Linux
Monthly
Uninitialized GPU memory reuse in the Linux kernel's drm/vc4 driver (Broadcom VideoCore IV, used in Raspberry Pi) allows a local low-privileged user to trigger GPU hangs, corrupt GPU state, and read stale tile state data left by prior GPU jobs in recycled buffer slots. The vulnerability exists because the 16MB binner Buffer Object is partitioned into 512KB slots that are recycled across jobs without clearing, causing the Primitive Tile Binner (PTB) hardware to act on stale Tile State Data Array (TSDA) contents from previous jobs - producing invalid command and primitive streams. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) reflects low exploitation probability despite the high CVSS base score.
Heap buffer overflow and potential kernel memory mass-zeroing in the Linux kernel drm/panthor GPU driver allow a local attacker to corrupt kernel heap structures or trigger catastrophic out-of-bounds writes by supplying a crafted firmware image to the Arm Mali Valhall (Panthor) DRM subsystem. The root cause is that panthor_fw_load_section_entry() computes section->data.size from raw firmware header fields without bounding it against the allocated section_size, allowing both a memcpy overflow and an unsigned integer underflow in a subsequent memset that could zero arbitrarily large kernel memory regions. No public exploit has been identified and EPSS is low at 0.18% (8th percentile), but the CVSS impact ratings of C:H/I:H/A:H reflect the realistic worst case of full kernel compromise on affected hardware.
Out-of-bounds memory access in the Linux kernel's drm/panthor driver (ARM Mali Valhall GPU) allows a local authenticated attacker to read or corrupt kernel memory by supplying a crafted MCU virtual address near the end of the firmware shared memory section. The underlying flaw is in iface_fw_to_cpu_addr(), which validated only that a firmware-provided address falls within the shared section - not that the full firmware interface structure fits within it - enabling subsequent structure-level accesses to reach past the section boundary. No public exploit code exists and EPSS is 0.17% (6th percentile), indicating no evidence of active exploitation; patches are available in Linux stable releases 6.12.103, 7.1.8, and 6.18.44.
Use-after-free in the Linux kernel's AMD GPU power management subsystem (drm/amd/pm) allows a low-privileged local attacker to corrupt kernel memory via a race condition in the sysfs power table interface. The flaw exists because amdgpu_dpm_get_pp_table() returns a raw pointer to a driver-owned buffer after releasing adev->pm.mutex, enabling a concurrent pp_table write to free the allocation while a sysfs copy is still in progress. No public exploit has been identified and EPSS probability is very low (0.15%), but the CVSS 7.8 C:H/I:H/A:H impact reflects credible potential for local privilege escalation or kernel crash on AMD GPU-equipped Linux systems.
Divide-by-zero panic in the Linux kernel's AMD display driver (drm/amd/display) allows a low-privileged local user to crash the kernel by triggering a zero-area viewport condition in the calculate_mcache_setting function. The vulnerable code path exits early with num_mcaches == 0 and mvmpg_width/height == 0, then proceeds to divide by those zero values, causing both a divide-by-zero panic and potential integer underflow on num_mcaches. EPSS is very low at 0.15% (5th percentile) and no active exploitation or public exploit code has been identified at time of analysis; however, the local trigger mechanism via display mode setting is accessible to low-privileged users on systems with AMD GPU hardware.
Integer overflow in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user with AMD KFD device access to bypass EOP ring buffer size validation on GFX8/GFX9 hardware, enabling out-of-bounds GPU writes that can corrupt adjacent kernel memory or trigger GPU faults. A crafted eop_ring_buffer_size of 0xFFFFF001 exploits the ALIGN macro's typeof-preserved 32-bit arithmetic to wrap the computed size to zero, causing kfd_queue_buffer_get() to skip its exact-size check and accept an undersized buffer object. No public exploit has been identified and this is not in CISA KEV; EPSS stands at 0.17% (6th percentile), reflecting very low in-the-wild exploitation probability despite a CVSS 7.8 score.
Concurrent event manipulation during CRIU checkpointing in the Linux kernel's AMD GPU driver (drm/amdkfd) exposes a race condition leading to heap out-of-bounds writes or use-after-free memory corruption. A low-privileged local attacker on a system with an AMD GPU can exploit the unprotected gap between the event count and IDR walk in kfd_criu_checkpoint_events() by racing event creation or destruction from a second thread within the same process, producing kernel heap corruption primitives exploitable for local privilege escalation. No public exploit code and no CISA KEV entry have been identified at time of analysis; EPSS is 0.17% (6th percentile), reflecting low current adversary interest despite the high C:H/I:H/A:H CVSS impact triad.
Out-of-bounds kernel memory read in the Linux kernel's vmwgfx DRM driver exposes systems running VMware-virtualized graphics to local privilege escalation or sensitive information disclosure. The flaw in vmw_cmd_draw() allows a low-privilege local user to supply a crafted DRAW_PRIMITIVES command stream header with an undersized size field, triggering unsigned integer underflow that produces a near-4 GiB loop bound and causes the kernel to dereference memory far beyond the allocated command bounce buffer. Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6); no active exploitation has been confirmed and the vulnerability is not listed in CISA KEV.
Pointer underflow in the VMware graphics driver (drm/vmwgfx) of the Linux kernel enables local low-privileged users to perform a TOCTOU attack on the DMA command stream inside a bounce buffer, allowing one crafted command to overwrite authenticated fields (GMR id, surface id) of a previously verified command. This bypasses kernel command authentication and can lead to unauthorized access to graphics memory regions or escalated privileges within a VMware guest. EPSS is 0.17% (6th percentile) and the vulnerability is not listed in CISA KEV, suggesting no confirmed widespread exploitation at the time of analysis.
Race condition in the Linux kernel's drm/xe Intel GPU driver allows a locally-authenticated user to schedule a GPU job that executes concurrently with an in-flight kernel memory management operation on an external buffer object, violating the DMA_RESV_USAGE_KERNEL cross-driver synchronization contract. Affected systems are those running Linux 6.8 or later with compatible Intel Xe-architecture GPU hardware and the xe driver loaded; the race can result in reading or writing memory that is simultaneously being evicted or relocated. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV), consistent with the low EPSS score of 0.17% at the 6th percentile.
Heap overflow in the Linux kernel ASoC SOF IPC3 control subsystem allows a local low-privileged user to write past the end of a kernel heap allocation and over-read adjacent heap memory via the ALSA TLV kcontrol interface. The root cause is an off-by-offset bounds check in `bytes_ext_put` and `bytes_ext_get` that compared user-supplied lengths against the full allocation size rather than the actual payload capacity at `cdata->data`, enabling up to `sizeof(struct sof_ipc_ctrl_data)` bytes of out-of-bounds write and disclosure. Patched versions are confirmed across multiple stable branches (6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2-rc1); no public exploit or active exploitation has been identified at time of analysis.
Heap buffer overflow in the Linux kernel ASoC SOF IPC3 audio subsystem allows a local low-privilege attacker to write past an allocated buffer via a missing bounds check in `snd_sof_update_control()`, potentially enabling kernel memory corruption, privilege escalation, or system crash. Affected systems span Linux 5.18 through multiple stable branches (6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x) on hosts with Intel SOF-capable audio DSP hardware. No public exploit is known and EPSS is low at 0.21%, but the CVSS 7.8 score reflects the severity of the potential kernel-level impact once local access is obtained.
Use-after-free in the Linux kernel netfilter nf_queue subsystem allows a local attacker with bridge networking and NFQUEUE configured to corrupt kernel memory, potentially escalating privileges to root. The flaw arises because NFQUEUE upgrades a no-reference bridge fake dst to a real dst reference via skb_dst_force(), but the bridge device can complete teardown before the queued packet receives its verdict, leaving dst_release() operating on freed memory belonging to netdev_priv(br->dev). No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, CVSS rates it 7.8 HIGH with full confidentiality, integrity, and availability impact, consistent with kernel-level use-after-free primitives.
NULL pointer dereference in the Linux kernel netfilter nft_fib subsystem crashes the kernel when a FIB expression is placed in a netdev egress base chain, enabling denial of service against any system carrying that configuration. The root cause is a hook namespace collision where NF_NETDEV_EGRESS aliases NF_INET_LOCAL_IN numerically, causing nft_fib_validate() to incorrectly approve egress chain placement and then dereference nft_in(pkt) - which is NULL on the transmit path. No public exploit exists and EPSS is 0.21% (11th percentile), but systems running custom nftables egress FIB rules are at immediate kernel crash risk until patched.
Null pointer dereference in the Linux kernel's netfilter SIP connection tracking helper (nf_conntrack_sip) can crash the kernel when the non-default sip_external_media=1 module parameter is active and SIP traffic traverses tc ingress or OpenVSwitch paths. Successful exploitation causes a complete availability loss (kernel panic/crash), satisfying the CVSS A:H rating. No public exploit code has been identified and EPSS sits at the 11th percentile, indicating low observed exploitation activity despite the high base score.
Out-of-bounds write in the Linux kernel's netfilter nft_set_pipapo component allows a local low-privileged attacker to corrupt kernel memory and potentially escalate to root. When memory allocation fails during cloning of an nft_pipapo_match structure inside a netfilter batch transaction, the clone can enter an inconsistent state - with mismatched lookup table sizes, toggled bits, or an undersized scratch map - and that corrupted clone can persist into the next transaction where a subsequent set insertion triggers an out-of-bounds write. No public exploit has been identified at time of analysis, and EPSS at 0.21% (11th percentile) indicates low predicted exploitation probability despite the high CVSS score of 7.8.
Memory-safety flaw in the Linux kernel's netfilter SIP NAT helper (net/netfilter/nf_nat_sip.c) allows a stale, freed data pointer to be used after skb_ensure_writable() reallocates a cloned socket buffer, potentially corrupting kernel memory or crashing the host when SIP connection tracking and NAT are active. The bug affects systems using the nf_nat_sip application-layer gateway; because SIP conntrack linearizes SKBs, only clones (not fragments) trigger it, and a secondary error path could invoke UDP mangling on a TCP stream. No public exploit is identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not in CISA KEV.
Netfilter IPv6 fragment reassembly in the Linux kernel incorrectly advances the sk_buff MAC header offset on the NF_INET_LOCAL_OUT path, where no link-layer header exists, causing a u16 integer wrap that leaves the MAC header pointer aimed at kernel headroom. All Linux kernels from version 2.6.15 through the stable-branch patch releases (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5) are affected when the nf_conntrack_ipv6 module is loaded. A local low-privilege attacker can send crafted IPv6 fragmented packets to trigger the vulnerable reassembly code path, potentially achieving information disclosure of kernel memory or a kernel panic; no public exploit or active exploitation has been identified at time of analysis.
Incorrect route selection in the Linux kernel's netfilter flowtable IPIP-encapsulation offload path causes the headroom and IP fragment-offset (iph->frag_off) to be computed from the reverse-direction dst instead of the current direction when pushing the IPIP header. Affecting kernel 6.19 and development branches through the 7.x line, the flaw can lead to malformed encapsulated packets and potential memory/headroom mishandling in the fast-path offload; it is tagged as information disclosure. The input CVSS of 9.8 (RCE-grade) is a CNA auto-score that overstates a config-dependent packet-handling bug, and EPSS is low at 0.20% (10th percentile) with no public exploit or KEV listing.
Denial of service in the Linux kernel netfilter flowtable subsystem allows a crash in the tunnel transmit path when IPIP tunnel offload is combined with a direct-xmit device such as a bridge. Because no dst_entry is supplied, the code performs invalid dst usage while checking skb headroom and setting iph->frag_off, leading to a kernel crash. Rated CVSS 9.8 by automated scoring, but vendor tags classify it as Denial Of Service; EPSS is 0.20% (10th percentile), it is not in CISA KEV, and no public exploit was identified at time of analysis.
Connection limit bypass in the Linux kernel's netfilter nf_conncount subsystem allows network-reachable attackers to exhaust host resources by exploiting incorrect zone direction bitmask handling in tuple deduplication. The bug in __nf_conncount_add() conflates the u8 zone direction bitmask (NF_CT_ZONE_DIR_ORIG=1, NF_CT_ZONE_DIR_REPL=2, NF_CT_DEFAULT_ZONE_DIR=3) with the ip_conntrack_dir enum (IP_CT_DIR_ORIGINAL=0, IP_CT_DIR_REPLY=1), causing non-default directional zones to be erroneously treated as equivalent and bypassing per-connection counting. No active exploitation is confirmed (EPSS 0.22%, 13th percentile); upstream fixes have been committed across multiple stable kernel branches.
Local privilege escalation in the Linux kernel's GPU buddy memory allocator (gpu/buddy) allows a low-privileged authenticated local user to exploit a misalignment logic error in the try_harder contiguous fallback path, achieving high confidentiality, integrity, and availability impact (CVSS 7.8). The defect, introduced at commit 0a1844bf0b532d84324453374ad6845f64066c28, caused the allocator to return candidate blocks whose start offsets were not aligned to the caller's min_block_size, violating allocation invariants on both the RHS and LHS paths. No public exploit identified at time of analysis; EPSS exploitation probability is 0.21% (11th percentile), consistent with low near-term exploitation likelihood.
SELinux mandatory access control bypass in the Linux kernel allows local low-privilege users to circumvent connect-related network policy enforcement by initiating TCP connections via TCP Fast Open (MSG_FASTOPEN). The kernel's SELinux LSM hook for socket_sendmsg() was never updated to invoke selinux_socket_connect() when the MSG_FASTOPEN flag is passed, meaning connections using this path skip SELinux policy checks entirely. With a CVSS 8.4, Scope Changed, and confirmed patches across six stable branches, this is a meaningful MAC bypass in SELinux-enforcing environments - no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile).
