Linux
Monthly
Integer underflow in the Linux kernel fastrpc misc driver corrupts DMA addresses sent to Qualcomm DSPs, enabling a local low-privileged user to crash the DSP subsystem or induce a kernel panic. The flaw in fastrpc_get_args() affects all major stable kernel branches from 5.15 through 7.1-rc3 and is patched across multiple stable series. No public exploit exists and EPSS probability is 0.17% (7th percentile), indicating low real-world exploitation risk despite broad platform coverage.
NULL pointer dereference in the Linux kernel's fastrpc misc driver crashes the kernel when a Qualcomm DSP sends a glink message before the fastrpc_rpmsg_probe() initialization routine completes. Systems using the Qualcomm FastRPC subsystem - primarily Android and embedded Qualcomm SoC platforms running Linux 5.1 through unpatched 6.x/7.x stable branches - are vulnerable to a local denial-of-service (kernel panic) at boot. No public exploit exists and EPSS is 0.17% (6th percentile), consistent with a hardware-timing race condition requiring specific Qualcomm DSP hardware rather than generic remote exploitation.
Corrupted reverse-mapping (rmap) state in the Linux kernel's mm/huge_memory subsystem crashes or destabilizes affected systems through a flag misinterpretation in set_pmd_migration_entry() for device-private PMD entries. On x86-64 with CONFIG_MEM_SOFT_DIRTY enabled, the function incorrectly reads the softdirty bit as a write-permission flag - because _PAGE_SWP_SOFT_DIRTY aliases _PAGE_RW - causing migration entries to be marked writable when they should be read-only, ultimately triggering a VM_WARN assertion in __folio_add_anon_rmap() when an AnonExclusive folio reaches entire_mapcount=2. No public exploit exists and no active exploitation is confirmed; a vendor patch is available as of Linux 7.0.13 and 7.1.
Hugetlb VMA reservation leak in the Linux kernel mm/hugetlb subsystem allows a local authenticated user to trigger SIGBUS on a process at a previously reserved huge-page address. Two code paths - the UFFDIO_COPY resubmission path and the fork-time copy-on-write path - fail to call restore_reserve_on_error() after copy_user_large_folio() returns an error, leaving the per-VMA reservation map entry marked consumed. No public exploit exists and EPSS is 0.17% (6th percentile), but patches are available in multiple stable branches.
NULL pointer dereference in the Linux kernel's dw_mmc-rockchip MMC driver triggers kernel panics on systems running legacy Rockchip SoCs (rk2928, rk3066, rk3188) when the MMC subsystem initializes. Commit ff6f0286c896 introduced a mandatory private-data access path that was never populated for these old controllers - which historically had no UHS support and no parse_dt callback - causing a reproducible kernel crash on affected hardware. No active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.17% (6th percentile) reflects negligible real-world exploitation probability; the primary risk is an accidental reliability failure on embedded systems running these legacy SoCs.
Thunderbolt XDomain property validator in the Linux kernel triggers a heap underflow when processing zero-length TEXT property entries, enabling a local low-privileged attacker to crash the kernel (denial of service). The root cause is in tb_property_entry_valid(), which permits length==0 for TEXT entries that subsequently compute an array index of -1 during null-termination (0 * 4 - 1), writing one byte before the allocated buffer. No public exploit has been identified and EPSS is extremely low at 0.18% (8th percentile), indicating negligible opportunistic exploitation pressure despite the kernel's ubiquitous deployment footprint.
NULL pointer dereference in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user to trigger a kernel panic by invoking the kfd_ioctl_set_debug_trap() ioctl with a non-zero num_queues value and a NULL queue_array_ptr. The root flaw is that get_queue_ids() returns NULL in this case rather than ERR_PTR(-EINVAL), and both callers check only IS_ERR() - since IS_ERR(NULL) evaluates false, execution proceeds to q_array_invalidate(), which immediately dereferences the NULL pointer while iterating, crashing the kernel. No public exploit has been identified and the EPSS score of 0.17% (6th percentile) confirms low observed exploitation probability, though the trigger path is mechanically simple for any user with /dev/kfd access.
NULL pointer dereference in the Intel Xe GPU driver (drm/xe) causes a kernel panic during system suspend or shutdown when display hardware is disabled via hardware fuses rather than absent at initial probe. Systems running Linux 6.8 and later with Intel Xe GPUs in fuse-disabled display configurations are affected; a low-privileged local user can trigger an unplanned system crash by initiating suspend or shutdown. No public exploit exists and EPSS is 0.17% (6th percentile), reflecting this as a reliability and local-denial-of-service issue rather than a broad security priority.
Reference counting leaks in the Linux kernel's drm/v3d driver allow a local user to exhaust kernel memory and trigger a denial-of-service condition on systems equipped with Broadcom VideoCore VI GPUs (e.g., Raspberry Pi 4/5). The flaw exists across three code paths in the SET_GLOBAL and CLEAR_GLOBAL perfmon ioctls, as well as in the perfmon destroy path, each of which fails to release references acquired by v3d_perfmon_find(). No public exploit or active exploitation has been identified; EPSS probability stands at 0.17%, reflecting negligible automated exploitation interest.
Memory exhaustion via vaddr leak in the Linux kernel's V3D DRM driver allows a local low-privileged user to degrade or deny service on systems equipped with Broadcom V3D GPUs. The function v3d_rewrite_csd_job_wg_counts_from_indirect() maps two buffer objects (indirect buffer and workgroup buffer) but takes an early return path - without releasing the vaddr mappings - whenever any workgroup count read from the indirect buffer is zero, permanently leaking both BO mappings per triggering job submission. No public exploit has been identified and EPSS sits at the 6th percentile (0.17%), consistent with the hardware-specific, local-only attack surface; this vulnerability is not listed in CISA KEV.
The drm/v3d GPU driver in the Linux kernel mishandles indirect Compute Shader Dispatch (CSD) jobs that carry zeroed workgroup dimension counts, allowing a local low-privilege user with GPU compute access to crash the VideoCore VI GPU subsystem. The hardware interprets a zero workgroup count as 65536 - exceeding the user-space-exposed maximum of 65535 - instead of treating the dispatch as a no-op, causing undefined GPU behavior and a denial-of-service condition. Exploitation is constrained to Broadcom VideoCore VI hardware (Raspberry Pi 4/5 ecosystem); EPSS is 0.17% (6th percentile), no public exploit exists, and the vulnerability is absent from CISA KEV.
NULL pointer dereference and buffer over-read in the Linux kernel's AMD display driver (drm/amd/display) can be triggered by a local user writing to the sdp_message debugfs node, causing a kernel panic and denial of service. The dp_sdp_message_debugfs_write() function fails to check whether connector->base.state->crtc is NULL - a valid transient state after GPU hotplug before an atomic commit - and unconditionally passes 36 bytes to copy_from_user() regardless of the caller-provided size, enabling a second over-read path. No public exploit or CISA KEV listing exists; EPSS is 0.18% (7th percentile), consistent with a localized, hardware-dependent DoS.
Local information disclosure in the Linux kernel's netfilter nft_fib module leaks uninitialized stack data to userspace when handling NFT_FIB_RESULT_OIFNAME or the NFTA_FIB_F_PRESENT flag. An attacker with low privileges (e.g., CAP_NET_ADMIN) can read sensitive kernel memory to potentially bypass KASLR. No active exploitation has been reported, and EPSS indicates a very low probability (0.18%) of widespread exploitation; vendor patches are available.
Kernel panic via RCU locking imbalance in the DRBD subsystem's drbd_adm_dump_devices() function affects Linux kernel versions from the introduction of commit a55bbd375d18 through multiple stable branches. A locally authenticated low-privilege user who can invoke DRBD administrative operations may trigger a kernel crash by exploiting the unbalanced rcu_read_unlock() call - called without a preceding rcu_read_lock() - leading to a denial-of-service via kernel instability. No public exploit exists and EPSS probability is 0.18% (8th percentile), indicating very low real-world exploitation activity.
Memory leak in the Linux kernel block layer's zone revalidation path allows local low-privileged users to cause kernel memory exhaustion, resulting in a denial-of-service condition. Specifically, blk_revalidate_disk_zones() fails to free the args.zones_cond allocation on error paths after disk_revalidate_zone_resources() succeeds, leaving memory unreleased. No public exploit code exists and no active exploitation has been confirmed; EPSS probability stands at 0.14% (4th percentile), consistent with a low-priority local DoS affecting niche storage configurations.
Reference leak in the Linux kernel blk-cgroup subsystem allows a local low-privileged user to cause kernel disk object memory exhaustion, potentially leading to system instability or denial of service. The flaw exists in blkcg_maybe_throttle_current() since kernel 6.3, where a missing put_disk() call on error paths leaves disk references permanently unreleased. No public exploit exists and EPSS at 0.16% (5th percentile) indicates negligible exploitation probability; patches are available across multiple stable branches.
Improper locking in the Linux kernel's md (Multiple Devices/software RAID) subsystem causes a recursive kobject teardown deadlock when 'clear' is written to the sysfs array_state attribute. A local user with write access to an active md array's sysfs interface can trigger a kernel denial-of-service by exploiting the incorrect ordering of mddev_put() before sysfs_unbreak_active_protection() in md_attr_store(). No public exploit code is identified and EPSS exploitation probability is minimal at 0.17% (7th percentile); no CISA KEV listing indicates active exploitation has not been confirmed.
Availability loss in the Linux kernel ublk (userspace block device) subsystem can permanently hang IO commands when a ublk recovery server dies before issuing fetch commands for all IOs in a queue. The per-IO canceled flag, once set, is only cleared when every IO in the queue is fetched - if the server crashes mid-recovery, surviving IOs with set canceled flags can never be completed because ublk_cancel_cmd is blocked from calling io_uring_cmd_done. This results in a denial-of-service condition affecting systems using ublk-based userspace block devices. No public exploit has been identified at time of analysis, and EPSS is 0.14% (4th percentile), consistent with a low-exploitation-probability kernel logic flaw requiring specific local conditions.
Deadlock in the Linux kernel's md/raid456 subsystem during array reshape allows a local low-privileged user to hang the system indefinitely. When direct I/O spans the reshape position in a RAID 4/5/6 array, the I/O blocks in raid5_make_request() holding an active_io reference while waiting for reshape progress. If an administrator concurrently freezes the reshape and writes to md/suspend_lo or md/suspend_hi, mddev_suspend() deadlocks: it waits for active_io to drain, but the blocked I/O requires reshape progress that the frozen reshape thread can never provide. Exploitation requires a very specific confluence of conditions and no public exploit code or active exploitation (CISA KEV) has been identified; EPSS at 0.17% (7th percentile) confirms low real-world exploitation probability.
Deadlock in the Linux kernel btrfs filesystem subsystem triggers an unrecoverable kernel hang when the flushoncommit mount option is active and a reflink operation copies an inline extent to a destination offset beyond the target inode's i_size. The circular wait arises because the reflink task holds the extent io tree lock while blocking on a pending transaction commit, while the commit's delalloc flush simultaneously blocks trying to acquire that same held lock. No public exploit or CISA KEV listing exists; EPSS is 0.18% (8th percentile), reflecting very low real-world exploitation interest.
Memory leak in the Linux kernel's amd-pstate driver allows local availability impact on systems running AMD CPUs when EPP (Energy Performance Preference) initialization fails. The amd_pstate_epp_cpu_init() function allocates a cpudata object at entry but lacks a corresponding free on the error path triggered when setting the EPP value fails, causing kernel heap memory to leak on each failed CPU initialization event. No public exploit exists and EPSS sits at 0.15% (5th percentile), reflecting negligible adversarial interest; risk is primarily operational - repeated CPU hotplug cycles on affected hardware can progressively exhaust kernel memory.
Unsafe NMI-context invocation of perf_allow_kernel() in the Linux kernel's AMD IBS (Instruction Based Sampling) perf handler can cause a fatal kernel crash on AMD-powered systems running affected stable branches from commit 50a53b60e141d7e3 onward. A local user with perf event access on an AMD system can trigger the IBS NMI handler path, inducing a kernel panic or deadlock as the unsupported function call violates NMI-context restrictions. No public exploit has been identified at time of analysis; EPSS is 0.15% (5th percentile), consistent with a niche hardware-specific kernel subsystem flaw with no current exploitation activity.
Memory leaks in the Linux kernel's ath11k Wi-Fi driver (Qualcomm 802.11ax/Wi-Fi 6) expose systems to local availability-only denial-of-service via kernel memory exhaustion. The affected functions ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid() fail to release allocated beacon template memory when error conditions occur in parameter setup, causing incremental heap exhaustion. With EPSS at 0.16% (5th percentile), no public exploit, and no CISA KEV listing, this is a low-urgency fix discovered through static analysis - not active exploitation.
