Linux
Monthly
Denial of service (and potential memory corruption) in the Linux kernel SCTP stack arises because __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport, leaving a dangling pointer once the original transport is RCU-freed via an ASCONF Delete-IP peer removal. A subsequent SACK that reneges the TSN clears tsn_gap_acked, and the next SACK dereferences the freed transport in sctp_check_transmitted(), producing a KASAN-confirmed slab-use-after-free. The issue affects hosts actively using SCTP with dynamic address reconfiguration; it carries a published CVSS of 9.8 but low EPSS (0.22%, 13th percentile), and no public exploit has been identified at time of analysis.
Use-after-free and NULL-pointer dereference in the Linux kernel's SCTP stack allow a remote SCTP peer to corrupt kernel memory or crash the host by triggering association-restart handling that leaves the cached ASCONF chunk pointer (addip_last_asconf) dangling. A delayed authenticated ASCONF-ACK then reaches sctp_sf_do_asconf_ack() and operates on freed memory, causing a second release, while clearing the pointer exposes a companion NULL dereference via a racing T4 timer callback. There is no public exploit identified and EPSS is low (0.22%), consistent with a race-condition kernel bug rather than a turnkey remote exploit despite the 9.8 input score.
A remotely triggerable use-after-free in the Linux kernel's SCTP stack (net/sctp) lets an authenticated SCTP peer read freed transport memory in sctp_outq_select_transport(). By sending an ASCONF chunk that both adds a peer transport and then removes it via a wildcard DEL-IP, the newly added transport is freed while asoc->new_transport still points to it; a later HEARTBEAT and address-replacement sequence dereferences the dangling pointer. There is no public exploit identified at time of analysis, EPSS is low (0.22%), and the flaw is not in CISA KEV, though a reliable private reproducer is described.
Kernel memory disclosure in the Linux bnxt_re RDMA driver (Broadcom NetXtreme RDMA) exposes 4092 bytes of stale kernel data to local users holding InfiniBand device access. The bnxt_re_alloc_ucontext() function allocates the user context shared page with __get_free_page(GFP_KERNEL), which does not zero memory, then maps the page into userspace - leaving all bytes beyond the 4-byte AVID write at offset 0x10 uninitialized and fully readable by the calling process. Exploitation requires only a single mmap() call after IB_USER_VERBS_CMD_GET_CONTEXT, making it trivially scriptable; no public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects low observed exploitation activity.
Use-after-free in the Linux kernel's route4 (cls_route) traffic classifier fastmap cache allows a local attacker with CAP_NET_ADMIN to read freed kernel heap memory by racing filter deletion against fastmap cache population, potentially escalating to full kernel compromise. Affected versions span Linux 3.18 through current stable branches; the kernel security team backported fixes to eight LTS/stable lines (5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2). No public exploit identified at time of analysis; EPSS of 0.17% (6th percentile) reflects minimal current exploitation activity, though the theoretical impact is severe given the kernel-level UAF primitive.
Out-of-bounds kernel memory write in the Linux kernel packet socket implementation allows a local low-privilege attacker to corrupt kernel memory by exploiting a race condition between `packet_snd()` reads of `dev->hard_header_len` and concurrent device reconfiguration. When the race is won - for example during a bonding device type change - `skb->data` is positioned before `skb->head`, and the subsequent userspace copy writes beyond the allocated socket buffer, creating a kernel memory corruption primitive suitable for local privilege escalation. No public exploit or CISA KEV listing exists at time of analysis; EPSS of 0.16% reflects very low current exploitation probability, though the primitive is powerful and patch availability across multiple stable branches makes remediation straightforward.
Kernel-level use-after-free in the Linux IPv6 policy-routing (fib6 rules) subsystem allows a suppressed route to leak a released rt6_info back to rt6_lookup() callers, so a subsequent dst_release() operates on freed memory. The flaw affects systems using IPv6 FIB rules with route suppression and realistically manifests as a kernel crash (denial of service) and potential memory corruption. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile); a vendor patch is available across stable trees.
Out-of-bounds host memory access in the Linux kernel vhost subsystem results from a stale metadata cache that is not invalidated when vring addresses or sizes are reconfigured via VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM while a virtqueue is live. Systems running KVM/QEMU virtualization with vhost and a device IOTLB attached - spanning kernel versions from 4.11 through unpatched stable series - are affected, with the scope change (S:C) in the CVSS vector indicating potential read/write access to host memory beyond the vhost subsystem boundary. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (6th percentile), consistent with a complex kernel-internal flaw not yet commoditized.
Netfilter's nft_payload offload mask builder in the Linux kernel performs an undefined-behavior shift (1 << 120 on a 32-bit int) when constructing hardware-offload match masks for partial IPv6 address fields, and separately over-masks trailing bytes when priv_len is a multiple of four. Systems running affected kernel versions that use nftables hardware offload rules with partial IPv6 address matches may experience firewall rule bypass (I:H) or kernel instability triggered by UBSAN (A:H). No public exploit is identified at time of analysis, and EPSS sits at 0.16% (5th percentile), consistent with a kernel correctness/stability bug rather than an actively targeted security issue. Patches are available across all active stable branches.
IV race condition in the Linux kernel's AF_ALG skcipher interface allows local unprivileged users to inject attacker-controlled initialization vectors into in-flight AIO cryptographic operations. For CTR and CBC modes, IV reuse enables keystream derivation and plaintext recovery of concurrent cipher operations sharing the same AF_ALG socket. No public exploit has been identified at time of analysis; patches are confirmed available across all major stable kernel branches (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 7.1.5, 7.2-rc1).
Unbounded recursion in the Linux kernel's slab allocator free path can crash the kernel when memory allocation profiling or cgroup memory accounting is active. Specific size relationships between KMALLOC_NORMAL caches cause circular obj_exts array dependencies - for example, kmalloc-512 and kmalloc-1k each hold the other's obj_exts array - so freeing one slab triggers a chain of recursive kfree/discard_slab calls that exhausts the kernel task stack. This was confirmed to cause production kernel stack overflows at Meta's infrastructure (approximately 125 recursive frames observed) and is fixed in Linux 6.12.103, 6.18.44, and 7.1.8; no public exploit code exists and exploitation probability is very low (EPSS 0.18%).
Use-after-free in the Linux kernel Thunderbolt XDomain subsystem enables a physically adjacent attacker with a malicious Thunderbolt device to corrupt kernel memory, potentially achieving code execution at kernel privilege level. The flaw stems from a race condition introduced when commit 559c1e1e0134 moved tb_xdp_handle_request() to the system workqueue, breaking the serialization with the disconnect path and creating a window where queue_delayed_work() can fire on a freed xdomain object. No public exploit has been identified and EPSS (0.16%, 5th percentile) confirms very low near-term exploitation probability, though the kernel-level impact makes this relevant for organizations operating Thunderbolt-enabled endpoints in adversarial physical environments.
Deadlock and use-after-free conditions in the Linux kernel's IDXD character device driver expose local low-privileged users on Intel DSA-equipped systems to potential kernel memory corruption or denial of service. The vulnerability resides in `idxd_cdev_open()`, where error cleanup paths call `put_device(fdev)` while still holding `wq->wq_lock`, causing `idxd_file_dev_release()` to deadlock on synchronous reentry; a secondary fallthrough defect then allows `idxd_xa_pasid_remove(ctx)` and `kfree(ctx)` to operate on memory already freed by that release callback. No public exploit has been identified at time of analysis, and an EPSS score of 0.16% (6th percentile) reflects the low observed exploitation probability consistent with the specialized hardware prerequisite.
Out-of-bounds kernel memory read and incomplete invalidation affect the Linux kernel's ARM SMMUv3 iommufd nested-virtualization path (arm_vsmmu_vsid_to_sid), where a guest virtual Stream ID is mapped to a single physical Stream ID from master->streams[0]. On ARM64 hosts using nested SMMUv3 with iommufd vDEVICE, assigning a device that has zero streams turns master->streams into a ZERO_SIZE_PTR that is read out of bounds, while a device with multiple streams leaves the other streams' ATC/IOTLB entries unreachable by guest invalidations. There is no public exploit identified at time of analysis, and EPSS is very low (0.15%, 5th percentile), consistent with a niche subsystem rather than broad exploitability despite the 9.3 CVSS.
Deadlock in the Linux kernel btrfs zoned filesystem causes an unrecoverable filesystem hang on hosts using zoned block devices (SMR HDDs or ZNS SSDs). The writeback path in btree_writepages() holds zoned_meta_io_lock while the tree-log block group fallback path waits for a transaction commit, while the concurrent transaction commit path blocks on that same lock - a classic ABBA deadlock resulting in complete filesystem unavailability. No public exploit exists and EPSS is 0.16% (5th percentile), reflecting a niche-deployment reliability issue rather than a broad security threat; the condition can be triggered by normal I/O stress and was confirmed reproducible via fstests generic/475.
Memory corruption in the Linux kernel's NTFS filesystem driver stems from unchecked integer arithmetic when converting runlist element counts into byte sizes inside ntfs_rl_realloc() and ntfs_rl_realloc_nofail(). An attacker who can get a crafted NTFS volume mounted and parsed can overflow the size calculation and corrupt kernel heap memory, potentially escalating to code execution. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile).
Out-of-bounds kernel memory read in the Linux netfilter SIP connection-tracking helper (nf_conntrack_sip) lets remote attackers crash or leak memory from any host doing SIP NAT rewriting. When sip_help_tcp() NAT-rewrites a SIP message, the per-message size delta is stored in a signed 16-bit variable; a single message with a long Contact list can grow by more than S16_MAX (while still under the 65535 enlarge_skb limit), wrapping the counter so datalen underflows to a huge unsigned value and ct_sip_get_header() reads past the linearized skb tail (KASAN use-after-free). Tagged Information Disclosure; no public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile).
Local privilege escalation and host memory corruption in the Linux kernel's KVM arm64 virtual GIC (vgic) LPI handling allows a malicious guest to trigger a use-after-free by racing LPI release against re-registration. Affecting arm64 KVM hosts (introduced by the LPI refcounting rework, present through Linux 6.17), a guest that issues an ITS DISCARD while an LPI is still referenced and then re-maps the same INTID via MAPTI can cause the kernel to erase a newly registered LPI from the xarray or leak an orphaned structure. There is no public exploit identified at time of analysis and EPSS is low (0.14%), but the scope-changing guest-to-host impact makes this a meaningful host-integrity issue.
Out-of-bounds slab read in the Linux kernel keyring subsystem's `keyring_get_key_chunk()` exposes kernel heap memory and enables potential kernel crashes from any unprivileged local user account. Affected kernels fail to bounds-check the full computed byte offset when walking description-level key chunks, allowing reads past a `kmemdup`-allocated buffer. This is reachable via the standard `add_key(2)` syscall with no elevated privileges and is confirmed by KASAN as a slab-out-of-bounds read; no public exploit exists and EPSS is 0.16% (5th percentile), but multi-tenant and container environments with untrusted local users face meaningful exposure.
Use-after-free in the Linux kernel's nf_tables netfilter subsystem exposes local attackers with low-privilege accounts to potential kernel-level privilege escalation by exploiting a race condition in nft_object lifecycle management across network namespaces. The nft_object rhltable was implemented as a global structure, meaning that as one network namespace tears down its objects via nft_rcv_nl_event(), another namespace can still resolve pointers to those objects through the shared lookup table - and since nft_obj_destroy() frees memory immediately, a concurrent lookup dereferences freed memory. No active exploitation has been identified (not in CISA KEV) and EPSS sits at 0.16% (5th percentile), though the vulnerability's kernel-level impact warrants patching on multi-tenant and containerized Linux hosts.
Uninitialized memory access in the Linux kernel's netfilter xt_hashlimit module allows local users with netfilter rule configuration privileges to read uninitialized kernel memory and potentially corrupt rate-limiting state. The flaw exists in the .checkentry validation path, which failed to detect when XT_HASHLIMIT_RATE_MATCH mode is applied across multiple rules sharing the same hashtable, leaving the burst field in the dsthash_ent union uninitialized. No public exploit or CISA KEV listing exists at time of analysis; an EPSS score of 0.16% reflects low near-term exploitation probability.
Use-after-free in the Linux kernel's RDS/TCP subsystem allows a local authenticated attacker to read freed kernel memory via a race condition in `rds_tcp_laddr_check()`, potentially enabling privilege escalation. The flaw is triggered through the `bind()` syscall when the RCU read lock is incorrectly released between a `dev_get_by_index_rcu()` lookup and a subsequent `ipv6_chk_addr()` call, creating a window for concurrent interface deletion to free the `net_device` struct. No public exploit is identified at time of analysis, and EPSS of 0.16% (5th percentile) indicates low near-term exploitation probability despite the CVSS 7.8 High rating.
Use-after-free in the Linux kernel's IPv6 nexthop routing subsystem allows a local low-privileged attacker to corrupt kernel memory by racing nexthop replace operations against concurrent IPv6 route deletion. The functions fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list under RTNL serialization without holding nh->lock, while IPv6 route add/delete operations mutate that same list under nh->lock without RTNL, creating a window where a freed fib6_info struct is read. No public exploit is confirmed in CISA KEV and EPSS is a low 0.14%, but KASAN stack traces embedded in the advisory (tasks 'exploit/142' and 'exploit/143') confirm the race was reproducibly triggered, and the vendor has released fix commits to the stable kernel trees.