NULL pointer dereference in the Linux kernel's SELinux `selinux_sctp_bind_connect()` hook crashes affected systems when SCTP ASCONF chunks are processed via the softirq path, where no file reference guarantees `sk->sk_socket` is non-NULL. Systems running Linux kernel 4.17 through current mainline with SELinux enforcing and SCTP active are vulnerable; patched stable releases exist at 6.12.97, 6.6.148, 6.18.40, 7.1.5, and 7.2-rc3. No public exploit has been identified and EPSS sits at 0.21%, but the unauthenticated network-reachable attack path warrants prompt patching on SCTP-exposed infrastructure.
Weakened AMD SEV-SNP memory-integrity enforcement in the Linux kernel results from a race between WBINVD IPIs and dirty-cacheline migration that can leave Reverse Map Table (RMP) memory with un-flushed dirty cache lines when SNP_INIT_EX is invoked with INIT_RMP=1, violating SNP firmware requirement (spec section 8.8). Affected are Linux 7.1 hosts that had adopted commit 99cf1fb58e68 (which dropped the pre-SNPEn WBINVD); the fix reverts that change so wbinvd_on_all_cpus() again runs before setting MSR_AMD64_SYSCFG_SNP_EN, while the RMP is not yet in use. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not CISA KEV-listed.
Use-after-free in the Linux kernel's batman-adv mesh networking driver allows adjacent unauthenticated attackers to achieve kernel memory corruption with potential for code execution, information disclosure, or denial of service. The flaw exists in batadv_interface_rx(), where pskb_may_pull() may reallocate the socket buffer during RX processing - the VLAN header pointer was correctly refreshed post-reallocation, but the ethernet header pointer was not, leaving a dangling reference used subsequently in Translation Table and AP isolation logic. EPSS is low at 0.22% (13th percentile) and no CISA KEV listing exists, limiting real-world risk primarily to environments actively running batman-adv mesh deployments. Vendor-released patches are confirmed across multiple stable kernel branches.
Use-after-free in the Linux kernel's batman-adv mesh networking module (net/batman-adv unicast path) occurs because the unicast_packet pointer is not reassigned after pskb_may_pull() inside batadv_get_vid() may reallocate the socket buffer, leaving a stale pointer into freed memory. Systems running batman-adv B.A.T.M.A.N. advanced mesh routing are affected across a wide range of stable kernel series. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.22%, 13th percentile).
Use-after-free in the Linux kernel's batman-adv Bridge Loop Avoidance (BLA) subsystem allows an unauthenticated attacker on the same Layer 2 network segment to corrupt kernel memory, potentially achieving arbitrary code execution or system crash. The flaw originates from pskb_may_pull() silently reallocating the socket buffer during backbone gateway processing in batadv_bla_is_backbone_gw(), leaving cached gateway address pointers dangling against the freed old buffer. Affected kernels span from commit 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 (approximately Linux 4.12) through multiple stable branches; patches are available across all active stable series. No public exploit or CISA KEV listing exists at time of analysis, and the very low EPSS of 0.22% (13th percentile) reflects the niche deployment footprint of batman-adv BLA.
Out-of-bounds buffer read in the Linux kernel's batman-adv (batadv) mesh networking driver allows a local user with eBPF TC hook access to trigger reads beyond allocated packet buffer boundaries inside batadv_interface_tx(). The vulnerability spans many stable kernel series from 2.6.38 through pre-patch releases of 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, and 7.1 branches. No public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), though the high CVSS impact metrics (C:H/I:H/A:H) reflect potential for kernel heap memory disclosure or corruption if the out-of-bounds read extends into sensitive kernel state.
Request storm vulnerability in the Linux kernel's batman-adv mesh networking subsystem (B.A.T.M.A.N. Advanced) exposes nodes to availability degradation through an inverted boolean condition in batadv_send_tt_request(). When a send buffer allocation fails, an incorrect check (ret == true instead of ret == false) causes the tt_req_node tracking structure to be retained rather than cleaned up, breaking the de-duplication mechanism that prevents simultaneous TT requests to the same originator. The result is that repeated, redundant translation table requests can flood a mesh peer - a request storm - degrading availability of nodes on the batman-adv overlay. No public exploit code exists and EPSS exploitation probability is very low (0.22%, 13th percentile); no active exploitation is confirmed.
Out-of-bounds read in the Linux kernel's batman-adv multicast tracker exposes adjacent-network unauthenticated attackers to kernel memory disclosure or denial-of-service via a crafted TVLV mcast tracker packet. The root cause is a C macro misuse - offsetof() on the first struct member always evaluates to 0, making the bounds check a no-op that permits access to num_dests even when only 0 or 1 byte is in the received packet instead of the required 2. EPSS is 0.21% (11th percentile), no CISA KEV entry exists, and no public exploit is identified; vendor-released patches are available in Linux 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3.
Integer-overflow-driven out-of-bounds access in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh networking module allows a node on the same mesh to corrupt translation-table processing via a crafted TT unicast TVLV. The VLAN count (u16) multiplied by the 8-byte batadv_tvlv_tt_vlan_data size overflows the u16 length variable, defeating every downstream bounds check that guards the TVLV buffer. This is a fixed, patched kernel bug with a low EPSS (0.22%, 13th percentile) and no public exploit identified at time of analysis; it is not listed in CISA KEV.
Integer underflow in the Linux kernel's jbd2 journaling subsystem corrupts critical journal metadata, aborting the filesystem journal and rendering affected ext4 volumes unavailable. Local, low-privileged attackers on unpatched systems running ext4 with the fast-commit feature can trigger the arithmetic wraparound in jbd2_journal_initialize_fast_commit() to corrupt j_last, j_fc_first, and j_free, with CVSS scoring this at 7.8 (AV:L/AC:L/PR:L). No public exploit code has been identified and CISA KEV listing is absent, with EPSS at 0.22% (14th percentile), but the breadth of the patch set across six stable kernel branches signals meaningful engineering priority across the fleet.
Use-after-free in the Linux kernel's sunrpc server-side TLS handshake path (svc_tcp_handshake/svc_sock) allows the asynchronous tlshd handshake-completion callback to write through a freed struct svc_sock, corrupting slab memory on any NFS server configured for RPC-with-TLS. Two close-versus-cancel races let svc_sock_free() kfree() the socket while svc_tcp_handshake_done() is still updating xpt_flags and walking the embedded wait queue, yielding an attacker-influenceable slab-corruption primitive rather than a benign read. No public exploit identified at time of analysis and EPSS is low (0.20%), but the fix is upstream in stable kernels.
Kernel-side race condition in the Linux SUNRPC server's TLS handshake path (svc_tcp_handshake) allows a lost cancellation race to corrupt an embedded swait_queue or prematurely tear down a succeeding handshake, leading to kernel memory corruption or connection instability on NFS/RPC servers using RPC-with-TLS. Affects servers that terminate kernel RPC TLS sessions; it is a resolved upstream kernel bug with no public exploit and a very low EPSS (0.21%, 11th percentile), and it is not in CISA KEV. Despite the NVD-propagated 9.8 rating typical of auto-generated kernel CVEs, the practical impact is a narrow timing window affecting availability/state integrity rather than turnkey remote code execution.
Memory-corruption (double-free / use-after-free) in the Linux kernel's SunRPC server layer allows the rq_procinfo->pc_release hook to fire against stale, reused request state when a worker thread hits an early error path (unsupported protocol, short frame, or bad auth) before a valid procinfo is installed. It affects Linux 6.18 (and the shared SunRPC code reachable via kernel RPC servers such as nfsd), and successful triggering corrupts kernel heap state, risking denial of service or privilege escalation. The issue is patched upstream; there is no public exploit identified at time of analysis and EPSS is low (0.21%), so it is not currently known to be exploited.
Out-of-bounds slab write in the Linux kernel SUNRPC layer (xdr_buf_to_bvec()) lets a remote NFS client corrupt kernel memory via the in-kernel NFS server (nfsd) write path. The function stores a bio_vec into the caller's rq_bvec array before verifying the slot is in range - and the head branch stores with no check at all - so when the exactly-sized rq_maxpages budget is used up, one bio_vec lands past the array into adjacent slab memory, with attacker-influenced bv_len and bv_offset values taken from client-supplied RPC payload sizes. Rated CVSS 9.8 by the source, but with low EPSS (0.21%), no CISA KEV listing, and no public exploit identified at time of analysis.
Page-counter underflow in Linux kernel's hugetlb cgroup accounting allows a local low-privileged user to corrupt memory accounting state, causing integrity and availability impacts on affected systems. The flaw exists in alloc_hugetlb_folio() where a shared h_cg pointer is overwritten during sequential rsvd and non-rsvd hugetlb cgroup charges, causing the wrong cgroup to be committed to the folio's reserved slot. When the folio is freed, the mismatched uncharge path decrements a counter on a cgroup that was never charged, triggering a page_counter underflow (WARNING: mm/page_counter.c:61). No public exploit exists and EPSS sits at 0.21% (11th percentile), but the flaw affects a broad swath of kernel versions from 5.7 onward.
Filesystem consistency flaw in the Linux kernel NTFS driver's ntfs_ir_reparent() index-root reparenting path allows a transient on-disk/in-memory layout that $INDEX_ROOT validation rejects as corrupt, surfacing as generic/013 xfstests failures and ntfsck 'Corrupt index root' errors. The bug is a metadata-ordering error triggered during NTFS write operations that grow an index root and hit -ENOSPC, not a remotely exploitable memory-safety issue; no public exploit identified at time of analysis and it is not in CISA KEV. Fixed in stable 7.1.5 and mainline 7.2-rc1.
Out-of-bounds read in the Linux kernel's NTFS driver (ntfs_mapping_pairs_decompress) lets a crafted NTFS attribute record trigger a one-byte read past the attribute boundary. It stems from off-by-one bounds checks that use strict greater-than instead of >=, so mapping-pair data extending exactly to attr_end passes validation and buf[b] reads one byte too far. No public exploit is identified at time of analysis, EPSS is low (0.20%), and it is not on CISA KEV; exploitation requires the kernel to parse an attacker-controlled NTFS volume.
Out-of-bounds kernel memory read in the legacy NTFS filesystem driver of the Linux kernel (affecting builds derived from commit 6ceb4cc8 up to the 7.1.x and 7.2-rc series) occurs when the driver parses a crafted NTFS image whose $FILE_NAME attribute declares a small resident value_length but an oversized file_name_length. Callers trust file_name_length and read past the resident attribute value during name conversion/comparison, producing a slab-out-of-bounds read confirmed under KASAN from the kmalloc-1k MFT record copy. There is no public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and despite the source-assigned 9.8 CVSS this is a local filesystem-parsing bug rather than a remote-unauthenticated flaw.
Out-of-bounds read in the Linux kernel's NTFS driver allows a local attacker to leak adjacent kernel memory or crash the system by parsing extended attribute (EA) entries on a crafted NTFS volume. The ntfs_ea_lookup and ntfs_listxattr routines dereferenced the next_entry_offset field of an EA entry without first verifying that enough space remained in the buffer. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is tagged as Information Disclosure rather than code execution.
On-disk NTFS metadata corruption in the Linux kernel's NTFS3 driver arises because ntfs_resident_attr_resize() may select zero-length resident $DATA attributes when converting attributes to non-resident to free MFT record space, producing 0-byte non-resident $DATA that fsck flags as filesystem corruption. The flaw affects Linux systems writing to NTFS volumes and is a data-integrity/consistency defect rather than a memory-safety or remote-code issue; it is fixed in stable 7.1.5 and 7.2-rc1. There is no public exploit identified at time of analysis, EPSS probability is low (0.20%, 10th percentile), and it is not listed in CISA KEV. The published CVSS of 9.8 (network vector) is not consistent with a local filesystem write path and appears to be an automated over-assessment.
Out-of-bounds access in the Linux kernel's legacy NTFS filesystem driver arises from insufficient validation of INDEX_HEADER geometry within INDX directory-index blocks; a crafted NTFS volume can drive ntfs_lookup_inode_by_name() to read past block boundaries. The fix hardens ntfs_index_block_inconsisent() to strictly validate index-block header fields before use, affecting systems that mount attacker-controlled NTFS media. There is no public exploit identified at time of analysis, KEV does not list it, and EPSS is low (0.20%, 10th percentile), consistent with a filesystem-parsing bug that requires a malicious volume rather than remote reach.
Inconsistent $INDEX_ROOT attribute header validation in the Linux kernel's legacy ntfs filesystem driver exposes systems to potential kernel-level memory corruption when processing maliciously crafted NTFS volumes. Kernel versions from the initial NTFS implementation through 7.1.4 stable are affected across both directory inode and named index inode read paths, with fix releases confirmed at 7.1.5 stable and 7.2-rc1 mainline. No public exploit has been identified at time of analysis, and EPSS exploitation probability is 0.20% (10th percentile), though the CVSS 8.4 High score reflects the theoretical severity of kernel-space memory corruption if the vulnerability is successfully reached.
Deadlock in the Linux kernel NTFS driver allows local users with write access to an NTFS-mounted volume to render the system completely unresponsive by triggering an ABBA lock ordering race between concurrent VFS writeback paths. The vulnerability affects kernels since commit 6994acf33bae and manifests when inode writeback (acquiring extent_lock then mrec_lock) races with MFT folio writeback (holding mrec_lock while attempting extent_lock). No active exploitation has been confirmed - EPSS places this at the 10th percentile (0.20%) - reflecting the narrow real-world surface: production Linux systems rarely mount NTFS volumes. Patches are available in Linux 7.1.5 and 7.2-rc1.