Null pointer dereference in the Linux kernel's BPF LWT (Lightweight Tunnel) subsystem allows a local user with BPF syscall privileges to crash the kernel via a denial-of-service. The flaw exists because bpf_prog_test_run_skb constructs a socket buffer (skb) without initializing skb->_skb_refdst; when a BPF program invokes the bpf_lwt_xmit_push_encap helper through this test path, the subsequent dereference of skb_dst(skb)->dev hits a null pointer and triggers a kernel panic. No public exploit or CISA KEV listing exists, and EPSS is very low at 0.18% (7th percentile), consistent with the specialized access required.
PowerPC 64-bit (ppc64le/Book3S64) Linux kernel systems from version 5.8 onward can be crashed via a local race condition between concurrent move_pages() and munmap() operations on Transparent Huge Page (THP) PMD-backed memory. During the PMD migration sequence, a narrow window exists where the PMD entry holds a migration swap entry with pmd_present=0; a concurrent munmap() acquiring the same page table lock during this window triggers a VM_BUG_ON() assertion in pmdp_huge_get_and_clear_full(), causing a kernel panic. No public exploit is identified and EPSS stands at 0.15% (5th percentile), but the DoS impact is confirmed by upstream kernel developers with real hardware traces on IBM POWER10 and is patched in stable releases 7.0.10 and 7.1.
The Marvell Libertas USB WiFi driver in the Linux kernel invokes usb_kill_urb() and usb_kill_anchored_urbs() from interrupt context during the HCD giveback path, causing a kernel BUG() or deadlock because those functions may sleep. Systems with a Marvell Libertas USB WiFi adapter attached can be crashed by a local low-privileged user triggering the race condition, resulting in a denial of service via kernel panic. No public exploit exists and EPSS is 0.15% (5th percentile), indicating negligible exploitation probability; the constraint to specific legacy hardware further limits real-world impact.
BPF local storage deletion in the Linux kernel deadlocks when `bpf_xxx_storage_delete()` helpers execute within a Non-Maskable Interrupt (NMI) context, because the underlying RCU-based freeing mechanisms (`kfree_rcu`, `call_rcu`, `call_rcu_tasks_trace`) are not safe in NMI or reentrant execution paths. Locally privileged users capable of loading BPF programs attached to NMI-triggerable events can exploit this to cause a CPU-level deadlock, denying availability on the affected processor. No public exploit has been identified and EPSS at 0.14% (4th percentile) confirms this is a very low probability of opportunistic exploitation; impact is purely availability.
NULL pointer dereference in the Linux kernel's MediaTek mt76/mt7925 WiFi driver crashes affected systems when the `vif` (virtual interface) pointer is uninitialized at the time `mt7925_mac_write_txwi` calls `ieee80211_vif_is_mld(vif)`. Local low-privilege users on systems equipped with mt7925 hardware and running unpatched kernels can trigger a kernel panic, resulting in a denial of service. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.17% (6th percentile) reflects negligible real-world exploitation probability at this time.
Memory exhaustion in the Linux kernel mt76 WiFi driver allows a local low-privileged user on systems with MediaTek MT76 hardware to cause denial of service through kernel memory leakage during module teardown. The mt76_dma_cleanup routine fails to destroy page_pools associated with WED RRO receive queues (queues not tied to NAPI), and does not return pages to the pool when WED is not enabled - resulting in unreclaimed kernel memory on each module unload cycle. No public exploit exists and EPSS probability sits at 0.17% (6th percentile), consistent with a niche hardware-specific leak with no code-execution path.
Deadlock in the Linux kernel's mt76/mt7925 MediaTek WiFi driver can be triggered by a local low-privileged user, causing the wireless networking subsystem to hang indefinitely. The flaw exists in mt7925_roc_abort_sync(), which calls cancel_work_sync() while already holding dev->mt76.mutex - the same mutex held by roc_work() - producing a classic mutual-wait deadlock with no path to resolution. Systems running affected kernel versions with MediaTek MT7925 WiFi hardware are vulnerable to a local denial of service; no public exploit has been identified and EPSS places exploitation probability at 0.17% (6th percentile), consistent with the niche hardware requirement.
Kernel memory exhaustion in the Linux mt76 WiFi driver allows a local low-privileged user on affected hardware to gradually degrade system availability. The functions mt76_connac_mcu_sta_wed_update() and mt76_connac_mcu_sta_key_tlv() may fail before the allocated socket buffer (skb) is handed off to mt76_mcu_skb_send_msg() for transmission and cleanup, leaving the skb permanently leaked. With EPSS at the 5th percentile, no KEV listing, and discovery solely via static analysis, this is a stability maintenance concern rather than an active security threat.
Mutex deadlock in the Linux kernel's mt7921 WiFi driver (mt76/mt7921 subsystem) can render the WiFi subsystem permanently unresponsive on affected systems. The deadlock arises during station removal: the call chain mt76_sta_state() → mt76_sta_remove() → mt7921_mac_sta_remove() → mt7921_roc_abort_sync() invokes cancel_work_sync() while roc_work() holds dev->mt76.mutex and the removal path already owns the same lock - a classic ABBA deadlock with no progress possible. No public exploit is identified and EPSS sits at 0.17% (6th percentile), placing this firmly in the patch-and-move-on category for most organisations, though Linux distributions serving MT7921 hardware (common in consumer laptops) should prioritise kernel updates.
Deadlock in the Linux kernel mt76 WiFi driver's remain-on-channel path allows a local low-privileged user to crash or hang the WiFi subsystem. The flaw affects kernels containing the mt76 driver from commit a8f424c128 through the fixed releases (6.18.33, 7.0.10, 7.1), with no confidentiality or integrity impact - only availability. No public exploit code exists and EPSS sits at 0.17% (6th percentile), consistent with a local, hardware-specific denial-of-service with negligible opportunistic exploitation risk.
Control Flow Integrity (CFI) protection for the BPF subsystem's btf_dtor_kfunc_t type is silently compiled out in affected Linux kernel versions because BPF code references the deprecated CONFIG_CFI_CLANG symbol rather than the renamed CONFIG_CFI, leaving CFI violations in BPF destructor functions unchecked and capable of crashing the kernel. Locally-privileged users on affected kernel builds - those compiled with CFI support, typically Clang-built distributions - can trigger a kernel panic by interacting with the BPF subsystem. This vulnerability is not listed in the CISA KEV catalog, no public exploit has been identified, and the EPSS score of 0.16% (5th percentile) reflects minimal real-world exploitation probability.
BPF subsystem argument-tampering in the Linux kernel allows local attackers with CAP_BPF privileges to abuse the kprobe+freplace program chaining path to overwrite kernel function arguments via a manipulated `struct pt_regs`, causing kernel denial of service or subversion of kernel function behavior. The root mechanism is that freplace programs inherit the `kprobe_write_ctx=true` permission from a parent kprobe program, enabling register writes that should be confined to uprobe contexts. No public exploit or CISA KEV listing is confirmed; EPSS sits at the 6th percentile. Patches are available in Linux 6.18.33, 7.0.10, and the 7.1 mainline branch.
Error pointer dereference in the Linux kernel's brcmfmac Broadcom WiFi driver allows a local low-privilege attacker to crash the kernel via a NULL pointer dereference, resulting in denial of service. The function brcmf_chip_add_core() in brcmf_chip_recognition() can return an ERR_PTR sentinel value that is never validated before being dereferenced at five separate code sites (lines 1010-1022 of chip.c), as identified by Smatch static analysis. No public exploit or active exploitation has been identified; EPSS sits at 0.18% (7th percentile), consistent with a low-priority local DoS affecting only systems with Broadcom WiFi hardware.
Lock ordering deadlock in the Linux kernel BPF task_vma iterator allows a local low-privileged user with BPF program execution rights to trigger a system hang or denial of service. Holding the per-VMA lock across BPF program body execution creates a circular dependency (vm_lock → i_rwsem → mmap_lock → vm_lock) when BPF helpers internally acquire mmap_lock. Patches are available across multiple stable branches; EPSS is low at 0.16% and no public exploit or active exploitation has been identified.
RCU stall denial-of-service in the Linux kernel BPF subsystem allows a local low-privileged user to cause kernel-level availability degradation by triggering map clearing on a large PROG_ARRAY BPF map. The missing cond_resched() call in bpf_fd_array_map_clear() prevents CPU yielding during an expensive per-entry loop, starving the RCU grace period mechanism and triggering watchdog stalls in the deferred workqueue. No active exploitation is confirmed - EPSS is 0.16% (5th percentile) and the vulnerability is absent from CISA KEV - making this a maintenance-tier patch rather than an emergency response priority.
Uninitialized memory read in the Linux kernel's hamradio 6pack TTY driver (net/hamradio/6pack.c) allows a local low-privileged user to crash the kernel, causing a denial of service. The flaw exists across a broad range of stable kernel branches from 2.6.12 through at least 7.0, and patches have been issued across eight stable series. No public exploit code exists and no active exploitation has been reported; with an EPSS of 0.16% at the 6th percentile, real-world risk is constrained by the highly niche deployment context of amateur-radio 6pack hardware.
NULL pointer dereference in the Linux kernel's Traffic Control cls_fw (firewall classifier) module causes a local denial of service via kernel crash. Affected kernels from commit ed76f5edccc9 onward publish TC filters to the shared datapath block before the ->change() validation function runs; an attacker with CAP_NET_ADMIN who adds an invalid 'old-style' cls_fw filter to a shared block can trigger fw_classify() to dereference a NULL 'q->handle' pointer when live traffic hits the unvalidated filter. No public exploit or KEV listing exists at time of analysis, and EPSS sits at the 7th percentile (0.17%), consistent with a kernel-local, capability-gated DoS.
Memory leak in the Linux kernel's network scheduler (net_sched) subsystem allows a local low-privileged user to exhaust kernel memory and degrade system availability. The flaw resides in qdisc_dequeue_drop(), which fails to account for root qdiscs that lack the TCQ_F_DEQUEUE_DROPS flag - leaving packet buffers stranded indefinitely on child qdisc to_free lists during qdisc_run_end() cleanup. No active exploitation is confirmed (not in CISA KEV) and EPSS sits at 0.14% (4th percentile), reflecting the low probability of opportunistic abuse given the local access and specific configuration requirements.
Out-of-bounds read in the Linux kernel's BPF test interface (bpf_prog_test_run_skb) allows local users with BPF syscall access to crash the kernel by supplying a crafted test packet containing only an Ethernet header bearing an IPv4 or IPv6 EtherType but no L3 payload. The code calls eth_type_trans() to set skb->protocol and then unconditionally dereferences ip_hdr(skb) or ipv6_hdr(skb) without first validating that the supplied buffer is large enough to contain an IP or IPv6 header, producing a kernel panic. Patched stable releases are confirmed across eight kernel branches; no public exploit or CISA KEV listing exists, and EPSS probability is 0.16% (6th percentile).
Null pointer dereference in the Linux kernel Bluetooth HCI UART line discipline driver (hci_ldisc) allows local low-privileged users on systems with UART-attached Bluetooth hardware to crash the kernel, causing denial of service. The flaw spans multiple stable kernel branches from 5.4.x through 6.15 and stems from a missing flag clear in the error path of hci_uart_register_dev(). No public exploit code exists and EPSS sits at the 7th percentile (0.17%), indicating low real-world exploitation probability; patched versions are available across all affected stable branches.
Kernel panic via unchecked error pointer dereference in the Linux kernel's drm/sun4i display backend driver affects Allwinner SoC-based systems running kernel versions from 4.17 up to the patched releases. In sun4i_backend_atomic_check() at drivers/gpu/drm/sun4i/sun4i_backend.c:496, the return value of drm_atomic_get_plane_state() is not validated against IS_ERR() before dereference, allowing a local low-privilege user to crash the kernel. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.16% (6th percentile) reflects negligible real-world exploitation interest.
Resource leak in the Linux kernel ASoC STI audio driver allows a local authenticated user to exhaust kernel memory by repeatedly loading and unloading the driver, degrading system availability. The vulnerability stems from regmap_field objects allocated during STI audio player initialization never being released on driver removal. With EPSS at 0.17% (7th percentile), no KEV listing, and no public exploit, this is a low-priority maintenance fix rather than an actively weaponizable flaw. Vendor-released patches are available across multiple stable kernel branches.
NULL pointer dereference in the Linux kernel dm-cache subsystem crashes the kernel when concurrent writes target the same cached block in passthrough mode. The flaw affects any kernel with a dm-cache device explicitly configured in passthrough mode since version 4.12, allowing a local low-privileged user with write access to the block device to cause a kernel panic and complete denial of service. No public exploit code exists and EPSS at 0.18% (7th percentile) confirms very low exploitation probability; fixed across multiple stable kernel series with patches confirmed by Ubuntu security advisories.
