Linux
Monthly
Kernel panic in the Linux hantro_vpu media driver (verisilicon subsystem) allows a local low-privileged user to crash the system by triggering a device probe deferral or unbind-bind cycle on affected NXP i.MX8MQ hardware. The root cause is an incorrect __initconst annotation on the imx8mq_vpu_shared_resources array, which causes the kernel to free that data after module initialization while variant structures retain a live pointer to it; subsequent probe calls dereference freed memory and fault. No public exploit or PoC exists and this CVE is not in CISA KEV; the EPSS score of 0.02% (5th percentile) confirms negligible real-world exploitation probability.
NULL pointer dereference in the Linux kernel's i2c:designware:amdisp driver exposes AMD ISP-equipped systems to a local denial-of-service via a race condition between runtime PM resume and driver probe. The race exists because pm_runtime_get_sync() called before i2c_dw_probe() triggers PM resume, which powers on the ISP and simultaneously invokes the amdisp i2c runtime resume callback before probe initialization is complete - dereferencing an uninitialized pointer and causing a kernel panic. The flaw predates its detection but became reproducible in kernel v7.0 after commit 38fa29b01a6a reorganized init functions; no public exploit identified at time of analysis.
State ordering regression in the Linux kernel's drm/i915 Intel graphics driver causes unlink_nv12_plane() to clobber plane state already computed by plane_atomic_check(), resulting in a kernel WARN and availability disruption on systems with Intel i915 GPUs. The flaw affects local users with DRM device access who configure a plane previously used as an NV12 Y plane back to a normal plane. No public exploit exists and EPSS sits at 0.02% (4th percentile), confirming this as a low-probability exploitation scenario; however, the patch is available across multiple stable kernel branches.
Spurious WARN_ON() in the Linux kernel's PM sleep subsystem (pm_restore_gfp_mask()) can be triggered by defensive hibernation code paths, causing kernel warning floods or, on systems with panic_on_warn=1, a full kernel panic and denial of service. Affected kernels contain commit 35e4a69b2003f introducing refcount-based GFP mask stacking but lack the corrective fix removing the assertion from the zero-count guard. No active exploitation confirmed (not in CISA KEV), and EPSS is 0.02% (4th percentile), consistent with a low-risk code-quality defect rather than a targeted vulnerability.
Deadlock in the Linux kernel's RDMA/irdma subsystem (CVE-2026-31565) causes an indefinite system hang when a netdev reset is performed on Intel ice Ethernet hardware while active RDMA/iWARP applications hold Queue Pair connections. The ice driver's removal of the irdma auxiliary driver triggers a circular dependency: uverbs_client waits for QP reference count to reach zero while cma_client holds the final reference in iWARP mode, neither releasing first. No public exploit has been identified at time of analysis; an EPSS of 0.02% (7th percentile) and absence of CISA KEV listing confirm this is currently a low exploitation-priority issue concentrated in HPC and data center environments with Intel RDMA hardware.
Pointer arithmetic type confusion in the Linux kernel's LoongArch KVM EIOINTC register access handler allows a local low-privileged attacker to crash the host kernel. The function kvm_eiointc_regs_access() stores the register array base address as a u64 rather than a void pointer, causing byte offsets to be scaled incorrectly during address calculation and producing out-of-bounds memory accesses that result in a kernel panic. No public exploit code exists and EPSS sits at 0.02%, consistent with the narrow LoongArch KVM attack surface; the vulnerability is not listed in CISA KEV.
NULL pointer dereference in the Linux kernel's MediaTek DSI DRM driver causes a kernel panic during module initialization on ARM64 systems with MediaTek display hardware. The crash occurs because `mipi_dsi_host_register` triggers the `mtk_dsi_bind` callback before the `mtk_dsi` struct is stored in driver data, dereferencing a NULL pointer inside `drm_mode_object_add` and acquiring `mode_config.idr_mutex` before panicking - blocking all subsequent DRM operations on the system. No public exploit exists and EPSS stands at 0.02%, consistent with a hardware-specific local denial-of-service with no confidentiality or integrity impact.
The Linux kernel's x86 FRED (Flexible Return and Event Delivery) initialization path crashes AMD SEV-ES, SEV-SNP, and Intel TDX confidential VM guests via triple fault when any exception is triggered during the brief AP initialization window before FRED MSRs are configured. A prior attempted mitigation introduced a secondary risk: temporarily disabling CR4 pinning for offline CPUs created a path where a local attacker could flip a single RW-memory bit (the CPU online flag) to suppress CR4 security controls and disable SMEP/SMAP protections. No public exploit has been identified at time of analysis; EPSS is 0.02% (5th percentile), consistent with the narrow real-world exploitability of this flaw.
Null pointer dereference in the Linux kernel's spi-dw-dma driver crashes the system when an error occurs during a DMA transaction and the current SPI message pointer is NULL at the time error-log printing is attempted. Systems running the DesignWare SPI DMA driver are exposed to a local denial-of-service condition triggerable by a low-privileged user. No public exploit exists and EPSS probability is 0.02% (5th percentile), indicating negligible current exploitation interest; however, the crash path is deterministic once the error condition is induced.
Null pointer dereference in the Linux kernel's LoongArch architecture code can crash the kernel during early boot when kstrdup() fails to allocate memory while parsing CPU model strings from the device tree. Affected systems running unpatched kernels on LoongArch hardware may experience a kernel oops and complete system unavailability if memory is exhausted at boot time. No public exploit exists and EPSS is 0.02% (6th percentile), reflecting very low exploitation probability; this is not listed in CISA KEV.
Missing lock release in the Linux kernel's XFS quota scrub subsystem allows a local, low-privileged user to trigger a dquot lock leak that can cause deadlocks in subsequent quota operations. The flaw exists in xchk_quota_item, which can exit early after xchk_fblock_process_error without releasing dq->q_qlock. This denial-of-service condition affects kernels from the introducing commit 7d1f0e167a06 through the respective stable branch fix points; no public exploit exists and EPSS is at the 5th percentile, indicating low real-world exploitation probability.
Stale pointer dereference in the Linux kernel's futex Priority Inheritance lock path (futex_lock_pi(), kernel/futex/core.c) exposes systems running affected kernel versions to local denial of service by low-privileged users. The flaw manifests in a three-way race between a PI futex owner exiting, a concurrent FUTEX_LOCK_PI attempt, and a futex value modification - causing a freed task_struct pointer to be re-used on the retry path, violating the wait_for_owner_exiting() invariant and triggering WARN_ON_ONCE. No active exploitation is confirmed (EPSS 0.02% at 7th percentile, not in CISA KEV); vendor-released patches are available across all maintained stable LTS branches.
Race condition in the Linux kernel's mac80211 WiFi subsystem allows a local low-privileged attacker to trigger a static_branch_dec() integer underflow via concurrent writes to the AQL debugfs control file, causing a kernel WARNING and potential availability impact. Affected kernels span from the introduction of the aql_disable static key (v5.12) through multiple stable branches, with fixes backported to 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, and 7.0. EPSS is 0.02% (7th percentile) and no active exploitation is recorded in CISA KEV, placing this firmly in the low-real-world-risk category despite its availability impact.
Insufficient ASB polling timeout in the Linux kernel's bcm2835-power pmdomain driver intermittently fails to complete the V3D AXI Slave Bridge handshake on BCM2711 hardware during runtime PM suspend, leaving the VideoCore 3D GPU in a broken power state. Systems running intensive V3D workloads on BCM2711 (e.g., Raspberry Pi 4) may subsequently experience bus faults or full system hangs on later GPU accesses. No public exploit code exists and EPSS is 0.02% (7th percentile), consistent with a hardware-specific reliability defect rather than a broadly exploitable security attack; the vulnerability is not in CISA KEV.
NULL pointer dereference in the Linux kernel's cp2615 i2c driver crashes the kernel when a USB device lacking a serial number string is probed, resulting in denial of service. The cp2615 driver unconditionally uses the USB serial string as the i2c adapter name without first verifying the pointer is non-NULL, a flaw exploitable by connecting a crafted or malformed CP2615 USB-to-I2C bridge device. No active exploitation is confirmed (not in CISA KEV) and the EPSS score of 0.02% at the 7th percentile reflects negligible exploitation interest; impact is limited to availability with no code execution or data exposure possible.
Missing runtime power management reference in the Linux kernel's Intel Xe GPU driver (drm/xe) allows a local low-privileged user to trigger a kernel WARNING and cause system instability via the ccs_mode sysfs attribute. When ccs_mode_store() invokes xe_gt_reset() without first acquiring an outer runtime PM reference, the internal xe_pm_runtime_get_noresume() call detects the unprotected state and emits a kernel WARNING, with potential for device reset failures and availability loss. No public exploit code exists and EPSS is 0.02%, consistent with a driver correctness bug rather than a targeted security vulnerability; patches are available in stable kernel trees.
NULL pointer dereference in the Linux kernel bonding driver's RLB debug interface allows a local low-privileged user to crash the kernel, causing a denial of service. Specifically, bond_debug_rlb_hash_show in bond_debugfs.c dereferences client_info->slave without a NULL guard - a condition intentionally created by rlb_clear_slave when no replacement bonding slave is available - producing a BUG: kernel NULL pointer dereference at address 0x0. Affected across multiple stable kernel trees from 5.10.x through 7.0; no public exploit code exists and EPSS is 0.02%, consistent with low opportunistic risk, though Siemens PSIRT has issued downstream advisories (SSA-019113, SSA-082556) indicating industrial/embedded impact.
The NXP-NCI NFC driver in the Linux kernel triggers a kernel WARN_ON and fails to operate correctly when firmware and enable GPIOs are routed through I2C GPIO expanders, causing denial of service to NFC subsystem functionality on affected hardware. Systems running kernel versions from 5.4 through pre-patch releases across multiple stable branches are affected when using NXP NCI NFC chipsets with I2C-connected GPIO expanders. With EPSS at 0.02% (7th percentile), no KEV listing, and no public exploit code identified at time of analysis, this is a low-risk operational reliability defect relevant primarily to embedded and IoT deployments.
A NULL pointer dereference in the Linux kernel ARM SCMI firmware driver allows local authenticated users to trigger a denial of service by causing the system to crash. The vulnerability exists in the __scmi_event_handler_get_ops helper function, which can return NULL instead of the expected ERR_PTR on failure, causing downstream code to dereference a NULL pointer when handling unsupported SCMI events. The flaw was introduced in commit b5daf93b809d1 and affects multiple stable kernel versions; patches are available in Linux 6.18.20, 6.19.10, and 7.0.
Debug logging in the Linux kernel's crash_dump module exposes dm-crypt key material when debug logging is enabled, allowing local privileged users to read encryption keys from kernel logs and potentially cause denial of service through availability impact on crash dump functionality. The vulnerability affects Linux kernel versions prior to 6.18.20, 6.19.10, and 7.0, with an EPSS score of 0.02% indicating low exploitation probability despite the information disclosure risk.
