Linux
Monthly
BPF test infrastructure in the Linux kernel allows a local user with BPF program execution privileges to emit packets with malformed GSO (Generic Segmentation Offload) metadata to the network stack via bpf_clone_redirect(), triggering skb_warn_bad_offload() and disabling GSO-related offload features - a denial-of-service condition. The root cause is convert___skb_to_skb() populating gso_segs and gso_size without a corresponding gso_type, producing an internally inconsistent socket buffer that fails GSO validation in netif_skb_features(). No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the issue was originally surfaced through fuzzing by Yinhao et al. Patches across six stable kernel branches have been released.
Memory corruption in the Linux kernel's asymmetric_keys crypto subsystem allows a local low-privileged user to trigger a heap buffer overflow by supplying a crafted X.509 certificate. The flaw lives in asymmetric_key_generate_id(), where the sizes of attacker-controlled binary blobs (such as arbitrarily large ASN.1 INTEGER serial numbers and issuer names) are added to the size of an asymmetric_key_id structure without overflow checking, so an integer overflow yields an undersized allocation and a subsequent out-of-bounds copy. No public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile).
Local denial of service in the Linux kernel's software RDMA driver (RDMA/rxe, rdma_rxe module) allows a user with access to an rxe device to crash the host via a NULL pointer dereference. When ibv_modify_srq() is called to resize a shared receive queue and rxe_queue_resize() fails, rxe_srq_from_attr() leaves srq->rq.queue set to NULL; a subsequent modify call dereferences srq->rq.queue->buf->index_mask in rxe_srq_chk_attr() and panics. No public exploit identified at time of analysis, and the EPSS score is low (0.16%, 6th percentile).
In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix device resources accessed after device removal Correct possible race conditions during device removal. Previously, a scheduled work item to reset a LUN could still execute after the device was removed, leading to use-after-free and other resource access issues. This race condition occurs because the abort handler may schedule a LUN reset concurrently with device removal via sdev_destroy(), leading to use-after-free and improper access to freed resources. - Check in the device reset handler if the device is still present in the controller's SCSI device list before running; if not, the reset is skipped. - Cancel any pending TMF work that has not started in sdev_destroy(). - Ensure device freeing in sdev_destroy() is done while holding the LUN reset mutex to avoid races with ongoing resets.
Local privilege-limited denial of service in the Linux kernel's CoreSight TMC (Trace Memory Controller) driver allows a user with performance-monitoring access to trigger a kernel oops via an invalid pointer dereference in tmc_etr_get_buffer(). The flaw occurs because the perf event handle was not attached to the coresight_path, so dependent devices such as the CATU could not retrieve the per-CPU AUX_EVENT during path enablement. It is reproducible with a standard perf record command against CoreSight ETM tracing; there is no public exploit identified at time of analysis and EPSS is low (0.16%).
Denial of service in the Linux kernel's ntfs3 filesystem driver stems from a run_lock rwsem that is never initialized when the special $Extend metadata inode is loaded. When $Extend's inode mode is set to a regular file, a truncate() call reaches ntfs_set_size() and acquires the uninitialized lock, tripping lockdep and risking kernel instability. The regression was introduced by commit 4e8011ffec79 and was found via syzbot fuzzing; no public exploit identified at time of analysis, and EPSS is low at 0.17%.
Uninitialized memory use in the Linux kernel NTFS3 filesystem driver (fs/ntfs3) enables a local low-privileged user to trigger a kernel crash, causing a denial of service. The `__getname()` function allocates slab memory via `kmem_cache_alloc()` without zeroing it; `ntfs_read_hdr` and `bcmp` then operate on this indeterminate data, as detected by KMSAN. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.18% at the 7th percentile reflects very low real-world exploitation probability. Upstream patches are available across multiple stable kernel branches.
In the Linux kernel, the following vulnerability has been resolved: bpf: Check skb->transport_header is set in bpf_skb_check_mtu The bpf_skb_check_mtu helper needs to use skb->transport_header when the BPF_MTU_CHK_SEGS flag is used: bpf_skb_check_mtu(skb, ifindex, &mtu_len, 0, BPF_MTU_CHK_SEGS) The transport_header is not always set. There is a WARN_ON_ONCE report when CONFIG_DEBUG_NET is enabled + skb->gso_size is set + bpf_prog_test_run is used: WARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071 skb_gso_validate_network_len bpf_skb_check_mtu bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch bpf_test_run bpf_prog_test_run_skb For a normal ingress skb (not test_run), skb_reset_transport_header is performed but there is plan to avoid setting it as described in commit 2170a1f09148 ("net: no longer reset transport_header in __netif_receive_skb_core()"). This patch fixes the bpf helper by checking skb_transport_header_was_set(). The check is done just before skb->transport_header is used, to avoid breaking the existing bpf prog. The WARN_ON_ONCE is limited to bpf_prog_test_run, so targeting bpf-next.
Denial of service in the Linux kernel's mt76 wireless driver (MT7996 WiFi 7 support) allows the kernel to crash (NULL/invalid pointer dereference) when hardware-accelerated flow offloading runs on a secondary Wireless Ethernet Dispatch instance (wed_hif2, e.g. a 6GHz link). The mt76 WED callbacks unconditionally referenced the primary wed device, so tearing down or disabling offload on wed_hif2 dereferences an invalid address and triggers a kernel Oops. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%, 8th percentile), and it is not in CISA KEV; impact is availability loss (system crash), not code execution.
Memory corruption (double free) in the Linux kernel btrfs filesystem's quota group (qgroup) accounting affects the add_delayed_ref_head() code path when a qgroup record is reported as already existing but a subsequent error occurs, causing both caller and callee to free the same 'qrecord' object. The flaw is a local btrfs-triggered condition on systems using btrfs with quota groups; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, with a very low EPSS of 0.17%. Despite an automated CVSS of 9.8, the realistic attack surface is local to the machine and gated by a hard-to-reach error path.
Linux kernel iomap subsystem fails to allocate the s_dio_done_wq workqueue for asynchronous read operations, causing read error completions deferred by commit 222f2c7c6d14 to lack proper execution context and potentially leading to information disclosure or system instability. The vulnerability affects Linux kernel versions where the read error completion deferral was implemented without corresponding workqueue allocation for async reads. With an EPSS score of 0.01% and no evidence of active exploitation, this is a low-probability but correctness-critical issue affecting async I/O error handling on affected kernel versions.
Out-of-bounds memory access in the Linux kernel's ch341 SPI driver (drivers/spi/spi-ch341) allows a local low-privileged actor to trigger heap buffer overreads and overwrites during SPI transfers on systems using a WCH CH341 USB-to-SPI bridge. The flaw stems from ch341_transfer_one copying 'len' bytes (which includes a 1-byte command header) instead of 'len - 1' from the user-supplied transfer buffer, causing both an out-of-bounds read from trans->tx_buf and, when len equals the 32-byte packet length, a 1-byte overflow of ch341->tx_buf. EPSS is low at 0.18% and there is no public exploit identified at time of analysis, consistent with a niche hardware-dependent kernel driver rather than a widely exploited target.
Denial of service in the Linux kernel's NFSv4/pNFS client allows a null-pointer dereference and system crash during inode writeback, affecting hosts mounting parallel-NFS (pNFS) exports. The flaw occurs because NFS_INO_LAYOUTCOMMIT was not cleared in pnfs_mark_layout_stateid_invalid, so the write_inode → nfs4_write_inode → pnfs_layoutcommit_inode path may dereference a layout that has already been freed. There is no public exploit identified at time of analysis, and the low EPSS score (0.18%) indicates minimal observed exploitation interest despite the CVSS 7.5 rating.
Local memory corruption in the Linux kernel's ALSA firewire-motu driver allows a user to trigger a buffer overflow when reading DSP events from the hwdep interface with an undersized buffer. The hwdep_read() path copied the full 8-byte DSP event header regardless of the caller-supplied buffer length, writing past the end of the user-provided buffer; the fix clamps the copy with min_t(). There is no public exploit identified at time of analysis, and EPSS is low (0.20%), consistent with a niche driver requiring MOTU FireWire audio hardware.
In the Linux kernel, the following vulnerability has been resolved: arm64: mm: fix VA-range sanity check Both create_mapping_noalloc() and update_mapping_prot() sanity-check their 'virt' parameter,. No vendor patch available.
A command injection vulnerability in Coolify's Database Import functionality allows authenticated users with application/service management permissions to execute arbitrary system commands as root on managed servers. The vulnerability stems from unsanitized database names being passed directly to shell commands, enabling full remote code execution. A public proof-of-concept exploit is available, and with an EPSS score of 0.41% (61st percentile), this represents a moderate real-world exploitation risk for organizations using vulnerable Coolify versions.
Concurrency-driven information disclosure in the Linux kernel's veth (virtual Ethernet) driver allows old or uninitialized packet descriptors to be exposed to AF_XDP consumers when veth is run in threaded-NAPI mode with an XDP program attached. Because the BPF redirect/return context was moved from per-CPU storage into the 'current' task_struct (commit 401cb7dae813), two concurrent veth_poll() invocations can nest the xdp_set/clear_return_frame_no_direct() section and race, corrupting the shared BPF net context. Despite an NVD CVSS of 9.8, this is a local, configuration-dependent kernel race with EPSS at 0.16% (6th percentile), no KEV listing, and no public exploit identified at time of analysis.
Type confusion in the Linux kernel's team network driver (team_port_add) allows a local user with CAP_NET_ADMIN to corrupt a team device's header_ops state, leading to a kernel hang or BUG(). When an already-UP GRE device is added as a team port, the operation fails but not before team_dev_type_check_change irreversibly replaces eth_header with ipgre_header on the team device; subsequent packet transmission causes ipgre_header() to dereference struct team private data as struct ip_tunnel, triggering a local denial-of-service. No active exploitation has been confirmed (not in CISA KEV), though a syzbot reproducer demonstrates the issue reliably.
Denial of service in the Linux kernel's jbd2 (JBD2 journaling layer) used by ext4 allows a local attacker to crash the system by mounting a specially crafted or corrupted ext4 image; when journal metadata is inconsistent (e.g. a block bitmap does not reflect an in-use block), jbd2_journal_get_create_access() hits a J_ASSERT/BUG_ON at fs/jbd2/transaction.c:1289 and panics the machine. Affected products span multiple stable kernel branches, with the fix converting the fatal BUG_ON into a JBD2 abort. No public exploit identified at time of analysis and EPSS is low (0.18%), consistent with a locally-triggered availability-only issue rather than a remotely weaponizable flaw.
Denial-of-service potential in the Linux kernel's spinlock debugging instrumentation (do_raw_write_lock) stems from an unmarked read/write in debug_write_lock_before(), producing a data-race flagged by the Kernel Concurrency Sanitizer (KCSAN). Only kernels built with lock debugging enabled are affected, and the fix completes prior race-hardening work (commit 1a365e822372) by converting the remaining access to WRITE_ONCE(). No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile).
Linux kernel AMD platform management controller (PMC) driver lacks Van Gogh SoC suspend handler support, preventing S0ix suspend operations on affected devices and causing GPU driver crashes during resume due to power management failures. ASUS ROG Ally (non-X) handheld gaming devices are directly impacted. Local attackers or unprivileged users can trigger denial of service by attempting system suspend, rendering the device unresponsive and forcing a hard reboot. The vulnerability carries low exploitation probability (EPSS 0.03%) but affects a specific consumer hardware class; upstream patches are available in stable kernel branches.
Denial-of-service hardening in the Linux kernel's page_pool subsystem addresses noisy allocation-failure handling on the network receive datapath. Because driver authors frequently omit GFP_NOWARN, ATOMIC page allocations that fail under memory pressure emit full allocation-failure warnings/backtraces; the fix makes page_pool add GFP_NOWARN by default for ATOMIC allocations. Rated CVSS 7.5 for availability impact only (C:N/I:N), with no public exploit identified at time of analysis and a low EPSS score (0.17%, 6th percentile).
Denial of service in the Linux kernel's lan966x Ethernet switch driver (Microchip LAN966x SoC) allows a potential deadlock and kernel warning when network statistics are read while holding an atomic context. The driver incorrectly used a sleeping mutex (lan966x_stats_get) inside an atomic/spinlock-held path, tripping a 'sleeping function called from invalid context' BUG and risking system instability; the fix replaces the mutex with a spinlock. No public exploit identified at time of analysis, and the EPSS score is negligible (0.16%, 6th percentile).
Local privilege-context memory corruption in the Linux kernel's io_uring zero-copy send (zctx) path allows a local user to trigger unsafe handling of chained notification (ubuf_info) contexts. The flaw stems from send-zerocopy operations linking ubuf_info structures that may originate from a different io_uring context than assumed, and the fix adds a check enforcing that only same-context notifications are chained. No public exploit has been identified at time of analysis; EPSS is very low (0.16%, 6th percentile) and the issue is not on the CISA KEV list, but the CVSS base score of 7.8 reflects high confidentiality, integrity, and availability impact for a successful local trigger.