Write operation hang in the Linux kernel dm-cache subsystem's passthrough mode allows a local user with low privileges to stall I/O indefinitely on affected block devices. The defect lies in `invalidate_remove()`, which configures a remapped bio for submission to the cache origin but discards it without dispatching, leaving write operations permanently pending. No public exploit has been identified at time of analysis; EPSS at 0.18% (8th percentile) and a strictly local attack vector place this firmly in the operational-bug category rather than an active threat.
Data loss in the Linux kernel dm-cache subsystem occurs when LVM's table preload feature is used to switch a writeback cache to passthrough mode while dirty mappings exist. The dirty mapping check was designed assuming table reloads happen only after device suspension (which flushes dirty blocks), but LVM's preload path bypasses this assumption, allowing dirty cache blocks to be silently loaded into passthrough mode where they will never be written back to the origin device. No public exploit code exists; reproduction requires a deliberate sequence of dmsetup and fio operations documented in the CVE description itself. EPSS is 0.18% (7th percentile), consistent with a local, configuration-specific data-loss condition rather than a remotely exploitable flaw.
Memory leak in the Linux kernel dm-cache metadata subsystem can be triggered by local users with low privileges to gradually exhaust kernel memory, causing system availability degradation. The flaw resides in dm_cache_metadata_abort, where a temporary block_manager object allocated before acquiring root_lock is not freed when the lock acquisition fails due to a read-only block manager - a condition reproducible by reloading a dm-cache table during metadata error states. No public exploit code and no CISA KEV listing have been identified; EPSS of 0.18% (8th percentile) confirms very low current exploitation probability.
NULL pointer dereference in the Linux kernel's DRM Cadence MHDP8546 DisplayPort bridge driver (cdns-mhdp8546-core) can be triggered by a local low-privileged user on systems with the affected hardware, causing a kernel panic and complete system availability loss. The flaw arises when error recovery paths in cdns_mhdp_modeset_retry_fn() attempt to access a mutex via a connector pointer that has not yet been initialized in the DRM_BRIDGE_ATTACH_NO_CONNECTOR code path. No public exploit code or active exploitation (CISA KEV) has been identified; patches are available across multiple stable kernel branches.
Instability and system crash vulnerability in the Linux kernel's Qualcomm DRM/MSM Display Processing Unit (DPU) driver allows a local low-privileged attacker to trigger a voltage-clock mismatch that causes the MMCX power rail to fall to MIN_SVS while the DPU core clock remains at its maximum frequency. This race condition between power management and clock control during runtime suspend/resume can leave the hardware in an unsustainable electrical state, leading to display subsystem failure or kernel panic. No public exploit identified at time of analysis; EPSS of 0.18% reflects the hardware-specific, local-only nature of this flaw.
Incorrect memory access in the Linux kernel's ASoC Qualcomm QDSP6 audio topology driver can trigger a kernel panic on affected Qualcomm Snapdragon hardware when virtual DAPM widgets are processed without a type guard. The flaw, introduced at commit 36ad9bf1d93d66b901342eab9f8ed6c1537655a6, affects kernel branches from 5.16 onward until the respective stable fixes. No active exploitation has been identified (not in CISA KEV) and the EPSS score of 0.17% (7th percentile) reflects negligible real-world exploitation probability; hardware dependency further constrains the affected population.
Operation sequencing flaw in the Linux kernel's tegra194 PCIe endpoint driver causes a Control Backbone (CBB) timeout when PERST# is deasserted twice in succession. During the second deassert cycle, the driver invokes pci_epc_deinit_notify() and dw_pcie_ep_cleanup() - which access DBI register PCIE_MISC_CONTROL_1_OFF at offset 0x8bc - before reset_control_deassert() powers on the PCIe controller core, triggering a hardware bus timeout and denying availability of the PCIe subsystem. With an EPSS of 0.18% (7th percentile), no CISA KEV listing, and hardware-specific scope limited to NVIDIA Tegra194 SoCs, this is a low-probability exploitation target with real-world impact confined to embedded and automotive Linux deployments.
NULL pointer dereference in the GFS2 filesystem's log release path crashes the Linux kernel during unmount on affected versions. The vulnerability arises because gfs2_log_release() dereferences sdp->sd_jdesc without checking for NULL, which can occur after the journal descriptor has already been freed during the unmount sequence. A prior fix (commit 35264909e9d1) addressed the same class of bug in gfs2_log_flush() but left gfs2_log_release() unprotected. No public exploit exists (EPSS 0.17%), exploitation is limited to local access on GFS2-mounted systems, and patches are available across all affected stable kernel branches.
Heap buffer overflow in the Linux kernel EFI capsule loader arises from an incorrect sizeof operand in a krealloc() call inside __efi_capsule_setup_info(), allocating half the required space on 32-bit PAE systems where phys_addr_t is 64-bit but pointers are 32-bit. When physical addresses are subsequently written via page_to_phys(), the undersized heap buffer is overflowed, corrupting kernel heap metadata and causing a system crash. Exploitation is architecturally constrained to 32-bit PAE kernels; 64-bit systems are unaffected because sizeof(phys_addr_t) equals sizeof(phys_addr_t*). No public exploit exists, EPSS is 0.19% (9th percentile), and no active exploitation has been recorded.
NULL pointer dereference in the Linux kernel's fwctl subsystem allows a local low-privilege user to crash the kernel when CXL memory expansion hardware is present and a device removal is triggered. The defect stems from a deterministic module initialization ordering race between the CXL and fwctl drivers, leaving knode_class uninitialized at device registration time and causing device_del() to dereference it fatally on removal. No public exploit identified at time of analysis; EPSS of 0.17% (6th percentile) reflects very low exploitation probability consistent with the local-only attack surface.
Kernel panic via reachable assertion in the OCFS2 cluster filesystem allows a local, low-privileged user to crash the system by issuing a crafted OCFS2_IOC_GROUP_ADD ioctl. The root cause is that ocfs2_group_add() invokes ocfs2_set_new_buffer_uptodate() on a user-supplied group block number before ocfs2_verify_group_and_input() has validated that number; if the block already exists in the metadata cache, the BUG_ON at uptodate.c:509 fires unconditionally, triggering a kernel oops. No public exploit has been identified and EPSS is 0.18% (7th percentile), but the fix is widely available across maintained stable branches.
Out-of-bounds read in the Linux kernel's IMA (Integrity Measurement Architecture) filesystem subsystem causes a kernel panic during boot on systems with TPM chips advertising hash algorithms unsupported by the kernel. Specifically, when `ima_tpm_chip->allocated_banks[i].crypto_id` is set to the sentinel `HASH_ALGO__LAST` for an unmapped TPM algorithm (demonstrated with TPM_ALG_SHA3_256 = 0x0027), the `create_securityfs_measurement_lists` function dereferences the out-of-range index into `hash_algo_name[]`, triggering a KASAN-detected global-out-of-bounds read and kernel crash. No public exploit has been identified and EPSS is 0.17% (6th percentile), making deliberate exploitation unlikely; the primary risk is inadvertent boot-time denial of service on hardware with qualifying TPM chips.
Deadlock in the Linux kernel's usbhid driver (`hid_post_reset()`) can halt systems connected to composite USB devices that combine HID and block storage or UAS components. When such a device undergoes a reset during block IO error handling, memory allocations using the default GFP_KERNEL flag can trigger block IO reclaim, which deadlocks against the mutex already held by the reset path - producing a kernel hang. No public exploit has been identified, and EPSS of 0.18% (7th percentile) confirms very low exploitation likelihood; the fix replaces GFP_KERNEL with GFP_NOIO across all affected reset callbacks, and patches are available across multiple Linux stable branches.
The Linux kernel's BPF sockmap subsystem deadlocks when a BPF iterator program iterating over AF_UNIX sockets via `bpf_iter_unix_seq_show()` simultaneously attempts to update a sockmap entry during the same execution context. When `lock_sock_fast()` takes the spinlock fast path and holds `slock-AF_UNIX`, any subsequent `sock_map_update_elem()` call within the BPF iterator program spins indefinitely attempting to re-acquire the same spinlock on the same CPU, causing an unrecoverable kernel deadlock and loss of system availability. This is not confirmed actively exploited (not in CISA KEV), no public exploit has been identified, and EPSS at 0.17% (7th percentile) confirms negligible current exploitation interest; the real-world risk is constrained to specialized BPF workloads with specific capability requirements.
Null pointer dereference in the Linux kernel's BPF sockmap subsystem allows a local low-privileged user to crash the system via a race condition between AF_UNIX socket connection and sockmap proto update. The flaw exists because unix_stream_connect() sets sk_state to TCP_ESTABLISHED before assigning the peer pointer, creating a window where unix_stream_bpf_update_proto() dereferences unix_peer(sk) while it is still NULL. No public exploit exists and EPSS sits at the 8th percentile; this is not in CISA KEV, and the narrow race window constrains practical exploitation.
NULL pointer dereference in the Linux kernel's BPF verifier crashes the kernel when a scalar register is stored into a kptr map slot during BPF program loading. Introduced by commit ab6c637ad027, which refactored map_kptr_match_type() to call btf_is_kernel(reg->btf) before the guard that excludes non-BTF register types - exposing scalar registers (reg->btf == NULL) to an immediate NULL dereference. A local user with BPF syscall access can trigger a kernel panic, producing a denial of service. No active exploitation is confirmed (not in CISA KEV), and EPSS is low at 0.17% (6th percentile), consistent with the local-only, DoS-limited impact.
Memory leak in the Linux kernel's Renesas i3c master driver causes local denial of service through kernel memory exhaustion. Specifically, the xfer structure allocated by renesas_i3c_alloc_xfer() inside renesas_i3c_i3c_xfers() is never released, allowing a local user with low privileges on affected Renesas SoC hardware to exhaust kernel memory by repeatedly triggering i3c transfers. No public exploit has been identified at time of analysis, and EPSS probability sits at 0.17% (6th percentile), reflecting low real-world exploitation interest.
Uninitialized variable read in the NTFS3 filesystem driver (`ntfs_iomap_begin()`) of the Linux kernel allows a local authenticated user to crash the system by triggering a zero-length run condition that causes the `lcn` (logical cluster number) variable to be consumed before assignment. The flaw affects Linux 7.0 up to 7.0.10 and Linux 7.1 prior to the stable fix commits, with the defect discovered and confirmed by Google syzbot via KMSAN. No public exploit has been identified and EPSS probability is very low (0.17%, 7th percentile); patches are available in Linux 7.0.10 and 7.1.
Error pointer dereference in the Linux kernel USB Type-C TI Power Delivery (tipd) driver allows a local low-privileged user to crash the kernel (denial of service) on systems with TI CD321x or TPS6598x USB Type-C controller hardware. The flaw in `cd321x_update_work()` at `drivers/usb/typec/tipd/core.c:827` logs a warning when `typec_register_partner()` fails but omits an early return, causing a subsequent unconditional dereference of the error pointer via `typec_partner_set_identity()`. No public exploit code has been identified at time of analysis, EPSS probability is 0.17% (6th percentile), and the vulnerability is not listed in CISA KEV.
Kernel availability impact in the Linux NTFS3 filesystem driver allows a local low-privileged user to trigger a WARN_ON(1) in attr_data_get_block_locked() by accessing NTFS volumes containing compressed or sparse attributes with frame-aligned cluster boundaries. The root cause is a missing run-segment load for vcn0 when it resides in a different attribute segment than vcn after cmask rounding, causing run_lookup_entry() to return SPARSE_LCN and fire the kernel warning. No public exploit has been identified and EPSS is 0.15% (5th percentile), confirming this as a low-probability exploitation target despite the confirmed vendor patch.
Missing NUL termination in the Linux kernel's ntfs3 filesystem driver allows a local attacker with filesystem mount privileges to trigger an out-of-bounds memory read, crashing the kernel. The defect in ntfs_fill_super() leaves sbi->volume.label unterminated when a UTF-16 volume label converts to a UTF-8 string that exactly fills the fixed buffer, causing ntfs3_label_show() to read past the buffer boundary via a %s format specifier. No public exploit has been identified at time of analysis and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation interest despite the High availability impact in CVSS.
Unbounded string concatenation in the Linux kernel's Dell WMI BIOS interface driver (dell-wmi-sysman) allows a local low-privileged attacker on Dell hardware to crash the kernel. The populate_enum_data() function bounds each individual firmware-provided string but applies no remaining-space check during cumulative strcat() calls into fixed 512-byte struct members, enabling a buffer overflow that results in complete system availability loss. With an EPSS of 0.17% (7th percentile), no public exploit code, and no CISA KEV listing, this is a low-likelihood but straightforward local denial-of-service on Dell platforms running unpatched kernel versions.
