is subsequently removed, the kernel destroys the program's offload state while it remains live on device B, producing a use-after-free condition that triggers a kernel WARN or panic (guaranteed denial of service with panic_on_warn=1, with potential for privilege escalation via the memory corruption primitive). Patches are available across multiple stable kernel branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in OpenZFS on Linux allows any unprivileged local user to perform root-restricted ZFS pool operations - including pool creation, import, destruction, event log access, and fault injection via zinject - by exploiting a flaw in ioctl authorization that incorrectly treats CAP_SYS_ADMIN held within a user-created unprivileged namespace as equivalent to real host-level root privilege. The vulnerability requires only that the user can open /dev/zfs and that the kernel permits unprivileged user namespace creation, a configuration that is enabled by default on most modern Linux distributions. No public exploit has been identified at time of analysis, and the OpenZFS project has released patched versions 2.2.11, 2.3.9, and 2.4.4 addressing all affected branches.
Race condition in the Linux kernel's GPIO PCA953x driver allows local low-privileged users on systems with PCA953x I2C GPIO expander hardware to trigger incorrect register reads or writes by exploiting missing mutex coverage in pca953x_irq_bus_sync_unlock(). A prior partial fix protected only the interrupt mask register write but left the direction register read unguarded, permitting concurrent threads to interleave I2C transactions and corrupt GPIO expander state on affected kernel stable branches including 6.1.101-6.2, 6.6.42-6.7, and 6.9.11-6.10. No public exploit has been identified and EPSS exploitation probability is 0.20% at the 10th percentile, consistent with negligible real-world exploitation interest.
Use-after-free in the Linux kernel's sched_ext (extensible BPF scheduler) subsystem allows a local low-privileged attacker to corrupt kernel memory, potentially achieving full confidentiality, integrity, and availability compromise of the affected system. The race condition arises when a sub-scheduler enable fails before being linked into the scheduler hierarchy, yet the full teardown path still executes concurrently against root scheduler disable, causing tasks to be re-homed onto an already-freed scheduler hierarchy. No public exploit or POC has been identified at time of analysis, and EPSS at 0.20% (10th percentile) reflects negligible observed exploitation activity.
A use-after-free in the Linux kernel's NFSv4 client can occur when a FREE_STATEID operation is delayed and the associated 'struct nfs_server' is torn down (for example on unmount) while the operation is still in flight, leaving the RPC referencing freed memory. The fix pins the nfs_server by bumping its refcount for the duration of the FREE_STATEID call. This is a client-side race condition, not a server-facing service bug; no public exploit identified at time of analysis, and EPSS is low (0.22%, 13th percentile).
Use-after-free in the Linux kernel's ovpn (in-kernel OpenVPN data-channel offload) module lets a local privileged attacker corrupt kernel memory by racing peer-management operations. A time-of-check/time-of-use window between ovpn_peer_get_by_id() and acquisition of ovpn->lock allows a peer that was concurrently removed to be re-inserted into the rehash tables, resurrecting a peer userspace believes is gone and leaving embedded hash entries linked to memory later freed via call_rcu. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), consistent with a hard-to-win kernel race rather than a mass-exploitable bug.
Null-pointer dereference and promiscuity counter underflow in the Linux kernel bonding driver's ALB monitor can crash the kernel or permanently pin a network interface in promiscuous mode. The bond_alb_monitor() workqueue function reads primary_is_promisc under RCU, drops that lock, then acquires RTNL - allowing the active slave to be removed or changed in the intervening window, leaving the monitor to act on stale state. Linux systems from kernel 2.6.24 through unpatched stable branches (5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, 7.2) with network bonding explicitly configured in ALB mode are affected. No public exploit identified at time of analysis.
Kernel memory corruption path in Linux's tunnel metadata subsystem (`tun_dst_unclone`) triggers a FORTIFY_SOURCE memcpy overflow warning when the kernel is built with clang, due to the `__counted_by` annotation on a flexible array member being evaluated as zero at copy time. Systems using GENEVE tunneling on clang-built kernels with source fortification enabled may experience kernel availability disruption if the warning escalates to a panic. No public exploit has been identified; EPSS of 0.17% at the 7th percentile reflects low exploitation probability, and the vulnerability is not listed in CISA KEV.
NULL pointer dereference in the Linux kernel's EMAC (Ethernet MAC) network driver during device probe can crash the kernel, resulting in complete system availability loss on affected hardware. The fault lies in `emac_probe()` where `devm_request_irq()` is called before `dev->emacp` is mapped via `devm_platform_ioremap_resource()`, leaving a race window during initialization in which any hardware interrupt invoking `emac_irq()` will dereference a NULL pointer and trigger a kernel panic. No public exploit code exists and the vulnerability is absent from CISA KEV; patches have been released across multiple Linux stable branches.
Use-after-free in the Linux kernel's veth driver XDP error path allows a local attacker with network interface configuration privileges to corrupt kernel memory, potentially achieving privilege escalation. The flaw stems from an off-by-one error in the rollback loop during XDP enablement: when xdp_rxq_info_reg() or xdp_rxq_info_reg_mem_model() fails, the loop skips netif_napi_del() for the failing queue index, leaving a dangling napi_struct in the device's napi_list. On subsequent device teardown, the freed - and potentially reallocated - queue memory is traversed via the stale NAPI list, resulting in UAF with full C/I/A impact. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS is 0.17% (7th percentile), reflecting low current exploitation probability.
Metadata corruption in the Linux kernel's lightweight tunnel (LWT) subsystem affects forwarded packets that carry XDP/TC skb metadata when they pass through LWT encapsulation (seg6, rpl, ila, mpls, ioam6, or BPF LWT xmit). Because encapsulation prepends outer headers over the skb headroom where metadata lives, non-BPF encaps silently overwrite it while BPF LWT xmit triggers a skb_data_move() WARNING and clears it; the fix drops metadata at the three LWT dispatch chokepoints before handing the skb to the encap op. There is no public exploit identified at time of analysis, EPSS is low (0.15%), and the nominal CVSS 9.8 appears substantially overstated for what is fundamentally a kernel data-path robustness fix.
Out-of-bounds memory access in the Linux kernel's qede network driver (QLogic FastLinQ/QL4xxx Ethernet) occurs because the driver reads into cqe->len_list[] before validating the index, allowing a crafted or malformed completion-queue entry to trigger reads past the array bounds. The flaw affects multiple stable branches (5.15, 6.1, 6.6, 6.12, 6.17/6.18) on systems that load the qede driver, with a vendor fix that reorders the bounds check before element access. There is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile).