Use-after-free race condition in the Linux kernel nexthop subsystem (net/ipv4/nexthop.c) allows a local attacker with low-privilege access to trigger slab-use-after-free in kernel memory, potentially achieving full kernel code execution with scope change across the system. The race occurs between nh_rt_cache_flush() walking nh->f6i_list without holding nh->lock and concurrent IPv6 route add/delete operations freeing fib6_info entries under nh->lock - confirmed by an in-kernel KASAN trace naming the task 'exploit/146'. This CVE carries a CVSS 3.1 score of 8.8 (S:C, C:H/I:H/A:H) but EPSS of 0.14% (4th percentile) and no CISA KEV listing indicate no confirmed active exploitation at time of analysis.
Stale kernel memory leaks to userspace through an off-by-two bounds error in the Linux kernel's libiscsi subsystem, specifically in `iscsi_scsi_cmd_rsp()`. Systems running an iSCSI initiator (libiscsi loaded) that connect to a malicious or compromised iSCSI target are exposed: the target crafts a SCSI Response PDU where the data segment length equals the declared sense length, causing a `memcpy()` to read two bytes past the received buffer boundary into stale `conn->data` contents, which are then returned to userspace in the SCSI sense buffer. No public exploit exists and EPSS stands at 0.16% (5th percentile); exploitation requires adversary control of an iSCSI target the victim connects to, making this a concern primarily for enterprise iSCSI storage environments rather than general internet-facing systems.
Heap buffer overflow in the Linux kernel iSCSI TCP initiator (drivers/scsi/libiscsi_tcp.c) lets a malicious or compromised iSCSI target overflow the fixed 8192-byte conn->data buffer by returning a SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) whose DataSegmentLength exceeds ISCSI_DEF_MAX_RECV_SEG_LEN. Unlike LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT, the SCSI response path copied sense/response data into conn->data without bounding it against the buffer size, only against the negotiated MaxRecvDataSegmentLength (open-iscsi default 262144). Any Linux host acting as an iSCSI initiator against an untrusted target is affected; there is no public exploit identified at time of analysis and EPSS is low (0.16%, 5th percentile), and it is not on CISA KEV.
Out-of-bounds memory corruption in the Linux kernel's ath12k WiFi 7 driver corrupts kernel memory adjacent to the ML peer ID bitmap during MLO peer cleanup. The `ath12k_mac_dp_peer_cleanup()` function incorrectly indexes a 256-bit bitmap with `dp_peer->peer_id`, which always carries the ATH12K_PEER_ML_ID_VALID flag (BIT(13), value 8192+), causing `clear_bit()` to write far outside the valid bitmap range. No public exploit has been identified at time of analysis, and EPSS probability stands at 0.14%, though the CVSS 8.8 rating reflects the adjacent-network, unauthenticated vector and full kernel-level C/I/A impact of the memory corruption primitive.
Memory corruption in the Linux kernel's nzxt-smart2 hwmon driver exposes systems on non-coherent DMA architectures (ARM, MIPS) to deterministic kernel memory corruption whenever the NZXT Smart Device 2 USB hardware triggers a DMA-mapped output report. The driver's send_output_report() passes a misaligned buffer to hid_hw_output_report(), which hands it to usb_interrupt_msg() for DMA mapping; on non-coherent caches, cache line flush or invalidate operations corrupt adjacent kernel variables (mutex, update_interval) sharing the same cache line. No public exploit has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects low exploitation probability, and the bug is not listed in CISA KEV.
Un-rate-limited ICMP and NDISC Redirect packet storms are possible in the Linux kernel when peer entry allocation fails inside `inet_getpeer_v4()` or `inet_getpeer_v6()`, affecting all kernels from 2.6.39 through the fixed stable releases. A remote unauthenticated attacker who can trigger peer table exhaustion against a Linux system acting as a network forwarder can cause the kernel to emit unbounded ICMP/NDISC Redirect messages, producing severe network availability degradation. No public exploit or proof-of-concept is identified at time of analysis, and EPSS sits at 0.17%, but the no-authentication CVSS profile warrants prompt patching on any Linux routing infrastructure.
Out-of-bounds array access in the Linux kernel nct6775-core hardware monitoring driver allows a local low-privileged user on systems equipped with the nct6116 Super I/O chip to trigger reads beyond 3-element weight register arrays (up to index 4), with the resulting garbage values subsequently used as hardware I/O register addresses. This can cause invalid hardware register writes, hardware misconfiguration, or system crashes. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), making this a patch-priority rather than emergency-response item; exploitation is bounded by the hardware specificity of the nct6116 chip.
Use-after-free in the Linux kernel's forcedeth Ethernet driver allows a local user to trigger kernel memory corruption during device removal. The driver's nv_remove() function frees per-CPU txrx_stats before unregister_netdev() completes, leaving the ndo_get_stats64 statistics path, NAPI polling, xmit data path, and nv_close()/drain all capable of accessing the already-freed structure. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and no public exploit identified at time of analysis, the immediate risk is narrow but the potential for local privilege escalation on systems with NVIDIA nForce-era hardware warrants prompt patching.
A double-free memory-corruption defect in the Linux kernel's rtase Realtek automotive Ethernet driver allows the same multi-fragment socket buffer to be freed twice when the transmit path hits a DMA mapping failure. It affects hosts running the rtase driver (Realtek multi-gigabit/automotive NICs) on kernel 6.12 and related stable trees, and can lead to kernel memory corruption and denial of service. No public exploit has been identified at time of analysis; EPSS is low (0.17%, 7th percentile) and the CVE is not on CISA KEV.
Shift-out-of-bounds undefined behavior in the Linux kernel's TC u32 classifier allows local privilege escalation on systems where unprivileged namespace creation is permitted. The root cause is that u32_change() copies a user-supplied offshift value (0-255) into the kernel without validating it is less than 16, so when packet classification later evaluates the variable offset expression with TC_U32_VAROFFSET set, an offshift >= 32 violates C11 §6.5.7p3 and produces undefined behavior exploitable for kernel-level impact. No public exploit has been identified at time of analysis, and patched stable releases 7.1.8 and 7.2-rc6 are available.
Use-after-free in the Linux kernel Bluetooth ISO subsystem allows a physically adjacent, unauthenticated attacker to corrupt kernel heap memory, potentially enabling privilege escalation or a denial-of-service crash. The defect exists in `iso_sock_disconn()`, where clearing `conn->hcon = NULL` omits the required `conn->hcon->iso_data = NULL` reset, leaving a dangling pointer that `iso_conn_free()` later dereferences. Patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.44, 7.1.8); no confirmed active exploitation is on record despite the high CVSS score, consistent with the very low EPSS of 0.17% and the specialized Bluetooth ISO attack surface.
Use-After-Free in the Linux kernel's Bluetooth L2CAP LE connection response handler exposes systems with Bluetooth enabled to potential kernel-level memory corruption by an adjacent, unauthenticated attacker. The flaw in `l2cap_le_connect_rsp()` stems from missing reference-count protection on a channel object, allowing a concurrent remote-disconnect-triggered `l2cap_chan_del()` to free the object between lookup and lock - a pattern already fixed in the BR/EDR counterpart but overlooked here. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.17%, and no public exploit code has been identified, though the kernel-level UAF impact class is inherently severe if triggered.
Missing socket lock in the Linux kernel Bluetooth ISO subsystem exposes a race condition in iso_sock_getname that allows a low-privileged adjacent attacker to trigger a use-after-free or null-pointer dereference via concurrent connection teardown. Systems running affected kernel versions with Bluetooth ISO (Isochronous) sockets enabled are vulnerable to kernel crashes or memory disclosure. No public exploit code exists and EPSS probability is 0.17%, but the CVSS 8.0 score reflects the potential for high-impact memory corruption if the race is won.
Race condition in the Linux kernel Bluetooth ISO subsystem allows an adjacent, unauthenticated attacker to trigger a NULL pointer dereference or memory corruption by sending crafted Bluetooth LE ISO connection events targeting a socket concurrently transitioning out of LISTEN or CONNECT state. Affected kernels span the 6.8.9 through pre-6.9 range, with backported fixes confirmed for stable releases 6.18.44 and 7.1.8. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), though the kernel-level impact and Bluetooth-adjacent unauthenticated access vector justify the vendor's 8.8 CVSS rating.
Use-after-free race condition in the Linux kernel's Bluetooth ISO subsystem allows an unauthenticated attacker within Bluetooth adjacency range to corrupt kernel memory by exploiting concurrent socket teardown in iso_conn_ready(), potentially leading to privilege escalation or system crash on affected hosts. The flaw - present since the introduction of Bluetooth 5.2 ISO channel support in Linux 5.15 - arises because conn->sk is dereferenced without holding a lock or refcount, enabling a concurrent iso_sock_release() call to free the socket before iso_conn_ready() completes its dereference. No public exploit or CISA KEV entry exists at time of analysis, and the EPSS score of 0.17% (6th percentile) reflects very low near-term exploitation probability despite the High CVSS score.
Concurrent deadlock and use-after-free (UAF) vulnerabilities in the Linux kernel's Bluetooth ISO socket layer allow adjacent-network attackers to corrupt kernel memory via race conditions in `iso_sock_timeout()`. Affected systems must be within Bluetooth radio range; no authentication is required. No public exploit code and no CISA KEV listing have been identified - EPSS of 0.17% (6th percentile) reflects low current exploitation probability despite the high CVSS score of 8.8.
Use-after-free via reference counting race in the Linux kernel's Bluetooth ISO (LE Audio) subsystem allows an adjacent, unauthenticated attacker to potentially achieve kernel-level code execution or information disclosure. The race arises between concurrent execution of iso_conn_del() and iso_chan_del() in separate kernel tasks, resulting in a double-put of the iso_conn object and subsequent memory corruption. Affected stable branches span Linux 6.11.11 through pre-6.13 series; upstream patches are available in Linux 6.18.44, 7.1.8, and 7.2-rc6. No public exploit code exists and no active exploitation has been confirmed, consistent with a very low EPSS score of 0.17%.
Use-after-free race condition in the Linux kernel Bluetooth ISO subsystem allows an adjacent, unauthenticated attacker to trigger kernel memory corruption with full confidentiality, integrity, and availability impact. The flaw resides in the hci_conn::iso_data field, which is read and modified across concurrent kernel tasks without lock or RCU protection - allowing a kfree() in one task to race against a kref_get_unless_zero() in another, yielding a dangling pointer dereference. No public exploit code has been identified and EPSS exploitation probability is 0.15% (5th percentile), but kernel UAF primitives are well-understood by skilled attackers and the Bluetooth adjacency requirement is the primary limiting factor for mass exploitation.
Use-after-free (UAF) in the Linux kernel Bluetooth HCI connection subsystem exposes adjacent-network attackers to potential kernel memory corruption via a race condition in abort_conn_sync(). The hci_conn object can be freed while the hci_sync task is still executing against it, because no reference count is held across the async operation - a classic lifetime management failure in kernel concurrent code. No public exploit has been identified and EPSS sits at only 0.17% (6th percentile), but the CVSS 8.8 score reflects the theoretical full-system impact if the race is successfully won. The vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at time of analysis.
Use-after-free in the Linux kernel Bluetooth HCI synchronization subsystem (hci_sync) creates a theoretical kernel memory corruption risk via a race condition in the hci_connect_big_sync() callback. The conn (connection) struct can be freed while the hci_sync asynchronous task is still executing, potentially allowing an adjacent, unauthenticated attacker within Bluetooth range to trigger a dangling pointer dereference in kernel context. No public exploit identified at time of analysis and EPSS stands at 0.15% (5th percentile), but patches are available across multiple Linux stable branches and should be applied as routine maintenance.
Use-after-free in the Linux kernel Bluetooth hci_sync subsystem exposes local users with low privileges to potential kernel heap corruption via a race condition in `hci_connect_pa_sync()`. The `conn` connection object can be freed by one code path while the asynchronous hci_sync callback is still executing, allowing a local attacker on affected 6.12.x, 6.14.x, and 6.15.x kernel branches to corrupt kernel memory and potentially achieve full privilege escalation. No public exploit code has been identified, and EPSS of 0.15% (5th percentile) confirms very low exploitation probability at this time - no confirmed active exploitation (not in CISA KEV).
Use-after-free in the Linux kernel's Bluetooth HCI synchronization subsystem allows an adjacent-network attacker with low privileges to pass freed hci_conn pointers to hci_conn_valid(), where kmalloc may have reallocated that memory to unrelated objects. Affected Linux kernel versions across multiple stable branches expose systems with active Bluetooth to potential kernel memory corruption, yielding full confidentiality, integrity, and availability impact at the kernel level. No public exploit code has been identified and CISA KEV does not list this CVE; however, the HIGH CVSS score and kernel-level CIA:H/H/H impact justify prompt patching on any Bluetooth-enabled Linux host.
