Linux
Monthly
Denial of service in Linux kernel ALSA ctxfi audio driver allows local authenticated attackers to crash the system via improper SPDIF1 enumeration during DAIO initialization on hw20k2 hardware. The vulnerability affects kernel versions 6.19 through 7.0 due to a refactoring that loops over all DAIO types including the hw20k2-incompatible SPDIF1 entry, triggering a kernel crash when the undefined hardware info is accessed. Patch available from Linux stable repositories.
Denial of service via divide-by-zero crash in the hwmon OCC (On-Chip Controller) power monitoring driver affects Linux kernels when the power sensor is queried before initial data samples are collected, typically during early boot. Local attackers with unprivileged user privileges can trigger a kernel panic by accessing the affected sysfs power attribute, causing system availability impact. CVSS 5.5 reflects local attack vector and low complexity; EPSS 0.02% indicates low real-world exploitation probability despite the straightforward trigger condition.
Division-by-zero denial of service in Linux kernel's Intel i915 DRM driver when loading on certain machines with DSC (Display Stream Compression) enabled in command mode. The driver incorrectly applies horizontal timing adjustments based on compression ratio in command mode, causing line_time_us to become zero and triggering a kernel panic. Affects Linux kernel versions 5.6 and later; patch available via stable kernel releases.
Kernel NULL pointer dereference in AMD GPU driver on systems with 64KB page sizes allows local authenticated attackers to crash the system by triggering memory allocation mismatches between reserved trap area (8KB) and required allocation size (128KB) during GPU memory initialization. The vulnerability affects systems running ROCm workloads and causes denial of service when executing rocminfo or rccl unit tests on IBM POWER10 and similar 64K-page architectures. EPSS exploitation probability is very low (0.02%), and no public exploit code or active in-the-wild exploitation has been identified.
Denial of service in the Linux kernel's mpu3050 gyroscope driver allows local authenticated attackers to crash the system via incorrect IRQ handler cleanup during module unload. A mismatch between the registered IRQ handler (mpu3050->trig) and the handler passed to free_irq() (mpu3050) causes improper cleanup, leading to resource leaks and potential kernel panic when the device is removed or the driver is unloaded. No public exploit code identified; patch available across affected kernel series.
Resource leak in the Linux kernel MPU3050 gyro driver allows local authenticated users to cause denial of service through memory exhaustion by repeatedly triggering iio_trigger_register() failures that fail to release previously allocated interrupt handlers. The vulnerability affects multiple kernel versions and requires local access with unprivileged user privileges, resulting in potential system availability impact with low real-world exploitation likelihood (EPSS 0.02%).
Memory leak in the Linux kernel's GPIB lpvo_usb driver allows local authenticated users to cause a denial of service through resource exhaustion by repeatedly connecting and disconnecting USB devices, as the driver fails to release USB device references during interface enumeration. The EPSS score of 0.02% indicates minimal real-world exploitation risk despite the moderate CVSS 5.5 severity, reflecting the combination of local-only access requirement, authentication need, and the niche nature of GPIB USB device usage.
A memory leak in the Linux kernel's USB misc usbio driver allows local attackers with low privileges to cause a denial of service by exhausting kernel memory through repeated USB device probe failures. The vulnerability arises when usb_submit_urb() fails during device initialization, leaving allocated URB structures unreleased and accumulating with each failed probe attempt.
Denial of service in Linux kernel USB dwc2 gadget driver allows local authenticated users to trigger a deadlock via improper spin lock handling in dwc2_hsotg_udc_stop(). The vulnerability stems from a locking protocol violation where dwc2_gadget_exit_clock_gating() expects a held lock but is called without one, causing spin_unlock on an unheld lock followed by a lock held indefinitely, resulting in system hang. No public exploit code identified at time of analysis.
Denial of service via NULL pointer dereference in the Linux kernel USB Cadence 3 (cdns3) gadget driver when ep_queue is called on disabled or unconfigured endpoints. A local authenticated attacker can trigger a kernel crash by invoking the vulnerable code path on systems with cdns3 USB gadget support enabled. No public exploit code has been identified, but the attack requires only local access and low privileges (CVSS 5.5, EPSS 0.02%).
A denial of service condition in the Linux kernel's Cadence USB3 (cdns3) gadget driver occurs when gadget initialization fails, leaving the DRD hardware in gadget mode while software state remains inactive. Switching the device to USB host mode via sysfs triggers a synchronous external abort in the xHCI host controller setup, causing a kernel crash. Local authenticated users with access to the USB role-switch sysfs interface can trigger this condition, affecting Linux kernel versions 5.4 through current releases. A patch is available from the Linux kernel project.
NULL pointer dereference in the Linux kernel's auxdisplay line-display driver (linedisp_release()) causes a local denial of service through a kernel panic. The flaw exists because linedisp_release() relies on to_linedisp() - which depends on the device attachment list - but that attachment may already be removed before put_device() invokes the release callback, causing a NULL dereference during resource cleanup. Triggered from linedisp_unregister() or linedisp_register() error paths, exploitation requires local low-privilege access on a system running the auxdisplay module. No public exploit exists and EPSS is 0.02% (5th percentile), confirming this as a stability fix with minimal real-world security urgency.
Denial of service in Linux kernel bridge module via malformed IPv6 Neighbor Discovery options allows local authenticated attackers to crash the system by crafting packets with invalid ND option lengths that cause memory access violations in the br_nd_send() function. The vulnerability affects kernel versions 4.15 and later across multiple stable branches. EPSS exploitation probability is very low at 0.02%, reflecting the requirement for local authenticated access and low attack complexity.
Denial of service in the Linux kernel comedi dt2815 driver allows local authenticated users to crash the system by attaching the driver to arbitrary I/O addresses without actual hardware present via the COMEDI_DEVCONFIG ioctl. The vulnerability occurs when outb() operations are performed on non-existent hardware, triggering page faults under race conditions. A patch adding hardware detection via status register reads prevents the crash.
Memory leak in Linux kernel comedi subsystem allows local privileged users to exhaust kernel memory and cause denial of service. The vulnerability exists in do_cmd_ioctl() where chanlist memory is not properly freed when runflags is not set following an exceptional exit, due to incomplete reference counting logic introduced in commit 4e1da516debb. CVSS 5.5 (local, low complexity, requires user privilege) with EPSS 0.02% indicates this is a lower-priority local DoS affecting systems with comedi driver loaded and untrusted local users.
Null pointer dereference and invalid I/O port writes in the Linux kernel's comedi ni_atmio16d driver occur when the device attach handler fails, causing the detach handler to call reset_atmio16d() with uninitialized device state. Local privileged attackers can trigger a denial of service by causing attach to fail, resulting in kernel memory access violations or writes to address zero. No public exploit code or active exploitation has been identified; patch versions are available from the Linux kernel stable branches.
Memory leak in Linux kernel s390/zcrypt subsystem allows local authenticated attackers to exhaust memory resources by repeatedly using CCA cards as accelerators for clear key RSA requests (ME and CRT operations). The vulnerability stems from incomplete refactoring where AP message allocations via ap_init_apmsg() are not properly freed in two code paths, causing heap memory exhaustion over time and enabling denial of service on s390 systems with CCA cryptographic hardware.
Denial of service in Linux kernel energy model netlink handler allows local authenticated attackers to crash the system via NULL pointer dereference when requesting non-existent performance domain IDs. The dev_energymodel_nl_get_perf_domains_doit() function fails to validate the return value from em_perf_domain_get_by_id() before dereferencing the performance domain structure, causing immediate kernel panic when an invalid domain ID is supplied. EPSS exploitation probability is very low (0.02%, 5th percentile), and no public exploit code or active exploitation has been identified.
Denial of service via runtime PM usage count underflow in the rz-mtu3-cnt counter driver allows local privileged users to disable hardware counters and trigger kernel warnings by repeatedly writing to the sysfs enable file. Multiple writes of the same value (0 or 1) to the enable attribute cause the runtime PM reference count to become misaligned with actual hardware state, leading to register access with clocks disabled and potential PWM channel conflicts. EPSS exploitation probability is minimal (0.02%) despite local access requirement, indicating this is primarily a local reliability issue rather than a remote attack vector.
Denial of service in Linux kernel counter driver (rz-mtu3-cnt) allows local attackers with low privileges to crash the system by exploiting a race condition where counter and PWM sub-drivers overwrite a shared device pointer, causing incorrect runtime power management operations. The vulnerability affects kernel versions prior to specific patch levels across the 6.x and 7.x branches, with EPSS exploitation probability of 0.02% indicating low real-world exploitation likelihood despite the availability of a vendor patch.
Denial of service in Linux kernel VXLAN module allows local authenticated attackers to crash the system via malformed IPv6 neighbor discovery options in vxlan_na_create(). A crafted ND option with incorrect length values can cause out-of-bounds access or undersized payload reads, triggering a kernel panic. EPSS exploitation probability is low at 0.02%, but the vulnerability is confirmed patched across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12).
Memory leaks in the ftgmac100 Ethernet driver's ring allocation function allow local authenticated users to cause a denial of service through resource exhaustion on driver initialization failure. The vulnerability is triggered when ftgmac100_alloc_rings() fails during intermediate allocation stages, returning directly without freeing previously allocated resources (rx_skbs, tx_skbs, rxdes, txdes, rx_scratch). This affects Linux kernel versions prior to fixes released in stable branches 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0.
Denial of service via NULL pointer dereference in the MediaTek Ethernet PPE (packet processing engine) driver occurs when gmac0 (the primary ethernet interface) is disabled on affected systems. A local authenticated attacker can trigger a kernel crash by sending traffic through the networking stack when the driver incorrectly checks for a valid ingress device without verifying if the first network device pointer is actually initialized. The vulnerability affects Linux kernel versions prior to fixes released in stable branches 6.18.22, 6.12.81, 6.19.12, and 7.0.
Denial of service in Linux kernel scheduler extension (sched_ext) allows local privileged attackers to crash systems by triggering incorrect task migration validation. The vulnerability exists in the is_bpf_migration_disabled() function, which fails to correctly identify migration-disabled tasks on non-PREEMPT_RCU configurations, potentially dispatching such tasks to remote CPUs and triggering kernel errors in task_can_run_on_remote_rq(). EPSS exploitation probability is very low at 0.02%, but CVSS 5.5 indicates local attackers with standard user privileges can cause denial of service.
A denial of service condition in the Linux kernel scheduler extension (sched_ext) subsystem allows local authenticated attackers to trigger a kernel warning and potential crash via improper handling of stale direct dispatch state in the ddsp_dsq_id field. When a task's direct dispatch verdict is not properly cleared across all code paths that consume or cancel such verdicts, a subsequent wakeup operation calling ops.select_cpu() with scx_bpf_dsq_insert() triggers a spurious WARN_ON_ONCE() in mark_direct_dispatch(), exposing the availability impact of the vulnerability. The issue affects Linux kernels with sched_ext enabled and requires local access with low privilege (non-root user capable of triggering task scheduling operations).