Use-after-free race condition in the Linux kernel's amdxdna AMD AI accelerator driver allows a local low-privileged user to trigger kernel memory corruption by racing device removal against GEM object deallocation, potentially achieving full kernel privilege escalation. The flaw is specific to deployments where force_iova mode is enabled in the amdxdna driver, limiting the real-world exposure to systems with AMD XDna-capable hardware. No CISA KEV listing and no public proof-of-concept exist; EPSS of 0.15% (5th percentile) confirms this remains a theoretical priority rather than an active exploitation concern.
Lock mode mismatch in the Linux kernel's DRM XE GPU driver allows a local low-privileged user to trigger a kernel WARN_ON assertion via the xe_vm_bind_ioctl interface on systems compiled with the debug option CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y. The vulnerability arises because xe_pt_svm_userptr_pre_commit() acquires the SVM notifier_lock for read, but the injected test path calls into drm_gpusvm_unmap_pages() expecting a write-mode hold, causing the assertion to fire and potentially destabilizing the kernel. No public exploit has been identified and an EPSS of 0.18% (7th percentile) reflects minimal real-world threat, with impact confined entirely to debug kernel builds.
Out-of-bounds read in the Linux kernel HID subsystem (hid_get_report) allows an adjacent, unauthenticated attacker to trigger a kernel panic or leak kernel memory by submitting a zero-length numbered HID report via a crafted Bluetooth or USB device. The vulnerability affects multiple stable kernel branches from 5.10.x through 7.1.x, with patches backported across all supported trees. No public exploit has been identified at time of analysis, and EPSS remains very low at 0.18% (7th percentile), indicating limited threat actor awareness thus far.
Out-of-bounds read in the Linux kernel's netfilter nf_conntrack_irc connection-tracking helper (parse_dcc) allows a one-byte stale read past the IRC DCC parse buffer, potentially producing an incorrect DCC IP or port in the resulting conntrack expectation. The flaw stems from parse_dcc() treating data_end as an inclusive pointer while its caller passes an exclusive one-past-the-end limit; the read currently cannot fault because irc_buffer is over-allocated by one byte and datalen is capped at MAX_SEARCH_SIZE. It affects only systems with the nf_conntrack_irc helper active, and there is no public exploit identified at time of analysis (not in CISA KEV; EPSS 0.18%).
Use-after-free in the Linux kernel's batman-adv mesh networking gateway module exposes systems on batman-adv mesh segments to kernel memory corruption via crafted Ethernet frames. The flaw occurs because pskb_may_pull(), called within batadv_get_vid(), can reallocate the socket buffer backing store, leaving the ethernet header pointer stale; the code then dereferences this freed pointer before the fix reassigns it. No public exploit exists and EPSS sits at 0.18% (7th percentile) with no CISA KEV listing, but kernel-level UAF carries theoretical escalation-to-privilege-or-crash potential on any system actively running batman-adv.
Use-after-free in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) distributed ARP table (DAT) code lets an attacker on the same mesh corrupt kernel memory: batadv_get_vid() calls pskb_may_pull(), which can reallocate the skb buffer, leaving the previously-cached ARP hardware-source pointer dangling and later dereferenced. The flaw affects systems running batman-adv mesh networking across numerous stable kernel branches; a vendor fix reorders the pointer acquisition to occur after the realloc. No public exploit is identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not on CISA KEV.
Out-of-bounds read in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking subsystem exposes adjacent-network attackers to kernel memory disclosure and system crash. The vulnerability exists in batadv_dat_get_vid() within the Distributed ARP Table (DAT) component, which calls batadv_get_vid() to access the proto field of an ethernet header without first verifying that the underlying data is accessible - an obligation other call sites fulfill but this path omits. A network-adjacent unauthenticated attacker can send a crafted Layer 2 frame to trigger the flaw, yielding High confidentiality impact (kernel memory disclosure) and High availability impact (kernel panic). EPSS is 0.18% (7th percentile) and the flaw is not in CISA KEV, indicating no public exploitation at time of analysis.
Out-of-bounds read in the Linux kernel's ntfs3 LZNT decompression handler allows a local attacker with low privileges to trigger kernel memory access violations by mounting a specially crafted NTFS3 filesystem image. Affected stable branches span 5.15 through 7.x, with patched releases available across all branches. No public exploit code has been identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low predicted exploitation probability despite the high CVSS score of 7.8.
The Linux kernel ims-pcu USB driver exposes sysfs device attributes on the secondary data interface in addition to the intended primary control interface, allowing local users to trigger kernel crashes or undefined behavior by accessing those attributes on the data interface, which lacks the descriptors and internal state the driver requires. Affected systems must have an IMS Passenger Control Unit USB device physically connected and run a kernel version between commit 204d18a7a0c67352857dee1bbac517ed63f01d8e and the respective fix commits. No public exploit code exists, and the EPSS score of 0.17% (6th percentile) reflects the extreme hardware rarity required for exploitation; no CISA KEV listing exists.
Out-of-bounds read in the Linux kernel's asus_atk0110 hardware monitoring driver allows a malformed ACPI GGRP firmware package to trigger kernel memory corruption. Systems running ASUS ATK0110-equipped hardware with a BIOS that returns zero-count sub-packages in its GGRP management group response are affected across a wide range of Long-Term Support and mainline kernel versions from 2.6.32 onward. Exploitation is contingent on a specific hardware/firmware defect condition rather than a direct user action, but the resulting out-of-bounds read in kernel space carries high potential impact across confidentiality, integrity, and availability. No public exploit or CISA KEV listing exists; EPSS is 0.18% (7th percentile), reflecting the niche hardware prerequisite.
Corrupted xattr entry handling in the Linux kernel's f2fs filesystem driver exposes local users to kernel memory disclosure and potential corruption. When f2fs_listxattr() processes a crafted or corrupted filesystem image containing malformed extended attribute entries that fall outside the valid xattr storage area, the kernel previously returned a partial success result without validating entry boundaries. This flaw affects a wide range of kernel stable branches from the commit introducing the bug (688078e7f36c293dae25b338ddc9e0a2790f6e06) through the backported fixes. No public exploit code exists and EPSS is 0.18% (7th percentile), indicating low exploitation probability at time of analysis.
Kernel panic vulnerability in the Linux kernel's IP fragment reassembly path allows an unprivileged user in their own user namespace to crash the host kernel by writing two specially crafted packets with GSO (Generic Segmentation Offload) metadata to a tun/tap device. The flaw exists because inet_frag_queue_insert() - shared by IPv4, IPv6, nf_conntrack_reasm, and 6lowpan reassembly - fails to strip GSO state from fragments before queuing, causing the reassembled skb to reach skb_segment() with SKB_GSO_DODGY state and trigger BUG_ON() assertions. The vulnerability is also reachable with CAP_NET_RAW in a netns where a defrag point precedes a GSO point, and from a guest VM whose VMM forwards virtio_net_hdr to a host tap; KEV status is unconfirmed and EPSS is low at 0.18% (7th percentile), though the CVE description contains a working reproducer.