Local privilege escalation in the Linux kernel's octeontx2-af driver (Marvell OcteonTX2 hardware) allows a low-privileged Virtual Function (VF) tenant to overwrite the Physical Function's (PF) shared CGX hardware PKIND configuration, corrupting HiGig2 or EDSA packet parsing state and achieving high confidentiality, integrity, and availability impact across the PF boundary. The vulnerability arises because VF NIX LF allocation did not check whether the LMAC was already configured with a privileged PKIND before resetting it. No public exploit code has been identified and EPSS is 0.15% (5th percentile), indicating very low exploitation probability, though the changed-scope CVSS vector reflects genuine cross-tenant hardware corruption potential in SR-IOV deployments.
Deadlock in the Linux kernel qede NIC driver's recovery path permanently wedges the rtnetlink control plane of any affected host when a TX timeout fires on a QLogic/Cavium FastLinQ interface with VXLAN or GENEVE tunnel ports configured. Systems in this state remain pingable but every subsequent caller of rtnl_lock - including ip, sshd, ovs-vswitchd, IPv6 addrconf, and lldpad - blocks indefinitely, denying all network management access until reboot. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the impact on unpatched datacenter hosts in tunnel-overlay environments is severe and patch adoption should be prioritized.
Use-after-free memory corruption in the Linux kernel's ksmbd SMB server subsystem exposes systems running the in-kernel file-sharing daemon to potential kernel-level compromise by an authenticated remote attacker. Affected are Linux kernel versions beginning at commit 8510a043d334ecdf83d4604782f288db6bf21d60 (ksmbd introduction) through multiple stable branches, with vendor-released patches confirmed in 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. No public exploit code has been identified and EPSS stands at 0.17% (6th percentile), indicating no observed mass exploitation at time of analysis despite the CVSS 8.8 severity rating.
Session-binding authentication weakness in the Linux kernel's ksmbd in-kernel SMB3 server allows different SMB clients to be treated as identical because ClientGUID values were compared with strncmp(), which halts at the first embedded NUL byte. An attacker able to reach an exposed ksmbd share could exploit this to bind to another client's authenticated SMB3 multichannel session or bypass FSCTL_VALIDATE_NEGOTIATE_INFO integrity checks, exposing high confidentiality and integrity impact per the CVSS 9.1 rating. There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), indicating no observed exploitation activity.
Use-after-free in the Linux kernel's IOMMUFD subsystem (iommu/iommufd) exposes systems running VFIO device passthrough to kernel memory corruption by a local low-privileged attacker, with a scope change that may cross security boundaries into the hypervisor layer. The flaw, present since Linux 6.11, stems from a race between IOPF group acceptance by the fault handler and concurrent device detach operations, leaving IOMMUFD's deliver list holding references to memory already freed by the generic pending list cleanup path. No public exploit or active exploitation has been identified at time of analysis - EPSS stands at 0.17% (6th percentile) and the vulnerability is absent from CISA KEV - though the CVSS 3.1 score of 8.8 reflects the severity of potential impact in affected virtualization environments.
Double-free memory corruption in the Linux kernel's pinctrl/devicetree subsystem enables a local low-privileged attacker on systems running affected pinctrl drivers - such as pinctrl-imx on NXP iMX6 platforms - to corrupt kernel heap memory, with theoretical potential for local privilege escalation. The flaw resides in the error-cleanup path of `dt_remember_or_free_map()`: when `kstrdup_const()` fails mid-loop, `dt_free_map()` iterates over all map entries including those never initialized by the core, passing uninitialized `kmalloc()` data to `kfree_const()` - a KASAN-confirmed double-free. No public exploit identified at time of analysis; the EPSS score of 0.18% (8th percentile) reflects very low real-world exploitation probability despite the formal CVSS 7.8 rating.
List corruption in the Linux kernel's hugetlb memory management subsystem (`mm/hugetlb`) allows a local low-privileged attacker to trigger kernel memory corruption, potentially achieving privilege escalation or host crash. The flaw was confirmed as causing real-world KVM host panics in dense virtualization environments where QEMU and SPDK/DPDK vhost-user processes share a hugetlbfs MAP_SHARED mapping; with CONFIG_DEBUG_LIST disabled, the corruption silently embeds a kernel stack address into an active cache list, setting up a use-after-free. No public exploit has been identified at time of analysis; EPSS is 0.17% and the vulnerability is not in CISA KEV, but fixed stable kernel releases are available across all active branches.
Local privilege-escalation/denial-of-service via a use-after-free in the Linux kernel's KVM x86 I/O APIC emulation (CVE-2026-74517): during VM teardown the delayed I/O APIC EOI work (kvm_ioapic_eoi_inject_work) can execute after the target vCPUs are freed, causing __kvm_irq_delivery_to_apic_fast to read freed slab memory. Any local principal able to create and run a KVM guest can race VM destruction against a pending delayed EOI to corrupt host kernel memory. EPSS is low (0.15%, 5th percentile) and the issue is not on CISA KEV; no public exploit is identified, and the reporter/tags frame the practical impact as denial of service.
KVM on AMD SVM-enabled hosts fails to update x2APIC MSR intercepts when AVIC is inhibited while a nested guest (L2) is running, allowing an L1 guest with root-level privileges to directly access the host's APIC state, send arbitrary interrupts, and crash the host kernel. Affected Linux kernels from 6.0 through multiple stable branches expose the host to interrupt manipulation, task priority changes, and denial-of-service. A functional proof-of-concept demonstrating both spurious interrupt injection and wakeup handler corruption is embedded in the CVE description itself; this vulnerability is not currently listed in the CISA KEV catalog and carries a 0.17% EPSS score consistent with its narrow but severe exploitation conditions.
KVM s390 PCI subsystem in the Linux kernel allows a local low-privileged user to corrupt hypervisor resources by repeatedly calling the adapter interrupt forwarding ioctl for the same zPCI device without prior unregistration. The vulnerability affects IBM Z (s390) systems running Linux KVM with PCI passthrough from commit 3c5a1b6f onwards (Linux 6.0+), with patched stable releases available. No public exploit exists and EPSS sits at 0.17% (6th percentile), reflecting the niche architecture and local-access prerequisite, but the CVSS Scope:Changed designation signals the flaw can cross the guest-to-hypervisor boundary, elevating its priority on affected IBM Z KVM deployments.
Use-after-free in the Linux kernel's dibs loopback subsystem allows a local low-privileged attacker to corrupt kernel memory during concurrent DMB node attach, detach, and unregister operations. The vulnerability arises from a race window between hash table lookup under dmb_ht_lock and the subsequent refcount operation performed after the lock is dropped, enabling a concurrent unregister path to free the node before the refcount transition completes. With a CVSS score of 7.8 and C:H/I:H/A:H impact metrics, successful exploitation can lead to privilege escalation or kernel crash; however, no public exploit is identified at time of analysis and EPSS at 0.17% reflects low current exploitation probability.
Use-after-free in the Linux kernel audit subsystem's `audit_del_rule()` function exposes systems from kernel 4.3 onward to local privilege escalation. The flaw stems from incorrect RCU ordering: fsnotify mark resources tied to `e->rule.exe` are freed before the rule is unlinked from RCU-visible filter lists, creating a window where concurrent `audit_filter()` and `audit_filter_rules()` readers dereference already-freed memory. Patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Linux kernel Bluetooth management subsystem allows a local low-privileged user to corrupt kernel heap memory by racing MGMT_OP_SET_LOCAL_NAME against MGMT_OP_REMOVE_UUID on systems with a powered BR/EDR-capable Bluetooth controller. The race exploits a missing lock acquisition in pending_eir_or_class() and the omission of MGMT_OP_SET_LOCAL_NAME from EIR-serialization logic, enabling a freed pending command entry to be read during EIR reconstruction. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), but the kernel UAF primitive and confirmed 7.8 CVSS score make patching a clear priority for Bluetooth-enabled systems.
Use-after-free in the Linux kernel Bluetooth management subsystem allows a low-privileged local attacker to corrupt kernel heap memory and achieve privilege escalation to root. Kernels from approximately 2.6.39 through unpatched revisions of the 6.6.x, 6.12.x, 6.18.x, and 7.1.x stable series are vulnerable when Bluetooth hardware is present and the mgmt interface is accessible. No public exploit has been identified at time of analysis, and EPSS at 0.20% (10th percentile) reflects limited current exploitation probability, though UAF primitives in the Linux kernel are historically weaponized following public disclosure.
Use-after-free in the Linux kernel Bluetooth hci_sync subsystem exposes kernel heap memory to corruption via a race condition between advertising instance teardown and HCI command synchronization. Systems running affected kernel versions (from commit cba6b758711cab946c787f7c15be92cc749b8e1f across 5.15.x, 6.12.x, 6.18.x stable branches) with active Bluetooth LE extended advertising are vulnerable to exploitation by attackers within Bluetooth radio range. The kernel-level UAF can yield arbitrary code execution in kernel context with full C/I/A impact; no public exploit has been identified and EPSS sits at the 6th percentile, indicating purely theoretical exploitation risk at this time.
Uninitialized memory read and session hijack in the Linux kernel Bluetooth HIDP subsystem exposes systems with active Bluetooth HID sessions to kernel memory disclosure and forced session termination from an unauthenticated adjacent attacker. The functions hidp_recv_ctrl_frame() and hidp_recv_intr_frame() dereference skb->data[0] before validating that the received L2CAP SDU is at least one byte long, allowing a connected peer to feed an empty frame and cause the kernel to consume a stale tailroom byte - or, via a crafted HCI ACL packet, a fully attacker-controlled byte interpreted as a synthetic HIDP transaction code. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Bluetooth HIDP in the Linux kernel exposes an uninitialized-memory read and a peer-controlled out-of-bounds byte access in hidp_session_run() when processing numbered HID report responses. Systems running Linux with active Bluetooth HID sessions are vulnerable to a malicious adjacent Bluetooth peer leveraging this to disclose kernel memory contents (rated C:H, enabling potential KASLR bypass) or manipulate HIDIOCGFEATURE report completion with attacker-controlled data. No public exploit has been identified, EPSS is 0.17% (6th percentile), and this vulnerability is not listed in CISA KEV.
Use-after-free in the Linux kernel's AFS (Andrew File System) subsystem exposes systems running the kafs module to kernel memory corruption exploitable by local low-privileged users, potentially enabling privilege escalation to root. The race condition in afs_make_call() allows the afs_call structure to be freed by an arriving async server response while the sending function - having transferred its reference rather than retaining one - continues to access the freed memory. EPSS is 0.17% (6th percentile), no CISA KEV listing exists, and upstream fix commits are publicly available on stable kernel trees.
Use-after-free in the Linux kernel ALSA timer subsystem allows an unprivileged local user to corrupt kernel heap memory and escalate privileges to root. The flaw stems from snd_timer_close_locked() setting SNDRV_TIMER_IFLG_DEAD but never clearing it after close completes; when snd_seq_timer_open() retries on the same instance after a forced failure, snd_timer_instance_free() frees an object still referenced across multiple kernel data structures. With CVSS 7.8 and a detailed exploitation path described directly in the upstream kernel commit, this is a credible local privilege escalation on desktop and workstation Linux systems, despite a low EPSS score of 0.17% (6th percentile) and no current CISA KEV listing. No public exploit code has been identified at time of analysis.
Missing bounds enforcement in the Linux kernel ALSA USB audio driver's implicit-feedback path allows a physically-connected malicious USB device to inject oversized sync packets that propagate un-clamped into the playback endpoint queue. The un-clamped frame count - potentially exceeding ep->maxframesize - can drive packet transfers beyond hardware frame limits, risking kernel memory corruption with high confidentiality, integrity, and availability impact. No public exploit has been identified and EPSS is 0.17% (6th percentile), but patches are confirmed across multiple stable kernel branches including 6.6.151, 6.12.103, 7.1.8, and 6.18.44.
Use-after-free in the Linux kernel's FOU (Foo-over-UDP) tunnel subsystem allows a local attacker with low privileges to corrupt kernel memory by exploiting a race condition in fou_create(). The struct fou object is published via sk_user_data before being committed to the per-network-namespace port list; when fou_add_to_port_list() subsequently fails on port-0 requests, the error path frees the object while concurrent RCU readers can still dereference it through fou_from_sock(). Two stable-branch upstream commits (a28d8903, b14361ac) provide the fix; no public exploit has been identified at time of analysis, and EPSS sits at the 5th percentile.
A DMA mapping resource leak in the Linux kernel's igbvf driver (Intel 82576 SR-IOV virtual function NIC) occurs on the TX buffer-mapping error path: an off-by-one in the dma_error cleanup loop leaks exactly one DMA mapping (the packet head) whenever a fragment mapping fails after the head was successfully mapped. The bug traces to a 2010 fix for an endless loop and affects a wide range of stable kernels until patched (fixes landed in 6.6.151, 6.12.103, 6.18.44, 7.1.8 and 7.2-rc6). There is no public exploit identified at time of analysis, EPSS is very low (0.17%), and the practical impact is memory/DMA resource exhaustion rather than the remote code execution suggested by the assigned 9.8 score.