Denial of service in Linux kernel x86/platform/uv module when sockets are deconfigured, causing kernel panic during UV hub info structure allocation on systems with SGI UV architecture. Affects authenticated local attackers with standard user privileges. Vendor-released patches available for multiple kernel versions (6.6.130, 6.12.78, 6.18.20, 6.19.10 and others). EPSS score of 0.02% indicates exploitation is unlikely in typical environments despite low CVSS score barrier.
A null pointer dereference in the i915 GPU driver's graphics translation table (GT) submission logic causes kernel panic and denial of service when the i915 firmware binaries are absent and the system attempts to suspend. Local authenticated attackers with normal user privileges can trigger this crash by initiating system suspend on affected Intel graphics systems without required firmware, resulting in denial of service. No public exploit code identified at time of analysis; EPSS score of 0.02% indicates low exploitation probability in practice.
Denial of service in Linux kernel SMB server implementation allows local authenticated users to crash the system by triggering data stream corruption through improper credit management in smbdirect socket operations. The vulnerability affects kernel versions prior to 6.18.11, 6.19.1, and 7.0, and requires local access with limited privileges to exploit.
A race condition in the Linux kernel SMB client's recv_io credit management allows local authenticated users to cause a denial of service through timing-sensitive credit accounting between incoming data reception and completion processing. The vulnerability affects SMBDirect socket credit handling where credits may be granted to peers before corresponding recv buffers are actually posted, creating a window where credit accounting becomes inconsistent. Exploitation requires local access and moderate complexity but is not confirmed as actively exploited (not listed in CISA KEV).
Denial of service in Linux kernel nexthop query handling allows local authenticated attackers to crash the kernel by querying nexthop objects with large Equal-Cost Multi-Path groups via the RTM_GETNEXTHOP netlink message. The vulnerability stems from fixed-size socket buffer allocation that overflows when processing nexthop groups exceeding approximately 512 members, triggering a kernel warning and potential system instability.
Memory leak in Linux kernel CXL region initialization allows local privileged attackers to cause denial of service through resource exhaustion. The vulnerability exists in the __construct_region() function where failed sysfs_update_group() calls fail to properly free allocated resources, resulting in cumulative memory exhaustion when region construction is repeatedly attempted and fails. CVSS 5.5 reflects local attack vector with low complexity and high availability impact; EPSS 0.02% indicates minimal real-world exploitation probability despite the vulnerability's severity classification.
The Linux kernel BPF verifier fails to validate lock release on exception exits from static subprograms when bpf_throw() is invoked, potentially allowing denial of service or system instability through uncontrolled RCU and preemption lock retention. Affected versions span from 6.7 through 7.0-rc4; CVSS 5.5 (local privilege escalation path) but EPSS 0.02% suggests low real-world exploitation probability. Patch available in stable releases 6.18.21, 6.19.11, and 7.0.
Memory leak and out-of-bounds read in the asus_report_fixup() HID driver function allows local authenticated attackers with limited privileges to cause denial of service through memory exhaustion. The vulnerability affects the ASUS HID device driver across multiple Linux kernel versions, where kmemdup()-allocated buffers were not freed properly and an out-of-bounds read could access memory beyond the original descriptor size. A patch is available from Linux kernel maintainers switching to devm_kzalloc() for proper memory lifecycle management.
Double completions in NVMe-PCI polled queue handling occur when a high-priority task attempts to poll a queue during kernel reset before block layer queue maps are updated, causing race conditions between interrupt-driven and polled I/O paths. Affects Linux kernel versions before 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, and 7.0-rc2, requiring local authentication and high attack complexity to trigger. No public exploit identified, but vendor-released patches are available across all affected stable and development branches.
Memory leak in the HID magicmouse driver's report_fixup() function allows local authenticated attackers to cause a denial of service through repeated device interactions. The magicmouse_report_fixup() function allocates memory via kmemdup() but fails to free the allocated buffer before returning, leading to exhaustion of kernel memory on systems with a Magic Mouse connected. Vendor patches are available across multiple stable branches.
Linux kernel module loader fails to validate ELF section index bounds in simplify_symbols(), causing kernel panic when processing modules with out-of-bounds st_shndx values such as SHN_XINDEX (0xffff). Local privileged attackers can crash the system by loading malformed or legitimately-crafted modules that exploit this missing bounds check, resulting in denial of service. The vulnerability affects all stable kernel versions from 2.6.12 through current releases; patches are available across multiple stable branches (5.15.203+, 6.1.168+, 6.6.131+, 6.12.80+, 6.18.21+, 6.19.11+, 7.0+).
Memory leak in the Linux kernel HID Apple driver causes gradual kernel memory exhaustion on systems connected to Apple HID peripherals. The `apple_report_fixup()` function in `drivers/hid/hid-apple.c` allocates a new buffer via `kmemdup()` each time an Apple device descriptor is processed, but the HID core caller never frees it because the API contract only guarantees lifetime management for pointers returned into the original descriptor buffer. Patches are available across all actively maintained stable branches (6.1, 6.6, 6.12, 6.18, 6.19, 7.0); no active exploitation has been confirmed and EPSS stands at 0.02%.
A denial-of-service vulnerability in the Linux kernel's Btrfs filesystem implementation allows local authenticated attackers to cause filesystem corruption and crashes through a race condition during subvolume creation and lookup. When a newly created Btrfs subvolume's dentry cache is dropped before the BTRFS_ROOT_ORPHAN_CLEANUP flag is set, concurrent orphan cleanup operations can fail with ENOENT, creating negative dentries that prevent subvolume deletion and cause filesystem aborts. EPSS score of 0.02% indicates this is a low-probability exploitation scenario requiring specific timing and configuration conditions, though the impact is severe for affected systems. No public exploit code is identified at time of analysis.
Memory leak in Linux kernel ESP-over-TCP implementation with asynchronous cryptography causes denial of service via socket queue exhaustion when crypto operations complete asynchronously. Authenticated local attackers can trigger the vulnerability by filling the TX queue for espintcp connections while using async crypto algorithms, preventing proper cleanup of socket buffers and gradually consuming system memory until services become unavailable. EPSS score of 0.02% indicates low real-world exploitation probability despite moderate CVSS severity.
Denial of service via kernel panic in the Linux kernel xfrm_iptfs module when processing fragmented IP-TFS packets with mixed fast-path and slow-path reassembly conditions. The vulnerability triggers an invalid memory access (SKB_LINEAR_ASSERT) in skb_put() when attempting to append data to a non-linear socket buffer during packet reassembly, affecting systems using IP-TFS encapsulation over IPsec. Local attackers with network access to send crafted IPsec packets can crash the kernel; active exploitation not confirmed but patch is available.
Denial of service in Linux kernel af_key module allows local authenticated attackers to crash the system via buffer overflow in pfkey_send_migrate() function. The vulnerability occurs because pfkey_send_migrate() fails to validate address family parameters before passing them to set_ipsecrequest(), causing truncation that overfills the socket buffer and triggers kernel panic in skb_put(). EPSS score of 0.02% indicates minimal real-world exploitation risk despite moderate CVSS severity.
Short read handling in EROFS file-backed mounts can mark unread file pages as uptodate when vfs_iocb_iter_read() is interrupted by signals, leading to potential data corruption or information disclosure on systems using EROFS with file-backed mounts. Affected Linux kernel versions prior to fixes in 6.18.21, 6.19.11, and 6.12.80. Local authenticated users can trigger this via signal interruption during I/O operations.
Denial of service via buffer over-read in Linux kernel Bluetooth L2CAP Enhanced Credit Based Flow Control data path allows local authenticated attackers to crash the system by sending malformed L2CAP packets with insufficient payload length. The vulnerability exists in l2cap_ecred_data_rcv() which reads the SDU length field without validating that the socket buffer contains the required 2 bytes, causing an out-of-bounds read that triggers a kernel panic when the buffer is too small. EPSS exploitation probability is 0.02% (percentile 7%), and a vendor patch is available.
Null pointer dereference in the Linux kernel Bluetooth L2CAP implementation allows local authenticated attackers to cause a kernel panic and denial of service via the l2cap_sock_ready_cb function during L2CAP connection initialization. The vulnerability occurs when a socket pointer is dereferenced without null validation, triggering a KASAN null-ptr-deref exception that crashes the kernel. EPSS score of 0.02% indicates low real-world exploitation probability despite the moderate CVSS score; no public exploit code or active KEV listing has been identified at time of analysis.
Denial of service via deadlock in NFC NCI subsystem when nci_close_device() flushes work queues while holding req_lock, triggering a circular lock dependency with nci_rx_work(). The vulnerability affects Linux kernels across multiple stable branches (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 6.19, 7.0) and was reproduced in roughly 4% of nci selftest runs on debug kernels, though EPSS scoring (0.02% percentile 7%) indicates low baseline exploitation probability. Local privilege requirement and high attack complexity in practice mean real-world impact is limited to NFC-capable systems with specific workload timing.
Linux kernel UDP socket binding fails to properly detect wildcard address conflicts when hash table collision count exceeds 10, allowing a socket to bind to a wildcard address (such as [::]:8888 or 0.0.0.0:8888) even when specific addresses on that port are already in use. This denial-of-service vulnerability affects local authenticated users who can create UDP sockets, bypassing port conflict checks that should prevent duplicate bindings. The issue stems from improper hash table selection logic in UDP's bind path, which switches from a port-only hash to an address-port hash at a threshold, creating a window where wildcard bindings are incorrectly permitted.
A deadlock condition in Linux kernel Bluetooth L2CAP connection deletion allows local authenticated users to trigger a denial of service by causing the l2cap_conn_del() function to deadlock when canceling delayed work timers while holding the connection lock. The vulnerability affects multiple Linux kernel versions across the 6.x and 7.0 release branches and has been resolved through upstream patch commits that reorganize lock acquisition and work cancellation order.
Denial of service via infinite loop in Bluetooth L2CAP ERTM reconfiguration allows local authenticated attackers to exhaust system memory. The vulnerability arises from two distinct flaws: improper handling of L2CAP channel reconfiguration that leaks ERTM resources and fails to validate minimum PDU size, causing an infinite loop in l2cap_segment_sdu() when remote_mps is set to zero. EPSS score of 0.02% indicates limited exploitation likelihood despite the high CVSS score, reflecting the requirement for local access and authenticated Bluetooth channel state.
Out-of-bounds array access in the btusb driver's Bluetooth SCO link handling allows local authenticated attackers to cause denial of service by exhausting kernel memory or crashing the Bluetooth subsystem. The btusb_work() function fails to constrain the sco_num variable before indexing a three-entry lookup table, permitting reads and potential writes past allocated buffer boundaries when four or more SCO links are active. This affects Linux kernel versions 5.8 through 7.0-rc2 and requires local access with unprivileged user privileges to trigger.
Information disclosure in Linux kernel netfilter nf_conntrack_expect proc interface allows local authenticated users to read connection tracking expectations from other network namespaces, bypassing namespace isolation. The vulnerability affects kernel versions through 6.x and 7.0-rc releases with CVSS 5.5 (local, low complexity, high availability impact) and EPSS 0.02% exploitation probability; vendor-released patches are available for multiple stable branches (6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, 7.0).