Use-after-free in the Linux kernel block layer occurs when a disk whose driver probe fails before add_disk() is released: disk_release() calls blk_mq_exit_queue() without stopping the request_queue timeout timer, so the request_queue is freed while still linked in a timer-wheel bucket. NVMe reaches this path because nvme_update_ns_info() issues Report Zones or FDP io-mgmt-recv I/O on the namespace queue before the disk is added, and a later failure (concurrent reset setting NVME_CTRL_FROZEN, or device_add_disk() failing) leaves the timer armed on freed memory. The flaw was found by the FuzzNvme fuzzer and produces a KASAN slab-use-after-free (write) during timer teardown; no public exploit is identified at time of analysis and it is not in CISA KEV.
Memory exhaustion in the Linux kernel's MPTCP (Multipath TCP) subsystem allows unauthenticated remote attackers to drive forward-allocated memory growth without bound, resulting in kernel memory exhaustion and denial of service. The flaw is a regression introduced by commit 9db5b3cec4ec, which added forward-memory borrowing from MPTCP subflows but omitted the corresponding reclaim step when socket buffers are dropped before reaching the receive queue. Stable-branch patches have been released across the 6.18.x and 7.1.x series; no active exploitation or public exploit code has been identified.
Improper handling of incoming MPTCP suboptions in the Linux kernel's Multipath TCP (mptcp) implementation lets a remote peer send option combinations that RFC 8684 treats as mutually exclusive and that the parsing code does not expect, potentially causing inconsistent internal state when malformed or malicious combinations (e.g. MP_CAPABLE with MP_JOIN, or MP_FASTCLOSE with a DSS) are processed on the receive path. The fix mirrors the output-side restrictions in mptcp_write_options so conflicting suboptions are ignored rather than acted upon. No public exploit identified at time of analysis, and the issue is only reachable on hosts where MPTCP is enabled and in use; the supplied CVSS of 9.8 appears automated and likely overstates real-world impact.
Uninitialized-data exposure in the Linux kernel's MPTCP (Multipath TCP) option parser lets a remote peer send a malformed DSS suboption with an incorrect size, followed by a second DSS or MPC+Data, causing the first suboption to be ignored while leaving stale fields populated. The kernel then acts on inconsistent or uninitialized memory when handling the MPTCP connection. The upstream fix explicitly resets the affected DSS fields; vendor stable patches are available, this maps to CWE-908/CWE-457 (use of uninitialized resource), and there is no public exploit identified at time of analysis.
Kernel-state confusion in the Linux MPTCP subsystem allows a remote peer to leave stale Multipath TCP Fast Open (MPTFO) state on a passively-opened socket by sending a valid-cookie TCP Fast Open SYN that carries no payload. Because mptcp_fastopen_subflow_synack_set_params() set the is_mptfo flag before verifying that data was actually queued, a data-less TFO SYN triggers a WARN and, if non-fatal, leaves the subflow in an inconsistent state that can later be tripped inside check_fully_established(). The upstream fix marks the subflow as MPTFO only after an SKB is confirmed queued and returns quietly on an empty receive queue. No public exploit identified at time of analysis; the input carries the inflated CVSS 9.4 typical of automated kernel-CVE scoring rather than a demonstrated high-impact primitive.
Heap buffer overflow in the Linux kernel's s390/qeth driver exposes IBM System z hosts to local kernel memory corruption via malformed SNMP and ARP query ioctl calls. Affected systems run Linux kernel versions from 2.6.26 through the last unfixed stable releases across eight stable branches, with patches available in 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2. An attacker supplying a zero or undersized udata_len value to qeth_snmp_command() or qeth_l3_arp_query() triggers a u32 integer underflow in the callback bounds check, allowing memcpy to write past the kernel heap allocation and potentially achieve kernel code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds memory write in the Linux kernel's ASoC lpass-tx-macro audio codec driver allows a local low-privileged user to corrupt kernel memory via misconfigured ALSA enum kcontrol access, with potential for privilege escalation. The driver's get and put handlers for DEC0-DEC7 MODE controls incorrectly access the 8-byte integer union field instead of the 4-byte enumerated union field, writing 4 bytes beyond the intended boundary on 64-bit systems. No public exploit code has been identified at time of analysis, but the pattern mirrors two previously fixed sibling drivers (rx-macro, va-macro), confirming the root cause is well-understood.
PMD huge page mapping boundary violation in the Linux kernel's drm/shmem_helper subsystem allows local users with low privileges to trigger out-of-bounds memory mappings via the DRM ->huge_fault handler. The handler installs PMD-level Transparent Huge Page mappings without verifying they remain within Virtual Memory Area boundaries, triggering a VM_BUG_ON_VMA() assertion when the mapping subsequently reaches copy_pmd_range() during fork or remap operations. Patches have been committed to Linux 7.1.10 and 7.2 stable branches; no public exploit has been identified at time of analysis.
Out-of-bounds kernel memory write in the Linux framebuffer device (fbdev) subsystem exposes systems to potential privilege escalation by local low-privileged users. The flaw resides in show_modes(), which accumulates unchecked snprintf() return values while building sysfs output, allowing the write offset to advance beyond the PAGE_SIZE sysfs buffer when a display device has a sufficiently long modelist. No public exploit has been identified at time of analysis; patched kernel versions 7.1.10 and 7.2 are available via the stable kernel tree.
Use-after-free in the Linux kernel's fbdev framebuffer subsystem allows a local low-privileged user to trigger a stale pointer dereference with potential for information disclosure, memory corruption, or privilege escalation. When userspace issues FBIOPUT_VSCREENINFO with FB_ACTIVATE_INV_MODE via the fb_set_var() path, a videomode entry may be deleted from the modelist while fb_info->mode still holds a dangling pointer to the freed entry; a subsequent sysfs read via show_mode() then dereferences freed kernel memory. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Out-of-bounds hardware I/O reads in the Linux kernel's fbdev framebuffer subsystem allow low-privileged local users to read memory beyond valid hardware bounds, with high confidentiality and availability impact. The flaw in fb_io_read() stems from pointer desynchronization after a partial copy_to_user() transfer: the hardware source pointer advances by the full original chunk size while count is only decremented by successfully copied bytes, causing subsequent loop iterations to read from incorrect, over-advanced offsets. No public exploit or CISA KEV listing exists at time of analysis; patches are available across multiple stable kernel branches.
Missing bounds validation in the amdgpu DRM driver's GFX ring command submission path allows a local low-privileged user to submit oversized Indirect Buffer (IB) requests that corrupt adjacent control bits in GPU ring packet fields, destabilizing command submission and potentially achieving kernel memory corruption with scope-changing impact. Affected systems must have AMD GPU hardware and the amdgpu kernel module loaded; the vulnerability is present across multiple stable branches prior to Linux 6.12.105, 7.1.10, 6.18.46, and 7.2. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available for all affected stable branches.
