Linux
Monthly
NULL pointer dereference in the Linux kernel's Bluetooth ISO subsystem can crash the kernel when a race condition is triggered during PA-sync broadcast sink socket operations. The flaw exists in iso_conn_big_sync(), which drops the socket lock to call hci_get_route() and then re-acquires it without re-validating that the connection structure is still intact - allowing concurrent teardown events (iso_disconn_cfm → iso_conn_del → iso_chan_del) to null out iso_pi(sk)->conn before it is dereferenced. A local low-privileged user with access to Bluetooth ISO sockets can reliably crash the kernel, resulting in a denial of service. No public exploit code has been identified and no active exploitation is confirmed.
Device reference count leak in the Linux kernel's firmware_loader subsystem exposes systems to local denial-of-service conditions. Specifically, firmware_upload_register() fails to call put_device() on the fw_dev pointer when alloc_lookup_fw_priv() fails after fw_create_instance() has already called device_initialize(), leaving the embedded struct device reference count unbalanced and potentially preventing proper memory cleanup. Discovered via static analysis and confirmed by manual code review, the issue is patched across multiple stable kernel branches including 6.1.178, 6.6.145, 6.12.96, 6.18.39, and 7.1.4. No public exploit exists and no active exploitation has been observed.
Null pointer dereference in the Linux kernel's cpufreq subsystem during system reboot allows a local attacker with low privileges to crash the kernel. The reboot path (kernel_restart() → device_shutdown() → cpufreq_suspend()) does not invoke freeze_processes() - unlike the normal suspend path - leaving CPU hotplug operations free to run concurrently and free governor_data while cpufreq_suspend() is still reading it, producing a use-after-free null pointer dereference. No public exploit exists and EPSS probability is 0.22% (13th percentile), placing this in low-urgency territory despite the ubiquitous kernel footprint.
Kernel denial-of-service via missing exec_update_lock protection in six Linux procfs functions affects all Linux deployments running kernel 2.6.30 through multiple current stable branches. When a low-privileged local user reads specific /proc entries (stat, map_files, ns symlinks) concurrently with an execve() call in the target process, the missing lock allows ptrace_may_access() to observe transiently invalid credential or memory-map state, triggering a kernel crash. No public exploit identified at time of analysis; EPSS is 0.22% (13th percentile), consistent with low near-term automated exploitation probability.
Resource reference leak in the Linux kernel's POSIX CPU timer subsystem allows a local unprivileged user to exhaust kernel pid references and cause a local denial of service. The flaw exists in `do_cpu_nanosleep()` across all stable kernel branches from 2.6.12 onward: when `posix_cpu_timer_set()` returns an error, the pid reference acquired by the preceding `posix_cpu_timer_create()` call is never released. No public exploit code exists and EPSS sits at 0.22%, consistent with a kernel stability regression fix rather than an actively targeted security flaw.
Denial of service via infinite exception loop in the Linux kernel's s390 architecture affects systems running IBM Secure Execution (Ultravisor) workloads on kernel versions 6.7 through the patched releases. When load_unaligned_zeropad() reads across a page boundary where the adjacent page has been donated to the Ultravisor, the do_secure_storage_access() exception handler cannot resolve the fault and enters an unresolvable loop, permanently hanging the affected execution context. Patched in upstream versions 6.12.97, 7.1.4, and 7.2-rc1 via reversion of DCACHE_WORD_ACCESS support on s390; no public exploit or active exploitation is confirmed at time of analysis.
Uninitialized stack memory use in the Linux kernel HFS and HFS+ filesystem drivers allows a local user to crash the kernel by mounting a crafted filesystem image. Two early-exit paths in `hfs_bnode_read()` - an invalid offset check and a corrected-to-zero length - skip the buffer write, while downstream callers such as `hfs_bnode_read_u16()` and `hfs_bnode_read_u8()` consume the uninitialized stack buffer unconditionally, producing KMSAN uninit-value reports and risking kernel panics. Patches are available across multiple stable kernel branches; no public exploit exists and EPSS is very low at 0.22%.
Hung-task denial-of-service in the Linux kernel's nilfs2 filesystem allows a local low-privileged user to indefinitely stall concurrent filesystem operations by supplying out-of-range segment numbers to the NILFS_IOCTL_CLEAN_SEGMENTS ioctl. Because input validation was deferred deep inside the call chain to nilfs_sufile_updatev() - which emits one printk warning per invalid entry while holding ns_segctor_sem write-locked - repeated invocations saturate the global printk path and keep the semaphore held long enough to block all readers, including routine operations such as chmod(). No public exploit has been identified and EPSS is very low (0.22%, 13th percentile), consistent with a local kernel DoS requiring filesystem access.
Unconditional invocation of cancel_work_sync() in the mtk-jpeg media driver's release path triggers spurious WARN_ON kernel warnings on non-multicore MediaTek JPEG codec platforms where the workqueue callback pointer is NULL. Systems running affected Linux kernel versions (6.6.140-6.18.38, 7.0.4) on MediaTek SoC hardware may experience kernel log pollution or, on kernels compiled with CONFIG_PANIC_ON_WARN=y, a full system denial of service when the JPEG device is released. No public exploit has been identified and no active exploitation is recorded; this is a stability and correctness fix with strictly local trigger conditions.
Integer overflow in the Linux kernel's XFS filesystem exchmaps reservation logic allows a local low-privileged user to crash the system. The bug in xfs_exchmaps_estimate_overhead() adds bmbt and rmapbt overhead to a local resblks variable but then performs the UINT_MAX guard check against the original req->resblks value - the pre-overhead figure - before writing the inflated value back into req->resblks for use in xfs_trans_alloc(). This means the guard intended to prevent integer truncation when the reservation is cast to unsigned int is rendered ineffective, enabling a kernel panic on XFS systems where exchmaps overhead pushes the reservation past UINT_MAX. No public exploit exists and EPSS is 0.21%, placing this firmly in the kernel stability/bug-fix category rather than active threat landscape.
Memory exhaustion in the Linux kernel XFS quota subsystem can be triggered by a local low-privilege user on systems mounting metadir XFS images with user quota enabled. The vulnerability exists in xfs_dqinode_metadir_create(), where failure of xfs_metadir_create() returns without releasing the allocated update and transaction state, and commit failures leave behind caller-owned inode references. Confirmed present from Linux 6.13-rc1 through v7.1.1; patched in stable releases 6.18.39 and 7.1.4.
The Linux kernel BPF verifier incorrectly elides null-check requirements for inner array map lookups when the BPF_F_INNER_MAP flag is set, allowing a local attacker with BPF program loading privileges to trigger a null pointer dereference and crash the kernel. The flaw arises because the verifier uses the inner map template's max_entries for bounds reasoning at verification time, while the runtime helper operates against a concrete inner map that may have a larger max_entries value. A crafted BPF program exploiting the faulty nullness elision can cause a kernel denial of service. No public exploit code has been identified at time of analysis, and EPSS is low at 0.21%.
Out-of-bounds read in the Linux kernel's Samsung Kalmia USB network driver allows a malicious USB device to crash the kernel via a u16 integer underflow in `kalmia_rx_fixup()`. When a crafted bulk-IN frame is 6-11 bytes long, the subtraction `skb->len - 12` underflows to approximately 65,530, bypassing length validation and causing `memcmp()`, `skb_trim()`, and `skb_pull()` to operate past the end of the 14,000-byte RX buffer. No public exploit or active exploitation (CISA KEV) has been identified; EPSS at 0.23% (14th percentile) confirms minimal exploitation interest.
Memory exhaustion in the Linux kernel's USB CDNSP host controller driver allows local users to trigger a kernel-level memory leak by forcing partial allocation failures in `cdnsp_alloc_stream_info()`. Systems running Linux 5.12 through unpatched stable branches accumulate unreleased `stream_ctx_array` allocations that are never freed, eventually causing availability impact on hosts with CDNSP USB hardware. No public exploit exists, EPSS stands at 0.21%, and the vulnerability carries no confidentiality or integrity impact per the CVSS vector.
Incorrect argument passing in dwc3_ulpi_setup() causes the Linux kernel's DWC3 USB controller driver to pass a raw MMIO register pointer (dwc3->regs, typed as void __iomem *) to dwc3_readl() and dwc3_writel(), which instead expect the containing struct dwc3 * pointer. Because the register accessor functions internally dereference the struct to locate ->regs, supplying ->regs directly results in incorrect memory access during ULPI (USB Low Pin Interface) initialization - flagged by the kernel sparse checker as a type-safety violation across address spaces. The practical impact is a potential kernel panic or silent misread/miswrite of a USB control register, manifesting as an availability failure in systems using DWC3 ULPI USB controllers. No public exploit exists and the issue requires local access to trigger.
Kernel denial-of-service in the Linux USB gadget composite driver crashes the system by triggering a KASAN memory fault in the USB_DT_OTG request handler when the configuration list is empty. The flaw exists because list_first_entry() never returns NULL - making the subsequent config NULL-check dead code - so when cdev->configs is empty during a gadget unbind race or when a driver sets is_otg before registering any configuration, composite_setup() dereferences a garbage pointer and memcpy() copies arbitrary kernel memory into the USB response buffer. No public exploit code has been identified, and EPSS is 0.22% (13th percentile), consistent with the local, race-condition nature of the flaw.
Reference count leak in the Linux kernel USB gadget printer driver (f_printer) allows a local user to trigger a permanent kref increment on every rejected concurrent open attempt. Each call to printer_open() that returns -EBUSY still increments dev->kref, but because VFS never invokes ->release() for a failed open, the reference is never balanced. Repeated exploitation exhausts the reference counter, preventing proper driver teardown and causing availability degradation. No public exploit has been identified at time of analysis.
Incomplete error-path cleanup in the Linux kernel's uss720 USB-to-parallel-port driver leaves a parport device registered after probe failure, creating a dangling stale pointer backed by freed private data. Systems where a Belkin F5U002 or similar USS720-based adapter is attached and causes get_1284_register() to fail during uss720_probe() are left with an orphaned kernel parport entry and a reserved parport slot, which can lead to a kernel crash when the stale pp->private_data pointer is later dereferenced. No active exploitation has been identified; the bug was discovered via static-analysis research, and patches are available across all major Linux stable branches.
DMA mapping leak in the Linux kernel's MTU3 USB device controller driver causes local denial-of-service on MediaTek SoC platforms. When mtu3_gadget_queue() maps a USB transfer request via DMA before checking whether the QMU GPD ring has capacity, then mtu3_prepare_transfer() fails and returns -EAGAIN, the error path bypasses the mtu3_req_complete() cleanup helper, permanently stranding the DMA mapping. Repeated exhaustion of the IOMMU aperture can destabilize or crash the kernel. No public exploit code exists and EPSS at 0.22% (13th percentile) confirms negligible exploitation interest; the impact is a local availability-only issue confined to MediaTek USB gadget hardware.
The keyspan_pda USB-serial driver in the Linux kernel transmits kernel memory beyond the tty write buffer to an attached USB device due to an incorrect write() return value introduced with write FIFO support. After commit 034e38e8f687, the driver returns the byte count submitted to the USB device rather than the count accepted from the caller; the TTY line discipline interprets this inflated count as authorization to advance its read pointer past the buffer boundary, exposing adjacent kernel memory. Affected stable trees span Linux 5.15 through 7.1 and the 7.2-rc3 development branch, with patches released across all maintained stable series; no public exploit or active exploitation is confirmed, and EPSS is 0.21% (12th percentile).
Availability loss in the Linux kernel's USB serial digi_acceleport driver allows a local user to permanently halt data reception on a Digi AccelePort serial port until the USB device is physically reconnected or the driver is rebound. The bug arises from a missing URB resubmission path: when a port is closed while in a throttled state, the read URB is never re-queued, leaving the port silently deaf to incoming data upon next open. No public exploit has been identified and EPSS sits at 0.22% (13th percentile), reflecting the niche hardware dependency and local-only attack surface.
Hard lockup in the Linux kernel's digi_acceleport USB serial driver causes full system freeze when a Digi AccelePort device is physically disconnected during active I/O. The driver's OOB (out-of-band) command path loops indefinitely with interrupts disabled upon persistent URB submission failure, resulting in a kernel hard lockup that effectively crashes the host. Systems with this specific USB-to-serial adapter are affected across a wide range of stable kernel branches from 2.6.12 onward; patches have been released across all active stable series.
Memory leak in the Linux kernel USB ULPI (Universal Serial Bus Link Interface) subsystem allows a local low-privileged user to trigger repeated ULPI device registration failures that leak kernel memory, potentially leading to system instability or denial of service. Affected kernel versions span from 4.2 through multiple pre-patch stable branches, with fixes backported to 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc3. No public exploit or active exploitation has been identified at time of analysis; the EPSS score of 0.22% (13th percentile) reflects minimal probability of weaponization.