Improper validation of node identifiers (nid) in the Linux kernel's F2FS filesystem allows a crafted or corrupted on-disk image to pass an out-of-range nid (where footer.ino equals footer.nid and both exceed valid bounds) through f2fs_alloc_nid() and free_nid_list, potentially causing out-of-bounds access, memory corruption, or a kernel crash. The upstream fix adds a sanity check to detect this corruption. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 6th percentile). Note the published CVSS 9.8 network vector appears inconsistent with the local, filesystem-image-driven nature of this bug.
Privilege-relevant use-after-free in the Linux kernel's drm/msm (Qualcomm Adreno GPU) driver allows a local user with GPU access to trigger kernel faults because last_fence is not waited on at VM-bind context close, freeing GPU resources while they are still in use. Affected systems run the msm DRM driver on Qualcomm SoCs and use vm_bind contexts. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.15%, 5th percentile), consistent with an in-tree kernel fix rather than an in-the-wild threat.
Weakened cryptographic randomness affects the Linux kernel on AMD Zen5 processors, where the RDSEED instruction's 16-bit and 32-bit register variants can return a zero value while falsely reporting success (CF=1), tracked upstream as AMD-SB-7055. Kernel and userspace consumers that rely on RDSEED for entropy can silently receive predictable seed material, undermining key generation and other cryptographic operations. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile); the kernel resolves this by adding a microcode-revision check that works around the faulty hardware behavior.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmt_pending before write iter sends the cmd, just as syzbot reported in UAF[1]. Here we use hci_dev_lock to synchronize the two, thereby avoiding the UAF mentioned in [1]. [1] syzbot reported: BUG: KASAN: slab-use-after-free in mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 Read of size 8 at addr ffff888077164818 by task syz.0.17/5989 Call Trace: mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 set_link_security+0x5c2/0x710 net/bluetooth/mgmt.c:1918 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195 Allocated by task 5989: mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296 set_link_security+0x557/0x710 net/bluetooth/mgmt.c:1910 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195 Freed by task 5991: mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline] mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257 mgmt_index_removed+0x112/0x2f0 net/bluetooth/mgmt.c:9477 hci_sock_bind+0xbe9/0x1000 net/bluetooth/hci_sock.c:1314
Use-after-free in the Linux kernel Bluetooth HCI core (hci_core) lets an attacker within Bluetooth range trigger a race between the ACL data RX path (l2cap_recv_acldata) and connection teardown (hci_abort_conn_sync/hci_conn_del), causing the RX handler to dereference a freed hci_conn structure. A syzkaller-reproduced crash confirms the flaw, which primarily manifests as denial of service though memory corruption cannot be excluded; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The issue is resolved upstream by moving the hci_conn lookup into the protocol receive handlers under a single RCU/lock-protected critical section.
Kernel memory corruption in the Linux platform/x86 Intel P-Unit IPC driver (intel_punit_ipc) arises from an interrupt handler dereferencing the address of a global pointer variable (&punit_ipcdev) instead of the pointer itself, so the completion call complete(&ipcdev->cmd_complete) in intel_punit_ioc() writes to an incorrect memory location. Affected systems are those running the punit_ipc driver on specific Intel SoC platforms; a local low-privileged actor able to drive the IPC command path can corrupt kernel memory, most plausibly causing instability or a crash. There is no public exploit identified at time of analysis, EPSS is very low (0.17%, 6th percentile), and the issue is not in CISA KEV.
Denial of service in the Linux kernel's Samsung sxgbe 10G Ethernet driver stems from a NULL pointer dereference in sxgbe_rx(), where the receive path logs an error when an skb is NULL but then dereferences that same NULL skb on the following line. The fix adds a 'break' so the code falls through to sxgbe_rx_refill() instead of crashing, mirroring the handling already used by other NIC drivers such as Calxeda's xgmac_rx(). There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile); the bug was found during code review rather than in-the-wild.
Out-of-bounds kernel write in the Linux 'atlantic' network driver (Aquantia/Marvell AQC-series 10G NICs) occurs when the RX path receives large multi-descriptor packets exceeding MAX_SKB_FRAGS (17) fragments, causing a fragment index to overrun the skb frag array inside skb_add_rx_frag_netmem() and triggering a kernel panic. The flaw was observed crashing production systems equipped with the Aquantia AQC113 10G NIC. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.17% (6th percentile), consistent with a hardware-specific denial-of-service condition rather than a broadly exploitable RCE.
In the Linux kernel, the following vulnerability has been resolved: afs: Fix delayed allocation of a cell's anonymous key The allocation of a cell's anonymous key is done in a background thread along with other cell setup such as doing a DNS upcall. In the reported bug, this is triggered by afs_parse_source() parsing the device name given to mount() and calling afs_lookup_cell() with the name of the cell. The normal key lookup then tries to use the key description on the anonymous authentication key as the reference for request_key() - but it may not yet be set and so an oops can happen. This has been made more likely to happen by the fix for dynamic lookup failure. Fix this by firstly allocating a reference name and attaching it to the afs_cell record when the record is created. It can share the memory allocation with the cell name (unfortunately it can't just overlap the cell name by prepending it with "afs@" as the cell name already has a '.' prepended for other purposes). This reference name is then passed to request_key(). Secondly, the anon key is now allocated on demand at the point a key is requested in afs_request_key() if it is not already allocated. A mutex is used to prevent multiple allocation for a cell. Thirdly, make afs_request_key_rcu() return NULL if the anonymous key isn't yet allocated (if we need it) and then the caller can return -ECHILD to drop out of RCU-mode and afs_request_key() can be called. Note that the anonymous key is kind of necessary to make the key lookup cache work as that doesn't currently cache a negative lookup, but it's probably worth some investigation to see if NULL can be used instead.
Local privilege escalation and memory corruption in the Linux kernel's io_uring networking subsystem stems from vectored registered buffer imports being tied to the wrong io_kiocb (the request 'req' instead of the notification 'sr->notif'), creating an object-lifetime mismatch. Local low-privileged users on affected kernels can trigger use-after-free-style conditions leading to information disclosure or code execution in kernel context. No public exploit identified at time of analysis, and EPSS is low (0.16%).
In the Linux kernel, the following vulnerability has been resolved: mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). syzbot reported divide-by-zero in __tcp_select_window() by MPTCP socket. [0] We had a similar issue for the bare TCP and fixed in commit 499350a5a6e7 ("tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0"). Let's apply the same fix to mptcp_do_fastclose(). [0]: Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 6068 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:__tcp_select_window+0x824/0x1320 net/ipv4/tcp_output.c:3336 Code: ff ff ff 44 89 f1 d3 e0 89 c1 f7 d1 41 01 cc 41 21 c4 e9 a9 00 00 00 e8 ca 49 01 f8 e9 9c 00 00 00 e8 c0 49 01 f8 44 89 e0 99 <f7> 7c 24 1c 41 29 d4 48 bb 00 00 00 00 00 fc ff df e9 80 00 00 00 RSP: 0018:ffffc90003017640 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88807b469e40 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003017730 R08: ffff888033268143 R09: 1ffff1100664d028 R10: dffffc0000000000 R11: ffffed100664d029 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 000055557faa0500(0000) GS:ffff888126135000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f64a1912ff8 CR3: 0000000072122000 CR4: 00000000003526f0 Call Trace: <TASK> tcp_select_window net/ipv4/tcp_output.c:281 [inline] __tcp_transmit_skb+0xbc7/0x3aa0 net/ipv4/tcp_output.c:1568 tcp_transmit_skb net/ipv4/tcp_output.c:1649 [inline] tcp_send_active_reset+0x2d1/0x5b0 net/ipv4/tcp_output.c:3836 mptcp_do_fastclose+0x27e/0x380 net/mptcp/protocol.c:2793 mptcp_disconnect+0x238/0x710 net/mptcp/protocol.c:3253 mptcp_sendmsg_fastopen+0x2f8/0x580 net/mptcp/protocol.c:1776 mptcp_sendmsg+0x1774/0x1980 net/mptcp/protocol.c:1855 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0xe5/0x270 net/socket.c:742 __sys_sendto+0x3bd/0x520 net/socket.c:2244 __do_sys_sendto net/socket.c:2251 [inline] __se_sys_sendto net/socket.c:2247 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2247 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f66e998f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffff9acedb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f66e9be5fa0 RCX: 00007f66e998f749 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007ffff9acee10 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007f66e9be5fa0 R14: 00007f66e9be5fa0 R15: 0000000000000006 </TASK>
Denial of service in the Linux kernel's AMD GPU display driver (amdgpu drm/amd/display) allows a local user to crash the system via a NULL pointer dereference in dc_stream_get_scanoutpos(). The flaw triggers during concurrent atomic modeset and cursor operations - reproducible with the IGT kms_cursor_legacy 'long-nonblocking-modeset-vs-cursor-atomic' test when both an eDP panel and a DP monitor are connected. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and this is not in CISA KEV.
Use-after-free in the Linux kernel's libceph client (the in-kernel Ceph transport shared by CephFS and RBD) lets the mount-time wait loop in __ceph_open_session() read a monmap or osdmap structure after a worker thread has freed and replaced it. The flaw is a race between a mounting task polling have_mon_and_osd_map() without locks and ceph_monc_handle_map()/handle_one_map() swapping in a fresh map under their respective locks, producing a KASAN slab-use-after-free (reproducible with xfstests generic/395 and generic/397). There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is very low at 0.18% (8th percentile).
Out-of-bounds kernel memory write in the Linux kernel's libceph client (handle_auth_session_key) allows a malicious or compromised Ceph server to corrupt kernel memory when a client decrypts the connection secret or processes CephX service tickets. The attacker-controlled 'len' field from network packets was used without boundary checks, enabling potential kernel memory corruption and code execution against any host mounting Ceph/RBD storage. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.18%, 8th percentile).
Remote denial-of-service in the Linux kernel's libceph (Ceph client) module allows a malicious or compromised Ceph OSD/monitor to crash the kernel by sending OSDMap packets containing out-of-bounds OSD indexes. Because libceph previously used BUG_ON assertions on OSD index values drawn directly from untrusted network data, an attacker-controlled index exceeding map->max_osd triggers a kernel panic. This is a fixed issue with upstream stable-tree commits; no public exploit has been identified and EPSS exploitation probability is low (0.17%, 7th percentile).
In the Linux kernel, the following vulnerability has been resolved: bfs: Reconstruct file type when loading from disk syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted or when the 32bits "attributes" field loaded from disk are corrupted. A documentation says that BFS uses only lower 9 bits of the "mode" field. But I can't find an explicit explanation that the unused upper 23 bits (especially, the S_IFMT bits) are initialized with 0. Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk. Also, verify that the value of the "attributes" field loaded from disk is either BFS_VREG or BFS_VDIR (because BFS supports only regular files and the root directory).
Local privilege escalation and memory corruption in the Linux kernel's NVMe driver arises from a use-after-free in admin request_queue lifetime management, where namespaces retain stale references to a controller's admin request_queue that can be dereferenced after the controller is torn down. Confirmed via a KASAN slab-use-after-free report in blk_queue_enter() triggered through an nvme ioctl (nvme_submit_user_cmd), the flaw affects hosts running NVMe storage and is fixed upstream by reordering the controller 'put' until after all references are released. EPSS is very low (0.03%, 7th percentile) and there is no public exploit identified at time of analysis; exploitation requires local access and a race against controller teardown.
In the Linux kernel, the following vulnerability has been resolved: ext4: refresh inline data size before write operations The cached ei->i_inline_size can become stale between the initial size check and when ext4_update_inline_data()/ext4_create_inline_data() use it. Although ext4_get_max_inline_size() reads the correct value at the time of the check, concurrent xattr operations can modify i_inline_size before ext4_write_lock_xattr() is acquired. This causes ext4_update_inline_data() and ext4_create_inline_data() to work with stale capacity values, leading to a BUG_ON() crash in ext4_write_inline_data(): kernel BUG at fs/ext4/inline.c:1331! BUG_ON(pos + len > EXT4_I(inode)->i_inline_size); The race window: 1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct) 2. Size check passes for 50-byte write 3. [Another thread adds xattr, i_inline_size changes to 40] 4. ext4_write_lock_xattr() acquires lock 5. ext4_update_inline_data() uses stale i_inline_size = 60 6. Attempts to write 50 bytes but only 40 bytes actually available 7. BUG_ON() triggers Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock() immediately after acquiring xattr_sem. This ensures ext4_update_inline_data() and ext4_create_inline_data() work with current values that are protected from concurrent modifications. This is similar to commit a54c4613dac1 ("ext4: fix race writing to an inline_data file while its xattrs are changing") which fixed i_inline_off staleness. This patch addresses the related i_inline_size staleness issue.