Resource leaks in the Linux kernel GPIO subsystem allow local attackers with low privileges to cause denial of service through memory exhaustion during gpiochip initialization error handling. The vulnerability arises from improper reference counting in gpiochip_add_data_with_key() after device initialization, where error paths fail to release device references, leading to memory not being freed on function failure. CVSS 5.5 with EPSS 0.02% indicates low real-world exploitation probability despite local attack vector.
A race condition in the USB gadget ethernet driver (usb: gadget: u_ether) between gether_disconnect() and eth_stop() causes a NULL pointer dereference and system hardlockup on local systems with low privilege users. When eth_stop() is triggered concurrently during gether_disconnect(), it attempts to access a cleared endpoint descriptor, crashing while holding a spinlock that gether_disconnect() also needs, resulting in kernel panic and denial of service. CVSS 4.7 with low EPSS score (0.02%, percentile 7%) indicates limited real-world exploitation likelihood despite confirmed availability of vendor patches across multiple stable kernel branches.
NULL pointer dereference in the USB Ethernet gadget driver (u_ether) allows local attackers with low privileges to cause a denial of service by querying device information via ethtool during device unbind. The vulnerability occurs when userspace tools call eth_get_drvinfo() on a gadget interface after the kernel has cleared the gadget pointer during device reparenting, triggering a crash without authentication or user interaction. EPSS exploitation probability is minimal (0.02%), and this is a localized denial of service with no impact on confidentiality or integrity.
A NULL pointer dereference in the Linux kernel USB gadget UVC (USB Video Class) driver during power management transitions allows local authenticated attackers with low privileges to cause a kernel panic and denial of service. The vulnerability occurs when the PM subsystem freezes user space processes during suspend, causing wait_event_interruptible_timeout() to abort early in uvc_function_unbind(), which nullifies the gadget pointer. When tasks are restarted, the V4L2 release path attempts to access the already nullified pointer, triggering a kernel panic. Patches are available across multiple kernel versions (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0).
Denial of service in the Linux kernel USB gadget ECM (Ethernet Control Model) driver allows local authenticated attackers to crash the system by exploiting improper net_device lifecycle management during bind and unbind cycles. When the gadget device unbinds, the network device survives with dangling sysfs symlinks, causing kernel issues when accessed or when the device tree is traversed. The vulnerability affects Linux kernel versions prior to patches released in 6.12.81, 6.18.22, 6.19.12, and 7.0.
Denial of service in Linux kernel USB gadget EEM function allows local privileged attackers to crash the system by triggering a dangling sysfs symlink condition during gadget device unbind cycles. The vulnerability arises from improper net_device lifecycle management when the parent gadget device is destroyed while the network device persists, resulting in kernel panic or system instability. CVSS 5.5 reflects local privilege requirement (PR:L) and high availability impact, with EPSS at 0.02% percentile indicating minimal real-world exploitation probability despite patch availability.
USB gadget subsystem net_device lifecycle mismanagement in Linux kernel allows local privileged users to cause denial of service through sysfs corruption. The f_subset gadget function creates dangling sysfs symlinks when unbinding due to improper device reparenting, resulting in inaccessible network device references and potential system instability. A local user with sufficient privileges can trigger unbind/rebind cycles to exhaust resources or corrupt the sysfs filesystem state.
Dangling sysfs symlinks in the Linux kernel's USB gadget f_rndis driver cause availability loss on systems where the RNDIS USB gadget function is used. The net_device object outlives its sysfs parent when the USB gadget unbinds, leaving broken references under /sys/class/net/ that persist until the kernel object is reclaimed. Exploitation is local and requires low-privilege access; no public exploit or active exploitation (CISA KEV) has been identified, and EPSS probability stands at 0.02% (5th percentile), reflecting minimal real-world exploitation interest at time of analysis.
List corruption in the Linux kernel's USB HID gadget driver (f_hid) can crash systems configured with USB gadget functionality. When a user-space process opens /dev/hidg0, registers the file descriptor with epoll, and the UDC (USB Device Controller) is subsequently unbound and rebound, the hidg_bind() function re-initializes wait queues that still contain registered waiters - corrupting the kernel's internal list structures and triggering an availability-impacting kernel panic upon epoll removal. The vulnerability carries a CVSS score of 5.5 (Medium), EPSS of 0.02% (7th percentile), is not listed in CISA KEV, and no public exploit code has been identified at time of analysis.
Missing CAP_NET_ADMIN capability check in the Linux kernel's rtnetlink subsystem allows a local low-privileged user with an unprivileged user namespace to inject network interfaces into arbitrary network namespaces, including the host's init_net. The flaw is in rtnl_newlink(), which validates capabilities only in the caller's namespace but not in the peer namespace when creating paired devices such as veth, vxcan, and netkit. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.02% (4th percentile) reflects very low current exploitation probability, though the impact is rated Availability:High and the vulnerability is relevant to multi-tenant and containerized environments.
Indefinite deadlock in the Linux kernel's igb Gigabit Ethernet driver causes permanent TX queue stall when an AF_XDP zero-copy application is killed abruptly. Affected systems using Intel igb-family NICs (82575, 82576, I350) experience a hang in igb_down() because napi_synchronize() waits for NAPI_STATE_SCHED to clear - a state that igb_clean_rx_irq_zc() prevents from clearing by continuously returning the full NAPI budget after the XSK buffer pool is destroyed. The TX watchdog fires and the network interface becomes permanently unavailable until reboot. No public exploit has been identified (EPSS 0.02%, 4th percentile), and upstream patches are available in stable kernel branches 6.18.23, 6.19.13, and 7.0.
Denial of service in the Linux kernel EDAC (Error Detection and Correction) subsystem due to improper initialization ordering in edac_mc_alloc(). When memory allocation fails during EDAC memory controller initialization, the error path calls put_device() before device_initialize() is executed, triggering a null pointer dereference in kobject_put() that causes a kernel panic or system crash. This affects Linux systems with EDAC support enabled across multiple kernel versions from 5.19 through 7.0.
Denial of service in Linux kernel GPIO OMAP driver allows local authenticated users to crash the system via a deadlock condition triggered by improper driver registration from probe() callback. The vulnerability stems from registering the omap_mpuio_driver within omap_gpio_probe(), which violates driver core locking rules and creates a potential deadlock when device_lock enforcement was strengthened in commit dc23806a7c47. EPSS score of 0.03% reflects low exploitation probability despite availability of patched kernel versions.
Denial-of-service in the Linux kernel's traffic control `act_csum` module allows a local low-privileged user to crash the kernel by exploiting missing VLAN header validation in `tcf_csum_act()`. Systems running any Linux kernel version from the introducing commit through the stable patch releases (pre-6.12.83, pre-6.18.24, pre-6.19.14) and configured with the `act_csum` tc action on paths carrying nested VLAN-tagged traffic are vulnerable. No public exploit has been identified and EPSS stands at 0.02% (5th percentile), indicating minimal real-world exploitation probability, but the issue is patch-confirmed across multiple stable branches.
Out-of-bounds array access in the Linux kernel's netfilter xt_multiport module enables a local attacker with low privileges to crash the system via a crafted malformed iptables rule. The checkentry validation path for multiport v1 rules fails to verify range encoding, allowing ports_match_v1() to step past the end of the ports[] array when processing rules where the last slot is flagged as a range start or when two consecutive range-start markers appear without an intervening range-end. Exploitation is confined to local actors with CAP_NET_ADMIN capability; no public exploit has been identified and EPSS sits at 0.02% (5th percentile), consistent with the narrow attack surface.
Denial of service in the Linux kernel's AF_ALG crypto socket subsystem allows a local, low-privileged user to crash or hang the system via crafted recvmsg calls. The flaw in af_alg_get_rsgl() causes receive buffer accounting to diverge from actual data attached to skcipher requests - when insufficient RX space remains, the kernel rounds the request length to zero rather than rejecting it, producing an invalid crypto operation. No exploitation has been confirmed (not in CISA KEV) and EPSS is 0.02%, reflecting the narrow local-only attack surface.
Memory leak in the Linux kernel's rt2x00usb WiFi driver allows a local low-privileged user to exhaust kernel memory on systems equipped with Ralink RT2x00-based USB WiFi adapters. The flaw - present since kernel 4.7 - results from USB anchor device-managed resources being incorrectly scoped to the parent USB device rather than the USB interface, so resources are not released when the driver unbinds without a physical device disconnection. No active exploitation is confirmed (not in CISA KEV) and EPSS stands at 0.02% (7th percentile), marking this as a low-urgency stability fix rather than an emergency security response.
Uninitialized kernel memory leaks to userspace through the xfrm_user subsystem's build_report() function in the Linux kernel, exposing three bytes of alignment padding in struct xfrm_user_report via Netlink before it is copied to userspace. The flaw affects virtually all Linux kernel versions from initial commit through the recently issued stable-tree patches (5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, and 7.0). No public exploit has been identified at time of analysis, EPSS sits at just 0.02% (7th percentile), and it is not listed in CISA KEV; however, the breadth of affected systems is enormous given the Linux kernel's ubiquitous deployment.
Local low-privileged users can exhaust system memory on Linux systems by generating unbounded rfkill events without consuming them from the rfkill file descriptor, resulting in a potential out-of-memory condition and system crash. Affected kernel versions span a wide range across multiple stable branches, with fixes backported to 5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, and 7.0. No public exploit code or active exploitation has been identified; the EPSS score of 0.02% (7th percentile) reflects minimal real-world exploitation interest at time of analysis.
Kernel heap memory disclosure in the Linux kernel's xfrm (IPsec) subsystem exposes uninitialized heap bytes to local unprivileged users via netlink multicast. The `build_polexpire()` function omits the `memset_after()` call that its counterpart `build_expire()` correctly applies, leaving trailing padding bytes of `struct xfrm_user_polexpire` uninitialized before broadcasting the structure to XFRMNLGRP_EXPIRE listeners. Any local user able to subscribe to that netlink multicast group on a system running IPsec with expiring policies can capture these notifications and read arbitrary kernel heap contents. No public exploit has been identified at time of analysis, and EPSS is extremely low at 0.02% (7th percentile), indicating negligible automated exploitation activity.
Memory mismanagement in the Linux kernel brcmsmac WiFi driver causes a kernel availability impact through a size mismatch between DMA allocation and deallocation. The brcmsmac driver incorrectly calls dma_free_coherent() with the original requested size rather than the aligned size stored in 'alloced' by dma_alloc_consistent(), which may have grown the allocation during alignment. This affects Linux from version 3.2 (commit 5b435de0) through multiple stable branches, with no public exploit identified at time of analysis and an EPSS score of 0.02% indicating very low exploitation probability.
NULL dereference in the Linux kernel's pn533 NFC driver (pn532_receive_buf) can crash the kernel when a socket buffer allocation fails after bytes have already been consumed from the serial receive stream. Systems running affected kernel versions with PN532/PN533 NFC hardware attached over serial are exposed to a local denial-of-service (kernel panic). No public exploit code exists, EPSS probability is negligible (0.02%, 7th percentile), and this vulnerability is not in the CISA KEV catalog - indicating no confirmed active exploitation.
