Linux
Monthly
NULL pointer dereference in the Linux kernel's amdgpu RAS (Reliability, Availability, and Serviceability) driver crashes the kernel when a local user reads the sysfs badpages interface on a system whose AMD GPU EEPROM contains only invalid address entries. The driver skips RAS data allocation under this condition, and the subsequent read of `amdgpu_ras_sysfs_badpages_read` dereferences the uninitialized pointer, producing a kernel panic and complete denial of service. No public exploit exists and no active exploitation has been identified; EPSS is 0.02% (4th percentile), reflecting very low real-world risk.
Integer wraparound in the Linux kernel JFS (Journaled File System) `jfs_rename` function can be triggered by a local low-privileged user to cause a kernel warning and denial of service. When a directory's hard link count (nlink) is already at its maximum value (-1 as an unsigned overflow scenario), performing an in-place rename of a child subdirectory increments nlink and then decrements it, wrapping the counter to zero and triggering a `drop_nlink` kernel warning. The vulnerability affects a wide range of stable kernel branches from 5.10 through 6.19; no public exploit code exists and CISA has not listed this in KEV, making active exploitation unlikely but not impossible in multi-tenant or container environments where JFS-mounted filesystems are accessible to low-privilege users.
Null pointer dereference in the Linux kernel's bcm_vk misc driver allows a local authenticated attacker to crash the kernel, resulting in a denial of service. The bcm_vk_read() function checks whether the 'entry' pointer is NULL but fails to prevent subsequent dereferences of that pointer when rc is set to -EMSGSIZE, leading to a kernel panic. No public exploit exists and the vulnerability is not listed in CISA KEV; however, vendor-released patches are available across multiple stable kernel branches, and Red Hat and SUSE have tagged this for attention in their ecosystems.
Memory exhaustion denial-of-service in the Linux kernel's ti_fpc202 misc driver allows a local low-privileged user to degrade system availability through a memory leak introduced in the probe function. The root cause is improper release of device tree child node references during driver initialization when iterating over nodes, classified as CWE-401 (Missing Release of Memory after Effective Lifetime). No active exploitation is confirmed - no public exploit identified at time of analysis - and the extremely low EPSS score of 0.02% (4th percentile) reflects the niche hardware dependency and local-only attack surface.
Silent error suppression in the Linux kernel's NTFS3 filesystem driver allows a local authenticated user to trigger inode inconsistency by causing attr_set_size() to fail during file truncation. Affected systems running NTFS3-mounted volumes may experience filesystem corruption or denial of service without any visible error signal to the kernel. No active exploitation has been identified (EPSS 0.02%, not in CISA KEV), and vendor-released patches are available in Linux 7.0 and 6.19.6.
Resource leak in the Linux kernel's mtk-smi (MediaTek System Memory Interface) driver allows a local, low-privileged attacker on MediaTek SoC-based systems to cause a denial of service by exhausting kernel device references. The driver fails to call put_device() on the SMI device reference obtained during common probe when late probe failure (e.g., -EPROBE_DEFER) or driver unbind occurs, leaving dangling references that accumulate over repeated cycles. No public exploit identified at time of analysis and EPSS at 0.02% (7th percentile) indicates very low exploitation probability; patches are available across multiple stable branches.
Device reference leak in the Linux kernel's MediaTek SMI (mtk-smi) memory driver can cause resource exhaustion and denial of service on affected MediaTek SoC-based systems. The flaw exists in the larb (Local Arbiter) probe path, where a reference acquired during SMI device lookup is never released when late probe failure occurs (e.g., probe deferral) or when the driver is unbound - leaving the kernel device struct's reference count permanently inflated. With EPSS at 0.02% (7th percentile), no KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is very low and narrowly scoped to hardware running MediaTek SoCs.
Memory allocation underflow in the Linux kernel ASoC SOF (Sound Open Firmware) ipc4-topology module allows local authenticated users to trigger a denial of service via bytes control handling that fails to account for the full data structure size. The vulnerability affects kernel versions prior to specific stable releases (6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0) where the allocation size calculation omits the sof_ipc4_control_data structure, potentially causing memory exhaustion or kernel crash when processing audio topology configuration.
Null pointer dereference in the Linux kernel QRTR (Qualcomm IPC Router) driver via MHI auto_queue feature causes denial of service on Qualcomm X1E80100 CRD machines during boot. The vulnerability occurs when the MHI stack invokes the DL (downlink) callback before the QRTR client driver is fully probed, accessing uninitialized driver structures. A local privileged attacker can trigger kernel panic by exploiting the race condition between MHI buffer auto-queuing and driver initialization, affecting systems relying on QRTR over MHI transport.
NULL pointer dereference in the Linux kernel's RDMA/ionic driver allows a local low-privileged user to crash the kernel by triggering the `ionic_query_port()` function when the associated network device is unavailable. The root cause is an unchecked return value from `ib_device_get_netdev()`, which can return NULL during device absence or hot-unplug transitions - leading to a kernel panic and complete denial of service. No public exploit has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) confirms this is not being actively targeted.
Out-of-bounds read in the Linux kernel's APEI/GHES subsystem crashes affected systems when processing malformed or oversized CPER (Common Platform Error Record) data supplied by non-conformant firmware. The `ghes_new()` function enforces a maximum size check against `GHES_ESTATUS_MAX_SIZE` (64KB), but the underlying buffer is allocated using the actual page count from the BIOS CPER table location, which may be smaller; when firmware supplies error data exceeding the allocated buffer, subsequent CPER printing via `cper_estatus_print_section()` triggers a kernel OOPS (level-3 page fault) and system crash. No active exploitation is confirmed: EPSS is 0.02% at the 7th percentile, and this vulnerability is absent from the CISA KEV catalog.
Race condition in the Linux kernel UFS core driver causes a system crash during suspend when the runtime power management level is set to UFS_PM_LVL_0. At this PM level the device power mode and link state remain active, yet the driver previously skipped flushing pending exception event handling work before proceeding with suspend - allowing a workqueue job to access UFS host controller registers after the hardware has entered a deep power-down state. The resulting kernel panic yields a total denial of service. No public exploit has been identified and EPSS sits at 0.02% (7th percentile), indicating low near-term exploitation likelihood.
Snapshot data integrity corruption in the Linux kernel's CephFS driver allows a local authenticated user to silently corrupt immutable snapshot content by performing a fallocate hole-punch operation on a mounted CephFS volume. The `ceph_zero_partial_object()` function omits the RADOS snapshot context (`snapc`) when issuing OSD zeroing writes, causing those writes to propagate into snapshot objects rather than being scoped to the live file layer only. Affected environments are limited to those running CephFS mounts with active snapshots; no active exploitation is confirmed (absent from CISA KEV), and EPSS sits at 0.02%, though a developer-supplied reproducer effectively functions as proof-of-concept.
Uninitialized pointer dereference in the Linux kernel ring-buffer subsystem crashes the kernel, enabling a local low-privileged user to cause a denial of service. The function `rb_meta_validate_events()` fails to initialize `head_page` before error-handling code at the `invalid` label dereferences it during reader page validation failure. No public exploit exists and EPSS places this at the 4th percentile, but vendor-released patches are available in stable branches 6.18.16, 6.19.6, and 7.0.
NULL pointer dereference in the Linux kernel md-cluster subsystem allows a local low-privileged user to crash the system during a narrow race window in MD array startup. The process_metadata_update() function blindly dereferences mddev->thread before it is initialized, which becomes reachable if a remote cluster peer sends a METADATA_UPDATED message after bitmap_load() starts the recv_daemon but before mddev->thread is assigned in md_run(). No public exploit has been identified at time of analysis, and EPSS probability is 0.02% (5th percentile), consistent with a niche, timing-dependent local DoS.
Reference count leak in the Linux kernel's mtk-mdp (MediaTek Media Data Path) driver allows a local low-privileged user on MediaTek SoC hardware to cause incremental resource exhaustion. The missing platform_device_put() call in mtk_mdp_remove() means each driver removal cycle permanently leaks one reference to the VPU platform device, preventing kernel memory reclamation. No public exploit exists and EPSS sits at 0.02% (7th percentile); patches are confirmed across eight stable kernel branches.
Memory exhaustion in the Linux kernel's drm/atmel-hlcdc DRM driver gradually degrades availability on systems using Atmel/Microchip HLCDC display controller hardware. The atomic_destroy_state callback incorrectly releases only framebuffer references while omitting the call to __drm_atomic_helper_plane_destroy_state(), causing drm_crtc_commit objects (64 bytes each) to accumulate in kernel slab memory across every DRM atomic commit operation. Impact is limited to local denial of service through eventual OOM on embedded platforms using SAMA5 SoCs; no public exploit identified at time of analysis and EPSS is 0.02% (7th percentile), reflecting negligible exploitation interest.
Kernel crash in the Linux hfsplus filesystem driver results from a VFS enforcement change (commit af153bb63a33) that requires all inodes to carry a standard file-type mode bit, which hfsplus special inodes (catalog file, extents overflow file, attributes file, etc.) historically did not. Any local user able to trigger access to those special inodes on a mounted HFS+ volume can cause a kernel panic, producing a high-availability denial-of-service. No public exploit code exists and EPSS sits at 0.02% (7th percentile), reflecting low opportunistic exploitation likelihood, but the bug is deterministically reproducible against any unpatched kernel configured with hfsplus support.
Division by zero in the Linux kernel's rtw89 WiFi driver can crash the kernel when beacon interval is zero during beacon tracking. Discovered via fuzz testing, this local vulnerability (AV:L/PR:L) affects systems running any Linux kernel from initial commit through stable branches prior to 6.18.16, 6.19.6, and 7.0. An authenticated local attacker can trigger a kernel panic, resulting in a complete denial of service on the affected host. No public exploit exists and no active exploitation has been observed.
Out-of-bounds read in the Linux kernel's EFI/CPER ARM processor error record handler allows firmware-supplied records with a crafted or malformed `section_length` value to cause the kernel to read far beyond the allocated CPER buffer, potentially leaking contents of firmware-mapped memory regions to system logs. Affected systems are ARM-based machines with UEFI/APEI/GHES support running any Linux kernel prior to the patched stable releases (5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0). No public exploit has been identified, EPSS is 0.02% (7th percentile), and the vulnerability is absent from CISA KEV.
Denial of service in Linux kernel KVM x86 nested virtualization allows local privileged attackers to crash virtual machines by manipulating vCPU state through userspace MP_STATE and injected event stuffing. When a vCPU is awakened from a blocking state in L2 (nested guest mode) with an already-injected event, the kernel generates spurious KVM_EXIT_UNKNOWN exits that typically terminate the VM. The vulnerability stems from insufficient validation of impossible vCPU states that userspace can artificially create, despite architectural safeguards that should prevent injected events during blocking. CVSS 5.5 (local, low complexity, high availability impact); EPSS 0.02% indicates minimal widespread exploitation likelihood.
Refcount leak in the Linux kernel's fbdev Open Firmware display timing subsystem (of_get_display_timings()) affects kernel versions from 3.9 through multiple stable branches, allowing a local low-privileged user to trigger resource exhaustion that degrades system availability. The flaw lies in error-path handling where of_parse_phandle() increments a device_node refcount into native_mode, but the goto target 'entryfail' at lines 184 and 192 never calls of_node_put(native_mode), leaving the refcount permanently elevated. No active exploitation has been identified - EPSS of 0.02% (7th percentile) and absence from CISA KEV confirm this as a maintenance-class kernel fix rather than an emergency threat.