Denial of service in Linux kernel netfilter ctnetlink subsystem allows local authenticated attackers to trigger undefined behavior via improper validation of TCP window scale and connection tracking state parameters. The vulnerability stems from missing netlink policy range checks that permit out-of-bounds values (TCP window scale 0-255 instead of clamped 0-14, TCP state values exceeding TCP_CONNTRACK_MAX) to be passed to kernel code expecting constrained ranges, leading to undefined behavior in shift operations and state machine logic. CVSS 5.5 (local, low complexity, requires low privileges) with EPSS 0.03% indicates low real-world exploitation likelihood despite availability of vendor patches.
Use-after-free in Linux kernel RDMA/irdma driver allows local authenticated users to cause denial of service by triggering uninitialized completion handling during queue pair creation failure. When ib_copy_to_udata fails in irdma_create_qp, the cleanup path attempts to wait on an uninitialized free_qp completion structure, resulting in a kernel panic or system hang. EPSS score of 0.02% indicates low exploitation probability despite moderate CVSS score; patch is available from vendor.
Integer overflow in Linux kernel RDMA/irdma depth calculation functions allows local authenticated users to trigger a denial of service via improper handling of U32_MAX values passed for SQ/RQ/SRQ size parameters. The vulnerability stems from depth calculations performed in 32-bit integers rather than 64-bit, enabling truncation that bypasses validation and returns success when allocation should fail, potentially causing system instability or resource exhaustion.
Use-after-free vulnerability in the Linux kernel SPI subsystem allows local authenticated attackers to cause denial of service by exploiting unsynchronized access to the driver_override field during device probe operations. The vulnerability occurs because __driver_attach() calls the bus match() callback without holding the device lock, creating a race condition when driver_override is accessed without proper synchronization. CVSS score of 5.5 reflects local attack vector with low complexity and high availability impact. EPSS exploitation probability is minimal at 0.02%, suggesting this is a localized memory safety issue rather than a widely-exploited attack vector.
Denial of service in Linux kernel on s390 architecture allows local authenticated attackers to crash the system by triggering an out-of-bounds access in the syscall dispatch table. The s390 syscall number is directly controlled by userspace without spectre boundary protection (array_index_nospec), enabling an attacker with local user privileges to supply an invalid syscall number that bypasses array bounds checking and causes a memory access violation. EPSS score is extremely low (0.03%), consistent with limited attack surface on s390-specific systems and requirement for local authentication.
Information disclosure in Linux kernel s390 architecture allows local authenticated attackers to read residual data from r12 register during kernel entry transitions, enabling potential exposure of sensitive kernel state through register side channels. This occurs on s390 systems running kernel versions 6.4 through 7.0-rc5 and affects all architectures due to incomplete register scrubbing following removal of branch prediction isolation code. EPSS score of 0.02% indicates minimal real-world exploitation likelihood despite moderate CVSS impact rating.
Kernel panic via null pointer dereference in the tracing subsystem occurs when boot-time trigger registration fails and kthread creation does not succeed, allowing deferred trigger frees to accumulate indefinitely and crash the system. Local authenticated attackers can trigger this by specifying malformed trace event parameters on the kernel command line, resulting in denial of service. EPSS exploitation probability is 0.02% (very low) despite moderate CVSS score, suggesting this requires specific boot-time configuration and local access.
Denial of service via deadlock in the Linux kernel tracing subsystem occurs when CPU hotplug operations interact with osnoise tracing thread lifecycle management. A local privileged user can trigger a deadlock by inducing CPU offline events while osnoise threads hold conflicting locks (interface_lock and cpus_read_lock), causing system hang. CVSS 5.5 reflects local attack vector and privilege requirement; EPSS 0.02% indicates low real-world exploitation likelihood despite deadlock severity.
Denial of service in Linux kernel IPTFS (IP Traffic Flow Security) subsystem allows local authenticated attackers to trigger an infinite loop via crafted ESP packets with malformed inner IPv4 headers containing tot_len=0. The vulnerability bypasses input validation in __input_process_payload() that should reject IPv4 packets where tot_len is less than the header length, causing the kernel to spin indefinitely in softirq context and hang the system.
A race condition in Linux kernel memory management causes folio objects to be accessed without proper locking during concurrent mega-transparent huge page (mTHP) splitting and zap operations on arm64, triggering a denial-of-service condition via VM_WARN_ON_ONCE() panic when the missing memory barrier allows CPU reordering to expose unlocked folio state. The vulnerability affects Linux kernel versions before 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.21, 6.19.11, and 7.0 with EPSS score of 0.02% indicating low real-world exploitation likelihood despite moderate CVSS impact rating.
A denial-of-service condition in the Linux kernel writeback subsystem causes system hangs during suspend-to-RAM on filesystems with no data integrity guarantees (such as FUSE-based overlayfs). When the sync operation waits for flusher threads to complete writeback on these filesystems, the kernel can deadlock if the underlying filesystem daemon is frozen or unresponsive, particularly during system power management. The vulnerability affects Linux kernel versions prior to the fix and is resolved by introducing the SB_I_NO_DATA_INTEGRITY superblock flag to skip unnecessary writeback completion waits on filesystems that cannot guarantee data persistence.
AMD GPU driver in the Linux kernel fails to prevent rapid PASID (Process Address Space ID) reuse, allowing local authenticated attackers to trigger interrupt handling errors and denial of service. When a process exits with an assigned PASID, page faults may remain pending in the interrupt handler ring buffer; if a new process is immediately assigned the same PASID, it inherits these stale interrupts causing system instability. The vulnerability affects Linux kernel versions prior to 7.0 RC1 and requires local user access with standard privileges. EPSS score of 0.02% indicates minimal real-world exploitation likelihood despite moderate CVSS impact rating.
Memory leak in AMD display driver (amdgpu_dm) on Linux kernel allows local authenticated attackers to cause denial of service by exhausting kernel memory when display sinks are connected and the system resumes from sleep. The vulnerability arises from failure to free previously allocated drm_edid structures before overwriting them, and is confirmed in kernel versions up to 7.0 RC5 with EPSS exploitation probability of 0.02% indicating low real-world exploitation likelihood.
Denial of service via null pointer dereference in AMD display driver backlight setup affects Linux kernel versions 6.19 through 7.0-rc5 when LVDS connectors are present without extended backlight capabilities. Local authenticated users with low privileges can trigger a crash by accessing backlight controls on affected systems, causing system instability. Patch available from vendor with EPSS score of 0.02% indicating low real-world exploitation probability.
Memory leak in Linux kernel DAMON subsystem allows local authenticated users to exhaust system memory via failed allocation in damon_sysfs_new_test_ctx(), causing denial of service. The vulnerability affects kernel versions 6.17.6 through 7.0-rc1 when DAMON_SYSFS is enabled. A privileged user can trigger the leak by making specific control sequences that cause early function returns, bypassing cleanup code and leaving param_ctx unfreed.
Denial of service via null pointer dereference in Linux kernel DAMON sysfs module allows local privileged users to crash the system by setting nr_contexts to zero while DAMON is running, then issuing state-change commands that dereference an empty contexts array without bounds checking. EPSS exploitation probability is minimal at 0.02%, reflecting the requirement for local privileged access and active DAMON configuration.
Null pointer dereference in Linux kernel DAMON sysfs interface allows local authenticated users to cause denial of service by setting nr_contexts to zero while DAMON is running, triggering dereference of uninitialized context array pointers in damon_sysfs_repeat_call_fn(). The vulnerability requires local access and low-level privileges (non-root user with sysfs write access), with an EPSS exploitation probability of 0.02% indicating low real-world attack likelihood despite the straightforward trigger mechanism.
A race condition in the Linux kernel's page table walking code (mm/pagewalk) allows local authenticated attackers to trigger a kernel panic (denial of service) by concurrent PUD splitting and refaulting operations. The vulnerability occurs when one thread is reading proc/[pid]/numa_maps while another thread (e.g., VFIO-PCI DMA setup) modifies the page table hierarchy, causing walk_pmd_range() to attempt walking a PMD range that no longer exists. The condition requires local access and a privileged operation (VFIO DMA pinning), but can reliably crash the kernel, affecting system availability.
Kernel panic via reachable assertion in the Linux kernel ext4 filesystem driver allows a local low-privileged user to crash the system by presenting an ext4 filesystem with inline data exceeding PAGE_SIZE, triggering BUG_ON() in ext4_read_inline_folio(). Affected branches span 6.6.x through 7.0-rc5; patched releases are available as 6.6.131, 6.12.80, 6.18.21, 6.19.11, and 7.0. No public exploit code exists and EPSS stands at 0.02% (5th percentile), consistent with the absence of active exploitation from CISA KEV.
Null pointer dereference in Linux kernel DAMON subsystem allows local authenticated attackers to cause denial of service when memory allocation failures occur during online parameter updates. The vulnerability affects DAMON's context commit mechanism (damon_commit_ctx), which can partially corrupt kernel state if internal memory allocation fails, potentially leading to NULL pointer dereference in damos_commit_dests(). While real-world impact is rare due to the low probability of allocation failure, the severe consequence of kernel panic necessitates this fix.
Denial of service in the Linux kernel dmaengine idxd subsystem allows local attackers with low privileges to crash the system by triggering a Function Level Reset when the hardware does not support event log reporting. The vulnerability occurs when the driver attempts to restore or free an event log that was never allocated, resulting in a kernel crash with high availability impact.
Memory leak in the Linux kernel dmaengine idxd driver occurs when a workqueue is reset, causing resources to be improperly released due to premature setting of the workqueue type to NONE. A local attacker with low privileges can trigger this condition to exhaust kernel memory and cause a denial of service. The vulnerability affects kernel versions 5.8 through 7.0 and has an available vendor patch with low exploitation probability (EPSS 0.02%).
Memory leak in the Linux kernel dmaengine idxd driver during device removal allows local authenticated attackers to cause a denial of service by exhausting kernel memory. The vulnerability occurs when the device reset causes configuration registers to revert to default state, preventing proper deallocation of event log memory. EPSS exploitation probability is very low at 0.02%, and no public exploit has been identified.
Incorrect error-handling in the Linux kernel's Xilinx XDMA DMA engine driver causes a kernel denial-of-service when regmap initialization fails. The driver's probe function checks the return value of devm_regmap_init_mmio against NULL rather than using IS_ERR(), meaning a failure returns an ERR_PTR() value that is non-NULL and passes the check silently; the corrupted pointer is then used, triggering a kernel panic. Affected systems require Xilinx XDMA hardware to be present and actively probed by the driver. No public exploit has been identified at time of analysis, and EPSS exploitation probability stands at a negligible 0.02%.
Kernel panic in the Linux netfs subsystem's netfs_limit_iter() function crashes systems when a process writes a core dump to a 9P-mounted filesystem. The function handles only ITER_FOLIOQ, ITER_BVEC, and ITER_XARRAY iterator types, triggering a hard BUG() when __kernel_write() supplies an ITER_KVEC iterator via netfs_unbuffered_write(), producing a local denial of service via kernel panic. No public exploit code exists and no active exploitation has been identified; this is a no public exploit identified at time of analysis scenario with EPSS at 0.02% (5th percentile), indicating minimal widespread exploitation interest.