Memory leak in the Linux kernel's Altera Triple Speed Ethernet (altera-tse) driver allows a local low-privileged user on affected hardware to exhaust kernel memory over time. The flaw in tse_start_xmit() incorrectly signals successful packet transmission to the network stack when DMA mapping fails, preventing socket buffer (skb) cleanup and causing a per-failure memory leak that can escalate to availability loss. No public exploit exists and EPSS at 0.02% (7th percentile) confirms negligible exploitation interest; this is a maintenance-tier fix relevant only to specialized embedded Linux deployments on Altera/Intel FPGA hardware.
System hang exposure in the Linux kernel's i.MX 8MP (imx8mp-blk-ctrl) power management domain driver allows a local attacker with low privileges to trigger a kernel hang on affected NXP i.MX 8M Plus-based systems. The root cause is the NOC_HDCP clock being incorrectly allowed to power down, which causes the NoC ADB400 port power-down handshake to deadlock, resulting in a complete loss of system availability. No public exploit code exists and EPSS is 0.02%, indicating this is a stability defect with low opportunistic exploitation probability, though it carries meaningful availability risk on affected embedded hardware.
Memory leak in the Linux kernel's __mmap_region() function allows a local low-privileged user to incrementally exhaust kernel slab memory, potentially causing denial of service. Introduced as a regression by commit 605f6586ecf7, the bug leaves a shmem file object unreferenced when mmap() on /dev/zero with MAP_SHARED fails mid-way through VMA setup - the replacement file allocated by shmem_zero_setup_desc() is never released via fput(). No public exploit exists and EPSS sits at 0.02%, making this a low-urgency but genuine availability risk for affected kernel versions; patched upstream in stable commits 61fc8eaf and 894f99eb.
Memory leak in the Linux kernel's DAMON (Data Access MONitor) sysfs subsystem allows a local low-privileged user to exhaust kernel memory by triggering a race condition between process termination and damon_call() invocation. When DAMON is configured to monitor virtual address spaces and the target process exits before damon_call() executes, the dynamically allocated repeat_call_control structure is never freed. No public exploit exists and EPSS is 0.02% (4th percentile), placing this firmly in the low-urgency tier despite the high availability impact scored by CVSS.
NULL pointer dereference in the Linux kernel vub300 USB MMC driver allows a local authenticated attacker to crash the kernel by disconnecting a VUB300-based USB MMC adapter while the driver is active. The disconnect handler releases the driver data reference before deregistering the MMC controller, creating a window for NULL dereference or use-after-free that results in a kernel panic and denial of service. No active exploitation has been confirmed - EPSS is 0.02% (7th percentile) and the vulnerability is absent from the CISA KEV catalog.
Denial of service via kernel panic in the Linux kernel idpf NIC driver arises from invalid spinlock nesting in the async virtchannel message handler, most critically on PREEMPT_RT-enabled kernels. The idpf_mac_filter_async_handler acquires a BH spinlock while the workqueue thread already holds the raw spinlock embedded in the completion primitive of idpf_vc_xn, violating PREEMPT_RT lock context rules and triggering a kernel BUG that crashes the system. No public exploit identified at time of analysis; EPSS is 0.02%, indicating negligible observed exploitation interest for this narrow driver-level locking defect.
Null pointer dereference in the Linux kernel's lan966x FDMA network driver crashes the kernel when page_pool_create() fails during receive pool initialization. Affected systems running lan966x network controller hardware can be brought down by a local low-privileged user who triggers a page pool allocation failure, resulting in a kernel oops via dereference of an ERR_PTR in xdp_rxq_info_reg_mem_model(). No public exploit or active exploitation (CISA KEV) has been identified; EPSS at 0.02% (5th percentile) confirms negligible observed exploitation activity.
Page pool memory leaks in the Linux kernel's lan966x FDMA (Flexible DMA) network driver cause resource exhaustion when DMA allocation failures occur during driver initialization, affecting systems built on Microchip lan966x Ethernet switch hardware. The missing `page_pool_destroy()` calls in two distinct error paths - inside `lan966x_fdma_rx_alloc()` and `lan966x_fdma_init()` - allow allocated pools to persist indefinitely if initialization fails, potentially degrading host availability. With an EPSS of 0.02% and no public exploit or KEV listing, this is a low-priority maintenance issue with real-world impact limited almost exclusively to embedded and industrial Linux deployments running this specific controller hardware.
Memory exhaustion in the Linux kernel's rxrpc subsystem allows a local low-privileged user to degrade system availability by repeatedly triggering a key parsing error path that leaks kernel memory. The flaw exists in rxrpc_preparse_xdr_yfs_rxgk(), where allocations for token->rxgk are not freed on certain error branches before jumping to reject_token. With EPSS at 0.02% (5th percentile) and no CISA KEV listing, real-world exploitation is assessed as low-probability and operationally constrained to systems actively using AFS/YFS rxrpc authentication.
Infinite-loop denial of service in the Linux kernel's rxrpc subsystem allows a local low-privileged user to hang a process indefinitely by reading /proc/net/rxrpc/calls while concurrent rxrpc call teardown occurs. The root cause is use of list_del_init() instead of the RCU-safe list_del_rcu() during call removal from rxnet->calls, leaving the list in a state that confuses RCU readers into endless traversal. No public exploit exists and EPSS sits at the 5th percentile, reflecting the combination of local-only access and the niche deployment footprint of rxrpc.
Reference count leak in the rxrpc subsystem of the Linux kernel allows a local low-privilege user to exhaust kernel keyring resources, causing denial of service. The flaw exists in rxrpc_alloc_client_call(), which acquires a reference to call->key but never releases it in rxrpc_destroy_call(), causing the key reference counter to increment indefinitely across repeated client call creation and destruction. EPSS at 0.02% (5th percentile) and no KEV listing confirm this carries negligible real-world exploitation urgency; no public exploit is identified at time of analysis.
Reference count leak in the Linux kernel's rxrpc subsystem (`rxrpc_server_keyring()`) causes progressive kernel resource exhaustion when `rx->securities` is already initialized and the extra reference is not decremented. Affected kernels span from version 2.6.22 through multiple stable branches, with fixes backported to 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, and 7.0. No public exploit identified at time of analysis, and EPSS sits at 0.02% (7th percentile), reflecting niche real-world exploitation probability despite the kernel's ubiquitous deployment footprint.
Memory exhaustion in the Linux kernel's rxrpc/rxgk subsystem allows a local low-privileged attacker to cause a denial-of-service condition by triggering a resource leak in rxgk_verify_response(), where allocated rxgk authentication context objects are never released. The flaw is confined to systems actively using AFS with RxGK GSS-based authentication, a non-default configuration absent from the vast majority of Linux deployments. No public exploit code exists and exploitation probability is extremely low (EPSS 0.02%), though patched stable kernel versions 6.18.23, 6.19.13, and 7.0 are available.
Cross-thread information disclosure in the Linux kernel on AMD Zen1 processors allows a low-privileged local attacker to harvest partial floating-point division results belonging to a concurrently executing victim thread. Zen1's hardware FP divider fails to fully clear intermediate state between operations, creating a side-channel leakage path exploitable by any unprivileged thread sharing the same physical CPU core. No public exploit code has been identified and CISA has not added this to the KEV catalog, but the vulnerability affects all Linux versions from inception through multiple stable branches, with patches now available across eight stable series (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 6.19, 7.0).
NULL pointer dereference in the Linux kernel hid-alps driver crashes systems with Alps HID touchpad hardware when raw events are processed before the device is fully claimed. Local low-privileged users on affected systems can trigger a kernel panic, causing a denial of service. No public exploit exists (EPSS 0.02%, 5th percentile) and no KEV listing has been issued; however, patches are confirmed across multiple stable branches including 6.12.83, 6.18.24, 6.19.14, and 7.0.1.
Shift-out-of-bounds vulnerability in Linux kernel HID core driver allows local authenticated attackers to cause denial of service via crafted HID device report descriptors with oversized fields that trigger undefined bit-shift operations in the s32ton() function. A malicious or malfunctioning HID device can supply a report_size value up to 256, causing shifts on 32-bit integers with exponents exceeding safe limits, crashing the kernel or triggering undefined behavior. CVSS 5.5 reflects local-only attack vector with low complexity and requirement for user/driver privileges to process HID output reports.
Denial of service via skb_shared_info->frags[] buffer overflow in the CDC Phonet USB driver allows local attackers with USB device access to crash the kernel by sending unbounded sequences of full-page bulk transfers. A malicious or compromised USB modem device can trigger this overflow without authentication or user interaction. The vulnerability has a low EPSS score (0.02%) despite moderate CVSS (5.5), indicating exploitation requires specific local USB hardware control.
Null pointer dereference in Linux kernel bnge driver occurs when auxiliary_device_add() fails and the error handling path omits a return statement after auxiliary_device_uninit(), causing subsequent code to dereference a freed and nullified auxr_dev pointer. Local users with limited privileges can trigger kernel panic (denial of service) by inducing auxiliary device initialization failure. EPSS score of 0.02% reflects low real-world exploitation probability despite availability of vendor patches in stable branches 6.19.14 and 7.0.1.
Null pointer dereference in the ALSA TASCAM US-144MKII USB audio driver allows local attackers with physical access to a malicious USB device to cause a kernel panic and denial of service. The vulnerability exists because the driver fails to validate that USB interface 0 exists before dereferencing it, and attackers can craft a malicious USB configuration that includes only interface 1, triggering the crash when the device is connected.
Denial of service via out-of-bounds string lookup in Linux kernel ALSA fireworks driver allows local authenticated users to crash the system by supplying an invalid status value from a firewire device. The vulnerability stems from insufficient bounds checking on a 32-bit status field before array indexing into a 17-entry string table, enabling memory access violations when the device reports unexpected values including EFR_STATUS_INCOMPLETE (0x80000000).
Divide-by-zero denial of service in Linux kernel framebuffer driver tdfxfb allows local authenticated users to crash the system by issuing a malformed FBIOPUT_VSCREENINFO ioctl with zero pixclock value. The vulnerability affects the framebuffer video mode setting functionality when pixclock is used directly in division operations without validation, triggering a kernel panic.
Integer underflow in the Linux kernel's USB NCM gadget driver allows a malicious USB host to bypass buffer boundary checks and copy adjacent kernel memory into network packet buffers. The vulnerability exists in ncm_unwrap_ntb() where block_len values smaller than the NDP size cause unsigned integer underflow in bounds validation, enabling out-of-bounds memory read and potential information disclosure. Affected versions prior to Linux 6.12.83, 6.18.24, 6.19.14, and 7.0.1 require patching; exploitation requires local USB device attachment or administrative USB gadget configuration.
Memory corruption via skb fragment array overflow in the USB Phonet gadget driver allows local attackers with device-level USB host capabilities to cause denial of service. The vulnerability exists in pn_rx_complete() which fails to enforce the MAX_SKB_FRAGS limit when processing unbounded full-page OUT transfers, causing heap memory corruption adjacent to the skb_shared_info structure. A malicious or misconfigured USB host sending continuous PAGE_SIZE byte transfers triggers the flaw in gadgets exposing the Phonet function, confirmed fixed in Linux 6.12.83, 6.18.24, 6.19.14, and 7.0.1.