Recursive glock deadlock in the Linux kernel GFS2 cluster filesystem driver allows a locally authenticated user to cause a kernel thread hang and denial of service. In gfs2_fiemap(), the inode glock is held while calling iomap_fiemap(); if the userspace fiemap output buffer is memory-mapped to the same GFS2 inode, a page fault during buffer writes triggers a second attempt to acquire the already-held glock, producing a deadlock. No public exploit or CISA KEV listing exists; EPSS is 0.02% (7th percentile), consistent with the niche GFS2 deployment footprint and the specific trigger conditions required.
Spectre-BHB (Branch History Buffer) software mitigation was absent in the Linux kernel arm64 subsystem for systems running the HiSilicon TSV110 processor, leaving those systems exposed to branch prediction side-channel attacks capable of leaking sensitive kernel memory contents across privilege boundaries. The root cause was the kernel lacking the TSV110 MIDR (Main ID Register) entry in its processor-specific mitigation table, meaning the software workaround was never applied on that hardware. No public exploit has been identified at time of analysis, and EPSS probability sits at a low 0.02% (7th percentile), though the real-world confidentiality risk on Huawei/HiSilicon arm64 deployments is meaningful given the class of attack.
NULL pointer dereference in the Linux kernel's fsl-imx8mq-usb PHY driver crashes systems built on NXP i.MX8MQ SoC when the driver is unloaded or the device is removed. The driver's probe function omits the required platform_set_drvdata() call, leaving the driver data pointer unset; when remove() subsequently dereferences it, a kernel panic results. Exploitation is limited to local, low-privilege users on specialized embedded hardware; EPSS at 0.02% (4th percentile) and absence from CISA KEV confirm no public exploit or in-the-wild exploitation at time of analysis.
Denial of service in Linux kernel media cx88 driver allows local authenticated attackers to exhaust system resources by triggering a missing DMA unmapping in the snd_cx88_hw_params() error path. The vulnerability causes resource leaks when audio hardware parameter initialization fails, potentially rendering the audio subsystem unavailable. CVSS 5.5 reflects local attack vector with low complexity; EPSS 0.02% indicates minimal real-world exploitation probability despite vendor-released patches across multiple kernel versions.
A use-after-free condition in the libertas USB wireless driver allows local attackers with user privileges to cause a denial of service by triggering a kernel warning and potential crash through rapid firmware loading or repeated usb_tx_block() calls while a USB request is still active. The vulnerability stems from insufficient synchronization of USB URB submissions, enabling concurrent requests on the same URB without enforcing completion of prior transmissions.
Denial of service via kernel warning in MPTCP path manager occurs when combining endpoint removal with fullmesh and flag-setting operations through netlink in the Linux kernel. A local attacker with low privileges can trigger a WARNING in net/mptcp/pm_kernel.c:1074 by sending a crafted sequence of netlink commands, causing the system to emit a kernel warning and potentially become unstable. No known public exploit code exists, but the low CVSS (5.5) and minimal EPSS (0.03%) indicate this is a local DoS with limited real-world impact.
NULL pointer dereference in the Linux kernel HID prodikeys driver allows a local attacker with USB access to crash the kernel by presenting a crafted USB device that impersonates a Creative Prodikeys PC-MIDI controller. When the fake device's HID report descriptors bypass the input_mapping() callback, pm->input_ep82 remains NULL; subsequent dereference of that pointer causes a kernel panic, resulting in a complete availability loss. No public exploit or active exploitation has been identified; EPSS is 0.02% (7th percentile), consistent with the local-only, denial-of-service-only impact profile.
Kernel panic via SError interrupt in Linux kernel media driver (chips-media wave5) when device enters autosuspend during video decoding operations. Local authenticated attackers can trigger a denial of service by queuing buffers to the wave5 video decoder while autosuspend timeout occurs, causing the CPU to access suspended hardware and generate an unrecoverable asynchronous SError, crashing the system. No privilege escalation or code execution; impact limited to availability.
Memory leak in the tw9906 media driver's probe function allows local authenticated attackers to cause denial of service through memory exhaustion. The vulnerability occurs in tw9906_probe() when an error path fails to free memory allocated by v4l2_ctrl_handler_init() and v4l2_ctrl_new_std(), potentially leading to kernel memory depletion on repeated device probe attempts. Vendor-released patches are available across multiple stable kernel branches.
Denial of service in Linux kernel KCM (kernel connection multiplexer) subsystem when processing messages with zero-fragment skbs in frag_list after partial sendmsg failures. A local authenticated attacker can trigger a kernel warning and potentially crash the system by sending a malformed message that fails during data copy, leaving an empty skb in the fragment list. The vulnerability requires local access and low-level socket manipulation, affecting systems running vulnerable Linux kernel versions prior to patching.
A denial of service vulnerability in the Linux kernel's AMD display driver (drm/amd/display) allows local authenticated users to crash the system by accessing link encoder functionality on DisplayPort over USB-C (DPIA) links without proper signal type validation. The vulnerability affects kernel versions before the patches released in stable branches 6.12.75, 6.18.16, 6.19.6, and 7.0. No public exploit code has been identified, and real-world exploitation probability is very low (EPSS 0.02%), suggesting this is primarily an edge-case denial of service affecting specific hardware configurations with DPIA displays.
Memory leak in the Linux kernel's TI K3 SoC info driver (soc/ti/k3-socinfo) fails to release an allocated mmio regmap, causing denial of service through resource exhaustion on probe failures and driver unbind. Local attackers with low privileges can trigger probe deferral or driver unbind to exhaust kernel memory, affecting systems running vulnerable Linux kernel versions. The vulnerability has a low EPSS score (0.02%) but enables practical local DoS against systems where low-privilege users can control driver lifecycle.
Linux kernel x86 architecture fails to validate IMA measurement list memory bounds during kexec boot with restricted memory parameters, causing kernel panic when the carried-over IMA buffer falls outside truncated RAM. Authenticated local users with kexec privileges can trigger a denial of service. The fix adds a sanity check to validate the previous kernel's IMA kexec buffer against actual memory bounds before restoration, aligning x86 behavior with other architectures.
Divide-by-zero in the Linux kernel's traffic control subsystem (`net/sched/act_skbedit.c`) crashes the kernel when a tc SKBEDIT action is configured with a queue mapping range spanning the full u16 address space. Affected kernels range from 5.19 (where commit 38a6f0865796 introduced SKBEDIT_F_TXQ_SKBHASH support) through all unpatched stable branches up to 7.0; vendor-released patches are available across six stable branches. No public exploit code exists and EPSS sits at 0.02% (7th percentile), making this a low-urgency patch cycle item for most environments, with highest relevance where low-privileged users can invoke tc configuration.
Availability failure in the Linux kernel's iris media driver for Qualcomm SM8750 (Snapdragon 8 Elite) causes video codec sessions to crash during bring-up due to two missing platform data entries. The absent get_vpu_buffer_size field prevents internal VPU buffer allocation, while the missing max_core_mbps entry causes incomplete capability checks and v4l2-compliance failures for the encoder. No public exploit exists and EPSS is 0.02% (4th percentile), consistent with the niche hardware dependency; this is a functional defect with availability impact rather than a traditional exploitable security weakness.
Denial of service in the Linux kernel team network driver arises when a slave interface is moved to a different network namespace and then deleted, causing team_port_del() to fire a spurious NETDEV_CHANGEMTU event during slave unregistration that prompts inetdev_init() to acquire an unreleased reference on the device. This reference leak prevents the device from completing unregistration, hanging the kernel with 'unregister_netdevice: waiting for [device] to become free.' The bug is confined to local authenticated access and no public exploit exists (EPSS 0.02%, 4th percentile); however, the Linux kernel's ubiquitous deployment makes patch application broadly relevant. Upstream stable fixes are confirmed available in Linux 6.18.16, 6.19.6, and 7.0.
Memory leak in the Linux kernel's radio-keene USB FM transmitter driver (radio-keene.c) leaves a v4l2 control handler unfreed when either v4l2_device_register() or video_register_device() fails during device probe. Affected kernel versions range from the commit introducing the flaw (1bf20c3a0c616f44359c573b533d06bae960ee45) through multiple stable branches, with fixed versions confirmed across 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0. No public exploit has been identified at time of analysis, and EPSS at 0.02% (7th percentile) confirms negligible real-world exploitation probability.
Kernel panic in the Linux kernel's chips-media wave5 VPU driver stems from an incorrect device cleanup order during module removal or autosuspend, allowing a powered-down hardware state to be accessed by a still-running worker thread. Systems with chips-media wave5 VPU hardware running video encoding workloads are vulnerable to a local denial-of-service via synchronous external abort (bus error). No public exploit exists and no active exploitation is confirmed; EPSS is 0.02% (5th percentile), reflecting the niche hardware requirement.
Kernel panic via reachable assertion in the HFS filesystem driver allows a local low-privileged user to crash the system by mounting a crafted, corrupted HFS disk image. The BUG_ON assertions guarding CNID count overflow in the superblock were triggered by syzbot when processing a malformed MDB (Master Directory Block), causing a denial-of-service through kernel panic. No active exploitation has been confirmed (not in CISA KEV), and EPSS probability sits at 0.02% (5th percentile), indicating negligible real-world exploitation activity at time of analysis.
Denial-of-service through an invalid spinlock context in the Linux kernel's sh_tmu (SH Timer Unit) clocksource/clockevent driver triggers a lockdep violation and system hang on PREEMPT_RT-enabled builds running on Renesas SH/ARM platforms. The driver invokes pm_runtime_*() and clk_*() functions while holding a raw spinlock required by the clockevent framework; on PREEMPT_RT kernels, these PM and clock management calls acquire regular spinlocks that can sleep, making the combined locking sequence illegal. No public exploit code exists and exploitation probability is negligible (EPSS 0.02%), but the impact on affected hardware is a full system availability loss. Patches are confirmed available across all active stable branches.
Memory leak in the Linux kernel's staging rtl8723bs Wi-Fi driver degrades system availability for hosts running affected kernel versions with Realtek RTL8723BS hardware. The flaw occurs in the BSS scanning code path where cfg80211_inform_bss_frame() can return NULL on failure, but the previously allocated 'buf' buffer is not released, causing unbounded kernel memory loss over time. With EPSS at 0.02% (7th percentile), no CISA KEV listing, and no public exploit code, this is a low-urgency memory management defect patched across all active stable kernel branches.
Memory leak in the Linux kernel io_uring zero-copy receive (zcrx) subsystem allows a local low-privileged attacker to exhaust kernel memory via repeated DMA mapping failures on PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA systems, causing denial of service. The root cause is a sgtable (scatter-gather table) resource that is initialized but never freed when io_populate_area_dma() fails, because the error path's cleanup guard (!is_mapped) incorrectly skips deallocation. No public exploit exists and EPSS is 0.02% (4th percentile), reflecting the narrow hardware-specific trigger condition.
URB (USB Request Block) leak in the Linux kernel pvrusb2 media driver causes a denial-of-service condition on systems with Hauppauge WinTV-PVR USB2 capture devices. The pvr2_send_request_ex() function fails to unlink and await the write URB before returning on read URB submission failure, leaving the URB in an active state; subsequent driver calls trigger a 'URB submitted while active' kernel warning that destabilizes the USB subsystem. No public exploit exists and EPSS is 0.02% (7th percentile), but vendor-released patches are available across all major stable kernel branches.