NULL pointer dereference in the Linux kernel's netfs subsystem crashes the kernel when retrying unbuffered writes on filesystems that omit the prepare_write stream operation, such as 9P. A local low-privilege user who can write to such a mounted filesystem and induce a get_user_pages() -EFAULT failure can trigger a kernel panic, causing a denial of service. No public exploit has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) reflects negligible observed exploitation probability; the vulnerability is not listed in CISA KEV.
Memory leak in the Linux kernel btrfs filesystem driver allows a local authenticated attacker to gradually exhaust kernel memory through repeated mount and unmount operations on affected configurations. The flaw exists in check_removing_space_info(), which incorrectly uses kfree() on kobject-initialized sub-group space_info elements instead of the proper kobject_put() teardown path, leaving kobj->name string allocations unreferenced and unfreed. No public exploit exists (EPSS 0.02%, 7th percentile) and the vulnerability is not listed in CISA KEV, placing real-world risk well below the CVSS 5.5 Medium score might suggest.
Cross-cache slab free in the Linux kernel's socket buffer (SKB) subsystem allows a local authenticated attacker to trigger a kernel panic and denial of service on systems where KFENCE is enabled. When KFENCE intercepts a kzalloc() call whose requested size exactly matches SKB_SMALL_HEAD_CACHE_SIZE, the computed skb_end_offset misleads skb_kfree_head() into freeing the object to skb_small_head_cache instead of the originating kmalloc cache, corrupting slab allocator state. No public exploit is identified at time of analysis and EPSS is 0.02% (4th percentile), placing this firmly in the low-urgency tier absent a KFENCE-enabled production environment.
MaxKB versions 2.7.1 and below allow authenticated users with tool-editing permissions to bypass sandbox network protection via socket.sendto() with the MSG_FASTOPEN flag, enabling connections to internal services explicitly blocked by the sandbox's banned hosts configuration. The vulnerability exploits a gap in LD_PRELOAD hooking-sendto() with MSG_FASTOPEN establishes TCP connections directly through the kernel without invoking the hooked connect() function, completely circumventing IP validation. This is a server-side request forgery (SSRF) vector that requires prior authentication and tool-editing privileges. Vendor-released patch: version 2.8.0.
Uninitialized heap memory leaks to userspace via the Linux kernel's netfilter logging subsystem (nfnetlink_log), exposing 1-3 bytes of stale kernel heap content per logged packet through the NFULA_PAYLOAD netlink attribute. Affected systems are those running Linux kernel versions dating back to commit df6fb868d611 (circa 2.6.24) where NFLOG-based packet logging is configured. A low-privileged local attacker with access to an NFLOG netlink socket can passively harvest kernel memory fragments, potentially useful for defeating KASLR or reconstructing sensitive in-memory data. No public exploit identified at time of analysis and EPSS exploitation probability is very low (0.02%, 7th percentile), but the vulnerability class is well-understood by kernel exploit developers.
Stack corruption in the Linux kernel's netfilter SIP connection tracking helper (`nf_conntrack_sip`) allows a local low-privileged attacker to disrupt SIP call establishment by triggering use of an uninitialized `rtp_addr` stack variable in `process_sdp()`. When SDP bodies contain no valid media sections, the uninitialized address is passed to `nf_nat_sdp_session()`, which rewrites SDP `o=` and `c=` lines with either zeroes (when `CONFIG_INIT_STACK_ALL_ZERO` is active) or arbitrary stack contents, corrupting session negotiation. No public exploit identified at time of analysis; EPSS is 0.02% (7th percentile), and this vulnerability is not listed in CISA KEV.
Null pointer dereference in the Linux kernel's RDS-over-InfiniBand (RDS/IB) subsystem allows a local low-privileged user to crash the kernel by sending an RDS_CMSG_RDMA_MAP control message before an IB connection is fully established. The impact is a complete denial of service (kernel panic) with no confidentiality or integrity exposure, scoring CVSS 5.5. No public exploit code has been identified at time of analysis, and EPSS exploitation probability is extremely low at 0.02%, consistent with the specialized InfiniBand hardware prerequisite.
NULL pointer dereference in the Linux kernel's netfilter x_tables subsystem allows a local attacker with CAP_NET_ADMIN privileges to crash the system by loading an NFPROTO_UNSPEC-registered xt_match or xt_target (e.g., xt_devgroup) into an ARP nftables chain via nft_compat, triggering a kernel panic and complete availability loss. CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects the local-only, availability-only impact, and EPSS at 0.02% (7th percentile) indicates very low real-world exploitation probability. No active exploitation confirmed (not in CISA KEV); vendor-released patches are available across multiple stable kernel branches.
Divide-by-zero in the Linux kernel's HFSC traffic scheduler (net/sched/sch_hfsc.c) allows a local authenticated user to crash the kernel via a denial-of-service oops. The flaw is triggered by enqueueing packets through an HFSC qdisc configured with slope values that cause a u64-to-u32 arithmetic truncation to yield a zero divisor in rtsc_min(). With EPSS at 0.02% (7th percentile), no CISA KEV listing, and no public exploit code identified at time of analysis, real-world exploitation risk is currently low, though the crash path is deterministic and reproducible by anyone with HFSC configuration access.
NULL pointer dereference in the Linux kernel's net/sched cls_flow traffic classifier allows a local low-privileged attacker to crash the kernel (denial of service) by creating a flow filter on a shared traffic control block without a fully qualified baseclass. The crash occurs in flow_change() at net/sched/cls_flow.c:508, confirmed by a KASAN trace showing null-ptr-deref when block->q is dereferenced on a shared block where it is intentionally NULL. No active exploitation confirmed - not listed in CISA KEV - and EPSS stands at 0.02% (7th percentile), indicating negligible real-world exploitation probability at time of analysis.
NULL pointer dereference in the Linux kernel's cls_fw traffic classifier (net/sched/cls_fw.c) crashes the kernel when authenticated local users configure an old-method cls_fw filter on a shared tc block and traffic with a nonzero major skb mark is processed. The flaw exists because the old classification path in fw_classify() calls tcf_block_q() and dereferences q->handle, but shared blocks hold a NULL block->q pointer. The impact is limited to local denial of service (kernel panic); no confidentiality or integrity compromise is possible. EPSS is 0.02% (7th percentile), this vulnerability is not in CISA KEV, and no public exploit has been identified at time of analysis.
Uncontrolled resource exhaustion in the Linux kernel bridge MRP subsystem allows a locally authenticated attacker to trigger a kernel OOM panic by supplying a zero-value test interval via netlink. The br_mrp_start_test() and br_mrp_start_in_test() functions lack input validation for the interval parameter; when set to zero, usecs_to_jiffies(0) yields 0, causing delayed work items on system_percpu_wq to reschedule themselves at maximum rate while continuously allocating and transmitting MRP test frames until all system memory is exhausted. No public exploit has been identified at time of analysis, and the EPSS score of 0.02% (6th percentile) reflects low current exploitation probability, though the denial-of-service impact is severe - a full kernel panic.
Local denial-of-service via kernel memory leak in the Linux kernel's netfilter ipset subsystem affects multiple stable branches from Linux 5.6 through the fixed releases 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0. The mtype_del() function contains a logic flaw that prevents proper bucket release when all live entries are deleted but the positional counter (n->pos) still references past-deleted slots, causing accumulated unreleased kernel memory across repeated ipset add/delete operations. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; EPSS at 0.02% (7th percentile) reflects very low real-world exploitation probability.
Local denial-of-service in the Linux kernel's netfilter nfnetlink_log subsystem allows a low-privileged local user to trigger a kernel WARN splat and cause netlink message drops. The root cause is an accounting error in NLMSG_DONE that omits the netlink header size, counting only the attribute size. With a CVSS score of 5.5 (AV:L/AC:L/PR:L) and EPSS at 0.02% (7th percentile), this has no public exploit code identified at time of analysis and is not listed in the CISA KEV catalog - impact is limited to netlink logging availability, with no code execution or data exposure.
Integer overflow in the Linux kernel's IPv6 sendmsg ancillary-data path allows a local user with CAP_NET_RAW (or namespaced CAP_NET_RAW via unprivileged user namespaces) to crash the kernel via skb_under_panic(), constituting a local denial of service. The 16-bit opt_flen accumulator in ip6_datagram_send_ctl() wraps around when flooded with large IPV6_DSTOPTS cmsgs, causing the transmit path to underallocate sk_buff headroom while dst1opt still references a large destination-options header - the mismatch triggers BUG() on subsequent packet transmission. A proof-of-concept (poc.c) was submitted with the bug report; no public exploit identified at time of analysis as actively exploited (no CISA KEV listing), and EPSS is very low at 0.03%.
Integer overflow in the Linux kernel's USB gadget mass storage driver (f_mass_storage) allows a malicious USB host to corrupt kernel memory or trigger out-of-bounds accesses on any Linux system acting as a USB storage gadget. The flaw affects kernel versions tracing back to Linux 3.3 (commit 144974e7f9e32b53b02f6c8632be45d8f43d6ab5), with vendor-released patches now available across multiple stable branches. No public exploit has been identified at time of analysis, and EPSS exploitation probability stands at a very low 0.02%, consistent with the physical USB access prerequisite.
Kernel crash via forged VCC pointer in the Linux kernel ATM networking subsystem (net/atm/sigd.c) allows a local low-privileged attacker who has assumed the ATM signaling daemon role to dereference arbitrary kernel memory, resulting in denial of service. The flaw affects Linux 2.6.12 through multiple current stable branches, with patches available for 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 6.19.x, and 7.0-rc1. A public reproducer exists at a GitHub gist, though the EPSS score of 0.02% (7th percentile) and absence from CISA KEV reflect the niche ATM subsystem's limited real-world attack surface.
Denial-of-service in the Linux kernel's ksmbd SMB server component stems from improper handling of volume identifiers in FS_OBJECT_ID_INFORMATION responses. Affected kernels fail to correctly use the superblock UUID (sb->s_uuid) as the volume identifier, and lack a safe fallback (via vfs_statfs()) for filesystems that do not expose a UUID - creating conditions for a kernel availability impact when a local low-privileged user interacts with an affected SMB share. EPSS is 0.01% (1st percentile) and no active exploitation is confirmed in CISA KEV; no public exploit code has been identified at time of analysis.
Linux kernel sunrpc subsystem fails to properly release cache_request objects when file descriptors are closed mid-read, resulting in memory leaks and potential information disclosure through stale cache entries. The vulnerability affects all Linux kernel versions with the affected sunrpc cache implementation, and requires no special privileges or network access to trigger since it occurs during normal file descriptor closure in the kernel's user-space cache management interface.
Null pointer dereference in Linux kernel mac80211 IEEE 802.11 wireless subsystem crashes AP_VLAN stations during channel bandwidth change operations. The ieee80211_chan_bw_change() function incorrectly accesses link data on VLAN interfaces (such as 4-address WDS clients) where the link structure is uninitialized, leading to kernel panic when dereferencing a NULL channel pointer. Any system with AP_VLAN wireless configurations and active channel state announcement (CSA) operations is vulnerable to local denial of service.