Indefinite thread blocking in the Linux kernel's NTFS driver can cause a local denial of service on systems mounting NTFS volumes under memory pressure. Specifically, `get_nr_free_clusters()` and `__get_nr_free_mft_records()` allocate heap memory for a readahead state structure; if that allocation fails, neither `NVolFreeClusterKnown()` is set nor `vol->free_waitq` is woken, leaving any waiting kernel thread blocked indefinitely. Kernels prior to 7.1.5 and 7.2-rc1 are affected; no public exploit has been identified and EPSS is 0.20% (10th percentile).
Improper validation of NTFS index entries in the Linux kernel's NTFS filesystem driver allows a crafted or corrupted NTFS volume to be processed without adequate bounds checking during index root and index block reads. When an attacker-controlled NTFS image is mounted and traversed (lookup/readdir), missing per-read validation can lead to out-of-bounds memory access, enabling information disclosure or a kernel crash. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is not on the CISA KEV list.
Signed-integer overflow in the Linux kernel NTFS driver's mapping-pairs runlist parser lets a crafted or corrupted NTFS volume redirect logical-to-physical cluster mappings to unintended disk locations. The flaw affects the kernel's NTFS attribute parsing when it accumulates relative LCN deltas; a malicious runlist can set the accumulator to S64_MAX and add 1, triggering undefined behavior that resolves runs to a different set of physical clusters. Fixed upstream in Linux 7.1.5 and 7.2-rc1; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.20%).
Out-of-bounds memory access in the Linux kernel NTFS driver arises because resident $INDEX_ROOT attribute headers are consumed after lookup without fully validating their layout invariants. Affected are Linux kernels prior to the 7.1.5 and 7.2-rc1 stable fixes when mounting or accessing an attacker-crafted NTFS volume; unchecked entries_offset, index_length, and allocated_size fields let a malformed filesystem drive reads beyond the resident value, tagged upstream as Information Disclosure. This is not actively exploited (no CISA KEV entry) and EPSS is low at 0.20%, with no public exploit identified at time of analysis, though upstream stable commits are available.
The legacy NTFS driver in the Linux kernel fails to reject non-resident attribute records for attribute types contractually required to be resident, creating resident/non-resident union confusion paths in multiple critical code locations. Affected callers - including inode loading ($STANDARD_INFORMATION), volume flag updates ($VOLUME_INFORMATION), and directory traversal ($INDEX_ROOT) - read data.resident.value_offset directly without first verifying the a->non_resident flag, potentially acting on the wrong union member when a crafted or corrupted NTFS image is mounted. A local attacker with standard user privileges can exploit this to trigger kernel memory corruption or information disclosure; no active exploitation is confirmed (EPSS 0.20%, not in CISA KEV), and patches are available in Linux 7.1.5 and 7.2-rc1.
Linux kernel's ntfs3 filesystem driver crashes and may corrupt memory when processing a crafted NTFS image due to an unbounded memmove in the DeleteIndexEntryAllocation code path. Any local user able to mount a malformed NTFS volume can trigger a kernel oops through a negative ptrdiff_t silently cast to a near-maximal size_t, causing memmove to walk far past the destination buffer. No public exploit and no CISA KEV listing exist at time of analysis; EPSS is low at 0.21%, but the memory corruption primitive and local-to-kernel boundary crossing make this a meaningful privilege escalation and availability risk on systems where unprivileged NTFS mounts are possible.
Slab-out-of-bounds write in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3) is triggered during the log_replay() analysis pass when mounting a malformed NTFS3 volume. The copy_lcns loop lacks bounds enforcement against dp->lcns_follow, so a crafted LRH entry with target_vcn set to dp->vcn + dp->lcns_follow - 1 and lcns_follow greater than 1 overflows the heap-allocated page_lcns[] array, corrupting kernel memory. Confirmed by KASAN on mainline kernel 8d90b09e6741 with a slab-out-of-bounds write of size 8 at log_replay+0x68d4; no public exploit exists and EPSS stands at 0.21%, though the CVSS score of 8.4 reflects the full confidentiality, integrity, and availability impact of kernel heap corruption.
Integer underflow in the ntfs3 filesystem driver's journal replay logic (`fs/ntfs3/fslog.c`) allows a local attacker with low privileges to corrupt the resident attribute data size to approximately 4 GiB, enabling out-of-bounds kernel memory reads up to 4 GiB beyond a 1024-byte MFT record allocation. Exploitation requires mounting or processing a crafted NTFS image with specially crafted Log Record Header values - on distributions with unprivileged user namespaces enabled (Ubuntu, Fedora, and others), this is achievable without elevated privileges. No public exploit code has been identified and the vulnerability is not in CISA KEV; EPSS stands at 0.21% (12th percentile), and patches are confirmed available across multiple stable kernel branches.
Denial-of-service in the Linux kernel ntfs3 driver lets an attacker with the ability to mount a crafted NTFS image panic the system via unbounded recursion. indx_find_buffer() descends the NTFS B+ tree index with no depth limit, so a circular index-node reference overflows the kernel stack when a file deletion hits the index rebalancing fallback path. No public exploit is identified and it is not in CISA KEV; EPSS is low at 0.23%. Note that the supplied CVSS 9.8/AV:N vector is inconsistent with the description, which requires local access to attach a malicious filesystem.
Heap out-of-bounds write in the Linux kernel's ntfs3 filesystem driver lets a local user corrupt kernel slab memory by mounting and accessing a crafted NTFS image. When indx_insert_into_root() promotes a full resident $INDEX_ROOT into $INDEX_ALLOCATION, hdr_insert_head() copies resident entry bytes ('to_move') sized from on-disk data into a destination buffer sized from an attacker-shrunk root->index_block_size, writing 120-136 bytes of attacker-controlled data past a kmalloc allocation. The flaw is fixed across multiple stable trees; there is no public exploit identified at time of analysis and EPSS is low (0.21%), and despite the NVD CVSS of 9.8 the described trigger is local rather than network-reachable.
Out-of-bounds kernel write in the Linux kernel's ntfs3 filesystem driver allows a local attacker to corrupt kernel memory and panic the system by mounting a crafted NTFS image and performing a single directory operation. The flaw lives in indx_insert_into_buffer(), where an unvalidated split-point size from hdr_find_split() causes a u32 subtraction underflow and a near-4-GiB memmove. A vendor fix is available across multiple stable branches; EPSS is low (0.21%) and no public exploit is identified at time of analysis, though the trigger is trivial (a 'touch' on a mounted attacker-supplied image).
Improper validation of on-disk metadata in the Linux kernel's legacy NTFS driver allows a crafted NTFS filesystem image to smuggle an error-marked MFT (Master File Table) reference back through ntfs_lookup_inode_by_name(), causing directory-lookup callers to misinterpret corrupted disk data as a legitimate pseudo-errno. This affects systems that mount attacker-supplied NTFS volumes; there is no public exploit identified at time of analysis and the EPSS probability is low (0.20%). The upstream fix normalizes any error-marked reference to ERR_MREF(-EIO) so callers can no longer be tricked into consuming a bogus value.
Local volume corruption and a writeback deadlock affect the Linux kernel NTFS driver (fixed in 7.1.5 and 7.2-rc3) when a filesystem is mounted with the non-default show_sys_files option and userspace writes to an exposed base metadata file such as $Bitmap; because the cluster allocator scans $Bitmap through the same inode page cache, the write both corrupts the volume and deadlocks writeback against an already-locked folio. Only affected when the opt-in show_sys_files mount option is set, so this is a local integrity/availability issue rather than a remote one. There is no public exploit identified at time of analysis, EPSS is 0.20% (10th percentile), and it is not in CISA KEV.
Memory-safety flaw in the Linux kernel's legacy NTFS (read) driver lets a crafted NTFS filesystem image bypass a resident/non-resident attribute check in ntfs_map_runlist_nolock(). When the driver expects a non-resident attribute during mount, an attacker-supplied image can substitute a resident attribute; the code previously only flagged this with a non-fatal WARN_ON() and then read a->data.non_resident.highest_vcn from the wrong union member, corrupting the VCN range check. The fix replaces WARN_ON() with an -EIO return so the malicious image is rejected at mount. There is no public exploit identified at time of analysis, and EPSS is low (0.22%).
Landlock SCOPE_SIGNAL enforcement in the Linux kernel can be bypassed by a sandboxed process via the asynchronous SIGIO delivery path, allowing it to send arbitrary signals - including SIGKILL - to processes outside its Landlock domain such as supervisors or security monitors. The flaw exists because hook_file_send_sigiotask() evaluates the Landlock domain recorded at F_SETOWN time rather than the live sender domain, and control_current_fowner() incorrectly skips domain recording when a single member of the target process group (PIDTYPE_PGID) shares the caller's thread group, leaving the remaining group members unchecked at delivery. No public exploit code exists and EPSS is 0.22% (13th percentile), but the impact is significant for environments relying on Landlock as a containment boundary.
Memory corruption in the Linux kernel's MIPS scheduler corrupts kernel pointer state when CONFIG_CPUMASK_OFFSTACK is enabled, enabling local privilege escalation to root. Two compounding flaws exist: sizeof(new_mask) resolves to the pointer width (4-8 bytes on MIPS) rather than the actual cpumask buffer size, causing copy_from_user() to overwrite the mask pointer with user-controlled bytes; and the original code invoked copy_from_user() prior to allocating the mask buffer, creating a write-before-allocation primitive. CVSS 7.8 with AV:L/AC:L/PR:L/UI:N reflects straightforward local exploitation on affected MIPS systems, though EPSS at 0.21% (12th percentile), no CISA KEV listing, and no public exploit code indicate limited real-world exploitation activity at time of analysis.
Race condition in the Linux kernel's HugeTLB page table protection code allows a local low-privileged user to corrupt page tracking state or leak memory access metadata. Specifically, make_uffd_wp_huge_pte() in fs/proc/task_mmu.c invokes huge_ptep_modify_prot_commit() on a PTE snapshot captured without the preceding huge_ptep_modify_prot_start() atomic clear, creating a window where hardware can set Dirty or Accessed bits between the read and commit, which are then silently overwritten with stale values. EPSS is 0.21% (11th percentile) and no active exploitation has been confirmed - this is a correctness/integrity fix in the kernel stable queue, not a commonly weaponized class of vulnerability.
Uninitialized struct page corruption in the Linux kernel's ZONE_DEVICE memory subsystem exposes systems with DAX/persistent memory hotplug to kernel memory corruption. When DAX memory is hotplugged into an unoccupied subsection of an early section, section_activate() reuses the unoptimized boot memmap while compound_nr_pages() incorrectly assumes vmemmap optimization is active, initializing fewer struct pages than the memory region actually contains. The resulting uninitialized tail struct pages can cause crashes or, under adverse conditions, kernel memory corruption with high confidentiality, integrity, and availability impact per the CVSS 7.8 rating. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.21% (11th percentile).
Kernel memory corruption in the Linux kernel's MTD slram driver stems from a link-before-initialize race in `register_device()`, where new `slram_mtdlist` entries are inserted into the global device list before all required state (memory allocation, `memremap()`, and `mtd_device_register()`) is fully committed. When any of these subsequent operations fail, the partially initialized entry persists on the list, and later cleanup code dereferences or frees invalid kernel memory - enabling potential local privilege escalation from low-privileged access to full kernel compromise. EPSS is 0.22% (13th percentile), no CISA KEV listing exists, and no public exploit has been identified at time of analysis, collectively indicating low near-term exploitation likelihood despite the high CVSS score of 7.8.
The 9p filesystem client (v9fs) in the Linux kernel incorrectly invokes drop_nlink() on inodes whose nlink counter is already zero in cacheless mode, producing a kernel WARN_ON under concurrent unlink workloads. The race arises because cacheless mode delegates authority to the server: after the server processes an unlink and sets nlink to 0, the client refetches that metadata before its own v9fs_dec_count() executes, resulting in a decrement of an already-zero counter. No public exploit exists and EPSS is 0.21%, placing this firmly in patch-cycle rather than emergency response territory.
Out-of-bounds memory access in the Linux kernel MTD raw NAND subsystem allows a local low-privilege user to corrupt or read kernel memory via an improper bounds check in `nand_select_target()`, where the chip-select index `cs` is not validated against `nanddev_ntargets()`. Affected systems span Linux 5.2 through current stable branches across multiple LTS lines; patched releases are available. No public exploit code exists and the vulnerability is not listed in CISA KEV, with EPSS at 0.22% (13th percentile), indicating low real-world exploitation probability despite the high CVSS score of 7.8.
The OCFS2 extent-move ioctl (OCFS2_IOC_MOVE_EXT) in the Linux kernel permits a local user with write access to an OCFS2-mounted filesystem to trigger cross-inode data corruption and information disclosure by supplying a crafted physical goal cluster that an uninitialized probe output allows to survive a failed scan. Affected kernel versions span from approximately Linux 3.0 (commit e6b5859cccfa0fec) through all stable branches prior to the fix releases in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit has been identified at time of analysis, and EPSS probability is 0.22% (13th percentile), consistent with a subsystem-specific kernel bug requiring deliberate targeting.