Uninitialized read bytes in the Linux kernel IPMI IPMB driver expose systems to a local denial-of-service condition. The IPMB subsystem does not use i2c reads by design, but when an i2c read is triggered through the event handler, an uninitialized value is returned from the underlying bus driver, potentially causing kernel instability or a crash on affected server hardware. No public exploit exists and EPSS is 0.02% (7th percentile), indicating low real-world exploitation probability despite patches being available across multiple stable branches.
Denial of service in the Linux kernel AMD IOMMU subsystem allows a local low-privileged user to crash or stall IOMMU completion waits on systems with AMD hardware and IOMMU enabled. The root cause is a race condition where cmd_sem_val was incremented outside the IOMMU spinlock, permitting CMD_COMPL_WAIT commands to queue out of order and breaking the ordering invariant in wait_on_sem() under concurrent TLB invalidations. No public exploit or active exploitation has been identified; EPSS stands at 0.02% (4th percentile), reflecting negligible real-world exploitation probability at time of analysis.
Improper error-path cleanup in the Linux kernel's cpsw_new (TI Common Platform Switch) network driver can trigger an attempt to unregister a net device that was never successfully registered, causing a kernel crash or panic and resulting in local denial of service. Systems running affected kernel versions on Texas Instruments SoC hardware - including BeagleBone and AM335x/AM437x platforms - are at risk when the CPSW driver encounters a failure during the first MAC's netdev registration. No public exploit identified at time of analysis and EPSS exploitation probability is extremely low at 0.02% (4th percentile), consistent with its hardware-specific, error-path nature.
Memory leak in Linux kernel tw9903 media driver probe function allows local authenticated attackers to cause denial of service through repeated device initialization failures. The v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() allocations are not freed in one error path of tw9903_probe(), enabling exhaustion of kernel memory. CVSS 5.5 (local, low complexity, requires low privileges). EPSS score of 0.02% indicates minimal exploitation probability.
Kernel panic in the Linux iris gen2 media driver can be triggered by a local low-privileged user when a sequencing flaw between iris_kill_session and stop_streaming causes a NULL dereference of a freed packet buffer. The iris driver - used for Qualcomm video codec hardware - frees inst_hfi_gen2->packet during session teardown via kfree, but stop_streaming lacks a guard against subsequently dereferencing that pointer when sending a STOP command to firmware, resulting in a system crash. No public exploit code exists, EPSS is 0.02% (4th percentile), and vendor-released patches are confirmed across multiple stable kernel branches.
Denial of service in the Linux kernel's net subsystem via deadlock in skb_may_tx_timestamp() when socket timestamp completion occurs in interrupt context while sk_callback_lock is write-locked, affecting local attackers with user privileges on systems with network drivers that complete TX timestamps from dedicated interrupt handlers.
Local denial of service in Linux kernel ring-buffer tracing code allows authenticated local users to crash the system by triggering invalid memory access through malformed event length fields. The vulnerability exists in rb_read_data_buffer(), which validates possibly corrupted ring buffers at boot but fails to verify event lengths are within acceptable ranges before calculating buffer offsets. EPSS exploitation probability is very low at 0.02%, and no public exploit code or active exploitation has been identified.
Denial of service in Linux kernel minix filesystem implementation allows local authenticated users to crash the system via crafted minix superblock structures due to missing validation of s_log_zone_size and other superblock fields in the minix_check_superblock() function.
Kernel lockup in the Qualcomm Q6ASM (Audio Stream Manager) driver allows a local low-privileged user to trigger a system hang by racing audio stream closure against in-flight DSP responses. Affected Linux kernel versions spanning from the initial commit (1da177e4c3f4) up to the stable fixes in 6.19.6 and 7.0 are vulnerable. A prior partial fix (commit a354f030dbce) attempted to suppress post-close DSP response handling but failed to prevent processing, leaving the lockup reachable. No public exploit code exists and no active exploitation has been confirmed - EPSS sits at 0.02% (5th percentile), consistent with a niche hardware-dependent kernel DoS.
Memory leak in Linux kernel fbdev vt8500lcdfb driver allows local authenticated users to cause denial of service via unfreed DMA-allocated buffer on error path. The vulnerability exists in the framebuffer initialization code where dma_alloc_coherent() allocation for fbi->fb.screen_buffer is not properly freed if an error occurs during probe, leading to memory exhaustion on repeated device initialization attempts. Local privilege required; no remote or unauthenticated attack vector.
Denial of service in Linux kernel APEI/GHES ARM processor error handling allows local authenticated attackers to trigger kernel oops by crafting malformed ARM Processor Error records with incomplete or oversized section data, causing out-of-bounds memory dereference. CVSS 5.5 (local, low complexity, authenticated, availability impact only) with EPSS 0.02% indicates low real-world exploitation probability despite public patch availability.
Denial of service in Linux kernel PCI endpoint configfs interface allows local attackers with low privileges to crash the kernel via swapped parameters in pci_primary_epc_epf_unlink() and pci_secondary_epc_epf_unlink() functions. When executing the unlink command in configfs, incorrect parameter ordering causes invalid memory access and kernel panic. CVSS 5.5 (local, low complexity, low privilege) with EPSS 0.02% suggests limited real-world exploitation despite confirmed availability of patches across multiple kernel branches.
Missing input validation in the Linux kernel's amdgpu DRM driver allows a local user with low privileges to trigger GPU faults by supplying invalid user queue sizes. The driver fails to enforce two hardware requirements - that queue sizes be a power-of-two and at least AMDGPU_GPU_PAGE_SIZE - enabling crafted queue configurations that cause availability loss (GPU faults or unexpected GPU subsystem behavior). No public exploit is identified at time of analysis, and EPSS at 0.02% (4th percentile) reflects very low real-world exploitation probability. Patches are available in kernel stable branches 6.18.16, 6.19.6, and 7.0.
Reference count leak in the Linux kernel's NFS server daemon (nfsd) subsystem allows a local low-privileged user on a system running NFSv4 to exhaust kernel file object resources, resulting in denial of service. The vulnerability lies in nfsd_get_dir_deleg(), which fails to release the nfs4_file reference before early return paths. No public exploit exists and the EPSS score of 0.02% (5th percentile) reflects very low real-world exploitation probability; there is no CISA KEV listing.
Resource reference leak in the Linux kernel's dm-multipath (dm mpath) subsystem allows a local low-privileged user to trigger an availability impact against systems using multipath SCSI storage. Specifically, the `parse_path()` function fails to call `dm_put_device()` when `scsi_dh_attached_handler_name()` returns -ENOMEM during path parsing, leaving a dangling device reference that is never released. No public exploit exists and EPSS probability is 0.02%, placing this firmly in the low-exploitation-likelihood tier, but enterprise Linux systems with SAN-backed multipath storage are in scope. Vendor-released patches are available in Linux 6.19.6 and the 7.0 stable branch.
System hang vulnerability in the AMD DCN35 display engine driver allows a local low-privilege user to trigger an unrecoverable kernel hang by initiating a TMDS display disable event on affected AMD hardware. The hang arises because the PHY FSM transition from TX_EN to PLL_ON is non-atomic, leaving the Output Timing Generator stuck and blocking DCHVM IOMMU invalidation acknowledgments - a condition that can arise under normal display reconfiguration. No public exploit code exists and EPSS is 0.02% (5th percentile), indicating no meaningful exploitation interest; the CISA KEV does not list this vulnerability.
Error handling flaws in the Linux kernel's V4L2 async media subsystem allow a local low-privileged attacker to crash the kernel, causing a denial of service. Two bugs exist in the post-match processing path: an async connection is double-removed from the sub-device's connection list when v4l2_async_match_notify() fails mid-way, and the connection's sd pointer is dereferenced in the unbind error path before it is initialized - a NULL pointer dereference. No public exploit or active exploitation has been identified; EPSS at 0.02% (5th percentile) confirms very low current exploitation probability and this vulnerability is not listed in CISA KEV.
Kernel worker crash (BUG_ON oops) in the Linux kernel Ceph filesystem driver occurs when fscrypt encryption is enabled and GFP_NOWAIT bounce buffer allocations fail during writeback batch processing. A local user with write access to an fscrypt-encrypted Ceph mount can trigger this under memory pressure, causing the writeback loop to pass a stale page array pointer to ceph_allocate_page_array(), firing its BUG_ON assertion and crashing the worker. No public exploit is identified; EPSS of 0.02% (4th percentile) and absence from CISA KEV confirm negligible real-world exploitation activity.
Resource leak in the Linux kernel cx25821 media driver allows a local low-privileged user on a system with CX25821 video capture hardware to degrade system availability by exhausting kernel I/O memory regions. The flaw exists in cx25821_dev_setup() where a call to release_mem_region() is missing on the ioremap() failure path, leaving a memory region claimed by cx25821_get_resources() permanently unreleased. No public exploit code exists and EPSS sits at 0.02% (7th percentile), confirming this as a low-exploitation-risk maintenance fix rather than an active threat; patches are available across all active stable kernel branches.
Division by zero in the Linux kernel's CCS (Camera Control Set) media driver can be triggered by a local authenticated user, causing a kernel crash and denial of service. The flaw exists in scaler configuration logic where the MAX_M calculation divides by the MIN_X_OUTPUT_SIZE limit register value without first validating it is non-zero. Affected systems must have a CCS-compatible camera device attached and the ccs media driver loaded; no public exploit or active exploitation (CISA KEV) has been identified, and EPSS sits at 0.02%, reflecting very low real-world exploitation probability.
GPIO sysfs teardown in the Linux kernel fails to drop the final sysfs attribute reference when a GPIO controller is unbound while pins remain exported, leaving stale /sys/class/gpio entries and causing a kernel availability impact on affected systems. Kernels from commit 1cd53df733c21ae0d344a2dec941a3e2a06fefd9 through the fix are affected, with patched stable releases at 6.18.16, 6.19.6, and 7.0; Red Hat and SUSE downstream kernels incorporating the affected range are similarly impacted. No public exploit exists and the EPSS score is 0.02% (4th percentile), making this primarily a stability concern for embedded Linux deployments actively using the GPIO sysfs interface.
EROFS filesystem folio reference leaks in the Linux kernel allow a local low-privileged attacker to cause availability degradation by mounting crafted EROFS images with metabox (metadata compression) enabled, triggering incorrect early returns in the kernel's EROFS parser. Affected kernels prior to stable releases 6.18.16, 6.19.6, and 7.0 are vulnerable; the vendor explicitly notes no system crashes result, limiting impact to gradual resource exhaustion. No public exploit code exists and EPSS sits at 0.02% (4th percentile), indicating negligible observed exploitation interest at time of analysis.
Runtime PM reference leak in the Linux kernel's Intel IPU6 PCI driver causes a local denial-of-service condition on systems with compatible Intel Image Processing Unit hardware. Low-privileged local users on affected kernel versions can trigger unbalanced runtime power management reference counts when the ipu6_pci_probe() function traverses error paths without calling pm_runtime_put_sync(), leaving the device in a corrupted power management state. No public exploit exists and the EPSS score of 0.02% (5th percentile) reflects negligible real-world exploitation interest; no active exploitation has been confirmed.