Kernel panic in the Linux hantro_vpu media driver (verisilicon subsystem) allows a local low-privileged user to crash the system by triggering a device probe deferral or unbind-bind cycle on affected NXP i.MX8MQ hardware. The root cause is an incorrect __initconst annotation on the imx8mq_vpu_shared_resources array, which causes the kernel to free that data after module initialization while variant structures retain a live pointer to it; subsequent probe calls dereference freed memory and fault. No public exploit or PoC exists and this CVE is not in CISA KEV; the EPSS score of 0.02% (5th percentile) confirms negligible real-world exploitation probability.
NULL pointer dereference in the Linux kernel's i2c:designware:amdisp driver exposes AMD ISP-equipped systems to a local denial-of-service via a race condition between runtime PM resume and driver probe. The race exists because pm_runtime_get_sync() called before i2c_dw_probe() triggers PM resume, which powers on the ISP and simultaneously invokes the amdisp i2c runtime resume callback before probe initialization is complete - dereferencing an uninitialized pointer and causing a kernel panic. The flaw predates its detection but became reproducible in kernel v7.0 after commit 38fa29b01a6a reorganized init functions; no public exploit identified at time of analysis.
State ordering regression in the Linux kernel's drm/i915 Intel graphics driver causes unlink_nv12_plane() to clobber plane state already computed by plane_atomic_check(), resulting in a kernel WARN and availability disruption on systems with Intel i915 GPUs. The flaw affects local users with DRM device access who configure a plane previously used as an NV12 Y plane back to a normal plane. No public exploit exists and EPSS sits at 0.02% (4th percentile), confirming this as a low-probability exploitation scenario; however, the patch is available across multiple stable kernel branches.
Spurious WARN_ON() in the Linux kernel's PM sleep subsystem (pm_restore_gfp_mask()) can be triggered by defensive hibernation code paths, causing kernel warning floods or, on systems with panic_on_warn=1, a full kernel panic and denial of service. Affected kernels contain commit 35e4a69b2003f introducing refcount-based GFP mask stacking but lack the corrective fix removing the assertion from the zero-count guard. No active exploitation confirmed (not in CISA KEV), and EPSS is 0.02% (4th percentile), consistent with a low-risk code-quality defect rather than a targeted vulnerability.
Deadlock in the Linux kernel's RDMA/irdma subsystem (CVE-2026-31565) causes an indefinite system hang when a netdev reset is performed on Intel ice Ethernet hardware while active RDMA/iWARP applications hold Queue Pair connections. The ice driver's removal of the irdma auxiliary driver triggers a circular dependency: uverbs_client waits for QP reference count to reach zero while cma_client holds the final reference in iWARP mode, neither releasing first. No public exploit has been identified at time of analysis; an EPSS of 0.02% (7th percentile) and absence of CISA KEV listing confirm this is currently a low exploitation-priority issue concentrated in HPC and data center environments with Intel RDMA hardware.
Pointer arithmetic type confusion in the Linux kernel's LoongArch KVM EIOINTC register access handler allows a local low-privileged attacker to crash the host kernel. The function kvm_eiointc_regs_access() stores the register array base address as a u64 rather than a void pointer, causing byte offsets to be scaled incorrectly during address calculation and producing out-of-bounds memory accesses that result in a kernel panic. No public exploit code exists and EPSS sits at 0.02%, consistent with the narrow LoongArch KVM attack surface; the vulnerability is not listed in CISA KEV.
NULL pointer dereference in the Linux kernel's MediaTek DSI DRM driver causes a kernel panic during module initialization on ARM64 systems with MediaTek display hardware. The crash occurs because `mipi_dsi_host_register` triggers the `mtk_dsi_bind` callback before the `mtk_dsi` struct is stored in driver data, dereferencing a NULL pointer inside `drm_mode_object_add` and acquiring `mode_config.idr_mutex` before panicking - blocking all subsequent DRM operations on the system. No public exploit exists and EPSS stands at 0.02%, consistent with a hardware-specific local denial-of-service with no confidentiality or integrity impact.
The Linux kernel's x86 FRED (Flexible Return and Event Delivery) initialization path crashes AMD SEV-ES, SEV-SNP, and Intel TDX confidential VM guests via triple fault when any exception is triggered during the brief AP initialization window before FRED MSRs are configured. A prior attempted mitigation introduced a secondary risk: temporarily disabling CR4 pinning for offline CPUs created a path where a local attacker could flip a single RW-memory bit (the CPU online flag) to suppress CR4 security controls and disable SMEP/SMAP protections. No public exploit has been identified at time of analysis; EPSS is 0.02% (5th percentile), consistent with the narrow real-world exploitability of this flaw.
Null pointer dereference in the Linux kernel's spi-dw-dma driver crashes the system when an error occurs during a DMA transaction and the current SPI message pointer is NULL at the time error-log printing is attempted. Systems running the DesignWare SPI DMA driver are exposed to a local denial-of-service condition triggerable by a low-privileged user. No public exploit exists and EPSS probability is 0.02% (5th percentile), indicating negligible current exploitation interest; however, the crash path is deterministic once the error condition is induced.
Null pointer dereference in the Linux kernel's LoongArch architecture code can crash the kernel during early boot when kstrdup() fails to allocate memory while parsing CPU model strings from the device tree. Affected systems running unpatched kernels on LoongArch hardware may experience a kernel oops and complete system unavailability if memory is exhausted at boot time. No public exploit exists and EPSS is 0.02% (6th percentile), reflecting very low exploitation probability; this is not listed in CISA KEV.
Missing lock release in the Linux kernel's XFS quota scrub subsystem allows a local, low-privileged user to trigger a dquot lock leak that can cause deadlocks in subsequent quota operations. The flaw exists in xchk_quota_item, which can exit early after xchk_fblock_process_error without releasing dq->q_qlock. This denial-of-service condition affects kernels from the introducing commit 7d1f0e167a06 through the respective stable branch fix points; no public exploit exists and EPSS is at the 5th percentile, indicating low real-world exploitation probability.
Stale pointer dereference in the Linux kernel's futex Priority Inheritance lock path (futex_lock_pi(), kernel/futex/core.c) exposes systems running affected kernel versions to local denial of service by low-privileged users. The flaw manifests in a three-way race between a PI futex owner exiting, a concurrent FUTEX_LOCK_PI attempt, and a futex value modification - causing a freed task_struct pointer to be re-used on the retry path, violating the wait_for_owner_exiting() invariant and triggering WARN_ON_ONCE. No active exploitation is confirmed (EPSS 0.02% at 7th percentile, not in CISA KEV); vendor-released patches are available across all maintained stable LTS branches.
Race condition in the Linux kernel's mac80211 WiFi subsystem allows a local low-privileged attacker to trigger a static_branch_dec() integer underflow via concurrent writes to the AQL debugfs control file, causing a kernel WARNING and potential availability impact. Affected kernels span from the introduction of the aql_disable static key (v5.12) through multiple stable branches, with fixes backported to 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, and 7.0. EPSS is 0.02% (7th percentile) and no active exploitation is recorded in CISA KEV, placing this firmly in the low-real-world-risk category despite its availability impact.
Insufficient ASB polling timeout in the Linux kernel's bcm2835-power pmdomain driver intermittently fails to complete the V3D AXI Slave Bridge handshake on BCM2711 hardware during runtime PM suspend, leaving the VideoCore 3D GPU in a broken power state. Systems running intensive V3D workloads on BCM2711 (e.g., Raspberry Pi 4) may subsequently experience bus faults or full system hangs on later GPU accesses. No public exploit code exists and EPSS is 0.02% (7th percentile), consistent with a hardware-specific reliability defect rather than a broadly exploitable security attack; the vulnerability is not in CISA KEV.
NULL pointer dereference in the Linux kernel's cp2615 i2c driver crashes the kernel when a USB device lacking a serial number string is probed, resulting in denial of service. The cp2615 driver unconditionally uses the USB serial string as the i2c adapter name without first verifying the pointer is non-NULL, a flaw exploitable by connecting a crafted or malformed CP2615 USB-to-I2C bridge device. No active exploitation is confirmed (not in CISA KEV) and the EPSS score of 0.02% at the 7th percentile reflects negligible exploitation interest; impact is limited to availability with no code execution or data exposure possible.
Missing runtime power management reference in the Linux kernel's Intel Xe GPU driver (drm/xe) allows a local low-privileged user to trigger a kernel WARNING and cause system instability via the ccs_mode sysfs attribute. When ccs_mode_store() invokes xe_gt_reset() without first acquiring an outer runtime PM reference, the internal xe_pm_runtime_get_noresume() call detects the unprotected state and emits a kernel WARNING, with potential for device reset failures and availability loss. No public exploit code exists and EPSS is 0.02%, consistent with a driver correctness bug rather than a targeted security vulnerability; patches are available in stable kernel trees.
NULL pointer dereference in the Linux kernel bonding driver's RLB debug interface allows a local low-privileged user to crash the kernel, causing a denial of service. Specifically, bond_debug_rlb_hash_show in bond_debugfs.c dereferences client_info->slave without a NULL guard - a condition intentionally created by rlb_clear_slave when no replacement bonding slave is available - producing a BUG: kernel NULL pointer dereference at address 0x0. Affected across multiple stable kernel trees from 5.10.x through 7.0; no public exploit code exists and EPSS is 0.02%, consistent with low opportunistic risk, though Siemens PSIRT has issued downstream advisories (SSA-019113, SSA-082556) indicating industrial/embedded impact.
The NXP-NCI NFC driver in the Linux kernel triggers a kernel WARN_ON and fails to operate correctly when firmware and enable GPIOs are routed through I2C GPIO expanders, causing denial of service to NFC subsystem functionality on affected hardware. Systems running kernel versions from 5.4 through pre-patch releases across multiple stable branches are affected when using NXP NCI NFC chipsets with I2C-connected GPIO expanders. With EPSS at 0.02% (7th percentile), no KEV listing, and no public exploit code identified at time of analysis, this is a low-risk operational reliability defect relevant primarily to embedded and IoT deployments.
A NULL pointer dereference in the Linux kernel ARM SCMI firmware driver allows local authenticated users to trigger a denial of service by causing the system to crash. The vulnerability exists in the __scmi_event_handler_get_ops helper function, which can return NULL instead of the expected ERR_PTR on failure, causing downstream code to dereference a NULL pointer when handling unsupported SCMI events. The flaw was introduced in commit b5daf93b809d1 and affects multiple stable kernel versions; patches are available in Linux 6.18.20, 6.19.10, and 7.0.
Debug logging in the Linux kernel's crash_dump module exposes dm-crypt key material when debug logging is enabled, allowing local privileged users to read encryption keys from kernel logs and potentially cause denial of service through availability impact on crash dump functionality. The vulnerability affects Linux kernel versions prior to 6.18.20, 6.19.10, and 7.0, with an EPSS score of 0.02% indicating low exploitation probability despite the information disclosure risk.