Unbounded array indexing in the ocfs2 filesystem's ocfs2_sum_rightmost_rec() function causes UBSAN-detected kernel panic or memory corruption when a file write targets an inode whose embedded extent list has been corrupted on-disk. Linux kernels prior to 6.18.40 (stable 6.x branch) and 7.1.5 (7.x branch) are affected on any system mounting an ocfs2 volume. No public exploit has been identified at time of analysis and EPSS probability sits at 0.21% (11th percentile), reflecting realistically constrained exploitability due to the required on-disk corruption precondition.
OCFS2 cluster filesystem dinode validation in the Linux kernel fails to reject inodes with non-canonical i_mode type bits, allowing forged on-disk metadata to propagate into in-core kernel inode structures. Affected kernels accept any non-zero i_mode value and pass it verbatim into ocfs2_populate_inode(), where an unrecognized S_IFMT type falls through to ocfs2_special_file_iops and init_special_inode() - a code path not designed for arbitrary mode inputs. No public exploit has been identified at time of analysis and EPSS sits at only 0.22%, but the kernel-level impact (C:H/I:H/A:H) and the shared-storage attack surface of OCFS2 clusters warrant priority patching on affected systems.
Memory corruption in the Linux kernel's ThunderboltIP receive path allows an adjacent unauthenticated attacker to overflow the skb frags[] array by sending a crafted multi-frame packet with 19 or more small frames. The insufficient frame_count bound in tbnet_check_frame() (capped at TBNET_RING_SIZE/4 = 64) far exceeds MAX_SKB_FRAGS (17), causing skb_add_rx_frag() to write past the frags[] array and corrupt kernel memory. EPSS is low (0.21%, 11th percentile), no public exploit exists, and CISA KEV confirmation is absent, but CVSS 8.8 reflects the severity of kernel memory corruption once Thunderbolt physical access is achieved.
Cache coherency corruption in the Linux kernel's OpenRISC architecture jump_label implementation leaves instruction cache lines on remote SMP cores stale after static key updates, meaning security-relevant kernel branches may execute the wrong code path indefinitely on affected multi-core OpenRISC systems. The flaw originates in commit 8c30b0018f9d, which ported jump_label support from arm64 without adapting icache invalidation to OpenRISC's SMP model - `kick_all_cpus_sync()` does not guarantee a full remote icache flush on this architecture. No public exploit has been identified at time of analysis, and the 0.21% EPSS score (11th percentile) reflects the severe rarity of OpenRISC SMP hardware in production.
Use-after-free in the Linux kernel TPM subsystem's tpm_buf_append_salt() function triggers automatic kernel memory corruption on systems equipped with asynchronous KPP cryptographic hardware backends. The defect fires continuously and without any userland action - the hwrng_fillfn kernel thread invokes the vulnerable code path on every entropy poll via tpm2_get_random → tpm2_start_auth_session → tpm_buf_append_salt, causing a deferred completion worker to dereference a freed kpp_request when the async backend returns -EINPROGRESS. No public exploit has been identified at time of analysis and EPSS is 0.20% (10th percentile), but the kernel-space use-after-free carries inherent privilege escalation and denial-of-service risk on affected hardware configurations.
Tegra GPC DMA driver in the Linux kernel hangs when a client submits a transfer whose length is not evenly divisible by the channel's configured maximum burst size, resulting in a partial-burst stall that freezes the DMA channel indefinitely. The defect is confirmed in production via the PL011 UART TX DMA path on NVIDIA Tegra SoC hardware and affects kernel branches from the introducing commit ee17028009d4 through fixed stable releases spanning 6.1, 6.6, 6.12, 6.18, and 7.1 series. No public exploit code exists and no active exploitation is confirmed; EPSS of 0.21% (12th percentile) reflects the extremely low real-world exploitation probability, consistent with a hardware-specific driver defect rather than a broadly exploitable software flaw.
Race condition in the Linux kernel's DesignWare eDMA (dw-edma) driver exposes DONE_INT_MASK and ABORT_INT_MASK interrupt registers to concurrent corruption when multiple DMA channels are started simultaneously. Systems running Linux kernel versions since commit 7e4b8a4fbe2c and equipped with DesignWare eDMA hardware - common in PCIe-attached peripherals and certain SoC platforms - are affected across stable branches from 6.1 through 7.1. No public exploit has been identified and EPSS sits at 0.21% (12th percentile), consistent with a hardware-specific driver flaw; however, the kernel maintainers have shipped patches across all active stable series, and remediation should be prioritized where this DMA controller is in use.
Initialization ordering flaw in the Linux kernel's Renesas RZ DMAC driver (rz-dmac) creates a race window during driver probe where a DMA interrupt fires before channel->ch_base is assigned and before the ld_free, ld_queue, and ld_active linked-list structures are initialized, leading to invalid kernel memory access, potential kernel crashes, or memory corruption on Renesas RZ SoC-based platforms. Affected systems run Linux 5.15 through the pre-patch stable releases; fixes are available across multiple upstream stable branches (6.6.148, 6.12.101, 7.1.5, 7.2-rc1). No public exploit exists, EPSS is 0.21% (11th percentile), and this CVE is not listed in the CISA KEV catalog.
Incomplete error-path cleanup in the Linux kernel's dell-laptop platform driver exposes systems running Dell hardware to resource leak conditions that can be leveraged for privilege escalation by local low-privileged users. The dell_init() function fails to release the notifier, debugfs directory, keyboard backlight LED, and optional touchpad LED when a later initialization step fails, leaving dangling kernel object registrations. No active exploitation is confirmed (not in CISA KEV), and the EPSS score is very low at 0.20% (10th percentile), but the CVSS 3.1 score of 7.8 High with local-access C:H/I:H/A:H reflects the theoretical privilege escalation ceiling if the dangling resources are abused post-init.
Incorrect pointer usage in the Intel Speed Select Technology (ISST) platform driver causes SST-PP control registers to be restored only for power domain 0 during system resume from suspend, leaving all non-zero power domains with corrupted performance profile settings. Systems running affected Linux kernel versions (6.18.16-6.18.39, 6.19.x, 7.0) on Intel Xeon hardware with multi-domain ISST configurations will silently misconfigure CPU performance profiles after any suspend/resume cycle, leading to integrity and availability impact. EPSS is at 0.21% (11th percentile) and no active exploitation has been identified; a vendor patch is available across multiple stable branches.
Permanent I2C bus lockup in the Linux kernel i2c-imx driver (NXP i.MX SoCs) occurs when an SMBus block-read response returns a byte count of 0, a condition explicitly permitted by SMBus 3.1 specification section 6.5.7. The interrupt-driven state machine introduced in the v6.13 rework rejects count=0 with -EPROTO but critically fails to issue NACK+STOP before returning, leaving the target device holding SDA and the entire I2C bus permanently stuck until the controller is power-cycled. A secondary bug on the count > I2C_SMBUS_BLOCK_MAX error path exhibits the same failure mode. No public exploit or active exploitation is identified; vendor-released patches are available in kernel versions 6.18.40, 7.1.5, and 7.2-rc4.
Use-after-free in the Linux kernel's IPv4 TCP stack (net/ipv4/tcp_output.c) occurs when tcp_connect() reconciles conflicting TCP-MD5 and TCP-AO authentication keys on a socket that is already in TCP_SYN_SENT and hashed into the inet ehash. In the needs_ao branch, tcp_clear_md5_list() frees each tcp_md5sig_key and the md5sig_info container with bare kfree() before the RCU grace period, while softirq RX-path readers (__tcp_md5_do_lookup / __tcp_md5_do_lookup_exact) are still walking the same list under RCU, producing a per-key slab use-after-free. It affects kernels on the 6.18 line (and the described stable range) and is fixed by deferring frees with kfree_rcu; no public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile).
Kernel memory corruption (double free) in the Linux kernel's XFRM/IPsec NAT keepalive path allows a crash or potential heap exploitation when a keepalive transmission fails after the socket buffer has already been handed to the IPv4/IPv6 output stack. Introduced with the nat_keepalive feature in Linux 6.11 and affecting recent stable branches, nat_keepalive_send() incorrectly frees an skb that ip_build_and_send_pkt() or ip6_xmit() may already have consumed, producing a double free. EPSS is low (0.21%, 11th percentile), no public exploit has been identified, and it is not listed in CISA KEV; despite the auto-assigned 9.8 CVSS, realistic impact centers on denial of service and requires an IPsec NAT-traversal configuration.
Insufficient capability verification in the Linux kernel's xfrm interface changelink path allows a process holding CAP_NET_ADMIN in a device's network namespace to rewrite xfrm (IPsec transform) interface parameters belonging to a separate, distinct link namespace where it lacks authorization. Affected kernel versions span all stable branches from the introduction of xfrm_interface (commit f203b76d) through the fix commits, with patched releases confirmed at 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. No public exploit code or active exploitation has been identified; EPSS is 0.22% at the 13th percentile, reflecting low current attacker interest despite a High CVSS score driven by the cross-namespace scope change.
Out-of-bounds heap read and write in the Linux kernel TPM character device driver exposes kernel heap memory to local low-privileged users with access to /dev/tpm0 or /dev/tpmrm0. The TPM char device open handlers fail to call nonseekable_open(), leaving FMODE_PREAD and FMODE_PWRITE enabled on a device that only supports sequential command/response I/O; a pread() call with a large offset (e.g., 0x1400) passes that offset unchecked into tpm_common_read(), causing an out-of-bounds heap read via copy_to_user() and a subsequent out-of-bounds zero-write via memset(). No public exploit is identified at time of analysis, EPSS sits at 0.22% (13th percentile), and patches are available across all active Linux stable branches.
Data corruption in the Linux kernel's spi-imx driver causes SPI bus transfers to produce malformed data when DMA initialization fails and the driver incorrectly falls back to PIO mode without resetting the ECSPI hardware configuration. Systems running NXP i.MX SoCs with ECSPI DMA declared in the device tree but without the sdma-imx7d.bin SDMA firmware are deterministically and silently affected on every transfer. Downstream security-critical devices connected to the affected SPI bus - such as the Infineon SLB9670 TPM - receive corrupted responses that can prevent device initialization entirely, eliminating TPM-based security services; no public exploit has been identified at time of analysis.
Undefined behavior in the Linux kernel's spi-uniphier SPI controller driver arises from a driver probe initialization ordering defect: devm_request_irq() is called before init_completion(), leaving a race window in which an early interrupt can invoke complete() on an uninitialized kernel completion object. Systems running Socionext UniPhier SoC hardware on affected kernel versions are exposed during driver probe. No public exploit has been identified and EPSS sits at 0.22% (13th percentile), consistent with the hardware-specific nature of the flaw - practical exploitation is constrained to platforms physically equipped with UniPhier SoCs.
Heap out-of-bounds write in the Linux kernel NVMe-oF target (nvmet) DH-HMAC-CHAP authentication handler lets a remote NVMe-oF initiator corrupt kernel heap memory when in-band authentication is enabled. nvmet_execute_auth_receive() trusts the host-supplied AUTH_RECEIVE allocation length after only checking it is nonzero, so the SUCCESS1 and FAILURE1 response builders write a fixed-size DH-HMAC-CHAP message into an undersized kmalloc() buffer, producing a 16-byte OOB write from a one-byte allocation length. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.25%, 17th percentile).
Out-of-bounds read in the Linux kernel NVMe-over-Fabrics RDMA target (nvmet-rdma) allows a connected fabric host to make the target map inline data at an attacker-chosen offset, corrupting the per-command scatterlist. When a port is configured with inline_data_size greater than PAGE_SIZE, an offset in the (PAGE_SIZE, inline_data_size] range causes the 'PAGE_SIZE - off' calculation to underflow and sets sg->length to roughly 4 GiB, so the block backend reads far past the first inline page, leaking adjacent kernel memory and risking a crash. No public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile), but the flaw is patched across all maintained stable branches.
Use-after-free in the Linux kernel CAN isotp (ISO 15765-2 Transport Protocol) socket subsystem enables a local low-privileged attacker to corrupt freed kernel memory, potentially escalating privileges to root. The race arises because isotp_notify() clears so->bound via can_rx_unregister() without a subsequent RCU grace period, causing isotp_release() to skip synchronize_rcu() and cancel so->rxtimer while an in-flight isotp_rcv() callback is still executing and about to re-arm it via isotp_send_fc(). Multiple Linux stable branches from 5.10 through pre-7.2-rc4 are affected; vendor-released patches are confirmed across eight stable-tree commits. No public exploit identified at time of analysis; EPSS is 0.22% at the 13th percentile.
Use-after-free race condition in the Linux kernel CAN ISO-TP (isotp) subsystem enables a local user to corrupt kernel memory by racing isotp_release() against concurrent network device unregistration, with CVSS 7.8 reflecting full confidentiality, integrity, and availability impact on the vulnerable system. Affected kernels span the stable 5.10 tree through at least 6.18.x and 7.1.x; patched versions 6.6.148, 6.12.101, 6.18.40, 7.1.5, and 7.2-rc4 are available. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS exploitation probability is low at 0.21% (11th percentile), consistent with the narrow race window and specialized hardware prerequisites.
Race condition in the Linux kernel's CAN ISO-TP (isotp) socket subsystem allows adjacent-network attackers to corrupt TX state machine transitions, enabling kernel memory corruption with high confidentiality, integrity, and availability impact. Multiple stable branches from 5.10 onward are affected, with fixes released in kernel versions 6.6.148, 6.12.101, 6.18.40, 7.1.5, and 7.2-rc4. No public exploit code or CISA KEV entry has been identified at time of analysis, and the EPSS probability of exploitation within 30 days is 0.21% (11th percentile), consistent with the narrow, specialized conditions required.