Out-of-bounds memory access in the Linux kernel's cs40l50-vibra haptic driver allows a local low-privileged user to read or write beyond allocated kernel buffers by submitting a crafted force-feedback effect via EVIOCSFF ioctl. The driver's cs40l50_add() function fails to validate user-supplied custom_len before dereferencing custom_data[0] and custom_data[1], and an integer sign-wrap in bank type handling permits negative array indexing into vib->dsp.banks[]. Three distinct code paths are exploitable: zero-length allocation returning ZERO_SIZE_PTR, single-word allocation followed by a two-word read, and s16 overflow enabling out-of-bounds bank array access. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Out-of-bounds kernel heap write in the Linux kernel's Focaltech touchpad input driver allows local attackers to corrupt kernel memory through a signed integer underflow in the finger index variable. The `focaltech_process_rel_packet` function incorrectly handles a packet reporting finger index 0: subtracting 1 from a signed variable produces -1 rather than wrapping to a large unsigned value, bypassing the FOC_MAX_FINGERS bounds check and writing to `state->fingers[-1]`. Affected kernel versions span multiple stable branches from Linux 4.0 through the pre-patch revisions of 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, and 7.2; no CISA KEV listing and no public proof-of-concept exploit exist at time of analysis.
Use-after-free race condition in the Linux kernel BYD PS/2 mouse driver allows a local low-privileged user to corrupt kernel memory by racing a device disconnect event against in-flight timer callbacks. Affected systems must run an unpatched Linux kernel with BYD PS/2 touchpad hardware present and the byd module loaded, spanning stable branches from approximately kernel 4.6 through pre-fix releases ahead of 6.18.46, 7.1.10, and 7.2. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.
Heap buffer overflow in the Linux kernel synaptics-rmi4 driver allows local low-privileged users to overwrite kernel heap memory by exploiting stale state in the F54 diagnostics function. Affected systems must have Synaptics RMI4 touchpad hardware present and the driver loaded; exploitation involves manipulating V4L2 buffer sizes to trigger the overflow after an error condition leaves f54->report_size containing a stale value from a prior successful operation. Patches are available across all supported stable branches; no public exploit or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Out-of-bounds memory write in the Linux kernel's synaptics-rmi4 input driver allows a local attacker with access to a malicious or malfunctioning RMI4 touchpad device to corrupt kernel memory, potentially enabling privilege escalation or information disclosure. The root cause is a mismatch between the F54 report buffer allocation size (derived from F54 electrode counts) and the transfer size computed from F55 electrode counts - both sourced directly from device queries with no cross-validation. Vendor patches are confirmed across multiple stable kernel branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap buffer overflow in the Linux kernel's synaptics-rmi4 driver allows a local low-privileged user to trigger memory corruption by issuing VIDIOC_S_INPUT while the V4L2 diagnostic queue is actively streaming. The F54 function allocates V4L2 buffers sized to the report type at stream start; switching the input mid-stream to a larger report type overflows those buffers, enabling potential privilege escalation to root. Patches have been released across all active stable kernel branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect error-path logic in the Linux kernel's Qualcomm Crypto Engine (QCE) driver allows a local attacker with low privileges on Qualcomm SoC-based hardware to potentially trigger memory corruption via a use-after-free or improper resource release condition. The flaw resides in `devm_qce_register_algs`, where a failed `ops->register_algs()` call causes the cleanup loop to repeatedly invoke `ops->unregister_algs()` on the failed slot rather than iterating over previously successfully registered algorithm slots - leaving registered algorithms unreleased and potentially double-freeing or corrupting state. No public exploit identified at time of analysis, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.
Slab-out-of-bounds reads in the Linux kernel's libceph client (cls_lock_client.c decode_locker()) allow a malicious or compromised Ceph OSD to read kernel memory past a validated buffer when a client parses lock information. Any kernel Ceph/RBD client that issues the lock.get_info class method - for example during RBD exclusive lock acquisition - is affected across a wide range of stable branches. The input assigns CVSS 9.8, but no public exploit identified at time of analysis and the flaw is an out-of-bounds read (information disclosure / crash) rather than confirmed code execution, so the practical impact is narrower than the score suggests.
Local privilege escalation in the Linux kernel's OpenRISC signal return path allows any unprivileged local user to disable the Data MMU and gain arbitrary physical memory read/write access. The flaw exists in restore_sigcontext() on the OpenRISC (or1k) architecture, which fails to filter privileged Supervision Register (SR) bits copied from a user-controlled signal frame on sigreturn. Patched stable releases are available across all maintained kernel branches (5.10 through 7.2); no public exploit identified at time of analysis, though a verification proof-of-concept is documented in the fix description.
Race condition and error-path corruption in the Linux kernel sur40 input driver allow a local low-privileged user with access to an attached Samsung SUR40 multi-touch device to crash the kernel or corrupt input core state. The driver registers the input device in sur40_probe() before V4L2 video and vb2_queue components are fully initialized; any userspace process opening the input node immediately after registration can trigger the sur40_poll() worker thread, which dereferences the still-uninitialized vb2_queue and causes a data race leading to a potential system crash. A secondary error-path bug calls input_free_device() on an already-registered device instead of input_unregister_device(), corrupting input subsystem state if V4L2 initialization subsequently fails. No public exploit is identified at time of analysis.
Out-of-bounds memory access in the Linux kernel's libceph client (net/ceph) allows a malicious or corrupted Ceph osdmap to steer requests toward a non-existent OSD index. The flaw stems from an unvalidated osd index taken from the osdmap's primary_temp mapping, which is used to index the fixed-size osd_state, osd_weight, and osd_addr arrays. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed across multiple stable trees.
Out-of-bounds kernel memory read in the Linux kernel's libceph client (decode_watchers()) lets a malicious or compromised Ceph OSD trigger a 4-byte read past a validated buffer when it returns an obj_list_watch_response_t reply with struct_len=0. Any kernel client issuing CEPH_OSD_OP_LIST_WATCHERS is affected; the leaked garbage value is then used as a watcher count for allocation, risking information disclosure or unstable allocation behavior. Tagged as Information Disclosure with no public exploit identified at time of analysis and no CISA KEV listing, despite an NVD CVSS of 9.8.
Use-after-free race condition in the Linux kernel atmel-mci MMC/SD controller driver allows a local privileged user to corrupt freed kernel memory by racing module removal against queued bottom-half work items. Systems running Linux on Atmel AT91 or AVR32 SoC hardware with the atmel-mci driver loaded are exclusively affected; x86/x64 deployments are unaffected by design. Patch commits are confirmed available for stable branches 6.12.x, 6.18.x, 7.1.x, and 7.2, with no public exploit identified at time of analysis.