Out-of-bounds write in the Linux kernel's clk/rs9 clock driver corrupts kernel memory on systems equipped with the Renesas 9FGV0841 clock chip, reliably crashing the kernel during driver unbind or suspend. The rs9_driver_data structure allocated only 4 slots for clk_hw pointers but the 9FGV0841 exposes 8 outputs, so registering outputs 4-7 silently overwrites adjacent kernel memory. No public exploit exists and no active exploitation is confirmed (not in CISA KEV); EPSS is 0.02% (5th percentile), reflecting the hardware-specific and local-only attack surface.
Improper error handling in the Linux kernel's io_uring zero-copy receive (zcrx) subsystem causes a premature release of the zcrx context when closing a queue, leading to a local denial-of-service (kernel crash). Affected kernels include Linux 6.15 series; the root cause is that queue closure does not guarantee immediate termination of all associated page pools, and the code incorrectly released the zcrx ctx directly rather than delegating cleanup to the reference-counting mechanism. No public exploit exists and no active exploitation has been identified at time of analysis; EPSS is 0.02% (5th percentile), consistent with the low real-world exploitation risk.
NULL pointer dereference in the Linux kernel's ixp4xx Ethernet driver (net/ethernet/xscale) crashes the kernel on Intel IXP4xx-based embedded systems when PTP timestamp queries are made against non-ixp46x hardware. A local authenticated user on affected hardware can trigger a kernel panic simply by running standard tools such as tcpdump or ethtool, causing a full system crash. No active exploitation is confirmed (EPSS 0.02%, no CISA KEV listing), and real-world impact is constrained to legacy IXP4xx-based embedded devices such as OpenWrt-capable routers.
Integer underflow in the Linux kernel's EFI/CPER firmware error logging function (cper_print_fw_err) allows local authenticated attackers to trigger denial of service via memory dump of unmapped regions, disclose kernel memory contents, or cause system crash when processing malformed EFI firmware error records with invalid offsets. The vulnerability stems from insufficient validation of error record length before subtracting an offset, causing integer wraparound that permits dumping of arbitrary kernel memory regions.
Kernel panic occurs in Linux kernel USB gadget driver (dwc3) when vbus_draw function executes PMIC power-supply APIs from atomic context, causing sleep operations in non-sleepable context. The vulnerability affects Linux kernel versions prior to 5.13 and various stable series (6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0) and is resolved by deferring vbus_draw operations to workqueue context. Local authenticated users with privilege level PR:L can trigger denial of service by invoking affected USB gadget functionality, with EPSS exploitation probability at 0.02% percentile indicating extremely low practical risk despite moderate CVSS severity.
Denial of service via kernel panic in the DRM buddy allocator when rounded allocation sizes exceed available memory. Local authenticated attackers can trigger a BUG_ON() crash by requesting contiguous or large-aligned GPU memory allocations that, after power-of-two or block-size rounding, exceed the total VRAM size. Example: a 9GB contiguous allocation request on 10GB VRAM rounds to 16GB, causing immediate kernel panic. No authentication bypass or privilege escalation; requires local access and appropriate user permissions to invoke DRM allocator.
Denial of service via incomplete xattr cleanup in the Linux kernel OCFS2 filesystem causes memory corruption when processing reflinked files with extended attributes. A local user with standard privileges can trigger this vulnerability through crafted xattr operations, resulting in system crashes or data integrity issues. The flaw affects Linux kernel versions from 2.6.32 through multiple recent releases (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 6.19), with vendor-released patches available for supported stable branches.
Resource leak in Linux kernel xfrm (IPsec) subsystem allows local authenticated users to exhaust kernel memory and trigger denial of service by preventing proper cleanup of IPsec hardware offload device references during network device unregistration. The vulnerability affects XFRM state management when IPsec hardware offloading is configured, particularly when the hardware offload capability (NETIF_F_HW_ESP) is disabled after state creation but before device removal.
Resource leak in the Linux kernel's hwmon nct7363 hardware monitor driver allows a local, low-privileged user to cause a denial-of-service condition through repeated reference exhaustion. The vulnerability resides in nct7363_present_pwm_fanin, which calls of_parse_phandle_with_args() but never releases the acquired device node reference via of_node_put(), violating the kernel's reference-counting contract for device tree nodes. Exploitation requires physical or local authenticated access to a system equipped with NCT7363 hardware and the driver loaded; no public exploit exists and no active exploitation is confirmed (EPSS: 0.02%, 4th percentile).
Use-after-free in the Linux kernel's md/bitmap subsystem triggers a General Protection Fault (GPF) in write_page() during MD array resize operations, resulting in a kernel crash and denial of service. Affected are systems using Software RAID (md) with bitmap support across a wide range of stable kernel series from 3.5 through 7.0, with patches backported to 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, and 6.19.6. No public exploit code exists and the EPSS score of 0.02% (7th percentile) indicates very low exploitation probability; however, Red Hat has issued a formal advisory (RHSA-2026:19568), confirming vendor acknowledgment.
Memory leak in the Linux kernel's tegra-video media driver causes local denial-of-service on NVIDIA Tegra-based systems. The `__tegra_channel_try_format()` function fails to free a V4L2 subdev state object on two error paths after `v4l2_subdev_call()` fails, leaking kernel memory on each invocation. A local authenticated attacker with access to a Tegra video capture device can repeatedly trigger the error paths to exhaust kernel memory, degrading or crashing the system. No public exploit exists and EPSS is 0.02% (7th percentile), consistent with a niche, hardware-specific availability issue.
Hard-lock denial of service in the Linux kernel's Intel VT-d IOMMU subsystem affects systems running PCIe passthrough configurations (QEMU, DPDK) without scalable mode enabled. When a PCIe endpoint's link drops - through surprise removal, link fault, or process termination - the kernel enters an indefinite wait inside qi_submit_sync() attempting an ATS invalidation that the disconnected device can never acknowledge. The existing partial fix (commit 4fc82cd907ac) guards this path only when Intel IOMMU scalable mode is active, leaving non-scalable-mode deployments unprotected. No public exploit identified at time of analysis and EPSS is 0.02%, but the impact is a complete host freeze with no recovery path short of power cycling.
NULL pointer dereferences in the Linux kernel's Apple SMC (System Management Controller) MFD driver expose Apple-hardware systems to local denial-of-service. The struct apple_smc mutex was never initialized in apple_smc_probe(), causing occasional crashes when sub-device probe() functions call apple_smc_read() and attempt to acquire the uninitialized lock. Only local, low-privileged users on Apple hardware running an affected kernel can trigger this condition. No public exploit code exists and no active exploitation has been reported; EPSS sits at 0.02% (4th percentile), consistent with a narrow hardware-specific attack surface.
Null pointer dereference in the Linux kernel's rtl8723bs staging Wi-Fi driver allows a locally authenticated user to crash the kernel, resulting in a denial of service. The `pwlan` variable in `find_network()` is not validated for NULL before being passed to `rtw_free_network_nolock()`, which then dereferences it unconditionally. The flaw has been present since Linux 4.12 and is patched across all active stable branches; no public exploit exists and EPSS sits at 0.02%, confirming negligible exploitation activity.
Memory leak in the Linux kernel's octeontx2-af CGX driver causes kernel resource exhaustion on systems using Marvell OcteonTX2 network hardware. The rx_fc_pfvf_bmap and tx_fc_pfvf_bmap bitmaps allocated during cgx_lmac_init() are never freed in cgx_lmac_exit(), meaning each unbind/rebind cycle of the driver leaks 16 bytes of kernel memory, detectable via kmemleak. No public exploit is identified at time of analysis, and with an EPSS of 0.02% (7th percentile), real-world exploitation risk is negligible; this is a correctness and stability issue rather than an active security threat.
Denial-of-service in the Linux kernel's pegasus USB-to-Ethernet driver allows a local attacker to crash the kernel by connecting a crafted USB device with mismatched endpoint transfer types. The driver's probe function fills URBs using hardcoded endpoint pipes (bulk RX on ep1, bulk TX on ep2, interrupt on ep3) without first verifying the endpoint descriptors presented by the attached device, leaving it susceptible to assertion failure when types do not match expectations. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.02% reflects the niche local-access-only attack surface; patches have been released across all major stable kernel branches.
Memory leak in the Linux kernel's MMIO mux driver (mux/mmio subsystem) causes kernel memory exhaustion under local access conditions. The mmio regmap allocated during device probe is never released on probe failure paths or driver unbind, resulting in cumulative memory loss that can degrade availability. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.02% (4th percentile) reflects minimal real-world exploitation interest, consistent with the local-only attack vector and narrow hardware dependency.
Folio reference leaks in the Linux kernel EROFS filesystem driver allow a local low-privileged user to cause gradual memory resource exhaustion by presenting crafted EROFS images with valid but specially structured volume labels. Affected kernel versions span multiple stable branches including the 6.18 and 6.19 series, as confirmed by ENISA EUVD-2026-27717 and upstream kernel commit data. No public exploit has been identified at time of analysis, and the vulnerability description explicitly limits impact to reference leaks without system crashes, which aligns with the low EPSS score of 0.02% (4th percentile).
NULL pointer dereference in the Linux kernel's hid-pl driver (Pantherlord/GreenAsia USB game controllers) allows a local low-privileged user to crash the kernel by triggering force feedback on an improperly initialized device. The root cause is unhandled probe errors during driver initialization that leave NULL pointers in place of valid data structures, which are later dereferenced when force feedback is first invoked. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.02% at the 7th percentile reflects negligible real-world exploitation probability.
Local denial-of-service in the Linux kernel's iris media driver (Qualcomm video codec) results from a regression introduced by commit ad699fa78b59241c9d71a8cafb51525f3dab04d4, now reverted. When a media session enters IRIS_INST_ERROR state and userspace subsequently calls stop_streaming for cleanup, the erroneous check skipped the handler entirely - preventing videobuf2 (vb2) buffer returns and leaving firmware in an inconsistent, non-recoverable state. Affected are systems running the iris V4L2 driver on Qualcomm hardware; no public exploit identified at time of analysis and EPSS is 0.02% (percentile 4%), indicating minimal real-world exploitation activity.
Incorrect DMA buffer cleanup in the Linux kernel's fsl_ucc_hdlc WAN driver (used on Freescale/NXP QorIQ embedded platforms) causes a double-free of coherent DMA memory, resulting in a kernel panic and system crash. The driver allocates rx_buffer and tx_buffer as a single contiguous DMA region in uhdlc_init() but mistakenly calls dma_free_coherent() twice - once per buffer pointer - in uhdlc_memclean(), corrupting the DMA allocator state. Any authenticated local user or kernel path that triggers interface teardown on affected hardware can cause a complete availability loss. No public exploit identified at time of analysis, and EPSS at 0.02% (7th percentile) reflects near-zero opportunistic exploitation probability given the narrow hardware scope.
NULL pointer dereference in the Linux kernel's powerpc/smp subsystem allows a local authenticated user to crash the kernel, causing a denial of service on PowerPC-based systems. The `parse_thread_groups()` function passes the return value of `kcalloc()` directly to `of_property_read_u32_array()` without validating it for NULL, meaning a failed memory allocation - possible under memory pressure - leads to a kernel panic or oops. No public exploit code exists and this vulnerability is not in CISA KEV; with an EPSS of 0.02% (7th percentile) and architecture-specific scope limited to PowerPC, real-world exploitation risk is low but relevant to IBM POWER server deployments running Red Hat or SUSE Linux.