Uninitialized GPU memory reuse in the Linux kernel's drm/vc4 driver (Broadcom VideoCore IV, used in Raspberry Pi) allows a local low-privileged user to trigger GPU hangs, corrupt GPU state, and read stale tile state data left by prior GPU jobs in recycled buffer slots. The vulnerability exists because the 16MB binner Buffer Object is partitioned into 512KB slots that are recycled across jobs without clearing, causing the Primitive Tile Binner (PTB) hardware to act on stale Tile State Data Array (TSDA) contents from previous jobs - producing invalid command and primitive streams. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) reflects low exploitation probability despite the high CVSS base score.
Heap buffer overflow and potential kernel memory mass-zeroing in the Linux kernel drm/panthor GPU driver allow a local attacker to corrupt kernel heap structures or trigger catastrophic out-of-bounds writes by supplying a crafted firmware image to the Arm Mali Valhall (Panthor) DRM subsystem. The root cause is that panthor_fw_load_section_entry() computes section->data.size from raw firmware header fields without bounding it against the allocated section_size, allowing both a memcpy overflow and an unsigned integer underflow in a subsequent memset that could zero arbitrarily large kernel memory regions. No public exploit has been identified and EPSS is low at 0.18% (8th percentile), but the CVSS impact ratings of C:H/I:H/A:H reflect the realistic worst case of full kernel compromise on affected hardware.
Out-of-bounds memory access in the Linux kernel's drm/panthor driver (ARM Mali Valhall GPU) allows a local authenticated attacker to read or corrupt kernel memory by supplying a crafted MCU virtual address near the end of the firmware shared memory section. The underlying flaw is in iface_fw_to_cpu_addr(), which validated only that a firmware-provided address falls within the shared section - not that the full firmware interface structure fits within it - enabling subsequent structure-level accesses to reach past the section boundary. No public exploit code exists and EPSS is 0.17% (6th percentile), indicating no evidence of active exploitation; patches are available in Linux stable releases 6.12.103, 7.1.8, and 6.18.44.
Use-after-free in the Linux kernel's AMD GPU power management subsystem (drm/amd/pm) allows a low-privileged local attacker to corrupt kernel memory via a race condition in the sysfs power table interface. The flaw exists because amdgpu_dpm_get_pp_table() returns a raw pointer to a driver-owned buffer after releasing adev->pm.mutex, enabling a concurrent pp_table write to free the allocation while a sysfs copy is still in progress. No public exploit has been identified and EPSS probability is very low (0.15%), but the CVSS 7.8 C:H/I:H/A:H impact reflects credible potential for local privilege escalation or kernel crash on AMD GPU-equipped Linux systems.
Divide-by-zero panic in the Linux kernel's AMD display driver (drm/amd/display) allows a low-privileged local user to crash the kernel by triggering a zero-area viewport condition in the calculate_mcache_setting function. The vulnerable code path exits early with num_mcaches == 0 and mvmpg_width/height == 0, then proceeds to divide by those zero values, causing both a divide-by-zero panic and potential integer underflow on num_mcaches. EPSS is very low at 0.15% (5th percentile) and no active exploitation or public exploit code has been identified at time of analysis; however, the local trigger mechanism via display mode setting is accessible to low-privileged users on systems with AMD GPU hardware.
Integer overflow in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user with AMD KFD device access to bypass EOP ring buffer size validation on GFX8/GFX9 hardware, enabling out-of-bounds GPU writes that can corrupt adjacent kernel memory or trigger GPU faults. A crafted eop_ring_buffer_size of 0xFFFFF001 exploits the ALIGN macro's typeof-preserved 32-bit arithmetic to wrap the computed size to zero, causing kfd_queue_buffer_get() to skip its exact-size check and accept an undersized buffer object. No public exploit has been identified and this is not in CISA KEV; EPSS stands at 0.17% (6th percentile), reflecting very low in-the-wild exploitation probability despite a CVSS 7.8 score.
Concurrent event manipulation during CRIU checkpointing in the Linux kernel's AMD GPU driver (drm/amdkfd) exposes a race condition leading to heap out-of-bounds writes or use-after-free memory corruption. A low-privileged local attacker on a system with an AMD GPU can exploit the unprotected gap between the event count and IDR walk in kfd_criu_checkpoint_events() by racing event creation or destruction from a second thread within the same process, producing kernel heap corruption primitives exploitable for local privilege escalation. No public exploit code and no CISA KEV entry have been identified at time of analysis; EPSS is 0.17% (6th percentile), reflecting low current adversary interest despite the high C:H/I:H/A:H CVSS impact triad.
Out-of-bounds kernel memory read in the Linux kernel's vmwgfx DRM driver exposes systems running VMware-virtualized graphics to local privilege escalation or sensitive information disclosure. The flaw in vmw_cmd_draw() allows a low-privilege local user to supply a crafted DRAW_PRIMITIVES command stream header with an undersized size field, triggering unsigned integer underflow that produces a near-4 GiB loop bound and causes the kernel to dereference memory far beyond the allocated command bounce buffer. Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6); no active exploitation has been confirmed and the vulnerability is not listed in CISA KEV.
Pointer underflow in the VMware graphics driver (drm/vmwgfx) of the Linux kernel enables local low-privileged users to perform a TOCTOU attack on the DMA command stream inside a bounce buffer, allowing one crafted command to overwrite authenticated fields (GMR id, surface id) of a previously verified command. This bypasses kernel command authentication and can lead to unauthorized access to graphics memory regions or escalated privileges within a VMware guest. EPSS is 0.17% (6th percentile) and the vulnerability is not listed in CISA KEV, suggesting no confirmed widespread exploitation at the time of analysis.
Race condition in the Linux kernel's drm/xe Intel GPU driver allows a locally-authenticated user to schedule a GPU job that executes concurrently with an in-flight kernel memory management operation on an external buffer object, violating the DMA_RESV_USAGE_KERNEL cross-driver synchronization contract. Affected systems are those running Linux 6.8 or later with compatible Intel Xe-architecture GPU hardware and the xe driver loaded; the race can result in reading or writing memory that is simultaneously being evicted or relocated. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV), consistent with the low EPSS score of 0.17% at the 6th percentile.
Heap overflow in the Linux kernel ASoC SOF IPC3 control subsystem allows a local low-privileged user to write past the end of a kernel heap allocation and over-read adjacent heap memory via the ALSA TLV kcontrol interface. The root cause is an off-by-offset bounds check in `bytes_ext_put` and `bytes_ext_get` that compared user-supplied lengths against the full allocation size rather than the actual payload capacity at `cdata->data`, enabling up to `sizeof(struct sof_ipc_ctrl_data)` bytes of out-of-bounds write and disclosure. Patched versions are confirmed across multiple stable branches (6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2-rc1); no public exploit or active exploitation has been identified at time of analysis.
Heap buffer overflow in the Linux kernel ASoC SOF IPC3 audio subsystem allows a local low-privilege attacker to write past an allocated buffer via a missing bounds check in `snd_sof_update_control()`, potentially enabling kernel memory corruption, privilege escalation, or system crash. Affected systems span Linux 5.18 through multiple stable branches (6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x) on hosts with Intel SOF-capable audio DSP hardware. No public exploit is known and EPSS is low at 0.21%, but the CVSS 7.8 score reflects the severity of the potential kernel-level impact once local access is obtained.
Use-after-free in the Linux kernel netfilter nf_queue subsystem allows a local attacker with bridge networking and NFQUEUE configured to corrupt kernel memory, potentially escalating privileges to root. The flaw arises because NFQUEUE upgrades a no-reference bridge fake dst to a real dst reference via skb_dst_force(), but the bridge device can complete teardown before the queued packet receives its verdict, leaving dst_release() operating on freed memory belonging to netdev_priv(br->dev). No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, CVSS rates it 7.8 HIGH with full confidentiality, integrity, and availability impact, consistent with kernel-level use-after-free primitives.
NULL pointer dereference in the Linux kernel netfilter nft_fib subsystem crashes the kernel when a FIB expression is placed in a netdev egress base chain, enabling denial of service against any system carrying that configuration. The root cause is a hook namespace collision where NF_NETDEV_EGRESS aliases NF_INET_LOCAL_IN numerically, causing nft_fib_validate() to incorrectly approve egress chain placement and then dereference nft_in(pkt) - which is NULL on the transmit path. No public exploit exists and EPSS is 0.21% (11th percentile), but systems running custom nftables egress FIB rules are at immediate kernel crash risk until patched.
Null pointer dereference in the Linux kernel's netfilter SIP connection tracking helper (nf_conntrack_sip) can crash the kernel when the non-default sip_external_media=1 module parameter is active and SIP traffic traverses tc ingress or OpenVSwitch paths. Successful exploitation causes a complete availability loss (kernel panic/crash), satisfying the CVSS A:H rating. No public exploit code has been identified and EPSS sits at the 11th percentile, indicating low observed exploitation activity despite the high base score.
Out-of-bounds write in the Linux kernel's netfilter nft_set_pipapo component allows a local low-privileged attacker to corrupt kernel memory and potentially escalate to root. When memory allocation fails during cloning of an nft_pipapo_match structure inside a netfilter batch transaction, the clone can enter an inconsistent state - with mismatched lookup table sizes, toggled bits, or an undersized scratch map - and that corrupted clone can persist into the next transaction where a subsequent set insertion triggers an out-of-bounds write. No public exploit has been identified at time of analysis, and EPSS at 0.21% (11th percentile) indicates low predicted exploitation probability despite the high CVSS score of 7.8.
Memory-safety flaw in the Linux kernel's netfilter SIP NAT helper (net/netfilter/nf_nat_sip.c) allows a stale, freed data pointer to be used after skb_ensure_writable() reallocates a cloned socket buffer, potentially corrupting kernel memory or crashing the host when SIP connection tracking and NAT are active. The bug affects systems using the nf_nat_sip application-layer gateway; because SIP conntrack linearizes SKBs, only clones (not fragments) trigger it, and a secondary error path could invoke UDP mangling on a TCP stream. No public exploit is identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not in CISA KEV.
Netfilter IPv6 fragment reassembly in the Linux kernel incorrectly advances the sk_buff MAC header offset on the NF_INET_LOCAL_OUT path, where no link-layer header exists, causing a u16 integer wrap that leaves the MAC header pointer aimed at kernel headroom. All Linux kernels from version 2.6.15 through the stable-branch patch releases (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5) are affected when the nf_conntrack_ipv6 module is loaded. A local low-privilege attacker can send crafted IPv6 fragmented packets to trigger the vulnerable reassembly code path, potentially achieving information disclosure of kernel memory or a kernel panic; no public exploit or active exploitation has been identified at time of analysis.
Incorrect route selection in the Linux kernel's netfilter flowtable IPIP-encapsulation offload path causes the headroom and IP fragment-offset (iph->frag_off) to be computed from the reverse-direction dst instead of the current direction when pushing the IPIP header. Affecting kernel 6.19 and development branches through the 7.x line, the flaw can lead to malformed encapsulated packets and potential memory/headroom mishandling in the fast-path offload; it is tagged as information disclosure. The input CVSS of 9.8 (RCE-grade) is a CNA auto-score that overstates a config-dependent packet-handling bug, and EPSS is low at 0.20% (10th percentile) with no public exploit or KEV listing.
Denial of service in the Linux kernel netfilter flowtable subsystem allows a crash in the tunnel transmit path when IPIP tunnel offload is combined with a direct-xmit device such as a bridge. Because no dst_entry is supplied, the code performs invalid dst usage while checking skb headroom and setting iph->frag_off, leading to a kernel crash. Rated CVSS 9.8 by automated scoring, but vendor tags classify it as Denial Of Service; EPSS is 0.20% (10th percentile), it is not in CISA KEV, and no public exploit was identified at time of analysis.
Connection limit bypass in the Linux kernel's netfilter nf_conncount subsystem allows network-reachable attackers to exhaust host resources by exploiting incorrect zone direction bitmask handling in tuple deduplication. The bug in __nf_conncount_add() conflates the u8 zone direction bitmask (NF_CT_ZONE_DIR_ORIG=1, NF_CT_ZONE_DIR_REPL=2, NF_CT_DEFAULT_ZONE_DIR=3) with the ip_conntrack_dir enum (IP_CT_DIR_ORIGINAL=0, IP_CT_DIR_REPLY=1), causing non-default directional zones to be erroneously treated as equivalent and bypassing per-connection counting. No active exploitation is confirmed (EPSS 0.22%, 13th percentile); upstream fixes have been committed across multiple stable kernel branches.
Local privilege escalation in the Linux kernel's GPU buddy memory allocator (gpu/buddy) allows a low-privileged authenticated local user to exploit a misalignment logic error in the try_harder contiguous fallback path, achieving high confidentiality, integrity, and availability impact (CVSS 7.8). The defect, introduced at commit 0a1844bf0b532d84324453374ad6845f64066c28, caused the allocator to return candidate blocks whose start offsets were not aligned to the caller's min_block_size, violating allocation invariants on both the RHS and LHS paths. No public exploit identified at time of analysis; EPSS exploitation probability is 0.21% (11th percentile), consistent with low near-term exploitation likelihood.
SELinux mandatory access control bypass in the Linux kernel allows local low-privilege users to circumvent connect-related network policy enforcement by initiating TCP connections via TCP Fast Open (MSG_FASTOPEN). The kernel's SELinux LSM hook for socket_sendmsg() was never updated to invoke selinux_socket_connect() when the MSG_FASTOPEN flag is passed, meaning connections using this path skip SELinux policy checks entirely. With a CVSS 8.4, Scope Changed, and confirmed patches across six stable branches, this is a meaningful MAC bypass in SELinux-enforcing environments - no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile).