Denial of service in Linux kernel x86/platform/uv module when sockets are deconfigured, causing kernel panic during UV hub info structure allocation on systems with SGI UV architecture. Affects authenticated local attackers with standard user privileges. Vendor-released patches available for multiple kernel versions (6.6.130, 6.12.78, 6.18.20, 6.19.10 and others). EPSS score of 0.02% indicates exploitation is unlikely in typical environments despite low CVSS score barrier.
A null pointer dereference in the i915 GPU driver's graphics translation table (GT) submission logic causes kernel panic and denial of service when the i915 firmware binaries are absent and the system attempts to suspend. Local authenticated attackers with normal user privileges can trigger this crash by initiating system suspend on affected Intel graphics systems without required firmware, resulting in denial of service. No public exploit code identified at time of analysis; EPSS score of 0.02% indicates low exploitation probability in practice.
Denial of service in Linux kernel SMB server implementation allows local authenticated users to crash the system by triggering data stream corruption through improper credit management in smbdirect socket operations. The vulnerability affects kernel versions prior to 6.18.11, 6.19.1, and 7.0, and requires local access with limited privileges to exploit.
A race condition in the Linux kernel SMB client's recv_io credit management allows local authenticated users to cause a denial of service through timing-sensitive credit accounting between incoming data reception and completion processing. The vulnerability affects SMBDirect socket credit handling where credits may be granted to peers before corresponding recv buffers are actually posted, creating a window where credit accounting becomes inconsistent. Exploitation requires local access and moderate complexity but is not confirmed as actively exploited (not listed in CISA KEV).
Denial of service in Linux kernel nexthop query handling allows local authenticated attackers to crash the kernel by querying nexthop objects with large Equal-Cost Multi-Path groups via the RTM_GETNEXTHOP netlink message. The vulnerability stems from fixed-size socket buffer allocation that overflows when processing nexthop groups exceeding approximately 512 members, triggering a kernel warning and potential system instability.
Memory leak in Linux kernel CXL region initialization allows local privileged attackers to cause denial of service through resource exhaustion. The vulnerability exists in the __construct_region() function where failed sysfs_update_group() calls fail to properly free allocated resources, resulting in cumulative memory exhaustion when region construction is repeatedly attempted and fails. CVSS 5.5 reflects local attack vector with low complexity and high availability impact; EPSS 0.02% indicates minimal real-world exploitation probability despite the vulnerability's severity classification.
The Linux kernel BPF verifier fails to validate lock release on exception exits from static subprograms when bpf_throw() is invoked, potentially allowing denial of service or system instability through uncontrolled RCU and preemption lock retention. Affected versions span from 6.7 through 7.0-rc4; CVSS 5.5 (local privilege escalation path) but EPSS 0.02% suggests low real-world exploitation probability. Patch available in stable releases 6.18.21, 6.19.11, and 7.0.
Memory leak and out-of-bounds read in the asus_report_fixup() HID driver function allows local authenticated attackers with limited privileges to cause denial of service through memory exhaustion. The vulnerability affects the ASUS HID device driver across multiple Linux kernel versions, where kmemdup()-allocated buffers were not freed properly and an out-of-bounds read could access memory beyond the original descriptor size. A patch is available from Linux kernel maintainers switching to devm_kzalloc() for proper memory lifecycle management.
Double completions in NVMe-PCI polled queue handling occur when a high-priority task attempts to poll a queue during kernel reset before block layer queue maps are updated, causing race conditions between interrupt-driven and polled I/O paths. Affects Linux kernel versions before 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, and 7.0-rc2, requiring local authentication and high attack complexity to trigger. No public exploit identified, but vendor-released patches are available across all affected stable and development branches.
Memory leak in the HID magicmouse driver's report_fixup() function allows local authenticated attackers to cause a denial of service through repeated device interactions. The magicmouse_report_fixup() function allocates memory via kmemdup() but fails to free the allocated buffer before returning, leading to exhaustion of kernel memory on systems with a Magic Mouse connected. Vendor patches are available across multiple stable branches.
Linux kernel module loader fails to validate ELF section index bounds in simplify_symbols(), causing kernel panic when processing modules with out-of-bounds st_shndx values such as SHN_XINDEX (0xffff). Local privileged attackers can crash the system by loading malformed or legitimately-crafted modules that exploit this missing bounds check, resulting in denial of service. The vulnerability affects all stable kernel versions from 2.6.12 through current releases; patches are available across multiple stable branches (5.15.203+, 6.1.168+, 6.6.131+, 6.12.80+, 6.18.21+, 6.19.11+, 7.0+).
Memory leak in the Linux kernel HID Apple driver causes gradual kernel memory exhaustion on systems connected to Apple HID peripherals. The `apple_report_fixup()` function in `drivers/hid/hid-apple.c` allocates a new buffer via `kmemdup()` each time an Apple device descriptor is processed, but the HID core caller never frees it because the API contract only guarantees lifetime management for pointers returned into the original descriptor buffer. Patches are available across all actively maintained stable branches (6.1, 6.6, 6.12, 6.18, 6.19, 7.0); no active exploitation has been confirmed and EPSS stands at 0.02%.
A denial-of-service vulnerability in the Linux kernel's Btrfs filesystem implementation allows local authenticated attackers to cause filesystem corruption and crashes through a race condition during subvolume creation and lookup. When a newly created Btrfs subvolume's dentry cache is dropped before the BTRFS_ROOT_ORPHAN_CLEANUP flag is set, concurrent orphan cleanup operations can fail with ENOENT, creating negative dentries that prevent subvolume deletion and cause filesystem aborts. EPSS score of 0.02% indicates this is a low-probability exploitation scenario requiring specific timing and configuration conditions, though the impact is severe for affected systems. No public exploit code is identified at time of analysis.
Memory leak in Linux kernel ESP-over-TCP implementation with asynchronous cryptography causes denial of service via socket queue exhaustion when crypto operations complete asynchronously. Authenticated local attackers can trigger the vulnerability by filling the TX queue for espintcp connections while using async crypto algorithms, preventing proper cleanup of socket buffers and gradually consuming system memory until services become unavailable. EPSS score of 0.02% indicates low real-world exploitation probability despite moderate CVSS severity.
Denial of service via kernel panic in the Linux kernel xfrm_iptfs module when processing fragmented IP-TFS packets with mixed fast-path and slow-path reassembly conditions. The vulnerability triggers an invalid memory access (SKB_LINEAR_ASSERT) in skb_put() when attempting to append data to a non-linear socket buffer during packet reassembly, affecting systems using IP-TFS encapsulation over IPsec. Local attackers with network access to send crafted IPsec packets can crash the kernel; active exploitation not confirmed but patch is available.
Denial of service in Linux kernel af_key module allows local authenticated attackers to crash the system via buffer overflow in pfkey_send_migrate() function. The vulnerability occurs because pfkey_send_migrate() fails to validate address family parameters before passing them to set_ipsecrequest(), causing truncation that overfills the socket buffer and triggers kernel panic in skb_put(). EPSS score of 0.02% indicates minimal real-world exploitation risk despite moderate CVSS severity.
Short read handling in EROFS file-backed mounts can mark unread file pages as uptodate when vfs_iocb_iter_read() is interrupted by signals, leading to potential data corruption or information disclosure on systems using EROFS with file-backed mounts. Affected Linux kernel versions prior to fixes in 6.18.21, 6.19.11, and 6.12.80. Local authenticated users can trigger this via signal interruption during I/O operations.
Denial of service via buffer over-read in Linux kernel Bluetooth L2CAP Enhanced Credit Based Flow Control data path allows local authenticated attackers to crash the system by sending malformed L2CAP packets with insufficient payload length. The vulnerability exists in l2cap_ecred_data_rcv() which reads the SDU length field without validating that the socket buffer contains the required 2 bytes, causing an out-of-bounds read that triggers a kernel panic when the buffer is too small. EPSS exploitation probability is 0.02% (percentile 7%), and a vendor patch is available.
Null pointer dereference in the Linux kernel Bluetooth L2CAP implementation allows local authenticated attackers to cause a kernel panic and denial of service via the l2cap_sock_ready_cb function during L2CAP connection initialization. The vulnerability occurs when a socket pointer is dereferenced without null validation, triggering a KASAN null-ptr-deref exception that crashes the kernel. EPSS score of 0.02% indicates low real-world exploitation probability despite the moderate CVSS score; no public exploit code or active KEV listing has been identified at time of analysis.
Denial of service via deadlock in NFC NCI subsystem when nci_close_device() flushes work queues while holding req_lock, triggering a circular lock dependency with nci_rx_work(). The vulnerability affects Linux kernels across multiple stable branches (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 6.19, 7.0) and was reproduced in roughly 4% of nci selftest runs on debug kernels, though EPSS scoring (0.02% percentile 7%) indicates low baseline exploitation probability. Local privilege requirement and high attack complexity in practice mean real-world impact is limited to NFC-capable systems with specific workload timing.
Linux kernel UDP socket binding fails to properly detect wildcard address conflicts when hash table collision count exceeds 10, allowing a socket to bind to a wildcard address (such as [::]:8888 or 0.0.0.0:8888) even when specific addresses on that port are already in use. This denial-of-service vulnerability affects local authenticated users who can create UDP sockets, bypassing port conflict checks that should prevent duplicate bindings. The issue stems from improper hash table selection logic in UDP's bind path, which switches from a port-only hash to an address-port hash at a threshold, creating a window where wildcard bindings are incorrectly permitted.
A deadlock condition in Linux kernel Bluetooth L2CAP connection deletion allows local authenticated users to trigger a denial of service by causing the l2cap_conn_del() function to deadlock when canceling delayed work timers while holding the connection lock. The vulnerability affects multiple Linux kernel versions across the 6.x and 7.0 release branches and has been resolved through upstream patch commits that reorganize lock acquisition and work cancellation order.
Denial of service via infinite loop in Bluetooth L2CAP ERTM reconfiguration allows local authenticated attackers to exhaust system memory. The vulnerability arises from two distinct flaws: improper handling of L2CAP channel reconfiguration that leaks ERTM resources and fails to validate minimum PDU size, causing an infinite loop in l2cap_segment_sdu() when remote_mps is set to zero. EPSS score of 0.02% indicates limited exploitation likelihood despite the high CVSS score, reflecting the requirement for local access and authenticated Bluetooth channel state.
Out-of-bounds array access in the btusb driver's Bluetooth SCO link handling allows local authenticated attackers to cause denial of service by exhausting kernel memory or crashing the Bluetooth subsystem. The btusb_work() function fails to constrain the sco_num variable before indexing a three-entry lookup table, permitting reads and potential writes past allocated buffer boundaries when four or more SCO links are active. This affects Linux kernel versions 5.8 through 7.0-rc2 and requires local access with unprivileged user privileges to trigger.
Information disclosure in Linux kernel netfilter nf_conntrack_expect proc interface allows local authenticated users to read connection tracking expectations from other network namespaces, bypassing namespace isolation. The vulnerability affects kernel versions through 6.x and 7.0-rc releases with CVSS 5.5 (local, low complexity, high availability impact) and EPSS 0.02% exploitation probability; vendor-released patches are available for multiple stable branches (6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, 7.0).