NULL pointer dereference in the Linux kernel's usbip virtual UDC (vudc) subsystem crashes the kernel when FunctionFS AIO cancellations are processed. The `vep_alloc_request()` function never initialized `vrequest->udc`, so any AIO cancellation arriving at `vep_dequeue()` - such as one triggered by a host-side `usbip attach` - dereferences a null pointer and produces a kernel oops, denying service to the guest system. A local attacker with low privileges on a system configured for USB/IP with FunctionFS AIO endpoints can reliably reproduce this crash. No public exploit code exists, and EPSS at 0.22% (13th percentile) confirms the path has not seen meaningful exploitation despite the bug reportedly existing for approximately ten years since Linux 4.7.
Kernel memory leak in the Linux USB gadget FunctionFS (f_fs) subsystem allows a local low-privileged user to slowly exhaust kernel memory by repeatedly triggering DMA buffer transfers via the ffs_dmabuf_transfer() code path. Affected kernels span from the commit introducing DMA buffer sharing (7b07a2a7ca02) through versions prior to 6.12.96, 7.1.4, and 7.2-rc3. The root cause is a missing dma_fence_put() call after dma_resv_add_fence(), leaving the initial kref permanently outstanding and causing ffs_dma_fence objects to accumulate without ever being freed. No public exploit has been identified at time of analysis.
The USB gadget FunctionFS (f_fs) subsystem in the Linux kernel fails to initialize the endpoint direction field (epfile->in) until USB host connection, leaving it zero when userspace performs early DMA ioctl calls such as FUNCTIONFS_DMABUF_ATTACH before a host connects. This incorrect DMA direction causes kernel-mode availability loss - crashes or hangs - on systems actively using FunctionFS-based USB gadgets with DMABUF. No public exploit has been identified, and EPSS probability stands at 0.21% (11th percentile), reflecting very low opportunistic exploitation risk.
The block device layer in Linux Kernel hangs indefinitely during NVMe surprise removal when `bdev_mark_dead()` is called with `surprise=true`, because a missing guard causes `sync_blockdev()` to be invoked on an already-dead device, permanently blocking `folio_wait_writeback()`. Triggered via `nvme_reset_work()` I/O-queues-lost path, the bug wedges the NVMe reset worker and every task waiting on it, requiring a system reboot to recover. Discovered by FuzzNvme (syzkaller + FEMU fuzzing framework); no public exploit identified at time of analysis.
NULL pointer dereference in the Linux kernel's mt76 driver for MediaTek mt7921/mt7925 WiFi chipsets causes a kernel panic (denial of service) via a race condition in Channel Switch Announcement (CSA) beacon processing. When a CSA beacon is received, cfg80211 queues a wiphy work item; if the station disconnects or the channel context is torn down before the work item executes, the driver's dev->new_ctx pointer is already NULL but dereferenced unconditionally in mt7921_channel_switch_rx_beacon() and mt7925_channel_switch_rx_beacon(). EPSS is 0.20% (10th percentile) and no public exploit or CISA KEV listing is identified at time of analysis.
Reference count leak in the Linux kernel NVMe-oF target RDMA subsystem causes local denial of service on affected storage servers. When nvmet_rdma_queue_connect() calls nvmet_rdma_find_get_device() and the host queue backlog is exceeded (NVME_SC_CONNECT_CTRL_BUSY), the kref acquired by kref_get() is never released via the put_device cleanup path. Repeated triggering of this code path by a local low-privileged process causes progressive resource exhaustion, ultimately rendering the affected device unreclaimable and degrading availability. No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile).
Sensitive cryptographic key material handled by the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver was unconditionally emitted to the kernel ring buffer via unguarded hex-dump calls in *_setkey() and gen_split_key(), exposing raw key bytes to any local user with dmesg access on kernels built with CONFIG_DYNAMIC_DEBUG. The exposure affects NXP CAAM-equipped platforms (i.MX, QorIQ SoC families) running kernel versions from approximately 5.3 through the fix commits across all active stable branches. No public exploit code exists and EPSS probability is 0.22%, but key material disclosure on a crypto-accelerator driver carries genuine confidentiality risk that the vendor-assigned CVSS (C:N/I:N/A:H) incorrectly characterizes - the real primary impact is confidentiality loss, not availability.
Null pointer dereference in the Linux kernel's chacha20poly1305 crypto template allows a local unprivileged user to crash the system. The flaw exists in chachapoly_create(), which passes the unvalidated return value of crypto_attr_alg_name() directly to strcmp() when the poly1305 sub-argument is absent in a malformed template string; since that function returns an ERR_PTR on failure, the subsequent strcmp() call dereferences an invalid pointer, triggering a kernel panic. Patches are available across multiple stable branches; no public exploit or active exploitation has been identified at time of analysis.
Denial of service in the Linux kernel's AMD CCP/SEV driver allows a local low-privileged process to crash a KVM hypervisor host by submitting SEV firmware ioctls to /dev/sev, which incorrectly triggers SNP initialization and zeroes the MSR_VM_HSAVE_PA register, causing a general protection fault on the next VMRUN and terminating all running virtual machines. Affected kernels span from the introducing commit (ceac7fb89e8da465aec3ac3c20477f912f5c3a6c) through the fixed stable releases 6.12.96, 6.18.39, and 7.1.4. No public exploit has been identified and EPSS is 0.22%, but the blast radius - crashing the host and all its tenant VMs - warrants prompt patching on AMD EPYC KVM deployments.
Crash of a Linux KVM host is achievable by a local low-privileged user via the /dev/sev ioctl interface on systems running AMD SEV-SNP firmware. When SNP_COMMIT is issued after a prior failed SEV initialization, the crypto/ccp driver incorrectly proceeds with SNP initialization, zeroing out MSR_VM_HSAVE_PA - the model-specific register holding the AMD SVM host save-area pointer. Any subsequent VMRUN instruction by KVM for an already-running VM will generate a General Protection Fault, crashing the host and terminating all guest workloads. No public exploit has been identified at time of analysis; patch commits are available across multiple stable branches.
Uncontrolled SNP initialization in the Linux kernel's CCP/SEV driver allows a local low-privileged user with /dev/sev access to crash the host kernel on AMD SEV/SNP-capable systems running KVM. Sending a SNP_VLEK_LOAD ioctl when SNP has not been initialized triggers an unnecessary initialization/shutdown wrapper that zeros MSR_VM_HSAVE_PA globally; the subsequent VMRUN instruction for any active KVM guest then triggers a General Protection Fault, bringing down the host and terminating all co-hosted VMs. No public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects the specialized attack environment required.
Host crash vulnerability in the Linux kernel's AMD SEV/SNP subsystem allows a local low-privileged user to take down a virtualization host by triggering SNP re-initialization via the `/dev/sev` `SNP_CONFIG` ioctl when SNP has previously failed to initialize. When re-initialization executes while KVM guests are running, it zeroes `MSR_VM_HSAVE_PA` globally across all CPUs; the next VMRUN instruction on any active guest then raises a General Protection Fault, crashing the host kernel and terminating all hosted VMs. No public exploit identified at time of analysis; EPSS is 0.22% at the 13th percentile, consistent with low opportunistic exploitation probability.
Silent error propagation in the Linux kernel's CTR_DRBG implementation (`drbg_ctr_generate()`) causes the function to return a success code while leaving its output buffer uninitialized when an internal operation fails. Code that relies on the generated random material receives garbage data, which can trigger kernel crashes or hangs depending on how the uninitialized buffer is consumed downstream. No public exploit has been identified; patched stable kernel releases are available across all active longterm-support branches.
PMD-sized vmemmap pages are silently leaked in the Linux kernel's x86 memory management subsystem following a regression introduced in commit bf9e4e30f353, which replaced __free_pages() with pagetable_free() for vmemmap page freeing. Because vmemmap pages are not compound pages (outside of HVO, which does not apply here), pagetable_free() resolves compound_order() to zero and frees only the first page of a PMD-sized block, leaking the remaining pages on every memory section removal. Systems running affected kernel versions (6.18.7-6.18.38, 6.19 series through 7.1.3) that perform x86 memory hotplug operations will experience progressive physical memory loss; no public exploit has been identified and this vulnerability is not in CISA KEV.
Reference count leak in the Linux kernel's SCMI regulator driver can exhaust kernel memory resources, leading to a denial-of-service condition on affected systems. The flaw resides in scmi_regulator_probe(), where of_find_node_by_name() acquires a reference on a device-tree node but the corresponding of_node_put() release call is omitted on the error path when process_scmi_regulator_of_node() fails, permanently leaking the reference. Exploitation requires local access; no public exploit code has been identified and EPSS probability stands at 0.21%, indicating very low likelihood of opportunistic exploitation.
Null pointer dereference in the Linux kernel module decompression path crashes the kernel when a local user loads a compressed module under memory pressure. The flaw exists across multiple stable kernel branches and was introduced at commit b1ae6dc41eaa; patches are now available for all affected stable trees. No active exploitation confirmed (not in CISA KEV), and EPSS at 0.21% (12th percentile) reflects very low exploitation probability, consistent with the local-only, condition-dependent attack surface.
NULL pointer dereference in the Linux kernel's `page_ext` memory iteration API crashes systems during dynamic memory hotplug operations. The `page_ext_iter_next()` function fails to enforce the PFN boundary, advancing the iterator index past `__pgcount` and calling `page_ext_lookup()` on an uninitialized memory section, triggering a kernel panic. With EPSS at 0.21% (11th percentile) and no CISA KEV listing, real-world exploitation is low-probability and operationally constrained to environments actively performing memory hotplug, such as cloud hypervisors or NUMA-heavy servers with memory ballooning.
Incorrect idmap handling in the Linux kernel memory management subsystem causes `owner_or_capable()` checks inside `mincore()` and `madvise(MADV_PAGEOUT)` to use the identity no-op mount idmap (`nop_mnt_idmap`) rather than the actual mount's idmap, producing incorrect ownership evaluations on idmapped mounts. Local users with low privileges on Linux 5.12+ systems configured with idmapped mounts may trigger incorrect authorization decisions that deny legitimate memory management operations, with the most impactful edge case occurring on 0444 files where neither the idmap check nor the fallback `file_permission(MAY_WRITE)` path succeeds. No public exploit is known and EPSS is 0.21% (11th percentile), reflecting minimal real-world exploitation risk despite the Linux kernel's ubiquitous deployment footprint.
Atomic memory reserve exhaustion in the Linux kernel's iommufd subsystem allows a local low-privileged user to trigger kernel-side memory pressure by allocating virtual event queues whose depth is fully user-controlled, potentially destabilizing the system through GFP_ATOMIC reserve depletion. The root cause is memory allocation for veventq entries occurring inside a spinlock, drawing from atomic reserves never intended for user-directed exhaustion. No active exploitation is confirmed and EPSS sits at 0.21% (11th percentile); upstream fix commits are available across the 6.18.x, 7.1.x, and 7.2-rc1 stable series.
Memory exhaustion in the Linux kernel iommufd subsystem allows a local low-privileged user to crash the system by passing an uncapped veventq_depth value to iommufd_veventq_alloc(), which previously accepted any non-zero integer up to U32_MAX without validation. Exploitation requires local access with low privileges on a system where the iommufd device is accessible, making this primarily a concern for multi-tenant or virtualization hosts. No public exploit has been identified and EPSS at 0.21% (11th percentile) reflects minimal real-world exploitation interest at time of analysis.
Infinite loop in the Linux kernel iommufd subsystem's fault read path allows a low-privileged local user to pin a CPU core at 100% utilization while holding a kernel mutex, causing a local denial of service. The flaw exists in iommufd_fault_fops_read(), where a copy_to_user() failure in the inner list traversal loop fails to propagate its error code to the outer while loop, which then re-fetches the same fault group and retries the failing operation indefinitely with fault->mutex held. No public exploit is identified at time of analysis; EPSS indicates a very low 0.21% exploitation probability, and this CVE is not listed in the CISA KEV catalog.
Unbounded cache invalidation parameters in the Linux kernel iommufd subsystem allow a local low-privileged user to pin a CPU indefinitely or trigger a soft-lockup watchdog fault, resulting in a kernel denial of service. The iommufd_hwpt_invalidate() ioctl accepts user-supplied entry_len and entry_num values bounded only by U32_MAX, enabling an uninterruptible gigabyte-scale memory scan or a no-reschedule VT-d flush loop. No public exploit has been identified and EPSS stands at 0.21% (11th percentile); the vulnerability is not listed in CISA KEV, indicating low active exploitation pressure.