Kernel-level use-after-free in the Linux SMC (Shared Memory Communications) subsystem allows a race between socket close and link group termination to write to freed memory. The flaw lives in the net/smc driver where __smc_lgr_terminate() releases conns_lock after locating a connection in lgr->conns_all but before calling sock_hold(), so a concurrent close can free the embedded socket first. Fixed across multiple stable trees; EPSS is low (0.17%), there is no public exploit identified at time of analysis, and it is not on CISA KEV.
Use-after-free in the Linux kernel netfilter ipset subsystem enables local kernel memory corruption with potential for privilege escalation. During an ipset hash resize (`mtype_resize()`), comment pointers are shallow-copied via `memcpy()` rather than deep-copied, causing both old and new table entries to share the same `ip_set_comment_rcu` pointer; an `xt_SET --add-set --exist` packet hitting the old entry during this window calls `ip_set_init_comment()`, freeing the shared pointer and leaving the new table entry with a dangling reference that is later dereferenced in `strlen()` during backlog replay. Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6), no public exploit has been identified, and EPSS sits at 0.17% (6th percentile), indicating very low observed exploitation pressure at time of analysis.
Use-after-free race condition in the Linux Kernel TIPC subsystem allows a low-privileged attacker to trigger stale-pointer dereference during socket poll trace operations, potentially leading to kernel memory corruption and privilege escalation. The flaw arises because tipc_poll() invokes trace_tipc_sk_poll() without holding the socket lock, enabling tipc_list_dump() to walk live queue members while a concurrent thread dequeues and frees socket buffers (skbs). Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8); no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Linux kernel wifi/mac80211 subsystem allows an adjacent network attacker to trigger kernel memory corruption during Block Acknowledgment session teardown. ieee80211_stop_tx_ba_cb() hands tid_tx to kfree_rcu() and then reads tid_tx->ndp after dropping sta->lock without RCU read-side protection, creating a window where the RCU softirq callback can free the object before the read completes. The vulnerability carries a CVSS 8.8 score (AV:A) but EPSS sits at the 5th percentile with no KEV listing, reflecting the race-condition exploitation complexity; no public exploit has been identified at time of analysis.
Use-after-free and out-of-bounds read in the Linux kernel mwifiex WiFi driver (CVSS 8.8, AV:A) allow an unauthenticated attacker on an adjacent WiFi segment to trigger kernel memory corruption by sending crafted A-MSDU frames containing TDLS payloads. Affected kernel versions span from the commit introducing A-MSDU TDLS handling (circa Linux 4.5, commit 776f742040ca) through all stable branches prior to the fixes in 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the flaw is remotely selectable by the sender through control over A-MSDU subframe layout, making TDLS-capable mwifiex deployments meaningfully exposed from the local wireless segment.
Out-of-bounds slab read in the Linux kernel's binfmt_misc subsystem allows local low-privileged users - including those operating within unprivileged user namespaces - to trigger heap memory exposure or a kernel crash by registering a binary format with a flag character ('P', 'O', 'C', or 'F') as the field delimiter. The flaw exists because check_special_flags() consumes flag characters without using the delimiter as a terminator, swallowing the 8-byte padding appended by create_entry() and reading past the end of the allocated buffer. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates low near-term exploitation probability; however, reachability from unprivileged user namespaces on most modern Linux distributions meaningfully broadens the real-world attack surface.
Use-after-free in the Linux kernel's Transparent Huge Page split path exposes systems to kernel memory corruption, potential privilege escalation, or denial of service via a race condition in __folio_split(). Any local low-privilege user on affected kernels prior to the stable fixes in versions 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6 may trigger this by racing a concurrent final iput() against the shmem THP split unlock sequence. No public exploit or PoC has been identified, and the EPSS score of 0.17% (6th percentile) reflects minimal real-world exploitation activity at time of analysis.
Use-After-Free in the Linux kernel's mm/page_reporting subsystem triggers a General Protection Fault during PM suspend and hibernation on systems running virtio_balloon with page reporting enabled. When the PM freezer initiates a suspend or S4 hibernation cycle, the virtio_balloon driver tears down its virtqueues via del_vqs(), but page_reporting_process - scheduled on the non-freezable system_wq workqueue - remains active. If the buddy allocator frees pages during this window (e.g., the balloon shrinker runs during S4 image saving), the reporting worker calls virtballoon_free_page_report() on already-deleted virtqueues, causing kernel memory corruption. No public exploit has been identified at time of analysis; EPSS is 0.18% (8th percentile), reflecting minimal exploitation probability, though this is a confirmed kernel UAF with crash-level impact validated by Google in production virtualization infrastructure.
Use-after-free in the Linux kernel bridge (net/bridge) multicast fast-leave path lets the group-leave handler dereference a freed port-group entry after br_multicast_del_pg() removes it, because the loop keeps walking through the stale next pointer. It affects bridges that had multicast-to-unicast enabled and later disabled while multiple per-source-MAC port groups existed, and can corrupt kernel memory. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not in CISA KEV, so the headline CVSS 9.8 overstates practical risk for most deployments.
Use-after-free in the Linux kernel pktgen subsystem exposes local attackers with low privileges to kernel memory corruption, potential privilege escalation, or system crash. The flaw arises from a race condition between pktgen_change_name() and pktgen_remove_device() on a shared proc_dir_entry pointer, allowing a kpktgend kernel thread to dereference a stale, freed pointer after a concurrent rename operation releases it. No public exploit code or active exploitation has been identified; EPSS stands at 0.17% (6th percentile), consistent with the niche production footprint of the pktgen testing module.
Memory corruption in the Linux kernel's User Mode Linux (UML) vector network driver lets a remote peer trigger a use-after-free in vector_mmsg_rx(). When a received packet fails verify_header(), the code frees the skb but skips the slot-cleanup that normal paths perform, so the next RX iteration re-reads and double-frees the same freed buffer, causing a refcount underflow / use-after-free. It affects UML instances using the GRE or L2TPv3 vector transports; any peer on such a transport can trigger it without authentication. No public exploit identified at time of analysis, and EPSS is low (0.20%).
Denial-of-service (kernel crash) in the Linux kernel's veth driver affects hosts running an XDP program with AF_XDP sockets in copy mode bound to a virtual ethernet interface. When a frag_list skb (data_len set, nr_frags zero) reaches veth_convert_skb_to_xdp_buff(), the driver advertises XDP fragment metadata for a non-existent frags[] array, causing __xsk_rcv() to walk an empty fragment and crash inside memcpy(). NVD rates it CVSS 9.1, though the underlying tags and code path point to availability impact (crash) rather than the confidentiality loss the vector claims; EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis.
Race-condition torn read in the Linux kernel's VXLAN driver (route_shortcircuit()) allows the neighbour hardware address (n->ha) to be read without holding the n->ha_lock seqlock, producing a partially-updated or corrupted MAC address while the neighbour subsystem concurrently updates it. Fixed by switching to neigh_ha_snapshot() for a seqlock-protected read. No public exploit identified at time of analysis; EPSS is 0.17% (6th percentile), and despite the assigned CVSS of 10.0 the practical impact is a minor data-integrity/read-consistency issue in VXLAN forwarding, not a genuine critical remote compromise.
Improper transmit-path header validation in the Linux kernel VXLAN driver (functions vxlan_xmit, arp_reduce, and vxlan_mdb_entry_skb_get) can cause the driver to read network-layer header bytes (ARP, IPv6/ND, IP/IPv6 MDB keys) that reside in non-linear skb fragments. The root cause is the use of pskb_may_pull(), which measures length from skb->data - which on transmit points at the MAC header - instead of pskb_network_may_pull(), which accounts for the ETH_HLEN (14-byte) network offset; the result is that part of the network header may remain unpulled in paged fragments and be parsed from stale linear-buffer memory, an information-disclosure/misparse condition. Only systems with VXLAN overlay interfaces configured are affected. There is no public exploit identified at time of analysis, EPSS is 0.17% (6th percentile), and it is not in CISA KEV; the upstream 9.8 CVSS score appears substantially overstated for this robustness fix.
Out-of-bounds read in the Linux kernel's VXLAN driver stems from route_shortcircuit() validating only 20 bytes from skb->data instead of accounting for the 14-byte MAC header offset, so ip_hdr()->daddr dereferences can read past the pulled linear buffer when packets have non-linear fragments. The flaw affects hosts running VXLAN tunneling with proxy mode, is tagged as an information-disclosure issue, and has no public exploit identified at time of analysis (EPSS 0.17%, 6th percentile). A vendor fix replaces pskb_may_pull() with pskb_network_may_pull() to check the full network header including skb_network_offset().
Use-after-free in the Linux kernel tracing subsystem exposes low-privileged local attackers to kernel memory corruption and potential privilege escalation. The defect, introduced at commit ae63b31e4d0e2ec09c569306ea46f664508ef717, causes trace_module_add_events() to call __add_event_to_tracers() unconditionally even when __register_event() has failed, leaving a trace_event_file holding a dangling pointer to a freed trace_event_call after a module load failure. EPSS is 0.17% (6th percentile) and no public exploit or CISA KEV listing has been identified, but the kernel UAF class carries inherent escalation potential and patches are available across multiple stable branches.
Integer overflow in the Linux kernel's scsi_debug module allows a local low-privileged attacker on a 32-bit system to trigger an out-of-bounds write via a crafted SCSI REPORT ZONES command. When alloc_len is in the range 0xFFFFFFC1-0xFFFFFFFF, an ALIGN() rounding operation overflows to 0x100000000, which truncates to zero under 32-bit size_t, causing kzalloc(0) to return a ZERO_SIZE_PTR sentinel that passes null checks - subsequent pointer arithmetic and loop writes then corrupt kernel memory, leading to privilege escalation or kernel panic. No public exploit has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects the narrow exploitation conditions required.
Integer overflow in the Linux kernel SCTP subsystem allows a remote low-privileged attacker to trigger an approximately 8 MiB out-of-bounds write past a socket buffer (skb) tail in kernel heap memory by adding 65,536 unique peer transport addresses to an SCTP association, wrapping the 16-bit transport_count to zero. Affected systems running Linux kernels from the 4.7 era through stable branches prior to 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6 are vulnerable. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates minimal current exploitation activity despite the CVSS 8.8 rating.
Privilege escalation in the Linux kernel's s390/qeth network driver allows any local unprivileged user to invoke three network management ioctls - SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE, and SIOC_QETH_QUERY_OAT - without the CAP_NET_ADMIN capability check that should gate them. Affected deployments are exclusively IBM z Systems (s390) mainframe environments running Linux kernels from commit 18787eeebd7 through the respective stable fix points, limiting real-world exposure to a narrow architectural niche. No public exploit or active exploitation has been identified; EPSS of 0.17% at the 6th percentile is consistent with the specialized environment required.
Use-after-free in the Linux kernel's Open vSwitch meter subsystem exposes systems running OVS to local privilege escalation, memory corruption, and potential information disclosure. The flaw affects all Linux 5.8+ kernels up to the patched stable releases and is triggered by a custom userspace application interacting with OVS via Netlink uAPI - standard ovs-vswitchd deployments are not vulnerable. No public exploit has been identified and EPSS sits at the 6th percentile, but the bug was discovered by Trend Micro's Zero Day Initiative (ZDI-CAN-31642), indicating professional security research attention; multiple stable kernel patches are now available.
NULL pointer dereference and use-after-free in the Linux kernel i2c-imx driver (NXP i.MX SoC family) allows a local attacker or concurrent kernel path to trigger kernel memory corruption during I2C slave unregistration. The race condition in i2c_imx_unreg_slave() permits a pending hrtimer callback to fire after the slave pointer has been cleared, causing i2c_imx_slave_finish_op() to dereference a NULL pointer with potential for privilege escalation or system crash. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.17% (6th percentile) confirms low exploitation likelihood, though the CVSS base score of 8.4 reflects high potential impact if triggered.
Double-free heap corruption in the Linux kernel's peak_usb CAN bus USB driver exposes systems with PEAK USB-to-CAN hardware to local privilege escalation, kernel panic, or sensitive memory disclosure. The flaw resides in the peak_usb_start() error-handling path, where a URB transfer buffer is freed explicitly via kfree(buf) before usb_free_urb() frees the same buffer a second time through the URB_FREE_BUFFER flag, corrupting kernel heap allocator metadata. Patched stable kernel releases are confirmed available (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6), no public exploit code has been identified, and EPSS at 0.17% (6th percentile) confirms no observed exploitation activity.
Arbitrary CMA memory corruption via GPU DMA in the Linux kernel's drm/vc4 VideoCore 4 driver affects Raspberry Pi and similar vc4-based platforms running kernels from version 4.13 through multiple stable series. The vc4_overflow_mem_work() function incorrectly programs BPOS with the full 16MB binner BO size instead of the correct 512KB slot size, authorizing the GPU's PTB hardware to scribble tile lists across adjacent in-flight job memory and into unrelated CMA pages beyond the BO boundary. No public exploit has been identified at time of analysis and EPSS is 0.17% (6th percentile), but the memory corruption manifests reliably as GPU hangs, userspace heap corruption, and system crashes under normal GPU workloads that overflow the initial binner slot.