Use-after-free in Linux ksmbd IPC handler allows remote unauthenticated attackers to trigger memory corruption via race condition in generic netlink reply processing. The flaw (CVSS 9.8 critical, network-reachable) affects ksmbd's ipc_msg_send_request() function where concurrent access to response buffers occurs without proper locking. EPSS data not provided; no CISA KEV listing identified at time of analysis. Multiple upstream kernel commits available across stable branches indicate vendor-released patches exist.
Local denial-of-service in the Linux kernel ext4 filesystem allows a low-privileged user to crash the system by racing inline-data destruction against block mapping. The function ext4_destroy_inline_data_nolock() flips an inode from EXT4_INODE_INLINE_DATA to EXT4_INODE_EXTENTS without holding i_data_sem, so a concurrent ext4_map_blocks() can enter ext4_ind_map_blocks() on an inode that already advertises extents, tripping a BUG_ON at fs/ext4/indirect.c:546 and panicking the kernel. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and the flaw is availability-only (kernel oops), not information disclosure despite the input tag.
Local privilege escalation potential in the Linux kernel's experimental Rust Binder driver (rust_binder) arises from a race condition on a node's death_list where NodeDeath entries can be concurrently manipulated. During Node::release the driver moves death entries to a stack-local list while other threads call an unsafe remove() on the original list, corrupting the prev/next pointers and producing kernel memory corruption (observed as a paging-request Oops on ARM64 Android 6.12 kernels). No public exploit has been identified and EPSS is low (0.20%), but the flaw yields high confidentiality, integrity, and availability impact if a local attacker wins the race.
Denial of service and out-of-bounds memory read in the Linux kernel's staging rtl8723bs Realtek Wi-Fi driver allows an attacker within radio range to crash or hang a vulnerable device by transmitting a malformed 802.11 frame. The rtw_get_ie() Information Element parser trusted the attacker-supplied IE length byte without bounds-checking, so a crafted length can push the parser past the frame buffer, producing OOB reads or an infinite loop. No public exploit is identified at time of analysis (EPSS 0.07%, 21st percentile) and the issue is not in CISA KEV; it has been fixed upstream and shipped in Ubuntu security updates.
Adjacent-network stack buffer overflow in the Linux kernel's rtl8723bs staging Wi-Fi driver lets a nearby malicious station corrupt kernel stack memory by sending a crafted 802.11 Association Request. The OnAssocReq handler copied the Supported Rates IE into a fixed 16-byte stack buffer using the attacker-controlled IE length without bounds checking, enabling denial of service and potentially kernel code execution. Rated CVSS 8.8; no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with an unauthenticated but proximity-limited radio attack.
Out-of-bounds read in the Linux kernel's staging rtl8723bs Realtek Wi-Fi driver allows an adjacent attacker to trigger a kernel panic by broadcasting a malformed 802.11 beacon frame. The OnBeacon handler parses an Extended Supported Rates (ESR) information element positioned at the end of the received frame buffer without bounds validation, reading past the buffer. No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.17%), but the flaw is remotely reachable over the air against any device using this driver.
Spurious kernel warnings in the Linux kernel hung_task blocker-tracking mechanism arise on architectures that align 32-bit values on 2-byte boundaries (e.g., m68k), where the code incorrectly assumes lock pointers are always 4-byte aligned so it can pack a type tag into the lower two pointer bits. The mismatch trips two WARN_ON_ONCE checks; the fix silently ignores non-4-byte-aligned locks, disabling the feature on those platforms. This is an internal kernel robustness fix rather than a remotely reachable attack primitive, with no public exploit identified at time of analysis and a low EPSS score of 0.15% (5th percentile).
Remote unauthenticated denial of service in the Linux kernel's ksmbd in-kernel SMB server allows an attacker to exhaust kernel socket resources by repeatedly tripping the per-IP connection limit. When ksmbd_kthread_fn() rejects a connection that exceeds the per-IP limit, it sets ret = -EAGAIN and continues the accept loop without releasing the just-accepted socket, leaking one socket per rejected attempt from a single source IP. This is a resource-leak DoS with no public exploit identified at time of analysis and a low EPSS score (0.16%, 6th percentile).
Client-identity confusion in the Linux kernel's NFS client allows a low-privileged local user to have an NFS mount silently reuse an existing RPC connection established under a different TLS X.509 client certificate. Because nfs_match_client() failed to compare the cert_serial and privkey_serial fields that define the client's presented identity, a mount intended to use one certificate could be bound to a connection authenticated with another, enabling access to data under the wrong identity. This is an information-disclosure/identity-mismatch flaw (CVSS 7.0); it is not in CISA KEV, has no public exploit identified at time of analysis, and carries a very low EPSS score of 0.10% (1st percentile).
Denial of service in the Linux kernel IPv4 routing subsystem allows a permanent device reference-count leak through a race condition in FIB next-hop exception (fnhe) handling. On systems using tunnel drivers such as sit or gretap, concurrent transmit paths can bind a soon-to-be-freed fnhe to a new dst, leaking the dst and its device reference so the interface can never be unregistered (visible as 'unregister_netdevice: waiting for sitX to become free'). This is availability-only, has no public exploit identified at time of analysis, and carries a low EPSS score of 0.17%.
Linux kernel binfmt_misc module fails to restore write access to executable files when error handling closes improperly opened file descriptors, potentially causing subsequent write operations on the same file to fail and creating a denial-of-service condition for legitimate file modifications. The vulnerability affects the bm_register_write() function which uses open_exec() to open executable files with intentionally denied write permissions, but does not call exe_file_allow_write_access() before closing the file on error paths. With an EPSS score of 0.03% (8th percentile), this represents a low exploitation probability; no public exploit has been identified at time of analysis.
Local privilege-relevant memory corruption in the Linux kernel's io_uring cmd_net timestamp-retrieval path arises from transposed arguments to skb_queue_splice(), causing SKBs to be spliced in the wrong direction between the socket queue and an on-stack list. Any local user able to issue io_uring network commands with timestamp retrieval could trigger the flawed splice, potentially leading to information disclosure (per source tagging) or broader list/memory corruption. There is no public exploit identified at time of analysis and EPSS is low (0.15%), so this is a code-quality/security hardening fix rather than an actively exploited threat.
Denial of service in the Linux kernel's veth (virtual Ethernet) driver allows a permanently stalled transmit queue and halted network traffic once a lost-wakeup race is triggered under load. The flaw is a regression introduced by commit dc82a33297fc ('veth: apply qdisc backpressure on full ptr_ring'), where the producer in veth_xmit() misuses the __ptr_ring_empty() API to decide whether to re-wake a stopped TXQ; when a consumer on another CPU empties the ring concurrently, the wakeup is lost and the queue stays in QUEUE_STATE_DRV_XOFF. It was observed in production on ARM64 (Ampere Altra Max) systems. There is no public exploit identified at time of analysis, EPSS is low (0.16%), and it is not in CISA KEV.
Use-after-free in the Linux kernel's SMB/CIFS client (cifs module) arises from an incomplete backport of commit bdb596ceb4b7, which left a stale kref_put() call in cfids_invalidation_worker() instead of converting it to close_cached_dir(). The flaw affects the cached-directory (cfid) invalidation path used when a Linux system mounts remote SMB shares, and with a CVSS of 8.8 (C:H/I:H/A:H) could allow memory corruption leading to information disclosure or code execution. There is no public exploit identified at time of analysis and the EPSS probability is low (0.15%).
Denial of service in the Linux kernel's NVMe multipath subsystem allows a lockdep-detected deadlock among disk->open_mutex, the kblockd workqueue, and partition_scan_work completion, which can hang block-device operations. The fix moves partition_scan_work off the kblockd workqueue onto nvme_wq to break the lock-dependency cycle. No public exploit identified at time of analysis; the issue surfaces intermittently during NVMe partition scanning on systems using NVMe multipath.
Improper resource cleanup in the Linux kernel's Intel ice Ethernet driver leaves PTP (Precision Time Protocol) resources leaked when driver probe, PTP initialization, or PTP restart hits an error path. On subsequent driver removal the leaked PF PTP state and un-deinitialized 'ps_lock' mutex trigger a kernel WARNING in ice_adapter_put, and the PTP clock is left registered. No public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and there is no CISA KEV listing; this is a robustness/error-handling defect requiring local privileged access to the NIC driver.
Local privilege-level information disclosure and memory corruption in the Linux kernel's VFS statmount() implementation arises from an uninitialized output-offset pointer ('offp') in statmount_string(). When a caller requests the STATMOUNT_MNT_UIDMAP or STATMOUNT_MNT_GIDMAP fields, those code paths write directly to the struct fields and never assign 'offp', so a later dereference of the uninitialized pointer can leak kernel memory or corrupt state. The CVSS 3.1 vector (AV:L/PR:L) indicates a local, low-privileged attacker is required; there is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile).
Out-of-bounds memory access in the Linux kernel's eBPF verifier (widen_imprecise_scalars()) allows a local actor able to load eBPF programs to read or corrupt kernel memory beyond the bpf_verifier_state stack array. The flaw arises because the verifier assumed an ancestor state (prev_st) shares the same allocated_stack depth as a newly queued state (queued_st), which is false when the same callsite is invoked with differently sized stack frames. No public exploit has been identified at time of analysis; EPSS risk is low (0.17%, 7th percentile) and the issue has been resolved upstream.
Local privilege escalation and memory corruption in the Linux kernel's Intel Xe GPU driver (drm/xe/guc) arises from a use-after-free race during device unbind: the GuC 'Dead CT' worker is not synchronized with the unbind path, so it can access GuC communication-transport resources after they have already been freed. Exploitation requires local access with low privileges (CVSS 7.8, AV:L/PR:L) and can result in high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the low EPSS (0.17%) reflects the niche, timing-dependent nature of the flaw.
Denial of service in the Linux kernel's netfilter nftables connection-tracking (nft_ct) code allows disruption of FTP passive-mode (PASV/EPSV) sessions on hosts acting as NAT gateways. When an nftables FTP conntrack helper is assigned to a connection that already has a NAT binding (helper set after DNAT), the required nfct_seqadj sequence-adjustment extension is never allocated, so the FTP payload mangling path hits a kernel WARNING and tears down the control connection ("Service not available, remote server has closed connection"); on kernels built with panic_on_warn this escalates to a full crash. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%), and it is not in CISA KEV.
Out-of-bounds memory access in the Linux kernel's AMD CPU microcode-matching logic affects systems running on AMD Zen5 processors, where the zen5_rdseed_microcode revision table lacks a terminating sentinel entry. When x86_match_min_microcode_rev() iterates this array during CPU initialization on a Zen5 part, it reads past the array bounds, tripping KASAN and potentially disclosing adjacent kernel memory or causing instability. No public exploit identified at time of analysis, and EPSS risk is low (0.16%, 6th percentile).
Kernel panic (denial of service) in the Linux kernel's qmi_wwan USB WWAN driver occurs because qmimux_rx_fixup() leaves skb->mac_header uninitialized for raw-IP packets that have no MAC header; on ARM64, strict-alignment access to that offset by xfrm/IPsec crashes the machine. The flaw is reachable when IPsec (ESP) traffic is received over a qmimux0 multiplexed interface, as shown by the provided oops in xfrm_input(). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), consistent with a config-specific crash rather than broad remote code execution.
Improper GEM object cleanup in the Linux kernel's drm/msm (Qualcomm Adreno) graphics driver mishandles imported dma-bufs, because the free path only checked object flags without accounting for imported buffers whose reservation object differs from the embedded default. A local user with DRM/GPU access can trigger the faulty path (reproduced during hardware-accelerated IRIS video playback under GNOME Shell) by closing a GEM handle backed by an imported dma-buf, producing a kernel WARNING at msm_gem.c:1127 and potential incorrect reservation-object handling during buffer teardown. There is no public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and this is not on CISA KEV.
Broken AFBC (Arm Frame Buffer Compression) handling in the Linux kernel's Mediatek DRM driver on MT8188 (Genio 700) SoCs causes constant vblank timeouts and garbled display output when the 32x8/split/sparse AFBC modifier is used, which Mesa v25.0+ enables by default. A local user with GPU/display access can trigger a hung display pipeline (denial of service) and rendering of stale/garbled framebuffer contents (limited information disclosure). No public exploit identified at time of analysis, and EPSS is very low (0.17%, 7th percentile), consistent with a hardware-specific reliability bug rather than a widely weaponizable flaw.