NULL pointer dereference in the Linux kernel's amdgpu RAS (Reliability, Availability, and Serviceability) driver crashes the kernel when a local user reads the sysfs badpages interface on a system whose AMD GPU EEPROM contains only invalid address entries. The driver skips RAS data allocation under this condition, and the subsequent read of `amdgpu_ras_sysfs_badpages_read` dereferences the uninitialized pointer, producing a kernel panic and complete denial of service. No public exploit exists and no active exploitation has been identified; EPSS is 0.02% (4th percentile), reflecting very low real-world risk.
Integer wraparound in the Linux kernel JFS (Journaled File System) `jfs_rename` function can be triggered by a local low-privileged user to cause a kernel warning and denial of service. When a directory's hard link count (nlink) is already at its maximum value (-1 as an unsigned overflow scenario), performing an in-place rename of a child subdirectory increments nlink and then decrements it, wrapping the counter to zero and triggering a `drop_nlink` kernel warning. The vulnerability affects a wide range of stable kernel branches from 5.10 through 6.19; no public exploit code exists and CISA has not listed this in KEV, making active exploitation unlikely but not impossible in multi-tenant or container environments where JFS-mounted filesystems are accessible to low-privilege users.
Null pointer dereference in the Linux kernel's bcm_vk misc driver allows a local authenticated attacker to crash the kernel, resulting in a denial of service. The bcm_vk_read() function checks whether the 'entry' pointer is NULL but fails to prevent subsequent dereferences of that pointer when rc is set to -EMSGSIZE, leading to a kernel panic. No public exploit exists and the vulnerability is not listed in CISA KEV; however, vendor-released patches are available across multiple stable kernel branches, and Red Hat and SUSE have tagged this for attention in their ecosystems.
Memory exhaustion denial-of-service in the Linux kernel's ti_fpc202 misc driver allows a local low-privileged user to degrade system availability through a memory leak introduced in the probe function. The root cause is improper release of device tree child node references during driver initialization when iterating over nodes, classified as CWE-401 (Missing Release of Memory after Effective Lifetime). No active exploitation is confirmed - no public exploit identified at time of analysis - and the extremely low EPSS score of 0.02% (4th percentile) reflects the niche hardware dependency and local-only attack surface.
Silent error suppression in the Linux kernel's NTFS3 filesystem driver allows a local authenticated user to trigger inode inconsistency by causing attr_set_size() to fail during file truncation. Affected systems running NTFS3-mounted volumes may experience filesystem corruption or denial of service without any visible error signal to the kernel. No active exploitation has been identified (EPSS 0.02%, not in CISA KEV), and vendor-released patches are available in Linux 7.0 and 6.19.6.
Resource leak in the Linux kernel's mtk-smi (MediaTek System Memory Interface) driver allows a local, low-privileged attacker on MediaTek SoC-based systems to cause a denial of service by exhausting kernel device references. The driver fails to call put_device() on the SMI device reference obtained during common probe when late probe failure (e.g., -EPROBE_DEFER) or driver unbind occurs, leaving dangling references that accumulate over repeated cycles. No public exploit identified at time of analysis and EPSS at 0.02% (7th percentile) indicates very low exploitation probability; patches are available across multiple stable branches.
Device reference leak in the Linux kernel's MediaTek SMI (mtk-smi) memory driver can cause resource exhaustion and denial of service on affected MediaTek SoC-based systems. The flaw exists in the larb (Local Arbiter) probe path, where a reference acquired during SMI device lookup is never released when late probe failure occurs (e.g., probe deferral) or when the driver is unbound - leaving the kernel device struct's reference count permanently inflated. With EPSS at 0.02% (7th percentile), no KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is very low and narrowly scoped to hardware running MediaTek SoCs.
Memory allocation underflow in the Linux kernel ASoC SOF (Sound Open Firmware) ipc4-topology module allows local authenticated users to trigger a denial of service via bytes control handling that fails to account for the full data structure size. The vulnerability affects kernel versions prior to specific stable releases (6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0) where the allocation size calculation omits the sof_ipc4_control_data structure, potentially causing memory exhaustion or kernel crash when processing audio topology configuration.
Null pointer dereference in the Linux kernel QRTR (Qualcomm IPC Router) driver via MHI auto_queue feature causes denial of service on Qualcomm X1E80100 CRD machines during boot. The vulnerability occurs when the MHI stack invokes the DL (downlink) callback before the QRTR client driver is fully probed, accessing uninitialized driver structures. A local privileged attacker can trigger kernel panic by exploiting the race condition between MHI buffer auto-queuing and driver initialization, affecting systems relying on QRTR over MHI transport.
NULL pointer dereference in the Linux kernel's RDMA/ionic driver allows a local low-privileged user to crash the kernel by triggering the `ionic_query_port()` function when the associated network device is unavailable. The root cause is an unchecked return value from `ib_device_get_netdev()`, which can return NULL during device absence or hot-unplug transitions - leading to a kernel panic and complete denial of service. No public exploit has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) confirms this is not being actively targeted.
Out-of-bounds read in the Linux kernel's APEI/GHES subsystem crashes affected systems when processing malformed or oversized CPER (Common Platform Error Record) data supplied by non-conformant firmware. The `ghes_new()` function enforces a maximum size check against `GHES_ESTATUS_MAX_SIZE` (64KB), but the underlying buffer is allocated using the actual page count from the BIOS CPER table location, which may be smaller; when firmware supplies error data exceeding the allocated buffer, subsequent CPER printing via `cper_estatus_print_section()` triggers a kernel OOPS (level-3 page fault) and system crash. No active exploitation is confirmed: EPSS is 0.02% at the 7th percentile, and this vulnerability is absent from the CISA KEV catalog.
Race condition in the Linux kernel UFS core driver causes a system crash during suspend when the runtime power management level is set to UFS_PM_LVL_0. At this PM level the device power mode and link state remain active, yet the driver previously skipped flushing pending exception event handling work before proceeding with suspend - allowing a workqueue job to access UFS host controller registers after the hardware has entered a deep power-down state. The resulting kernel panic yields a total denial of service. No public exploit has been identified and EPSS sits at 0.02% (7th percentile), indicating low near-term exploitation likelihood.
Snapshot data integrity corruption in the Linux kernel's CephFS driver allows a local authenticated user to silently corrupt immutable snapshot content by performing a fallocate hole-punch operation on a mounted CephFS volume. The `ceph_zero_partial_object()` function omits the RADOS snapshot context (`snapc`) when issuing OSD zeroing writes, causing those writes to propagate into snapshot objects rather than being scoped to the live file layer only. Affected environments are limited to those running CephFS mounts with active snapshots; no active exploitation is confirmed (absent from CISA KEV), and EPSS sits at 0.02%, though a developer-supplied reproducer effectively functions as proof-of-concept.
Uninitialized pointer dereference in the Linux kernel ring-buffer subsystem crashes the kernel, enabling a local low-privileged user to cause a denial of service. The function `rb_meta_validate_events()` fails to initialize `head_page` before error-handling code at the `invalid` label dereferences it during reader page validation failure. No public exploit exists and EPSS places this at the 4th percentile, but vendor-released patches are available in stable branches 6.18.16, 6.19.6, and 7.0.
NULL pointer dereference in the Linux kernel md-cluster subsystem allows a local low-privileged user to crash the system during a narrow race window in MD array startup. The process_metadata_update() function blindly dereferences mddev->thread before it is initialized, which becomes reachable if a remote cluster peer sends a METADATA_UPDATED message after bitmap_load() starts the recv_daemon but before mddev->thread is assigned in md_run(). No public exploit has been identified at time of analysis, and EPSS probability is 0.02% (5th percentile), consistent with a niche, timing-dependent local DoS.
Reference count leak in the Linux kernel's mtk-mdp (MediaTek Media Data Path) driver allows a local low-privileged user on MediaTek SoC hardware to cause incremental resource exhaustion. The missing platform_device_put() call in mtk_mdp_remove() means each driver removal cycle permanently leaks one reference to the VPU platform device, preventing kernel memory reclamation. No public exploit exists and EPSS sits at 0.02% (7th percentile); patches are confirmed across eight stable kernel branches.
Memory exhaustion in the Linux kernel's drm/atmel-hlcdc DRM driver gradually degrades availability on systems using Atmel/Microchip HLCDC display controller hardware. The atomic_destroy_state callback incorrectly releases only framebuffer references while omitting the call to __drm_atomic_helper_plane_destroy_state(), causing drm_crtc_commit objects (64 bytes each) to accumulate in kernel slab memory across every DRM atomic commit operation. Impact is limited to local denial of service through eventual OOM on embedded platforms using SAMA5 SoCs; no public exploit identified at time of analysis and EPSS is 0.02% (7th percentile), reflecting negligible exploitation interest.
Kernel crash in the Linux hfsplus filesystem driver results from a VFS enforcement change (commit af153bb63a33) that requires all inodes to carry a standard file-type mode bit, which hfsplus special inodes (catalog file, extents overflow file, attributes file, etc.) historically did not. Any local user able to trigger access to those special inodes on a mounted HFS+ volume can cause a kernel panic, producing a high-availability denial-of-service. No public exploit code exists and EPSS sits at 0.02% (7th percentile), reflecting low opportunistic exploitation likelihood, but the bug is deterministically reproducible against any unpatched kernel configured with hfsplus support.
Division by zero in the Linux kernel's rtw89 WiFi driver can crash the kernel when beacon interval is zero during beacon tracking. Discovered via fuzz testing, this local vulnerability (AV:L/PR:L) affects systems running any Linux kernel from initial commit through stable branches prior to 6.18.16, 6.19.6, and 7.0. An authenticated local attacker can trigger a kernel panic, resulting in a complete denial of service on the affected host. No public exploit exists and no active exploitation has been observed.
Out-of-bounds read in the Linux kernel's EFI/CPER ARM processor error record handler allows firmware-supplied records with a crafted or malformed `section_length` value to cause the kernel to read far beyond the allocated CPER buffer, potentially leaking contents of firmware-mapped memory regions to system logs. Affected systems are ARM-based machines with UEFI/APEI/GHES support running any Linux kernel prior to the patched stable releases (5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0). No public exploit has been identified, EPSS is 0.02% (7th percentile), and the vulnerability is absent from CISA KEV.
Denial of service in Linux kernel KVM x86 nested virtualization allows local privileged attackers to crash virtual machines by manipulating vCPU state through userspace MP_STATE and injected event stuffing. When a vCPU is awakened from a blocking state in L2 (nested guest mode) with an already-injected event, the kernel generates spurious KVM_EXIT_UNKNOWN exits that typically terminate the VM. The vulnerability stems from insufficient validation of impossible vCPU states that userspace can artificially create, despite architectural safeguards that should prevent injected events during blocking. CVSS 5.5 (local, low complexity, high availability impact); EPSS 0.02% indicates minimal widespread exploitation likelihood.
Refcount leak in the Linux kernel's fbdev Open Firmware display timing subsystem (of_get_display_timings()) affects kernel versions from 3.9 through multiple stable branches, allowing a local low-privileged user to trigger resource exhaustion that degrades system availability. The flaw lies in error-path handling where of_parse_phandle() increments a device_node refcount into native_mode, but the goto target 'entryfail' at lines 184 and 192 never calls of_node_put(native_mode), leaving the refcount permanently elevated. No active exploitation has been identified - EPSS of 0.02% (7th percentile) and absence from CISA KEV confirm this as a maintenance-class kernel fix rather than an emergency threat.