Integer overflow in the Linux kernel SCSI target core allows a local attacker with low privileges to crash the kernel via crafted UNMAP commands. The `sbc_execute_unmap()` function performs a capacity bounds check on LBA + range but fails to guard against 64-bit wraparound, meaning an attacker can supply values that overflow to bypass the check and trigger a kernel panic. No public exploit code or CISA KEV listing exists; EPSS is 0.18% (7th percentile), reflecting the niche attack surface limited to systems actively running SCSI target daemons. Patches are confirmed available across all supported stable kernel branches.
Kernel panic in the SpaceMIT clock controller driver (`clk-spacemit-ccu`) can be triggered during CPU frequency scaling on systems running SpaceMIT RISC-V hardware. The root cause is an inverted boolean condition in `ccu_mix_trigger_fc()` that causes the frequency change trigger to be skipped at the wrong time and fired at the wrong time, crashing the kernel under normal cpufreq governor activity. Exploitation requires only local low-privilege access, but is practically limited to the narrow hardware footprint of SpaceMIT K1-based boards; no public exploit or CISA KEV listing exists, and EPSS is 0.17% (6th percentile).
Kernel panic in the Linux f2fs garbage collector allows a local low-privileged user to crash the system by triggering a VM_BUG_ON_FOLIO assertion when GC attempts to re-read a page already marked uptodate after multiple block relocations. The affected subsystem is f2fs (Flash-Friendly File System); systems using ext4, XFS, or other filesystems are not impacted. EPSS is extremely low (0.17%, 6th percentile) and no active exploitation has been identified, making this a stability/DoS concern primarily relevant to mobile, embedded, and flash-storage Linux deployments.
Data loss in the Linux kernel's f2fs (Flash-Friendly File System) driver exposes files created and synced before any checkpoint has been written to permanent loss on sudden power off. The race condition between fsync on newly created files and concurrent checkpoint operations causes f2fs_need_inode_block_update() to misread prematurely set nat_entry flags (IS_CHECKPOINTED and HAS_LAST_FSYNC), leading fsync to skip the inode block flush it actually requires. No public exploit identified at time of analysis; the EPSS score of 0.16% at the 6th percentile reflects the narrow triggering conditions and local-only attack surface.
Integer truncation in the Linux kernel's EROFS filesystem driver on 32-bit platforms causes logical cluster number (LCN) calculations to overflow at the 4 GiB boundary, resulting in incorrect block addressing and potential kernel-level availability impact. Affected systems are those running 32-bit Linux kernels (where `unsigned long` is 32 bits wide) with EROFS filesystems mounted. No public exploit exists and no active exploitation has been confirmed; EPSS stands at a very low 0.17% (6th percentile), consistent with the niche attack surface of 32-bit deployments.
Kernel panic via skb headroom exhaustion in the Linux kernel's Traffic Control (TC) act_mirred subsystem affects systems using block-cast packet redirection across mixed device types. The root cause is a copy-paste error in tcf_blockcast_redir() where dev_is_mac_header_xmit() is queried against the next device in the iteration (dev) rather than the device currently being transmitted to (dev_prev), causing tcf_mirred_to_dev() to make wrong MAC header push/pull decisions for intermediate devices. In the worst case, skb_push_rcsum is called with an incorrect mac_len, exhausting socket buffer headroom and triggering a kernel panic. No public exploit code has been identified and EPSS is 0.17% at the 6th percentile, consistent with low real-world exploitation interest.
Denial-of-service in the Linux kernel macvlan driver allows local users with network interface management privileges to crash netlink interface dumps by exploiting a missing netlink buffer size reservation for the IFLA_MACVLAN_BC_CUTOFF attribute. When bc_cutoff is set to any value other than the default (1) on a macvlan bridge interface, any subsequent attempt to dump that interface via GETLINK triggers nla_put_s32() to return -EMSGSIZE, fires a WARN_ON in rtnetlink, and prevents the interface from being enumerated. No public exploit tool has been identified and no active exploitation is confirmed; EPSS is 0.17% (6th percentile).
NULL pointer dereference in the Linux kernel nexthop routing subsystem allows a local privileged attacker to crash the kernel (denial of service) by exploiting a stale address-family flag state. The `has_v4` flag in nexthop groups is not updated when an IPv6 nexthop is replaced with an IPv4 one, letting a corrupt group bypass `fib6_check_nexthop` validation and attach to an IPv6 route; subsequent traffic through that route calls `nexthop_fib6_nh()`, which returns NULL for the AF_INET member, triggering the panic. No public exploit identified at time of analysis, though the CVE disclosure itself includes a functional step-by-step reproducer using standard `ip nexthop` and `ip route` commands, and the EPSS score of 0.18% (8th percentile) reflects low current real-world exploitation pressure.
NULL pointer dereference in the Linux kernel ICE (Intel Ethernet Controller) driver allows a local low-privileged attacker to trigger a kernel panic via a race condition during TX timestamp ring teardown. The flaw exists in systems using Intel ICE-series NICs with TX timestamping configured, where concurrent execution of ice_free_tx_tstamp_ring() and ice_tx_map() across CPU cores can cause CPU B to dereference a pointer that CPU A has already set to NULL. No public exploit or active exploitation has been identified; EPSS is 0.15% (5th percentile), consistent with its local, timing-dependent nature.
NULL pointer dereference in the Linux kernel ice driver's error path can cause a kernel panic on systems using Intel E800/E830 series Ethernet adapters. The flaw in ice_set_ringparam() leaves the ICE_TX_RING_FLAGS_TXTIME bit set after nullifying tstamp_ring, so a subsequent failure in ice_setup_tx_ring() triggers a dereference of a NULL tstamp_ring->desc pointer during error unwinding. No public exploit exists and EPSS sits at 0.15% (5th percentile), consistent with the discoverer's note that this was identified by manual code review rather than observed exploitation.
Denial of service in the Linux kernel's netfilter xtables subsystem exposes systems to local kernel panics caused by using inet-specific match extensions (xt_mac, xt_owner, xt_physdev, xt_realm) in incompatible protocol family contexts such as ebtables. The flaw was introduced by commit ab4f21e6fb1c, which broadened these extensions to NFPROTO_UNSPEC, inadvertently permitting their use in Ethernet bridge filtering contexts where IPv4-specific kernel data structures (e.g., dst->tclassid for xt_realm) are undefined or null. No public exploit has been identified and EPSS is 0.18% at the 7th percentile, indicating low adversarial interest despite the ubiquitous deployment footprint of the Linux kernel.
NULL pointer dereference in the Linux kernel's sch_dualpi2 queuing discipline (net/sched) allows a local attacker with low privileges to crash the kernel, causing a denial of service. The flaw exists in dualpi2_change(), which enforces updated queue limits after a qdisc reconfiguration: when traffic is exclusively queued in the L-queue and the C-queue is empty, the function unconditionally dereferences the NULL skb returned by the C-queue dequeue path, triggering a kernel panic. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), consistent with a locally-triggered, configuration-dependent kernel bug.
Resource exhaustion in the Linux kernel ksmbd SMB server allows a low-privileged authenticated SMB client to leak kernel file descriptor references by sending repeated SMB2 CREATE requests with a DURABLE_HANDLE_REQUEST_V2 context that produces a CreateGuid hit but a ClientGUID mismatch. Each such request increments the refcount on a ksmbd_file via ksmbd_fp_get() in ksmbd_lookup_fd_cguid() but the mismatch code path never calls the matching release, causing global_ft entries to be pinned indefinitely. Over time this defeats the durable file scavenger and causes long-lived kernel resource leaks that can degrade or deny availability. No public exploit has been identified at time of analysis and EPSS is 0.19% (9th percentile), indicating low opportunistic exploitation probability.
Stack memory disclosure in the Linux kernel RDS/IB subsystem exposes up to 26 bytes of uninitialized kernel stack contents - including kernel text and data pointers - to local unprivileged users via the getsockopt(SOL_RDS, RDS_INFO_IB_CONNECTIONS) interface. The leak enables KASLR bypass on systems where the kernel was built without CONFIG_INIT_STACK_ALL_ZERO=y, making this a useful primitive for chaining into privilege escalation. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS is very low at 0.18% (7th percentile), but the CVE description itself supplies a complete, step-by-step reproduction recipe that reduces practical exploitation complexity to near-trivial for any local user with AF_RDS socket access.
Improper RLIMIT_MEMLOCK accounting in the Linux kernel's vsock/virtio MSG_ZEROCOPY path allows a local low-privileged user to bypass per-process pinned-page limits, enabling unbounded kernel memory pinning that can drive the system toward memory exhaustion. The flaw is confined to the virtio vsock transport and is not remotely exploitable. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), reflecting low exploitation interest; however, a vendor-confirmed fix is available in stable releases.
Resource leak in the Linux kernel fsnotify subsystem causes hung tasks and local denial of service via a race condition in fsnotify_recalc_mask(). A local low-privilege user can trigger concurrent mark addition and removal on a filesystem connector object, causing an inode pointer returned by __fsnotify_recalc_mask() to be silently discarded rather than released via fsnotify_drop_object() - permanently blocking the umount path as fsnotify_sb_delete() waits indefinitely on the leaked reference. No public exploit exists and EPSS is at the 7th percentile, indicating negligible opportunistic exploitation risk.
Uninitialized memory use in the Linux kernel netdevsim subsystem allows a local low-privileged attacker to cause kernel crashes or potentially expose residual kernel heap contents via dummy packet trap operations. The root defect is in `nsim_dev_trap_skb_build`, where `skb_put` allocated space for a `struct iphdr` without zeroing it, leaving uninitialized kernel memory accessible in a dummy `sk_buff`. No public exploit code exists and the vulnerability is not in CISA KEV; EPSS stands at 0.18% (7th percentile), consistent with negligible opportunistic exploitation risk. Vendor-released patches are confirmed across all actively supported stable kernel branches.
Unbounded queue growth in the Linux kernel's netem (Network Emulator) traffic control subsystem allows a local low-privileged user to exhaust kernel memory and trigger a denial of service. The flaw exists because netem_enqueue() enforces queue depth limits using only q->t_len (packets in the internal tfifo), while packets placed into sch->q via the reorder path (__qdisc_enqueue_head) are silently excluded from that count, allowing total queue occupancy to grow beyond sch->limit without bound. No public exploit has been identified and the EPSS score of 0.18% (8th percentile) places this in the lowest exploitation-probability tier; however, the vulnerability affects a wide range of active stable kernel branches and patched versions are available.
Kernel crash via scheduler state corruption in the Linux kernel's CFS/EEVDF fair scheduler allows a local user to cause a NULL pointer dereference and system denial of service. When a task is forked while the parent's sched_entity has rel_deadline set, the child inherits stale deadline state that __sched_fork() fails to clear; a subsequent sched_yield() call on the child inflates vruntime by approximately 2x (observed: ~9.8e15 jumping to ~1.9e16), corrupting cfs_rq->sum_w_vruntime and ultimately causing pick_next_entity() to return NULL unexpectedly. No active exploitation has been identified (EPSS 0.17%, not in CISA KEV), and upstream stable patches are available across multiple kernel branches.
Race condition in the Linux kernel PSP network subsystem allows a local low-privileged attacker to crash the kernel through a TOCTOU flaw in device association creation. In `psp_assoc_device_get_locked()`, a device reference acquired under RCU becomes stale before the protecting lock is taken if `psp_dev_unregister()` completes concurrently, leaving the kernel operating on freed or invalid device state. No public exploit has been identified and EPSS stands at 0.17% (6th percentile), reflecting minimal active exploitation risk despite the well-characterized code-level race condition.
Missing CAP_NET_ADMIN enforcement in the Linux kernel PSP (PSP Security Protocol) netlink subsystem allows any local user with low privileges within the same network namespace to invoke the dev-set and key-rotate operations - modifying PSP version configuration and rotating cryptographic key material without authorization. The only access control in place, psp_dev_check_access(), validates only network namespace membership and does not enforce administrative capability. This enables unauthorized disruption of PSP-encrypted network communications and unauthorized modification of in-use cryptographic keying material. No public exploit code has been identified at time of analysis, and EPSS exploitation probability is very low at 0.17% (7th percentile).
Livelock in the Linux kernel's futex requeue-PI subsystem can hang a system when a signal or timeout interrupts a FUTEX_WAIT_REQUEUE_PI operation concurrently with an active FUTEX_CQ_REQUEUE_PI requeue. The race causes a waiting thread (Task A) to block indefinitely on a hash-bucket lock while a requeue thread (Task B) busy-loops retrying the same operation, consuming all available CPU - worst-case on uniprocessor systems where Task A cannot be scheduled at all. No public exploit is identified and EPSS is 0.17% (7th percentile), but the deterministic nature of the livelock on UP or real-time-scheduled hardware makes this a genuine denial-of-service risk; patches are available across six Linux stable branches.