Null pointer dereference in the Renesas USB3 gadget driver allows local authenticated attackers to trigger a denial of service by sending crafted USB standard requests with invalid endpoint indices that bypass validation in GET_STATUS and SET/CLEAR_FEATURE handlers. The vulnerability affects multiple stable kernel versions and requires local access with user-level privileges, resulting in potential system crash or service disruption.
Memory leak in the Linux kernel ksmbd SMB server subsystem allows pre-authenticated remote clients to exhaust kernel memory by repeatedly sending malformed SPNEGO/ASN.1 BER blobs. The ksmbd_decode_negTokenInit() function allocates a mechToken buffer mid-parse via kmemdup_nul(), but if a subsequent element in the same blob is malformed (e.g., mechListMIC[3] overrunning its enclosing SEQUENCE), the decoder fails and clears use_spnego, causing the cleanup gate at smb2_sess_setup() to skip kfree() - leaking the allocation. No public exploit code has been identified at time of analysis, and EPSS sits at 0.03% (10th percentile), consistent with a slow-burn DoS rather than an immediately weaponizable condition.
Kernel oops and denial of service in the Linux kernel USB gadget HID driver (`f_hid`) occurs when `cdev_init` reinitializes an in-use character device during a USB gadget unbind/rebind cycle while `/dev/hidg*` remains open. A local attacker with low privileges who holds a file descriptor to `/dev/hidg0` open during a rebind operation can trigger a kernel oops, crashing the affected system. No public exploit exists and EPSS probability is 0.02% (5th percentile), indicating negligible exploitation interest; however, patched kernel versions are available across multiple stable branches.
Divide-by-zero crash in the Linux kernel's udlfb (USB DisplayLink framebuffer) driver allows a local low-privileged user to trigger a kernel panic via the FBIOPUT_VSCREENINFO ioctl when pixclock is zero. The flaw, classified CWE-369, mirrors an identical class of defect previously corrected in the fb_pm2fb driver (commit 19f953e74356). Patched kernel versions are available across multiple stable branches; no public exploit or active exploitation has been identified at time of analysis.
Resource leak in the Linux kernel rtw88 USB WiFi driver allows a local attacker with low privileges to cause system availability degradation by triggering repeated probe failures that leave unreleased USB device references. The driver increments the USB device reference count during probe but fails to decrement it on all error exit paths - specifically when descriptor parsing fails - resulting in CWE-401 reference leaks that accumulate over time. No public exploit exists and EPSS is at the 6th percentile (0.02%), indicating negligible exploitation probability; the real-world impact is constrained to systems with Realtek rtw88 USB WiFi adapters.
Division-by-zero in the sm750fb staging framebuffer driver allows a local low-privileged user to crash the kernel. By submitting a FBIOPUT_VSCREENINFO ioctl with pixclock set to zero, an attacker triggers an unvalidated division in ps_to_hz(), called from hw_sm750_crtc_set_mode(), resulting in a kernel panic and full denial of service. No public exploit code has been identified and EPSS is 0.02% (5th percentile), consistent with a locally-reachable, hardware-dependent crash with no remote or confidentiality impact.
Kernel panic in the Linux xe/vfio driver causes a denial-of-service when a reset is triggered on SR-IOV Virtual Function (VF) devices that do not support live migration. The xe_vfio_pci_core_device struct members required by reset handling are only initialized during migration setup, leaving them NULL for non-migration VFs; writing to the sysfs reset attribute of such a VF dereferences the uninitialized pointer and crashes the kernel. No public exploit has been identified, EPSS is 0.02% (5th percentile), and exploitation requires a narrow hardware and configuration prerequisite - Intel Xe GPU with SR-IOV and VFIO passthrough enabled.
NULL pointer dereference in the Linux kernel's vidtv virtual DVB-T test driver allows a local low-privileged user to crash the kernel, resulting in a denial-of-service. The flaw resides in vidtv_channel_pmt_match_sections(), which calls vidtv_psi_pmt_stream_init() without validating whether the return value is NULL on memory allocation failure; a subsequent field access on the NULL pointer triggers a general protection fault. No public exploit or active KEV-listed exploitation exists; EPSS at 0.02% (5th percentile) reflects negligible real-world exploitation probability.
Kernel panic in the Linux kernel's ocfs2 (Oracle Cluster File System 2) resize path allows a local low-privileged user to crash the system via a crafted filesystem image. The ocfs2_group_extend() function in fs/ocfs2/resize.c:308 unconditionally asserts that the global bitmap buffer contains a valid dinode signature using BUG_ON, but the JBD2 journaling layer's buffer path bypasses structural validation, permitting an invalid dinode to reach the resize ioctl and trigger a kernel BUG. No active exploitation is confirmed (not in CISA KEV), and EPSS stands at 0.02% (5th percentile), reflecting minimal exploitation activity; patches are available across multiple stable kernel branches.
Kernel panic in the Linux pci-epf-vntb driver allows a local low-privileged user to crash the system by triggering a race between the delayed cmd_handler work queue and the epf_ntb_epc_cleanup teardown path. When cleanup frees BAR mappings and doorbells without first canceling the pending work, the handler subsequently dereferences invalid virtual addresses and produces a fatal kernel oops. Affected systems are limited to those with PCIe NTB endpoint hardware and the pci_epf_vntb module loaded; no public exploit exists and EPSS is 0.02%, reflecting negligible exploitation probability.
Kernel crash (oops) in the Linux PCI endpoint virtual NTB (pci-epf-vntb) driver allows a local user with limited privileges to trigger a use-after-free via configfs symlink operations. The driver's epf_ntb_epc_destroy() helper performs resource teardown that duplicates what the caller later executes, causing a double-free that dereferences a kernel poison pointer (0xDEAD000000000108) and crashes the system. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.02% (4th percentile), and impact is purely availability - confidentiality and integrity are not affected.
Host kernel panic in Linux KVM's AMD SEV-SNP subsystem allows a local attacker with KVM device access to crash the host by issuing a VMSA synchronization ioctl after a vCPU has already been launched and its VMSA encrypted. On SNP-enabled hosts, this write access violates the Reverse Map Table (RMP) hardware protection, producing an unrecoverable RMP page fault that panics the host kernel and terminates all co-located guest VMs simultaneously. No public exploit or active exploitation has been identified; vendor-released patches are available for stable kernel series 6.12.83, 6.18.24, 6.19.14, and 7.0.1.
Null pointer dereference in the Linux kernel's KVM SEV subsystem crashes the host with a kernel panic when a low-privileged local user issues a specific ioctl sequence. The missing `kvm->lock` acquisition before the `sev_guest()` check in `sev_mem_enc_register_region()` allows exploitation when `KVM_SEV_INIT{2}` fails and leaves `sev->regions_list` uninitialized - a subsequent `KVM_MEM_ENCRYPT_REG_REGION` ioctl then dereferences the null list head. No confirmed active exploitation (not in CISA KEV), but a syzbot-generated reproducer is embedded in the CVE description; EPSS is 0.02% (4th percentile), consistent with the local-only, denial-of-service nature. Patched kernel versions 6.18.24, 6.19.14, and 7.0.1 are available.
Kernel crash risk in Linux KVM's AMD SEV-SNP guest launch path allows a local attacker with KVM vCPU management privileges to crash the host by exploiting a missing vCPU lock during VMSA synchronization. The SEV-SNP `KVM_SNP_LAUNCH_FINISH` path failed to lock all vCPUs before encrypting their save areas, permitting concurrent userspace manipulation that corrupts per-vCPU state or triggers a kernel panic. No public exploit code has been identified and the EPSS score of 0.02% (4th percentile) reflects extremely low exploitation probability, making this a targeted concern for AMD EPYC-based KVM hypervisors running SNP guests.
Denial-of-service in the Linux kernel KVM SEV subsystem allows a local low-privileged user to trivially trigger a kernel WARN in sev_pin_memory() by submitting a crafted KVM_MEMORY_ENCRYPT_REG_REGION ioctl with an oversized region (e.g., size set to the maximum u64 value), causing npages to overflow a signed int. On kernels configured with panic_on_warn=1, this directly results in a kernel panic and full system crash. No public exploit has been identified at time of analysis and CISA has not added this to the KEV catalog, though the CVE description itself provides a working proof-of-concept reproducer.
State corruption and memory leak in the Linux kernel's vidtv virtual DVB test driver allow a local low-privileged user to cause kernel memory exhaustion. When vidtv_start_streaming() fails inside vidtv_start_feed(), the nfeeds counter is incremented but never rolled back, desynchronizing driver state so that subsequent start calls skip mux initialization and stop calls exit early without freeing partially allocated mux and channel resources. No public exploit exists and EPSS is 0.02% (5th percentile), reflecting the niche nature of the affected test driver component.
Deadlock in the Linux kernel WireGuard subsystem can cause a hung task and system-level denial of service for authenticated local users. The `wg_netns_pre_exit()` pernet callback manually acquires `rtnl_lock()`, blocking indefinitely if `rtnl_mutex` is concurrently held by the `cleanup_net` workqueue or `setup_net` failure rollback path. No public exploit exists and EPSS is extremely low (0.02%, 4th percentile); however, the issue spans a broad range of kernel versions and has been patched in stable releases 6.18.24, 6.19.14, and 7.0.1.
NULL pointer dereference in the Linux kernel's nilfs2 filesystem driver allows a local, low-privileged attacker to crash the kernel by invoking the NILFS_IOCTL_CLEAN_SEGMENTS ioctl immediately after mounting a nilfs2 filesystem, before the DAT inode's btree node cache is lazily initialized. The impact is a general protection fault and full denial of service; no confidentiality or integrity impact is possible. No public exploit is known at time of analysis, and EPSS at 0.02% (5th percentile) reflects extremely low real-world exploitation probability.
Race condition in the Linux kernel's userfaultfd hugetlb path allows a local low-privilege user to crash the kernel by triggering a BUG_ON assertion in resv_map_release(). The root cause is a unit mismatch in mfill_atomic_hugetlb(): linear_page_index() returns a PAGE_SIZE-unit index while hugetlb_fault_mutex_hash() expects a huge-page-granularity index, causing concurrent fault threads within the same huge page to acquire different mutexes and corrupt the reservation map. No public exploit has been identified and EPSS is 0.02% (4th percentile), placing real-world risk firmly in the low tier despite reliable kernel crash reproducibility under the right conditions.
Timer interrupt starvation in the Linux kernel clockevents subsystem results from the `next_event_forced` flag not being reset across three distinct code paths: clock event state transitions (shutdown/startup), non-forced event arming when a far-future event follows, and the suspend wakeup handler. This stale flag prevents timer rearming and causes system stalls, confirmed by multiple user reports. The vulnerability carries a CVSS 5.5 (Medium) score, is not listed in CISA KEV, and EPSS rates it at 0.02% (5th percentile), placing it firmly in the reliability-defect category rather than active exploitation risk. Patch commit 9401b593fa48218d2667df1610b0ebc518554880 is available in Linux 7.0.1.