Recursive glock deadlock in the Linux kernel GFS2 cluster filesystem driver allows a locally authenticated user to cause a kernel thread hang and denial of service. In gfs2_fiemap(), the inode glock is held while calling iomap_fiemap(); if the userspace fiemap output buffer is memory-mapped to the same GFS2 inode, a page fault during buffer writes triggers a second attempt to acquire the already-held glock, producing a deadlock. No public exploit or CISA KEV listing exists; EPSS is 0.02% (7th percentile), consistent with the niche GFS2 deployment footprint and the specific trigger conditions required.
Spectre-BHB (Branch History Buffer) software mitigation was absent in the Linux kernel arm64 subsystem for systems running the HiSilicon TSV110 processor, leaving those systems exposed to branch prediction side-channel attacks capable of leaking sensitive kernel memory contents across privilege boundaries. The root cause was the kernel lacking the TSV110 MIDR (Main ID Register) entry in its processor-specific mitigation table, meaning the software workaround was never applied on that hardware. No public exploit has been identified at time of analysis, and EPSS probability sits at a low 0.02% (7th percentile), though the real-world confidentiality risk on Huawei/HiSilicon arm64 deployments is meaningful given the class of attack.
NULL pointer dereference in the Linux kernel's fsl-imx8mq-usb PHY driver crashes systems built on NXP i.MX8MQ SoC when the driver is unloaded or the device is removed. The driver's probe function omits the required platform_set_drvdata() call, leaving the driver data pointer unset; when remove() subsequently dereferences it, a kernel panic results. Exploitation is limited to local, low-privilege users on specialized embedded hardware; EPSS at 0.02% (4th percentile) and absence from CISA KEV confirm no public exploit or in-the-wild exploitation at time of analysis.
Denial of service in Linux kernel media cx88 driver allows local authenticated attackers to exhaust system resources by triggering a missing DMA unmapping in the snd_cx88_hw_params() error path. The vulnerability causes resource leaks when audio hardware parameter initialization fails, potentially rendering the audio subsystem unavailable. CVSS 5.5 reflects local attack vector with low complexity; EPSS 0.02% indicates minimal real-world exploitation probability despite vendor-released patches across multiple kernel versions.
A use-after-free condition in the libertas USB wireless driver allows local attackers with user privileges to cause a denial of service by triggering a kernel warning and potential crash through rapid firmware loading or repeated usb_tx_block() calls while a USB request is still active. The vulnerability stems from insufficient synchronization of USB URB submissions, enabling concurrent requests on the same URB without enforcing completion of prior transmissions.
Denial of service via kernel warning in MPTCP path manager occurs when combining endpoint removal with fullmesh and flag-setting operations through netlink in the Linux kernel. A local attacker with low privileges can trigger a WARNING in net/mptcp/pm_kernel.c:1074 by sending a crafted sequence of netlink commands, causing the system to emit a kernel warning and potentially become unstable. No known public exploit code exists, but the low CVSS (5.5) and minimal EPSS (0.03%) indicate this is a local DoS with limited real-world impact.
NULL pointer dereference in the Linux kernel HID prodikeys driver allows a local attacker with USB access to crash the kernel by presenting a crafted USB device that impersonates a Creative Prodikeys PC-MIDI controller. When the fake device's HID report descriptors bypass the input_mapping() callback, pm->input_ep82 remains NULL; subsequent dereference of that pointer causes a kernel panic, resulting in a complete availability loss. No public exploit or active exploitation has been identified; EPSS is 0.02% (7th percentile), consistent with the local-only, denial-of-service-only impact profile.
Kernel panic via SError interrupt in Linux kernel media driver (chips-media wave5) when device enters autosuspend during video decoding operations. Local authenticated attackers can trigger a denial of service by queuing buffers to the wave5 video decoder while autosuspend timeout occurs, causing the CPU to access suspended hardware and generate an unrecoverable asynchronous SError, crashing the system. No privilege escalation or code execution; impact limited to availability.
Memory leak in the tw9906 media driver's probe function allows local authenticated attackers to cause denial of service through memory exhaustion. The vulnerability occurs in tw9906_probe() when an error path fails to free memory allocated by v4l2_ctrl_handler_init() and v4l2_ctrl_new_std(), potentially leading to kernel memory depletion on repeated device probe attempts. Vendor-released patches are available across multiple stable kernel branches.
Denial of service in Linux kernel KCM (kernel connection multiplexer) subsystem when processing messages with zero-fragment skbs in frag_list after partial sendmsg failures. A local authenticated attacker can trigger a kernel warning and potentially crash the system by sending a malformed message that fails during data copy, leaving an empty skb in the fragment list. The vulnerability requires local access and low-level socket manipulation, affecting systems running vulnerable Linux kernel versions prior to patching.
A denial of service vulnerability in the Linux kernel's AMD display driver (drm/amd/display) allows local authenticated users to crash the system by accessing link encoder functionality on DisplayPort over USB-C (DPIA) links without proper signal type validation. The vulnerability affects kernel versions before the patches released in stable branches 6.12.75, 6.18.16, 6.19.6, and 7.0. No public exploit code has been identified, and real-world exploitation probability is very low (EPSS 0.02%), suggesting this is primarily an edge-case denial of service affecting specific hardware configurations with DPIA displays.
Memory leak in the Linux kernel's TI K3 SoC info driver (soc/ti/k3-socinfo) fails to release an allocated mmio regmap, causing denial of service through resource exhaustion on probe failures and driver unbind. Local attackers with low privileges can trigger probe deferral or driver unbind to exhaust kernel memory, affecting systems running vulnerable Linux kernel versions. The vulnerability has a low EPSS score (0.02%) but enables practical local DoS against systems where low-privilege users can control driver lifecycle.
Linux kernel x86 architecture fails to validate IMA measurement list memory bounds during kexec boot with restricted memory parameters, causing kernel panic when the carried-over IMA buffer falls outside truncated RAM. Authenticated local users with kexec privileges can trigger a denial of service. The fix adds a sanity check to validate the previous kernel's IMA kexec buffer against actual memory bounds before restoration, aligning x86 behavior with other architectures.
Divide-by-zero in the Linux kernel's traffic control subsystem (`net/sched/act_skbedit.c`) crashes the kernel when a tc SKBEDIT action is configured with a queue mapping range spanning the full u16 address space. Affected kernels range from 5.19 (where commit 38a6f0865796 introduced SKBEDIT_F_TXQ_SKBHASH support) through all unpatched stable branches up to 7.0; vendor-released patches are available across six stable branches. No public exploit code exists and EPSS sits at 0.02% (7th percentile), making this a low-urgency patch cycle item for most environments, with highest relevance where low-privileged users can invoke tc configuration.
Availability failure in the Linux kernel's iris media driver for Qualcomm SM8750 (Snapdragon 8 Elite) causes video codec sessions to crash during bring-up due to two missing platform data entries. The absent get_vpu_buffer_size field prevents internal VPU buffer allocation, while the missing max_core_mbps entry causes incomplete capability checks and v4l2-compliance failures for the encoder. No public exploit exists and EPSS is 0.02% (4th percentile), consistent with the niche hardware dependency; this is a functional defect with availability impact rather than a traditional exploitable security weakness.
Denial of service in the Linux kernel team network driver arises when a slave interface is moved to a different network namespace and then deleted, causing team_port_del() to fire a spurious NETDEV_CHANGEMTU event during slave unregistration that prompts inetdev_init() to acquire an unreleased reference on the device. This reference leak prevents the device from completing unregistration, hanging the kernel with 'unregister_netdevice: waiting for [device] to become free.' The bug is confined to local authenticated access and no public exploit exists (EPSS 0.02%, 4th percentile); however, the Linux kernel's ubiquitous deployment makes patch application broadly relevant. Upstream stable fixes are confirmed available in Linux 6.18.16, 6.19.6, and 7.0.
Memory leak in the Linux kernel's radio-keene USB FM transmitter driver (radio-keene.c) leaves a v4l2 control handler unfreed when either v4l2_device_register() or video_register_device() fails during device probe. Affected kernel versions range from the commit introducing the flaw (1bf20c3a0c616f44359c573b533d06bae960ee45) through multiple stable branches, with fixed versions confirmed across 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0. No public exploit has been identified at time of analysis, and EPSS at 0.02% (7th percentile) confirms negligible real-world exploitation probability.
Kernel panic in the Linux kernel's chips-media wave5 VPU driver stems from an incorrect device cleanup order during module removal or autosuspend, allowing a powered-down hardware state to be accessed by a still-running worker thread. Systems with chips-media wave5 VPU hardware running video encoding workloads are vulnerable to a local denial-of-service via synchronous external abort (bus error). No public exploit exists and no active exploitation is confirmed; EPSS is 0.02% (5th percentile), reflecting the niche hardware requirement.
Kernel panic via reachable assertion in the HFS filesystem driver allows a local low-privileged user to crash the system by mounting a crafted, corrupted HFS disk image. The BUG_ON assertions guarding CNID count overflow in the superblock were triggered by syzbot when processing a malformed MDB (Master Directory Block), causing a denial-of-service through kernel panic. No active exploitation has been confirmed (not in CISA KEV), and EPSS probability sits at 0.02% (5th percentile), indicating negligible real-world exploitation activity at time of analysis.
Denial-of-service through an invalid spinlock context in the Linux kernel's sh_tmu (SH Timer Unit) clocksource/clockevent driver triggers a lockdep violation and system hang on PREEMPT_RT-enabled builds running on Renesas SH/ARM platforms. The driver invokes pm_runtime_*() and clk_*() functions while holding a raw spinlock required by the clockevent framework; on PREEMPT_RT kernels, these PM and clock management calls acquire regular spinlocks that can sleep, making the combined locking sequence illegal. No public exploit code exists and exploitation probability is negligible (EPSS 0.02%), but the impact on affected hardware is a full system availability loss. Patches are confirmed available across all active stable branches.
Memory leak in the Linux kernel's staging rtl8723bs Wi-Fi driver degrades system availability for hosts running affected kernel versions with Realtek RTL8723BS hardware. The flaw occurs in the BSS scanning code path where cfg80211_inform_bss_frame() can return NULL on failure, but the previously allocated 'buf' buffer is not released, causing unbounded kernel memory loss over time. With EPSS at 0.02% (7th percentile), no CISA KEV listing, and no public exploit code, this is a low-urgency memory management defect patched across all active stable kernel branches.
Memory leak in the Linux kernel io_uring zero-copy receive (zcrx) subsystem allows a local low-privileged attacker to exhaust kernel memory via repeated DMA mapping failures on PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA systems, causing denial of service. The root cause is a sgtable (scatter-gather table) resource that is initialized but never freed when io_populate_area_dma() fails, because the error path's cleanup guard (!is_mapped) incorrectly skips deallocation. No public exploit exists and EPSS is 0.02% (4th percentile), reflecting the narrow hardware-specific trigger condition.
URB (USB Request Block) leak in the Linux kernel pvrusb2 media driver causes a denial-of-service condition on systems with Hauppauge WinTV-PVR USB2 capture devices. The pvr2_send_request_ex() function fails to unlink and await the write URB before returning on read URB submission failure, leaving the URB in an active state; subsequent driver calls trigger a 'URB submitted while active' kernel warning that destabilizes the USB subsystem. No public exploit exists and EPSS is 0.02% (7th percentile), but vendor-released patches are available across all major stable kernel branches.