Memory leak in the Linux kernel s390/vfio_ccw subsystem enables a guest VM user to exhaust host kernel memory by submitting crafted channel programs that trigger cp_init() failure paths, leaving ccwchain segments unfreed. Affected deployments are IBM s390 (mainframe) KVM hosts that have vfio channel command word (CCW) device passthrough configured, making the attack surface highly specific. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; CVSS 7.1 with S:C reflects the guest-to-host cross-boundary availability impact.
Uncontrolled recursion in the Linux kernel's s390 vfio-ccw driver lets a local actor on IBM Z (s390) hosts submit a channel program containing an unbounded number of chained CCW/Transfer-in-Channel (TIC) segments, which are processed recursively and can exhaust the kernel stack. Affected are s390 systems using vfio-ccw device passthrough to KVM guests; the impact is host instability and potential kernel memory corruption. No public exploit is identified at time of analysis, it is not in CISA KEV, and no EPSS score was provided.
Use-after-free in the Linux kernel's s390/vfio_ccw subsystem allows a local low-privileged user on IBM Z hardware to corrupt freed kernel memory by triggering workqueue dispatch after the owning private struct has been released. Affected systems are those running KVM guests with VFIO CCW I/O channel passthrough on s390 architecture, spanning kernel versions from 4.12 through multiple unpatched stable branches. No public exploit or CISA KEV entry exists at time of analysis, but the scope-changing CVSS vector reflects the potential to compromise the host kernel or co-resident VMs.
Out-of-bounds region index access in the Linux kernel's s390/vfio_ccw subsystem exposes systems to potential guest-to-host privilege escalation on IBM mainframe KVM deployments. The read/write region handlers lack the bounds clamping that was applied to the capability chain regions, allowing a low-privileged local attacker - typically a KVM guest with vfio_ccw passthrough access - to trigger out-of-bounds memory access with a CVSS Scope:Changed impact. Vendor-released patches are available across multiple stable kernel branches, and no public exploit has been identified at time of analysis.
Host-side memory corruption/information disclosure in the Linux kernel s390 vfio_ccw driver allows a malicious or compromised KVM guest on IBM Z mainframes to exploit a double-fetch race when the driver reads a guest-supplied IDAL (Indirect Data Address List). Because the first IDAW is read separately to size the transfer buffer, a guest that changes that address between reads can desynchronize the buffer size from the actual IDAW set, corrupting or leaking host memory (S:C, C:H/I:H/A:H, CVSS 9.3). No public exploit identified at time of analysis and the issue is not in CISA KEV; the fix (verifying the first IDAW is unchanged between reads) is available upstream via stable kernel commits.
Out-of-bounds read in the Linux kernel's s390/vfio_ccw subsystem exposes host kernel memory to guest VM users, caused by an off-by-one error in the CCW chain length validation loop within `ccwchain_calc_length()`. Affected versions span from Linux 4.12 across multiple stable branches, with vendor-released patches confirmed in 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV; however, the guest-to-host scope change and high confidentiality impact warrant prioritized patching in any s390/IBM Z virtualization environment using vfio_ccw device passthrough.
Improper lock-aware cleanup in the s390/vfio_ccw subsystem of the Linux kernel exposes host systems to memory corruption when a virtualized channel device transitions to a non-operational state. The fsm_notoper() routine, invoked asynchronously upon device loss, performs private->cp resource cleanup while potentially holding the CIO subchannel lock, creating a lock inversion or use-after-free condition that crosses the VM-to-host boundary (CVSS S:C). The affected code path is specific to IBM Z (s390) architectures using vfio_ccw for channel I/O device passthrough to guests. No public exploit code has been identified at time of analysis, and vendor-released patches are available across multiple stable kernel branches.
Race conditions in the s390/vfio_ccw subsystem of the Linux kernel arise from an insufficiently scoped io_mutex that serialized io_regions but left other I/O operations unserialized, creating exploitable synchronization windows. Local low-privilege users inside guest VMs on IBM s390/zSeries hosts running vfio_ccw can exploit these races to achieve scope-changed privilege escalation into the host kernel, with full confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified; vendor patches are confirmed across stable branches 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2.
Race condition in the Linux kernel's s390/vfio_ccw CRW (Channel Report Word) subsystem allows low-privileged local attackers on IBM mainframe KVM hosts to read incoherent CRW payload state, with CVSS-assessed potential for high confidentiality, integrity, and availability impact including scope change into the hypervisor. The root cause is an absent lock on the CRW payload list, which receives exclusively asynchronous hardware events and was therefore never protected for concurrent access. No public exploit code or CISA KEV listing exists; patches have been backported across multiple stable kernel branches including 6.12.105, 6.18.46, 7.1.10, and 7.2.
Integer overflow and missing input validation flaws in the Linux kernel's s390/zcrypt subsystem allow a local low-privileged user to trigger kernel buffer overflows and uninitialized memory reads, yielding full confidentiality, integrity, and availability impact. The vulnerable function `xcrb_msg_to_type6cprb_msgx()` fails to validate CPRBX structure sizes before copying from userspace, performs signed integer arithmetic subject to overflow during alignment, and does not detect overflow when summing control and data block sizes. Upstream patches are confirmed in stable branches 7.1.10 and 7.2; no public exploit or CISA KEV listing is confirmed at time of analysis.
Multiple input validation failures in the Linux kernel s390/zcrypt driver's `xcrb_msg_to_type6_ep11cprb_msgx()` function allow a local unprivileged user on IBM Z/s390 systems with EP11 cryptographic coprocessors to trigger kernel-level buffer overflows. Three compounding weaknesses exist: missing minimum size validation before copying ep11_cprb structures from userspace, arithmetic overflow in CEIL4 alignment that can wrap around and bypass size checks, and unsafe C struct overlay on ASN.1-encoded payload without proper parsing. The official CVSS score of 7.8 (AV:L/AC:L/PR:L) reflects a realistic local privilege escalation path with full C/I/A impact. No public exploit has been identified at time of analysis, and patches are available in Linux 7.1.10 and 7.2.
Memory safety flaws in the Linux kernel s390/zcrypt EP11 CPRB domain handler allow a local low-privileged user on IBM Z mainframe systems to achieve full privilege escalation via crafted cryptographic request blocks. The vulnerable function zcrypt_msgtype6_send_ep11_cprb() uses struct overlays to access EP11 payload domain fields without performing ASN.1 validation or bounds checks at each parsing step, creating conditions for out-of-bounds memory access and incorrect domain field manipulation - the latter consistent with the intelligence-tagged 'Authentication Bypass' impact on EP11 coprocessor domain isolation. Vendor-released patches are available in Linux 7.1.10 and 7.2; no public exploit code or CISA KEV confirmation has been identified at time of analysis.