Denial of service in Linux kernel ALSA ctxfi audio driver allows local authenticated attackers to crash the system via improper SPDIF1 enumeration during DAIO initialization on hw20k2 hardware. The vulnerability affects kernel versions 6.19 through 7.0 due to a refactoring that loops over all DAIO types including the hw20k2-incompatible SPDIF1 entry, triggering a kernel crash when the undefined hardware info is accessed. Patch available from Linux stable repositories.
Denial of service via divide-by-zero crash in the hwmon OCC (On-Chip Controller) power monitoring driver affects Linux kernels when the power sensor is queried before initial data samples are collected, typically during early boot. Local attackers with unprivileged user privileges can trigger a kernel panic by accessing the affected sysfs power attribute, causing system availability impact. CVSS 5.5 reflects local attack vector and low complexity; EPSS 0.02% indicates low real-world exploitation probability despite the straightforward trigger condition.
Division-by-zero denial of service in Linux kernel's Intel i915 DRM driver when loading on certain machines with DSC (Display Stream Compression) enabled in command mode. The driver incorrectly applies horizontal timing adjustments based on compression ratio in command mode, causing line_time_us to become zero and triggering a kernel panic. Affects Linux kernel versions 5.6 and later; patch available via stable kernel releases.
Kernel NULL pointer dereference in AMD GPU driver on systems with 64KB page sizes allows local authenticated attackers to crash the system by triggering memory allocation mismatches between reserved trap area (8KB) and required allocation size (128KB) during GPU memory initialization. The vulnerability affects systems running ROCm workloads and causes denial of service when executing rocminfo or rccl unit tests on IBM POWER10 and similar 64K-page architectures. EPSS exploitation probability is very low (0.02%), and no public exploit code or active in-the-wild exploitation has been identified.
Denial of service in the Linux kernel's mpu3050 gyroscope driver allows local authenticated attackers to crash the system via incorrect IRQ handler cleanup during module unload. A mismatch between the registered IRQ handler (mpu3050->trig) and the handler passed to free_irq() (mpu3050) causes improper cleanup, leading to resource leaks and potential kernel panic when the device is removed or the driver is unloaded. No public exploit code identified; patch available across affected kernel series.
Resource leak in the Linux kernel MPU3050 gyro driver allows local authenticated users to cause denial of service through memory exhaustion by repeatedly triggering iio_trigger_register() failures that fail to release previously allocated interrupt handlers. The vulnerability affects multiple kernel versions and requires local access with unprivileged user privileges, resulting in potential system availability impact with low real-world exploitation likelihood (EPSS 0.02%).
Memory leak in the Linux kernel's GPIB lpvo_usb driver allows local authenticated users to cause a denial of service through resource exhaustion by repeatedly connecting and disconnecting USB devices, as the driver fails to release USB device references during interface enumeration. The EPSS score of 0.02% indicates minimal real-world exploitation risk despite the moderate CVSS 5.5 severity, reflecting the combination of local-only access requirement, authentication need, and the niche nature of GPIB USB device usage.
A memory leak in the Linux kernel's USB misc usbio driver allows local attackers with low privileges to cause a denial of service by exhausting kernel memory through repeated USB device probe failures. The vulnerability arises when usb_submit_urb() fails during device initialization, leaving allocated URB structures unreleased and accumulating with each failed probe attempt.
Denial of service in Linux kernel USB dwc2 gadget driver allows local authenticated users to trigger a deadlock via improper spin lock handling in dwc2_hsotg_udc_stop(). The vulnerability stems from a locking protocol violation where dwc2_gadget_exit_clock_gating() expects a held lock but is called without one, causing spin_unlock on an unheld lock followed by a lock held indefinitely, resulting in system hang. No public exploit code identified at time of analysis.
Denial of service via NULL pointer dereference in the Linux kernel USB Cadence 3 (cdns3) gadget driver when ep_queue is called on disabled or unconfigured endpoints. A local authenticated attacker can trigger a kernel crash by invoking the vulnerable code path on systems with cdns3 USB gadget support enabled. No public exploit code has been identified, but the attack requires only local access and low privileges (CVSS 5.5, EPSS 0.02%).
A denial of service condition in the Linux kernel's Cadence USB3 (cdns3) gadget driver occurs when gadget initialization fails, leaving the DRD hardware in gadget mode while software state remains inactive. Switching the device to USB host mode via sysfs triggers a synchronous external abort in the xHCI host controller setup, causing a kernel crash. Local authenticated users with access to the USB role-switch sysfs interface can trigger this condition, affecting Linux kernel versions 5.4 through current releases. A patch is available from the Linux kernel project.
NULL pointer dereference in the Linux kernel's auxdisplay line-display driver (linedisp_release()) causes a local denial of service through a kernel panic. The flaw exists because linedisp_release() relies on to_linedisp() - which depends on the device attachment list - but that attachment may already be removed before put_device() invokes the release callback, causing a NULL dereference during resource cleanup. Triggered from linedisp_unregister() or linedisp_register() error paths, exploitation requires local low-privilege access on a system running the auxdisplay module. No public exploit exists and EPSS is 0.02% (5th percentile), confirming this as a stability fix with minimal real-world security urgency.
Denial of service in Linux kernel bridge module via malformed IPv6 Neighbor Discovery options allows local authenticated attackers to crash the system by crafting packets with invalid ND option lengths that cause memory access violations in the br_nd_send() function. The vulnerability affects kernel versions 4.15 and later across multiple stable branches. EPSS exploitation probability is very low at 0.02%, reflecting the requirement for local authenticated access and low attack complexity.
Denial of service in the Linux kernel comedi dt2815 driver allows local authenticated users to crash the system by attaching the driver to arbitrary I/O addresses without actual hardware present via the COMEDI_DEVCONFIG ioctl. The vulnerability occurs when outb() operations are performed on non-existent hardware, triggering page faults under race conditions. A patch adding hardware detection via status register reads prevents the crash.
Memory leak in Linux kernel comedi subsystem allows local privileged users to exhaust kernel memory and cause denial of service. The vulnerability exists in do_cmd_ioctl() where chanlist memory is not properly freed when runflags is not set following an exceptional exit, due to incomplete reference counting logic introduced in commit 4e1da516debb. CVSS 5.5 (local, low complexity, requires user privilege) with EPSS 0.02% indicates this is a lower-priority local DoS affecting systems with comedi driver loaded and untrusted local users.
Null pointer dereference and invalid I/O port writes in the Linux kernel's comedi ni_atmio16d driver occur when the device attach handler fails, causing the detach handler to call reset_atmio16d() with uninitialized device state. Local privileged attackers can trigger a denial of service by causing attach to fail, resulting in kernel memory access violations or writes to address zero. No public exploit code or active exploitation has been identified; patch versions are available from the Linux kernel stable branches.
Memory leak in Linux kernel s390/zcrypt subsystem allows local authenticated attackers to exhaust memory resources by repeatedly using CCA cards as accelerators for clear key RSA requests (ME and CRT operations). The vulnerability stems from incomplete refactoring where AP message allocations via ap_init_apmsg() are not properly freed in two code paths, causing heap memory exhaustion over time and enabling denial of service on s390 systems with CCA cryptographic hardware.
Denial of service in Linux kernel energy model netlink handler allows local authenticated attackers to crash the system via NULL pointer dereference when requesting non-existent performance domain IDs. The dev_energymodel_nl_get_perf_domains_doit() function fails to validate the return value from em_perf_domain_get_by_id() before dereferencing the performance domain structure, causing immediate kernel panic when an invalid domain ID is supplied. EPSS exploitation probability is very low (0.02%, 5th percentile), and no public exploit code or active exploitation has been identified.
Denial of service via runtime PM usage count underflow in the rz-mtu3-cnt counter driver allows local privileged users to disable hardware counters and trigger kernel warnings by repeatedly writing to the sysfs enable file. Multiple writes of the same value (0 or 1) to the enable attribute cause the runtime PM reference count to become misaligned with actual hardware state, leading to register access with clocks disabled and potential PWM channel conflicts. EPSS exploitation probability is minimal (0.02%) despite local access requirement, indicating this is primarily a local reliability issue rather than a remote attack vector.
Denial of service in Linux kernel counter driver (rz-mtu3-cnt) allows local attackers with low privileges to crash the system by exploiting a race condition where counter and PWM sub-drivers overwrite a shared device pointer, causing incorrect runtime power management operations. The vulnerability affects kernel versions prior to specific patch levels across the 6.x and 7.x branches, with EPSS exploitation probability of 0.02% indicating low real-world exploitation likelihood despite the availability of a vendor patch.
Denial of service in Linux kernel VXLAN module allows local authenticated attackers to crash the system via malformed IPv6 neighbor discovery options in vxlan_na_create(). A crafted ND option with incorrect length values can cause out-of-bounds access or undersized payload reads, triggering a kernel panic. EPSS exploitation probability is low at 0.02%, but the vulnerability is confirmed patched across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12).
Memory leaks in the ftgmac100 Ethernet driver's ring allocation function allow local authenticated users to cause a denial of service through resource exhaustion on driver initialization failure. The vulnerability is triggered when ftgmac100_alloc_rings() fails during intermediate allocation stages, returning directly without freeing previously allocated resources (rx_skbs, tx_skbs, rxdes, txdes, rx_scratch). This affects Linux kernel versions prior to fixes released in stable branches 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0.
Denial of service via NULL pointer dereference in the MediaTek Ethernet PPE (packet processing engine) driver occurs when gmac0 (the primary ethernet interface) is disabled on affected systems. A local authenticated attacker can trigger a kernel crash by sending traffic through the networking stack when the driver incorrectly checks for a valid ingress device without verifying if the first network device pointer is actually initialized. The vulnerability affects Linux kernel versions prior to fixes released in stable branches 6.18.22, 6.12.81, 6.19.12, and 7.0.
Denial of service in Linux kernel scheduler extension (sched_ext) allows local privileged attackers to crash systems by triggering incorrect task migration validation. The vulnerability exists in the is_bpf_migration_disabled() function, which fails to correctly identify migration-disabled tasks on non-PREEMPT_RCU configurations, potentially dispatching such tasks to remote CPUs and triggering kernel errors in task_can_run_on_remote_rq(). EPSS exploitation probability is very low at 0.02%, but CVSS 5.5 indicates local attackers with standard user privileges can cause denial of service.
A denial of service condition in the Linux kernel scheduler extension (sched_ext) subsystem allows local authenticated attackers to trigger a kernel warning and potential crash via improper handling of stale direct dispatch state in the ddsp_dsq_id field. When a task's direct dispatch verdict is not properly cleared across all code paths that consume or cancel such verdicts, a subsequent wakeup operation calling ops.select_cpu() with scx_bpf_dsq_insert() triggers a spurious WARN_ON_ONCE() in mark_direct_dispatch(), exposing the availability impact of the vulnerability. The issue affects Linux kernels with sched_ext enabled and requires local access with low privilege (non-root user capable of triggering task scheduling operations).