Denial of service (and potential memory corruption) in the Linux kernel SCTP stack arises because __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport, leaving a dangling pointer once the original transport is RCU-freed via an ASCONF Delete-IP peer removal. A subsequent SACK that reneges the TSN clears tsn_gap_acked, and the next SACK dereferences the freed transport in sctp_check_transmitted(), producing a KASAN-confirmed slab-use-after-free. The issue affects hosts actively using SCTP with dynamic address reconfiguration; it carries a published CVSS of 9.8 but low EPSS (0.22%, 13th percentile), and no public exploit has been identified at time of analysis.
Use-after-free and NULL-pointer dereference in the Linux kernel's SCTP stack allow a remote SCTP peer to corrupt kernel memory or crash the host by triggering association-restart handling that leaves the cached ASCONF chunk pointer (addip_last_asconf) dangling. A delayed authenticated ASCONF-ACK then reaches sctp_sf_do_asconf_ack() and operates on freed memory, causing a second release, while clearing the pointer exposes a companion NULL dereference via a racing T4 timer callback. There is no public exploit identified and EPSS is low (0.22%), consistent with a race-condition kernel bug rather than a turnkey remote exploit despite the 9.8 input score.
A remotely triggerable use-after-free in the Linux kernel's SCTP stack (net/sctp) lets an authenticated SCTP peer read freed transport memory in sctp_outq_select_transport(). By sending an ASCONF chunk that both adds a peer transport and then removes it via a wildcard DEL-IP, the newly added transport is freed while asoc->new_transport still points to it; a later HEARTBEAT and address-replacement sequence dereferences the dangling pointer. There is no public exploit identified at time of analysis, EPSS is low (0.22%), and the flaw is not in CISA KEV, though a reliable private reproducer is described.
Kernel memory disclosure in the Linux bnxt_re RDMA driver (Broadcom NetXtreme RDMA) exposes 4092 bytes of stale kernel data to local users holding InfiniBand device access. The bnxt_re_alloc_ucontext() function allocates the user context shared page with __get_free_page(GFP_KERNEL), which does not zero memory, then maps the page into userspace - leaving all bytes beyond the 4-byte AVID write at offset 0x10 uninitialized and fully readable by the calling process. Exploitation requires only a single mmap() call after IB_USER_VERBS_CMD_GET_CONTEXT, making it trivially scriptable; no public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects low observed exploitation activity.
Use-after-free in the Linux kernel's route4 (cls_route) traffic classifier fastmap cache allows a local attacker with CAP_NET_ADMIN to read freed kernel heap memory by racing filter deletion against fastmap cache population, potentially escalating to full kernel compromise. Affected versions span Linux 3.18 through current stable branches; the kernel security team backported fixes to eight LTS/stable lines (5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2). No public exploit identified at time of analysis; EPSS of 0.17% (6th percentile) reflects minimal current exploitation activity, though the theoretical impact is severe given the kernel-level UAF primitive.
Out-of-bounds kernel memory write in the Linux kernel packet socket implementation allows a local low-privilege attacker to corrupt kernel memory by exploiting a race condition between `packet_snd()` reads of `dev->hard_header_len` and concurrent device reconfiguration. When the race is won - for example during a bonding device type change - `skb->data` is positioned before `skb->head`, and the subsequent userspace copy writes beyond the allocated socket buffer, creating a kernel memory corruption primitive suitable for local privilege escalation. No public exploit or CISA KEV listing exists at time of analysis; EPSS of 0.16% reflects very low current exploitation probability, though the primitive is powerful and patch availability across multiple stable branches makes remediation straightforward.
Kernel-level use-after-free in the Linux IPv6 policy-routing (fib6 rules) subsystem allows a suppressed route to leak a released rt6_info back to rt6_lookup() callers, so a subsequent dst_release() operates on freed memory. The flaw affects systems using IPv6 FIB rules with route suppression and realistically manifests as a kernel crash (denial of service) and potential memory corruption. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile); a vendor patch is available across stable trees.
Out-of-bounds host memory access in the Linux kernel vhost subsystem results from a stale metadata cache that is not invalidated when vring addresses or sizes are reconfigured via VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM while a virtqueue is live. Systems running KVM/QEMU virtualization with vhost and a device IOTLB attached - spanning kernel versions from 4.11 through unpatched stable series - are affected, with the scope change (S:C) in the CVSS vector indicating potential read/write access to host memory beyond the vhost subsystem boundary. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (6th percentile), consistent with a complex kernel-internal flaw not yet commoditized.
Netfilter's nft_payload offload mask builder in the Linux kernel performs an undefined-behavior shift (1 << 120 on a 32-bit int) when constructing hardware-offload match masks for partial IPv6 address fields, and separately over-masks trailing bytes when priv_len is a multiple of four. Systems running affected kernel versions that use nftables hardware offload rules with partial IPv6 address matches may experience firewall rule bypass (I:H) or kernel instability triggered by UBSAN (A:H). No public exploit is identified at time of analysis, and EPSS sits at 0.16% (5th percentile), consistent with a kernel correctness/stability bug rather than an actively targeted security issue. Patches are available across all active stable branches.
IV race condition in the Linux kernel's AF_ALG skcipher interface allows local unprivileged users to inject attacker-controlled initialization vectors into in-flight AIO cryptographic operations. For CTR and CBC modes, IV reuse enables keystream derivation and plaintext recovery of concurrent cipher operations sharing the same AF_ALG socket. No public exploit has been identified at time of analysis; patches are confirmed available across all major stable kernel branches (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 7.1.5, 7.2-rc1).
Unbounded recursion in the Linux kernel's slab allocator free path can crash the kernel when memory allocation profiling or cgroup memory accounting is active. Specific size relationships between KMALLOC_NORMAL caches cause circular obj_exts array dependencies - for example, kmalloc-512 and kmalloc-1k each hold the other's obj_exts array - so freeing one slab triggers a chain of recursive kfree/discard_slab calls that exhausts the kernel task stack. This was confirmed to cause production kernel stack overflows at Meta's infrastructure (approximately 125 recursive frames observed) and is fixed in Linux 6.12.103, 6.18.44, and 7.1.8; no public exploit code exists and exploitation probability is very low (EPSS 0.18%).
Use-after-free in the Linux kernel Thunderbolt XDomain subsystem enables a physically adjacent attacker with a malicious Thunderbolt device to corrupt kernel memory, potentially achieving code execution at kernel privilege level. The flaw stems from a race condition introduced when commit 559c1e1e0134 moved tb_xdp_handle_request() to the system workqueue, breaking the serialization with the disconnect path and creating a window where queue_delayed_work() can fire on a freed xdomain object. No public exploit has been identified and EPSS (0.16%, 5th percentile) confirms very low near-term exploitation probability, though the kernel-level impact makes this relevant for organizations operating Thunderbolt-enabled endpoints in adversarial physical environments.
Deadlock and use-after-free conditions in the Linux kernel's IDXD character device driver expose local low-privileged users on Intel DSA-equipped systems to potential kernel memory corruption or denial of service. The vulnerability resides in `idxd_cdev_open()`, where error cleanup paths call `put_device(fdev)` while still holding `wq->wq_lock`, causing `idxd_file_dev_release()` to deadlock on synchronous reentry; a secondary fallthrough defect then allows `idxd_xa_pasid_remove(ctx)` and `kfree(ctx)` to operate on memory already freed by that release callback. No public exploit has been identified at time of analysis, and an EPSS score of 0.16% (6th percentile) reflects the low observed exploitation probability consistent with the specialized hardware prerequisite.
Out-of-bounds kernel memory read and incomplete invalidation affect the Linux kernel's ARM SMMUv3 iommufd nested-virtualization path (arm_vsmmu_vsid_to_sid), where a guest virtual Stream ID is mapped to a single physical Stream ID from master->streams[0]. On ARM64 hosts using nested SMMUv3 with iommufd vDEVICE, assigning a device that has zero streams turns master->streams into a ZERO_SIZE_PTR that is read out of bounds, while a device with multiple streams leaves the other streams' ATC/IOTLB entries unreachable by guest invalidations. There is no public exploit identified at time of analysis, and EPSS is very low (0.15%, 5th percentile), consistent with a niche subsystem rather than broad exploitability despite the 9.3 CVSS.
Deadlock in the Linux kernel btrfs zoned filesystem causes an unrecoverable filesystem hang on hosts using zoned block devices (SMR HDDs or ZNS SSDs). The writeback path in btree_writepages() holds zoned_meta_io_lock while the tree-log block group fallback path waits for a transaction commit, while the concurrent transaction commit path blocks on that same lock - a classic ABBA deadlock resulting in complete filesystem unavailability. No public exploit exists and EPSS is 0.16% (5th percentile), reflecting a niche-deployment reliability issue rather than a broad security threat; the condition can be triggered by normal I/O stress and was confirmed reproducible via fstests generic/475.
Memory corruption in the Linux kernel's NTFS filesystem driver stems from unchecked integer arithmetic when converting runlist element counts into byte sizes inside ntfs_rl_realloc() and ntfs_rl_realloc_nofail(). An attacker who can get a crafted NTFS volume mounted and parsed can overflow the size calculation and corrupt kernel heap memory, potentially escalating to code execution. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile).
Out-of-bounds kernel memory read in the Linux netfilter SIP connection-tracking helper (nf_conntrack_sip) lets remote attackers crash or leak memory from any host doing SIP NAT rewriting. When sip_help_tcp() NAT-rewrites a SIP message, the per-message size delta is stored in a signed 16-bit variable; a single message with a long Contact list can grow by more than S16_MAX (while still under the 65535 enlarge_skb limit), wrapping the counter so datalen underflows to a huge unsigned value and ct_sip_get_header() reads past the linearized skb tail (KASAN use-after-free). Tagged Information Disclosure; no public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile).
Local privilege escalation and host memory corruption in the Linux kernel's KVM arm64 virtual GIC (vgic) LPI handling allows a malicious guest to trigger a use-after-free by racing LPI release against re-registration. Affecting arm64 KVM hosts (introduced by the LPI refcounting rework, present through Linux 6.17), a guest that issues an ITS DISCARD while an LPI is still referenced and then re-maps the same INTID via MAPTI can cause the kernel to erase a newly registered LPI from the xarray or leak an orphaned structure. There is no public exploit identified at time of analysis and EPSS is low (0.14%), but the scope-changing guest-to-host impact makes this a meaningful host-integrity issue.
Out-of-bounds slab read in the Linux kernel keyring subsystem's `keyring_get_key_chunk()` exposes kernel heap memory and enables potential kernel crashes from any unprivileged local user account. Affected kernels fail to bounds-check the full computed byte offset when walking description-level key chunks, allowing reads past a `kmemdup`-allocated buffer. This is reachable via the standard `add_key(2)` syscall with no elevated privileges and is confirmed by KASAN as a slab-out-of-bounds read; no public exploit exists and EPSS is 0.16% (5th percentile), but multi-tenant and container environments with untrusted local users face meaningful exposure.
Use-after-free in the Linux kernel's nf_tables netfilter subsystem exposes local attackers with low-privilege accounts to potential kernel-level privilege escalation by exploiting a race condition in nft_object lifecycle management across network namespaces. The nft_object rhltable was implemented as a global structure, meaning that as one network namespace tears down its objects via nft_rcv_nl_event(), another namespace can still resolve pointers to those objects through the shared lookup table - and since nft_obj_destroy() frees memory immediately, a concurrent lookup dereferences freed memory. No active exploitation has been identified (not in CISA KEV) and EPSS sits at 0.16% (5th percentile), though the vulnerability's kernel-level impact warrants patching on multi-tenant and containerized Linux hosts.
Uninitialized memory access in the Linux kernel's netfilter xt_hashlimit module allows local users with netfilter rule configuration privileges to read uninitialized kernel memory and potentially corrupt rate-limiting state. The flaw exists in the .checkentry validation path, which failed to detect when XT_HASHLIMIT_RATE_MATCH mode is applied across multiple rules sharing the same hashtable, leaving the burst field in the dsthash_ent union uninitialized. No public exploit or CISA KEV listing exists at time of analysis; an EPSS score of 0.16% reflects low near-term exploitation probability.
Use-after-free in the Linux kernel's RDS/TCP subsystem allows a local authenticated attacker to read freed kernel memory via a race condition in `rds_tcp_laddr_check()`, potentially enabling privilege escalation. The flaw is triggered through the `bind()` syscall when the RCU read lock is incorrectly released between a `dev_get_by_index_rcu()` lookup and a subsequent `ipv6_chk_addr()` call, creating a window for concurrent interface deletion to free the `net_device` struct. No public exploit is identified at time of analysis, and EPSS of 0.16% (5th percentile) indicates low near-term exploitation probability despite the CVSS 7.8 High rating.
Use-after-free in the Linux kernel's IPv6 nexthop routing subsystem allows a local low-privileged attacker to corrupt kernel memory by racing nexthop replace operations against concurrent IPv6 route deletion. The functions fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list under RTNL serialization without holding nh->lock, while IPv6 route add/delete operations mutate that same list under nh->lock without RTNL, creating a window where a freed fib6_info struct is read. No public exploit is confirmed in CISA KEV and EPSS is a low 0.14%, but KASAN stack traces embedded in the advisory (tasks 'exploit/142' and 'exploit/143') confirm the race was reproducibly triggered, and the vendor has released fix commits to the stable kernel trees.