Integer underflow in the Linux kernel fastrpc misc driver corrupts DMA addresses sent to Qualcomm DSPs, enabling a local low-privileged user to crash the DSP subsystem or induce a kernel panic. The flaw in fastrpc_get_args() affects all major stable kernel branches from 5.15 through 7.1-rc3 and is patched across multiple stable series. No public exploit exists and EPSS probability is 0.17% (7th percentile), indicating low real-world exploitation risk despite broad platform coverage.
NULL pointer dereference in the Linux kernel's fastrpc misc driver crashes the kernel when a Qualcomm DSP sends a glink message before the fastrpc_rpmsg_probe() initialization routine completes. Systems using the Qualcomm FastRPC subsystem - primarily Android and embedded Qualcomm SoC platforms running Linux 5.1 through unpatched 6.x/7.x stable branches - are vulnerable to a local denial-of-service (kernel panic) at boot. No public exploit exists and EPSS is 0.17% (6th percentile), consistent with a hardware-timing race condition requiring specific Qualcomm DSP hardware rather than generic remote exploitation.
Corrupted reverse-mapping (rmap) state in the Linux kernel's mm/huge_memory subsystem crashes or destabilizes affected systems through a flag misinterpretation in set_pmd_migration_entry() for device-private PMD entries. On x86-64 with CONFIG_MEM_SOFT_DIRTY enabled, the function incorrectly reads the softdirty bit as a write-permission flag - because _PAGE_SWP_SOFT_DIRTY aliases _PAGE_RW - causing migration entries to be marked writable when they should be read-only, ultimately triggering a VM_WARN assertion in __folio_add_anon_rmap() when an AnonExclusive folio reaches entire_mapcount=2. No public exploit exists and no active exploitation is confirmed; a vendor patch is available as of Linux 7.0.13 and 7.1.
Hugetlb VMA reservation leak in the Linux kernel mm/hugetlb subsystem allows a local authenticated user to trigger SIGBUS on a process at a previously reserved huge-page address. Two code paths - the UFFDIO_COPY resubmission path and the fork-time copy-on-write path - fail to call restore_reserve_on_error() after copy_user_large_folio() returns an error, leaving the per-VMA reservation map entry marked consumed. No public exploit exists and EPSS is 0.17% (6th percentile), but patches are available in multiple stable branches.
NULL pointer dereference in the Linux kernel's dw_mmc-rockchip MMC driver triggers kernel panics on systems running legacy Rockchip SoCs (rk2928, rk3066, rk3188) when the MMC subsystem initializes. Commit ff6f0286c896 introduced a mandatory private-data access path that was never populated for these old controllers - which historically had no UHS support and no parse_dt callback - causing a reproducible kernel crash on affected hardware. No active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.17% (6th percentile) reflects negligible real-world exploitation probability; the primary risk is an accidental reliability failure on embedded systems running these legacy SoCs.
Thunderbolt XDomain property validator in the Linux kernel triggers a heap underflow when processing zero-length TEXT property entries, enabling a local low-privileged attacker to crash the kernel (denial of service). The root cause is in tb_property_entry_valid(), which permits length==0 for TEXT entries that subsequently compute an array index of -1 during null-termination (0 * 4 - 1), writing one byte before the allocated buffer. No public exploit has been identified and EPSS is extremely low at 0.18% (8th percentile), indicating negligible opportunistic exploitation pressure despite the kernel's ubiquitous deployment footprint.
NULL pointer dereference in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user to trigger a kernel panic by invoking the kfd_ioctl_set_debug_trap() ioctl with a non-zero num_queues value and a NULL queue_array_ptr. The root flaw is that get_queue_ids() returns NULL in this case rather than ERR_PTR(-EINVAL), and both callers check only IS_ERR() - since IS_ERR(NULL) evaluates false, execution proceeds to q_array_invalidate(), which immediately dereferences the NULL pointer while iterating, crashing the kernel. No public exploit has been identified and the EPSS score of 0.17% (6th percentile) confirms low observed exploitation probability, though the trigger path is mechanically simple for any user with /dev/kfd access.
NULL pointer dereference in the Intel Xe GPU driver (drm/xe) causes a kernel panic during system suspend or shutdown when display hardware is disabled via hardware fuses rather than absent at initial probe. Systems running Linux 6.8 and later with Intel Xe GPUs in fuse-disabled display configurations are affected; a low-privileged local user can trigger an unplanned system crash by initiating suspend or shutdown. No public exploit exists and EPSS is 0.17% (6th percentile), reflecting this as a reliability and local-denial-of-service issue rather than a broad security priority.
Reference counting leaks in the Linux kernel's drm/v3d driver allow a local user to exhaust kernel memory and trigger a denial-of-service condition on systems equipped with Broadcom VideoCore VI GPUs (e.g., Raspberry Pi 4/5). The flaw exists across three code paths in the SET_GLOBAL and CLEAR_GLOBAL perfmon ioctls, as well as in the perfmon destroy path, each of which fails to release references acquired by v3d_perfmon_find(). No public exploit or active exploitation has been identified; EPSS probability stands at 0.17%, reflecting negligible automated exploitation interest.
Memory exhaustion via vaddr leak in the Linux kernel's V3D DRM driver allows a local low-privileged user to degrade or deny service on systems equipped with Broadcom V3D GPUs. The function v3d_rewrite_csd_job_wg_counts_from_indirect() maps two buffer objects (indirect buffer and workgroup buffer) but takes an early return path - without releasing the vaddr mappings - whenever any workgroup count read from the indirect buffer is zero, permanently leaking both BO mappings per triggering job submission. No public exploit has been identified and EPSS sits at the 6th percentile (0.17%), consistent with the hardware-specific, local-only attack surface; this vulnerability is not listed in CISA KEV.
The drm/v3d GPU driver in the Linux kernel mishandles indirect Compute Shader Dispatch (CSD) jobs that carry zeroed workgroup dimension counts, allowing a local low-privilege user with GPU compute access to crash the VideoCore VI GPU subsystem. The hardware interprets a zero workgroup count as 65536 - exceeding the user-space-exposed maximum of 65535 - instead of treating the dispatch as a no-op, causing undefined GPU behavior and a denial-of-service condition. Exploitation is constrained to Broadcom VideoCore VI hardware (Raspberry Pi 4/5 ecosystem); EPSS is 0.17% (6th percentile), no public exploit exists, and the vulnerability is absent from CISA KEV.
NULL pointer dereference and buffer over-read in the Linux kernel's AMD display driver (drm/amd/display) can be triggered by a local user writing to the sdp_message debugfs node, causing a kernel panic and denial of service. The dp_sdp_message_debugfs_write() function fails to check whether connector->base.state->crtc is NULL - a valid transient state after GPU hotplug before an atomic commit - and unconditionally passes 36 bytes to copy_from_user() regardless of the caller-provided size, enabling a second over-read path. No public exploit or CISA KEV listing exists; EPSS is 0.18% (7th percentile), consistent with a localized, hardware-dependent DoS.
Local information disclosure in the Linux kernel's netfilter nft_fib module leaks uninitialized stack data to userspace when handling NFT_FIB_RESULT_OIFNAME or the NFTA_FIB_F_PRESENT flag. An attacker with low privileges (e.g., CAP_NET_ADMIN) can read sensitive kernel memory to potentially bypass KASLR. No active exploitation has been reported, and EPSS indicates a very low probability (0.18%) of widespread exploitation; vendor patches are available.
Kernel panic via RCU locking imbalance in the DRBD subsystem's drbd_adm_dump_devices() function affects Linux kernel versions from the introduction of commit a55bbd375d18 through multiple stable branches. A locally authenticated low-privilege user who can invoke DRBD administrative operations may trigger a kernel crash by exploiting the unbalanced rcu_read_unlock() call - called without a preceding rcu_read_lock() - leading to a denial-of-service via kernel instability. No public exploit exists and EPSS probability is 0.18% (8th percentile), indicating very low real-world exploitation activity.
Memory leak in the Linux kernel block layer's zone revalidation path allows local low-privileged users to cause kernel memory exhaustion, resulting in a denial-of-service condition. Specifically, blk_revalidate_disk_zones() fails to free the args.zones_cond allocation on error paths after disk_revalidate_zone_resources() succeeds, leaving memory unreleased. No public exploit code exists and no active exploitation has been confirmed; EPSS probability stands at 0.14% (4th percentile), consistent with a low-priority local DoS affecting niche storage configurations.
Reference leak in the Linux kernel blk-cgroup subsystem allows a local low-privileged user to cause kernel disk object memory exhaustion, potentially leading to system instability or denial of service. The flaw exists in blkcg_maybe_throttle_current() since kernel 6.3, where a missing put_disk() call on error paths leaves disk references permanently unreleased. No public exploit exists and EPSS at 0.16% (5th percentile) indicates negligible exploitation probability; patches are available across multiple stable branches.
Improper locking in the Linux kernel's md (Multiple Devices/software RAID) subsystem causes a recursive kobject teardown deadlock when 'clear' is written to the sysfs array_state attribute. A local user with write access to an active md array's sysfs interface can trigger a kernel denial-of-service by exploiting the incorrect ordering of mddev_put() before sysfs_unbreak_active_protection() in md_attr_store(). No public exploit code is identified and EPSS exploitation probability is minimal at 0.17% (7th percentile); no CISA KEV listing indicates active exploitation has not been confirmed.
Availability loss in the Linux kernel ublk (userspace block device) subsystem can permanently hang IO commands when a ublk recovery server dies before issuing fetch commands for all IOs in a queue. The per-IO canceled flag, once set, is only cleared when every IO in the queue is fetched - if the server crashes mid-recovery, surviving IOs with set canceled flags can never be completed because ublk_cancel_cmd is blocked from calling io_uring_cmd_done. This results in a denial-of-service condition affecting systems using ublk-based userspace block devices. No public exploit has been identified at time of analysis, and EPSS is 0.14% (4th percentile), consistent with a low-exploitation-probability kernel logic flaw requiring specific local conditions.
Deadlock in the Linux kernel's md/raid456 subsystem during array reshape allows a local low-privileged user to hang the system indefinitely. When direct I/O spans the reshape position in a RAID 4/5/6 array, the I/O blocks in raid5_make_request() holding an active_io reference while waiting for reshape progress. If an administrator concurrently freezes the reshape and writes to md/suspend_lo or md/suspend_hi, mddev_suspend() deadlocks: it waits for active_io to drain, but the blocked I/O requires reshape progress that the frozen reshape thread can never provide. Exploitation requires a very specific confluence of conditions and no public exploit code or active exploitation (CISA KEV) has been identified; EPSS at 0.17% (7th percentile) confirms low real-world exploitation probability.
Deadlock in the Linux kernel btrfs filesystem subsystem triggers an unrecoverable kernel hang when the flushoncommit mount option is active and a reflink operation copies an inline extent to a destination offset beyond the target inode's i_size. The circular wait arises because the reflink task holds the extent io tree lock while blocking on a pending transaction commit, while the commit's delalloc flush simultaneously blocks trying to acquire that same held lock. No public exploit or CISA KEV listing exists; EPSS is 0.18% (8th percentile), reflecting very low real-world exploitation interest.
Memory leak in the Linux kernel's amd-pstate driver allows local availability impact on systems running AMD CPUs when EPP (Energy Performance Preference) initialization fails. The amd_pstate_epp_cpu_init() function allocates a cpudata object at entry but lacks a corresponding free on the error path triggered when setting the EPP value fails, causing kernel heap memory to leak on each failed CPU initialization event. No public exploit exists and EPSS sits at 0.15% (5th percentile), reflecting negligible adversarial interest; risk is primarily operational - repeated CPU hotplug cycles on affected hardware can progressively exhaust kernel memory.
Unsafe NMI-context invocation of perf_allow_kernel() in the Linux kernel's AMD IBS (Instruction Based Sampling) perf handler can cause a fatal kernel crash on AMD-powered systems running affected stable branches from commit 50a53b60e141d7e3 onward. A local user with perf event access on an AMD system can trigger the IBS NMI handler path, inducing a kernel panic or deadlock as the unsupported function call violates NMI-context restrictions. No public exploit has been identified at time of analysis; EPSS is 0.15% (5th percentile), consistent with a niche hardware-specific kernel subsystem flaw with no current exploitation activity.
Memory leaks in the Linux kernel's ath11k Wi-Fi driver (Qualcomm 802.11ax/Wi-Fi 6) expose systems to local availability-only denial-of-service via kernel memory exhaustion. The affected functions ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid() fail to release allocated beacon template memory when error conditions occur in parameter setup, causing incremental heap exhaustion. With EPSS at 0.16% (5th percentile), no public exploit, and no CISA KEV listing, this is a low-urgency fix discovered through static analysis - not active exploitation.