Integrity protection weakening in the Linux kernel's IMA (Integrity Measurement Architecture) subsystem allows a stored IMA file signature to be silently downgraded to a plain IMA hash. When IMA and EVM run in fix mode (e.g. booting with 'ima_appraise=fix evm=fix ima_policy=appraise_tcb'), the kernel incorrectly clears the IMA_DIGSIG flag whenever a non-IMA security xattr (such as security.selinux or security.evm) or an ACL is set or removed after security.ima was written, so on file close a hash is generated instead of preserving the intended signature. A full C reproducer is embedded in the report, but there is no CISA KEV listing and no public weaponized exploit identified at time of analysis; EPSS is 0.17% (7th percentile).
Memory corruption (use-after-free) in the Linux kernel's Intel iwlwifi wireless driver, specifically in iwl_mld_remove_link(), where the code frees the 'link' object via kfree_rcu() and then dereferences it to read link->fw_id. On systems with Intel WiFi hardware using the newer MLD (multi-link device) code path, a triggered link-removal race can access freed memory, most likely crashing the kernel (denial of service) with only a theoretical path to further corruption. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS probability is low (0.16%, 6th percentile).
Local privilege-escalation-class use-after-free in the Linux kernel's radeon (AMD GPU) DRM driver, triggered on the probe-error and device-removal paths. After the driver switched its main structure to devm_drm_dev_alloc(), the leftover drm_put_dev() calls cause devres to release the already-freed device a second time, producing a refcount underflow ('refcount_t: underflow; use-after-free') and dangling reference. No public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and the issue is not listed in CISA KEV.
Kernel crashes and memory corruption in the Linux kernel on IBM s390/s390x systems occur when the HugeTLB Vmemmap Optimization (HVO) feature is enabled, because s390 architecture rules forbid overwriting an active/valid page table entry with another valid entry without first invalidating it, and the HVO path modifies kernel page tables without a compliant TLB flush. The upstream fix disables ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP on s390, effectively reverting the patch that enabled it. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is tagged as a Denial of Service issue rather than an exploitation primitive.
Local denial-of-service (and potential memory corruption) in the Linux kernel's NXP i.MX8 ISI media capture driver (imx8-isi) allows a low-privileged user with access to an ISI /dev/videoX device to trigger a WARNING and driver error state by simply querying device controls while a capture stream is active. The flaw stems from mxc_isi_video_release() unconditionally tearing down streaming state, so any release call (e.g. from `v4l2-ctl -l`) can free a queue that is still streaming. No public exploit is identified at time of analysis and EPSS risk is negligible (0.03%), though a deterministic crash-reproduction recipe is published in the fix commit.
Local denial-of-service (and potential memory corruption) in the AMD amdkfd (Kernel Fusion Driver) component of the Linux kernel arises from a race between GPU compute-partition switching and asynchronous KFD process teardown. Because the driver's partition-switch path only checks whether the kfd_processes_table is empty - while the actual kfd_process teardown runs later in the kfd_process_wq workqueue - a partition switch can free kfd_node structures still being accessed by an in-flight release, producing a divide-by-zero kernel oops (observed in kfd_get_num_sdma_engines). No public exploit identified at time of analysis, EPSS is low (0.16%), and it is not listed in CISA KEV.
Cross-task FPU state leakage in the Linux kernel x86 XFD (Extended Feature Disable) handling allows a local low-privileged task to trigger an inconsistent AMX/dynamic-feature register state during signal delivery. When a non-AMX task is preempted by an AMX-enabled task that changes the XFD MSR, fpu__clear_user_states() failed to re-synchronize XFD, producing a state mismatch (kernel WARNING) and potential exposure of dynamic FPU register contents. Tagged as an information-disclosure issue; no public exploit identified at time of analysis and EPSS is low (0.17%, 7th percentile).
Kernel memory corruption in the Linux drm/radeon GPU driver occurs because the driver calls kfree() on the rdev main structure that is now managed by devres (via devm_drm_dev_alloc()), causing a double-free when the driver probe fails and devres later cleans up the already-freed allocation. Local users on systems with AMD/ATI Radeon hardware may trigger memory corruption during a failed driver probe, most directly resulting in a kernel crash. There is no public exploit identified at time of analysis, and the EPSS score is low (0.17%, 7th percentile), consistent with an error-path bug rather than a broadly exploitable flaw.
Denial-of-service in the Linux kernel JFS filesystem driver lets a local low-privileged actor crash the system by mounting a JFS volume read-only. Because txInit() started its waitqueue-initialization loop at index 1, TxBlock[0].waitor is left uninitialized; a read-only mount returns tid=0 and the subsequent txEnd(0) dereferences that uninitialized waitqueue, triggering a lockdep 'non-static key' warning and a kernel crash. EPSS is low (0.18%, 8th percentile), there is no public exploit identified at time of analysis, and it is not in CISA KEV - impact is a crash rather than code execution.
Denial-of-service via invalid pointer access exists in the Linux kernel gpiolib debugfs interface, where a failed memory allocation in gpiolib_seq_start() leaves s->private uninitialized and later dereferenced in gpiolib_seq_stop(), crashing the kernel. The flaw affects systems exposing the GPIO debugfs seq_file (/sys/kernel/debug/gpio) and is triggerable only under memory-allocation failure. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and it is not on CISA KEV.
Authorization bypass in the Linux kernel CephFS client (ceph module) lets an authenticated Ceph user exercise MDS auth capabilities granted for one filesystem against a different filesystem in a multi-filesystem (multifs) Ceph cluster. Because the kernel client failed to validate the fsname alongside the associated caps, a user holding read-only rights on 'fsname1' but read-write rights on 'fsname2' would incorrectly gain read-write on 'fsname1', enabling file creation and deletion they should not be permitted. No public exploit identified at time of analysis, and the EPSS score is low (0.25%, 16th percentile), consistent with a specialized storage-cluster condition rather than mass exploitation.
Out-of-bounds memory access in the RISC-V stack unwinder (walk_stackframe) of the Linux kernel lets KASAN trip and read past a task's kernel stack boundary when unwinding a task other than the current one. The defect mirrors a previously fixed x86 issue (commit 84936118bdf3) and is reached through normal task-introspection paths on RISC-V builds. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.03%, 7th percentile), and it is not in CISA KEV; the fix disables KASAN checks for non-current tasks.
Local privilege-relevant memory corruption/disclosure risk exists in the Linux kernel's Rockchip SFC (Serial Flash Controller) SPI driver (spi-rockchip-sfc), where improper DMA-API usage - deriving DMA addresses via virt_to_phys() instead of dma_map_single() - causes the driver to sync DMA memory it never properly mapped. On affected Rockchip-based systems (e.g. ODROID-M1), this triggers a DMA-API debug warning and reflects an underlying unsafe memory-transfer path during SPI-NOR flash operations. No public exploit identified at time of analysis; EPSS probability is low (0.16%, 6th percentile).
Kernel memory corruption in the Linux kernel's AMD Display (amdgpu/DC) driver stems from an undersized dc->links[MAX_LINKS] array and an unchecked link->enc pointer, letting a local attacker on AMD-GPU systems trigger an out-of-bounds access and NULL-pointer dereference during hw_init() for DisplayPort-over-USB4 (DPIA) endpoints. Rated CVSS 7.8 (AV:L/PR:L) and tagged as denial-of-service, it most realistically causes a kernel crash. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.17% (7th percentile).
Memory mishandling in the Linux kernel's mlx5e (NVIDIA/Mellanox ConnectX) RX path lets a loaded XDP program corrupt skb generation on striding RQ, causing kernel warnings, a BUG_ON crash, or erroneous packet buffers. The flaw affects systems using mlx5 NICs where a multi-buffer XDP program calls bpf_xdp_adjust_head() or bpf_xdp_adjust_tail() to change the xdp_buff layout, which the driver wrongly assumed was static. This is a resolved upstream kernel fix with no public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and it is not in CISA KEV.
Out-of-bounds read in the Linux kernel HFS+ (hfsplus) filesystem driver allows a local attacker to crash the kernel via a crafted HFS+ B-tree node whose record offset or length in hfsplus_bmap_alloc exceeds node_size, causing access beyond the node's allocated pages. The flaw is reached during node allocation (hfs_btree_inc_height → hfsplus_brec_insert) when writing to files on a malicious HFS+ image, with KASAN confirming a slab-out-of-bounds read. Reported as a denial-of-service issue with a low EPSS score (0.18%, 8th percentile); no public exploit identified at time of analysis and it is not in CISA KEV.
Denial of service in the Linux kernel's NXP ENETC Ethernet driver (enetc) on Layerscape LS1028A platforms allows the CPU to hang under normal network load, causing RCU stalls on PREEMPT_RT kernels. The flaw stems from recursive acquisition of the read-side enetc_mdio_lock in the enetc_poll NAPI path, which deadlocks when a higher-priority writer is queued between two reader acquisitions. No public exploit identified at time of analysis; EPSS is very low (0.03%, 8th percentile) and it is not CISA KEV listed, consistent with a reliability/self-triggered availability bug rather than an attacker-weaponized flaw.
Physical access to SolarEdge SE3680H solar inverters allows privilege escalation, remote code execution, and information disclosure through unpatched Linux kernel vulnerabilities. Reported by DIVD CSIRT, this affects SE3680H firmware running outdated kernel subsystems. While CVSS 4.0 scores 7.0 with physical attack vector (AV:P), the presence of RCE and privilege escalation tags indicates high impact once physical proximity is achieved. No EPSS score, KEV listing, or public exploit identified at time of analysis, suggesting limited current exploitation risk for typical deployment scenarios.
A slab use-after-free in the Linux kernel's Intel AVS (Audio Voice Speech / Smart Sound Technology) ASoC driver lets a local user with access to a HOST HDAudio PCM stream corrupt kernel memory by racing PCM close against period-elapsed IRQ work. When avs_dai_fe_shutdown() frees the DAI's private context while the period-elapsed work is still servicing interrupts, the freed structure can be accessed concurrently, yielding a use-after-free with high confidentiality, integrity and availability impact (CVSS 7.8, AV:L). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.20%, 10th percentile), reflecting the local-only, hardware-specific nature of the flaw.
Denial-of-service (kernel use-after-free/double-free) in the Linux kernel's nvmet-fc NVMe-over-Fibre-Channel target driver allows a local privileged operator to crash the kernel by forcibly shutting down an NVMe target port via configfs. When a port is torn down, nvmet_port_subsys_drop_link() calls both nvmet_port_del_ctrls() and nvmet_disable_port(), each of which can schedule the same association-deletion work item; the first run frees all resources and the second reuses freed memory. This is a fix already merged upstream in the stable trees, with no public exploit identified at time of analysis and a low EPSS score (0.21%, 11th percentile).
Denial of service and potential memory corruption in the Linux kernel's NVMe over Fibre Channel (nvme-fc) transport arises because nvme_fc_create_association reads the remote port_state and increments the rport active count without holding a lock, racing against nvme_fc_unregister_remote which can free the remote port when no active association exists. An attacker or fault condition on the FC fabric able to trigger reconnect events concurrently with port teardown can drive a use-after-free style condition on the rport object. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile).
Data-integrity corruption in the Linux kernel's stmmac (Synopsys DesignWare/STMMAC) Ethernet driver allows malformed packets that failed hardware checksum validation to be accepted as valid by the network stack. When hardware checksum offload (CoE) is enabled, the Rx path marked known IP-ethertype frames as CHECKSUM_UNNECESSARY without honoring the hardware's reported header/payload checksum error, so corrupt frames bypass the stack's own validation. There is no public exploit identified at time of analysis, KEV status is not listed, and EPSS is low (0.20%, 11th percentile).
Local privilege-escalation and memory-disclosure flaw in the Linux kernel's DRM GPU SVM (Shared Virtual Memory) subsystem, where incorrect use of hmm_pfn_to_map_order() mishandles an HMM range that only partially covers a huge page (e.g. 2MB), causing the driver to map physical memory outside the intended range - memory that may not even belong to the faulting process's address space. Affecting recent kernels carrying the drm/gpusvm code (associated with the Intel Xe GPU driver's userptr/SVM path), a local user with GPU access can trigger cross-boundary mappings leading to information disclosure or memory corruption. There is no public exploit identified at time of analysis, and EPSS is low at 0.19% (9th percentile).
Local memory-safety flaw in the Linux kernel's AMD GPU (amdgpu) driver allows an authenticated local user to submit a user queue (userq) whose buffer virtual address and size are not validated against a legitimate VM mapping. Because the driver failed to confirm the userq object resides in a valid GPU virtual-memory mapping before use, a low-privileged process with GPU device access could reference out-of-bounds or unmapped memory, tagged as an information-disclosure issue with additional integrity and availability impact. No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile), consistent with a local-only kernel driver bug rather than a mass-exploited network flaw.