Denial of service in Linux kernel netfilter ctnetlink subsystem allows local authenticated attackers to trigger undefined behavior via improper validation of TCP window scale and connection tracking state parameters. The vulnerability stems from missing netlink policy range checks that permit out-of-bounds values (TCP window scale 0-255 instead of clamped 0-14, TCP state values exceeding TCP_CONNTRACK_MAX) to be passed to kernel code expecting constrained ranges, leading to undefined behavior in shift operations and state machine logic. CVSS 5.5 (local, low complexity, requires low privileges) with EPSS 0.03% indicates low real-world exploitation likelihood despite availability of vendor patches.
Use-after-free in Linux kernel RDMA/irdma driver allows local authenticated users to cause denial of service by triggering uninitialized completion handling during queue pair creation failure. When ib_copy_to_udata fails in irdma_create_qp, the cleanup path attempts to wait on an uninitialized free_qp completion structure, resulting in a kernel panic or system hang. EPSS score of 0.02% indicates low exploitation probability despite moderate CVSS score; patch is available from vendor.
Integer overflow in Linux kernel RDMA/irdma depth calculation functions allows local authenticated users to trigger a denial of service via improper handling of U32_MAX values passed for SQ/RQ/SRQ size parameters. The vulnerability stems from depth calculations performed in 32-bit integers rather than 64-bit, enabling truncation that bypasses validation and returns success when allocation should fail, potentially causing system instability or resource exhaustion.
Use-after-free vulnerability in the Linux kernel SPI subsystem allows local authenticated attackers to cause denial of service by exploiting unsynchronized access to the driver_override field during device probe operations. The vulnerability occurs because __driver_attach() calls the bus match() callback without holding the device lock, creating a race condition when driver_override is accessed without proper synchronization. CVSS score of 5.5 reflects local attack vector with low complexity and high availability impact. EPSS exploitation probability is minimal at 0.02%, suggesting this is a localized memory safety issue rather than a widely-exploited attack vector.
Denial of service in Linux kernel on s390 architecture allows local authenticated attackers to crash the system by triggering an out-of-bounds access in the syscall dispatch table. The s390 syscall number is directly controlled by userspace without spectre boundary protection (array_index_nospec), enabling an attacker with local user privileges to supply an invalid syscall number that bypasses array bounds checking and causes a memory access violation. EPSS score is extremely low (0.03%), consistent with limited attack surface on s390-specific systems and requirement for local authentication.
Information disclosure in Linux kernel s390 architecture allows local authenticated attackers to read residual data from r12 register during kernel entry transitions, enabling potential exposure of sensitive kernel state through register side channels. This occurs on s390 systems running kernel versions 6.4 through 7.0-rc5 and affects all architectures due to incomplete register scrubbing following removal of branch prediction isolation code. EPSS score of 0.02% indicates minimal real-world exploitation likelihood despite moderate CVSS impact rating.
Kernel panic via null pointer dereference in the tracing subsystem occurs when boot-time trigger registration fails and kthread creation does not succeed, allowing deferred trigger frees to accumulate indefinitely and crash the system. Local authenticated attackers can trigger this by specifying malformed trace event parameters on the kernel command line, resulting in denial of service. EPSS exploitation probability is 0.02% (very low) despite moderate CVSS score, suggesting this requires specific boot-time configuration and local access.
Denial of service via deadlock in the Linux kernel tracing subsystem occurs when CPU hotplug operations interact with osnoise tracing thread lifecycle management. A local privileged user can trigger a deadlock by inducing CPU offline events while osnoise threads hold conflicting locks (interface_lock and cpus_read_lock), causing system hang. CVSS 5.5 reflects local attack vector and privilege requirement; EPSS 0.02% indicates low real-world exploitation likelihood despite deadlock severity.
Denial of service in Linux kernel IPTFS (IP Traffic Flow Security) subsystem allows local authenticated attackers to trigger an infinite loop via crafted ESP packets with malformed inner IPv4 headers containing tot_len=0. The vulnerability bypasses input validation in __input_process_payload() that should reject IPv4 packets where tot_len is less than the header length, causing the kernel to spin indefinitely in softirq context and hang the system.
A race condition in Linux kernel memory management causes folio objects to be accessed without proper locking during concurrent mega-transparent huge page (mTHP) splitting and zap operations on arm64, triggering a denial-of-service condition via VM_WARN_ON_ONCE() panic when the missing memory barrier allows CPU reordering to expose unlocked folio state. The vulnerability affects Linux kernel versions before 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.21, 6.19.11, and 7.0 with EPSS score of 0.02% indicating low real-world exploitation likelihood despite moderate CVSS impact rating.
A denial-of-service condition in the Linux kernel writeback subsystem causes system hangs during suspend-to-RAM on filesystems with no data integrity guarantees (such as FUSE-based overlayfs). When the sync operation waits for flusher threads to complete writeback on these filesystems, the kernel can deadlock if the underlying filesystem daemon is frozen or unresponsive, particularly during system power management. The vulnerability affects Linux kernel versions prior to the fix and is resolved by introducing the SB_I_NO_DATA_INTEGRITY superblock flag to skip unnecessary writeback completion waits on filesystems that cannot guarantee data persistence.
AMD GPU driver in the Linux kernel fails to prevent rapid PASID (Process Address Space ID) reuse, allowing local authenticated attackers to trigger interrupt handling errors and denial of service. When a process exits with an assigned PASID, page faults may remain pending in the interrupt handler ring buffer; if a new process is immediately assigned the same PASID, it inherits these stale interrupts causing system instability. The vulnerability affects Linux kernel versions prior to 7.0 RC1 and requires local user access with standard privileges. EPSS score of 0.02% indicates minimal real-world exploitation likelihood despite moderate CVSS impact rating.
Memory leak in AMD display driver (amdgpu_dm) on Linux kernel allows local authenticated attackers to cause denial of service by exhausting kernel memory when display sinks are connected and the system resumes from sleep. The vulnerability arises from failure to free previously allocated drm_edid structures before overwriting them, and is confirmed in kernel versions up to 7.0 RC5 with EPSS exploitation probability of 0.02% indicating low real-world exploitation likelihood.
Denial of service via null pointer dereference in AMD display driver backlight setup affects Linux kernel versions 6.19 through 7.0-rc5 when LVDS connectors are present without extended backlight capabilities. Local authenticated users with low privileges can trigger a crash by accessing backlight controls on affected systems, causing system instability. Patch available from vendor with EPSS score of 0.02% indicating low real-world exploitation probability.
Memory leak in Linux kernel DAMON subsystem allows local authenticated users to exhaust system memory via failed allocation in damon_sysfs_new_test_ctx(), causing denial of service. The vulnerability affects kernel versions 6.17.6 through 7.0-rc1 when DAMON_SYSFS is enabled. A privileged user can trigger the leak by making specific control sequences that cause early function returns, bypassing cleanup code and leaving param_ctx unfreed.
Denial of service via null pointer dereference in Linux kernel DAMON sysfs module allows local privileged users to crash the system by setting nr_contexts to zero while DAMON is running, then issuing state-change commands that dereference an empty contexts array without bounds checking. EPSS exploitation probability is minimal at 0.02%, reflecting the requirement for local privileged access and active DAMON configuration.
Null pointer dereference in Linux kernel DAMON sysfs interface allows local authenticated users to cause denial of service by setting nr_contexts to zero while DAMON is running, triggering dereference of uninitialized context array pointers in damon_sysfs_repeat_call_fn(). The vulnerability requires local access and low-level privileges (non-root user with sysfs write access), with an EPSS exploitation probability of 0.02% indicating low real-world attack likelihood despite the straightforward trigger mechanism.
A race condition in the Linux kernel's page table walking code (mm/pagewalk) allows local authenticated attackers to trigger a kernel panic (denial of service) by concurrent PUD splitting and refaulting operations. The vulnerability occurs when one thread is reading proc/[pid]/numa_maps while another thread (e.g., VFIO-PCI DMA setup) modifies the page table hierarchy, causing walk_pmd_range() to attempt walking a PMD range that no longer exists. The condition requires local access and a privileged operation (VFIO DMA pinning), but can reliably crash the kernel, affecting system availability.
Kernel panic via reachable assertion in the Linux kernel ext4 filesystem driver allows a local low-privileged user to crash the system by presenting an ext4 filesystem with inline data exceeding PAGE_SIZE, triggering BUG_ON() in ext4_read_inline_folio(). Affected branches span 6.6.x through 7.0-rc5; patched releases are available as 6.6.131, 6.12.80, 6.18.21, 6.19.11, and 7.0. No public exploit code exists and EPSS stands at 0.02% (5th percentile), consistent with the absence of active exploitation from CISA KEV.
Null pointer dereference in Linux kernel DAMON subsystem allows local authenticated attackers to cause denial of service when memory allocation failures occur during online parameter updates. The vulnerability affects DAMON's context commit mechanism (damon_commit_ctx), which can partially corrupt kernel state if internal memory allocation fails, potentially leading to NULL pointer dereference in damos_commit_dests(). While real-world impact is rare due to the low probability of allocation failure, the severe consequence of kernel panic necessitates this fix.
Denial of service in the Linux kernel dmaengine idxd subsystem allows local attackers with low privileges to crash the system by triggering a Function Level Reset when the hardware does not support event log reporting. The vulnerability occurs when the driver attempts to restore or free an event log that was never allocated, resulting in a kernel crash with high availability impact.
Memory leak in the Linux kernel dmaengine idxd driver occurs when a workqueue is reset, causing resources to be improperly released due to premature setting of the workqueue type to NONE. A local attacker with low privileges can trigger this condition to exhaust kernel memory and cause a denial of service. The vulnerability affects kernel versions 5.8 through 7.0 and has an available vendor patch with low exploitation probability (EPSS 0.02%).
Memory leak in the Linux kernel dmaengine idxd driver during device removal allows local authenticated attackers to cause a denial of service by exhausting kernel memory. The vulnerability occurs when the device reset causes configuration registers to revert to default state, preventing proper deallocation of event log memory. EPSS exploitation probability is very low at 0.02%, and no public exploit has been identified.
Incorrect error-handling in the Linux kernel's Xilinx XDMA DMA engine driver causes a kernel denial-of-service when regmap initialization fails. The driver's probe function checks the return value of devm_regmap_init_mmio against NULL rather than using IS_ERR(), meaning a failure returns an ERR_PTR() value that is non-NULL and passes the check silently; the corrupted pointer is then used, triggering a kernel panic. Affected systems require Xilinx XDMA hardware to be present and actively probed by the driver. No public exploit has been identified at time of analysis, and EPSS exploitation probability stands at a negligible 0.02%.
Kernel panic in the Linux netfs subsystem's netfs_limit_iter() function crashes systems when a process writes a core dump to a 9P-mounted filesystem. The function handles only ITER_FOLIOQ, ITER_BVEC, and ITER_XARRAY iterator types, triggering a hard BUG() when __kernel_write() supplies an ITER_KVEC iterator via netfs_unbuffered_write(), producing a local denial of service via kernel panic. No public exploit code exists and no active exploitation has been identified; this is a no public exploit identified at time of analysis scenario with EPSS at 0.02% (5th percentile), indicating minimal widespread exploitation interest.