Local privilege escalation and kernel panic in the Linux kernel AMDGPU DRM subsystem allows a low-privileged local user to crash the system or potentially corrupt kernel memory by submitting a crafted GEM_CREATE ioctl with invalid domain flag combinations. The AMDGPU_GEM_CREATE ioctl validated individual domain bits against AMDGPU_GEM_DOMAIN_MASK but failed to reject illegal combinations of CPU, GTT, or VRAM domains mixed with special-purpose domains (DOORBELL, GDS, GWS, OA), causing amdgpu_bo_placement_from_domain() to write past the AMDGPU_BO_MAX_PLACEMENTS array boundary and trigger BUG_ON(), resulting in a kernel panic. No public exploit code or CISA KEV listing has been identified at time of analysis; patches are available across all active stable kernel branches.
Integer overflow in the amdgpu DRM subsystem's UVD (Unified Video Decoder) component exposes systems running AMD GPUs to local privilege escalation. The minimum image size calculation incorrectly references the image width rather than the pitch value, and fails to reject pitch values exceeding 4096, allowing arithmetic overflow that produces an artificially small size bound. A low-privileged local user can submit a crafted UVD decode request to corrupt kernel memory and achieve full system compromise with high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Error propagation failure in the Linux kernel's XFS realtime filesystem subsystem corrupts filesystem state during xfs_growfs operations. The function xfs_rtginode_ensure() silently discards all non-ENOENT errors returned by xfs_rtginode_load(), leaving the realtime group inode pointer unset while growfs proceeds as though load succeeded - producing a null pointer dereference, kernel panic, or realtime subvolume metadata corruption. Patch commits targeting Linux 6.18.46, 7.1.10, and 7.2 are available via kernel.org stable branches; no public exploit or CISA KEV listing exists at time of analysis.
Slab-out-of-bounds write in the Linux kernel XFS real-time refcount B-tree (rtrefcountbt) subsystem allows a local attacker to trigger a kernel panic or potentially escalate privileges by mounting a crafted XFS filesystem image with the rtreflink feature set. The flaw is an off-by-one in on-disk root level validation - two check paths use '>' instead of '>=' - permitting an illegal bb_level that causes the cursor's bc_nlevels to exceed bc_maxlevels by one, indexing a 2-byte write 8 bytes past the end of a 216-byte slab object during the first B-tree operation. No public exploit or CISA KEV listing exists, but the guaranteed kernel panic and kernel heap write primitive make this a meaningful local risk on affected configurations.
Heap out-of-bounds write in the Linux kernel's XFS log recovery path allows an attacker supplying a crafted XFS filesystem image to corrupt adjacent kernel slab memory during mount-time log replay. The flaw resides in xlog_recover_do_reg_buffer(), where a memcpy() copying dirty buffer regions is bounded solely by an ASSERT() that compiles away on production kernels (CONFIG_XFS_DEBUG=n), leaving attacker-controlled offset and length values from the logged dirty bitmap completely unchecked against the buffer's actual allocated size. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, though KASAN-confirmed slab-out-of-bounds writes demonstrate the primitive is real and reliable on unpatched kernels.
Use-After-Free in the XFS filesystem online repair subsystem of the Linux kernel allows a local low-privileged user to potentially achieve full kernel memory corruption and privilege escalation to root. The flaw in `xrep_tempfile_create` leaves `sc->tempip` as a dangling pointer when tempfile creation fails partway through, enabling subsequent dereference of freed memory. No public exploit has been identified at time of analysis, but the AV:L/AC:L/PR:L/C:H/I:H/A:H CVSS vector indicates any authenticated local user on an XFS-backed system can attempt exploitation with low complexity.
Data corruption in the Linux kernel's XFS exchange-range subsystem allows a low-privileged local attacker to trigger incorrect reflink inode flag clearing, causing subsequent writes to bypass Copy-on-Write protection on shared extents. Affected are Linux kernel versions prior to 6.12.105, 7.1.10, and 7.2 on systems using XFS volumes with reflink support enabled. No public exploit or CISA KEV listing exists at time of analysis, but the low-complexity local vector and high integrity/confidentiality impact make this a meaningful priority for XFS-heavy enterprise deployments such as RHEL-based systems where XFS is the default filesystem.
Denial of service (kernel crash/oops) in the Linux kernel CephFS client affects systems mounting a Ceph filesystem alongside another journaling filesystem such as ext4. The ceph handle_reply() path stores a ceph_mds_request pointer in current->journal_info while prepopulating the inode/dentry cache from an MDS reply; if an allocation in that window enters direct reclaim and prunes dentries from an ext4 mount, JBD2 misinterprets the Ceph pointer as a journal handle and dereferences r_tid as h_transaction, causing a paging fault and kernel oops. No KEV listing and no public exploit identified at time of analysis; the reported impact class is Denial Of Service rather than the code execution implied by the supplied 9.8 score.
Indefinite process hang in the Linux kernel Ceph filesystem client allows a remote Ceph cluster participant to cause a denial of service by triggering MDS capability revocation on a victim client. The flaw in `__ceph_get_caps()` causes a reading process to sleep forever on `i_cap_wq` when stale `cap->mds_wanted` state prevents the client from reacquiring FILE_RD without an external wake-up. No public exploit code has been identified at time of analysis; patches are available across multiple Linux stable branches.
Out-of-bounds array access in the Linux kernel's ASoC tas2562 audio driver allows local, low-privileged users to trigger kernel memory corruption by supplying unvalidated volume control values via the ALSA interface. The tas2562_volume_control_put() function accepts arbitrary userspace-supplied integers and uses them as unchecked array indices to look up a fixed-size table, potentially reading out-of-bounds kernel memory and writing that value to the TAS2562 hardware device over I2C. No public exploit code has been identified and the vulnerability is absent from CISA KEV; patched stable kernel releases are available across all affected branches.
The SpacemiT K3 clock driver in the Linux kernel fails to mark the HDMA clock as CLK_IS_CRITICAL, allowing the kernel's Common Clock Framework to gate it during power management. On SpacemiT K3 SoCs running an X100 RISC-V core, this produces an irrecoverable system hang whenever TCM-dependent operations - such as page fault handling triggered by vector instructions - are attempted while the HDMA clock is inactive. No public exploit has been identified at time of analysis and exposure is strictly bounded to SpacemiT K3 hardware; upstream fix commits are confirmed available for affected stable branches.