Null pointer dereference in the Linux kernel's KVM arm64 nested virtualization subsystem allows a local low-privileged attacker to crash the host kernel via a race condition in VNCR pseudo-TLB invalidation. The function kvm_invalidate_vncr_va() dereferences the VNCR pseudo-TLB pointer without first verifying allocation or validity, unlike its companion kvm_invalidate_vncr_ipa(). Exploitation results in a kernel panic that disrupts all virtual machines on the affected host; no public exploit has been identified at time of analysis, and EPSS of 0.21% (11th percentile) reflects minimal observed exploitation activity.
KVM's SEV-SNP guest initialization path in the Linux kernel can trigger a host kernel panic when processing CPUID data backed by a read-only memory mapping. The flaw affects hypervisors running Linux 7.0.x before 7.1.4 where a local, low-privileged VMM process can cause KVM to write corrected CPUID values into a read-only source page after AMD's trusted firmware rejects the userspace-supplied data. No public exploit has been identified and EPSS sits at 0.20% (10th percentile), consistent with a niche, difficult-to-trigger local denial-of-service condition with no confirmed active exploitation.
KVM arm64 in the Linux kernel leaks a Page Frame Number reference when kvm_translate_vncr() races an MMU notifier, allowing a local low-privileged attacker to gradually exhaust kernel memory and cause a denial of service on affected arm64 hypervisor hosts. The vulnerability is specific to arm64 systems running KVM with VNCR (Virtualization Non-Cached Region) active, and requires precise race-condition timing (AC:H). No public exploit has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) confirms this remains a low-probability exploitation target.
System hang vulnerability in the Linux kernel's NXP i.MX LPI2C driver arises from a race condition during suspend/resume power transitions. Specifically, periodic workqueues in I2C client drivers can fire I2C transfers between the suspend_noirq and resume_noirq phases, when clock and pinctrl resources have already been disabled or are not yet restored. Accessing I2C controller registers in this state causes the system to hang. The fix marks the adapter as suspended during noirq suspend, blocking transfers until hardware resources are fully restored. No public exploit or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Division-by-zero and arithmetic underflow flaws in the Linux kernel's elan_i2c touchpad driver cause kernel panic during device probe on systems equipped with Elan I2C touchpad hardware. When device firmware or device tree supplies zero values for x_traces or y_traces, the driver performs an unguarded integer division by zero, crashing the kernel. A secondary arithmetic underflow causes the input subsystem to report a massively incorrect touch width value to userspace when physical device dimensions fall below a hardcoded threshold. No public exploit exists and EPSS is 0.22% (13th percentile), reflecting the hardware-specific, limited-scope nature of this flaw.
Integer wrap in the FUSE subsystem's prune notification handler crashes 32-bit Linux kernels when a malicious or compromised FUSE daemon sends a crafted FUSE_NOTIFY_PRUNE message. On 32-bit platforms where size_t is 32 bits, multiplying a daemon-controlled count value of 0x20000000 by sizeof(u64) wraps to zero, causing the payload length check to pass with no actual nodeid data present; the subsequent copy loop then triggers a BUG_ON assertion, inducing a kernel panic. No public exploit has been identified at time of analysis and EPSS stands at 0.21% (11th percentile), consistent with the narrow exploitation window of 32-bit-only kernels and requiring FUSE daemon control.
Error-code mishandling in the Linux kernel fuse-uring subsystem causes a failed copy_from_user() in fuse_uring_commit to be silently treated as success, leaving callers processing uninitialized or partial output arguments. Local users with low-privilege access on kernels from 6.14 through pre-patch versions can trigger a kernel panic or crash, yielding a local denial of service. No public exploit has been identified and the EPSS score of 0.21% (11th percentile) indicates no meaningful active exploitation activity at time of analysis.
Kernel panic in the Linux kernel's fuse-uring subsystem allows a local low-privileged attacker to crash the system by triggering a NULL pointer dereference through crafted io_uring cancellation sequences against a FUSE filesystem. The root cause is that fuse_uring_cancel() moves cancelled entries with no attached requests to the ent_in_userspace list, where ent_list_request_expired() unconditionally dereferences ent->fuse_req, crashing the kernel. No public exploit code exists and EPSS sits at 0.21% (11th percentile), indicating negligible opportunistic exploitation pressure; however, the low privilege requirement and local DoS impact make it relevant for multi-tenant or shared-access Linux environments.
Resource exhaustion and denial of service in the Linux kernel's fuse-uring subsystem allows a local authenticated user to permanently hang FUSE requests and stall all background filesystem operations for the affected connection. The flaw was introduced with the fuse-uring interface in Linux 6.14 and affects stable series through 6.18.38 and 7.1.3; patched releases 6.18.39, 7.1.4, and mainline 7.2-rc1 are available. No public exploit has been identified at time of analysis (EPSS 0.21%, 11th percentile) and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation.
NULL pointer dereference in the Linux kernel's fuse-uring subsystem enables a local low-privilege attacker to crash the kernel, causing a denial of service. The flaw arises from a state management race in the fuse-uring request lifecycle: when a copy into a userspace io_uring ring buffer fails, the entry's request pointer is nullified but the entry remains on the active queue, allowing the expiration scanner to dereference the NULL pointer in a narrow race window. No public exploit has been identified and EPSS stands at 0.21% (11th percentile), indicating low likelihood of opportunistic exploitation.
XFS filesystem quota iteration in the Linux kernel wraps a 32-bit quota ID back to zero when a disk quota entry (dquot) exists at XFS_DQ_ID_MAX, producing an infinite loop and local denial of service. Systems running Linux 6.8 and later with XFS quotas enabled are vulnerable if a dquot is present at the maximum 32-bit ID boundary (0xFFFFFFFF). No active exploitation has been identified; patched releases 6.12.96, 6.18.39, 7.1.4, and 7.2-rc4 are available from the kernel stable tree.
Kernel availability degradation in the Linux kernel ntb_hw_epf driver occurs during module teardown when BAR_PEER_SPAD and BAR_CONFIG share a single PCI BAR, causing ntb_epf_pci_remove() to call pci_iounmap() on an offset address that was never independently registered as a vm_area. Systems running Linux 6.0 through at least 6.18.37 with the ntb_hw_epf module loaded under this BAR-sharing configuration will generate a kernel warning ('Trying to vunmap() nonexistent vm area') upon driver removal. No public exploit exists and EPSS probability is 0.16% (6th percentile), consistent with an availability-only defect requiring specific hardware topology and local privilege to trigger.
NULL pointer dereference in the Linux kernel's `copy_process()` function allows a local low-privileged user to crash the host kernel via a denial-of-service condition. During `fork()`, the child process inherits the `PF_BLOCK_TS` process flag from the parent while the child's `blk_plug` pointer is simultaneously reset to NULL, breaking the invariant that `PF_BLOCK_TS` set implies `current->plug != NULL`. Any downstream block I/O subsystem code path that dereferences `current->plug` without a NULL guard in the child will trigger a kernel panic. No public exploit is identified at time of analysis, and EPSS at 0.16% (5th percentile) reflects minimal observed exploitation interest.
Stack buffer address truncation in the MIPS DEC 64-bit Linux kernel platform layer causes kernel panics when the initial console handler is invoked from a non-initial kernel thread. The buffer resides on a stack allocated in the XKPHYS 64-bit memory segment, whose address is silently truncated by legacy 32-bit DEC firmware, producing an invalid pointer dereference and a fatal kernel exception. No public exploit identified at time of analysis and no active exploitation is confirmed; patches are available across multiple stable kernel branches including 5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3, and 7.2-rc1.
Shutdown and reboot operations hang indefinitely on LoongArch-based Linux systems due to a missing RCU notification in stop_this_cpu(), exposing multi-CPU LoongArch hosts running affected kernel stable branches to an unrecoverable hang during system halt or reboot. The vulnerable path is triggered when smp_send_stop() parks secondary CPUs without calling rcutree_report_cpu_dead(), after which any irq_work_sync() call in the shutdown sequence invokes synchronize_rcu() - which then blocks forever waiting for quiescent states from CPUs that are permanently parked with interrupts disabled. No public exploit identified at time of analysis; EPSS is 0.16% at the 6th percentile and the CVE is absent from CISA KEV, consistent with this being a reliability defect rather than a security exploitation path.
MIPS SMP systems running affected Linux kernel versions hang indefinitely during reboot or shutdown due to a missing RCU subsystem notification in the stop_this_cpu() shutdown path. When smp_send_stop() parks secondary CPUs, it correctly removes them from the scheduler's view via set_cpu_online(false) but never calls rcutree_report_cpu_dead(), leaving RCU waiting for quiescent states that can never arrive. The defect became reliably triggered after commit 91840be8f710 was backported to stable branches starting with 6.18.34, causing irq_work_sync() to invoke synchronize_rcu() on MIPS systems that lack an irq_work self-IPI, with no public exploit identified at time of analysis.
Improper ordering of resource assignment in the Linux kernel's memory hotplug subsystem causes a spurious WARN_ON during error recovery in __add_memory_block(). When xa_store() fails under memory pressure, device_unregister() is invoked while mem->altmap is already set, triggering memory_block_release() with a non-NULL altmap pointer and producing a kernel warning that can lead to system instability or crash. Affected systems are those running Linux kernel versions from the introduction commit 1a8c64e110435e44e71bcd50a75663174b575f22 through the respective fix commits across the 6.6, 6.12, 6.18, 7.0, and 7.1 stable series; patches are confirmed available. No public exploit has been identified and EPSS stands at 0.16% (6th percentile), consistent with a stability regression rather than an actively targeted security flaw.
Resource leaks and teardown race conditions in the Linux kernel's gpio-rockchip driver expose Rockchip-based systems to kernel panic and memory exhaustion. Three distinct defects exist in the driver's remove path: an unreleased debounce clock reference, a stale chained IRQ handler left registered after driver removal, and an unfreed IRQ domain with its generic chips. The IRQ handler defect is the most severe - if a stray GPIO interrupt arrives after the driver is unbound, the kernel dereferences a stale function pointer and panics. No public exploit identified at time of analysis; EPSS of 0.16% (5th percentile) reflects the niche, hardware-specific exploitation surface.
Incorrect pointer passing in the Linux kernel's igorplugusb infrared USB receiver driver causes the USB core to misinterpret raw pointer bytes as a USB control setup packet, triggering a BOGUS control direction warning and a kernel-level denial of service. The regression was introduced by commit eac69475b01f, which allocated ir->request as a pointer for DMA coherency but left the usb_fill_control_urb() call referencing &ir->request (the pointer variable's address) rather than ir->request (the allocated struct usb_ctrlrequest). No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.17% (6th percentile), reflecting minimal real-world exploitation probability.
Deadlock vulnerability in the Linux kernel's GPIO shared proxy subsystem allows a local, low-privileged user to cause a system hang by triggering removal of a shared GPIO proxy's parent device. The root cause is an overly-wide mutex critical section introduced in commit 710abda58055, where the gpio_shared_entry mutex was held for too long, creating a locking inversion scenario during parent device teardown. No public exploit code exists and no active exploitation has been identified; the fix narrows the critical section to protect only offset reads.
Division-by-zero kernel panic in the Linux kernel's i2c-davinci driver causes a deterministic system crash on TI DaVinci SoC-based hardware when the 'clock-frequency' device tree property is absent. The root cause is a unit mismatch: DAVINCI_I2C_DEFAULT_BUS_FREQ was defined in kHz (100) but the probe path divided it by 1000, producing dev->bus_freq = 0, which then triggers an unconditional divide-by-zero during clock divider calculation. Availability impact is complete (kernel panic), but exploitation requires specific embedded hardware context; no public exploit exists and EPSS is 0.15%, consistent with a reliability defect rather than an adversarially exploitable flaw.
NULL pointer dereference in the Linux kernel's pch_uart serial driver allows a local low-privileged user to crash the kernel by triggering a failed DMA memory allocation in dma_handle_rx(). Systems running Intel PCH (Platform Controller Hub) hardware with the pch_uart driver active and DMA enabled are vulnerable to denial of service via kernel panic. No public exploit or CISA KEV listing exists; with an EPSS of 0.17% (6th percentile), real-world exploitation risk is low, but patches are confirmed across multiple stable kernel branches.
Use-after-free in the Linux kernel USB UVC gadget driver allows a privileged local user to crash the kernel by racing configfs extension-unit teardown against the bind-time list walks in uvc_function_bind(). The bind path walks opts->extension_units without holding opts->lock, while the configfs write path (uvcg_extension_drop) correctly holds the lock, creating an asymmetric locking pattern that enables a freed struct uvcg_extension to be dereferenced. No public exploit exists and EPSS sits at 0.16% (5th percentile), but patches are confirmed across multiple stable kernel branches including 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1.