Uninitialized read bytes in the Linux kernel IPMI IPMB driver expose systems to a local denial-of-service condition. The IPMB subsystem does not use i2c reads by design, but when an i2c read is triggered through the event handler, an uninitialized value is returned from the underlying bus driver, potentially causing kernel instability or a crash on affected server hardware. No public exploit exists and EPSS is 0.02% (7th percentile), indicating low real-world exploitation probability despite patches being available across multiple stable branches.
Denial of service in the Linux kernel AMD IOMMU subsystem allows a local low-privileged user to crash or stall IOMMU completion waits on systems with AMD hardware and IOMMU enabled. The root cause is a race condition where cmd_sem_val was incremented outside the IOMMU spinlock, permitting CMD_COMPL_WAIT commands to queue out of order and breaking the ordering invariant in wait_on_sem() under concurrent TLB invalidations. No public exploit or active exploitation has been identified; EPSS stands at 0.02% (4th percentile), reflecting negligible real-world exploitation probability at time of analysis.
Improper error-path cleanup in the Linux kernel's cpsw_new (TI Common Platform Switch) network driver can trigger an attempt to unregister a net device that was never successfully registered, causing a kernel crash or panic and resulting in local denial of service. Systems running affected kernel versions on Texas Instruments SoC hardware - including BeagleBone and AM335x/AM437x platforms - are at risk when the CPSW driver encounters a failure during the first MAC's netdev registration. No public exploit identified at time of analysis and EPSS exploitation probability is extremely low at 0.02% (4th percentile), consistent with its hardware-specific, error-path nature.
Memory leak in Linux kernel tw9903 media driver probe function allows local authenticated attackers to cause denial of service through repeated device initialization failures. The v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() allocations are not freed in one error path of tw9903_probe(), enabling exhaustion of kernel memory. CVSS 5.5 (local, low complexity, requires low privileges). EPSS score of 0.02% indicates minimal exploitation probability.
Kernel panic in the Linux iris gen2 media driver can be triggered by a local low-privileged user when a sequencing flaw between iris_kill_session and stop_streaming causes a NULL dereference of a freed packet buffer. The iris driver - used for Qualcomm video codec hardware - frees inst_hfi_gen2->packet during session teardown via kfree, but stop_streaming lacks a guard against subsequently dereferencing that pointer when sending a STOP command to firmware, resulting in a system crash. No public exploit code exists, EPSS is 0.02% (4th percentile), and vendor-released patches are confirmed across multiple stable kernel branches.
Denial of service in the Linux kernel's net subsystem via deadlock in skb_may_tx_timestamp() when socket timestamp completion occurs in interrupt context while sk_callback_lock is write-locked, affecting local attackers with user privileges on systems with network drivers that complete TX timestamps from dedicated interrupt handlers.
Local denial of service in Linux kernel ring-buffer tracing code allows authenticated local users to crash the system by triggering invalid memory access through malformed event length fields. The vulnerability exists in rb_read_data_buffer(), which validates possibly corrupted ring buffers at boot but fails to verify event lengths are within acceptable ranges before calculating buffer offsets. EPSS exploitation probability is very low at 0.02%, and no public exploit code or active exploitation has been identified.
Denial of service in Linux kernel minix filesystem implementation allows local authenticated users to crash the system via crafted minix superblock structures due to missing validation of s_log_zone_size and other superblock fields in the minix_check_superblock() function.
Kernel lockup in the Qualcomm Q6ASM (Audio Stream Manager) driver allows a local low-privileged user to trigger a system hang by racing audio stream closure against in-flight DSP responses. Affected Linux kernel versions spanning from the initial commit (1da177e4c3f4) up to the stable fixes in 6.19.6 and 7.0 are vulnerable. A prior partial fix (commit a354f030dbce) attempted to suppress post-close DSP response handling but failed to prevent processing, leaving the lockup reachable. No public exploit code exists and no active exploitation has been confirmed - EPSS sits at 0.02% (5th percentile), consistent with a niche hardware-dependent kernel DoS.
Memory leak in Linux kernel fbdev vt8500lcdfb driver allows local authenticated users to cause denial of service via unfreed DMA-allocated buffer on error path. The vulnerability exists in the framebuffer initialization code where dma_alloc_coherent() allocation for fbi->fb.screen_buffer is not properly freed if an error occurs during probe, leading to memory exhaustion on repeated device initialization attempts. Local privilege required; no remote or unauthenticated attack vector.
Denial of service in Linux kernel APEI/GHES ARM processor error handling allows local authenticated attackers to trigger kernel oops by crafting malformed ARM Processor Error records with incomplete or oversized section data, causing out-of-bounds memory dereference. CVSS 5.5 (local, low complexity, authenticated, availability impact only) with EPSS 0.02% indicates low real-world exploitation probability despite public patch availability.
Denial of service in Linux kernel PCI endpoint configfs interface allows local attackers with low privileges to crash the kernel via swapped parameters in pci_primary_epc_epf_unlink() and pci_secondary_epc_epf_unlink() functions. When executing the unlink command in configfs, incorrect parameter ordering causes invalid memory access and kernel panic. CVSS 5.5 (local, low complexity, low privilege) with EPSS 0.02% suggests limited real-world exploitation despite confirmed availability of patches across multiple kernel branches.
Missing input validation in the Linux kernel's amdgpu DRM driver allows a local user with low privileges to trigger GPU faults by supplying invalid user queue sizes. The driver fails to enforce two hardware requirements - that queue sizes be a power-of-two and at least AMDGPU_GPU_PAGE_SIZE - enabling crafted queue configurations that cause availability loss (GPU faults or unexpected GPU subsystem behavior). No public exploit is identified at time of analysis, and EPSS at 0.02% (4th percentile) reflects very low real-world exploitation probability. Patches are available in kernel stable branches 6.18.16, 6.19.6, and 7.0.
Reference count leak in the Linux kernel's NFS server daemon (nfsd) subsystem allows a local low-privileged user on a system running NFSv4 to exhaust kernel file object resources, resulting in denial of service. The vulnerability lies in nfsd_get_dir_deleg(), which fails to release the nfs4_file reference before early return paths. No public exploit exists and the EPSS score of 0.02% (5th percentile) reflects very low real-world exploitation probability; there is no CISA KEV listing.
Resource reference leak in the Linux kernel's dm-multipath (dm mpath) subsystem allows a local low-privileged user to trigger an availability impact against systems using multipath SCSI storage. Specifically, the `parse_path()` function fails to call `dm_put_device()` when `scsi_dh_attached_handler_name()` returns -ENOMEM during path parsing, leaving a dangling device reference that is never released. No public exploit exists and EPSS probability is 0.02%, placing this firmly in the low-exploitation-likelihood tier, but enterprise Linux systems with SAN-backed multipath storage are in scope. Vendor-released patches are available in Linux 6.19.6 and the 7.0 stable branch.
System hang vulnerability in the AMD DCN35 display engine driver allows a local low-privilege user to trigger an unrecoverable kernel hang by initiating a TMDS display disable event on affected AMD hardware. The hang arises because the PHY FSM transition from TX_EN to PLL_ON is non-atomic, leaving the Output Timing Generator stuck and blocking DCHVM IOMMU invalidation acknowledgments - a condition that can arise under normal display reconfiguration. No public exploit code exists and EPSS is 0.02% (5th percentile), indicating no meaningful exploitation interest; the CISA KEV does not list this vulnerability.
Error handling flaws in the Linux kernel's V4L2 async media subsystem allow a local low-privileged attacker to crash the kernel, causing a denial of service. Two bugs exist in the post-match processing path: an async connection is double-removed from the sub-device's connection list when v4l2_async_match_notify() fails mid-way, and the connection's sd pointer is dereferenced in the unbind error path before it is initialized - a NULL pointer dereference. No public exploit or active exploitation has been identified; EPSS at 0.02% (5th percentile) confirms very low current exploitation probability and this vulnerability is not listed in CISA KEV.
Kernel worker crash (BUG_ON oops) in the Linux kernel Ceph filesystem driver occurs when fscrypt encryption is enabled and GFP_NOWAIT bounce buffer allocations fail during writeback batch processing. A local user with write access to an fscrypt-encrypted Ceph mount can trigger this under memory pressure, causing the writeback loop to pass a stale page array pointer to ceph_allocate_page_array(), firing its BUG_ON assertion and crashing the worker. No public exploit is identified; EPSS of 0.02% (4th percentile) and absence from CISA KEV confirm negligible real-world exploitation activity.
Resource leak in the Linux kernel cx25821 media driver allows a local low-privileged user on a system with CX25821 video capture hardware to degrade system availability by exhausting kernel I/O memory regions. The flaw exists in cx25821_dev_setup() where a call to release_mem_region() is missing on the ioremap() failure path, leaving a memory region claimed by cx25821_get_resources() permanently unreleased. No public exploit code exists and EPSS sits at 0.02% (7th percentile), confirming this as a low-exploitation-risk maintenance fix rather than an active threat; patches are available across all active stable kernel branches.
Division by zero in the Linux kernel's CCS (Camera Control Set) media driver can be triggered by a local authenticated user, causing a kernel crash and denial of service. The flaw exists in scaler configuration logic where the MAX_M calculation divides by the MIN_X_OUTPUT_SIZE limit register value without first validating it is non-zero. Affected systems must have a CCS-compatible camera device attached and the ccs media driver loaded; no public exploit or active exploitation (CISA KEV) has been identified, and EPSS sits at 0.02%, reflecting very low real-world exploitation probability.
GPIO sysfs teardown in the Linux kernel fails to drop the final sysfs attribute reference when a GPIO controller is unbound while pins remain exported, leaving stale /sys/class/gpio entries and causing a kernel availability impact on affected systems. Kernels from commit 1cd53df733c21ae0d344a2dec941a3e2a06fefd9 through the fix are affected, with patched stable releases at 6.18.16, 6.19.6, and 7.0; Red Hat and SUSE downstream kernels incorporating the affected range are similarly impacted. No public exploit exists and the EPSS score is 0.02% (4th percentile), making this primarily a stability concern for embedded Linux deployments actively using the GPIO sysfs interface.
EROFS filesystem folio reference leaks in the Linux kernel allow a local low-privileged attacker to cause availability degradation by mounting crafted EROFS images with metabox (metadata compression) enabled, triggering incorrect early returns in the kernel's EROFS parser. Affected kernels prior to stable releases 6.18.16, 6.19.6, and 7.0 are vulnerable; the vendor explicitly notes no system crashes result, limiting impact to gradual resource exhaustion. No public exploit code exists and EPSS sits at 0.02% (4th percentile), indicating negligible observed exploitation interest at time of analysis.
Runtime PM reference leak in the Linux kernel's Intel IPU6 PCI driver causes a local denial-of-service condition on systems with compatible Intel Image Processing Unit hardware. Low-privileged local users on affected kernel versions can trigger unbalanced runtime power management reference counts when the ipu6_pci_probe() function traverses error paths without calling pm_runtime_put_sync(), leaving the device in a corrupted power management state. No public exploit exists and the EPSS score of 0.02% (5th percentile) reflects negligible real-world exploitation interest; no active exploitation has been confirmed.