BPF test infrastructure in the Linux kernel allows a local user with BPF program execution privileges to emit packets with malformed GSO (Generic Segmentation Offload) metadata to the network stack via bpf_clone_redirect(), triggering skb_warn_bad_offload() and disabling GSO-related offload features - a denial-of-service condition. The root cause is convert___skb_to_skb() populating gso_segs and gso_size without a corresponding gso_type, producing an internally inconsistent socket buffer that fails GSO validation in netif_skb_features(). No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the issue was originally surfaced through fuzzing by Yinhao et al. Patches across six stable kernel branches have been released.
Memory corruption in the Linux kernel's asymmetric_keys crypto subsystem allows a local low-privileged user to trigger a heap buffer overflow by supplying a crafted X.509 certificate. The flaw lives in asymmetric_key_generate_id(), where the sizes of attacker-controlled binary blobs (such as arbitrarily large ASN.1 INTEGER serial numbers and issuer names) are added to the size of an asymmetric_key_id structure without overflow checking, so an integer overflow yields an undersized allocation and a subsequent out-of-bounds copy. No public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile).
Local denial of service in the Linux kernel's software RDMA driver (RDMA/rxe, rdma_rxe module) allows a user with access to an rxe device to crash the host via a NULL pointer dereference. When ibv_modify_srq() is called to resize a shared receive queue and rxe_queue_resize() fails, rxe_srq_from_attr() leaves srq->rq.queue set to NULL; a subsequent modify call dereferences srq->rq.queue->buf->index_mask in rxe_srq_chk_attr() and panics. No public exploit identified at time of analysis, and the EPSS score is low (0.16%, 6th percentile).
In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix device resources accessed after device removal Correct possible race conditions during device removal. Previously, a scheduled work item to reset a LUN could still execute after the device was removed, leading to use-after-free and other resource access issues. This race condition occurs because the abort handler may schedule a LUN reset concurrently with device removal via sdev_destroy(), leading to use-after-free and improper access to freed resources. - Check in the device reset handler if the device is still present in the controller's SCSI device list before running; if not, the reset is skipped. - Cancel any pending TMF work that has not started in sdev_destroy(). - Ensure device freeing in sdev_destroy() is done while holding the LUN reset mutex to avoid races with ongoing resets.
Local privilege-limited denial of service in the Linux kernel's CoreSight TMC (Trace Memory Controller) driver allows a user with performance-monitoring access to trigger a kernel oops via an invalid pointer dereference in tmc_etr_get_buffer(). The flaw occurs because the perf event handle was not attached to the coresight_path, so dependent devices such as the CATU could not retrieve the per-CPU AUX_EVENT during path enablement. It is reproducible with a standard perf record command against CoreSight ETM tracing; there is no public exploit identified at time of analysis and EPSS is low (0.16%).
Denial of service in the Linux kernel's ntfs3 filesystem driver stems from a run_lock rwsem that is never initialized when the special $Extend metadata inode is loaded. When $Extend's inode mode is set to a regular file, a truncate() call reaches ntfs_set_size() and acquires the uninitialized lock, tripping lockdep and risking kernel instability. The regression was introduced by commit 4e8011ffec79 and was found via syzbot fuzzing; no public exploit identified at time of analysis, and EPSS is low at 0.17%.
Uninitialized memory use in the Linux kernel NTFS3 filesystem driver (fs/ntfs3) enables a local low-privileged user to trigger a kernel crash, causing a denial of service. The `__getname()` function allocates slab memory via `kmem_cache_alloc()` without zeroing it; `ntfs_read_hdr` and `bcmp` then operate on this indeterminate data, as detected by KMSAN. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.18% at the 7th percentile reflects very low real-world exploitation probability. Upstream patches are available across multiple stable kernel branches.
In the Linux kernel, the following vulnerability has been resolved: bpf: Check skb->transport_header is set in bpf_skb_check_mtu The bpf_skb_check_mtu helper needs to use skb->transport_header when the BPF_MTU_CHK_SEGS flag is used: bpf_skb_check_mtu(skb, ifindex, &mtu_len, 0, BPF_MTU_CHK_SEGS) The transport_header is not always set. There is a WARN_ON_ONCE report when CONFIG_DEBUG_NET is enabled + skb->gso_size is set + bpf_prog_test_run is used: WARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071 skb_gso_validate_network_len bpf_skb_check_mtu bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch bpf_test_run bpf_prog_test_run_skb For a normal ingress skb (not test_run), skb_reset_transport_header is performed but there is plan to avoid setting it as described in commit 2170a1f09148 ("net: no longer reset transport_header in __netif_receive_skb_core()"). This patch fixes the bpf helper by checking skb_transport_header_was_set(). The check is done just before skb->transport_header is used, to avoid breaking the existing bpf prog. The WARN_ON_ONCE is limited to bpf_prog_test_run, so targeting bpf-next.
Denial of service in the Linux kernel's mt76 wireless driver (MT7996 WiFi 7 support) allows the kernel to crash (NULL/invalid pointer dereference) when hardware-accelerated flow offloading runs on a secondary Wireless Ethernet Dispatch instance (wed_hif2, e.g. a 6GHz link). The mt76 WED callbacks unconditionally referenced the primary wed device, so tearing down or disabling offload on wed_hif2 dereferences an invalid address and triggers a kernel Oops. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%, 8th percentile), and it is not in CISA KEV; impact is availability loss (system crash), not code execution.
Memory corruption (double free) in the Linux kernel btrfs filesystem's quota group (qgroup) accounting affects the add_delayed_ref_head() code path when a qgroup record is reported as already existing but a subsequent error occurs, causing both caller and callee to free the same 'qrecord' object. The flaw is a local btrfs-triggered condition on systems using btrfs with quota groups; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, with a very low EPSS of 0.17%. Despite an automated CVSS of 9.8, the realistic attack surface is local to the machine and gated by a hard-to-reach error path.
Linux kernel iomap subsystem fails to allocate the s_dio_done_wq workqueue for asynchronous read operations, causing read error completions deferred by commit 222f2c7c6d14 to lack proper execution context and potentially leading to information disclosure or system instability. The vulnerability affects Linux kernel versions where the read error completion deferral was implemented without corresponding workqueue allocation for async reads. With an EPSS score of 0.01% and no evidence of active exploitation, this is a low-probability but correctness-critical issue affecting async I/O error handling on affected kernel versions.
Out-of-bounds memory access in the Linux kernel's ch341 SPI driver (drivers/spi/spi-ch341) allows a local low-privileged actor to trigger heap buffer overreads and overwrites during SPI transfers on systems using a WCH CH341 USB-to-SPI bridge. The flaw stems from ch341_transfer_one copying 'len' bytes (which includes a 1-byte command header) instead of 'len - 1' from the user-supplied transfer buffer, causing both an out-of-bounds read from trans->tx_buf and, when len equals the 32-byte packet length, a 1-byte overflow of ch341->tx_buf. EPSS is low at 0.18% and there is no public exploit identified at time of analysis, consistent with a niche hardware-dependent kernel driver rather than a widely exploited target.
Denial of service in the Linux kernel's NFSv4/pNFS client allows a null-pointer dereference and system crash during inode writeback, affecting hosts mounting parallel-NFS (pNFS) exports. The flaw occurs because NFS_INO_LAYOUTCOMMIT was not cleared in pnfs_mark_layout_stateid_invalid, so the write_inode → nfs4_write_inode → pnfs_layoutcommit_inode path may dereference a layout that has already been freed. There is no public exploit identified at time of analysis, and the low EPSS score (0.18%) indicates minimal observed exploitation interest despite the CVSS 7.5 rating.
Local memory corruption in the Linux kernel's ALSA firewire-motu driver allows a user to trigger a buffer overflow when reading DSP events from the hwdep interface with an undersized buffer. The hwdep_read() path copied the full 8-byte DSP event header regardless of the caller-supplied buffer length, writing past the end of the user-provided buffer; the fix clamps the copy with min_t(). There is no public exploit identified at time of analysis, and EPSS is low (0.20%), consistent with a niche driver requiring MOTU FireWire audio hardware.
In the Linux kernel, the following vulnerability has been resolved: arm64: mm: fix VA-range sanity check Both create_mapping_noalloc() and update_mapping_prot() sanity-check their 'virt' parameter,. No vendor patch available.
A command injection vulnerability in Coolify's Database Import functionality allows authenticated users with application/service management permissions to execute arbitrary system commands as root on managed servers. The vulnerability stems from unsanitized database names being passed directly to shell commands, enabling full remote code execution. A public proof-of-concept exploit is available, and with an EPSS score of 0.41% (61st percentile), this represents a moderate real-world exploitation risk for organizations using vulnerable Coolify versions.
Concurrency-driven information disclosure in the Linux kernel's veth (virtual Ethernet) driver allows old or uninitialized packet descriptors to be exposed to AF_XDP consumers when veth is run in threaded-NAPI mode with an XDP program attached. Because the BPF redirect/return context was moved from per-CPU storage into the 'current' task_struct (commit 401cb7dae813), two concurrent veth_poll() invocations can nest the xdp_set/clear_return_frame_no_direct() section and race, corrupting the shared BPF net context. Despite an NVD CVSS of 9.8, this is a local, configuration-dependent kernel race with EPSS at 0.16% (6th percentile), no KEV listing, and no public exploit identified at time of analysis.
Type confusion in the Linux kernel's team network driver (team_port_add) allows a local user with CAP_NET_ADMIN to corrupt a team device's header_ops state, leading to a kernel hang or BUG(). When an already-UP GRE device is added as a team port, the operation fails but not before team_dev_type_check_change irreversibly replaces eth_header with ipgre_header on the team device; subsequent packet transmission causes ipgre_header() to dereference struct team private data as struct ip_tunnel, triggering a local denial-of-service. No active exploitation has been confirmed (not in CISA KEV), though a syzbot reproducer demonstrates the issue reliably.
Denial of service in the Linux kernel's jbd2 (JBD2 journaling layer) used by ext4 allows a local attacker to crash the system by mounting a specially crafted or corrupted ext4 image; when journal metadata is inconsistent (e.g. a block bitmap does not reflect an in-use block), jbd2_journal_get_create_access() hits a J_ASSERT/BUG_ON at fs/jbd2/transaction.c:1289 and panics the machine. Affected products span multiple stable kernel branches, with the fix converting the fatal BUG_ON into a JBD2 abort. No public exploit identified at time of analysis and EPSS is low (0.18%), consistent with a locally-triggered availability-only issue rather than a remotely weaponizable flaw.
Denial-of-service potential in the Linux kernel's spinlock debugging instrumentation (do_raw_write_lock) stems from an unmarked read/write in debug_write_lock_before(), producing a data-race flagged by the Kernel Concurrency Sanitizer (KCSAN). Only kernels built with lock debugging enabled are affected, and the fix completes prior race-hardening work (commit 1a365e822372) by converting the remaining access to WRITE_ONCE(). No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile).
Linux kernel AMD platform management controller (PMC) driver lacks Van Gogh SoC suspend handler support, preventing S0ix suspend operations on affected devices and causing GPU driver crashes during resume due to power management failures. ASUS ROG Ally (non-X) handheld gaming devices are directly impacted. Local attackers or unprivileged users can trigger denial of service by attempting system suspend, rendering the device unresponsive and forcing a hard reboot. The vulnerability carries low exploitation probability (EPSS 0.03%) but affects a specific consumer hardware class; upstream patches are available in stable kernel branches.
Denial-of-service hardening in the Linux kernel's page_pool subsystem addresses noisy allocation-failure handling on the network receive datapath. Because driver authors frequently omit GFP_NOWARN, ATOMIC page allocations that fail under memory pressure emit full allocation-failure warnings/backtraces; the fix makes page_pool add GFP_NOWARN by default for ATOMIC allocations. Rated CVSS 7.5 for availability impact only (C:N/I:N), with no public exploit identified at time of analysis and a low EPSS score (0.17%, 6th percentile).
Denial of service in the Linux kernel's lan966x Ethernet switch driver (Microchip LAN966x SoC) allows a potential deadlock and kernel warning when network statistics are read while holding an atomic context. The driver incorrectly used a sleeping mutex (lan966x_stats_get) inside an atomic/spinlock-held path, tripping a 'sleeping function called from invalid context' BUG and risking system instability; the fix replaces the mutex with a spinlock. No public exploit identified at time of analysis, and the EPSS score is negligible (0.16%, 6th percentile).
Local privilege-context memory corruption in the Linux kernel's io_uring zero-copy send (zctx) path allows a local user to trigger unsafe handling of chained notification (ubuf_info) contexts. The flaw stems from send-zerocopy operations linking ubuf_info structures that may originate from a different io_uring context than assumed, and the fix adds a check enforcing that only same-context notifications are chained. No public exploit has been identified at time of analysis; EPSS is very low (0.16%, 6th percentile) and the issue is not on the CISA KEV list, but the CVSS base score of 7.8 reflects high confidentiality, integrity, and availability impact for a successful local trigger.