Out-of-bounds memory access in the Linux kernel's drm/msm DSI display subsystem causes a kernel panic on systems with Qualcomm MSM DSI 6G hardware. The io_offset adjustment applied to the mapped IO base address is not reflected in the ctrl_size value passed to the snapshot dump routine, so msm_disp_snapshot_add_block reads past the end of the mapped region and crashes the kernel. Only devices with Qualcomm MSM DSI 6G display hardware running an unpatched kernel from 5.14 onward are affected; no public exploit exists and EPSS of 0.17% confirms very low exploitation probability.
Kernel panic via NULL pointer dereference in the Linux tps65219 PMIC regulator driver crashes affected systems when a hardware IRQ fires on the device, producing a local denial-of-service condition. The regression was introduced by commit 64a6b577490c, which removed the helper function `tps65219_get_rdev_by_name()` and inadvertently eliminated the only code path that assigned `irq_data.rdev`, leaving the pointer uninitialized for every registered IRQ. Systems running Linux kernel versions from that commit through the stable-branch fix points (6.18.34 and 7.0.11) on hardware equipped with the TI tps65219 PMIC are affected; no public exploit has been identified and the EPSS score of 0.17% reflects low exploitation probability.
Broadcast TLB flush in the Linux kernel x86 memory management subsystem triggers a General Protection Fault (#GP) on AMD INVLPGB-capable systems booted with the 'nopcid' parameter, causing a kernel panic and local denial of service. When PCID is disabled via 'nopcid', CR4.PCIDE is not set, but the INVLPGB broadcast TLB invalidation path remains enabled; once a memory descriptor becomes active across more than three CPUs, the kernel assigns it a global ASID and issues INVLPGB with a non-zero PCID - an illegal state that crashes the kernel. No public exploit exists, EPSS is 0.17% (6th percentile), and this is not in CISA KEV; real-world impact is constrained to the uncommon 'nopcid' boot configuration on AMD hardware.
NULL pointer dereference in the Linux kernel ethtool PHY subsystem allows a local low-privileged user to trigger a kernel panic (denial of service) by unbinding a PHY driver via sysfs while the device remains registered in the ethtool link topology. Affected kernel versions span the 6.16, 6.18.x, 7.0.x, and 7.1 stable branches; upstream fixes are available in commits targeting 6.18.34 and 7.0.11. No public exploit code exists and no active exploitation has been identified at time of analysis, consistent with EPSS at 0.17% (6th percentile).
NULL pointer dereference in the Linux kernel ACPI platform driver subsystem crashes the kernel when 13 core ACPI drivers are force-matched to devices lacking an ACPI companion object. The root cause is the absence of ACPI_COMPANION() or ACPI_HANDLE() null-checks in affected drivers, combined with the kernel's device_match_driver_override() mechanism which can bypass normal device-ID matching. Impact is limited to local denial of service (kernel panic); no active exploitation is confirmed (not in CISA KEV) and EPSS sits at 0.17% (6th percentile), placing this firmly in the maintenance-fix rather than urgent-remediation category.
Kernel denial-of-service in the Linux kernel's device property firmware node subsystem results from fwnode_init() failing to zero the secondary pointer before use, leaving it with uninitialized stack or heap garbage that may be incorrectly treated as a valid pointer and dereferenced in functions such as dev_to_swnode(). Local users with low privileges on any kernel version between the introducing commit and the respective stable patch releases can trigger a kernel panic, causing system downtime. No public exploit code exists and EPSS is 0.17% (7th percentile), reflecting negligible observed exploitation activity.
NULL pointer dereference in the Linux kernel's Qualcomm Adreno GPU driver (drm/msm/a6xx) crashes the kernel when `a8xx_hfi_send_perf_table()` proceeds to dereference a kzalloc() return value without first validating it against NULL. Systems running affected kernel versions with Qualcomm Adreno 6xx or 8xx GPU hardware - primarily Snapdragon-based ARM devices, smartphones, and servers - can be crashed by a local low-privileged user who triggers the GPU HFI performance table code path under memory pressure. EPSS of 0.16% (5th percentile) and no CISA KEV listing confirm no known active exploitation; patches are available in stable kernel releases 7.0.11 and 7.1.
Kernel panic in the Linux kernel's PowerPC-specific arch_irq_work_raise() function crashes affected systems when machine check exception handlers invoke the function from real mode, a context where virtual memory translation is disabled and preempt_count access via a virtual address faults with a bad area data access error. PowerPC deployments running kernel versions prior to 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1 are affected; x86, ARM, and other non-PowerPC architectures are completely unaffected. No public exploit code exists and EPSS is 0.17% (7th percentile), consistent with a hardware-architecture-specific reliability defect rather than an attacker-driven threat; the vulnerability does not appear in the CISA KEV catalog.
Missing mutex lock in the Linux kernel lm90 hwmon driver's alert handler creates a race condition that triggers an interrupt storm on systems with LM90-family temperature sensors. When lm90_alert() fires concurrently with a sysfs write operation - both modifying the shared data->config register cache - the sysfs path's restore of data->config silently overwrites the alert handler's hardware-disable flag, re-enabling the alert line while the alarm remains active. The result is uncontrolled interrupt escalation causing system availability impact. No public exploit exists, EPSS is 0.17% (6th percentile), and no KEV listing is present; patched releases 6.18.34, 7.0.11, and 7.1 are available.
NULL pointer dereference in the Linux kernel's iwlwifi MLD (Multi-Link Device) Wi-Fi driver allows a local low-privileged user to crash the kernel, resulting in a denial-of-service condition. The flaw resides in `iwl_mld_remove_link`, where the `link->fw_id` field is read before the `link` pointer is validated for NULL, enabling a kernel panic on affected systems with Intel wireless hardware. No public exploit code exists and the vulnerability is not listed in CISA KEV; patches are available in stable kernel releases 6.18.34, 7.0.11, and 7.1.
Availability loss in the Linux kernel's Tree SRCU (Sleepable Read-Copy-Update) subsystem causes system hangs by queuing workqueue handlers on CPUs that have never been-and may never be-online. Affected kernels spanning commit 61bbcfb50514 through the fix points can attempt to invoke callbacks for CPUs absent from cpu_possible_mask, a condition that is fatal on s390 (IBM mainframe) architectures not hardened to handle such scheduling anomalies. No public exploit code exists and EPSS places exploitation probability at 0.15% (5th percentile), consistent with a stability defect rather than a security attack surface; patches are available in Linux 7.0.11 and 7.1.
Cache-clearing denial-of-service in NLnet Labs Unbound through 1.25.1 allows a remote attacker who controls a DNS delegation to indefinitely and repeatedly flush Unbound's message and rrset caches without sending a single spoofed packet. The attack exploits a logic flaw in how the iterator processes in-bailiwick glue records containing the unspecified address 0.0.0.0/::0: on Linux, such queries are routed via loopback and answered by 127.0.0.1, creating an IP mismatch that the unwanted-reply counter tallies until the configured threshold triggers a defensive cache clear - which resets the counter, enabling the loop to continue indefinitely. No public exploit identified at time of analysis; CVSS 3.1 scores this 5.3 (Medium) with Low availability impact and no confidentiality or integrity impact.
NULL pointer dereference in the Linux kernel's DualPI2 traffic scheduler crashes the kernel when GSO segmentation accounting mismatches occur under a QFQ parent queueing discipline. Systems running Linux kernels prior to 6.18.39, 7.1.4, or 7.2-rc1 with DualPI2 configured as a child of QFQ are vulnerable to a local denial-of-service via kernel panic. No public exploit code exists and EPSS is 0.15% (5th percentile), reflecting the niche configuration required; however, the availability impact is total (kernel crash) when conditions are met.
Incorrect error-path logic in the Linux kernel's i2c-i801 SMBus driver allows a local, low-privileged user to trigger a hardware state machine corruption leading to a system-wide hung task panic. When i801_check_pre() returns -EBUSY because the BIOS/ACPI firmware legitimately holds the SMBus controller, the driver unconditionally writes to SMBHSTSTS hardware registers without owning the controller, destroying the firmware's in-progress transaction and permanently corrupting the SMBus state machine. This produces an infinite 'SMBus is busy' error log flood, causes a console livelock that starves processes competing for mmap_lock, and ultimately triggers the hung task watchdog. No public exploit is identified at time of analysis; EPSS is 0.17% (6th percentile) and the vulnerability is not in CISA KEV.
Kernel panic via NULL dereference in the Linux kernel BPF subsystem affects systems compiled with CONFIG_BPF_LSM=y where the BPF LSM is not activated at boot. A locally authenticated user with low privileges can create a BPF_MAP_TYPE_INODE_STORAGE map under this misconfigured state, causing bpf_inode() to alias the struct rcu_head.func callback pointer; when map cleanup nulls this aliased pointer, rcu_do_batch() subsequently attempts an instruction fetch at address 0x0, triggering an immediate kernel panic and complete system denial of service. No public exploit is identified at time of analysis; EPSS sits at 0.14% (4th percentile), consistent with the narrow triggering conditions required.
NULL pointer dereference in the Linux kernel's team network driver (net/team/team_core.c) allows a local attacker with CAP_NET_ADMIN to crash the kernel by racing a mode change against concurrent packet transmission. The vulnerability arises because __team_change_mode() wipes team->ops via memset() before reinstalling safe dummy handlers, creating a window where team_xmit() running under RCU on a parallel CPU can invoke a NULL function pointer. No public exploit code exists and the issue is not listed in CISA KEV, but the availability impact is total (kernel panic), and the fix is present in upstream stable commits.
NULL pointer dereference in the Linux kernel XFS log recovery path allows a local attacker to crash the kernel by mounting a crafted XFS filesystem image. The flaw exists in xlog_recover_reorder_trans() at fs/xfs/xfs_log_recover.c:1836, where a committed log transaction containing zero regions leaves ri_buf NULL, causing a fatal dereference when ITEM_TYPE() is called during recovery. EPSS is 0.16% (5th percentile) and no active exploitation has been observed; the vulnerability was discovered through an AI-assisted code audit, not in-the-wild activity.
Sysfs group corruption in the Linux kernel's kernfs/sysfs subsystem can cause local denial of service when a pre-existing attribute group directory is silently deleted during a failed update operation. When `sysfs_update_group()` encounters an allocation failure (-ENOMEM) in `create_files()`, the cleanup code in `internal_create_group()` calls `kernfs_remove(kn)` on a kernfs node obtained via `kernfs_find_and_get()` - a directory that existed before the call - rather than restricting removal to directories it created. This logic error, affecting multiple stable kernel branches prior to the respective fix commits, is not in CISA KEV, carries an EPSS of 0.17% (6th percentile), and no public exploit has been identified.
Reference leak in the Linux kernel DAMON sysfs-schemes subsystem allows a local low-privilege attacker to cause a denial of service through accumulated cgroup object reference exhaustion. Affected are kernel builds from Linux 6.3 (commit 29cbb9a13f05b20f0777c60db9603730b487a4e0) through stable branches prior to 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1, on systems where DAMON is active and cgroup-path-based memory schemes are configured via sysfs. No public exploit has been identified and EPSS is 0.16% (5th percentile), consistent with a kernel resource-management flaw requiring specific local conditions.
NULL pointer dereference in the Linux kernel's EFI runtime subsystem crashes affected systems when ACPI Platform Runtime Mechanism (PRM) handlers are invoked during early boot before the EFI runtime workqueue has been allocated. Systems with EFI PRM-capable firmware running unpatched kernels between the introduction of commit 5894cf571e14 and the respective stable-branch fixes are affected. No public exploit or CISA KEV listing exists; the vulnerability manifests as a kernel panic during initialization on susceptible hardware, resulting in a denial of service.
Reference count leaking in the Linux kernel's hardware memory poison accounting subsystem (drivers/base/memory) causes memory block device objects to remain unreleased across repeated hardware memory error events, gradually degrading system stability. Affected kernels span multiple stable branches from introducing commit 5033091de814 through their respective fix commits, with patched releases available at 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and no active exploitation is recorded (EPSS 0.16%, 5th percentile); this is a slow-accumulating resource leak rather than an immediately weaponizable flaw.
Memory hotplug removal in the Linux kernel leaks device references because `find_memory_block()` acquires a kobject reference inside `remove_memory_blocks_and_altmaps()` that is never released, allowing the reference count to accumulate unchecked across repeated memory block removal cycles. Systems with memory hotplug support - including virtual machines using ACPI memory balloon drivers and bare-metal servers with hot-pluggable DIMM slots - are affected across multiple stable kernel branches, with patches confirmed for 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and exploitation probability is extremely low (EPSS 0.16%), though the availability impact is rated high: leaked references accumulated over repeated hotplug cycles can eventually precipitate a kernel panic.