NULL pointer dereference in the Linux kernel's SELinux `selinux_sctp_bind_connect()` hook crashes affected systems when SCTP ASCONF chunks are processed via the softirq path, where no file reference guarantees `sk->sk_socket` is non-NULL. Systems running Linux kernel 4.17 through current mainline with SELinux enforcing and SCTP active are vulnerable; patched stable releases exist at 6.12.97, 6.6.148, 6.18.40, 7.1.5, and 7.2-rc3. No public exploit has been identified and EPSS sits at 0.21%, but the unauthenticated network-reachable attack path warrants prompt patching on SCTP-exposed infrastructure.
Weakened AMD SEV-SNP memory-integrity enforcement in the Linux kernel results from a race between WBINVD IPIs and dirty-cacheline migration that can leave Reverse Map Table (RMP) memory with un-flushed dirty cache lines when SNP_INIT_EX is invoked with INIT_RMP=1, violating SNP firmware requirement (spec section 8.8). Affected are Linux 7.1 hosts that had adopted commit 99cf1fb58e68 (which dropped the pre-SNPEn WBINVD); the fix reverts that change so wbinvd_on_all_cpus() again runs before setting MSR_AMD64_SYSCFG_SNP_EN, while the RMP is not yet in use. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not CISA KEV-listed.
Use-after-free in the Linux kernel's batman-adv mesh networking driver allows adjacent unauthenticated attackers to achieve kernel memory corruption with potential for code execution, information disclosure, or denial of service. The flaw exists in batadv_interface_rx(), where pskb_may_pull() may reallocate the socket buffer during RX processing - the VLAN header pointer was correctly refreshed post-reallocation, but the ethernet header pointer was not, leaving a dangling reference used subsequently in Translation Table and AP isolation logic. EPSS is low at 0.22% (13th percentile) and no CISA KEV listing exists, limiting real-world risk primarily to environments actively running batman-adv mesh deployments. Vendor-released patches are confirmed across multiple stable kernel branches.
Use-after-free in the Linux kernel's batman-adv mesh networking module (net/batman-adv unicast path) occurs because the unicast_packet pointer is not reassigned after pskb_may_pull() inside batadv_get_vid() may reallocate the socket buffer, leaving a stale pointer into freed memory. Systems running batman-adv B.A.T.M.A.N. advanced mesh routing are affected across a wide range of stable kernel series. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.22%, 13th percentile).
Use-after-free in the Linux kernel's batman-adv Bridge Loop Avoidance (BLA) subsystem allows an unauthenticated attacker on the same Layer 2 network segment to corrupt kernel memory, potentially achieving arbitrary code execution or system crash. The flaw originates from pskb_may_pull() silently reallocating the socket buffer during backbone gateway processing in batadv_bla_is_backbone_gw(), leaving cached gateway address pointers dangling against the freed old buffer. Affected kernels span from commit 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 (approximately Linux 4.12) through multiple stable branches; patches are available across all active stable series. No public exploit or CISA KEV listing exists at time of analysis, and the very low EPSS of 0.22% (13th percentile) reflects the niche deployment footprint of batman-adv BLA.
Out-of-bounds buffer read in the Linux kernel's batman-adv (batadv) mesh networking driver allows a local user with eBPF TC hook access to trigger reads beyond allocated packet buffer boundaries inside batadv_interface_tx(). The vulnerability spans many stable kernel series from 2.6.38 through pre-patch releases of 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, and 7.1 branches. No public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), though the high CVSS impact metrics (C:H/I:H/A:H) reflect potential for kernel heap memory disclosure or corruption if the out-of-bounds read extends into sensitive kernel state.
Request storm vulnerability in the Linux kernel's batman-adv mesh networking subsystem (B.A.T.M.A.N. Advanced) exposes nodes to availability degradation through an inverted boolean condition in batadv_send_tt_request(). When a send buffer allocation fails, an incorrect check (ret == true instead of ret == false) causes the tt_req_node tracking structure to be retained rather than cleaned up, breaking the de-duplication mechanism that prevents simultaneous TT requests to the same originator. The result is that repeated, redundant translation table requests can flood a mesh peer - a request storm - degrading availability of nodes on the batman-adv overlay. No public exploit code exists and EPSS exploitation probability is very low (0.22%, 13th percentile); no active exploitation is confirmed.
Out-of-bounds read in the Linux kernel's batman-adv multicast tracker exposes adjacent-network unauthenticated attackers to kernel memory disclosure or denial-of-service via a crafted TVLV mcast tracker packet. The root cause is a C macro misuse - offsetof() on the first struct member always evaluates to 0, making the bounds check a no-op that permits access to num_dests even when only 0 or 1 byte is in the received packet instead of the required 2. EPSS is 0.21% (11th percentile), no CISA KEV entry exists, and no public exploit is identified; vendor-released patches are available in Linux 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3.
Integer-overflow-driven out-of-bounds access in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh networking module allows a node on the same mesh to corrupt translation-table processing via a crafted TT unicast TVLV. The VLAN count (u16) multiplied by the 8-byte batadv_tvlv_tt_vlan_data size overflows the u16 length variable, defeating every downstream bounds check that guards the TVLV buffer. This is a fixed, patched kernel bug with a low EPSS (0.22%, 13th percentile) and no public exploit identified at time of analysis; it is not listed in CISA KEV.
Integer underflow in the Linux kernel's jbd2 journaling subsystem corrupts critical journal metadata, aborting the filesystem journal and rendering affected ext4 volumes unavailable. Local, low-privileged attackers on unpatched systems running ext4 with the fast-commit feature can trigger the arithmetic wraparound in jbd2_journal_initialize_fast_commit() to corrupt j_last, j_fc_first, and j_free, with CVSS scoring this at 7.8 (AV:L/AC:L/PR:L). No public exploit code has been identified and CISA KEV listing is absent, with EPSS at 0.22% (14th percentile), but the breadth of the patch set across six stable kernel branches signals meaningful engineering priority across the fleet.
Use-after-free in the Linux kernel's sunrpc server-side TLS handshake path (svc_tcp_handshake/svc_sock) allows the asynchronous tlshd handshake-completion callback to write through a freed struct svc_sock, corrupting slab memory on any NFS server configured for RPC-with-TLS. Two close-versus-cancel races let svc_sock_free() kfree() the socket while svc_tcp_handshake_done() is still updating xpt_flags and walking the embedded wait queue, yielding an attacker-influenceable slab-corruption primitive rather than a benign read. No public exploit identified at time of analysis and EPSS is low (0.20%), but the fix is upstream in stable kernels.
Kernel-side race condition in the Linux SUNRPC server's TLS handshake path (svc_tcp_handshake) allows a lost cancellation race to corrupt an embedded swait_queue or prematurely tear down a succeeding handshake, leading to kernel memory corruption or connection instability on NFS/RPC servers using RPC-with-TLS. Affects servers that terminate kernel RPC TLS sessions; it is a resolved upstream kernel bug with no public exploit and a very low EPSS (0.21%, 11th percentile), and it is not in CISA KEV. Despite the NVD-propagated 9.8 rating typical of auto-generated kernel CVEs, the practical impact is a narrow timing window affecting availability/state integrity rather than turnkey remote code execution.
Memory-corruption (double-free / use-after-free) in the Linux kernel's SunRPC server layer allows the rq_procinfo->pc_release hook to fire against stale, reused request state when a worker thread hits an early error path (unsupported protocol, short frame, or bad auth) before a valid procinfo is installed. It affects Linux 6.18 (and the shared SunRPC code reachable via kernel RPC servers such as nfsd), and successful triggering corrupts kernel heap state, risking denial of service or privilege escalation. The issue is patched upstream; there is no public exploit identified at time of analysis and EPSS is low (0.21%), so it is not currently known to be exploited.
Out-of-bounds slab write in the Linux kernel SUNRPC layer (xdr_buf_to_bvec()) lets a remote NFS client corrupt kernel memory via the in-kernel NFS server (nfsd) write path. The function stores a bio_vec into the caller's rq_bvec array before verifying the slot is in range - and the head branch stores with no check at all - so when the exactly-sized rq_maxpages budget is used up, one bio_vec lands past the array into adjacent slab memory, with attacker-influenced bv_len and bv_offset values taken from client-supplied RPC payload sizes. Rated CVSS 9.8 by the source, but with low EPSS (0.21%), no CISA KEV listing, and no public exploit identified at time of analysis.
Page-counter underflow in Linux kernel's hugetlb cgroup accounting allows a local low-privileged user to corrupt memory accounting state, causing integrity and availability impacts on affected systems. The flaw exists in alloc_hugetlb_folio() where a shared h_cg pointer is overwritten during sequential rsvd and non-rsvd hugetlb cgroup charges, causing the wrong cgroup to be committed to the folio's reserved slot. When the folio is freed, the mismatched uncharge path decrements a counter on a cgroup that was never charged, triggering a page_counter underflow (WARNING: mm/page_counter.c:61). No public exploit exists and EPSS sits at 0.21% (11th percentile), but the flaw affects a broad swath of kernel versions from 5.7 onward.
Filesystem consistency flaw in the Linux kernel NTFS driver's ntfs_ir_reparent() index-root reparenting path allows a transient on-disk/in-memory layout that $INDEX_ROOT validation rejects as corrupt, surfacing as generic/013 xfstests failures and ntfsck 'Corrupt index root' errors. The bug is a metadata-ordering error triggered during NTFS write operations that grow an index root and hit -ENOSPC, not a remotely exploitable memory-safety issue; no public exploit identified at time of analysis and it is not in CISA KEV. Fixed in stable 7.1.5 and mainline 7.2-rc1.
Out-of-bounds read in the Linux kernel's NTFS driver (ntfs_mapping_pairs_decompress) lets a crafted NTFS attribute record trigger a one-byte read past the attribute boundary. It stems from off-by-one bounds checks that use strict greater-than instead of >=, so mapping-pair data extending exactly to attr_end passes validation and buf[b] reads one byte too far. No public exploit is identified at time of analysis, EPSS is low (0.20%), and it is not on CISA KEV; exploitation requires the kernel to parse an attacker-controlled NTFS volume.
Out-of-bounds kernel memory read in the legacy NTFS filesystem driver of the Linux kernel (affecting builds derived from commit 6ceb4cc8 up to the 7.1.x and 7.2-rc series) occurs when the driver parses a crafted NTFS image whose $FILE_NAME attribute declares a small resident value_length but an oversized file_name_length. Callers trust file_name_length and read past the resident attribute value during name conversion/comparison, producing a slab-out-of-bounds read confirmed under KASAN from the kmalloc-1k MFT record copy. There is no public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and despite the source-assigned 9.8 CVSS this is a local filesystem-parsing bug rather than a remote-unauthenticated flaw.
Out-of-bounds read in the Linux kernel's NTFS driver allows a local attacker to leak adjacent kernel memory or crash the system by parsing extended attribute (EA) entries on a crafted NTFS volume. The ntfs_ea_lookup and ntfs_listxattr routines dereferenced the next_entry_offset field of an EA entry without first verifying that enough space remained in the buffer. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is tagged as Information Disclosure rather than code execution.
On-disk NTFS metadata corruption in the Linux kernel's NTFS3 driver arises because ntfs_resident_attr_resize() may select zero-length resident $DATA attributes when converting attributes to non-resident to free MFT record space, producing 0-byte non-resident $DATA that fsck flags as filesystem corruption. The flaw affects Linux systems writing to NTFS volumes and is a data-integrity/consistency defect rather than a memory-safety or remote-code issue; it is fixed in stable 7.1.5 and 7.2-rc1. There is no public exploit identified at time of analysis, EPSS probability is low (0.20%, 10th percentile), and it is not listed in CISA KEV. The published CVSS of 9.8 (network vector) is not consistent with a local filesystem write path and appears to be an automated over-assessment.
Out-of-bounds access in the Linux kernel's legacy NTFS filesystem driver arises from insufficient validation of INDEX_HEADER geometry within INDX directory-index blocks; a crafted NTFS volume can drive ntfs_lookup_inode_by_name() to read past block boundaries. The fix hardens ntfs_index_block_inconsisent() to strictly validate index-block header fields before use, affecting systems that mount attacker-controlled NTFS media. There is no public exploit identified at time of analysis, KEV does not list it, and EPSS is low (0.20%, 10th percentile), consistent with a filesystem-parsing bug that requires a malicious volume rather than remote reach.
Inconsistent $INDEX_ROOT attribute header validation in the Linux kernel's legacy ntfs filesystem driver exposes systems to potential kernel-level memory corruption when processing maliciously crafted NTFS volumes. Kernel versions from the initial NTFS implementation through 7.1.4 stable are affected across both directory inode and named index inode read paths, with fix releases confirmed at 7.1.5 stable and 7.2-rc1 mainline. No public exploit has been identified at time of analysis, and EPSS exploitation probability is 0.20% (10th percentile), though the CVSS 8.4 High score reflects the theoretical severity of kernel-space memory corruption if the vulnerability is successfully reached.
Deadlock in the Linux kernel NTFS driver allows local users with write access to an NTFS-mounted volume to render the system completely unresponsive by triggering an ABBA lock ordering race between concurrent VFS writeback paths. The vulnerability affects kernels since commit 6994acf33bae and manifests when inode writeback (acquiring extent_lock then mrec_lock) races with MFT folio writeback (holding mrec_lock while attempting extent_lock). No active exploitation has been confirmed - EPSS places this at the 10th percentile (0.20%) - reflecting the narrow real-world surface: production Linux systems rarely mount NTFS volumes. Patches are available in Linux 7.1.5 and 7.2-rc1.