Out-of-bounds write in the Linux kernel's Tegra hardware crypto driver affects AES-GCM decrypt operations on NVIDIA Tegra SoC-based systems running kernel 6.10 and later. When a caller skips invocation of tegra_gcm_setauthsize() - leaving ctx->authsize at zero - the rctx->cryptlen calculation in tegra_gcm_do_one_req() produces an inflated length that causes a subsequent decrypt operation to write beyond the rctx->dst_sg scatter-gather buffer. A local attacker with low-privilege access to the kernel crypto API on affected Tegra hardware could trigger this to achieve privilege escalation or a kernel crash. No public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free race condition in the Linux kernel's AF_UNIX garbage collector (GC) allows a local user with low privileges to corrupt kernel heap memory with potential for privilege escalation. The race occurs between concurrent send() and close() operations on a crafted set of Unix domain sockets forming a Strongly Connected Component (SCC), causing unix_walk_scc_fast() to dereference a freed scc_entry when a partially-freed SCC is walked during the next GC cycle. The vulnerability is not in CISA KEV and no public exploit code has been identified at time of analysis; however, the CVSS 7.8 score and C:H/I:H/A:H impact triad reflect realistic kernel memory corruption severity.
NULL pointer dereference in the Linux kernel's in-kernel OpenVPN data-plane module (ovpn) allows a network-reachable peer to crash the kernel by triggering key removal against a crypto slot that is not populated. Affected kernels span the ovpn-enabled range from commit 89d3c0e4612afa1c6429ed68d298e35592fbe208 through versions prior to 6.18.46, 7.1.10, and 7.2. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation impact is full availability loss of the VPN gateway via kernel panic.
A use-after-free / lifetime race in the Linux kernel's ovpn (in-kernel OpenVPN data-channel offload) module lets crypto completion callbacks outlive the peer and netdev they depend on. Because the callback holds both key-slot and peer references, dropping the last peer reference too early can schedule an RCU callback backed by already-freed module text after ovpn_cleanup's rcu_barrier has run, corrupting kernel memory during peer teardown or module removal. There is no public exploit identified at time of analysis, and despite the input's 9.8 CVSS this is a teardown-path race, not a remote unauthenticated RCE.
Use-after-free in the Linux kernel perf subsystem allows a local low-privileged user to obtain a dangling pointer to a freed perf_event structure, enabling memory corruption with full confidentiality, integrity, and availability impact. Affected are stable kernel series 6.6.x, 6.12.x, 6.18.x (up to 6.18.46), and 7.1.x (up to 7.1.10). No public exploit code or CISA KEV listing exists at time of analysis, but the local privilege escalation primitive is significant on multi-tenant Linux systems.
Kernel memory corruption in the Linux SCTP stack allows a forged COOKIE_ECHO chunk to bypass validation of AUTH parameters when cookie authentication is disabled, letting an attacker who controls the echoed cookie bytes supply unchecked RANDOM lengths, HMAC identifiers, and CHUNKS lists. A forged RANDOM length yields out-of-bounds reads during key-vector construction, and a forged HMAC identifier drives a 32-byte write past a zero-length AUTH chunk - described by the reporter as a primitive for a local privilege escalation chain. No public exploit identified at time of analysis; the issue is fixed upstream in the mainline SCTP code.
Out-of-bounds read in the RISC-V ZBB-optimized strnlen() routine of the Linux kernel allows the aligned-word loop to load one machine word past the caller-supplied count boundary; when the source is aligned and count is a multiple of the register size, the extra load lands exactly at s+count and faults if that address sits on an unmapped page boundary. The affected code path only runs on RISC-V hardware exposing the Zbb bitmanip extension. This has been fixed upstream (stable commits e697e30f and 5d588c68); no public exploit identified at time of analysis, and the CNA's 9.4 network-vector scoring is inconsistent with an arch-local kernel string-length primitive.
Unsafe sleeping in atomic context within the Linux kernel's ovpn module can crash affected systems during VPN key slot teardown. When AEAD crypto transforms are freed via a plain RCU callback, implementations backed by asynchronous or hardware crypto accelerators may block inside crypto_free_aead - an operation forbidden in softirq/atomic context - triggering a kernel BUG or panic and denying service to the host. Systems running Linux 6.16 or unpatched stable branches with the ovpn kernel module active and a non-synchronous AEAD backend are at risk; no public exploit has been identified and the flaw is absent from CISA KEV.
Reference count corruption in the Linux kernel netfilter ipset subsystem allows a local low-privileged attacker to trigger a kernel panic via a race condition between list:set garbage collection and ip_set_swap(). The flaw exists because __ip_set_put_byindex() resolves a set index to a pointer under RCU but acquires ip_set_ref_lock only afterward to decrement the refcount, creating a window where ip_set_swap() can atomically reassign both the ip_set_list slot and the associated refcount before the lock is taken - causing the GC path to decrement a refcount that has already moved, hitting BUG_ON(set->ref == 0) and a fatal kernel panic. All Linux stable branches from 3.8 through pre-patch 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1, and 7.2 are affected; no public exploit has been identified at time of analysis.
Out-of-bounds memory access in the Linux kernel's IPVS subsystem allows a low-privileged local process to trigger kernel memory corruption via ip_vs_nat_icmp(). The flaw arises because the embedded IP header length field (ihl) is not revalidated after skb_ensure_writable() is called on ICMP packets processed through IPVS NAT, enabling a local process to supply a larger ihl value than was originally validated, causing ip_send_check() to access memory beyond intended bounds. With a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N), this represents a credible local privilege escalation path on any Linux system running IPVS in NAT mode. No public exploit code has been identified at time of analysis.
Use-after-free in the Linux kernel netfilter flowtable (nf_flow_table_offload) arises from an ordering bug in how connection-tracking tuple nodes are published to the rhashtable. Because nf_flow_table_iterate() treats only the original-direction node as the owning entry, publishing it before the reply node lets the garbage collector observe and free a flow while flow_offload_add() is still inserting the reply node, producing slab-use-after-free reads and writes reachable through rht_deferred_worker, jhash, flow_offload_del and flow_offload_lookup. The flaw affects systems using software/hardware flow offload; no public exploit identified at time of analysis, though the CNA-assigned CVSS is 9.8.
Deadlock vulnerability in the Linux kernel's bnxt (Broadcom NetXtreme) ethernet driver causes kernel hangs or crashes on systems with Broadcom bnxt NICs when an IRQ affinity notifier callback and the bnxt work-cancellation path simultaneously contend for the netdev instance lock. The affinity notifier callback acquires the lock to restart the queue while cancellation synchronously waits for that callback to finish - both paths block indefinitely, resulting in full availability loss for the affected network interface and potentially the host. No public exploit code exists and the vulnerability is absent from CISA KEV; the assigned CVSS vector (AV:N/PR:N) is inconsistent with the described kernel-local race and should be treated with skepticism.
Memory corruption in the Linux kernel ipvlan driver arises because ipvlan devices inherit hard_header_len but leave needed_headroom and needed_tailroom at zero, so upper layers under-reserve skb space when the lower physical device needs extra header/trailer room (macsec, IPsec, WireGuard, tunnels, or veth with rx headroom). Triggering the header-prepend or tailroom-append path can cause skb headroom underflow and KASAN-detected slab-use-after-free crashes. It is tagged as Denial of Service, has a vendor fix across multiple stable branches, and shows no public exploit or CISA KEV listing at time of analysis.