NULL pointer dereference in the Linux kernel's Bluetooth ISO subsystem can crash the kernel when a race condition is triggered during PA-sync broadcast sink socket operations. The flaw exists in iso_conn_big_sync(), which drops the socket lock to call hci_get_route() and then re-acquires it without re-validating that the connection structure is still intact - allowing concurrent teardown events (iso_disconn_cfm → iso_conn_del → iso_chan_del) to null out iso_pi(sk)->conn before it is dereferenced. A local low-privileged user with access to Bluetooth ISO sockets can reliably crash the kernel, resulting in a denial of service. No public exploit code has been identified and no active exploitation is confirmed.
Device reference count leak in the Linux kernel's firmware_loader subsystem exposes systems to local denial-of-service conditions. Specifically, firmware_upload_register() fails to call put_device() on the fw_dev pointer when alloc_lookup_fw_priv() fails after fw_create_instance() has already called device_initialize(), leaving the embedded struct device reference count unbalanced and potentially preventing proper memory cleanup. Discovered via static analysis and confirmed by manual code review, the issue is patched across multiple stable kernel branches including 6.1.178, 6.6.145, 6.12.96, 6.18.39, and 7.1.4. No public exploit exists and no active exploitation has been observed.
Null pointer dereference in the Linux kernel's cpufreq subsystem during system reboot allows a local attacker with low privileges to crash the kernel. The reboot path (kernel_restart() → device_shutdown() → cpufreq_suspend()) does not invoke freeze_processes() - unlike the normal suspend path - leaving CPU hotplug operations free to run concurrently and free governor_data while cpufreq_suspend() is still reading it, producing a use-after-free null pointer dereference. No public exploit exists and EPSS probability is 0.22% (13th percentile), placing this in low-urgency territory despite the ubiquitous kernel footprint.
Kernel denial-of-service via missing exec_update_lock protection in six Linux procfs functions affects all Linux deployments running kernel 2.6.30 through multiple current stable branches. When a low-privileged local user reads specific /proc entries (stat, map_files, ns symlinks) concurrently with an execve() call in the target process, the missing lock allows ptrace_may_access() to observe transiently invalid credential or memory-map state, triggering a kernel crash. No public exploit identified at time of analysis; EPSS is 0.22% (13th percentile), consistent with low near-term automated exploitation probability.
Resource reference leak in the Linux kernel's POSIX CPU timer subsystem allows a local unprivileged user to exhaust kernel pid references and cause a local denial of service. The flaw exists in `do_cpu_nanosleep()` across all stable kernel branches from 2.6.12 onward: when `posix_cpu_timer_set()` returns an error, the pid reference acquired by the preceding `posix_cpu_timer_create()` call is never released. No public exploit code exists and EPSS sits at 0.22%, consistent with a kernel stability regression fix rather than an actively targeted security flaw.
Denial of service via infinite exception loop in the Linux kernel's s390 architecture affects systems running IBM Secure Execution (Ultravisor) workloads on kernel versions 6.7 through the patched releases. When load_unaligned_zeropad() reads across a page boundary where the adjacent page has been donated to the Ultravisor, the do_secure_storage_access() exception handler cannot resolve the fault and enters an unresolvable loop, permanently hanging the affected execution context. Patched in upstream versions 6.12.97, 7.1.4, and 7.2-rc1 via reversion of DCACHE_WORD_ACCESS support on s390; no public exploit or active exploitation is confirmed at time of analysis.
Uninitialized stack memory use in the Linux kernel HFS and HFS+ filesystem drivers allows a local user to crash the kernel by mounting a crafted filesystem image. Two early-exit paths in `hfs_bnode_read()` - an invalid offset check and a corrected-to-zero length - skip the buffer write, while downstream callers such as `hfs_bnode_read_u16()` and `hfs_bnode_read_u8()` consume the uninitialized stack buffer unconditionally, producing KMSAN uninit-value reports and risking kernel panics. Patches are available across multiple stable kernel branches; no public exploit exists and EPSS is very low at 0.22%.
Hung-task denial-of-service in the Linux kernel's nilfs2 filesystem allows a local low-privileged user to indefinitely stall concurrent filesystem operations by supplying out-of-range segment numbers to the NILFS_IOCTL_CLEAN_SEGMENTS ioctl. Because input validation was deferred deep inside the call chain to nilfs_sufile_updatev() - which emits one printk warning per invalid entry while holding ns_segctor_sem write-locked - repeated invocations saturate the global printk path and keep the semaphore held long enough to block all readers, including routine operations such as chmod(). No public exploit has been identified and EPSS is very low (0.22%, 13th percentile), consistent with a local kernel DoS requiring filesystem access.
Unconditional invocation of cancel_work_sync() in the mtk-jpeg media driver's release path triggers spurious WARN_ON kernel warnings on non-multicore MediaTek JPEG codec platforms where the workqueue callback pointer is NULL. Systems running affected Linux kernel versions (6.6.140-6.18.38, 7.0.4) on MediaTek SoC hardware may experience kernel log pollution or, on kernels compiled with CONFIG_PANIC_ON_WARN=y, a full system denial of service when the JPEG device is released. No public exploit has been identified and no active exploitation is recorded; this is a stability and correctness fix with strictly local trigger conditions.
Integer overflow in the Linux kernel's XFS filesystem exchmaps reservation logic allows a local low-privileged user to crash the system. The bug in xfs_exchmaps_estimate_overhead() adds bmbt and rmapbt overhead to a local resblks variable but then performs the UINT_MAX guard check against the original req->resblks value - the pre-overhead figure - before writing the inflated value back into req->resblks for use in xfs_trans_alloc(). This means the guard intended to prevent integer truncation when the reservation is cast to unsigned int is rendered ineffective, enabling a kernel panic on XFS systems where exchmaps overhead pushes the reservation past UINT_MAX. No public exploit exists and EPSS is 0.21%, placing this firmly in the kernel stability/bug-fix category rather than active threat landscape.
Memory exhaustion in the Linux kernel XFS quota subsystem can be triggered by a local low-privilege user on systems mounting metadir XFS images with user quota enabled. The vulnerability exists in xfs_dqinode_metadir_create(), where failure of xfs_metadir_create() returns without releasing the allocated update and transaction state, and commit failures leave behind caller-owned inode references. Confirmed present from Linux 6.13-rc1 through v7.1.1; patched in stable releases 6.18.39 and 7.1.4.
The Linux kernel BPF verifier incorrectly elides null-check requirements for inner array map lookups when the BPF_F_INNER_MAP flag is set, allowing a local attacker with BPF program loading privileges to trigger a null pointer dereference and crash the kernel. The flaw arises because the verifier uses the inner map template's max_entries for bounds reasoning at verification time, while the runtime helper operates against a concrete inner map that may have a larger max_entries value. A crafted BPF program exploiting the faulty nullness elision can cause a kernel denial of service. No public exploit code has been identified at time of analysis, and EPSS is low at 0.21%.
Out-of-bounds read in the Linux kernel's Samsung Kalmia USB network driver allows a malicious USB device to crash the kernel via a u16 integer underflow in `kalmia_rx_fixup()`. When a crafted bulk-IN frame is 6-11 bytes long, the subtraction `skb->len - 12` underflows to approximately 65,530, bypassing length validation and causing `memcmp()`, `skb_trim()`, and `skb_pull()` to operate past the end of the 14,000-byte RX buffer. No public exploit or active exploitation (CISA KEV) has been identified; EPSS at 0.23% (14th percentile) confirms minimal exploitation interest.
Memory exhaustion in the Linux kernel's USB CDNSP host controller driver allows local users to trigger a kernel-level memory leak by forcing partial allocation failures in `cdnsp_alloc_stream_info()`. Systems running Linux 5.12 through unpatched stable branches accumulate unreleased `stream_ctx_array` allocations that are never freed, eventually causing availability impact on hosts with CDNSP USB hardware. No public exploit exists, EPSS stands at 0.21%, and the vulnerability carries no confidentiality or integrity impact per the CVSS vector.
Incorrect argument passing in dwc3_ulpi_setup() causes the Linux kernel's DWC3 USB controller driver to pass a raw MMIO register pointer (dwc3->regs, typed as void __iomem *) to dwc3_readl() and dwc3_writel(), which instead expect the containing struct dwc3 * pointer. Because the register accessor functions internally dereference the struct to locate ->regs, supplying ->regs directly results in incorrect memory access during ULPI (USB Low Pin Interface) initialization - flagged by the kernel sparse checker as a type-safety violation across address spaces. The practical impact is a potential kernel panic or silent misread/miswrite of a USB control register, manifesting as an availability failure in systems using DWC3 ULPI USB controllers. No public exploit exists and the issue requires local access to trigger.
Kernel denial-of-service in the Linux USB gadget composite driver crashes the system by triggering a KASAN memory fault in the USB_DT_OTG request handler when the configuration list is empty. The flaw exists because list_first_entry() never returns NULL - making the subsequent config NULL-check dead code - so when cdev->configs is empty during a gadget unbind race or when a driver sets is_otg before registering any configuration, composite_setup() dereferences a garbage pointer and memcpy() copies arbitrary kernel memory into the USB response buffer. No public exploit code has been identified, and EPSS is 0.22% (13th percentile), consistent with the local, race-condition nature of the flaw.
Reference count leak in the Linux kernel USB gadget printer driver (f_printer) allows a local user to trigger a permanent kref increment on every rejected concurrent open attempt. Each call to printer_open() that returns -EBUSY still increments dev->kref, but because VFS never invokes ->release() for a failed open, the reference is never balanced. Repeated exploitation exhausts the reference counter, preventing proper driver teardown and causing availability degradation. No public exploit has been identified at time of analysis.
Incomplete error-path cleanup in the Linux kernel's uss720 USB-to-parallel-port driver leaves a parport device registered after probe failure, creating a dangling stale pointer backed by freed private data. Systems where a Belkin F5U002 or similar USS720-based adapter is attached and causes get_1284_register() to fail during uss720_probe() are left with an orphaned kernel parport entry and a reserved parport slot, which can lead to a kernel crash when the stale pp->private_data pointer is later dereferenced. No active exploitation has been identified; the bug was discovered via static-analysis research, and patches are available across all major Linux stable branches.
DMA mapping leak in the Linux kernel's MTU3 USB device controller driver causes local denial-of-service on MediaTek SoC platforms. When mtu3_gadget_queue() maps a USB transfer request via DMA before checking whether the QMU GPD ring has capacity, then mtu3_prepare_transfer() fails and returns -EAGAIN, the error path bypasses the mtu3_req_complete() cleanup helper, permanently stranding the DMA mapping. Repeated exhaustion of the IOMMU aperture can destabilize or crash the kernel. No public exploit code exists and EPSS at 0.22% (13th percentile) confirms negligible exploitation interest; the impact is a local availability-only issue confined to MediaTek USB gadget hardware.
The keyspan_pda USB-serial driver in the Linux kernel transmits kernel memory beyond the tty write buffer to an attached USB device due to an incorrect write() return value introduced with write FIFO support. After commit 034e38e8f687, the driver returns the byte count submitted to the USB device rather than the count accepted from the caller; the TTY line discipline interprets this inflated count as authorization to advance its read pointer past the buffer boundary, exposing adjacent kernel memory. Affected stable trees span Linux 5.15 through 7.1 and the 7.2-rc3 development branch, with patches released across all maintained stable series; no public exploit or active exploitation is confirmed, and EPSS is 0.21% (12th percentile).
Availability loss in the Linux kernel's USB serial digi_acceleport driver allows a local user to permanently halt data reception on a Digi AccelePort serial port until the USB device is physically reconnected or the driver is rebound. The bug arises from a missing URB resubmission path: when a port is closed while in a throttled state, the read URB is never re-queued, leaving the port silently deaf to incoming data upon next open. No public exploit has been identified and EPSS sits at 0.22% (13th percentile), reflecting the niche hardware dependency and local-only attack surface.
Hard lockup in the Linux kernel's digi_acceleport USB serial driver causes full system freeze when a Digi AccelePort device is physically disconnected during active I/O. The driver's OOB (out-of-band) command path loops indefinitely with interrupts disabled upon persistent URB submission failure, resulting in a kernel hard lockup that effectively crashes the host. Systems with this specific USB-to-serial adapter are affected across a wide range of stable kernel branches from 2.6.12 onward; patches have been released across all active stable series.
Memory leak in the Linux kernel USB ULPI (Universal Serial Bus Link Interface) subsystem allows a local low-privileged user to trigger repeated ULPI device registration failures that leak kernel memory, potentially leading to system instability or denial of service. Affected kernel versions span from 4.2 through multiple pre-patch stable branches, with fixes backported to 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc3. No public exploit or active exploitation has been identified at time of analysis; the EPSS score of 0.22% (13th percentile) reflects minimal probability of weaponization.