Resource leaks in the Linux kernel GPIO subsystem allow local attackers with low privileges to cause denial of service through memory exhaustion during gpiochip initialization error handling. The vulnerability arises from improper reference counting in gpiochip_add_data_with_key() after device initialization, where error paths fail to release device references, leading to memory not being freed on function failure. CVSS 5.5 with EPSS 0.02% indicates low real-world exploitation probability despite local attack vector.
A race condition in the USB gadget ethernet driver (usb: gadget: u_ether) between gether_disconnect() and eth_stop() causes a NULL pointer dereference and system hardlockup on local systems with low privilege users. When eth_stop() is triggered concurrently during gether_disconnect(), it attempts to access a cleared endpoint descriptor, crashing while holding a spinlock that gether_disconnect() also needs, resulting in kernel panic and denial of service. CVSS 4.7 with low EPSS score (0.02%, percentile 7%) indicates limited real-world exploitation likelihood despite confirmed availability of vendor patches across multiple stable kernel branches.
NULL pointer dereference in the USB Ethernet gadget driver (u_ether) allows local attackers with low privileges to cause a denial of service by querying device information via ethtool during device unbind. The vulnerability occurs when userspace tools call eth_get_drvinfo() on a gadget interface after the kernel has cleared the gadget pointer during device reparenting, triggering a crash without authentication or user interaction. EPSS exploitation probability is minimal (0.02%), and this is a localized denial of service with no impact on confidentiality or integrity.
A NULL pointer dereference in the Linux kernel USB gadget UVC (USB Video Class) driver during power management transitions allows local authenticated attackers with low privileges to cause a kernel panic and denial of service. The vulnerability occurs when the PM subsystem freezes user space processes during suspend, causing wait_event_interruptible_timeout() to abort early in uvc_function_unbind(), which nullifies the gadget pointer. When tasks are restarted, the V4L2 release path attempts to access the already nullified pointer, triggering a kernel panic. Patches are available across multiple kernel versions (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0).
Denial of service in the Linux kernel USB gadget ECM (Ethernet Control Model) driver allows local authenticated attackers to crash the system by exploiting improper net_device lifecycle management during bind and unbind cycles. When the gadget device unbinds, the network device survives with dangling sysfs symlinks, causing kernel issues when accessed or when the device tree is traversed. The vulnerability affects Linux kernel versions prior to patches released in 6.12.81, 6.18.22, 6.19.12, and 7.0.
Denial of service in Linux kernel USB gadget EEM function allows local privileged attackers to crash the system by triggering a dangling sysfs symlink condition during gadget device unbind cycles. The vulnerability arises from improper net_device lifecycle management when the parent gadget device is destroyed while the network device persists, resulting in kernel panic or system instability. CVSS 5.5 reflects local privilege requirement (PR:L) and high availability impact, with EPSS at 0.02% percentile indicating minimal real-world exploitation probability despite patch availability.
USB gadget subsystem net_device lifecycle mismanagement in Linux kernel allows local privileged users to cause denial of service through sysfs corruption. The f_subset gadget function creates dangling sysfs symlinks when unbinding due to improper device reparenting, resulting in inaccessible network device references and potential system instability. A local user with sufficient privileges can trigger unbind/rebind cycles to exhaust resources or corrupt the sysfs filesystem state.
Dangling sysfs symlinks in the Linux kernel's USB gadget f_rndis driver cause availability loss on systems where the RNDIS USB gadget function is used. The net_device object outlives its sysfs parent when the USB gadget unbinds, leaving broken references under /sys/class/net/ that persist until the kernel object is reclaimed. Exploitation is local and requires low-privilege access; no public exploit or active exploitation (CISA KEV) has been identified, and EPSS probability stands at 0.02% (5th percentile), reflecting minimal real-world exploitation interest at time of analysis.
List corruption in the Linux kernel's USB HID gadget driver (f_hid) can crash systems configured with USB gadget functionality. When a user-space process opens /dev/hidg0, registers the file descriptor with epoll, and the UDC (USB Device Controller) is subsequently unbound and rebound, the hidg_bind() function re-initializes wait queues that still contain registered waiters - corrupting the kernel's internal list structures and triggering an availability-impacting kernel panic upon epoll removal. The vulnerability carries a CVSS score of 5.5 (Medium), EPSS of 0.02% (7th percentile), is not listed in CISA KEV, and no public exploit code has been identified at time of analysis.
Missing CAP_NET_ADMIN capability check in the Linux kernel's rtnetlink subsystem allows a local low-privileged user with an unprivileged user namespace to inject network interfaces into arbitrary network namespaces, including the host's init_net. The flaw is in rtnl_newlink(), which validates capabilities only in the caller's namespace but not in the peer namespace when creating paired devices such as veth, vxcan, and netkit. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.02% (4th percentile) reflects very low current exploitation probability, though the impact is rated Availability:High and the vulnerability is relevant to multi-tenant and containerized environments.
Indefinite deadlock in the Linux kernel's igb Gigabit Ethernet driver causes permanent TX queue stall when an AF_XDP zero-copy application is killed abruptly. Affected systems using Intel igb-family NICs (82575, 82576, I350) experience a hang in igb_down() because napi_synchronize() waits for NAPI_STATE_SCHED to clear - a state that igb_clean_rx_irq_zc() prevents from clearing by continuously returning the full NAPI budget after the XSK buffer pool is destroyed. The TX watchdog fires and the network interface becomes permanently unavailable until reboot. No public exploit has been identified (EPSS 0.02%, 4th percentile), and upstream patches are available in stable kernel branches 6.18.23, 6.19.13, and 7.0.
Denial of service in the Linux kernel EDAC (Error Detection and Correction) subsystem due to improper initialization ordering in edac_mc_alloc(). When memory allocation fails during EDAC memory controller initialization, the error path calls put_device() before device_initialize() is executed, triggering a null pointer dereference in kobject_put() that causes a kernel panic or system crash. This affects Linux systems with EDAC support enabled across multiple kernel versions from 5.19 through 7.0.
Denial of service in Linux kernel GPIO OMAP driver allows local authenticated users to crash the system via a deadlock condition triggered by improper driver registration from probe() callback. The vulnerability stems from registering the omap_mpuio_driver within omap_gpio_probe(), which violates driver core locking rules and creates a potential deadlock when device_lock enforcement was strengthened in commit dc23806a7c47. EPSS score of 0.03% reflects low exploitation probability despite availability of patched kernel versions.
Denial-of-service in the Linux kernel's traffic control `act_csum` module allows a local low-privileged user to crash the kernel by exploiting missing VLAN header validation in `tcf_csum_act()`. Systems running any Linux kernel version from the introducing commit through the stable patch releases (pre-6.12.83, pre-6.18.24, pre-6.19.14) and configured with the `act_csum` tc action on paths carrying nested VLAN-tagged traffic are vulnerable. No public exploit has been identified and EPSS stands at 0.02% (5th percentile), indicating minimal real-world exploitation probability, but the issue is patch-confirmed across multiple stable branches.
Out-of-bounds array access in the Linux kernel's netfilter xt_multiport module enables a local attacker with low privileges to crash the system via a crafted malformed iptables rule. The checkentry validation path for multiport v1 rules fails to verify range encoding, allowing ports_match_v1() to step past the end of the ports[] array when processing rules where the last slot is flagged as a range start or when two consecutive range-start markers appear without an intervening range-end. Exploitation is confined to local actors with CAP_NET_ADMIN capability; no public exploit has been identified and EPSS sits at 0.02% (5th percentile), consistent with the narrow attack surface.
Denial of service in the Linux kernel's AF_ALG crypto socket subsystem allows a local, low-privileged user to crash or hang the system via crafted recvmsg calls. The flaw in af_alg_get_rsgl() causes receive buffer accounting to diverge from actual data attached to skcipher requests - when insufficient RX space remains, the kernel rounds the request length to zero rather than rejecting it, producing an invalid crypto operation. No exploitation has been confirmed (not in CISA KEV) and EPSS is 0.02%, reflecting the narrow local-only attack surface.
Memory leak in the Linux kernel's rt2x00usb WiFi driver allows a local low-privileged user to exhaust kernel memory on systems equipped with Ralink RT2x00-based USB WiFi adapters. The flaw - present since kernel 4.7 - results from USB anchor device-managed resources being incorrectly scoped to the parent USB device rather than the USB interface, so resources are not released when the driver unbinds without a physical device disconnection. No active exploitation is confirmed (not in CISA KEV) and EPSS stands at 0.02% (7th percentile), marking this as a low-urgency stability fix rather than an emergency security response.
Uninitialized kernel memory leaks to userspace through the xfrm_user subsystem's build_report() function in the Linux kernel, exposing three bytes of alignment padding in struct xfrm_user_report via Netlink before it is copied to userspace. The flaw affects virtually all Linux kernel versions from initial commit through the recently issued stable-tree patches (5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, and 7.0). No public exploit has been identified at time of analysis, EPSS sits at just 0.02% (7th percentile), and it is not listed in CISA KEV; however, the breadth of affected systems is enormous given the Linux kernel's ubiquitous deployment.
Local low-privileged users can exhaust system memory on Linux systems by generating unbounded rfkill events without consuming them from the rfkill file descriptor, resulting in a potential out-of-memory condition and system crash. Affected kernel versions span a wide range across multiple stable branches, with fixes backported to 5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, and 7.0. No public exploit code or active exploitation has been identified; the EPSS score of 0.02% (7th percentile) reflects minimal real-world exploitation interest at time of analysis.
Kernel heap memory disclosure in the Linux kernel's xfrm (IPsec) subsystem exposes uninitialized heap bytes to local unprivileged users via netlink multicast. The `build_polexpire()` function omits the `memset_after()` call that its counterpart `build_expire()` correctly applies, leaving trailing padding bytes of `struct xfrm_user_polexpire` uninitialized before broadcasting the structure to XFRMNLGRP_EXPIRE listeners. Any local user able to subscribe to that netlink multicast group on a system running IPsec with expiring policies can capture these notifications and read arbitrary kernel heap contents. No public exploit has been identified at time of analysis, and EPSS is extremely low at 0.02% (7th percentile), indicating negligible automated exploitation activity.
Memory mismanagement in the Linux kernel brcmsmac WiFi driver causes a kernel availability impact through a size mismatch between DMA allocation and deallocation. The brcmsmac driver incorrectly calls dma_free_coherent() with the original requested size rather than the aligned size stored in 'alloced' by dma_alloc_consistent(), which may have grown the allocation during alignment. This affects Linux from version 3.2 (commit 5b435de0) through multiple stable branches, with no public exploit identified at time of analysis and an EPSS score of 0.02% indicating very low exploitation probability.
NULL dereference in the Linux kernel's pn533 NFC driver (pn532_receive_buf) can crash the kernel when a socket buffer allocation fails after bytes have already been consumed from the serial receive stream. Systems running affected kernel versions with PN532/PN533 NFC hardware attached over serial are exposed to a local denial-of-service (kernel panic). No public exploit code exists, EPSS probability is negligible (0.02%, 7th percentile), and this vulnerability is not in the CISA KEV catalog - indicating no confirmed active exploitation.