NULL pointer dereference in the Linux kernel's netfs subsystem crashes the kernel when retrying unbuffered writes on filesystems that omit the prepare_write stream operation, such as 9P. A local low-privilege user who can write to such a mounted filesystem and induce a get_user_pages() -EFAULT failure can trigger a kernel panic, causing a denial of service. No public exploit has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) reflects negligible observed exploitation probability; the vulnerability is not listed in CISA KEV.
Memory leak in the Linux kernel btrfs filesystem driver allows a local authenticated attacker to gradually exhaust kernel memory through repeated mount and unmount operations on affected configurations. The flaw exists in check_removing_space_info(), which incorrectly uses kfree() on kobject-initialized sub-group space_info elements instead of the proper kobject_put() teardown path, leaving kobj->name string allocations unreferenced and unfreed. No public exploit exists (EPSS 0.02%, 7th percentile) and the vulnerability is not listed in CISA KEV, placing real-world risk well below the CVSS 5.5 Medium score might suggest.
Cross-cache slab free in the Linux kernel's socket buffer (SKB) subsystem allows a local authenticated attacker to trigger a kernel panic and denial of service on systems where KFENCE is enabled. When KFENCE intercepts a kzalloc() call whose requested size exactly matches SKB_SMALL_HEAD_CACHE_SIZE, the computed skb_end_offset misleads skb_kfree_head() into freeing the object to skb_small_head_cache instead of the originating kmalloc cache, corrupting slab allocator state. No public exploit is identified at time of analysis and EPSS is 0.02% (4th percentile), placing this firmly in the low-urgency tier absent a KFENCE-enabled production environment.
MaxKB versions 2.7.1 and below allow authenticated users with tool-editing permissions to bypass sandbox network protection via socket.sendto() with the MSG_FASTOPEN flag, enabling connections to internal services explicitly blocked by the sandbox's banned hosts configuration. The vulnerability exploits a gap in LD_PRELOAD hooking-sendto() with MSG_FASTOPEN establishes TCP connections directly through the kernel without invoking the hooked connect() function, completely circumventing IP validation. This is a server-side request forgery (SSRF) vector that requires prior authentication and tool-editing privileges. Vendor-released patch: version 2.8.0.
Uninitialized heap memory leaks to userspace via the Linux kernel's netfilter logging subsystem (nfnetlink_log), exposing 1-3 bytes of stale kernel heap content per logged packet through the NFULA_PAYLOAD netlink attribute. Affected systems are those running Linux kernel versions dating back to commit df6fb868d611 (circa 2.6.24) where NFLOG-based packet logging is configured. A low-privileged local attacker with access to an NFLOG netlink socket can passively harvest kernel memory fragments, potentially useful for defeating KASLR or reconstructing sensitive in-memory data. No public exploit identified at time of analysis and EPSS exploitation probability is very low (0.02%, 7th percentile), but the vulnerability class is well-understood by kernel exploit developers.
Stack corruption in the Linux kernel's netfilter SIP connection tracking helper (`nf_conntrack_sip`) allows a local low-privileged attacker to disrupt SIP call establishment by triggering use of an uninitialized `rtp_addr` stack variable in `process_sdp()`. When SDP bodies contain no valid media sections, the uninitialized address is passed to `nf_nat_sdp_session()`, which rewrites SDP `o=` and `c=` lines with either zeroes (when `CONFIG_INIT_STACK_ALL_ZERO` is active) or arbitrary stack contents, corrupting session negotiation. No public exploit identified at time of analysis; EPSS is 0.02% (7th percentile), and this vulnerability is not listed in CISA KEV.
Null pointer dereference in the Linux kernel's RDS-over-InfiniBand (RDS/IB) subsystem allows a local low-privileged user to crash the kernel by sending an RDS_CMSG_RDMA_MAP control message before an IB connection is fully established. The impact is a complete denial of service (kernel panic) with no confidentiality or integrity exposure, scoring CVSS 5.5. No public exploit code has been identified at time of analysis, and EPSS exploitation probability is extremely low at 0.02%, consistent with the specialized InfiniBand hardware prerequisite.
NULL pointer dereference in the Linux kernel's netfilter x_tables subsystem allows a local attacker with CAP_NET_ADMIN privileges to crash the system by loading an NFPROTO_UNSPEC-registered xt_match or xt_target (e.g., xt_devgroup) into an ARP nftables chain via nft_compat, triggering a kernel panic and complete availability loss. CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects the local-only, availability-only impact, and EPSS at 0.02% (7th percentile) indicates very low real-world exploitation probability. No active exploitation confirmed (not in CISA KEV); vendor-released patches are available across multiple stable kernel branches.
Divide-by-zero in the Linux kernel's HFSC traffic scheduler (net/sched/sch_hfsc.c) allows a local authenticated user to crash the kernel via a denial-of-service oops. The flaw is triggered by enqueueing packets through an HFSC qdisc configured with slope values that cause a u64-to-u32 arithmetic truncation to yield a zero divisor in rtsc_min(). With EPSS at 0.02% (7th percentile), no CISA KEV listing, and no public exploit code identified at time of analysis, real-world exploitation risk is currently low, though the crash path is deterministic and reproducible by anyone with HFSC configuration access.
NULL pointer dereference in the Linux kernel's net/sched cls_flow traffic classifier allows a local low-privileged attacker to crash the kernel (denial of service) by creating a flow filter on a shared traffic control block without a fully qualified baseclass. The crash occurs in flow_change() at net/sched/cls_flow.c:508, confirmed by a KASAN trace showing null-ptr-deref when block->q is dereferenced on a shared block where it is intentionally NULL. No active exploitation confirmed - not listed in CISA KEV - and EPSS stands at 0.02% (7th percentile), indicating negligible real-world exploitation probability at time of analysis.
NULL pointer dereference in the Linux kernel's cls_fw traffic classifier (net/sched/cls_fw.c) crashes the kernel when authenticated local users configure an old-method cls_fw filter on a shared tc block and traffic with a nonzero major skb mark is processed. The flaw exists because the old classification path in fw_classify() calls tcf_block_q() and dereferences q->handle, but shared blocks hold a NULL block->q pointer. The impact is limited to local denial of service (kernel panic); no confidentiality or integrity compromise is possible. EPSS is 0.02% (7th percentile), this vulnerability is not in CISA KEV, and no public exploit has been identified at time of analysis.
Uncontrolled resource exhaustion in the Linux kernel bridge MRP subsystem allows a locally authenticated attacker to trigger a kernel OOM panic by supplying a zero-value test interval via netlink. The br_mrp_start_test() and br_mrp_start_in_test() functions lack input validation for the interval parameter; when set to zero, usecs_to_jiffies(0) yields 0, causing delayed work items on system_percpu_wq to reschedule themselves at maximum rate while continuously allocating and transmitting MRP test frames until all system memory is exhausted. No public exploit has been identified at time of analysis, and the EPSS score of 0.02% (6th percentile) reflects low current exploitation probability, though the denial-of-service impact is severe - a full kernel panic.
Local denial-of-service via kernel memory leak in the Linux kernel's netfilter ipset subsystem affects multiple stable branches from Linux 5.6 through the fixed releases 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0. The mtype_del() function contains a logic flaw that prevents proper bucket release when all live entries are deleted but the positional counter (n->pos) still references past-deleted slots, causing accumulated unreleased kernel memory across repeated ipset add/delete operations. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; EPSS at 0.02% (7th percentile) reflects very low real-world exploitation probability.
Local denial-of-service in the Linux kernel's netfilter nfnetlink_log subsystem allows a low-privileged local user to trigger a kernel WARN splat and cause netlink message drops. The root cause is an accounting error in NLMSG_DONE that omits the netlink header size, counting only the attribute size. With a CVSS score of 5.5 (AV:L/AC:L/PR:L) and EPSS at 0.02% (7th percentile), this has no public exploit code identified at time of analysis and is not listed in the CISA KEV catalog - impact is limited to netlink logging availability, with no code execution or data exposure.
Integer overflow in the Linux kernel's IPv6 sendmsg ancillary-data path allows a local user with CAP_NET_RAW (or namespaced CAP_NET_RAW via unprivileged user namespaces) to crash the kernel via skb_under_panic(), constituting a local denial of service. The 16-bit opt_flen accumulator in ip6_datagram_send_ctl() wraps around when flooded with large IPV6_DSTOPTS cmsgs, causing the transmit path to underallocate sk_buff headroom while dst1opt still references a large destination-options header - the mismatch triggers BUG() on subsequent packet transmission. A proof-of-concept (poc.c) was submitted with the bug report; no public exploit identified at time of analysis as actively exploited (no CISA KEV listing), and EPSS is very low at 0.03%.
Integer overflow in the Linux kernel's USB gadget mass storage driver (f_mass_storage) allows a malicious USB host to corrupt kernel memory or trigger out-of-bounds accesses on any Linux system acting as a USB storage gadget. The flaw affects kernel versions tracing back to Linux 3.3 (commit 144974e7f9e32b53b02f6c8632be45d8f43d6ab5), with vendor-released patches now available across multiple stable branches. No public exploit has been identified at time of analysis, and EPSS exploitation probability stands at a very low 0.02%, consistent with the physical USB access prerequisite.
Kernel crash via forged VCC pointer in the Linux kernel ATM networking subsystem (net/atm/sigd.c) allows a local low-privileged attacker who has assumed the ATM signaling daemon role to dereference arbitrary kernel memory, resulting in denial of service. The flaw affects Linux 2.6.12 through multiple current stable branches, with patches available for 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 6.19.x, and 7.0-rc1. A public reproducer exists at a GitHub gist, though the EPSS score of 0.02% (7th percentile) and absence from CISA KEV reflect the niche ATM subsystem's limited real-world attack surface.
Denial-of-service in the Linux kernel's ksmbd SMB server component stems from improper handling of volume identifiers in FS_OBJECT_ID_INFORMATION responses. Affected kernels fail to correctly use the superblock UUID (sb->s_uuid) as the volume identifier, and lack a safe fallback (via vfs_statfs()) for filesystems that do not expose a UUID - creating conditions for a kernel availability impact when a local low-privileged user interacts with an affected SMB share. EPSS is 0.01% (1st percentile) and no active exploitation is confirmed in CISA KEV; no public exploit code has been identified at time of analysis.
Linux kernel sunrpc subsystem fails to properly release cache_request objects when file descriptors are closed mid-read, resulting in memory leaks and potential information disclosure through stale cache entries. The vulnerability affects all Linux kernel versions with the affected sunrpc cache implementation, and requires no special privileges or network access to trigger since it occurs during normal file descriptor closure in the kernel's user-space cache management interface.
Null pointer dereference in Linux kernel mac80211 IEEE 802.11 wireless subsystem crashes AP_VLAN stations during channel bandwidth change operations. The ieee80211_chan_bw_change() function incorrectly accesses link data on VLAN interfaces (such as 4-address WDS clients) where the link structure is uninitialized, leading to kernel panic when dereferencing a NULL channel pointer. Any system with AP_VLAN wireless configurations and active channel state announcement (CSA) operations is vulnerable to local denial of service.