NULL pointer dereference in the Linux kernel's usbip virtual UDC (vudc) subsystem crashes the kernel when FunctionFS AIO cancellations are processed. The `vep_alloc_request()` function never initialized `vrequest->udc`, so any AIO cancellation arriving at `vep_dequeue()` - such as one triggered by a host-side `usbip attach` - dereferences a null pointer and produces a kernel oops, denying service to the guest system. A local attacker with low privileges on a system configured for USB/IP with FunctionFS AIO endpoints can reliably reproduce this crash. No public exploit code exists, and EPSS at 0.22% (13th percentile) confirms the path has not seen meaningful exploitation despite the bug reportedly existing for approximately ten years since Linux 4.7.
Kernel memory leak in the Linux USB gadget FunctionFS (f_fs) subsystem allows a local low-privileged user to slowly exhaust kernel memory by repeatedly triggering DMA buffer transfers via the ffs_dmabuf_transfer() code path. Affected kernels span from the commit introducing DMA buffer sharing (7b07a2a7ca02) through versions prior to 6.12.96, 7.1.4, and 7.2-rc3. The root cause is a missing dma_fence_put() call after dma_resv_add_fence(), leaving the initial kref permanently outstanding and causing ffs_dma_fence objects to accumulate without ever being freed. No public exploit has been identified at time of analysis.
The USB gadget FunctionFS (f_fs) subsystem in the Linux kernel fails to initialize the endpoint direction field (epfile->in) until USB host connection, leaving it zero when userspace performs early DMA ioctl calls such as FUNCTIONFS_DMABUF_ATTACH before a host connects. This incorrect DMA direction causes kernel-mode availability loss - crashes or hangs - on systems actively using FunctionFS-based USB gadgets with DMABUF. No public exploit has been identified, and EPSS probability stands at 0.21% (11th percentile), reflecting very low opportunistic exploitation risk.
The block device layer in Linux Kernel hangs indefinitely during NVMe surprise removal when `bdev_mark_dead()` is called with `surprise=true`, because a missing guard causes `sync_blockdev()` to be invoked on an already-dead device, permanently blocking `folio_wait_writeback()`. Triggered via `nvme_reset_work()` I/O-queues-lost path, the bug wedges the NVMe reset worker and every task waiting on it, requiring a system reboot to recover. Discovered by FuzzNvme (syzkaller + FEMU fuzzing framework); no public exploit identified at time of analysis.
NULL pointer dereference in the Linux kernel's mt76 driver for MediaTek mt7921/mt7925 WiFi chipsets causes a kernel panic (denial of service) via a race condition in Channel Switch Announcement (CSA) beacon processing. When a CSA beacon is received, cfg80211 queues a wiphy work item; if the station disconnects or the channel context is torn down before the work item executes, the driver's dev->new_ctx pointer is already NULL but dereferenced unconditionally in mt7921_channel_switch_rx_beacon() and mt7925_channel_switch_rx_beacon(). EPSS is 0.20% (10th percentile) and no public exploit or CISA KEV listing is identified at time of analysis.
Reference count leak in the Linux kernel NVMe-oF target RDMA subsystem causes local denial of service on affected storage servers. When nvmet_rdma_queue_connect() calls nvmet_rdma_find_get_device() and the host queue backlog is exceeded (NVME_SC_CONNECT_CTRL_BUSY), the kref acquired by kref_get() is never released via the put_device cleanup path. Repeated triggering of this code path by a local low-privileged process causes progressive resource exhaustion, ultimately rendering the affected device unreclaimable and degrading availability. No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile).
Sensitive cryptographic key material handled by the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver was unconditionally emitted to the kernel ring buffer via unguarded hex-dump calls in *_setkey() and gen_split_key(), exposing raw key bytes to any local user with dmesg access on kernels built with CONFIG_DYNAMIC_DEBUG. The exposure affects NXP CAAM-equipped platforms (i.MX, QorIQ SoC families) running kernel versions from approximately 5.3 through the fix commits across all active stable branches. No public exploit code exists and EPSS probability is 0.22%, but key material disclosure on a crypto-accelerator driver carries genuine confidentiality risk that the vendor-assigned CVSS (C:N/I:N/A:H) incorrectly characterizes - the real primary impact is confidentiality loss, not availability.
Null pointer dereference in the Linux kernel's chacha20poly1305 crypto template allows a local unprivileged user to crash the system. The flaw exists in chachapoly_create(), which passes the unvalidated return value of crypto_attr_alg_name() directly to strcmp() when the poly1305 sub-argument is absent in a malformed template string; since that function returns an ERR_PTR on failure, the subsequent strcmp() call dereferences an invalid pointer, triggering a kernel panic. Patches are available across multiple stable branches; no public exploit or active exploitation has been identified at time of analysis.
Denial of service in the Linux kernel's AMD CCP/SEV driver allows a local low-privileged process to crash a KVM hypervisor host by submitting SEV firmware ioctls to /dev/sev, which incorrectly triggers SNP initialization and zeroes the MSR_VM_HSAVE_PA register, causing a general protection fault on the next VMRUN and terminating all running virtual machines. Affected kernels span from the introducing commit (ceac7fb89e8da465aec3ac3c20477f912f5c3a6c) through the fixed stable releases 6.12.96, 6.18.39, and 7.1.4. No public exploit has been identified and EPSS is 0.22%, but the blast radius - crashing the host and all its tenant VMs - warrants prompt patching on AMD EPYC KVM deployments.
Crash of a Linux KVM host is achievable by a local low-privileged user via the /dev/sev ioctl interface on systems running AMD SEV-SNP firmware. When SNP_COMMIT is issued after a prior failed SEV initialization, the crypto/ccp driver incorrectly proceeds with SNP initialization, zeroing out MSR_VM_HSAVE_PA - the model-specific register holding the AMD SVM host save-area pointer. Any subsequent VMRUN instruction by KVM for an already-running VM will generate a General Protection Fault, crashing the host and terminating all guest workloads. No public exploit has been identified at time of analysis; patch commits are available across multiple stable branches.
Uncontrolled SNP initialization in the Linux kernel's CCP/SEV driver allows a local low-privileged user with /dev/sev access to crash the host kernel on AMD SEV/SNP-capable systems running KVM. Sending a SNP_VLEK_LOAD ioctl when SNP has not been initialized triggers an unnecessary initialization/shutdown wrapper that zeros MSR_VM_HSAVE_PA globally; the subsequent VMRUN instruction for any active KVM guest then triggers a General Protection Fault, bringing down the host and terminating all co-hosted VMs. No public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects the specialized attack environment required.
Host crash vulnerability in the Linux kernel's AMD SEV/SNP subsystem allows a local low-privileged user to take down a virtualization host by triggering SNP re-initialization via the `/dev/sev` `SNP_CONFIG` ioctl when SNP has previously failed to initialize. When re-initialization executes while KVM guests are running, it zeroes `MSR_VM_HSAVE_PA` globally across all CPUs; the next VMRUN instruction on any active guest then raises a General Protection Fault, crashing the host kernel and terminating all hosted VMs. No public exploit identified at time of analysis; EPSS is 0.22% at the 13th percentile, consistent with low opportunistic exploitation probability.
Silent error propagation in the Linux kernel's CTR_DRBG implementation (`drbg_ctr_generate()`) causes the function to return a success code while leaving its output buffer uninitialized when an internal operation fails. Code that relies on the generated random material receives garbage data, which can trigger kernel crashes or hangs depending on how the uninitialized buffer is consumed downstream. No public exploit has been identified; patched stable kernel releases are available across all active longterm-support branches.
PMD-sized vmemmap pages are silently leaked in the Linux kernel's x86 memory management subsystem following a regression introduced in commit bf9e4e30f353, which replaced __free_pages() with pagetable_free() for vmemmap page freeing. Because vmemmap pages are not compound pages (outside of HVO, which does not apply here), pagetable_free() resolves compound_order() to zero and frees only the first page of a PMD-sized block, leaking the remaining pages on every memory section removal. Systems running affected kernel versions (6.18.7-6.18.38, 6.19 series through 7.1.3) that perform x86 memory hotplug operations will experience progressive physical memory loss; no public exploit has been identified and this vulnerability is not in CISA KEV.
Reference count leak in the Linux kernel's SCMI regulator driver can exhaust kernel memory resources, leading to a denial-of-service condition on affected systems. The flaw resides in scmi_regulator_probe(), where of_find_node_by_name() acquires a reference on a device-tree node but the corresponding of_node_put() release call is omitted on the error path when process_scmi_regulator_of_node() fails, permanently leaking the reference. Exploitation requires local access; no public exploit code has been identified and EPSS probability stands at 0.21%, indicating very low likelihood of opportunistic exploitation.
Null pointer dereference in the Linux kernel module decompression path crashes the kernel when a local user loads a compressed module under memory pressure. The flaw exists across multiple stable kernel branches and was introduced at commit b1ae6dc41eaa; patches are now available for all affected stable trees. No active exploitation confirmed (not in CISA KEV), and EPSS at 0.21% (12th percentile) reflects very low exploitation probability, consistent with the local-only, condition-dependent attack surface.
NULL pointer dereference in the Linux kernel's `page_ext` memory iteration API crashes systems during dynamic memory hotplug operations. The `page_ext_iter_next()` function fails to enforce the PFN boundary, advancing the iterator index past `__pgcount` and calling `page_ext_lookup()` on an uninitialized memory section, triggering a kernel panic. With EPSS at 0.21% (11th percentile) and no CISA KEV listing, real-world exploitation is low-probability and operationally constrained to environments actively performing memory hotplug, such as cloud hypervisors or NUMA-heavy servers with memory ballooning.
Incorrect idmap handling in the Linux kernel memory management subsystem causes `owner_or_capable()` checks inside `mincore()` and `madvise(MADV_PAGEOUT)` to use the identity no-op mount idmap (`nop_mnt_idmap`) rather than the actual mount's idmap, producing incorrect ownership evaluations on idmapped mounts. Local users with low privileges on Linux 5.12+ systems configured with idmapped mounts may trigger incorrect authorization decisions that deny legitimate memory management operations, with the most impactful edge case occurring on 0444 files where neither the idmap check nor the fallback `file_permission(MAY_WRITE)` path succeeds. No public exploit is known and EPSS is 0.21% (11th percentile), reflecting minimal real-world exploitation risk despite the Linux kernel's ubiquitous deployment footprint.
Atomic memory reserve exhaustion in the Linux kernel's iommufd subsystem allows a local low-privileged user to trigger kernel-side memory pressure by allocating virtual event queues whose depth is fully user-controlled, potentially destabilizing the system through GFP_ATOMIC reserve depletion. The root cause is memory allocation for veventq entries occurring inside a spinlock, drawing from atomic reserves never intended for user-directed exhaustion. No active exploitation is confirmed and EPSS sits at 0.21% (11th percentile); upstream fix commits are available across the 6.18.x, 7.1.x, and 7.2-rc1 stable series.
Memory exhaustion in the Linux kernel iommufd subsystem allows a local low-privileged user to crash the system by passing an uncapped veventq_depth value to iommufd_veventq_alloc(), which previously accepted any non-zero integer up to U32_MAX without validation. Exploitation requires local access with low privileges on a system where the iommufd device is accessible, making this primarily a concern for multi-tenant or virtualization hosts. No public exploit has been identified and EPSS at 0.21% (11th percentile) reflects minimal real-world exploitation interest at time of analysis.
Infinite loop in the Linux kernel iommufd subsystem's fault read path allows a low-privileged local user to pin a CPU core at 100% utilization while holding a kernel mutex, causing a local denial of service. The flaw exists in iommufd_fault_fops_read(), where a copy_to_user() failure in the inner list traversal loop fails to propagate its error code to the outer while loop, which then re-fetches the same fault group and retries the failing operation indefinitely with fault->mutex held. No public exploit is identified at time of analysis; EPSS indicates a very low 0.21% exploitation probability, and this CVE is not listed in the CISA KEV catalog.
Unbounded cache invalidation parameters in the Linux kernel iommufd subsystem allow a local low-privileged user to pin a CPU indefinitely or trigger a soft-lockup watchdog fault, resulting in a kernel denial of service. The iommufd_hwpt_invalidate() ioctl accepts user-supplied entry_len and entry_num values bounded only by U32_MAX, enabling an uninterruptible gigabyte-scale memory scan or a no-reschedule VT-d flush loop. No public exploit has been identified and EPSS stands at 0.21% (11th percentile); the vulnerability is not listed in CISA KEV, indicating low active exploitation pressure.