Null pointer dereference in the Linux kernel's BPF LWT (Lightweight Tunnel) subsystem allows a local user with BPF syscall privileges to crash the kernel via a denial-of-service. The flaw exists because bpf_prog_test_run_skb constructs a socket buffer (skb) without initializing skb->_skb_refdst; when a BPF program invokes the bpf_lwt_xmit_push_encap helper through this test path, the subsequent dereference of skb_dst(skb)->dev hits a null pointer and triggers a kernel panic. No public exploit or CISA KEV listing exists, and EPSS is very low at 0.18% (7th percentile), consistent with the specialized access required.
PowerPC 64-bit (ppc64le/Book3S64) Linux kernel systems from version 5.8 onward can be crashed via a local race condition between concurrent move_pages() and munmap() operations on Transparent Huge Page (THP) PMD-backed memory. During the PMD migration sequence, a narrow window exists where the PMD entry holds a migration swap entry with pmd_present=0; a concurrent munmap() acquiring the same page table lock during this window triggers a VM_BUG_ON() assertion in pmdp_huge_get_and_clear_full(), causing a kernel panic. No public exploit is identified and EPSS stands at 0.15% (5th percentile), but the DoS impact is confirmed by upstream kernel developers with real hardware traces on IBM POWER10 and is patched in stable releases 7.0.10 and 7.1.
The Marvell Libertas USB WiFi driver in the Linux kernel invokes usb_kill_urb() and usb_kill_anchored_urbs() from interrupt context during the HCD giveback path, causing a kernel BUG() or deadlock because those functions may sleep. Systems with a Marvell Libertas USB WiFi adapter attached can be crashed by a local low-privileged user triggering the race condition, resulting in a denial of service via kernel panic. No public exploit exists and EPSS is 0.15% (5th percentile), indicating negligible exploitation probability; the constraint to specific legacy hardware further limits real-world impact.
BPF local storage deletion in the Linux kernel deadlocks when `bpf_xxx_storage_delete()` helpers execute within a Non-Maskable Interrupt (NMI) context, because the underlying RCU-based freeing mechanisms (`kfree_rcu`, `call_rcu`, `call_rcu_tasks_trace`) are not safe in NMI or reentrant execution paths. Locally privileged users capable of loading BPF programs attached to NMI-triggerable events can exploit this to cause a CPU-level deadlock, denying availability on the affected processor. No public exploit has been identified and EPSS at 0.14% (4th percentile) confirms this is a very low probability of opportunistic exploitation; impact is purely availability.
NULL pointer dereference in the Linux kernel's MediaTek mt76/mt7925 WiFi driver crashes affected systems when the `vif` (virtual interface) pointer is uninitialized at the time `mt7925_mac_write_txwi` calls `ieee80211_vif_is_mld(vif)`. Local low-privilege users on systems equipped with mt7925 hardware and running unpatched kernels can trigger a kernel panic, resulting in a denial of service. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.17% (6th percentile) reflects negligible real-world exploitation probability at this time.
Memory exhaustion in the Linux kernel mt76 WiFi driver allows a local low-privileged user on systems with MediaTek MT76 hardware to cause denial of service through kernel memory leakage during module teardown. The mt76_dma_cleanup routine fails to destroy page_pools associated with WED RRO receive queues (queues not tied to NAPI), and does not return pages to the pool when WED is not enabled - resulting in unreclaimed kernel memory on each module unload cycle. No public exploit exists and EPSS probability sits at 0.17% (6th percentile), consistent with a niche hardware-specific leak with no code-execution path.
Deadlock in the Linux kernel's mt76/mt7925 MediaTek WiFi driver can be triggered by a local low-privileged user, causing the wireless networking subsystem to hang indefinitely. The flaw exists in mt7925_roc_abort_sync(), which calls cancel_work_sync() while already holding dev->mt76.mutex - the same mutex held by roc_work() - producing a classic mutual-wait deadlock with no path to resolution. Systems running affected kernel versions with MediaTek MT7925 WiFi hardware are vulnerable to a local denial of service; no public exploit has been identified and EPSS places exploitation probability at 0.17% (6th percentile), consistent with the niche hardware requirement.
Kernel memory exhaustion in the Linux mt76 WiFi driver allows a local low-privileged user on affected hardware to gradually degrade system availability. The functions mt76_connac_mcu_sta_wed_update() and mt76_connac_mcu_sta_key_tlv() may fail before the allocated socket buffer (skb) is handed off to mt76_mcu_skb_send_msg() for transmission and cleanup, leaving the skb permanently leaked. With EPSS at the 5th percentile, no KEV listing, and discovery solely via static analysis, this is a stability maintenance concern rather than an active security threat.
Mutex deadlock in the Linux kernel's mt7921 WiFi driver (mt76/mt7921 subsystem) can render the WiFi subsystem permanently unresponsive on affected systems. The deadlock arises during station removal: the call chain mt76_sta_state() → mt76_sta_remove() → mt7921_mac_sta_remove() → mt7921_roc_abort_sync() invokes cancel_work_sync() while roc_work() holds dev->mt76.mutex and the removal path already owns the same lock - a classic ABBA deadlock with no progress possible. No public exploit is identified and EPSS sits at 0.17% (6th percentile), placing this firmly in the patch-and-move-on category for most organisations, though Linux distributions serving MT7921 hardware (common in consumer laptops) should prioritise kernel updates.
Deadlock in the Linux kernel mt76 WiFi driver's remain-on-channel path allows a local low-privileged user to crash or hang the WiFi subsystem. The flaw affects kernels containing the mt76 driver from commit a8f424c128 through the fixed releases (6.18.33, 7.0.10, 7.1), with no confidentiality or integrity impact - only availability. No public exploit code exists and EPSS sits at 0.17% (6th percentile), consistent with a local, hardware-specific denial-of-service with negligible opportunistic exploitation risk.
Control Flow Integrity (CFI) protection for the BPF subsystem's btf_dtor_kfunc_t type is silently compiled out in affected Linux kernel versions because BPF code references the deprecated CONFIG_CFI_CLANG symbol rather than the renamed CONFIG_CFI, leaving CFI violations in BPF destructor functions unchecked and capable of crashing the kernel. Locally-privileged users on affected kernel builds - those compiled with CFI support, typically Clang-built distributions - can trigger a kernel panic by interacting with the BPF subsystem. This vulnerability is not listed in the CISA KEV catalog, no public exploit has been identified, and the EPSS score of 0.16% (5th percentile) reflects minimal real-world exploitation probability.
BPF subsystem argument-tampering in the Linux kernel allows local attackers with CAP_BPF privileges to abuse the kprobe+freplace program chaining path to overwrite kernel function arguments via a manipulated `struct pt_regs`, causing kernel denial of service or subversion of kernel function behavior. The root mechanism is that freplace programs inherit the `kprobe_write_ctx=true` permission from a parent kprobe program, enabling register writes that should be confined to uprobe contexts. No public exploit or CISA KEV listing is confirmed; EPSS sits at the 6th percentile. Patches are available in Linux 6.18.33, 7.0.10, and the 7.1 mainline branch.
Error pointer dereference in the Linux kernel's brcmfmac Broadcom WiFi driver allows a local low-privilege attacker to crash the kernel via a NULL pointer dereference, resulting in denial of service. The function brcmf_chip_add_core() in brcmf_chip_recognition() can return an ERR_PTR sentinel value that is never validated before being dereferenced at five separate code sites (lines 1010-1022 of chip.c), as identified by Smatch static analysis. No public exploit or active exploitation has been identified; EPSS sits at 0.18% (7th percentile), consistent with a low-priority local DoS affecting only systems with Broadcom WiFi hardware.
Lock ordering deadlock in the Linux kernel BPF task_vma iterator allows a local low-privileged user with BPF program execution rights to trigger a system hang or denial of service. Holding the per-VMA lock across BPF program body execution creates a circular dependency (vm_lock → i_rwsem → mmap_lock → vm_lock) when BPF helpers internally acquire mmap_lock. Patches are available across multiple stable branches; EPSS is low at 0.16% and no public exploit or active exploitation has been identified.
RCU stall denial-of-service in the Linux kernel BPF subsystem allows a local low-privileged user to cause kernel-level availability degradation by triggering map clearing on a large PROG_ARRAY BPF map. The missing cond_resched() call in bpf_fd_array_map_clear() prevents CPU yielding during an expensive per-entry loop, starving the RCU grace period mechanism and triggering watchdog stalls in the deferred workqueue. No active exploitation is confirmed - EPSS is 0.16% (5th percentile) and the vulnerability is absent from CISA KEV - making this a maintenance-tier patch rather than an emergency response priority.
Uninitialized memory read in the Linux kernel's hamradio 6pack TTY driver (net/hamradio/6pack.c) allows a local low-privileged user to crash the kernel, causing a denial of service. The flaw exists across a broad range of stable kernel branches from 2.6.12 through at least 7.0, and patches have been issued across eight stable series. No public exploit code exists and no active exploitation has been reported; with an EPSS of 0.16% at the 6th percentile, real-world risk is constrained by the highly niche deployment context of amateur-radio 6pack hardware.
NULL pointer dereference in the Linux kernel's Traffic Control cls_fw (firewall classifier) module causes a local denial of service via kernel crash. Affected kernels from commit ed76f5edccc9 onward publish TC filters to the shared datapath block before the ->change() validation function runs; an attacker with CAP_NET_ADMIN who adds an invalid 'old-style' cls_fw filter to a shared block can trigger fw_classify() to dereference a NULL 'q->handle' pointer when live traffic hits the unvalidated filter. No public exploit or KEV listing exists at time of analysis, and EPSS sits at the 7th percentile (0.17%), consistent with a kernel-local, capability-gated DoS.
Memory leak in the Linux kernel's network scheduler (net_sched) subsystem allows a local low-privileged user to exhaust kernel memory and degrade system availability. The flaw resides in qdisc_dequeue_drop(), which fails to account for root qdiscs that lack the TCQ_F_DEQUEUE_DROPS flag - leaving packet buffers stranded indefinitely on child qdisc to_free lists during qdisc_run_end() cleanup. No active exploitation is confirmed (not in CISA KEV) and EPSS sits at 0.14% (4th percentile), reflecting the low probability of opportunistic abuse given the local access and specific configuration requirements.
Out-of-bounds read in the Linux kernel's BPF test interface (bpf_prog_test_run_skb) allows local users with BPF syscall access to crash the kernel by supplying a crafted test packet containing only an Ethernet header bearing an IPv4 or IPv6 EtherType but no L3 payload. The code calls eth_type_trans() to set skb->protocol and then unconditionally dereferences ip_hdr(skb) or ipv6_hdr(skb) without first validating that the supplied buffer is large enough to contain an IP or IPv6 header, producing a kernel panic. Patched stable releases are confirmed across eight kernel branches; no public exploit or CISA KEV listing exists, and EPSS probability is 0.16% (6th percentile).
Null pointer dereference in the Linux kernel Bluetooth HCI UART line discipline driver (hci_ldisc) allows local low-privileged users on systems with UART-attached Bluetooth hardware to crash the kernel, causing denial of service. The flaw spans multiple stable kernel branches from 5.4.x through 6.15 and stems from a missing flag clear in the error path of hci_uart_register_dev(). No public exploit code exists and EPSS sits at the 7th percentile (0.17%), indicating low real-world exploitation probability; patched versions are available across all affected stable branches.
Kernel panic via unchecked error pointer dereference in the Linux kernel's drm/sun4i display backend driver affects Allwinner SoC-based systems running kernel versions from 4.17 up to the patched releases. In sun4i_backend_atomic_check() at drivers/gpu/drm/sun4i/sun4i_backend.c:496, the return value of drm_atomic_get_plane_state() is not validated against IS_ERR() before dereference, allowing a local low-privilege user to crash the kernel. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.16% (6th percentile) reflects negligible real-world exploitation interest.
Resource leak in the Linux kernel ASoC STI audio driver allows a local authenticated user to exhaust kernel memory by repeatedly loading and unloading the driver, degrading system availability. The vulnerability stems from regmap_field objects allocated during STI audio player initialization never being released on driver removal. With EPSS at 0.17% (7th percentile), no KEV listing, and no public exploit, this is a low-priority maintenance fix rather than an actively weaponizable flaw. Vendor-released patches are available across multiple stable kernel branches.
NULL pointer dereference in the Linux kernel dm-cache subsystem crashes the kernel when concurrent writes target the same cached block in passthrough mode. The flaw affects any kernel with a dm-cache device explicitly configured in passthrough mode since version 4.12, allowing a local low-privileged user with write access to the block device to cause a kernel panic and complete denial of service. No public exploit code exists and EPSS at 0.18% (7th percentile) confirms very low exploitation probability; fixed across multiple stable kernel series with patches confirmed by Ubuntu security advisories.