Memory leak in the Linux kernel's Altera Triple Speed Ethernet (altera-tse) driver allows a local low-privileged user on affected hardware to exhaust kernel memory over time. The flaw in tse_start_xmit() incorrectly signals successful packet transmission to the network stack when DMA mapping fails, preventing socket buffer (skb) cleanup and causing a per-failure memory leak that can escalate to availability loss. No public exploit exists and EPSS at 0.02% (7th percentile) confirms negligible exploitation interest; this is a maintenance-tier fix relevant only to specialized embedded Linux deployments on Altera/Intel FPGA hardware.
System hang exposure in the Linux kernel's i.MX 8MP (imx8mp-blk-ctrl) power management domain driver allows a local attacker with low privileges to trigger a kernel hang on affected NXP i.MX 8M Plus-based systems. The root cause is the NOC_HDCP clock being incorrectly allowed to power down, which causes the NoC ADB400 port power-down handshake to deadlock, resulting in a complete loss of system availability. No public exploit code exists and EPSS is 0.02%, indicating this is a stability defect with low opportunistic exploitation probability, though it carries meaningful availability risk on affected embedded hardware.
Memory leak in the Linux kernel's __mmap_region() function allows a local low-privileged user to incrementally exhaust kernel slab memory, potentially causing denial of service. Introduced as a regression by commit 605f6586ecf7, the bug leaves a shmem file object unreferenced when mmap() on /dev/zero with MAP_SHARED fails mid-way through VMA setup - the replacement file allocated by shmem_zero_setup_desc() is never released via fput(). No public exploit exists and EPSS sits at 0.02%, making this a low-urgency but genuine availability risk for affected kernel versions; patched upstream in stable commits 61fc8eaf and 894f99eb.
Memory leak in the Linux kernel's DAMON (Data Access MONitor) sysfs subsystem allows a local low-privileged user to exhaust kernel memory by triggering a race condition between process termination and damon_call() invocation. When DAMON is configured to monitor virtual address spaces and the target process exits before damon_call() executes, the dynamically allocated repeat_call_control structure is never freed. No public exploit exists and EPSS is 0.02% (4th percentile), placing this firmly in the low-urgency tier despite the high availability impact scored by CVSS.
NULL pointer dereference in the Linux kernel vub300 USB MMC driver allows a local authenticated attacker to crash the kernel by disconnecting a VUB300-based USB MMC adapter while the driver is active. The disconnect handler releases the driver data reference before deregistering the MMC controller, creating a window for NULL dereference or use-after-free that results in a kernel panic and denial of service. No active exploitation has been confirmed - EPSS is 0.02% (7th percentile) and the vulnerability is absent from the CISA KEV catalog.
Denial of service via kernel panic in the Linux kernel idpf NIC driver arises from invalid spinlock nesting in the async virtchannel message handler, most critically on PREEMPT_RT-enabled kernels. The idpf_mac_filter_async_handler acquires a BH spinlock while the workqueue thread already holds the raw spinlock embedded in the completion primitive of idpf_vc_xn, violating PREEMPT_RT lock context rules and triggering a kernel BUG that crashes the system. No public exploit identified at time of analysis; EPSS is 0.02%, indicating negligible observed exploitation interest for this narrow driver-level locking defect.
Null pointer dereference in the Linux kernel's lan966x FDMA network driver crashes the kernel when page_pool_create() fails during receive pool initialization. Affected systems running lan966x network controller hardware can be brought down by a local low-privileged user who triggers a page pool allocation failure, resulting in a kernel oops via dereference of an ERR_PTR in xdp_rxq_info_reg_mem_model(). No public exploit or active exploitation (CISA KEV) has been identified; EPSS at 0.02% (5th percentile) confirms negligible observed exploitation activity.
Page pool memory leaks in the Linux kernel's lan966x FDMA (Flexible DMA) network driver cause resource exhaustion when DMA allocation failures occur during driver initialization, affecting systems built on Microchip lan966x Ethernet switch hardware. The missing `page_pool_destroy()` calls in two distinct error paths - inside `lan966x_fdma_rx_alloc()` and `lan966x_fdma_init()` - allow allocated pools to persist indefinitely if initialization fails, potentially degrading host availability. With an EPSS of 0.02% and no public exploit or KEV listing, this is a low-priority maintenance issue with real-world impact limited almost exclusively to embedded and industrial Linux deployments running this specific controller hardware.
Memory exhaustion in the Linux kernel's rxrpc subsystem allows a local low-privileged user to degrade system availability by repeatedly triggering a key parsing error path that leaks kernel memory. The flaw exists in rxrpc_preparse_xdr_yfs_rxgk(), where allocations for token->rxgk are not freed on certain error branches before jumping to reject_token. With EPSS at 0.02% (5th percentile) and no CISA KEV listing, real-world exploitation is assessed as low-probability and operationally constrained to systems actively using AFS/YFS rxrpc authentication.
Infinite-loop denial of service in the Linux kernel's rxrpc subsystem allows a local low-privileged user to hang a process indefinitely by reading /proc/net/rxrpc/calls while concurrent rxrpc call teardown occurs. The root cause is use of list_del_init() instead of the RCU-safe list_del_rcu() during call removal from rxnet->calls, leaving the list in a state that confuses RCU readers into endless traversal. No public exploit exists and EPSS sits at the 5th percentile, reflecting the combination of local-only access and the niche deployment footprint of rxrpc.
Reference count leak in the rxrpc subsystem of the Linux kernel allows a local low-privilege user to exhaust kernel keyring resources, causing denial of service. The flaw exists in rxrpc_alloc_client_call(), which acquires a reference to call->key but never releases it in rxrpc_destroy_call(), causing the key reference counter to increment indefinitely across repeated client call creation and destruction. EPSS at 0.02% (5th percentile) and no KEV listing confirm this carries negligible real-world exploitation urgency; no public exploit is identified at time of analysis.
Reference count leak in the Linux kernel's rxrpc subsystem (`rxrpc_server_keyring()`) causes progressive kernel resource exhaustion when `rx->securities` is already initialized and the extra reference is not decremented. Affected kernels span from version 2.6.22 through multiple stable branches, with fixes backported to 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, and 7.0. No public exploit identified at time of analysis, and EPSS sits at 0.02% (7th percentile), reflecting niche real-world exploitation probability despite the kernel's ubiquitous deployment footprint.
Memory exhaustion in the Linux kernel's rxrpc/rxgk subsystem allows a local low-privileged attacker to cause a denial-of-service condition by triggering a resource leak in rxgk_verify_response(), where allocated rxgk authentication context objects are never released. The flaw is confined to systems actively using AFS with RxGK GSS-based authentication, a non-default configuration absent from the vast majority of Linux deployments. No public exploit code exists and exploitation probability is extremely low (EPSS 0.02%), though patched stable kernel versions 6.18.23, 6.19.13, and 7.0 are available.
Cross-thread information disclosure in the Linux kernel on AMD Zen1 processors allows a low-privileged local attacker to harvest partial floating-point division results belonging to a concurrently executing victim thread. Zen1's hardware FP divider fails to fully clear intermediate state between operations, creating a side-channel leakage path exploitable by any unprivileged thread sharing the same physical CPU core. No public exploit code has been identified and CISA has not added this to the KEV catalog, but the vulnerability affects all Linux versions from inception through multiple stable branches, with patches now available across eight stable series (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 6.19, 7.0).
NULL pointer dereference in the Linux kernel hid-alps driver crashes systems with Alps HID touchpad hardware when raw events are processed before the device is fully claimed. Local low-privileged users on affected systems can trigger a kernel panic, causing a denial of service. No public exploit exists (EPSS 0.02%, 5th percentile) and no KEV listing has been issued; however, patches are confirmed across multiple stable branches including 6.12.83, 6.18.24, 6.19.14, and 7.0.1.
Shift-out-of-bounds vulnerability in Linux kernel HID core driver allows local authenticated attackers to cause denial of service via crafted HID device report descriptors with oversized fields that trigger undefined bit-shift operations in the s32ton() function. A malicious or malfunctioning HID device can supply a report_size value up to 256, causing shifts on 32-bit integers with exponents exceeding safe limits, crashing the kernel or triggering undefined behavior. CVSS 5.5 reflects local-only attack vector with low complexity and requirement for user/driver privileges to process HID output reports.
Denial of service via skb_shared_info->frags[] buffer overflow in the CDC Phonet USB driver allows local attackers with USB device access to crash the kernel by sending unbounded sequences of full-page bulk transfers. A malicious or compromised USB modem device can trigger this overflow without authentication or user interaction. The vulnerability has a low EPSS score (0.02%) despite moderate CVSS (5.5), indicating exploitation requires specific local USB hardware control.
Null pointer dereference in Linux kernel bnge driver occurs when auxiliary_device_add() fails and the error handling path omits a return statement after auxiliary_device_uninit(), causing subsequent code to dereference a freed and nullified auxr_dev pointer. Local users with limited privileges can trigger kernel panic (denial of service) by inducing auxiliary device initialization failure. EPSS score of 0.02% reflects low real-world exploitation probability despite availability of vendor patches in stable branches 6.19.14 and 7.0.1.
Null pointer dereference in the ALSA TASCAM US-144MKII USB audio driver allows local attackers with physical access to a malicious USB device to cause a kernel panic and denial of service. The vulnerability exists because the driver fails to validate that USB interface 0 exists before dereferencing it, and attackers can craft a malicious USB configuration that includes only interface 1, triggering the crash when the device is connected.
Denial of service via out-of-bounds string lookup in Linux kernel ALSA fireworks driver allows local authenticated users to crash the system by supplying an invalid status value from a firewire device. The vulnerability stems from insufficient bounds checking on a 32-bit status field before array indexing into a 17-entry string table, enabling memory access violations when the device reports unexpected values including EFR_STATUS_INCOMPLETE (0x80000000).
Divide-by-zero denial of service in Linux kernel framebuffer driver tdfxfb allows local authenticated users to crash the system by issuing a malformed FBIOPUT_VSCREENINFO ioctl with zero pixclock value. The vulnerability affects the framebuffer video mode setting functionality when pixclock is used directly in division operations without validation, triggering a kernel panic.
Integer underflow in the Linux kernel's USB NCM gadget driver allows a malicious USB host to bypass buffer boundary checks and copy adjacent kernel memory into network packet buffers. The vulnerability exists in ncm_unwrap_ntb() where block_len values smaller than the NDP size cause unsigned integer underflow in bounds validation, enabling out-of-bounds memory read and potential information disclosure. Affected versions prior to Linux 6.12.83, 6.18.24, 6.19.14, and 7.0.1 require patching; exploitation requires local USB device attachment or administrative USB gadget configuration.
Memory corruption via skb fragment array overflow in the USB Phonet gadget driver allows local attackers with device-level USB host capabilities to cause denial of service. The vulnerability exists in pn_rx_complete() which fails to enforce the MAX_SKB_FRAGS limit when processing unbounded full-page OUT transfers, causing heap memory corruption adjacent to the skb_shared_info structure. A malicious or misconfigured USB host sending continuous PAGE_SIZE byte transfers triggers the flaw in gadgets exposing the Phonet function, confirmed fixed in Linux 6.12.83, 6.18.24, 6.19.14, and 7.0.1.