Improper validation of node identifiers (nid) in the Linux kernel's F2FS filesystem allows a crafted or corrupted on-disk image to pass an out-of-range nid (where footer.ino equals footer.nid and both exceed valid bounds) through f2fs_alloc_nid() and free_nid_list, potentially causing out-of-bounds access, memory corruption, or a kernel crash. The upstream fix adds a sanity check to detect this corruption. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 6th percentile). Note the published CVSS 9.8 network vector appears inconsistent with the local, filesystem-image-driven nature of this bug.
Privilege-relevant use-after-free in the Linux kernel's drm/msm (Qualcomm Adreno GPU) driver allows a local user with GPU access to trigger kernel faults because last_fence is not waited on at VM-bind context close, freeing GPU resources while they are still in use. Affected systems run the msm DRM driver on Qualcomm SoCs and use vm_bind contexts. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.15%, 5th percentile), consistent with an in-tree kernel fix rather than an in-the-wild threat.
Weakened cryptographic randomness affects the Linux kernel on AMD Zen5 processors, where the RDSEED instruction's 16-bit and 32-bit register variants can return a zero value while falsely reporting success (CF=1), tracked upstream as AMD-SB-7055. Kernel and userspace consumers that rely on RDSEED for entropy can silently receive predictable seed material, undermining key generation and other cryptographic operations. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile); the kernel resolves this by adding a microcode-revision check that works around the faulty hardware behavior.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmt_pending before write iter sends the cmd, just as syzbot reported in UAF[1]. Here we use hci_dev_lock to synchronize the two, thereby avoiding the UAF mentioned in [1]. [1] syzbot reported: BUG: KASAN: slab-use-after-free in mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 Read of size 8 at addr ffff888077164818 by task syz.0.17/5989 Call Trace: mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 set_link_security+0x5c2/0x710 net/bluetooth/mgmt.c:1918 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195 Allocated by task 5989: mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296 set_link_security+0x557/0x710 net/bluetooth/mgmt.c:1910 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195 Freed by task 5991: mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline] mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257 mgmt_index_removed+0x112/0x2f0 net/bluetooth/mgmt.c:9477 hci_sock_bind+0xbe9/0x1000 net/bluetooth/hci_sock.c:1314
Use-after-free in the Linux kernel Bluetooth HCI core (hci_core) lets an attacker within Bluetooth range trigger a race between the ACL data RX path (l2cap_recv_acldata) and connection teardown (hci_abort_conn_sync/hci_conn_del), causing the RX handler to dereference a freed hci_conn structure. A syzkaller-reproduced crash confirms the flaw, which primarily manifests as denial of service though memory corruption cannot be excluded; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The issue is resolved upstream by moving the hci_conn lookup into the protocol receive handlers under a single RCU/lock-protected critical section.
Kernel memory corruption in the Linux platform/x86 Intel P-Unit IPC driver (intel_punit_ipc) arises from an interrupt handler dereferencing the address of a global pointer variable (&punit_ipcdev) instead of the pointer itself, so the completion call complete(&ipcdev->cmd_complete) in intel_punit_ioc() writes to an incorrect memory location. Affected systems are those running the punit_ipc driver on specific Intel SoC platforms; a local low-privileged actor able to drive the IPC command path can corrupt kernel memory, most plausibly causing instability or a crash. There is no public exploit identified at time of analysis, EPSS is very low (0.17%, 6th percentile), and the issue is not in CISA KEV.
Denial of service in the Linux kernel's Samsung sxgbe 10G Ethernet driver stems from a NULL pointer dereference in sxgbe_rx(), where the receive path logs an error when an skb is NULL but then dereferences that same NULL skb on the following line. The fix adds a 'break' so the code falls through to sxgbe_rx_refill() instead of crashing, mirroring the handling already used by other NIC drivers such as Calxeda's xgmac_rx(). There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile); the bug was found during code review rather than in-the-wild.
Out-of-bounds kernel write in the Linux 'atlantic' network driver (Aquantia/Marvell AQC-series 10G NICs) occurs when the RX path receives large multi-descriptor packets exceeding MAX_SKB_FRAGS (17) fragments, causing a fragment index to overrun the skb frag array inside skb_add_rx_frag_netmem() and triggering a kernel panic. The flaw was observed crashing production systems equipped with the Aquantia AQC113 10G NIC. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.17% (6th percentile), consistent with a hardware-specific denial-of-service condition rather than a broadly exploitable RCE.
In the Linux kernel, the following vulnerability has been resolved: afs: Fix delayed allocation of a cell's anonymous key The allocation of a cell's anonymous key is done in a background thread along with other cell setup such as doing a DNS upcall. In the reported bug, this is triggered by afs_parse_source() parsing the device name given to mount() and calling afs_lookup_cell() with the name of the cell. The normal key lookup then tries to use the key description on the anonymous authentication key as the reference for request_key() - but it may not yet be set and so an oops can happen. This has been made more likely to happen by the fix for dynamic lookup failure. Fix this by firstly allocating a reference name and attaching it to the afs_cell record when the record is created. It can share the memory allocation with the cell name (unfortunately it can't just overlap the cell name by prepending it with "afs@" as the cell name already has a '.' prepended for other purposes). This reference name is then passed to request_key(). Secondly, the anon key is now allocated on demand at the point a key is requested in afs_request_key() if it is not already allocated. A mutex is used to prevent multiple allocation for a cell. Thirdly, make afs_request_key_rcu() return NULL if the anonymous key isn't yet allocated (if we need it) and then the caller can return -ECHILD to drop out of RCU-mode and afs_request_key() can be called. Note that the anonymous key is kind of necessary to make the key lookup cache work as that doesn't currently cache a negative lookup, but it's probably worth some investigation to see if NULL can be used instead.
Local privilege escalation and memory corruption in the Linux kernel's io_uring networking subsystem stems from vectored registered buffer imports being tied to the wrong io_kiocb (the request 'req' instead of the notification 'sr->notif'), creating an object-lifetime mismatch. Local low-privileged users on affected kernels can trigger use-after-free-style conditions leading to information disclosure or code execution in kernel context. No public exploit identified at time of analysis, and EPSS is low (0.16%).
In the Linux kernel, the following vulnerability has been resolved: mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). syzbot reported divide-by-zero in __tcp_select_window() by MPTCP socket. [0] We had a similar issue for the bare TCP and fixed in commit 499350a5a6e7 ("tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0"). Let's apply the same fix to mptcp_do_fastclose(). [0]: Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 6068 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:__tcp_select_window+0x824/0x1320 net/ipv4/tcp_output.c:3336 Code: ff ff ff 44 89 f1 d3 e0 89 c1 f7 d1 41 01 cc 41 21 c4 e9 a9 00 00 00 e8 ca 49 01 f8 e9 9c 00 00 00 e8 c0 49 01 f8 44 89 e0 99 <f7> 7c 24 1c 41 29 d4 48 bb 00 00 00 00 00 fc ff df e9 80 00 00 00 RSP: 0018:ffffc90003017640 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88807b469e40 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003017730 R08: ffff888033268143 R09: 1ffff1100664d028 R10: dffffc0000000000 R11: ffffed100664d029 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 000055557faa0500(0000) GS:ffff888126135000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f64a1912ff8 CR3: 0000000072122000 CR4: 00000000003526f0 Call Trace: <TASK> tcp_select_window net/ipv4/tcp_output.c:281 [inline] __tcp_transmit_skb+0xbc7/0x3aa0 net/ipv4/tcp_output.c:1568 tcp_transmit_skb net/ipv4/tcp_output.c:1649 [inline] tcp_send_active_reset+0x2d1/0x5b0 net/ipv4/tcp_output.c:3836 mptcp_do_fastclose+0x27e/0x380 net/mptcp/protocol.c:2793 mptcp_disconnect+0x238/0x710 net/mptcp/protocol.c:3253 mptcp_sendmsg_fastopen+0x2f8/0x580 net/mptcp/protocol.c:1776 mptcp_sendmsg+0x1774/0x1980 net/mptcp/protocol.c:1855 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0xe5/0x270 net/socket.c:742 __sys_sendto+0x3bd/0x520 net/socket.c:2244 __do_sys_sendto net/socket.c:2251 [inline] __se_sys_sendto net/socket.c:2247 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2247 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f66e998f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffff9acedb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f66e9be5fa0 RCX: 00007f66e998f749 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007ffff9acee10 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007f66e9be5fa0 R14: 00007f66e9be5fa0 R15: 0000000000000006 </TASK>
Denial of service in the Linux kernel's AMD GPU display driver (amdgpu drm/amd/display) allows a local user to crash the system via a NULL pointer dereference in dc_stream_get_scanoutpos(). The flaw triggers during concurrent atomic modeset and cursor operations - reproducible with the IGT kms_cursor_legacy 'long-nonblocking-modeset-vs-cursor-atomic' test when both an eDP panel and a DP monitor are connected. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and this is not in CISA KEV.
Use-after-free in the Linux kernel's libceph client (the in-kernel Ceph transport shared by CephFS and RBD) lets the mount-time wait loop in __ceph_open_session() read a monmap or osdmap structure after a worker thread has freed and replaced it. The flaw is a race between a mounting task polling have_mon_and_osd_map() without locks and ceph_monc_handle_map()/handle_one_map() swapping in a fresh map under their respective locks, producing a KASAN slab-use-after-free (reproducible with xfstests generic/395 and generic/397). There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is very low at 0.18% (8th percentile).
Out-of-bounds kernel memory write in the Linux kernel's libceph client (handle_auth_session_key) allows a malicious or compromised Ceph server to corrupt kernel memory when a client decrypts the connection secret or processes CephX service tickets. The attacker-controlled 'len' field from network packets was used without boundary checks, enabling potential kernel memory corruption and code execution against any host mounting Ceph/RBD storage. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.18%, 8th percentile).
Remote denial-of-service in the Linux kernel's libceph (Ceph client) module allows a malicious or compromised Ceph OSD/monitor to crash the kernel by sending OSDMap packets containing out-of-bounds OSD indexes. Because libceph previously used BUG_ON assertions on OSD index values drawn directly from untrusted network data, an attacker-controlled index exceeding map->max_osd triggers a kernel panic. This is a fixed issue with upstream stable-tree commits; no public exploit has been identified and EPSS exploitation probability is low (0.17%, 7th percentile).
In the Linux kernel, the following vulnerability has been resolved: bfs: Reconstruct file type when loading from disk syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted or when the 32bits "attributes" field loaded from disk are corrupted. A documentation says that BFS uses only lower 9 bits of the "mode" field. But I can't find an explicit explanation that the unused upper 23 bits (especially, the S_IFMT bits) are initialized with 0. Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk. Also, verify that the value of the "attributes" field loaded from disk is either BFS_VREG or BFS_VDIR (because BFS supports only regular files and the root directory).
Local privilege escalation and memory corruption in the Linux kernel's NVMe driver arises from a use-after-free in admin request_queue lifetime management, where namespaces retain stale references to a controller's admin request_queue that can be dereferenced after the controller is torn down. Confirmed via a KASAN slab-use-after-free report in blk_queue_enter() triggered through an nvme ioctl (nvme_submit_user_cmd), the flaw affects hosts running NVMe storage and is fixed upstream by reordering the controller 'put' until after all references are released. EPSS is very low (0.03%, 7th percentile) and there is no public exploit identified at time of analysis; exploitation requires local access and a race against controller teardown.
In the Linux kernel, the following vulnerability has been resolved: ext4: refresh inline data size before write operations The cached ei->i_inline_size can become stale between the initial size check and when ext4_update_inline_data()/ext4_create_inline_data() use it. Although ext4_get_max_inline_size() reads the correct value at the time of the check, concurrent xattr operations can modify i_inline_size before ext4_write_lock_xattr() is acquired. This causes ext4_update_inline_data() and ext4_create_inline_data() to work with stale capacity values, leading to a BUG_ON() crash in ext4_write_inline_data(): kernel BUG at fs/ext4/inline.c:1331! BUG_ON(pos + len > EXT4_I(inode)->i_inline_size); The race window: 1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct) 2. Size check passes for 50-byte write 3. [Another thread adds xattr, i_inline_size changes to 40] 4. ext4_write_lock_xattr() acquires lock 5. ext4_update_inline_data() uses stale i_inline_size = 60 6. Attempts to write 50 bytes but only 40 bytes actually available 7. BUG_ON() triggers Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock() immediately after acquiring xattr_sem. This ensures ext4_update_inline_data() and ext4_create_inline_data() work with current values that are protected from concurrent modifications. This is similar to commit a54c4613dac1 ("ext4: fix race writing to an inline_data file while its xattrs are changing") which fixed i_inline_off staleness. This patch addresses the related i_inline_size staleness issue.