Write operation hang in the Linux kernel dm-cache subsystem's passthrough mode allows a local user with low privileges to stall I/O indefinitely on affected block devices. The defect lies in `invalidate_remove()`, which configures a remapped bio for submission to the cache origin but discards it without dispatching, leaving write operations permanently pending. No public exploit has been identified at time of analysis; EPSS at 0.18% (8th percentile) and a strictly local attack vector place this firmly in the operational-bug category rather than an active threat.
Data loss in the Linux kernel dm-cache subsystem occurs when LVM's table preload feature is used to switch a writeback cache to passthrough mode while dirty mappings exist. The dirty mapping check was designed assuming table reloads happen only after device suspension (which flushes dirty blocks), but LVM's preload path bypasses this assumption, allowing dirty cache blocks to be silently loaded into passthrough mode where they will never be written back to the origin device. No public exploit code exists; reproduction requires a deliberate sequence of dmsetup and fio operations documented in the CVE description itself. EPSS is 0.18% (7th percentile), consistent with a local, configuration-specific data-loss condition rather than a remotely exploitable flaw.
Memory leak in the Linux kernel dm-cache metadata subsystem can be triggered by local users with low privileges to gradually exhaust kernel memory, causing system availability degradation. The flaw resides in dm_cache_metadata_abort, where a temporary block_manager object allocated before acquiring root_lock is not freed when the lock acquisition fails due to a read-only block manager - a condition reproducible by reloading a dm-cache table during metadata error states. No public exploit code and no CISA KEV listing have been identified; EPSS of 0.18% (8th percentile) confirms very low current exploitation probability.
NULL pointer dereference in the Linux kernel's DRM Cadence MHDP8546 DisplayPort bridge driver (cdns-mhdp8546-core) can be triggered by a local low-privileged user on systems with the affected hardware, causing a kernel panic and complete system availability loss. The flaw arises when error recovery paths in cdns_mhdp_modeset_retry_fn() attempt to access a mutex via a connector pointer that has not yet been initialized in the DRM_BRIDGE_ATTACH_NO_CONNECTOR code path. No public exploit code or active exploitation (CISA KEV) has been identified; patches are available across multiple stable kernel branches.
Instability and system crash vulnerability in the Linux kernel's Qualcomm DRM/MSM Display Processing Unit (DPU) driver allows a local low-privileged attacker to trigger a voltage-clock mismatch that causes the MMCX power rail to fall to MIN_SVS while the DPU core clock remains at its maximum frequency. This race condition between power management and clock control during runtime suspend/resume can leave the hardware in an unsustainable electrical state, leading to display subsystem failure or kernel panic. No public exploit identified at time of analysis; EPSS of 0.18% reflects the hardware-specific, local-only nature of this flaw.
Incorrect memory access in the Linux kernel's ASoC Qualcomm QDSP6 audio topology driver can trigger a kernel panic on affected Qualcomm Snapdragon hardware when virtual DAPM widgets are processed without a type guard. The flaw, introduced at commit 36ad9bf1d93d66b901342eab9f8ed6c1537655a6, affects kernel branches from 5.16 onward until the respective stable fixes. No active exploitation has been identified (not in CISA KEV) and the EPSS score of 0.17% (7th percentile) reflects negligible real-world exploitation probability; hardware dependency further constrains the affected population.
Operation sequencing flaw in the Linux kernel's tegra194 PCIe endpoint driver causes a Control Backbone (CBB) timeout when PERST# is deasserted twice in succession. During the second deassert cycle, the driver invokes pci_epc_deinit_notify() and dw_pcie_ep_cleanup() - which access DBI register PCIE_MISC_CONTROL_1_OFF at offset 0x8bc - before reset_control_deassert() powers on the PCIe controller core, triggering a hardware bus timeout and denying availability of the PCIe subsystem. With an EPSS of 0.18% (7th percentile), no CISA KEV listing, and hardware-specific scope limited to NVIDIA Tegra194 SoCs, this is a low-probability exploitation target with real-world impact confined to embedded and automotive Linux deployments.
NULL pointer dereference in the GFS2 filesystem's log release path crashes the Linux kernel during unmount on affected versions. The vulnerability arises because gfs2_log_release() dereferences sdp->sd_jdesc without checking for NULL, which can occur after the journal descriptor has already been freed during the unmount sequence. A prior fix (commit 35264909e9d1) addressed the same class of bug in gfs2_log_flush() but left gfs2_log_release() unprotected. No public exploit exists (EPSS 0.17%), exploitation is limited to local access on GFS2-mounted systems, and patches are available across all affected stable kernel branches.
Heap buffer overflow in the Linux kernel EFI capsule loader arises from an incorrect sizeof operand in a krealloc() call inside __efi_capsule_setup_info(), allocating half the required space on 32-bit PAE systems where phys_addr_t is 64-bit but pointers are 32-bit. When physical addresses are subsequently written via page_to_phys(), the undersized heap buffer is overflowed, corrupting kernel heap metadata and causing a system crash. Exploitation is architecturally constrained to 32-bit PAE kernels; 64-bit systems are unaffected because sizeof(phys_addr_t) equals sizeof(phys_addr_t*). No public exploit exists, EPSS is 0.19% (9th percentile), and no active exploitation has been recorded.
NULL pointer dereference in the Linux kernel's fwctl subsystem allows a local low-privilege user to crash the kernel when CXL memory expansion hardware is present and a device removal is triggered. The defect stems from a deterministic module initialization ordering race between the CXL and fwctl drivers, leaving knode_class uninitialized at device registration time and causing device_del() to dereference it fatally on removal. No public exploit identified at time of analysis; EPSS of 0.17% (6th percentile) reflects very low exploitation probability consistent with the local-only attack surface.
Kernel panic via reachable assertion in the OCFS2 cluster filesystem allows a local, low-privileged user to crash the system by issuing a crafted OCFS2_IOC_GROUP_ADD ioctl. The root cause is that ocfs2_group_add() invokes ocfs2_set_new_buffer_uptodate() on a user-supplied group block number before ocfs2_verify_group_and_input() has validated that number; if the block already exists in the metadata cache, the BUG_ON at uptodate.c:509 fires unconditionally, triggering a kernel oops. No public exploit has been identified and EPSS is 0.18% (7th percentile), but the fix is widely available across maintained stable branches.
Out-of-bounds read in the Linux kernel's IMA (Integrity Measurement Architecture) filesystem subsystem causes a kernel panic during boot on systems with TPM chips advertising hash algorithms unsupported by the kernel. Specifically, when `ima_tpm_chip->allocated_banks[i].crypto_id` is set to the sentinel `HASH_ALGO__LAST` for an unmapped TPM algorithm (demonstrated with TPM_ALG_SHA3_256 = 0x0027), the `create_securityfs_measurement_lists` function dereferences the out-of-range index into `hash_algo_name[]`, triggering a KASAN-detected global-out-of-bounds read and kernel crash. No public exploit has been identified and EPSS is 0.17% (6th percentile), making deliberate exploitation unlikely; the primary risk is inadvertent boot-time denial of service on hardware with qualifying TPM chips.
Deadlock in the Linux kernel's usbhid driver (`hid_post_reset()`) can halt systems connected to composite USB devices that combine HID and block storage or UAS components. When such a device undergoes a reset during block IO error handling, memory allocations using the default GFP_KERNEL flag can trigger block IO reclaim, which deadlocks against the mutex already held by the reset path - producing a kernel hang. No public exploit has been identified, and EPSS of 0.18% (7th percentile) confirms very low exploitation likelihood; the fix replaces GFP_KERNEL with GFP_NOIO across all affected reset callbacks, and patches are available across multiple Linux stable branches.
The Linux kernel's BPF sockmap subsystem deadlocks when a BPF iterator program iterating over AF_UNIX sockets via `bpf_iter_unix_seq_show()` simultaneously attempts to update a sockmap entry during the same execution context. When `lock_sock_fast()` takes the spinlock fast path and holds `slock-AF_UNIX`, any subsequent `sock_map_update_elem()` call within the BPF iterator program spins indefinitely attempting to re-acquire the same spinlock on the same CPU, causing an unrecoverable kernel deadlock and loss of system availability. This is not confirmed actively exploited (not in CISA KEV), no public exploit has been identified, and EPSS at 0.17% (7th percentile) confirms negligible current exploitation interest; the real-world risk is constrained to specialized BPF workloads with specific capability requirements.
Null pointer dereference in the Linux kernel's BPF sockmap subsystem allows a local low-privileged user to crash the system via a race condition between AF_UNIX socket connection and sockmap proto update. The flaw exists because unix_stream_connect() sets sk_state to TCP_ESTABLISHED before assigning the peer pointer, creating a window where unix_stream_bpf_update_proto() dereferences unix_peer(sk) while it is still NULL. No public exploit exists and EPSS sits at the 8th percentile; this is not in CISA KEV, and the narrow race window constrains practical exploitation.
NULL pointer dereference in the Linux kernel's BPF verifier crashes the kernel when a scalar register is stored into a kptr map slot during BPF program loading. Introduced by commit ab6c637ad027, which refactored map_kptr_match_type() to call btf_is_kernel(reg->btf) before the guard that excludes non-BTF register types - exposing scalar registers (reg->btf == NULL) to an immediate NULL dereference. A local user with BPF syscall access can trigger a kernel panic, producing a denial of service. No active exploitation is confirmed (not in CISA KEV), and EPSS is low at 0.17% (6th percentile), consistent with the local-only, DoS-limited impact.
Memory leak in the Linux kernel's Renesas i3c master driver causes local denial of service through kernel memory exhaustion. Specifically, the xfer structure allocated by renesas_i3c_alloc_xfer() inside renesas_i3c_i3c_xfers() is never released, allowing a local user with low privileges on affected Renesas SoC hardware to exhaust kernel memory by repeatedly triggering i3c transfers. No public exploit has been identified at time of analysis, and EPSS probability sits at 0.17% (6th percentile), reflecting low real-world exploitation interest.
Uninitialized variable read in the NTFS3 filesystem driver (`ntfs_iomap_begin()`) of the Linux kernel allows a local authenticated user to crash the system by triggering a zero-length run condition that causes the `lcn` (logical cluster number) variable to be consumed before assignment. The flaw affects Linux 7.0 up to 7.0.10 and Linux 7.1 prior to the stable fix commits, with the defect discovered and confirmed by Google syzbot via KMSAN. No public exploit has been identified and EPSS probability is very low (0.17%, 7th percentile); patches are available in Linux 7.0.10 and 7.1.
Error pointer dereference in the Linux kernel USB Type-C TI Power Delivery (tipd) driver allows a local low-privileged user to crash the kernel (denial of service) on systems with TI CD321x or TPS6598x USB Type-C controller hardware. The flaw in `cd321x_update_work()` at `drivers/usb/typec/tipd/core.c:827` logs a warning when `typec_register_partner()` fails but omits an early return, causing a subsequent unconditional dereference of the error pointer via `typec_partner_set_identity()`. No public exploit code has been identified at time of analysis, EPSS probability is 0.17% (6th percentile), and the vulnerability is not listed in CISA KEV.
Kernel availability impact in the Linux NTFS3 filesystem driver allows a local low-privileged user to trigger a WARN_ON(1) in attr_data_get_block_locked() by accessing NTFS volumes containing compressed or sparse attributes with frame-aligned cluster boundaries. The root cause is a missing run-segment load for vcn0 when it resides in a different attribute segment than vcn after cmask rounding, causing run_lookup_entry() to return SPARSE_LCN and fire the kernel warning. No public exploit has been identified and EPSS is 0.15% (5th percentile), confirming this as a low-probability exploitation target despite the confirmed vendor patch.
Missing NUL termination in the Linux kernel's ntfs3 filesystem driver allows a local attacker with filesystem mount privileges to trigger an out-of-bounds memory read, crashing the kernel. The defect in ntfs_fill_super() leaves sbi->volume.label unterminated when a UTF-16 volume label converts to a UTF-8 string that exactly fills the fixed buffer, causing ntfs3_label_show() to read past the buffer boundary via a %s format specifier. No public exploit has been identified at time of analysis and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation interest despite the High availability impact in CVSS.
Unbounded string concatenation in the Linux kernel's Dell WMI BIOS interface driver (dell-wmi-sysman) allows a local low-privileged attacker on Dell hardware to crash the kernel. The populate_enum_data() function bounds each individual firmware-provided string but applies no remaining-space check during cumulative strcat() calls into fixed 512-byte struct members, enabling a buffer overflow that results in complete system availability loss. With an EPSS of 0.17% (7th percentile), no public exploit code, and no CISA KEV listing, this is a low-likelihood but straightforward local denial-of-service on Dell platforms running unpatched kernel versions.