Use-after-free race condition in the Linux kernel nexthop subsystem (net/ipv4/nexthop.c) allows a local attacker with low-privilege access to trigger slab-use-after-free in kernel memory, potentially achieving full kernel code execution with scope change across the system. The race occurs between nh_rt_cache_flush() walking nh->f6i_list without holding nh->lock and concurrent IPv6 route add/delete operations freeing fib6_info entries under nh->lock - confirmed by an in-kernel KASAN trace naming the task 'exploit/146'. This CVE carries a CVSS 3.1 score of 8.8 (S:C, C:H/I:H/A:H) but EPSS of 0.14% (4th percentile) and no CISA KEV listing indicate no confirmed active exploitation at time of analysis.
Stale kernel memory leaks to userspace through an off-by-two bounds error in the Linux kernel's libiscsi subsystem, specifically in `iscsi_scsi_cmd_rsp()`. Systems running an iSCSI initiator (libiscsi loaded) that connect to a malicious or compromised iSCSI target are exposed: the target crafts a SCSI Response PDU where the data segment length equals the declared sense length, causing a `memcpy()` to read two bytes past the received buffer boundary into stale `conn->data` contents, which are then returned to userspace in the SCSI sense buffer. No public exploit exists and EPSS stands at 0.16% (5th percentile); exploitation requires adversary control of an iSCSI target the victim connects to, making this a concern primarily for enterprise iSCSI storage environments rather than general internet-facing systems.
Heap buffer overflow in the Linux kernel iSCSI TCP initiator (drivers/scsi/libiscsi_tcp.c) lets a malicious or compromised iSCSI target overflow the fixed 8192-byte conn->data buffer by returning a SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) whose DataSegmentLength exceeds ISCSI_DEF_MAX_RECV_SEG_LEN. Unlike LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT, the SCSI response path copied sense/response data into conn->data without bounding it against the buffer size, only against the negotiated MaxRecvDataSegmentLength (open-iscsi default 262144). Any Linux host acting as an iSCSI initiator against an untrusted target is affected; there is no public exploit identified at time of analysis and EPSS is low (0.16%, 5th percentile), and it is not on CISA KEV.
Out-of-bounds memory corruption in the Linux kernel's ath12k WiFi 7 driver corrupts kernel memory adjacent to the ML peer ID bitmap during MLO peer cleanup. The `ath12k_mac_dp_peer_cleanup()` function incorrectly indexes a 256-bit bitmap with `dp_peer->peer_id`, which always carries the ATH12K_PEER_ML_ID_VALID flag (BIT(13), value 8192+), causing `clear_bit()` to write far outside the valid bitmap range. No public exploit has been identified at time of analysis, and EPSS probability stands at 0.14%, though the CVSS 8.8 rating reflects the adjacent-network, unauthenticated vector and full kernel-level C/I/A impact of the memory corruption primitive.
Memory corruption in the Linux kernel's nzxt-smart2 hwmon driver exposes systems on non-coherent DMA architectures (ARM, MIPS) to deterministic kernel memory corruption whenever the NZXT Smart Device 2 USB hardware triggers a DMA-mapped output report. The driver's send_output_report() passes a misaligned buffer to hid_hw_output_report(), which hands it to usb_interrupt_msg() for DMA mapping; on non-coherent caches, cache line flush or invalidate operations corrupt adjacent kernel variables (mutex, update_interval) sharing the same cache line. No public exploit has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects low exploitation probability, and the bug is not listed in CISA KEV.
Un-rate-limited ICMP and NDISC Redirect packet storms are possible in the Linux kernel when peer entry allocation fails inside `inet_getpeer_v4()` or `inet_getpeer_v6()`, affecting all kernels from 2.6.39 through the fixed stable releases. A remote unauthenticated attacker who can trigger peer table exhaustion against a Linux system acting as a network forwarder can cause the kernel to emit unbounded ICMP/NDISC Redirect messages, producing severe network availability degradation. No public exploit or proof-of-concept is identified at time of analysis, and EPSS sits at 0.17%, but the no-authentication CVSS profile warrants prompt patching on any Linux routing infrastructure.
Out-of-bounds array access in the Linux kernel nct6775-core hardware monitoring driver allows a local low-privileged user on systems equipped with the nct6116 Super I/O chip to trigger reads beyond 3-element weight register arrays (up to index 4), with the resulting garbage values subsequently used as hardware I/O register addresses. This can cause invalid hardware register writes, hardware misconfiguration, or system crashes. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), making this a patch-priority rather than emergency-response item; exploitation is bounded by the hardware specificity of the nct6116 chip.
Use-after-free in the Linux kernel's forcedeth Ethernet driver allows a local user to trigger kernel memory corruption during device removal. The driver's nv_remove() function frees per-CPU txrx_stats before unregister_netdev() completes, leaving the ndo_get_stats64 statistics path, NAPI polling, xmit data path, and nv_close()/drain all capable of accessing the already-freed structure. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and no public exploit identified at time of analysis, the immediate risk is narrow but the potential for local privilege escalation on systems with NVIDIA nForce-era hardware warrants prompt patching.
A double-free memory-corruption defect in the Linux kernel's rtase Realtek automotive Ethernet driver allows the same multi-fragment socket buffer to be freed twice when the transmit path hits a DMA mapping failure. It affects hosts running the rtase driver (Realtek multi-gigabit/automotive NICs) on kernel 6.12 and related stable trees, and can lead to kernel memory corruption and denial of service. No public exploit has been identified at time of analysis; EPSS is low (0.17%, 7th percentile) and the CVE is not on CISA KEV.
Shift-out-of-bounds undefined behavior in the Linux kernel's TC u32 classifier allows local privilege escalation on systems where unprivileged namespace creation is permitted. The root cause is that u32_change() copies a user-supplied offshift value (0-255) into the kernel without validating it is less than 16, so when packet classification later evaluates the variable offset expression with TC_U32_VAROFFSET set, an offshift >= 32 violates C11 §6.5.7p3 and produces undefined behavior exploitable for kernel-level impact. No public exploit has been identified at time of analysis, and patched stable releases 7.1.8 and 7.2-rc6 are available.
Use-after-free in the Linux kernel Bluetooth ISO subsystem allows a physically adjacent, unauthenticated attacker to corrupt kernel heap memory, potentially enabling privilege escalation or a denial-of-service crash. The defect exists in `iso_sock_disconn()`, where clearing `conn->hcon = NULL` omits the required `conn->hcon->iso_data = NULL` reset, leaving a dangling pointer that `iso_conn_free()` later dereferences. Patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.44, 7.1.8); no confirmed active exploitation is on record despite the high CVSS score, consistent with the very low EPSS of 0.17% and the specialized Bluetooth ISO attack surface.
Use-After-Free in the Linux kernel's Bluetooth L2CAP LE connection response handler exposes systems with Bluetooth enabled to potential kernel-level memory corruption by an adjacent, unauthenticated attacker. The flaw in `l2cap_le_connect_rsp()` stems from missing reference-count protection on a channel object, allowing a concurrent remote-disconnect-triggered `l2cap_chan_del()` to free the object between lookup and lock - a pattern already fixed in the BR/EDR counterpart but overlooked here. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.17%, and no public exploit code has been identified, though the kernel-level UAF impact class is inherently severe if triggered.
Missing socket lock in the Linux kernel Bluetooth ISO subsystem exposes a race condition in iso_sock_getname that allows a low-privileged adjacent attacker to trigger a use-after-free or null-pointer dereference via concurrent connection teardown. Systems running affected kernel versions with Bluetooth ISO (Isochronous) sockets enabled are vulnerable to kernel crashes or memory disclosure. No public exploit code exists and EPSS probability is 0.17%, but the CVSS 8.0 score reflects the potential for high-impact memory corruption if the race is won.
Race condition in the Linux kernel Bluetooth ISO subsystem allows an adjacent, unauthenticated attacker to trigger a NULL pointer dereference or memory corruption by sending crafted Bluetooth LE ISO connection events targeting a socket concurrently transitioning out of LISTEN or CONNECT state. Affected kernels span the 6.8.9 through pre-6.9 range, with backported fixes confirmed for stable releases 6.18.44 and 7.1.8. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), though the kernel-level impact and Bluetooth-adjacent unauthenticated access vector justify the vendor's 8.8 CVSS rating.
Use-after-free race condition in the Linux kernel's Bluetooth ISO subsystem allows an unauthenticated attacker within Bluetooth adjacency range to corrupt kernel memory by exploiting concurrent socket teardown in iso_conn_ready(), potentially leading to privilege escalation or system crash on affected hosts. The flaw - present since the introduction of Bluetooth 5.2 ISO channel support in Linux 5.15 - arises because conn->sk is dereferenced without holding a lock or refcount, enabling a concurrent iso_sock_release() call to free the socket before iso_conn_ready() completes its dereference. No public exploit or CISA KEV entry exists at time of analysis, and the EPSS score of 0.17% (6th percentile) reflects very low near-term exploitation probability despite the High CVSS score.
Concurrent deadlock and use-after-free (UAF) vulnerabilities in the Linux kernel's Bluetooth ISO socket layer allow adjacent-network attackers to corrupt kernel memory via race conditions in `iso_sock_timeout()`. Affected systems must be within Bluetooth radio range; no authentication is required. No public exploit code and no CISA KEV listing have been identified - EPSS of 0.17% (6th percentile) reflects low current exploitation probability despite the high CVSS score of 8.8.
Use-after-free via reference counting race in the Linux kernel's Bluetooth ISO (LE Audio) subsystem allows an adjacent, unauthenticated attacker to potentially achieve kernel-level code execution or information disclosure. The race arises between concurrent execution of iso_conn_del() and iso_chan_del() in separate kernel tasks, resulting in a double-put of the iso_conn object and subsequent memory corruption. Affected stable branches span Linux 6.11.11 through pre-6.13 series; upstream patches are available in Linux 6.18.44, 7.1.8, and 7.2-rc6. No public exploit code exists and no active exploitation has been confirmed, consistent with a very low EPSS score of 0.17%.
Use-after-free race condition in the Linux kernel Bluetooth ISO subsystem allows an adjacent, unauthenticated attacker to trigger kernel memory corruption with full confidentiality, integrity, and availability impact. The flaw resides in the hci_conn::iso_data field, which is read and modified across concurrent kernel tasks without lock or RCU protection - allowing a kfree() in one task to race against a kref_get_unless_zero() in another, yielding a dangling pointer dereference. No public exploit code has been identified and EPSS exploitation probability is 0.15% (5th percentile), but kernel UAF primitives are well-understood by skilled attackers and the Bluetooth adjacency requirement is the primary limiting factor for mass exploitation.
Use-after-free (UAF) in the Linux kernel Bluetooth HCI connection subsystem exposes adjacent-network attackers to potential kernel memory corruption via a race condition in abort_conn_sync(). The hci_conn object can be freed while the hci_sync task is still executing against it, because no reference count is held across the async operation - a classic lifetime management failure in kernel concurrent code. No public exploit has been identified and EPSS sits at only 0.17% (6th percentile), but the CVSS 8.8 score reflects the theoretical full-system impact if the race is successfully won. The vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at time of analysis.
Use-after-free in the Linux kernel Bluetooth HCI synchronization subsystem (hci_sync) creates a theoretical kernel memory corruption risk via a race condition in the hci_connect_big_sync() callback. The conn (connection) struct can be freed while the hci_sync asynchronous task is still executing, potentially allowing an adjacent, unauthenticated attacker within Bluetooth range to trigger a dangling pointer dereference in kernel context. No public exploit identified at time of analysis and EPSS stands at 0.15% (5th percentile), but patches are available across multiple Linux stable branches and should be applied as routine maintenance.
Use-after-free in the Linux kernel Bluetooth hci_sync subsystem exposes local users with low privileges to potential kernel heap corruption via a race condition in `hci_connect_pa_sync()`. The `conn` connection object can be freed by one code path while the asynchronous hci_sync callback is still executing, allowing a local attacker on affected 6.12.x, 6.14.x, and 6.15.x kernel branches to corrupt kernel memory and potentially achieve full privilege escalation. No public exploit code has been identified, and EPSS of 0.15% (5th percentile) confirms very low exploitation probability at this time - no confirmed active exploitation (not in CISA KEV).
Use-after-free in the Linux kernel's Bluetooth HCI synchronization subsystem allows an adjacent-network attacker with low privileges to pass freed hci_conn pointers to hci_conn_valid(), where kmalloc may have reallocated that memory to unrelated objects. Affected Linux kernel versions across multiple stable branches expose systems with active Bluetooth to potential kernel memory corruption, yielding full confidentiality, integrity, and availability impact at the kernel level. No public exploit code has been identified and CISA KEV does not list this CVE; however, the HIGH CVSS score and kernel-level CIA:H/H/H impact justify prompt patching on any Bluetooth-enabled Linux host.