Out-of-bounds write in the Linux kernel's clk/rs9 clock driver corrupts kernel memory on systems equipped with the Renesas 9FGV0841 clock chip, reliably crashing the kernel during driver unbind or suspend. The rs9_driver_data structure allocated only 4 slots for clk_hw pointers but the 9FGV0841 exposes 8 outputs, so registering outputs 4-7 silently overwrites adjacent kernel memory. No public exploit exists and no active exploitation is confirmed (not in CISA KEV); EPSS is 0.02% (5th percentile), reflecting the hardware-specific and local-only attack surface.
Improper error handling in the Linux kernel's io_uring zero-copy receive (zcrx) subsystem causes a premature release of the zcrx context when closing a queue, leading to a local denial-of-service (kernel crash). Affected kernels include Linux 6.15 series; the root cause is that queue closure does not guarantee immediate termination of all associated page pools, and the code incorrectly released the zcrx ctx directly rather than delegating cleanup to the reference-counting mechanism. No public exploit exists and no active exploitation has been identified at time of analysis; EPSS is 0.02% (5th percentile), consistent with the low real-world exploitation risk.
NULL pointer dereference in the Linux kernel's ixp4xx Ethernet driver (net/ethernet/xscale) crashes the kernel on Intel IXP4xx-based embedded systems when PTP timestamp queries are made against non-ixp46x hardware. A local authenticated user on affected hardware can trigger a kernel panic simply by running standard tools such as tcpdump or ethtool, causing a full system crash. No active exploitation is confirmed (EPSS 0.02%, no CISA KEV listing), and real-world impact is constrained to legacy IXP4xx-based embedded devices such as OpenWrt-capable routers.
Integer underflow in the Linux kernel's EFI/CPER firmware error logging function (cper_print_fw_err) allows local authenticated attackers to trigger denial of service via memory dump of unmapped regions, disclose kernel memory contents, or cause system crash when processing malformed EFI firmware error records with invalid offsets. The vulnerability stems from insufficient validation of error record length before subtracting an offset, causing integer wraparound that permits dumping of arbitrary kernel memory regions.
Kernel panic occurs in Linux kernel USB gadget driver (dwc3) when vbus_draw function executes PMIC power-supply APIs from atomic context, causing sleep operations in non-sleepable context. The vulnerability affects Linux kernel versions prior to 5.13 and various stable series (6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0) and is resolved by deferring vbus_draw operations to workqueue context. Local authenticated users with privilege level PR:L can trigger denial of service by invoking affected USB gadget functionality, with EPSS exploitation probability at 0.02% percentile indicating extremely low practical risk despite moderate CVSS severity.
Denial of service via kernel panic in the DRM buddy allocator when rounded allocation sizes exceed available memory. Local authenticated attackers can trigger a BUG_ON() crash by requesting contiguous or large-aligned GPU memory allocations that, after power-of-two or block-size rounding, exceed the total VRAM size. Example: a 9GB contiguous allocation request on 10GB VRAM rounds to 16GB, causing immediate kernel panic. No authentication bypass or privilege escalation; requires local access and appropriate user permissions to invoke DRM allocator.
Denial of service via incomplete xattr cleanup in the Linux kernel OCFS2 filesystem causes memory corruption when processing reflinked files with extended attributes. A local user with standard privileges can trigger this vulnerability through crafted xattr operations, resulting in system crashes or data integrity issues. The flaw affects Linux kernel versions from 2.6.32 through multiple recent releases (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 6.19), with vendor-released patches available for supported stable branches.
Resource leak in Linux kernel xfrm (IPsec) subsystem allows local authenticated users to exhaust kernel memory and trigger denial of service by preventing proper cleanup of IPsec hardware offload device references during network device unregistration. The vulnerability affects XFRM state management when IPsec hardware offloading is configured, particularly when the hardware offload capability (NETIF_F_HW_ESP) is disabled after state creation but before device removal.
Resource leak in the Linux kernel's hwmon nct7363 hardware monitor driver allows a local, low-privileged user to cause a denial-of-service condition through repeated reference exhaustion. The vulnerability resides in nct7363_present_pwm_fanin, which calls of_parse_phandle_with_args() but never releases the acquired device node reference via of_node_put(), violating the kernel's reference-counting contract for device tree nodes. Exploitation requires physical or local authenticated access to a system equipped with NCT7363 hardware and the driver loaded; no public exploit exists and no active exploitation is confirmed (EPSS: 0.02%, 4th percentile).
Use-after-free in the Linux kernel's md/bitmap subsystem triggers a General Protection Fault (GPF) in write_page() during MD array resize operations, resulting in a kernel crash and denial of service. Affected are systems using Software RAID (md) with bitmap support across a wide range of stable kernel series from 3.5 through 7.0, with patches backported to 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, and 6.19.6. No public exploit code exists and the EPSS score of 0.02% (7th percentile) indicates very low exploitation probability; however, Red Hat has issued a formal advisory (RHSA-2026:19568), confirming vendor acknowledgment.
Memory leak in the Linux kernel's tegra-video media driver causes local denial-of-service on NVIDIA Tegra-based systems. The `__tegra_channel_try_format()` function fails to free a V4L2 subdev state object on two error paths after `v4l2_subdev_call()` fails, leaking kernel memory on each invocation. A local authenticated attacker with access to a Tegra video capture device can repeatedly trigger the error paths to exhaust kernel memory, degrading or crashing the system. No public exploit exists and EPSS is 0.02% (7th percentile), consistent with a niche, hardware-specific availability issue.
Hard-lock denial of service in the Linux kernel's Intel VT-d IOMMU subsystem affects systems running PCIe passthrough configurations (QEMU, DPDK) without scalable mode enabled. When a PCIe endpoint's link drops - through surprise removal, link fault, or process termination - the kernel enters an indefinite wait inside qi_submit_sync() attempting an ATS invalidation that the disconnected device can never acknowledge. The existing partial fix (commit 4fc82cd907ac) guards this path only when Intel IOMMU scalable mode is active, leaving non-scalable-mode deployments unprotected. No public exploit identified at time of analysis and EPSS is 0.02%, but the impact is a complete host freeze with no recovery path short of power cycling.
NULL pointer dereferences in the Linux kernel's Apple SMC (System Management Controller) MFD driver expose Apple-hardware systems to local denial-of-service. The struct apple_smc mutex was never initialized in apple_smc_probe(), causing occasional crashes when sub-device probe() functions call apple_smc_read() and attempt to acquire the uninitialized lock. Only local, low-privileged users on Apple hardware running an affected kernel can trigger this condition. No public exploit code exists and no active exploitation has been reported; EPSS sits at 0.02% (4th percentile), consistent with a narrow hardware-specific attack surface.
Null pointer dereference in the Linux kernel's rtl8723bs staging Wi-Fi driver allows a locally authenticated user to crash the kernel, resulting in a denial of service. The `pwlan` variable in `find_network()` is not validated for NULL before being passed to `rtw_free_network_nolock()`, which then dereferences it unconditionally. The flaw has been present since Linux 4.12 and is patched across all active stable branches; no public exploit exists and EPSS sits at 0.02%, confirming negligible exploitation activity.
Memory leak in the Linux kernel's octeontx2-af CGX driver causes kernel resource exhaustion on systems using Marvell OcteonTX2 network hardware. The rx_fc_pfvf_bmap and tx_fc_pfvf_bmap bitmaps allocated during cgx_lmac_init() are never freed in cgx_lmac_exit(), meaning each unbind/rebind cycle of the driver leaks 16 bytes of kernel memory, detectable via kmemleak. No public exploit is identified at time of analysis, and with an EPSS of 0.02% (7th percentile), real-world exploitation risk is negligible; this is a correctness and stability issue rather than an active security threat.
Denial-of-service in the Linux kernel's pegasus USB-to-Ethernet driver allows a local attacker to crash the kernel by connecting a crafted USB device with mismatched endpoint transfer types. The driver's probe function fills URBs using hardcoded endpoint pipes (bulk RX on ep1, bulk TX on ep2, interrupt on ep3) without first verifying the endpoint descriptors presented by the attached device, leaving it susceptible to assertion failure when types do not match expectations. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.02% reflects the niche local-access-only attack surface; patches have been released across all major stable kernel branches.
Memory leak in the Linux kernel's MMIO mux driver (mux/mmio subsystem) causes kernel memory exhaustion under local access conditions. The mmio regmap allocated during device probe is never released on probe failure paths or driver unbind, resulting in cumulative memory loss that can degrade availability. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.02% (4th percentile) reflects minimal real-world exploitation interest, consistent with the local-only attack vector and narrow hardware dependency.
Folio reference leaks in the Linux kernel EROFS filesystem driver allow a local low-privileged user to cause gradual memory resource exhaustion by presenting crafted EROFS images with valid but specially structured volume labels. Affected kernel versions span multiple stable branches including the 6.18 and 6.19 series, as confirmed by ENISA EUVD-2026-27717 and upstream kernel commit data. No public exploit has been identified at time of analysis, and the vulnerability description explicitly limits impact to reference leaks without system crashes, which aligns with the low EPSS score of 0.02% (4th percentile).
NULL pointer dereference in the Linux kernel's hid-pl driver (Pantherlord/GreenAsia USB game controllers) allows a local low-privileged user to crash the kernel by triggering force feedback on an improperly initialized device. The root cause is unhandled probe errors during driver initialization that leave NULL pointers in place of valid data structures, which are later dereferenced when force feedback is first invoked. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.02% at the 7th percentile reflects negligible real-world exploitation probability.
Local denial-of-service in the Linux kernel's iris media driver (Qualcomm video codec) results from a regression introduced by commit ad699fa78b59241c9d71a8cafb51525f3dab04d4, now reverted. When a media session enters IRIS_INST_ERROR state and userspace subsequently calls stop_streaming for cleanup, the erroneous check skipped the handler entirely - preventing videobuf2 (vb2) buffer returns and leaving firmware in an inconsistent, non-recoverable state. Affected are systems running the iris V4L2 driver on Qualcomm hardware; no public exploit identified at time of analysis and EPSS is 0.02% (percentile 4%), indicating minimal real-world exploitation activity.
Incorrect DMA buffer cleanup in the Linux kernel's fsl_ucc_hdlc WAN driver (used on Freescale/NXP QorIQ embedded platforms) causes a double-free of coherent DMA memory, resulting in a kernel panic and system crash. The driver allocates rx_buffer and tx_buffer as a single contiguous DMA region in uhdlc_init() but mistakenly calls dma_free_coherent() twice - once per buffer pointer - in uhdlc_memclean(), corrupting the DMA allocator state. Any authenticated local user or kernel path that triggers interface teardown on affected hardware can cause a complete availability loss. No public exploit identified at time of analysis, and EPSS at 0.02% (7th percentile) reflects near-zero opportunistic exploitation probability given the narrow hardware scope.
NULL pointer dereference in the Linux kernel's powerpc/smp subsystem allows a local authenticated user to crash the kernel, causing a denial of service on PowerPC-based systems. The `parse_thread_groups()` function passes the return value of `kcalloc()` directly to `of_property_read_u32_array()` without validating it for NULL, meaning a failed memory allocation - possible under memory pressure - leads to a kernel panic or oops. No public exploit code exists and this vulnerability is not in CISA KEV; with an EPSS of 0.02% (7th percentile) and architecture-specific scope limited to PowerPC, real-world exploitation risk is low but relevant to IBM POWER server deployments running Red Hat or SUSE Linux.