Indefinite thread blocking in the Linux kernel's NTFS driver can cause a local denial of service on systems mounting NTFS volumes under memory pressure. Specifically, `get_nr_free_clusters()` and `__get_nr_free_mft_records()` allocate heap memory for a readahead state structure; if that allocation fails, neither `NVolFreeClusterKnown()` is set nor `vol->free_waitq` is woken, leaving any waiting kernel thread blocked indefinitely. Kernels prior to 7.1.5 and 7.2-rc1 are affected; no public exploit has been identified and EPSS is 0.20% (10th percentile).
Improper validation of NTFS index entries in the Linux kernel's NTFS filesystem driver allows a crafted or corrupted NTFS volume to be processed without adequate bounds checking during index root and index block reads. When an attacker-controlled NTFS image is mounted and traversed (lookup/readdir), missing per-read validation can lead to out-of-bounds memory access, enabling information disclosure or a kernel crash. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is not on the CISA KEV list.
Signed-integer overflow in the Linux kernel NTFS driver's mapping-pairs runlist parser lets a crafted or corrupted NTFS volume redirect logical-to-physical cluster mappings to unintended disk locations. The flaw affects the kernel's NTFS attribute parsing when it accumulates relative LCN deltas; a malicious runlist can set the accumulator to S64_MAX and add 1, triggering undefined behavior that resolves runs to a different set of physical clusters. Fixed upstream in Linux 7.1.5 and 7.2-rc1; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.20%).
Out-of-bounds memory access in the Linux kernel NTFS driver arises because resident $INDEX_ROOT attribute headers are consumed after lookup without fully validating their layout invariants. Affected are Linux kernels prior to the 7.1.5 and 7.2-rc1 stable fixes when mounting or accessing an attacker-crafted NTFS volume; unchecked entries_offset, index_length, and allocated_size fields let a malformed filesystem drive reads beyond the resident value, tagged upstream as Information Disclosure. This is not actively exploited (no CISA KEV entry) and EPSS is low at 0.20%, with no public exploit identified at time of analysis, though upstream stable commits are available.
The legacy NTFS driver in the Linux kernel fails to reject non-resident attribute records for attribute types contractually required to be resident, creating resident/non-resident union confusion paths in multiple critical code locations. Affected callers - including inode loading ($STANDARD_INFORMATION), volume flag updates ($VOLUME_INFORMATION), and directory traversal ($INDEX_ROOT) - read data.resident.value_offset directly without first verifying the a->non_resident flag, potentially acting on the wrong union member when a crafted or corrupted NTFS image is mounted. A local attacker with standard user privileges can exploit this to trigger kernel memory corruption or information disclosure; no active exploitation is confirmed (EPSS 0.20%, not in CISA KEV), and patches are available in Linux 7.1.5 and 7.2-rc1.
Linux kernel's ntfs3 filesystem driver crashes and may corrupt memory when processing a crafted NTFS image due to an unbounded memmove in the DeleteIndexEntryAllocation code path. Any local user able to mount a malformed NTFS volume can trigger a kernel oops through a negative ptrdiff_t silently cast to a near-maximal size_t, causing memmove to walk far past the destination buffer. No public exploit and no CISA KEV listing exist at time of analysis; EPSS is low at 0.21%, but the memory corruption primitive and local-to-kernel boundary crossing make this a meaningful privilege escalation and availability risk on systems where unprivileged NTFS mounts are possible.
Slab-out-of-bounds write in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3) is triggered during the log_replay() analysis pass when mounting a malformed NTFS3 volume. The copy_lcns loop lacks bounds enforcement against dp->lcns_follow, so a crafted LRH entry with target_vcn set to dp->vcn + dp->lcns_follow - 1 and lcns_follow greater than 1 overflows the heap-allocated page_lcns[] array, corrupting kernel memory. Confirmed by KASAN on mainline kernel 8d90b09e6741 with a slab-out-of-bounds write of size 8 at log_replay+0x68d4; no public exploit exists and EPSS stands at 0.21%, though the CVSS score of 8.4 reflects the full confidentiality, integrity, and availability impact of kernel heap corruption.
Integer underflow in the ntfs3 filesystem driver's journal replay logic (`fs/ntfs3/fslog.c`) allows a local attacker with low privileges to corrupt the resident attribute data size to approximately 4 GiB, enabling out-of-bounds kernel memory reads up to 4 GiB beyond a 1024-byte MFT record allocation. Exploitation requires mounting or processing a crafted NTFS image with specially crafted Log Record Header values - on distributions with unprivileged user namespaces enabled (Ubuntu, Fedora, and others), this is achievable without elevated privileges. No public exploit code has been identified and the vulnerability is not in CISA KEV; EPSS stands at 0.21% (12th percentile), and patches are confirmed available across multiple stable kernel branches.
Denial-of-service in the Linux kernel ntfs3 driver lets an attacker with the ability to mount a crafted NTFS image panic the system via unbounded recursion. indx_find_buffer() descends the NTFS B+ tree index with no depth limit, so a circular index-node reference overflows the kernel stack when a file deletion hits the index rebalancing fallback path. No public exploit is identified and it is not in CISA KEV; EPSS is low at 0.23%. Note that the supplied CVSS 9.8/AV:N vector is inconsistent with the description, which requires local access to attach a malicious filesystem.
Heap out-of-bounds write in the Linux kernel's ntfs3 filesystem driver lets a local user corrupt kernel slab memory by mounting and accessing a crafted NTFS image. When indx_insert_into_root() promotes a full resident $INDEX_ROOT into $INDEX_ALLOCATION, hdr_insert_head() copies resident entry bytes ('to_move') sized from on-disk data into a destination buffer sized from an attacker-shrunk root->index_block_size, writing 120-136 bytes of attacker-controlled data past a kmalloc allocation. The flaw is fixed across multiple stable trees; there is no public exploit identified at time of analysis and EPSS is low (0.21%), and despite the NVD CVSS of 9.8 the described trigger is local rather than network-reachable.
Out-of-bounds kernel write in the Linux kernel's ntfs3 filesystem driver allows a local attacker to corrupt kernel memory and panic the system by mounting a crafted NTFS image and performing a single directory operation. The flaw lives in indx_insert_into_buffer(), where an unvalidated split-point size from hdr_find_split() causes a u32 subtraction underflow and a near-4-GiB memmove. A vendor fix is available across multiple stable branches; EPSS is low (0.21%) and no public exploit is identified at time of analysis, though the trigger is trivial (a 'touch' on a mounted attacker-supplied image).
Improper validation of on-disk metadata in the Linux kernel's legacy NTFS driver allows a crafted NTFS filesystem image to smuggle an error-marked MFT (Master File Table) reference back through ntfs_lookup_inode_by_name(), causing directory-lookup callers to misinterpret corrupted disk data as a legitimate pseudo-errno. This affects systems that mount attacker-supplied NTFS volumes; there is no public exploit identified at time of analysis and the EPSS probability is low (0.20%). The upstream fix normalizes any error-marked reference to ERR_MREF(-EIO) so callers can no longer be tricked into consuming a bogus value.
Local volume corruption and a writeback deadlock affect the Linux kernel NTFS driver (fixed in 7.1.5 and 7.2-rc3) when a filesystem is mounted with the non-default show_sys_files option and userspace writes to an exposed base metadata file such as $Bitmap; because the cluster allocator scans $Bitmap through the same inode page cache, the write both corrupts the volume and deadlocks writeback against an already-locked folio. Only affected when the opt-in show_sys_files mount option is set, so this is a local integrity/availability issue rather than a remote one. There is no public exploit identified at time of analysis, EPSS is 0.20% (10th percentile), and it is not in CISA KEV.
Memory-safety flaw in the Linux kernel's legacy NTFS (read) driver lets a crafted NTFS filesystem image bypass a resident/non-resident attribute check in ntfs_map_runlist_nolock(). When the driver expects a non-resident attribute during mount, an attacker-supplied image can substitute a resident attribute; the code previously only flagged this with a non-fatal WARN_ON() and then read a->data.non_resident.highest_vcn from the wrong union member, corrupting the VCN range check. The fix replaces WARN_ON() with an -EIO return so the malicious image is rejected at mount. There is no public exploit identified at time of analysis, and EPSS is low (0.22%).
Landlock SCOPE_SIGNAL enforcement in the Linux kernel can be bypassed by a sandboxed process via the asynchronous SIGIO delivery path, allowing it to send arbitrary signals - including SIGKILL - to processes outside its Landlock domain such as supervisors or security monitors. The flaw exists because hook_file_send_sigiotask() evaluates the Landlock domain recorded at F_SETOWN time rather than the live sender domain, and control_current_fowner() incorrectly skips domain recording when a single member of the target process group (PIDTYPE_PGID) shares the caller's thread group, leaving the remaining group members unchecked at delivery. No public exploit code exists and EPSS is 0.22% (13th percentile), but the impact is significant for environments relying on Landlock as a containment boundary.
Memory corruption in the Linux kernel's MIPS scheduler corrupts kernel pointer state when CONFIG_CPUMASK_OFFSTACK is enabled, enabling local privilege escalation to root. Two compounding flaws exist: sizeof(new_mask) resolves to the pointer width (4-8 bytes on MIPS) rather than the actual cpumask buffer size, causing copy_from_user() to overwrite the mask pointer with user-controlled bytes; and the original code invoked copy_from_user() prior to allocating the mask buffer, creating a write-before-allocation primitive. CVSS 7.8 with AV:L/AC:L/PR:L/UI:N reflects straightforward local exploitation on affected MIPS systems, though EPSS at 0.21% (12th percentile), no CISA KEV listing, and no public exploit code indicate limited real-world exploitation activity at time of analysis.
Race condition in the Linux kernel's HugeTLB page table protection code allows a local low-privileged user to corrupt page tracking state or leak memory access metadata. Specifically, make_uffd_wp_huge_pte() in fs/proc/task_mmu.c invokes huge_ptep_modify_prot_commit() on a PTE snapshot captured without the preceding huge_ptep_modify_prot_start() atomic clear, creating a window where hardware can set Dirty or Accessed bits between the read and commit, which are then silently overwritten with stale values. EPSS is 0.21% (11th percentile) and no active exploitation has been confirmed - this is a correctness/integrity fix in the kernel stable queue, not a commonly weaponized class of vulnerability.
Uninitialized struct page corruption in the Linux kernel's ZONE_DEVICE memory subsystem exposes systems with DAX/persistent memory hotplug to kernel memory corruption. When DAX memory is hotplugged into an unoccupied subsection of an early section, section_activate() reuses the unoptimized boot memmap while compound_nr_pages() incorrectly assumes vmemmap optimization is active, initializing fewer struct pages than the memory region actually contains. The resulting uninitialized tail struct pages can cause crashes or, under adverse conditions, kernel memory corruption with high confidentiality, integrity, and availability impact per the CVSS 7.8 rating. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.21% (11th percentile).
Kernel memory corruption in the Linux kernel's MTD slram driver stems from a link-before-initialize race in `register_device()`, where new `slram_mtdlist` entries are inserted into the global device list before all required state (memory allocation, `memremap()`, and `mtd_device_register()`) is fully committed. When any of these subsequent operations fail, the partially initialized entry persists on the list, and later cleanup code dereferences or frees invalid kernel memory - enabling potential local privilege escalation from low-privileged access to full kernel compromise. EPSS is 0.22% (13th percentile), no CISA KEV listing exists, and no public exploit has been identified at time of analysis, collectively indicating low near-term exploitation likelihood despite the high CVSS score of 7.8.
The 9p filesystem client (v9fs) in the Linux kernel incorrectly invokes drop_nlink() on inodes whose nlink counter is already zero in cacheless mode, producing a kernel WARN_ON under concurrent unlink workloads. The race arises because cacheless mode delegates authority to the server: after the server processes an unlink and sets nlink to 0, the client refetches that metadata before its own v9fs_dec_count() executes, resulting in a decrement of an already-zero counter. No public exploit exists and EPSS is 0.21%, placing this firmly in patch-cycle rather than emergency response territory.
Out-of-bounds memory access in the Linux kernel MTD raw NAND subsystem allows a local low-privilege user to corrupt or read kernel memory via an improper bounds check in `nand_select_target()`, where the chip-select index `cs` is not validated against `nanddev_ntargets()`. Affected systems span Linux 5.2 through current stable branches across multiple LTS lines; patched releases are available. No public exploit code exists and the vulnerability is not listed in CISA KEV, with EPSS at 0.22% (13th percentile), indicating low real-world exploitation probability despite the high CVSS score of 7.8.
The OCFS2 extent-move ioctl (OCFS2_IOC_MOVE_EXT) in the Linux kernel permits a local user with write access to an OCFS2-mounted filesystem to trigger cross-inode data corruption and information disclosure by supplying a crafted physical goal cluster that an uninitialized probe output allows to survive a failed scan. Affected kernel versions span from approximately Linux 3.0 (commit e6b5859cccfa0fec) through all stable branches prior to the fix releases in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit has been identified at time of analysis, and EPSS probability is 0.22% (13th percentile), consistent with a subsystem-specific kernel bug requiring deliberate targeting.