Local privilege escalation in the Linux kernel's octeontx2-af driver (Marvell OcteonTX2 hardware) allows a low-privileged Virtual Function (VF) tenant to overwrite the Physical Function's (PF) shared CGX hardware PKIND configuration, corrupting HiGig2 or EDSA packet parsing state and achieving high confidentiality, integrity, and availability impact across the PF boundary. The vulnerability arises because VF NIX LF allocation did not check whether the LMAC was already configured with a privileged PKIND before resetting it. No public exploit code has been identified and EPSS is 0.15% (5th percentile), indicating very low exploitation probability, though the changed-scope CVSS vector reflects genuine cross-tenant hardware corruption potential in SR-IOV deployments.
Deadlock in the Linux kernel qede NIC driver's recovery path permanently wedges the rtnetlink control plane of any affected host when a TX timeout fires on a QLogic/Cavium FastLinQ interface with VXLAN or GENEVE tunnel ports configured. Systems in this state remain pingable but every subsequent caller of rtnl_lock - including ip, sshd, ovs-vswitchd, IPv6 addrconf, and lldpad - blocks indefinitely, denying all network management access until reboot. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the impact on unpatched datacenter hosts in tunnel-overlay environments is severe and patch adoption should be prioritized.
Use-after-free memory corruption in the Linux kernel's ksmbd SMB server subsystem exposes systems running the in-kernel file-sharing daemon to potential kernel-level compromise by an authenticated remote attacker. Affected are Linux kernel versions beginning at commit 8510a043d334ecdf83d4604782f288db6bf21d60 (ksmbd introduction) through multiple stable branches, with vendor-released patches confirmed in 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. No public exploit code has been identified and EPSS stands at 0.17% (6th percentile), indicating no observed mass exploitation at time of analysis despite the CVSS 8.8 severity rating.
Session-binding authentication weakness in the Linux kernel's ksmbd in-kernel SMB3 server allows different SMB clients to be treated as identical because ClientGUID values were compared with strncmp(), which halts at the first embedded NUL byte. An attacker able to reach an exposed ksmbd share could exploit this to bind to another client's authenticated SMB3 multichannel session or bypass FSCTL_VALIDATE_NEGOTIATE_INFO integrity checks, exposing high confidentiality and integrity impact per the CVSS 9.1 rating. There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), indicating no observed exploitation activity.
Use-after-free in the Linux kernel's IOMMUFD subsystem (iommu/iommufd) exposes systems running VFIO device passthrough to kernel memory corruption by a local low-privileged attacker, with a scope change that may cross security boundaries into the hypervisor layer. The flaw, present since Linux 6.11, stems from a race between IOPF group acceptance by the fault handler and concurrent device detach operations, leaving IOMMUFD's deliver list holding references to memory already freed by the generic pending list cleanup path. No public exploit or active exploitation has been identified at time of analysis - EPSS stands at 0.17% (6th percentile) and the vulnerability is absent from CISA KEV - though the CVSS 3.1 score of 8.8 reflects the severity of potential impact in affected virtualization environments.
Double-free memory corruption in the Linux kernel's pinctrl/devicetree subsystem enables a local low-privileged attacker on systems running affected pinctrl drivers - such as pinctrl-imx on NXP iMX6 platforms - to corrupt kernel heap memory, with theoretical potential for local privilege escalation. The flaw resides in the error-cleanup path of `dt_remember_or_free_map()`: when `kstrdup_const()` fails mid-loop, `dt_free_map()` iterates over all map entries including those never initialized by the core, passing uninitialized `kmalloc()` data to `kfree_const()` - a KASAN-confirmed double-free. No public exploit identified at time of analysis; the EPSS score of 0.18% (8th percentile) reflects very low real-world exploitation probability despite the formal CVSS 7.8 rating.
List corruption in the Linux kernel's hugetlb memory management subsystem (`mm/hugetlb`) allows a local low-privileged attacker to trigger kernel memory corruption, potentially achieving privilege escalation or host crash. The flaw was confirmed as causing real-world KVM host panics in dense virtualization environments where QEMU and SPDK/DPDK vhost-user processes share a hugetlbfs MAP_SHARED mapping; with CONFIG_DEBUG_LIST disabled, the corruption silently embeds a kernel stack address into an active cache list, setting up a use-after-free. No public exploit has been identified at time of analysis; EPSS is 0.17% and the vulnerability is not in CISA KEV, but fixed stable kernel releases are available across all active branches.
Local privilege-escalation/denial-of-service via a use-after-free in the Linux kernel's KVM x86 I/O APIC emulation (CVE-2026-74517): during VM teardown the delayed I/O APIC EOI work (kvm_ioapic_eoi_inject_work) can execute after the target vCPUs are freed, causing __kvm_irq_delivery_to_apic_fast to read freed slab memory. Any local principal able to create and run a KVM guest can race VM destruction against a pending delayed EOI to corrupt host kernel memory. EPSS is low (0.15%, 5th percentile) and the issue is not on CISA KEV; no public exploit is identified, and the reporter/tags frame the practical impact as denial of service.
KVM on AMD SVM-enabled hosts fails to update x2APIC MSR intercepts when AVIC is inhibited while a nested guest (L2) is running, allowing an L1 guest with root-level privileges to directly access the host's APIC state, send arbitrary interrupts, and crash the host kernel. Affected Linux kernels from 6.0 through multiple stable branches expose the host to interrupt manipulation, task priority changes, and denial-of-service. A functional proof-of-concept demonstrating both spurious interrupt injection and wakeup handler corruption is embedded in the CVE description itself; this vulnerability is not currently listed in the CISA KEV catalog and carries a 0.17% EPSS score consistent with its narrow but severe exploitation conditions.
KVM s390 PCI subsystem in the Linux kernel allows a local low-privileged user to corrupt hypervisor resources by repeatedly calling the adapter interrupt forwarding ioctl for the same zPCI device without prior unregistration. The vulnerability affects IBM Z (s390) systems running Linux KVM with PCI passthrough from commit 3c5a1b6f onwards (Linux 6.0+), with patched stable releases available. No public exploit exists and EPSS sits at 0.17% (6th percentile), reflecting the niche architecture and local-access prerequisite, but the CVSS Scope:Changed designation signals the flaw can cross the guest-to-hypervisor boundary, elevating its priority on affected IBM Z KVM deployments.
Use-after-free in the Linux kernel's dibs loopback subsystem allows a local low-privileged attacker to corrupt kernel memory during concurrent DMB node attach, detach, and unregister operations. The vulnerability arises from a race window between hash table lookup under dmb_ht_lock and the subsequent refcount operation performed after the lock is dropped, enabling a concurrent unregister path to free the node before the refcount transition completes. With a CVSS score of 7.8 and C:H/I:H/A:H impact metrics, successful exploitation can lead to privilege escalation or kernel crash; however, no public exploit is identified at time of analysis and EPSS at 0.17% reflects low current exploitation probability.
Use-after-free in the Linux kernel audit subsystem's `audit_del_rule()` function exposes systems from kernel 4.3 onward to local privilege escalation. The flaw stems from incorrect RCU ordering: fsnotify mark resources tied to `e->rule.exe` are freed before the rule is unlinked from RCU-visible filter lists, creating a window where concurrent `audit_filter()` and `audit_filter_rules()` readers dereference already-freed memory. Patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Linux kernel Bluetooth management subsystem allows a local low-privileged user to corrupt kernel heap memory by racing MGMT_OP_SET_LOCAL_NAME against MGMT_OP_REMOVE_UUID on systems with a powered BR/EDR-capable Bluetooth controller. The race exploits a missing lock acquisition in pending_eir_or_class() and the omission of MGMT_OP_SET_LOCAL_NAME from EIR-serialization logic, enabling a freed pending command entry to be read during EIR reconstruction. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), but the kernel UAF primitive and confirmed 7.8 CVSS score make patching a clear priority for Bluetooth-enabled systems.
Use-after-free in the Linux kernel Bluetooth management subsystem allows a low-privileged local attacker to corrupt kernel heap memory and achieve privilege escalation to root. Kernels from approximately 2.6.39 through unpatched revisions of the 6.6.x, 6.12.x, 6.18.x, and 7.1.x stable series are vulnerable when Bluetooth hardware is present and the mgmt interface is accessible. No public exploit has been identified at time of analysis, and EPSS at 0.20% (10th percentile) reflects limited current exploitation probability, though UAF primitives in the Linux kernel are historically weaponized following public disclosure.
Use-after-free in the Linux kernel Bluetooth hci_sync subsystem exposes kernel heap memory to corruption via a race condition between advertising instance teardown and HCI command synchronization. Systems running affected kernel versions (from commit cba6b758711cab946c787f7c15be92cc749b8e1f across 5.15.x, 6.12.x, 6.18.x stable branches) with active Bluetooth LE extended advertising are vulnerable to exploitation by attackers within Bluetooth radio range. The kernel-level UAF can yield arbitrary code execution in kernel context with full C/I/A impact; no public exploit has been identified and EPSS sits at the 6th percentile, indicating purely theoretical exploitation risk at this time.
Uninitialized memory read and session hijack in the Linux kernel Bluetooth HIDP subsystem exposes systems with active Bluetooth HID sessions to kernel memory disclosure and forced session termination from an unauthenticated adjacent attacker. The functions hidp_recv_ctrl_frame() and hidp_recv_intr_frame() dereference skb->data[0] before validating that the received L2CAP SDU is at least one byte long, allowing a connected peer to feed an empty frame and cause the kernel to consume a stale tailroom byte - or, via a crafted HCI ACL packet, a fully attacker-controlled byte interpreted as a synthetic HIDP transaction code. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Bluetooth HIDP in the Linux kernel exposes an uninitialized-memory read and a peer-controlled out-of-bounds byte access in hidp_session_run() when processing numbered HID report responses. Systems running Linux with active Bluetooth HID sessions are vulnerable to a malicious adjacent Bluetooth peer leveraging this to disclose kernel memory contents (rated C:H, enabling potential KASLR bypass) or manipulate HIDIOCGFEATURE report completion with attacker-controlled data. No public exploit has been identified, EPSS is 0.17% (6th percentile), and this vulnerability is not listed in CISA KEV.
Use-after-free in the Linux kernel's AFS (Andrew File System) subsystem exposes systems running the kafs module to kernel memory corruption exploitable by local low-privileged users, potentially enabling privilege escalation to root. The race condition in afs_make_call() allows the afs_call structure to be freed by an arriving async server response while the sending function - having transferred its reference rather than retaining one - continues to access the freed memory. EPSS is 0.17% (6th percentile), no CISA KEV listing exists, and upstream fix commits are publicly available on stable kernel trees.
Use-after-free in the Linux kernel ALSA timer subsystem allows an unprivileged local user to corrupt kernel heap memory and escalate privileges to root. The flaw stems from snd_timer_close_locked() setting SNDRV_TIMER_IFLG_DEAD but never clearing it after close completes; when snd_seq_timer_open() retries on the same instance after a forced failure, snd_timer_instance_free() frees an object still referenced across multiple kernel data structures. With CVSS 7.8 and a detailed exploitation path described directly in the upstream kernel commit, this is a credible local privilege escalation on desktop and workstation Linux systems, despite a low EPSS score of 0.17% (6th percentile) and no current CISA KEV listing. No public exploit code has been identified at time of analysis.
Missing bounds enforcement in the Linux kernel ALSA USB audio driver's implicit-feedback path allows a physically-connected malicious USB device to inject oversized sync packets that propagate un-clamped into the playback endpoint queue. The un-clamped frame count - potentially exceeding ep->maxframesize - can drive packet transfers beyond hardware frame limits, risking kernel memory corruption with high confidentiality, integrity, and availability impact. No public exploit has been identified and EPSS is 0.17% (6th percentile), but patches are confirmed across multiple stable kernel branches including 6.6.151, 6.12.103, 7.1.8, and 6.18.44.
Use-after-free in the Linux kernel's FOU (Foo-over-UDP) tunnel subsystem allows a local attacker with low privileges to corrupt kernel memory by exploiting a race condition in fou_create(). The struct fou object is published via sk_user_data before being committed to the per-network-namespace port list; when fou_add_to_port_list() subsequently fails on port-0 requests, the error path frees the object while concurrent RCU readers can still dereference it through fou_from_sock(). Two stable-branch upstream commits (a28d8903, b14361ac) provide the fix; no public exploit has been identified at time of analysis, and EPSS sits at the 5th percentile.
A DMA mapping resource leak in the Linux kernel's igbvf driver (Intel 82576 SR-IOV virtual function NIC) occurs on the TX buffer-mapping error path: an off-by-one in the dma_error cleanup loop leaks exactly one DMA mapping (the packet head) whenever a fragment mapping fails after the head was successfully mapped. The bug traces to a 2010 fix for an endless loop and affects a wide range of stable kernels until patched (fixes landed in 6.6.151, 6.12.103, 6.18.44, 7.1.8 and 7.2-rc6). There is no public exploit identified at time of analysis, EPSS is very low (0.17%), and the practical impact is memory/DMA resource exhaustion rather than the remote code execution suggested by the assigned 9.8 score.