Memory corruption in the Linux kernel's macvlan driver occurs because macvlan devices fail to inherit needed_headroom and needed_tailroom from their underlying lower device, leaving both at 0. On systems where a macvlan is stacked on a lower device requiring extra header/trailer space (macsec, IPsec, WireGuard, tunnels, or veth with RX headroom), the upper layers under-reserve skb space, producing headroom underflows and KASAN slab-use-after-free crashes during header insertion. Tagged as Denial Of Service; a vendor patch is available and no public exploit has been identified at time of analysis.
Indefinite TX queue stall in the Linux kernel veth driver allows a denial-of-service condition against multi-queue virtual Ethernet interfaces running GRO without an XDP program attached. The root cause is that veth_poll() incorrectly uses rq->xdp_rxq.queue_index to determine which peer TX queue to wake - a field that is zero-initialized and only populated when XDP is active - causing all NAPI instances to wake peer TX queue 0 instead of the correct queue. In a multi-queue veth setup, a stopped TX queue (e.g., queue 1 halted due to ptr_ring saturation) is never woken, producing an indefinite transmit stall with no watchdog recovery because veth implements no ndo_tx_timeout. No public exploit is identified at time of analysis; reproduction scripts are publicly available from the reporter.
NULL pointer dereference in the Linux kernel ngbe (Wangxun) network driver crashes the kernel when the NIC operates in non-MSI-X interrupt mode (legacy INTx or single MSI). Systems running affected kernel versions with Wangxun WX1860-series NICs configured in non-MSI-X mode are exposed to a kernel panic, resulting in complete system availability loss. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, patch commits are available across multiple stable kernel branches.
Slab-out-of-bounds read in the Linux kernel's cls_u32 traffic classifier allows a local user with networking privileges to corrupt kernel heap memory and escalate to root. The flaw exists in u32_bind_class(), which unconditionally casts all objects enumerated by u32_walk() as tc_u_knode structures, even when the object is a tc_u_hnode (hash table), which lacks the tcf_result member - causing an out-of-bounds access to res->classid. Patches have been released across multiple stable kernel branches (6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, 7.2), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in the Linux kernel's TI AM65 CPSW NUSS Ethernet driver (am65-cpsw-nuss) allows sporadic kernel crashes because the driver treats the full 16-bit RX DMA descriptor Source Tag as the MAC port ID, when only the lower 8 bits are valid. On affected TI Sitara/K3 (AM65x-class) hardware, the arbitrary hardware-reserved upper 8 bits produce an invalid port_id that subsequent driver code uses to access out-of-bound memory, causing kernel panics. No public exploit is identified and it is not on CISA KEV; the vendor-tagged impact is Denial Of Service, not the remote code execution implied by the automated 9.8 score.
Traffic Control BPF classifier (cls_bpf) in the Linux kernel fails to validate that a hardware-offloaded SCHED_CLS program's bound network device matches the target TC classifier device, allowing a local attacker with CAP_NET_ADMIN to attach a program loaded for device A to device B via skip_sw. When device A is subsequently removed, the kernel destroys the program's offload state while it remains live on device B, producing a use-after-free condition that triggers a kernel WARN or panic (guaranteed denial of service with panic_on_warn=1, with potential for privilege escalation via the memory corruption primitive). Patches are available across multiple stable kernel branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in OpenZFS on Linux allows any unprivileged local user to perform root-restricted ZFS pool operations - including pool creation, import, destruction, event log access, and fault injection via zinject - by exploiting a flaw in ioctl authorization that incorrectly treats CAP_SYS_ADMIN held within a user-created unprivileged namespace as equivalent to real host-level root privilege. The vulnerability requires only that the user can open /dev/zfs and that the kernel permits unprivileged user namespace creation, a configuration that is enabled by default on most modern Linux distributions. No public exploit has been identified at time of analysis, and the OpenZFS project has released patched versions 2.2.11, 2.3.9, and 2.4.4 addressing all affected branches.
Race condition in the Linux kernel's GPIO PCA953x driver allows local low-privileged users on systems with PCA953x I2C GPIO expander hardware to trigger incorrect register reads or writes by exploiting missing mutex coverage in pca953x_irq_bus_sync_unlock(). A prior partial fix protected only the interrupt mask register write but left the direction register read unguarded, permitting concurrent threads to interleave I2C transactions and corrupt GPIO expander state on affected kernel stable branches including 6.1.101-6.2, 6.6.42-6.7, and 6.9.11-6.10. No public exploit has been identified and EPSS exploitation probability is 0.20% at the 10th percentile, consistent with negligible real-world exploitation interest.
Use-after-free in the Linux kernel's sched_ext (extensible BPF scheduler) subsystem allows a local low-privileged attacker to corrupt kernel memory, potentially achieving full confidentiality, integrity, and availability compromise of the affected system. The race condition arises when a sub-scheduler enable fails before being linked into the scheduler hierarchy, yet the full teardown path still executes concurrently against root scheduler disable, causing tasks to be re-homed onto an already-freed scheduler hierarchy. No public exploit or POC has been identified at time of analysis, and EPSS at 0.20% (10th percentile) reflects negligible observed exploitation activity.
A use-after-free in the Linux kernel's NFSv4 client can occur when a FREE_STATEID operation is delayed and the associated 'struct nfs_server' is torn down (for example on unmount) while the operation is still in flight, leaving the RPC referencing freed memory. The fix pins the nfs_server by bumping its refcount for the duration of the FREE_STATEID call. This is a client-side race condition, not a server-facing service bug; no public exploit identified at time of analysis, and EPSS is low (0.22%, 13th percentile).
Use-after-free in the Linux kernel's ovpn (in-kernel OpenVPN data-channel offload) module lets a local privileged attacker corrupt kernel memory by racing peer-management operations. A time-of-check/time-of-use window between ovpn_peer_get_by_id() and acquisition of ovpn->lock allows a peer that was concurrently removed to be re-inserted into the rehash tables, resurrecting a peer userspace believes is gone and leaving embedded hash entries linked to memory later freed via call_rcu. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), consistent with a hard-to-win kernel race rather than a mass-exploitable bug.
Null-pointer dereference and promiscuity counter underflow in the Linux kernel bonding driver's ALB monitor can crash the kernel or permanently pin a network interface in promiscuous mode. The bond_alb_monitor() workqueue function reads primary_is_promisc under RCU, drops that lock, then acquires RTNL - allowing the active slave to be removed or changed in the intervening window, leaving the monitor to act on stale state. Linux systems from kernel 2.6.24 through unpatched stable branches (5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, 7.2) with network bonding explicitly configured in ALB mode are affected. No public exploit identified at time of analysis.