Integer overflow in the Linux kernel SCSI target core allows a local attacker with low privileges to crash the kernel via crafted UNMAP commands. The `sbc_execute_unmap()` function performs a capacity bounds check on LBA + range but fails to guard against 64-bit wraparound, meaning an attacker can supply values that overflow to bypass the check and trigger a kernel panic. No public exploit code or CISA KEV listing exists; EPSS is 0.18% (7th percentile), reflecting the niche attack surface limited to systems actively running SCSI target daemons. Patches are confirmed available across all supported stable kernel branches.
Kernel panic in the SpaceMIT clock controller driver (`clk-spacemit-ccu`) can be triggered during CPU frequency scaling on systems running SpaceMIT RISC-V hardware. The root cause is an inverted boolean condition in `ccu_mix_trigger_fc()` that causes the frequency change trigger to be skipped at the wrong time and fired at the wrong time, crashing the kernel under normal cpufreq governor activity. Exploitation requires only local low-privilege access, but is practically limited to the narrow hardware footprint of SpaceMIT K1-based boards; no public exploit or CISA KEV listing exists, and EPSS is 0.17% (6th percentile).
Kernel panic in the Linux f2fs garbage collector allows a local low-privileged user to crash the system by triggering a VM_BUG_ON_FOLIO assertion when GC attempts to re-read a page already marked uptodate after multiple block relocations. The affected subsystem is f2fs (Flash-Friendly File System); systems using ext4, XFS, or other filesystems are not impacted. EPSS is extremely low (0.17%, 6th percentile) and no active exploitation has been identified, making this a stability/DoS concern primarily relevant to mobile, embedded, and flash-storage Linux deployments.
Data loss in the Linux kernel's f2fs (Flash-Friendly File System) driver exposes files created and synced before any checkpoint has been written to permanent loss on sudden power off. The race condition between fsync on newly created files and concurrent checkpoint operations causes f2fs_need_inode_block_update() to misread prematurely set nat_entry flags (IS_CHECKPOINTED and HAS_LAST_FSYNC), leading fsync to skip the inode block flush it actually requires. No public exploit identified at time of analysis; the EPSS score of 0.16% at the 6th percentile reflects the narrow triggering conditions and local-only attack surface.
Integer truncation in the Linux kernel's EROFS filesystem driver on 32-bit platforms causes logical cluster number (LCN) calculations to overflow at the 4 GiB boundary, resulting in incorrect block addressing and potential kernel-level availability impact. Affected systems are those running 32-bit Linux kernels (where `unsigned long` is 32 bits wide) with EROFS filesystems mounted. No public exploit exists and no active exploitation has been confirmed; EPSS stands at a very low 0.17% (6th percentile), consistent with the niche attack surface of 32-bit deployments.
Kernel panic via skb headroom exhaustion in the Linux kernel's Traffic Control (TC) act_mirred subsystem affects systems using block-cast packet redirection across mixed device types. The root cause is a copy-paste error in tcf_blockcast_redir() where dev_is_mac_header_xmit() is queried against the next device in the iteration (dev) rather than the device currently being transmitted to (dev_prev), causing tcf_mirred_to_dev() to make wrong MAC header push/pull decisions for intermediate devices. In the worst case, skb_push_rcsum is called with an incorrect mac_len, exhausting socket buffer headroom and triggering a kernel panic. No public exploit code has been identified and EPSS is 0.17% at the 6th percentile, consistent with low real-world exploitation interest.
Denial-of-service in the Linux kernel macvlan driver allows local users with network interface management privileges to crash netlink interface dumps by exploiting a missing netlink buffer size reservation for the IFLA_MACVLAN_BC_CUTOFF attribute. When bc_cutoff is set to any value other than the default (1) on a macvlan bridge interface, any subsequent attempt to dump that interface via GETLINK triggers nla_put_s32() to return -EMSGSIZE, fires a WARN_ON in rtnetlink, and prevents the interface from being enumerated. No public exploit tool has been identified and no active exploitation is confirmed; EPSS is 0.17% (6th percentile).
NULL pointer dereference in the Linux kernel nexthop routing subsystem allows a local privileged attacker to crash the kernel (denial of service) by exploiting a stale address-family flag state. The `has_v4` flag in nexthop groups is not updated when an IPv6 nexthop is replaced with an IPv4 one, letting a corrupt group bypass `fib6_check_nexthop` validation and attach to an IPv6 route; subsequent traffic through that route calls `nexthop_fib6_nh()`, which returns NULL for the AF_INET member, triggering the panic. No public exploit identified at time of analysis, though the CVE disclosure itself includes a functional step-by-step reproducer using standard `ip nexthop` and `ip route` commands, and the EPSS score of 0.18% (8th percentile) reflects low current real-world exploitation pressure.
NULL pointer dereference in the Linux kernel ICE (Intel Ethernet Controller) driver allows a local low-privileged attacker to trigger a kernel panic via a race condition during TX timestamp ring teardown. The flaw exists in systems using Intel ICE-series NICs with TX timestamping configured, where concurrent execution of ice_free_tx_tstamp_ring() and ice_tx_map() across CPU cores can cause CPU B to dereference a pointer that CPU A has already set to NULL. No public exploit or active exploitation has been identified; EPSS is 0.15% (5th percentile), consistent with its local, timing-dependent nature.
NULL pointer dereference in the Linux kernel ice driver's error path can cause a kernel panic on systems using Intel E800/E830 series Ethernet adapters. The flaw in ice_set_ringparam() leaves the ICE_TX_RING_FLAGS_TXTIME bit set after nullifying tstamp_ring, so a subsequent failure in ice_setup_tx_ring() triggers a dereference of a NULL tstamp_ring->desc pointer during error unwinding. No public exploit exists and EPSS sits at 0.15% (5th percentile), consistent with the discoverer's note that this was identified by manual code review rather than observed exploitation.
Denial of service in the Linux kernel's netfilter xtables subsystem exposes systems to local kernel panics caused by using inet-specific match extensions (xt_mac, xt_owner, xt_physdev, xt_realm) in incompatible protocol family contexts such as ebtables. The flaw was introduced by commit ab4f21e6fb1c, which broadened these extensions to NFPROTO_UNSPEC, inadvertently permitting their use in Ethernet bridge filtering contexts where IPv4-specific kernel data structures (e.g., dst->tclassid for xt_realm) are undefined or null. No public exploit has been identified and EPSS is 0.18% at the 7th percentile, indicating low adversarial interest despite the ubiquitous deployment footprint of the Linux kernel.
NULL pointer dereference in the Linux kernel's sch_dualpi2 queuing discipline (net/sched) allows a local attacker with low privileges to crash the kernel, causing a denial of service. The flaw exists in dualpi2_change(), which enforces updated queue limits after a qdisc reconfiguration: when traffic is exclusively queued in the L-queue and the C-queue is empty, the function unconditionally dereferences the NULL skb returned by the C-queue dequeue path, triggering a kernel panic. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), consistent with a locally-triggered, configuration-dependent kernel bug.
Resource exhaustion in the Linux kernel ksmbd SMB server allows a low-privileged authenticated SMB client to leak kernel file descriptor references by sending repeated SMB2 CREATE requests with a DURABLE_HANDLE_REQUEST_V2 context that produces a CreateGuid hit but a ClientGUID mismatch. Each such request increments the refcount on a ksmbd_file via ksmbd_fp_get() in ksmbd_lookup_fd_cguid() but the mismatch code path never calls the matching release, causing global_ft entries to be pinned indefinitely. Over time this defeats the durable file scavenger and causes long-lived kernel resource leaks that can degrade or deny availability. No public exploit has been identified at time of analysis and EPSS is 0.19% (9th percentile), indicating low opportunistic exploitation probability.
Stack memory disclosure in the Linux kernel RDS/IB subsystem exposes up to 26 bytes of uninitialized kernel stack contents - including kernel text and data pointers - to local unprivileged users via the getsockopt(SOL_RDS, RDS_INFO_IB_CONNECTIONS) interface. The leak enables KASLR bypass on systems where the kernel was built without CONFIG_INIT_STACK_ALL_ZERO=y, making this a useful primitive for chaining into privilege escalation. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS is very low at 0.18% (7th percentile), but the CVE description itself supplies a complete, step-by-step reproduction recipe that reduces practical exploitation complexity to near-trivial for any local user with AF_RDS socket access.
Improper RLIMIT_MEMLOCK accounting in the Linux kernel's vsock/virtio MSG_ZEROCOPY path allows a local low-privileged user to bypass per-process pinned-page limits, enabling unbounded kernel memory pinning that can drive the system toward memory exhaustion. The flaw is confined to the virtio vsock transport and is not remotely exploitable. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), reflecting low exploitation interest; however, a vendor-confirmed fix is available in stable releases.
Resource leak in the Linux kernel fsnotify subsystem causes hung tasks and local denial of service via a race condition in fsnotify_recalc_mask(). A local low-privilege user can trigger concurrent mark addition and removal on a filesystem connector object, causing an inode pointer returned by __fsnotify_recalc_mask() to be silently discarded rather than released via fsnotify_drop_object() - permanently blocking the umount path as fsnotify_sb_delete() waits indefinitely on the leaked reference. No public exploit exists and EPSS is at the 7th percentile, indicating negligible opportunistic exploitation risk.
Uninitialized memory use in the Linux kernel netdevsim subsystem allows a local low-privileged attacker to cause kernel crashes or potentially expose residual kernel heap contents via dummy packet trap operations. The root defect is in `nsim_dev_trap_skb_build`, where `skb_put` allocated space for a `struct iphdr` without zeroing it, leaving uninitialized kernel memory accessible in a dummy `sk_buff`. No public exploit code exists and the vulnerability is not in CISA KEV; EPSS stands at 0.18% (7th percentile), consistent with negligible opportunistic exploitation risk. Vendor-released patches are confirmed across all actively supported stable kernel branches.
Unbounded queue growth in the Linux kernel's netem (Network Emulator) traffic control subsystem allows a local low-privileged user to exhaust kernel memory and trigger a denial of service. The flaw exists because netem_enqueue() enforces queue depth limits using only q->t_len (packets in the internal tfifo), while packets placed into sch->q via the reorder path (__qdisc_enqueue_head) are silently excluded from that count, allowing total queue occupancy to grow beyond sch->limit without bound. No public exploit has been identified and the EPSS score of 0.18% (8th percentile) places this in the lowest exploitation-probability tier; however, the vulnerability affects a wide range of active stable kernel branches and patched versions are available.
Kernel crash via scheduler state corruption in the Linux kernel's CFS/EEVDF fair scheduler allows a local user to cause a NULL pointer dereference and system denial of service. When a task is forked while the parent's sched_entity has rel_deadline set, the child inherits stale deadline state that __sched_fork() fails to clear; a subsequent sched_yield() call on the child inflates vruntime by approximately 2x (observed: ~9.8e15 jumping to ~1.9e16), corrupting cfs_rq->sum_w_vruntime and ultimately causing pick_next_entity() to return NULL unexpectedly. No active exploitation has been identified (EPSS 0.17%, not in CISA KEV), and upstream stable patches are available across multiple kernel branches.
Race condition in the Linux kernel PSP network subsystem allows a local low-privileged attacker to crash the kernel through a TOCTOU flaw in device association creation. In `psp_assoc_device_get_locked()`, a device reference acquired under RCU becomes stale before the protecting lock is taken if `psp_dev_unregister()` completes concurrently, leaving the kernel operating on freed or invalid device state. No public exploit has been identified and EPSS stands at 0.17% (6th percentile), reflecting minimal active exploitation risk despite the well-characterized code-level race condition.
Missing CAP_NET_ADMIN enforcement in the Linux kernel PSP (PSP Security Protocol) netlink subsystem allows any local user with low privileges within the same network namespace to invoke the dev-set and key-rotate operations - modifying PSP version configuration and rotating cryptographic key material without authorization. The only access control in place, psp_dev_check_access(), validates only network namespace membership and does not enforce administrative capability. This enables unauthorized disruption of PSP-encrypted network communications and unauthorized modification of in-use cryptographic keying material. No public exploit code has been identified at time of analysis, and EPSS exploitation probability is very low at 0.17% (7th percentile).
Livelock in the Linux kernel's futex requeue-PI subsystem can hang a system when a signal or timeout interrupts a FUTEX_WAIT_REQUEUE_PI operation concurrently with an active FUTEX_CQ_REQUEUE_PI requeue. The race causes a waiting thread (Task A) to block indefinitely on a hash-bucket lock while a requeue thread (Task B) busy-loops retrying the same operation, consuming all available CPU - worst-case on uniprocessor systems where Task A cannot be scheduled at all. No public exploit is identified and EPSS is 0.17% (7th percentile), but the deterministic nature of the livelock on UP or real-time-scheduled hardware makes this a genuine denial-of-service risk; patches are available across six Linux stable branches.