Null pointer dereference in the Renesas USB3 gadget driver allows local authenticated attackers to trigger a denial of service by sending crafted USB standard requests with invalid endpoint indices that bypass validation in GET_STATUS and SET/CLEAR_FEATURE handlers. The vulnerability affects multiple stable kernel versions and requires local access with user-level privileges, resulting in potential system crash or service disruption.
Memory leak in the Linux kernel ksmbd SMB server subsystem allows pre-authenticated remote clients to exhaust kernel memory by repeatedly sending malformed SPNEGO/ASN.1 BER blobs. The ksmbd_decode_negTokenInit() function allocates a mechToken buffer mid-parse via kmemdup_nul(), but if a subsequent element in the same blob is malformed (e.g., mechListMIC[3] overrunning its enclosing SEQUENCE), the decoder fails and clears use_spnego, causing the cleanup gate at smb2_sess_setup() to skip kfree() - leaking the allocation. No public exploit code has been identified at time of analysis, and EPSS sits at 0.03% (10th percentile), consistent with a slow-burn DoS rather than an immediately weaponizable condition.
Kernel oops and denial of service in the Linux kernel USB gadget HID driver (`f_hid`) occurs when `cdev_init` reinitializes an in-use character device during a USB gadget unbind/rebind cycle while `/dev/hidg*` remains open. A local attacker with low privileges who holds a file descriptor to `/dev/hidg0` open during a rebind operation can trigger a kernel oops, crashing the affected system. No public exploit exists and EPSS probability is 0.02% (5th percentile), indicating negligible exploitation interest; however, patched kernel versions are available across multiple stable branches.
Divide-by-zero crash in the Linux kernel's udlfb (USB DisplayLink framebuffer) driver allows a local low-privileged user to trigger a kernel panic via the FBIOPUT_VSCREENINFO ioctl when pixclock is zero. The flaw, classified CWE-369, mirrors an identical class of defect previously corrected in the fb_pm2fb driver (commit 19f953e74356). Patched kernel versions are available across multiple stable branches; no public exploit or active exploitation has been identified at time of analysis.
Resource leak in the Linux kernel rtw88 USB WiFi driver allows a local attacker with low privileges to cause system availability degradation by triggering repeated probe failures that leave unreleased USB device references. The driver increments the USB device reference count during probe but fails to decrement it on all error exit paths - specifically when descriptor parsing fails - resulting in CWE-401 reference leaks that accumulate over time. No public exploit exists and EPSS is at the 6th percentile (0.02%), indicating negligible exploitation probability; the real-world impact is constrained to systems with Realtek rtw88 USB WiFi adapters.
Division-by-zero in the sm750fb staging framebuffer driver allows a local low-privileged user to crash the kernel. By submitting a FBIOPUT_VSCREENINFO ioctl with pixclock set to zero, an attacker triggers an unvalidated division in ps_to_hz(), called from hw_sm750_crtc_set_mode(), resulting in a kernel panic and full denial of service. No public exploit code has been identified and EPSS is 0.02% (5th percentile), consistent with a locally-reachable, hardware-dependent crash with no remote or confidentiality impact.
Kernel panic in the Linux xe/vfio driver causes a denial-of-service when a reset is triggered on SR-IOV Virtual Function (VF) devices that do not support live migration. The xe_vfio_pci_core_device struct members required by reset handling are only initialized during migration setup, leaving them NULL for non-migration VFs; writing to the sysfs reset attribute of such a VF dereferences the uninitialized pointer and crashes the kernel. No public exploit has been identified, EPSS is 0.02% (5th percentile), and exploitation requires a narrow hardware and configuration prerequisite - Intel Xe GPU with SR-IOV and VFIO passthrough enabled.
NULL pointer dereference in the Linux kernel's vidtv virtual DVB-T test driver allows a local low-privileged user to crash the kernel, resulting in a denial-of-service. The flaw resides in vidtv_channel_pmt_match_sections(), which calls vidtv_psi_pmt_stream_init() without validating whether the return value is NULL on memory allocation failure; a subsequent field access on the NULL pointer triggers a general protection fault. No public exploit or active KEV-listed exploitation exists; EPSS at 0.02% (5th percentile) reflects negligible real-world exploitation probability.
Kernel panic in the Linux kernel's ocfs2 (Oracle Cluster File System 2) resize path allows a local low-privileged user to crash the system via a crafted filesystem image. The ocfs2_group_extend() function in fs/ocfs2/resize.c:308 unconditionally asserts that the global bitmap buffer contains a valid dinode signature using BUG_ON, but the JBD2 journaling layer's buffer path bypasses structural validation, permitting an invalid dinode to reach the resize ioctl and trigger a kernel BUG. No active exploitation is confirmed (not in CISA KEV), and EPSS stands at 0.02% (5th percentile), reflecting minimal exploitation activity; patches are available across multiple stable kernel branches.
Kernel panic in the Linux pci-epf-vntb driver allows a local low-privileged user to crash the system by triggering a race between the delayed cmd_handler work queue and the epf_ntb_epc_cleanup teardown path. When cleanup frees BAR mappings and doorbells without first canceling the pending work, the handler subsequently dereferences invalid virtual addresses and produces a fatal kernel oops. Affected systems are limited to those with PCIe NTB endpoint hardware and the pci_epf_vntb module loaded; no public exploit exists and EPSS is 0.02%, reflecting negligible exploitation probability.
Kernel crash (oops) in the Linux PCI endpoint virtual NTB (pci-epf-vntb) driver allows a local user with limited privileges to trigger a use-after-free via configfs symlink operations. The driver's epf_ntb_epc_destroy() helper performs resource teardown that duplicates what the caller later executes, causing a double-free that dereferences a kernel poison pointer (0xDEAD000000000108) and crashes the system. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.02% (4th percentile), and impact is purely availability - confidentiality and integrity are not affected.
Host kernel panic in Linux KVM's AMD SEV-SNP subsystem allows a local attacker with KVM device access to crash the host by issuing a VMSA synchronization ioctl after a vCPU has already been launched and its VMSA encrypted. On SNP-enabled hosts, this write access violates the Reverse Map Table (RMP) hardware protection, producing an unrecoverable RMP page fault that panics the host kernel and terminates all co-located guest VMs simultaneously. No public exploit or active exploitation has been identified; vendor-released patches are available for stable kernel series 6.12.83, 6.18.24, 6.19.14, and 7.0.1.
Null pointer dereference in the Linux kernel's KVM SEV subsystem crashes the host with a kernel panic when a low-privileged local user issues a specific ioctl sequence. The missing `kvm->lock` acquisition before the `sev_guest()` check in `sev_mem_enc_register_region()` allows exploitation when `KVM_SEV_INIT{2}` fails and leaves `sev->regions_list` uninitialized - a subsequent `KVM_MEM_ENCRYPT_REG_REGION` ioctl then dereferences the null list head. No confirmed active exploitation (not in CISA KEV), but a syzbot-generated reproducer is embedded in the CVE description; EPSS is 0.02% (4th percentile), consistent with the local-only, denial-of-service nature. Patched kernel versions 6.18.24, 6.19.14, and 7.0.1 are available.
Kernel crash risk in Linux KVM's AMD SEV-SNP guest launch path allows a local attacker with KVM vCPU management privileges to crash the host by exploiting a missing vCPU lock during VMSA synchronization. The SEV-SNP `KVM_SNP_LAUNCH_FINISH` path failed to lock all vCPUs before encrypting their save areas, permitting concurrent userspace manipulation that corrupts per-vCPU state or triggers a kernel panic. No public exploit code has been identified and the EPSS score of 0.02% (4th percentile) reflects extremely low exploitation probability, making this a targeted concern for AMD EPYC-based KVM hypervisors running SNP guests.
Denial-of-service in the Linux kernel KVM SEV subsystem allows a local low-privileged user to trivially trigger a kernel WARN in sev_pin_memory() by submitting a crafted KVM_MEMORY_ENCRYPT_REG_REGION ioctl with an oversized region (e.g., size set to the maximum u64 value), causing npages to overflow a signed int. On kernels configured with panic_on_warn=1, this directly results in a kernel panic and full system crash. No public exploit has been identified at time of analysis and CISA has not added this to the KEV catalog, though the CVE description itself provides a working proof-of-concept reproducer.
State corruption and memory leak in the Linux kernel's vidtv virtual DVB test driver allow a local low-privileged user to cause kernel memory exhaustion. When vidtv_start_streaming() fails inside vidtv_start_feed(), the nfeeds counter is incremented but never rolled back, desynchronizing driver state so that subsequent start calls skip mux initialization and stop calls exit early without freeing partially allocated mux and channel resources. No public exploit exists and EPSS is 0.02% (5th percentile), reflecting the niche nature of the affected test driver component.
Deadlock in the Linux kernel WireGuard subsystem can cause a hung task and system-level denial of service for authenticated local users. The `wg_netns_pre_exit()` pernet callback manually acquires `rtnl_lock()`, blocking indefinitely if `rtnl_mutex` is concurrently held by the `cleanup_net` workqueue or `setup_net` failure rollback path. No public exploit exists and EPSS is extremely low (0.02%, 4th percentile); however, the issue spans a broad range of kernel versions and has been patched in stable releases 6.18.24, 6.19.14, and 7.0.1.
NULL pointer dereference in the Linux kernel's nilfs2 filesystem driver allows a local, low-privileged attacker to crash the kernel by invoking the NILFS_IOCTL_CLEAN_SEGMENTS ioctl immediately after mounting a nilfs2 filesystem, before the DAT inode's btree node cache is lazily initialized. The impact is a general protection fault and full denial of service; no confidentiality or integrity impact is possible. No public exploit is known at time of analysis, and EPSS at 0.02% (5th percentile) reflects extremely low real-world exploitation probability.
Race condition in the Linux kernel's userfaultfd hugetlb path allows a local low-privilege user to crash the kernel by triggering a BUG_ON assertion in resv_map_release(). The root cause is a unit mismatch in mfill_atomic_hugetlb(): linear_page_index() returns a PAGE_SIZE-unit index while hugetlb_fault_mutex_hash() expects a huge-page-granularity index, causing concurrent fault threads within the same huge page to acquire different mutexes and corrupt the reservation map. No public exploit has been identified and EPSS is 0.02% (4th percentile), placing real-world risk firmly in the low tier despite reliable kernel crash reproducibility under the right conditions.
Timer interrupt starvation in the Linux kernel clockevents subsystem results from the `next_event_forced` flag not being reset across three distinct code paths: clock event state transitions (shutdown/startup), non-forced event arming when a far-future event follows, and the suspend wakeup handler. This stale flag prevents timer rearming and causes system stalls, confirmed by multiple user reports. The vulnerability carries a CVSS 5.5 (Medium) score, is not listed in CISA KEV, and EPSS rates it at 0.02% (5th percentile), placing it firmly in the reliability-defect category rather than active exploitation risk. Patch commit 9401b593fa48218d2667df1610b0ebc518554880 is available in Linux 7.0.1.