Null pointer dereference in the Linux kernel's KVM arm64 nested virtualization subsystem allows a local low-privileged attacker to crash the host kernel via a race condition in VNCR pseudo-TLB invalidation. The function kvm_invalidate_vncr_va() dereferences the VNCR pseudo-TLB pointer without first verifying allocation or validity, unlike its companion kvm_invalidate_vncr_ipa(). Exploitation results in a kernel panic that disrupts all virtual machines on the affected host; no public exploit has been identified at time of analysis, and EPSS of 0.21% (11th percentile) reflects minimal observed exploitation activity.
KVM's SEV-SNP guest initialization path in the Linux kernel can trigger a host kernel panic when processing CPUID data backed by a read-only memory mapping. The flaw affects hypervisors running Linux 7.0.x before 7.1.4 where a local, low-privileged VMM process can cause KVM to write corrected CPUID values into a read-only source page after AMD's trusted firmware rejects the userspace-supplied data. No public exploit has been identified and EPSS sits at 0.20% (10th percentile), consistent with a niche, difficult-to-trigger local denial-of-service condition with no confirmed active exploitation.
KVM arm64 in the Linux kernel leaks a Page Frame Number reference when kvm_translate_vncr() races an MMU notifier, allowing a local low-privileged attacker to gradually exhaust kernel memory and cause a denial of service on affected arm64 hypervisor hosts. The vulnerability is specific to arm64 systems running KVM with VNCR (Virtualization Non-Cached Region) active, and requires precise race-condition timing (AC:H). No public exploit has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) confirms this remains a low-probability exploitation target.
System hang vulnerability in the Linux kernel's NXP i.MX LPI2C driver arises from a race condition during suspend/resume power transitions. Specifically, periodic workqueues in I2C client drivers can fire I2C transfers between the suspend_noirq and resume_noirq phases, when clock and pinctrl resources have already been disabled or are not yet restored. Accessing I2C controller registers in this state causes the system to hang. The fix marks the adapter as suspended during noirq suspend, blocking transfers until hardware resources are fully restored. No public exploit or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Division-by-zero and arithmetic underflow flaws in the Linux kernel's elan_i2c touchpad driver cause kernel panic during device probe on systems equipped with Elan I2C touchpad hardware. When device firmware or device tree supplies zero values for x_traces or y_traces, the driver performs an unguarded integer division by zero, crashing the kernel. A secondary arithmetic underflow causes the input subsystem to report a massively incorrect touch width value to userspace when physical device dimensions fall below a hardcoded threshold. No public exploit exists and EPSS is 0.22% (13th percentile), reflecting the hardware-specific, limited-scope nature of this flaw.
Integer wrap in the FUSE subsystem's prune notification handler crashes 32-bit Linux kernels when a malicious or compromised FUSE daemon sends a crafted FUSE_NOTIFY_PRUNE message. On 32-bit platforms where size_t is 32 bits, multiplying a daemon-controlled count value of 0x20000000 by sizeof(u64) wraps to zero, causing the payload length check to pass with no actual nodeid data present; the subsequent copy loop then triggers a BUG_ON assertion, inducing a kernel panic. No public exploit has been identified at time of analysis and EPSS stands at 0.21% (11th percentile), consistent with the narrow exploitation window of 32-bit-only kernels and requiring FUSE daemon control.
Error-code mishandling in the Linux kernel fuse-uring subsystem causes a failed copy_from_user() in fuse_uring_commit to be silently treated as success, leaving callers processing uninitialized or partial output arguments. Local users with low-privilege access on kernels from 6.14 through pre-patch versions can trigger a kernel panic or crash, yielding a local denial of service. No public exploit has been identified and the EPSS score of 0.21% (11th percentile) indicates no meaningful active exploitation activity at time of analysis.
Kernel panic in the Linux kernel's fuse-uring subsystem allows a local low-privileged attacker to crash the system by triggering a NULL pointer dereference through crafted io_uring cancellation sequences against a FUSE filesystem. The root cause is that fuse_uring_cancel() moves cancelled entries with no attached requests to the ent_in_userspace list, where ent_list_request_expired() unconditionally dereferences ent->fuse_req, crashing the kernel. No public exploit code exists and EPSS sits at 0.21% (11th percentile), indicating negligible opportunistic exploitation pressure; however, the low privilege requirement and local DoS impact make it relevant for multi-tenant or shared-access Linux environments.
Resource exhaustion and denial of service in the Linux kernel's fuse-uring subsystem allows a local authenticated user to permanently hang FUSE requests and stall all background filesystem operations for the affected connection. The flaw was introduced with the fuse-uring interface in Linux 6.14 and affects stable series through 6.18.38 and 7.1.3; patched releases 6.18.39, 7.1.4, and mainline 7.2-rc1 are available. No public exploit has been identified at time of analysis (EPSS 0.21%, 11th percentile) and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation.
NULL pointer dereference in the Linux kernel's fuse-uring subsystem enables a local low-privilege attacker to crash the kernel, causing a denial of service. The flaw arises from a state management race in the fuse-uring request lifecycle: when a copy into a userspace io_uring ring buffer fails, the entry's request pointer is nullified but the entry remains on the active queue, allowing the expiration scanner to dereference the NULL pointer in a narrow race window. No public exploit has been identified and EPSS stands at 0.21% (11th percentile), indicating low likelihood of opportunistic exploitation.
XFS filesystem quota iteration in the Linux kernel wraps a 32-bit quota ID back to zero when a disk quota entry (dquot) exists at XFS_DQ_ID_MAX, producing an infinite loop and local denial of service. Systems running Linux 6.8 and later with XFS quotas enabled are vulnerable if a dquot is present at the maximum 32-bit ID boundary (0xFFFFFFFF). No active exploitation has been identified; patched releases 6.12.96, 6.18.39, 7.1.4, and 7.2-rc4 are available from the kernel stable tree.
Kernel availability degradation in the Linux kernel ntb_hw_epf driver occurs during module teardown when BAR_PEER_SPAD and BAR_CONFIG share a single PCI BAR, causing ntb_epf_pci_remove() to call pci_iounmap() on an offset address that was never independently registered as a vm_area. Systems running Linux 6.0 through at least 6.18.37 with the ntb_hw_epf module loaded under this BAR-sharing configuration will generate a kernel warning ('Trying to vunmap() nonexistent vm area') upon driver removal. No public exploit exists and EPSS probability is 0.16% (6th percentile), consistent with an availability-only defect requiring specific hardware topology and local privilege to trigger.
NULL pointer dereference in the Linux kernel's `copy_process()` function allows a local low-privileged user to crash the host kernel via a denial-of-service condition. During `fork()`, the child process inherits the `PF_BLOCK_TS` process flag from the parent while the child's `blk_plug` pointer is simultaneously reset to NULL, breaking the invariant that `PF_BLOCK_TS` set implies `current->plug != NULL`. Any downstream block I/O subsystem code path that dereferences `current->plug` without a NULL guard in the child will trigger a kernel panic. No public exploit is identified at time of analysis, and EPSS at 0.16% (5th percentile) reflects minimal observed exploitation interest.
Stack buffer address truncation in the MIPS DEC 64-bit Linux kernel platform layer causes kernel panics when the initial console handler is invoked from a non-initial kernel thread. The buffer resides on a stack allocated in the XKPHYS 64-bit memory segment, whose address is silently truncated by legacy 32-bit DEC firmware, producing an invalid pointer dereference and a fatal kernel exception. No public exploit identified at time of analysis and no active exploitation is confirmed; patches are available across multiple stable kernel branches including 5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3, and 7.2-rc1.
Shutdown and reboot operations hang indefinitely on LoongArch-based Linux systems due to a missing RCU notification in stop_this_cpu(), exposing multi-CPU LoongArch hosts running affected kernel stable branches to an unrecoverable hang during system halt or reboot. The vulnerable path is triggered when smp_send_stop() parks secondary CPUs without calling rcutree_report_cpu_dead(), after which any irq_work_sync() call in the shutdown sequence invokes synchronize_rcu() - which then blocks forever waiting for quiescent states from CPUs that are permanently parked with interrupts disabled. No public exploit identified at time of analysis; EPSS is 0.16% at the 6th percentile and the CVE is absent from CISA KEV, consistent with this being a reliability defect rather than a security exploitation path.
MIPS SMP systems running affected Linux kernel versions hang indefinitely during reboot or shutdown due to a missing RCU subsystem notification in the stop_this_cpu() shutdown path. When smp_send_stop() parks secondary CPUs, it correctly removes them from the scheduler's view via set_cpu_online(false) but never calls rcutree_report_cpu_dead(), leaving RCU waiting for quiescent states that can never arrive. The defect became reliably triggered after commit 91840be8f710 was backported to stable branches starting with 6.18.34, causing irq_work_sync() to invoke synchronize_rcu() on MIPS systems that lack an irq_work self-IPI, with no public exploit identified at time of analysis.
Improper ordering of resource assignment in the Linux kernel's memory hotplug subsystem causes a spurious WARN_ON during error recovery in __add_memory_block(). When xa_store() fails under memory pressure, device_unregister() is invoked while mem->altmap is already set, triggering memory_block_release() with a non-NULL altmap pointer and producing a kernel warning that can lead to system instability or crash. Affected systems are those running Linux kernel versions from the introduction commit 1a8c64e110435e44e71bcd50a75663174b575f22 through the respective fix commits across the 6.6, 6.12, 6.18, 7.0, and 7.1 stable series; patches are confirmed available. No public exploit has been identified and EPSS stands at 0.16% (6th percentile), consistent with a stability regression rather than an actively targeted security flaw.
Resource leaks and teardown race conditions in the Linux kernel's gpio-rockchip driver expose Rockchip-based systems to kernel panic and memory exhaustion. Three distinct defects exist in the driver's remove path: an unreleased debounce clock reference, a stale chained IRQ handler left registered after driver removal, and an unfreed IRQ domain with its generic chips. The IRQ handler defect is the most severe - if a stray GPIO interrupt arrives after the driver is unbound, the kernel dereferences a stale function pointer and panics. No public exploit identified at time of analysis; EPSS of 0.16% (5th percentile) reflects the niche, hardware-specific exploitation surface.
Incorrect pointer passing in the Linux kernel's igorplugusb infrared USB receiver driver causes the USB core to misinterpret raw pointer bytes as a USB control setup packet, triggering a BOGUS control direction warning and a kernel-level denial of service. The regression was introduced by commit eac69475b01f, which allocated ir->request as a pointer for DMA coherency but left the usb_fill_control_urb() call referencing &ir->request (the pointer variable's address) rather than ir->request (the allocated struct usb_ctrlrequest). No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.17% (6th percentile), reflecting minimal real-world exploitation probability.
Deadlock vulnerability in the Linux kernel's GPIO shared proxy subsystem allows a local, low-privileged user to cause a system hang by triggering removal of a shared GPIO proxy's parent device. The root cause is an overly-wide mutex critical section introduced in commit 710abda58055, where the gpio_shared_entry mutex was held for too long, creating a locking inversion scenario during parent device teardown. No public exploit code exists and no active exploitation has been identified; the fix narrows the critical section to protect only offset reads.
Division-by-zero kernel panic in the Linux kernel's i2c-davinci driver causes a deterministic system crash on TI DaVinci SoC-based hardware when the 'clock-frequency' device tree property is absent. The root cause is a unit mismatch: DAVINCI_I2C_DEFAULT_BUS_FREQ was defined in kHz (100) but the probe path divided it by 1000, producing dev->bus_freq = 0, which then triggers an unconditional divide-by-zero during clock divider calculation. Availability impact is complete (kernel panic), but exploitation requires specific embedded hardware context; no public exploit exists and EPSS is 0.15%, consistent with a reliability defect rather than an adversarially exploitable flaw.
NULL pointer dereference in the Linux kernel's pch_uart serial driver allows a local low-privileged user to crash the kernel by triggering a failed DMA memory allocation in dma_handle_rx(). Systems running Intel PCH (Platform Controller Hub) hardware with the pch_uart driver active and DMA enabled are vulnerable to denial of service via kernel panic. No public exploit or CISA KEV listing exists; with an EPSS of 0.17% (6th percentile), real-world exploitation risk is low, but patches are confirmed across multiple stable kernel branches.
Use-after-free in the Linux kernel USB UVC gadget driver allows a privileged local user to crash the kernel by racing configfs extension-unit teardown against the bind-time list walks in uvc_function_bind(). The bind path walks opts->extension_units without holding opts->lock, while the configfs write path (uvcg_extension_drop) correctly holds the lock, creating an asymmetric locking pattern that enables a freed struct uvcg_extension to be dereferenced. No public exploit exists and EPSS sits at 0.16% (5th percentile), but patches are confirmed across multiple stable kernel branches including 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1.