Use-after-free in Linux ksmbd IPC handler allows remote unauthenticated attackers to trigger memory corruption via race condition in generic netlink reply processing. The flaw (CVSS 9.8 critical, network-reachable) affects ksmbd's ipc_msg_send_request() function where concurrent access to response buffers occurs without proper locking. EPSS data not provided; no CISA KEV listing identified at time of analysis. Multiple upstream kernel commits available across stable branches indicate vendor-released patches exist.
Local denial-of-service in the Linux kernel ext4 filesystem allows a low-privileged user to crash the system by racing inline-data destruction against block mapping. The function ext4_destroy_inline_data_nolock() flips an inode from EXT4_INODE_INLINE_DATA to EXT4_INODE_EXTENTS without holding i_data_sem, so a concurrent ext4_map_blocks() can enter ext4_ind_map_blocks() on an inode that already advertises extents, tripping a BUG_ON at fs/ext4/indirect.c:546 and panicking the kernel. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and the flaw is availability-only (kernel oops), not information disclosure despite the input tag.
Local privilege escalation potential in the Linux kernel's experimental Rust Binder driver (rust_binder) arises from a race condition on a node's death_list where NodeDeath entries can be concurrently manipulated. During Node::release the driver moves death entries to a stack-local list while other threads call an unsafe remove() on the original list, corrupting the prev/next pointers and producing kernel memory corruption (observed as a paging-request Oops on ARM64 Android 6.12 kernels). No public exploit has been identified and EPSS is low (0.20%), but the flaw yields high confidentiality, integrity, and availability impact if a local attacker wins the race.
Denial of service and out-of-bounds memory read in the Linux kernel's staging rtl8723bs Realtek Wi-Fi driver allows an attacker within radio range to crash or hang a vulnerable device by transmitting a malformed 802.11 frame. The rtw_get_ie() Information Element parser trusted the attacker-supplied IE length byte without bounds-checking, so a crafted length can push the parser past the frame buffer, producing OOB reads or an infinite loop. No public exploit is identified at time of analysis (EPSS 0.07%, 21st percentile) and the issue is not in CISA KEV; it has been fixed upstream and shipped in Ubuntu security updates.
Adjacent-network stack buffer overflow in the Linux kernel's rtl8723bs staging Wi-Fi driver lets a nearby malicious station corrupt kernel stack memory by sending a crafted 802.11 Association Request. The OnAssocReq handler copied the Supported Rates IE into a fixed 16-byte stack buffer using the attacker-controlled IE length without bounds checking, enabling denial of service and potentially kernel code execution. Rated CVSS 8.8; no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with an unauthenticated but proximity-limited radio attack.
Out-of-bounds read in the Linux kernel's staging rtl8723bs Realtek Wi-Fi driver allows an adjacent attacker to trigger a kernel panic by broadcasting a malformed 802.11 beacon frame. The OnBeacon handler parses an Extended Supported Rates (ESR) information element positioned at the end of the received frame buffer without bounds validation, reading past the buffer. No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.17%), but the flaw is remotely reachable over the air against any device using this driver.
Spurious kernel warnings in the Linux kernel hung_task blocker-tracking mechanism arise on architectures that align 32-bit values on 2-byte boundaries (e.g., m68k), where the code incorrectly assumes lock pointers are always 4-byte aligned so it can pack a type tag into the lower two pointer bits. The mismatch trips two WARN_ON_ONCE checks; the fix silently ignores non-4-byte-aligned locks, disabling the feature on those platforms. This is an internal kernel robustness fix rather than a remotely reachable attack primitive, with no public exploit identified at time of analysis and a low EPSS score of 0.15% (5th percentile).
Remote unauthenticated denial of service in the Linux kernel's ksmbd in-kernel SMB server allows an attacker to exhaust kernel socket resources by repeatedly tripping the per-IP connection limit. When ksmbd_kthread_fn() rejects a connection that exceeds the per-IP limit, it sets ret = -EAGAIN and continues the accept loop without releasing the just-accepted socket, leaking one socket per rejected attempt from a single source IP. This is a resource-leak DoS with no public exploit identified at time of analysis and a low EPSS score (0.16%, 6th percentile).
Client-identity confusion in the Linux kernel's NFS client allows a low-privileged local user to have an NFS mount silently reuse an existing RPC connection established under a different TLS X.509 client certificate. Because nfs_match_client() failed to compare the cert_serial and privkey_serial fields that define the client's presented identity, a mount intended to use one certificate could be bound to a connection authenticated with another, enabling access to data under the wrong identity. This is an information-disclosure/identity-mismatch flaw (CVSS 7.0); it is not in CISA KEV, has no public exploit identified at time of analysis, and carries a very low EPSS score of 0.10% (1st percentile).
Denial of service in the Linux kernel IPv4 routing subsystem allows a permanent device reference-count leak through a race condition in FIB next-hop exception (fnhe) handling. On systems using tunnel drivers such as sit or gretap, concurrent transmit paths can bind a soon-to-be-freed fnhe to a new dst, leaking the dst and its device reference so the interface can never be unregistered (visible as 'unregister_netdevice: waiting for sitX to become free'). This is availability-only, has no public exploit identified at time of analysis, and carries a low EPSS score of 0.17%.
Linux kernel binfmt_misc module fails to restore write access to executable files when error handling closes improperly opened file descriptors, potentially causing subsequent write operations on the same file to fail and creating a denial-of-service condition for legitimate file modifications. The vulnerability affects the bm_register_write() function which uses open_exec() to open executable files with intentionally denied write permissions, but does not call exe_file_allow_write_access() before closing the file on error paths. With an EPSS score of 0.03% (8th percentile), this represents a low exploitation probability; no public exploit has been identified at time of analysis.
Local privilege-relevant memory corruption in the Linux kernel's io_uring cmd_net timestamp-retrieval path arises from transposed arguments to skb_queue_splice(), causing SKBs to be spliced in the wrong direction between the socket queue and an on-stack list. Any local user able to issue io_uring network commands with timestamp retrieval could trigger the flawed splice, potentially leading to information disclosure (per source tagging) or broader list/memory corruption. There is no public exploit identified at time of analysis and EPSS is low (0.15%), so this is a code-quality/security hardening fix rather than an actively exploited threat.
Denial of service in the Linux kernel's veth (virtual Ethernet) driver allows a permanently stalled transmit queue and halted network traffic once a lost-wakeup race is triggered under load. The flaw is a regression introduced by commit dc82a33297fc ('veth: apply qdisc backpressure on full ptr_ring'), where the producer in veth_xmit() misuses the __ptr_ring_empty() API to decide whether to re-wake a stopped TXQ; when a consumer on another CPU empties the ring concurrently, the wakeup is lost and the queue stays in QUEUE_STATE_DRV_XOFF. It was observed in production on ARM64 (Ampere Altra Max) systems. There is no public exploit identified at time of analysis, EPSS is low (0.16%), and it is not in CISA KEV.
Use-after-free in the Linux kernel's SMB/CIFS client (cifs module) arises from an incomplete backport of commit bdb596ceb4b7, which left a stale kref_put() call in cfids_invalidation_worker() instead of converting it to close_cached_dir(). The flaw affects the cached-directory (cfid) invalidation path used when a Linux system mounts remote SMB shares, and with a CVSS of 8.8 (C:H/I:H/A:H) could allow memory corruption leading to information disclosure or code execution. There is no public exploit identified at time of analysis and the EPSS probability is low (0.15%).
Denial of service in the Linux kernel's NVMe multipath subsystem allows a lockdep-detected deadlock among disk->open_mutex, the kblockd workqueue, and partition_scan_work completion, which can hang block-device operations. The fix moves partition_scan_work off the kblockd workqueue onto nvme_wq to break the lock-dependency cycle. No public exploit identified at time of analysis; the issue surfaces intermittently during NVMe partition scanning on systems using NVMe multipath.
Improper resource cleanup in the Linux kernel's Intel ice Ethernet driver leaves PTP (Precision Time Protocol) resources leaked when driver probe, PTP initialization, or PTP restart hits an error path. On subsequent driver removal the leaked PF PTP state and un-deinitialized 'ps_lock' mutex trigger a kernel WARNING in ice_adapter_put, and the PTP clock is left registered. No public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and there is no CISA KEV listing; this is a robustness/error-handling defect requiring local privileged access to the NIC driver.
Local privilege-level information disclosure and memory corruption in the Linux kernel's VFS statmount() implementation arises from an uninitialized output-offset pointer ('offp') in statmount_string(). When a caller requests the STATMOUNT_MNT_UIDMAP or STATMOUNT_MNT_GIDMAP fields, those code paths write directly to the struct fields and never assign 'offp', so a later dereference of the uninitialized pointer can leak kernel memory or corrupt state. The CVSS 3.1 vector (AV:L/PR:L) indicates a local, low-privileged attacker is required; there is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile).
Out-of-bounds memory access in the Linux kernel's eBPF verifier (widen_imprecise_scalars()) allows a local actor able to load eBPF programs to read or corrupt kernel memory beyond the bpf_verifier_state stack array. The flaw arises because the verifier assumed an ancestor state (prev_st) shares the same allocated_stack depth as a newly queued state (queued_st), which is false when the same callsite is invoked with differently sized stack frames. No public exploit has been identified at time of analysis; EPSS risk is low (0.17%, 7th percentile) and the issue has been resolved upstream.
Local privilege escalation and memory corruption in the Linux kernel's Intel Xe GPU driver (drm/xe/guc) arises from a use-after-free race during device unbind: the GuC 'Dead CT' worker is not synchronized with the unbind path, so it can access GuC communication-transport resources after they have already been freed. Exploitation requires local access with low privileges (CVSS 7.8, AV:L/PR:L) and can result in high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the low EPSS (0.17%) reflects the niche, timing-dependent nature of the flaw.
Denial of service in the Linux kernel's netfilter nftables connection-tracking (nft_ct) code allows disruption of FTP passive-mode (PASV/EPSV) sessions on hosts acting as NAT gateways. When an nftables FTP conntrack helper is assigned to a connection that already has a NAT binding (helper set after DNAT), the required nfct_seqadj sequence-adjustment extension is never allocated, so the FTP payload mangling path hits a kernel WARNING and tears down the control connection ("Service not available, remote server has closed connection"); on kernels built with panic_on_warn this escalates to a full crash. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%), and it is not in CISA KEV.
Out-of-bounds memory access in the Linux kernel's AMD CPU microcode-matching logic affects systems running on AMD Zen5 processors, where the zen5_rdseed_microcode revision table lacks a terminating sentinel entry. When x86_match_min_microcode_rev() iterates this array during CPU initialization on a Zen5 part, it reads past the array bounds, tripping KASAN and potentially disclosing adjacent kernel memory or causing instability. No public exploit identified at time of analysis, and EPSS risk is low (0.16%, 6th percentile).
Kernel panic (denial of service) in the Linux kernel's qmi_wwan USB WWAN driver occurs because qmimux_rx_fixup() leaves skb->mac_header uninitialized for raw-IP packets that have no MAC header; on ARM64, strict-alignment access to that offset by xfrm/IPsec crashes the machine. The flaw is reachable when IPsec (ESP) traffic is received over a qmimux0 multiplexed interface, as shown by the provided oops in xfrm_input(). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), consistent with a config-specific crash rather than broad remote code execution.
Improper GEM object cleanup in the Linux kernel's drm/msm (Qualcomm Adreno) graphics driver mishandles imported dma-bufs, because the free path only checked object flags without accounting for imported buffers whose reservation object differs from the embedded default. A local user with DRM/GPU access can trigger the faulty path (reproduced during hardware-accelerated IRIS video playback under GNOME Shell) by closing a GEM handle backed by an imported dma-buf, producing a kernel WARNING at msm_gem.c:1127 and potential incorrect reservation-object handling during buffer teardown. There is no public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and this is not on CISA KEV.
Broken AFBC (Arm Frame Buffer Compression) handling in the Linux kernel's Mediatek DRM driver on MT8188 (Genio 700) SoCs causes constant vblank timeouts and garbled display output when the 32x8/split/sparse AFBC modifier is used, which Mesa v25.0+ enables by default. A local user with GPU/display access can trigger a hung display pipeline (denial of service) and rendering of stale/garbled framebuffer contents (limited information disclosure). No public exploit identified at time of analysis, and EPSS is very low (0.17%, 7th percentile), consistent with a hardware-specific reliability bug rather than a widely weaponizable flaw.