Kernel-level use-after-free in the Linux SMC (Shared Memory Communications) subsystem allows a race between socket close and link group termination to write to freed memory. The flaw lives in the net/smc driver where __smc_lgr_terminate() releases conns_lock after locating a connection in lgr->conns_all but before calling sock_hold(), so a concurrent close can free the embedded socket first. Fixed across multiple stable trees; EPSS is low (0.17%), there is no public exploit identified at time of analysis, and it is not on CISA KEV.
Use-after-free in the Linux kernel netfilter ipset subsystem enables local kernel memory corruption with potential for privilege escalation. During an ipset hash resize (`mtype_resize()`), comment pointers are shallow-copied via `memcpy()` rather than deep-copied, causing both old and new table entries to share the same `ip_set_comment_rcu` pointer; an `xt_SET --add-set --exist` packet hitting the old entry during this window calls `ip_set_init_comment()`, freeing the shared pointer and leaving the new table entry with a dangling reference that is later dereferenced in `strlen()` during backlog replay. Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6), no public exploit has been identified, and EPSS sits at 0.17% (6th percentile), indicating very low observed exploitation pressure at time of analysis.
Use-after-free race condition in the Linux Kernel TIPC subsystem allows a low-privileged attacker to trigger stale-pointer dereference during socket poll trace operations, potentially leading to kernel memory corruption and privilege escalation. The flaw arises because tipc_poll() invokes trace_tipc_sk_poll() without holding the socket lock, enabling tipc_list_dump() to walk live queue members while a concurrent thread dequeues and frees socket buffers (skbs). Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8); no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Linux kernel wifi/mac80211 subsystem allows an adjacent network attacker to trigger kernel memory corruption during Block Acknowledgment session teardown. ieee80211_stop_tx_ba_cb() hands tid_tx to kfree_rcu() and then reads tid_tx->ndp after dropping sta->lock without RCU read-side protection, creating a window where the RCU softirq callback can free the object before the read completes. The vulnerability carries a CVSS 8.8 score (AV:A) but EPSS sits at the 5th percentile with no KEV listing, reflecting the race-condition exploitation complexity; no public exploit has been identified at time of analysis.
Use-after-free and out-of-bounds read in the Linux kernel mwifiex WiFi driver (CVSS 8.8, AV:A) allow an unauthenticated attacker on an adjacent WiFi segment to trigger kernel memory corruption by sending crafted A-MSDU frames containing TDLS payloads. Affected kernel versions span from the commit introducing A-MSDU TDLS handling (circa Linux 4.5, commit 776f742040ca) through all stable branches prior to the fixes in 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the flaw is remotely selectable by the sender through control over A-MSDU subframe layout, making TDLS-capable mwifiex deployments meaningfully exposed from the local wireless segment.
Out-of-bounds slab read in the Linux kernel's binfmt_misc subsystem allows local low-privileged users - including those operating within unprivileged user namespaces - to trigger heap memory exposure or a kernel crash by registering a binary format with a flag character ('P', 'O', 'C', or 'F') as the field delimiter. The flaw exists because check_special_flags() consumes flag characters without using the delimiter as a terminator, swallowing the 8-byte padding appended by create_entry() and reading past the end of the allocated buffer. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates low near-term exploitation probability; however, reachability from unprivileged user namespaces on most modern Linux distributions meaningfully broadens the real-world attack surface.
Use-after-free in the Linux kernel's Transparent Huge Page split path exposes systems to kernel memory corruption, potential privilege escalation, or denial of service via a race condition in __folio_split(). Any local low-privilege user on affected kernels prior to the stable fixes in versions 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6 may trigger this by racing a concurrent final iput() against the shmem THP split unlock sequence. No public exploit or PoC has been identified, and the EPSS score of 0.17% (6th percentile) reflects minimal real-world exploitation activity at time of analysis.
Use-After-Free in the Linux kernel's mm/page_reporting subsystem triggers a General Protection Fault during PM suspend and hibernation on systems running virtio_balloon with page reporting enabled. When the PM freezer initiates a suspend or S4 hibernation cycle, the virtio_balloon driver tears down its virtqueues via del_vqs(), but page_reporting_process - scheduled on the non-freezable system_wq workqueue - remains active. If the buddy allocator frees pages during this window (e.g., the balloon shrinker runs during S4 image saving), the reporting worker calls virtballoon_free_page_report() on already-deleted virtqueues, causing kernel memory corruption. No public exploit has been identified at time of analysis; EPSS is 0.18% (8th percentile), reflecting minimal exploitation probability, though this is a confirmed kernel UAF with crash-level impact validated by Google in production virtualization infrastructure.
Use-after-free in the Linux kernel bridge (net/bridge) multicast fast-leave path lets the group-leave handler dereference a freed port-group entry after br_multicast_del_pg() removes it, because the loop keeps walking through the stale next pointer. It affects bridges that had multicast-to-unicast enabled and later disabled while multiple per-source-MAC port groups existed, and can corrupt kernel memory. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not in CISA KEV, so the headline CVSS 9.8 overstates practical risk for most deployments.
Use-after-free in the Linux kernel pktgen subsystem exposes local attackers with low privileges to kernel memory corruption, potential privilege escalation, or system crash. The flaw arises from a race condition between pktgen_change_name() and pktgen_remove_device() on a shared proc_dir_entry pointer, allowing a kpktgend kernel thread to dereference a stale, freed pointer after a concurrent rename operation releases it. No public exploit code or active exploitation has been identified; EPSS stands at 0.17% (6th percentile), consistent with the niche production footprint of the pktgen testing module.
Memory corruption in the Linux kernel's User Mode Linux (UML) vector network driver lets a remote peer trigger a use-after-free in vector_mmsg_rx(). When a received packet fails verify_header(), the code frees the skb but skips the slot-cleanup that normal paths perform, so the next RX iteration re-reads and double-frees the same freed buffer, causing a refcount underflow / use-after-free. It affects UML instances using the GRE or L2TPv3 vector transports; any peer on such a transport can trigger it without authentication. No public exploit identified at time of analysis, and EPSS is low (0.20%).
Denial-of-service (kernel crash) in the Linux kernel's veth driver affects hosts running an XDP program with AF_XDP sockets in copy mode bound to a virtual ethernet interface. When a frag_list skb (data_len set, nr_frags zero) reaches veth_convert_skb_to_xdp_buff(), the driver advertises XDP fragment metadata for a non-existent frags[] array, causing __xsk_rcv() to walk an empty fragment and crash inside memcpy(). NVD rates it CVSS 9.1, though the underlying tags and code path point to availability impact (crash) rather than the confidentiality loss the vector claims; EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis.
Race-condition torn read in the Linux kernel's VXLAN driver (route_shortcircuit()) allows the neighbour hardware address (n->ha) to be read without holding the n->ha_lock seqlock, producing a partially-updated or corrupted MAC address while the neighbour subsystem concurrently updates it. Fixed by switching to neigh_ha_snapshot() for a seqlock-protected read. No public exploit identified at time of analysis; EPSS is 0.17% (6th percentile), and despite the assigned CVSS of 10.0 the practical impact is a minor data-integrity/read-consistency issue in VXLAN forwarding, not a genuine critical remote compromise.
Improper transmit-path header validation in the Linux kernel VXLAN driver (functions vxlan_xmit, arp_reduce, and vxlan_mdb_entry_skb_get) can cause the driver to read network-layer header bytes (ARP, IPv6/ND, IP/IPv6 MDB keys) that reside in non-linear skb fragments. The root cause is the use of pskb_may_pull(), which measures length from skb->data - which on transmit points at the MAC header - instead of pskb_network_may_pull(), which accounts for the ETH_HLEN (14-byte) network offset; the result is that part of the network header may remain unpulled in paged fragments and be parsed from stale linear-buffer memory, an information-disclosure/misparse condition. Only systems with VXLAN overlay interfaces configured are affected. There is no public exploit identified at time of analysis, EPSS is 0.17% (6th percentile), and it is not in CISA KEV; the upstream 9.8 CVSS score appears substantially overstated for this robustness fix.
Out-of-bounds read in the Linux kernel's VXLAN driver stems from route_shortcircuit() validating only 20 bytes from skb->data instead of accounting for the 14-byte MAC header offset, so ip_hdr()->daddr dereferences can read past the pulled linear buffer when packets have non-linear fragments. The flaw affects hosts running VXLAN tunneling with proxy mode, is tagged as an information-disclosure issue, and has no public exploit identified at time of analysis (EPSS 0.17%, 6th percentile). A vendor fix replaces pskb_may_pull() with pskb_network_may_pull() to check the full network header including skb_network_offset().
Use-after-free in the Linux kernel tracing subsystem exposes low-privileged local attackers to kernel memory corruption and potential privilege escalation. The defect, introduced at commit ae63b31e4d0e2ec09c569306ea46f664508ef717, causes trace_module_add_events() to call __add_event_to_tracers() unconditionally even when __register_event() has failed, leaving a trace_event_file holding a dangling pointer to a freed trace_event_call after a module load failure. EPSS is 0.17% (6th percentile) and no public exploit or CISA KEV listing has been identified, but the kernel UAF class carries inherent escalation potential and patches are available across multiple stable branches.
Integer overflow in the Linux kernel's scsi_debug module allows a local low-privileged attacker on a 32-bit system to trigger an out-of-bounds write via a crafted SCSI REPORT ZONES command. When alloc_len is in the range 0xFFFFFFC1-0xFFFFFFFF, an ALIGN() rounding operation overflows to 0x100000000, which truncates to zero under 32-bit size_t, causing kzalloc(0) to return a ZERO_SIZE_PTR sentinel that passes null checks - subsequent pointer arithmetic and loop writes then corrupt kernel memory, leading to privilege escalation or kernel panic. No public exploit has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects the narrow exploitation conditions required.
Integer overflow in the Linux kernel SCTP subsystem allows a remote low-privileged attacker to trigger an approximately 8 MiB out-of-bounds write past a socket buffer (skb) tail in kernel heap memory by adding 65,536 unique peer transport addresses to an SCTP association, wrapping the 16-bit transport_count to zero. Affected systems running Linux kernels from the 4.7 era through stable branches prior to 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6 are vulnerable. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates minimal current exploitation activity despite the CVSS 8.8 rating.
Privilege escalation in the Linux kernel's s390/qeth network driver allows any local unprivileged user to invoke three network management ioctls - SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE, and SIOC_QETH_QUERY_OAT - without the CAP_NET_ADMIN capability check that should gate them. Affected deployments are exclusively IBM z Systems (s390) mainframe environments running Linux kernels from commit 18787eeebd7 through the respective stable fix points, limiting real-world exposure to a narrow architectural niche. No public exploit or active exploitation has been identified; EPSS of 0.17% at the 6th percentile is consistent with the specialized environment required.
Use-after-free in the Linux kernel's Open vSwitch meter subsystem exposes systems running OVS to local privilege escalation, memory corruption, and potential information disclosure. The flaw affects all Linux 5.8+ kernels up to the patched stable releases and is triggered by a custom userspace application interacting with OVS via Netlink uAPI - standard ovs-vswitchd deployments are not vulnerable. No public exploit has been identified and EPSS sits at the 6th percentile, but the bug was discovered by Trend Micro's Zero Day Initiative (ZDI-CAN-31642), indicating professional security research attention; multiple stable kernel patches are now available.
NULL pointer dereference and use-after-free in the Linux kernel i2c-imx driver (NXP i.MX SoC family) allows a local attacker or concurrent kernel path to trigger kernel memory corruption during I2C slave unregistration. The race condition in i2c_imx_unreg_slave() permits a pending hrtimer callback to fire after the slave pointer has been cleared, causing i2c_imx_slave_finish_op() to dereference a NULL pointer with potential for privilege escalation or system crash. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.17% (6th percentile) confirms low exploitation likelihood, though the CVSS base score of 8.4 reflects high potential impact if triggered.
Double-free heap corruption in the Linux kernel's peak_usb CAN bus USB driver exposes systems with PEAK USB-to-CAN hardware to local privilege escalation, kernel panic, or sensitive memory disclosure. The flaw resides in the peak_usb_start() error-handling path, where a URB transfer buffer is freed explicitly via kfree(buf) before usb_free_urb() frees the same buffer a second time through the URB_FREE_BUFFER flag, corrupting kernel heap allocator metadata. Patched stable kernel releases are confirmed available (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6), no public exploit code has been identified, and EPSS at 0.17% (6th percentile) confirms no observed exploitation activity.
Arbitrary CMA memory corruption via GPU DMA in the Linux kernel's drm/vc4 VideoCore 4 driver affects Raspberry Pi and similar vc4-based platforms running kernels from version 4.13 through multiple stable series. The vc4_overflow_mem_work() function incorrectly programs BPOS with the full 16MB binner BO size instead of the correct 512KB slot size, authorizing the GPU's PTB hardware to scribble tile lists across adjacent in-flight job memory and into unrelated CMA pages beyond the BO boundary. No public exploit has been identified at time of analysis and EPSS is 0.17% (6th percentile), but the memory corruption manifests reliably as GPU hangs, userspace heap corruption, and system crashes under normal GPU workloads that overflow the initial binner slot.