Unbounded array indexing in the ocfs2 filesystem's ocfs2_sum_rightmost_rec() function causes UBSAN-detected kernel panic or memory corruption when a file write targets an inode whose embedded extent list has been corrupted on-disk. Linux kernels prior to 6.18.40 (stable 6.x branch) and 7.1.5 (7.x branch) are affected on any system mounting an ocfs2 volume. No public exploit has been identified at time of analysis and EPSS probability sits at 0.21% (11th percentile), reflecting realistically constrained exploitability due to the required on-disk corruption precondition.
OCFS2 cluster filesystem dinode validation in the Linux kernel fails to reject inodes with non-canonical i_mode type bits, allowing forged on-disk metadata to propagate into in-core kernel inode structures. Affected kernels accept any non-zero i_mode value and pass it verbatim into ocfs2_populate_inode(), where an unrecognized S_IFMT type falls through to ocfs2_special_file_iops and init_special_inode() - a code path not designed for arbitrary mode inputs. No public exploit has been identified at time of analysis and EPSS sits at only 0.22%, but the kernel-level impact (C:H/I:H/A:H) and the shared-storage attack surface of OCFS2 clusters warrant priority patching on affected systems.
Memory corruption in the Linux kernel's ThunderboltIP receive path allows an adjacent unauthenticated attacker to overflow the skb frags[] array by sending a crafted multi-frame packet with 19 or more small frames. The insufficient frame_count bound in tbnet_check_frame() (capped at TBNET_RING_SIZE/4 = 64) far exceeds MAX_SKB_FRAGS (17), causing skb_add_rx_frag() to write past the frags[] array and corrupt kernel memory. EPSS is low (0.21%, 11th percentile), no public exploit exists, and CISA KEV confirmation is absent, but CVSS 8.8 reflects the severity of kernel memory corruption once Thunderbolt physical access is achieved.
Cache coherency corruption in the Linux kernel's OpenRISC architecture jump_label implementation leaves instruction cache lines on remote SMP cores stale after static key updates, meaning security-relevant kernel branches may execute the wrong code path indefinitely on affected multi-core OpenRISC systems. The flaw originates in commit 8c30b0018f9d, which ported jump_label support from arm64 without adapting icache invalidation to OpenRISC's SMP model - `kick_all_cpus_sync()` does not guarantee a full remote icache flush on this architecture. No public exploit has been identified at time of analysis, and the 0.21% EPSS score (11th percentile) reflects the severe rarity of OpenRISC SMP hardware in production.
Use-after-free in the Linux kernel TPM subsystem's tpm_buf_append_salt() function triggers automatic kernel memory corruption on systems equipped with asynchronous KPP cryptographic hardware backends. The defect fires continuously and without any userland action - the hwrng_fillfn kernel thread invokes the vulnerable code path on every entropy poll via tpm2_get_random → tpm2_start_auth_session → tpm_buf_append_salt, causing a deferred completion worker to dereference a freed kpp_request when the async backend returns -EINPROGRESS. No public exploit has been identified at time of analysis and EPSS is 0.20% (10th percentile), but the kernel-space use-after-free carries inherent privilege escalation and denial-of-service risk on affected hardware configurations.
Tegra GPC DMA driver in the Linux kernel hangs when a client submits a transfer whose length is not evenly divisible by the channel's configured maximum burst size, resulting in a partial-burst stall that freezes the DMA channel indefinitely. The defect is confirmed in production via the PL011 UART TX DMA path on NVIDIA Tegra SoC hardware and affects kernel branches from the introducing commit ee17028009d4 through fixed stable releases spanning 6.1, 6.6, 6.12, 6.18, and 7.1 series. No public exploit code exists and no active exploitation is confirmed; EPSS of 0.21% (12th percentile) reflects the extremely low real-world exploitation probability, consistent with a hardware-specific driver defect rather than a broadly exploitable software flaw.
Race condition in the Linux kernel's DesignWare eDMA (dw-edma) driver exposes DONE_INT_MASK and ABORT_INT_MASK interrupt registers to concurrent corruption when multiple DMA channels are started simultaneously. Systems running Linux kernel versions since commit 7e4b8a4fbe2c and equipped with DesignWare eDMA hardware - common in PCIe-attached peripherals and certain SoC platforms - are affected across stable branches from 6.1 through 7.1. No public exploit has been identified and EPSS sits at 0.21% (12th percentile), consistent with a hardware-specific driver flaw; however, the kernel maintainers have shipped patches across all active stable series, and remediation should be prioritized where this DMA controller is in use.
Initialization ordering flaw in the Linux kernel's Renesas RZ DMAC driver (rz-dmac) creates a race window during driver probe where a DMA interrupt fires before channel->ch_base is assigned and before the ld_free, ld_queue, and ld_active linked-list structures are initialized, leading to invalid kernel memory access, potential kernel crashes, or memory corruption on Renesas RZ SoC-based platforms. Affected systems run Linux 5.15 through the pre-patch stable releases; fixes are available across multiple upstream stable branches (6.6.148, 6.12.101, 7.1.5, 7.2-rc1). No public exploit exists, EPSS is 0.21% (11th percentile), and this CVE is not listed in the CISA KEV catalog.
Incomplete error-path cleanup in the Linux kernel's dell-laptop platform driver exposes systems running Dell hardware to resource leak conditions that can be leveraged for privilege escalation by local low-privileged users. The dell_init() function fails to release the notifier, debugfs directory, keyboard backlight LED, and optional touchpad LED when a later initialization step fails, leaving dangling kernel object registrations. No active exploitation is confirmed (not in CISA KEV), and the EPSS score is very low at 0.20% (10th percentile), but the CVSS 3.1 score of 7.8 High with local-access C:H/I:H/A:H reflects the theoretical privilege escalation ceiling if the dangling resources are abused post-init.
Incorrect pointer usage in the Intel Speed Select Technology (ISST) platform driver causes SST-PP control registers to be restored only for power domain 0 during system resume from suspend, leaving all non-zero power domains with corrupted performance profile settings. Systems running affected Linux kernel versions (6.18.16-6.18.39, 6.19.x, 7.0) on Intel Xeon hardware with multi-domain ISST configurations will silently misconfigure CPU performance profiles after any suspend/resume cycle, leading to integrity and availability impact. EPSS is at 0.21% (11th percentile) and no active exploitation has been identified; a vendor patch is available across multiple stable branches.
Permanent I2C bus lockup in the Linux kernel i2c-imx driver (NXP i.MX SoCs) occurs when an SMBus block-read response returns a byte count of 0, a condition explicitly permitted by SMBus 3.1 specification section 6.5.7. The interrupt-driven state machine introduced in the v6.13 rework rejects count=0 with -EPROTO but critically fails to issue NACK+STOP before returning, leaving the target device holding SDA and the entire I2C bus permanently stuck until the controller is power-cycled. A secondary bug on the count > I2C_SMBUS_BLOCK_MAX error path exhibits the same failure mode. No public exploit or active exploitation is identified; vendor-released patches are available in kernel versions 6.18.40, 7.1.5, and 7.2-rc4.
Use-after-free in the Linux kernel's IPv4 TCP stack (net/ipv4/tcp_output.c) occurs when tcp_connect() reconciles conflicting TCP-MD5 and TCP-AO authentication keys on a socket that is already in TCP_SYN_SENT and hashed into the inet ehash. In the needs_ao branch, tcp_clear_md5_list() frees each tcp_md5sig_key and the md5sig_info container with bare kfree() before the RCU grace period, while softirq RX-path readers (__tcp_md5_do_lookup / __tcp_md5_do_lookup_exact) are still walking the same list under RCU, producing a per-key slab use-after-free. It affects kernels on the 6.18 line (and the described stable range) and is fixed by deferring frees with kfree_rcu; no public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile).
Kernel memory corruption (double free) in the Linux kernel's XFRM/IPsec NAT keepalive path allows a crash or potential heap exploitation when a keepalive transmission fails after the socket buffer has already been handed to the IPv4/IPv6 output stack. Introduced with the nat_keepalive feature in Linux 6.11 and affecting recent stable branches, nat_keepalive_send() incorrectly frees an skb that ip_build_and_send_pkt() or ip6_xmit() may already have consumed, producing a double free. EPSS is low (0.21%, 11th percentile), no public exploit has been identified, and it is not listed in CISA KEV; despite the auto-assigned 9.8 CVSS, realistic impact centers on denial of service and requires an IPsec NAT-traversal configuration.
Insufficient capability verification in the Linux kernel's xfrm interface changelink path allows a process holding CAP_NET_ADMIN in a device's network namespace to rewrite xfrm (IPsec transform) interface parameters belonging to a separate, distinct link namespace where it lacks authorization. Affected kernel versions span all stable branches from the introduction of xfrm_interface (commit f203b76d) through the fix commits, with patched releases confirmed at 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. No public exploit code or active exploitation has been identified; EPSS is 0.22% at the 13th percentile, reflecting low current attacker interest despite a High CVSS score driven by the cross-namespace scope change.
Out-of-bounds heap read and write in the Linux kernel TPM character device driver exposes kernel heap memory to local low-privileged users with access to /dev/tpm0 or /dev/tpmrm0. The TPM char device open handlers fail to call nonseekable_open(), leaving FMODE_PREAD and FMODE_PWRITE enabled on a device that only supports sequential command/response I/O; a pread() call with a large offset (e.g., 0x1400) passes that offset unchecked into tpm_common_read(), causing an out-of-bounds heap read via copy_to_user() and a subsequent out-of-bounds zero-write via memset(). No public exploit is identified at time of analysis, EPSS sits at 0.22% (13th percentile), and patches are available across all active Linux stable branches.
Data corruption in the Linux kernel's spi-imx driver causes SPI bus transfers to produce malformed data when DMA initialization fails and the driver incorrectly falls back to PIO mode without resetting the ECSPI hardware configuration. Systems running NXP i.MX SoCs with ECSPI DMA declared in the device tree but without the sdma-imx7d.bin SDMA firmware are deterministically and silently affected on every transfer. Downstream security-critical devices connected to the affected SPI bus - such as the Infineon SLB9670 TPM - receive corrupted responses that can prevent device initialization entirely, eliminating TPM-based security services; no public exploit has been identified at time of analysis.
Undefined behavior in the Linux kernel's spi-uniphier SPI controller driver arises from a driver probe initialization ordering defect: devm_request_irq() is called before init_completion(), leaving a race window in which an early interrupt can invoke complete() on an uninitialized kernel completion object. Systems running Socionext UniPhier SoC hardware on affected kernel versions are exposed during driver probe. No public exploit has been identified and EPSS sits at 0.22% (13th percentile), consistent with the hardware-specific nature of the flaw - practical exploitation is constrained to platforms physically equipped with UniPhier SoCs.
Heap out-of-bounds write in the Linux kernel NVMe-oF target (nvmet) DH-HMAC-CHAP authentication handler lets a remote NVMe-oF initiator corrupt kernel heap memory when in-band authentication is enabled. nvmet_execute_auth_receive() trusts the host-supplied AUTH_RECEIVE allocation length after only checking it is nonzero, so the SUCCESS1 and FAILURE1 response builders write a fixed-size DH-HMAC-CHAP message into an undersized kmalloc() buffer, producing a 16-byte OOB write from a one-byte allocation length. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.25%, 17th percentile).
Out-of-bounds read in the Linux kernel NVMe-over-Fabrics RDMA target (nvmet-rdma) allows a connected fabric host to make the target map inline data at an attacker-chosen offset, corrupting the per-command scatterlist. When a port is configured with inline_data_size greater than PAGE_SIZE, an offset in the (PAGE_SIZE, inline_data_size] range causes the 'PAGE_SIZE - off' calculation to underflow and sets sg->length to roughly 4 GiB, so the block backend reads far past the first inline page, leaking adjacent kernel memory and risking a crash. No public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile), but the flaw is patched across all maintained stable branches.
Use-after-free in the Linux kernel CAN isotp (ISO 15765-2 Transport Protocol) socket subsystem enables a local low-privileged attacker to corrupt freed kernel memory, potentially escalating privileges to root. The race arises because isotp_notify() clears so->bound via can_rx_unregister() without a subsequent RCU grace period, causing isotp_release() to skip synchronize_rcu() and cancel so->rxtimer while an in-flight isotp_rcv() callback is still executing and about to re-arm it via isotp_send_fc(). Multiple Linux stable branches from 5.10 through pre-7.2-rc4 are affected; vendor-released patches are confirmed across eight stable-tree commits. No public exploit identified at time of analysis; EPSS is 0.22% at the 13th percentile.
Use-after-free race condition in the Linux kernel CAN ISO-TP (isotp) subsystem enables a local user to corrupt kernel memory by racing isotp_release() against concurrent network device unregistration, with CVSS 7.8 reflecting full confidentiality, integrity, and availability impact on the vulnerable system. Affected kernels span the stable 5.10 tree through at least 6.18.x and 7.1.x; patched versions 6.6.148, 6.12.101, 6.18.40, 7.1.5, and 7.2-rc4 are available. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS exploitation probability is low at 0.21% (11th percentile), consistent with the narrow race window and specialized hardware prerequisites.
Race condition in the Linux kernel's CAN ISO-TP (isotp) socket subsystem allows adjacent-network attackers to corrupt TX state machine transitions, enabling kernel memory corruption with high confidentiality, integrity, and availability impact. Multiple stable branches from 5.10 onward are affected, with fixes released in kernel versions 6.6.148, 6.12.101, 6.18.40, 7.1.5, and 7.2-rc4. No public exploit code or CISA KEV entry has been identified at time of analysis, and the EPSS probability of exploitation within 30 days is 0.21% (11th percentile), consistent with the narrow, specialized conditions required.