Integrity protection weakening in the Linux kernel's IMA (Integrity Measurement Architecture) subsystem allows a stored IMA file signature to be silently downgraded to a plain IMA hash. When IMA and EVM run in fix mode (e.g. booting with 'ima_appraise=fix evm=fix ima_policy=appraise_tcb'), the kernel incorrectly clears the IMA_DIGSIG flag whenever a non-IMA security xattr (such as security.selinux or security.evm) or an ACL is set or removed after security.ima was written, so on file close a hash is generated instead of preserving the intended signature. A full C reproducer is embedded in the report, but there is no CISA KEV listing and no public weaponized exploit identified at time of analysis; EPSS is 0.17% (7th percentile).
Memory corruption (use-after-free) in the Linux kernel's Intel iwlwifi wireless driver, specifically in iwl_mld_remove_link(), where the code frees the 'link' object via kfree_rcu() and then dereferences it to read link->fw_id. On systems with Intel WiFi hardware using the newer MLD (multi-link device) code path, a triggered link-removal race can access freed memory, most likely crashing the kernel (denial of service) with only a theoretical path to further corruption. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS probability is low (0.16%, 6th percentile).
Local privilege-escalation-class use-after-free in the Linux kernel's radeon (AMD GPU) DRM driver, triggered on the probe-error and device-removal paths. After the driver switched its main structure to devm_drm_dev_alloc(), the leftover drm_put_dev() calls cause devres to release the already-freed device a second time, producing a refcount underflow ('refcount_t: underflow; use-after-free') and dangling reference. No public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and the issue is not listed in CISA KEV.
Kernel crashes and memory corruption in the Linux kernel on IBM s390/s390x systems occur when the HugeTLB Vmemmap Optimization (HVO) feature is enabled, because s390 architecture rules forbid overwriting an active/valid page table entry with another valid entry without first invalidating it, and the HVO path modifies kernel page tables without a compliant TLB flush. The upstream fix disables ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP on s390, effectively reverting the patch that enabled it. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is tagged as a Denial of Service issue rather than an exploitation primitive.
Local denial-of-service (and potential memory corruption) in the Linux kernel's NXP i.MX8 ISI media capture driver (imx8-isi) allows a low-privileged user with access to an ISI /dev/videoX device to trigger a WARNING and driver error state by simply querying device controls while a capture stream is active. The flaw stems from mxc_isi_video_release() unconditionally tearing down streaming state, so any release call (e.g. from `v4l2-ctl -l`) can free a queue that is still streaming. No public exploit is identified at time of analysis and EPSS risk is negligible (0.03%), though a deterministic crash-reproduction recipe is published in the fix commit.
Local denial-of-service (and potential memory corruption) in the AMD amdkfd (Kernel Fusion Driver) component of the Linux kernel arises from a race between GPU compute-partition switching and asynchronous KFD process teardown. Because the driver's partition-switch path only checks whether the kfd_processes_table is empty - while the actual kfd_process teardown runs later in the kfd_process_wq workqueue - a partition switch can free kfd_node structures still being accessed by an in-flight release, producing a divide-by-zero kernel oops (observed in kfd_get_num_sdma_engines). No public exploit identified at time of analysis, EPSS is low (0.16%), and it is not listed in CISA KEV.
Cross-task FPU state leakage in the Linux kernel x86 XFD (Extended Feature Disable) handling allows a local low-privileged task to trigger an inconsistent AMX/dynamic-feature register state during signal delivery. When a non-AMX task is preempted by an AMX-enabled task that changes the XFD MSR, fpu__clear_user_states() failed to re-synchronize XFD, producing a state mismatch (kernel WARNING) and potential exposure of dynamic FPU register contents. Tagged as an information-disclosure issue; no public exploit identified at time of analysis and EPSS is low (0.17%, 7th percentile).
Kernel memory corruption in the Linux drm/radeon GPU driver occurs because the driver calls kfree() on the rdev main structure that is now managed by devres (via devm_drm_dev_alloc()), causing a double-free when the driver probe fails and devres later cleans up the already-freed allocation. Local users on systems with AMD/ATI Radeon hardware may trigger memory corruption during a failed driver probe, most directly resulting in a kernel crash. There is no public exploit identified at time of analysis, and the EPSS score is low (0.17%, 7th percentile), consistent with an error-path bug rather than a broadly exploitable flaw.
Denial-of-service in the Linux kernel JFS filesystem driver lets a local low-privileged actor crash the system by mounting a JFS volume read-only. Because txInit() started its waitqueue-initialization loop at index 1, TxBlock[0].waitor is left uninitialized; a read-only mount returns tid=0 and the subsequent txEnd(0) dereferences that uninitialized waitqueue, triggering a lockdep 'non-static key' warning and a kernel crash. EPSS is low (0.18%, 8th percentile), there is no public exploit identified at time of analysis, and it is not in CISA KEV - impact is a crash rather than code execution.
Denial-of-service via invalid pointer access exists in the Linux kernel gpiolib debugfs interface, where a failed memory allocation in gpiolib_seq_start() leaves s->private uninitialized and later dereferenced in gpiolib_seq_stop(), crashing the kernel. The flaw affects systems exposing the GPIO debugfs seq_file (/sys/kernel/debug/gpio) and is triggerable only under memory-allocation failure. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and it is not on CISA KEV.
Authorization bypass in the Linux kernel CephFS client (ceph module) lets an authenticated Ceph user exercise MDS auth capabilities granted for one filesystem against a different filesystem in a multi-filesystem (multifs) Ceph cluster. Because the kernel client failed to validate the fsname alongside the associated caps, a user holding read-only rights on 'fsname1' but read-write rights on 'fsname2' would incorrectly gain read-write on 'fsname1', enabling file creation and deletion they should not be permitted. No public exploit identified at time of analysis, and the EPSS score is low (0.25%, 16th percentile), consistent with a specialized storage-cluster condition rather than mass exploitation.
Out-of-bounds memory access in the RISC-V stack unwinder (walk_stackframe) of the Linux kernel lets KASAN trip and read past a task's kernel stack boundary when unwinding a task other than the current one. The defect mirrors a previously fixed x86 issue (commit 84936118bdf3) and is reached through normal task-introspection paths on RISC-V builds. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.03%, 7th percentile), and it is not in CISA KEV; the fix disables KASAN checks for non-current tasks.
Local privilege-relevant memory corruption/disclosure risk exists in the Linux kernel's Rockchip SFC (Serial Flash Controller) SPI driver (spi-rockchip-sfc), where improper DMA-API usage - deriving DMA addresses via virt_to_phys() instead of dma_map_single() - causes the driver to sync DMA memory it never properly mapped. On affected Rockchip-based systems (e.g. ODROID-M1), this triggers a DMA-API debug warning and reflects an underlying unsafe memory-transfer path during SPI-NOR flash operations. No public exploit identified at time of analysis; EPSS probability is low (0.16%, 6th percentile).
Kernel memory corruption in the Linux kernel's AMD Display (amdgpu/DC) driver stems from an undersized dc->links[MAX_LINKS] array and an unchecked link->enc pointer, letting a local attacker on AMD-GPU systems trigger an out-of-bounds access and NULL-pointer dereference during hw_init() for DisplayPort-over-USB4 (DPIA) endpoints. Rated CVSS 7.8 (AV:L/PR:L) and tagged as denial-of-service, it most realistically causes a kernel crash. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.17% (7th percentile).
Memory mishandling in the Linux kernel's mlx5e (NVIDIA/Mellanox ConnectX) RX path lets a loaded XDP program corrupt skb generation on striding RQ, causing kernel warnings, a BUG_ON crash, or erroneous packet buffers. The flaw affects systems using mlx5 NICs where a multi-buffer XDP program calls bpf_xdp_adjust_head() or bpf_xdp_adjust_tail() to change the xdp_buff layout, which the driver wrongly assumed was static. This is a resolved upstream kernel fix with no public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and it is not in CISA KEV.
Out-of-bounds read in the Linux kernel HFS+ (hfsplus) filesystem driver allows a local attacker to crash the kernel via a crafted HFS+ B-tree node whose record offset or length in hfsplus_bmap_alloc exceeds node_size, causing access beyond the node's allocated pages. The flaw is reached during node allocation (hfs_btree_inc_height → hfsplus_brec_insert) when writing to files on a malicious HFS+ image, with KASAN confirming a slab-out-of-bounds read. Reported as a denial-of-service issue with a low EPSS score (0.18%, 8th percentile); no public exploit identified at time of analysis and it is not in CISA KEV.
Denial of service in the Linux kernel's NXP ENETC Ethernet driver (enetc) on Layerscape LS1028A platforms allows the CPU to hang under normal network load, causing RCU stalls on PREEMPT_RT kernels. The flaw stems from recursive acquisition of the read-side enetc_mdio_lock in the enetc_poll NAPI path, which deadlocks when a higher-priority writer is queued between two reader acquisitions. No public exploit identified at time of analysis; EPSS is very low (0.03%, 8th percentile) and it is not CISA KEV listed, consistent with a reliability/self-triggered availability bug rather than an attacker-weaponized flaw.
Physical access to SolarEdge SE3680H solar inverters allows privilege escalation, remote code execution, and information disclosure through unpatched Linux kernel vulnerabilities. Reported by DIVD CSIRT, this affects SE3680H firmware running outdated kernel subsystems. While CVSS 4.0 scores 7.0 with physical attack vector (AV:P), the presence of RCE and privilege escalation tags indicates high impact once physical proximity is achieved. No EPSS score, KEV listing, or public exploit identified at time of analysis, suggesting limited current exploitation risk for typical deployment scenarios.
A slab use-after-free in the Linux kernel's Intel AVS (Audio Voice Speech / Smart Sound Technology) ASoC driver lets a local user with access to a HOST HDAudio PCM stream corrupt kernel memory by racing PCM close against period-elapsed IRQ work. When avs_dai_fe_shutdown() frees the DAI's private context while the period-elapsed work is still servicing interrupts, the freed structure can be accessed concurrently, yielding a use-after-free with high confidentiality, integrity and availability impact (CVSS 7.8, AV:L). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.20%, 10th percentile), reflecting the local-only, hardware-specific nature of the flaw.
Denial-of-service (kernel use-after-free/double-free) in the Linux kernel's nvmet-fc NVMe-over-Fibre-Channel target driver allows a local privileged operator to crash the kernel by forcibly shutting down an NVMe target port via configfs. When a port is torn down, nvmet_port_subsys_drop_link() calls both nvmet_port_del_ctrls() and nvmet_disable_port(), each of which can schedule the same association-deletion work item; the first run frees all resources and the second reuses freed memory. This is a fix already merged upstream in the stable trees, with no public exploit identified at time of analysis and a low EPSS score (0.21%, 11th percentile).
Denial of service and potential memory corruption in the Linux kernel's NVMe over Fibre Channel (nvme-fc) transport arises because nvme_fc_create_association reads the remote port_state and increments the rport active count without holding a lock, racing against nvme_fc_unregister_remote which can free the remote port when no active association exists. An attacker or fault condition on the FC fabric able to trigger reconnect events concurrently with port teardown can drive a use-after-free style condition on the rport object. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile).
Data-integrity corruption in the Linux kernel's stmmac (Synopsys DesignWare/STMMAC) Ethernet driver allows malformed packets that failed hardware checksum validation to be accepted as valid by the network stack. When hardware checksum offload (CoE) is enabled, the Rx path marked known IP-ethertype frames as CHECKSUM_UNNECESSARY without honoring the hardware's reported header/payload checksum error, so corrupt frames bypass the stack's own validation. There is no public exploit identified at time of analysis, KEV status is not listed, and EPSS is low (0.20%, 11th percentile).
Local privilege-escalation and memory-disclosure flaw in the Linux kernel's DRM GPU SVM (Shared Virtual Memory) subsystem, where incorrect use of hmm_pfn_to_map_order() mishandles an HMM range that only partially covers a huge page (e.g. 2MB), causing the driver to map physical memory outside the intended range - memory that may not even belong to the faulting process's address space. Affecting recent kernels carrying the drm/gpusvm code (associated with the Intel Xe GPU driver's userptr/SVM path), a local user with GPU access can trigger cross-boundary mappings leading to information disclosure or memory corruption. There is no public exploit identified at time of analysis, and EPSS is low at 0.19% (9th percentile).
Local memory-safety flaw in the Linux kernel's AMD GPU (amdgpu) driver allows an authenticated local user to submit a user queue (userq) whose buffer virtual address and size are not validated against a legitimate VM mapping. Because the driver failed to confirm the userq object resides in a valid GPU virtual-memory mapping before use, a low-privileged process with GPU device access could reference out-of-bounds or unmapped memory, tagged as an information-disclosure issue with additional integrity and availability impact. No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile), consistent with a local-only kernel driver bug rather than a mass-exploited network flaw.