Out-of-bounds memory access in the Linux kernel's drm/msm DSI display subsystem causes a kernel panic on systems with Qualcomm MSM DSI 6G hardware. The io_offset adjustment applied to the mapped IO base address is not reflected in the ctrl_size value passed to the snapshot dump routine, so msm_disp_snapshot_add_block reads past the end of the mapped region and crashes the kernel. Only devices with Qualcomm MSM DSI 6G display hardware running an unpatched kernel from 5.14 onward are affected; no public exploit exists and EPSS of 0.17% confirms very low exploitation probability.
Kernel panic via NULL pointer dereference in the Linux tps65219 PMIC regulator driver crashes affected systems when a hardware IRQ fires on the device, producing a local denial-of-service condition. The regression was introduced by commit 64a6b577490c, which removed the helper function `tps65219_get_rdev_by_name()` and inadvertently eliminated the only code path that assigned `irq_data.rdev`, leaving the pointer uninitialized for every registered IRQ. Systems running Linux kernel versions from that commit through the stable-branch fix points (6.18.34 and 7.0.11) on hardware equipped with the TI tps65219 PMIC are affected; no public exploit has been identified and the EPSS score of 0.17% reflects low exploitation probability.
Broadcast TLB flush in the Linux kernel x86 memory management subsystem triggers a General Protection Fault (#GP) on AMD INVLPGB-capable systems booted with the 'nopcid' parameter, causing a kernel panic and local denial of service. When PCID is disabled via 'nopcid', CR4.PCIDE is not set, but the INVLPGB broadcast TLB invalidation path remains enabled; once a memory descriptor becomes active across more than three CPUs, the kernel assigns it a global ASID and issues INVLPGB with a non-zero PCID - an illegal state that crashes the kernel. No public exploit exists, EPSS is 0.17% (6th percentile), and this is not in CISA KEV; real-world impact is constrained to the uncommon 'nopcid' boot configuration on AMD hardware.
NULL pointer dereference in the Linux kernel ethtool PHY subsystem allows a local low-privileged user to trigger a kernel panic (denial of service) by unbinding a PHY driver via sysfs while the device remains registered in the ethtool link topology. Affected kernel versions span the 6.16, 6.18.x, 7.0.x, and 7.1 stable branches; upstream fixes are available in commits targeting 6.18.34 and 7.0.11. No public exploit code exists and no active exploitation has been identified at time of analysis, consistent with EPSS at 0.17% (6th percentile).
NULL pointer dereference in the Linux kernel ACPI platform driver subsystem crashes the kernel when 13 core ACPI drivers are force-matched to devices lacking an ACPI companion object. The root cause is the absence of ACPI_COMPANION() or ACPI_HANDLE() null-checks in affected drivers, combined with the kernel's device_match_driver_override() mechanism which can bypass normal device-ID matching. Impact is limited to local denial of service (kernel panic); no active exploitation is confirmed (not in CISA KEV) and EPSS sits at 0.17% (6th percentile), placing this firmly in the maintenance-fix rather than urgent-remediation category.
Kernel denial-of-service in the Linux kernel's device property firmware node subsystem results from fwnode_init() failing to zero the secondary pointer before use, leaving it with uninitialized stack or heap garbage that may be incorrectly treated as a valid pointer and dereferenced in functions such as dev_to_swnode(). Local users with low privileges on any kernel version between the introducing commit and the respective stable patch releases can trigger a kernel panic, causing system downtime. No public exploit code exists and EPSS is 0.17% (7th percentile), reflecting negligible observed exploitation activity.
NULL pointer dereference in the Linux kernel's Qualcomm Adreno GPU driver (drm/msm/a6xx) crashes the kernel when `a8xx_hfi_send_perf_table()` proceeds to dereference a kzalloc() return value without first validating it against NULL. Systems running affected kernel versions with Qualcomm Adreno 6xx or 8xx GPU hardware - primarily Snapdragon-based ARM devices, smartphones, and servers - can be crashed by a local low-privileged user who triggers the GPU HFI performance table code path under memory pressure. EPSS of 0.16% (5th percentile) and no CISA KEV listing confirm no known active exploitation; patches are available in stable kernel releases 7.0.11 and 7.1.
Kernel panic in the Linux kernel's PowerPC-specific arch_irq_work_raise() function crashes affected systems when machine check exception handlers invoke the function from real mode, a context where virtual memory translation is disabled and preempt_count access via a virtual address faults with a bad area data access error. PowerPC deployments running kernel versions prior to 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1 are affected; x86, ARM, and other non-PowerPC architectures are completely unaffected. No public exploit code exists and EPSS is 0.17% (7th percentile), consistent with a hardware-architecture-specific reliability defect rather than an attacker-driven threat; the vulnerability does not appear in the CISA KEV catalog.
Missing mutex lock in the Linux kernel lm90 hwmon driver's alert handler creates a race condition that triggers an interrupt storm on systems with LM90-family temperature sensors. When lm90_alert() fires concurrently with a sysfs write operation - both modifying the shared data->config register cache - the sysfs path's restore of data->config silently overwrites the alert handler's hardware-disable flag, re-enabling the alert line while the alarm remains active. The result is uncontrolled interrupt escalation causing system availability impact. No public exploit exists, EPSS is 0.17% (6th percentile), and no KEV listing is present; patched releases 6.18.34, 7.0.11, and 7.1 are available.
NULL pointer dereference in the Linux kernel's iwlwifi MLD (Multi-Link Device) Wi-Fi driver allows a local low-privileged user to crash the kernel, resulting in a denial-of-service condition. The flaw resides in `iwl_mld_remove_link`, where the `link->fw_id` field is read before the `link` pointer is validated for NULL, enabling a kernel panic on affected systems with Intel wireless hardware. No public exploit code exists and the vulnerability is not listed in CISA KEV; patches are available in stable kernel releases 6.18.34, 7.0.11, and 7.1.
Availability loss in the Linux kernel's Tree SRCU (Sleepable Read-Copy-Update) subsystem causes system hangs by queuing workqueue handlers on CPUs that have never been-and may never be-online. Affected kernels spanning commit 61bbcfb50514 through the fix points can attempt to invoke callbacks for CPUs absent from cpu_possible_mask, a condition that is fatal on s390 (IBM mainframe) architectures not hardened to handle such scheduling anomalies. No public exploit code exists and EPSS places exploitation probability at 0.15% (5th percentile), consistent with a stability defect rather than a security attack surface; patches are available in Linux 7.0.11 and 7.1.
Cache-clearing denial-of-service in NLnet Labs Unbound through 1.25.1 allows a remote attacker who controls a DNS delegation to indefinitely and repeatedly flush Unbound's message and rrset caches without sending a single spoofed packet. The attack exploits a logic flaw in how the iterator processes in-bailiwick glue records containing the unspecified address 0.0.0.0/::0: on Linux, such queries are routed via loopback and answered by 127.0.0.1, creating an IP mismatch that the unwanted-reply counter tallies until the configured threshold triggers a defensive cache clear - which resets the counter, enabling the loop to continue indefinitely. No public exploit identified at time of analysis; CVSS 3.1 scores this 5.3 (Medium) with Low availability impact and no confidentiality or integrity impact.
NULL pointer dereference in the Linux kernel's DualPI2 traffic scheduler crashes the kernel when GSO segmentation accounting mismatches occur under a QFQ parent queueing discipline. Systems running Linux kernels prior to 6.18.39, 7.1.4, or 7.2-rc1 with DualPI2 configured as a child of QFQ are vulnerable to a local denial-of-service via kernel panic. No public exploit code exists and EPSS is 0.15% (5th percentile), reflecting the niche configuration required; however, the availability impact is total (kernel crash) when conditions are met.
Incorrect error-path logic in the Linux kernel's i2c-i801 SMBus driver allows a local, low-privileged user to trigger a hardware state machine corruption leading to a system-wide hung task panic. When i801_check_pre() returns -EBUSY because the BIOS/ACPI firmware legitimately holds the SMBus controller, the driver unconditionally writes to SMBHSTSTS hardware registers without owning the controller, destroying the firmware's in-progress transaction and permanently corrupting the SMBus state machine. This produces an infinite 'SMBus is busy' error log flood, causes a console livelock that starves processes competing for mmap_lock, and ultimately triggers the hung task watchdog. No public exploit is identified at time of analysis; EPSS is 0.17% (6th percentile) and the vulnerability is not in CISA KEV.
Kernel panic via NULL dereference in the Linux kernel BPF subsystem affects systems compiled with CONFIG_BPF_LSM=y where the BPF LSM is not activated at boot. A locally authenticated user with low privileges can create a BPF_MAP_TYPE_INODE_STORAGE map under this misconfigured state, causing bpf_inode() to alias the struct rcu_head.func callback pointer; when map cleanup nulls this aliased pointer, rcu_do_batch() subsequently attempts an instruction fetch at address 0x0, triggering an immediate kernel panic and complete system denial of service. No public exploit is identified at time of analysis; EPSS sits at 0.14% (4th percentile), consistent with the narrow triggering conditions required.
NULL pointer dereference in the Linux kernel's team network driver (net/team/team_core.c) allows a local attacker with CAP_NET_ADMIN to crash the kernel by racing a mode change against concurrent packet transmission. The vulnerability arises because __team_change_mode() wipes team->ops via memset() before reinstalling safe dummy handlers, creating a window where team_xmit() running under RCU on a parallel CPU can invoke a NULL function pointer. No public exploit code exists and the issue is not listed in CISA KEV, but the availability impact is total (kernel panic), and the fix is present in upstream stable commits.
NULL pointer dereference in the Linux kernel XFS log recovery path allows a local attacker to crash the kernel by mounting a crafted XFS filesystem image. The flaw exists in xlog_recover_reorder_trans() at fs/xfs/xfs_log_recover.c:1836, where a committed log transaction containing zero regions leaves ri_buf NULL, causing a fatal dereference when ITEM_TYPE() is called during recovery. EPSS is 0.16% (5th percentile) and no active exploitation has been observed; the vulnerability was discovered through an AI-assisted code audit, not in-the-wild activity.
Sysfs group corruption in the Linux kernel's kernfs/sysfs subsystem can cause local denial of service when a pre-existing attribute group directory is silently deleted during a failed update operation. When `sysfs_update_group()` encounters an allocation failure (-ENOMEM) in `create_files()`, the cleanup code in `internal_create_group()` calls `kernfs_remove(kn)` on a kernfs node obtained via `kernfs_find_and_get()` - a directory that existed before the call - rather than restricting removal to directories it created. This logic error, affecting multiple stable kernel branches prior to the respective fix commits, is not in CISA KEV, carries an EPSS of 0.17% (6th percentile), and no public exploit has been identified.
Reference leak in the Linux kernel DAMON sysfs-schemes subsystem allows a local low-privilege attacker to cause a denial of service through accumulated cgroup object reference exhaustion. Affected are kernel builds from Linux 6.3 (commit 29cbb9a13f05b20f0777c60db9603730b487a4e0) through stable branches prior to 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1, on systems where DAMON is active and cgroup-path-based memory schemes are configured via sysfs. No public exploit has been identified and EPSS is 0.16% (5th percentile), consistent with a kernel resource-management flaw requiring specific local conditions.
NULL pointer dereference in the Linux kernel's EFI runtime subsystem crashes affected systems when ACPI Platform Runtime Mechanism (PRM) handlers are invoked during early boot before the EFI runtime workqueue has been allocated. Systems with EFI PRM-capable firmware running unpatched kernels between the introduction of commit 5894cf571e14 and the respective stable-branch fixes are affected. No public exploit or CISA KEV listing exists; the vulnerability manifests as a kernel panic during initialization on susceptible hardware, resulting in a denial of service.
Reference count leaking in the Linux kernel's hardware memory poison accounting subsystem (drivers/base/memory) causes memory block device objects to remain unreleased across repeated hardware memory error events, gradually degrading system stability. Affected kernels span multiple stable branches from introducing commit 5033091de814 through their respective fix commits, with patched releases available at 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and no active exploitation is recorded (EPSS 0.16%, 5th percentile); this is a slow-accumulating resource leak rather than an immediately weaponizable flaw.
Memory hotplug removal in the Linux kernel leaks device references because `find_memory_block()` acquires a kobject reference inside `remove_memory_blocks_and_altmaps()` that is never released, allowing the reference count to accumulate unchecked across repeated memory block removal cycles. Systems with memory hotplug support - including virtual machines using ACPI memory balloon drivers and bare-metal servers with hot-pluggable DIMM slots - are affected across multiple stable kernel branches, with patches confirmed for 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and exploitation probability is extremely low (EPSS 0.16%), though the availability impact is rated high: leaked references accumulated over repeated hotplug cycles can eventually precipitate a kernel panic.