Linux
Monthly
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix kfd process ref leaking when userptr unmapping kfd_lookup_process_by_pid hold the kfd process reference to ensure. No vendor patch available.
Filesystem corruption and denial of service in the Linux kernel's ext4 extended-attribute (EA) inode handling allows a local attacker who can mount a crafted or corrupted ext4 image to trigger a reference-count underflow in ext4_xattr_inode_update_ref(). Because the code previously read an EA inode refcount that was already <= 0 and still applied the change (typically -1), it proceeded on a bogus negative value, spawning EXT4-fs errors and orphan/cleanup churn. No public exploit identified at time of analysis, and the EPSS score is very low (0.07%), consistent with a corruption-triggered fault rather than a readily weaponized remote flaw.
In the Linux kernel, the following vulnerability has been resolved: net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx_read_raw_eeprom Syzbot reported read of uninitialized. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: pwm: berlin: Fix wrong register in suspend/resume The 'enable' register should be BERLIN_PWM_EN rather than BERLIN_PWM_ENABLE,.
Denial of service in the Linux kernel's SCTP stack (net/sctp) allows a NULL-pointer dereference in the sctp_sf_do_5_1D_ce() COOKIE ECHO state-machine handler, crashing the kernel. When processing an incoming SCTP association setup, if the peer adaptation indication is zero and the authkey ulpevent allocation returns NULL, the uninitialized ai_ev pointer is passed to sctp_ulpevent_free() and dereferenced, panicking the system. The issue affects hosts actively using SCTP; there is no public exploit identified at time of analysis and EPSS risk is low (0.07%).
Memory corruption in the Linux kernel TCP stack allows a race between closing a listening socket and processing an in-flight TCP Fast Open (TFO) connection request to trigger a refcount underflow and double-free of the request socket, originally caught by syzbot. The flaw sits in tcp_conn_request(), which redundantly calls reqsk_fastopen_remove() after inet_child_forget()/tcp_disconnect() has already released the request socket, corrupting the listener's refcount. There is no public exploit identified at time of analysis and EPSS is very low (0.07%), but as a remotely reachable kernel use-after-free it warrants patching on IPv4/IPv6 servers that accept TFO connections.
In the Linux kernel, the following vulnerability has been resolved: ice: ice_adapter: release xa entry on adapter allocation failure When ice_adapter_new() fails, the reserved XArray entry created by. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix debug checking for np-guests using huge mappings When running with transparent huge pages and CONFIG_NVHE_EL2_DEBUG. No vendor patch available.
Resource exhaustion in the Linux kernel's BPF subsystem allows gradual, unbounded kernel memory consumption (kmalloc-256 slab) leading to denial of service on hosts using the bpf_redirect_neigh() helper on the collect-metadata vxlan datapath. The __bpf_redirect_neigh_v4/v6 code called skb_dst_set() to attach a new dst entry without first releasing the metadata_dst that vxlan had already attached, leaking one dst object per redirected packet. The condition was observed in production on Cilium egress-gateway deployments, where decapsulated Pod traffic is forwarded via bpf_redirect_neigh(); EPSS is low (0.07%) and there is no public exploit identified at time of analysis.
Local privilege-escalation and memory-corruption in the Linux kernel's crypto skcipher (symmetric block cipher) framework allows a low-privileged local user to corrupt kernel memory by exercising an skcipher algorithm that declares its request size via the new cra_reqsize field. The regression stems from commit afddce13ce81d, which added cra_reqsize for ahash/acomp but left skcipher's framework paths unaware of it, so per-request scratch buffers are undersized. EPSS is negligible (0.03%), the issue is not on the CISA KEV list, and no public exploit is identified - the tags characterize the practical outcome as denial of service (kernel crash), though memory corruption leaves privilege escalation theoretically possible.
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP When running as an SNP or TDX guest under KVM, force the. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop The cleanup loop was starting at the wrong array index,.
In the Linux kernel, the following vulnerability has been resolved: ext4: verify orphan file size is not too big In principle orphan file can be arbitrarily large.
In the Linux kernel, the following vulnerability has been resolved: pid: Add a judgment for ns null in pid_nr_ns __task_pid_nr_ns ns = task_active_pid_ns(current);.
In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Fix bootlog initialization ordering As soon as we queue MHI buffers to receive the bootlog from the device, we could be. No vendor patch available.
Memory-safety fault in the Linux kernel's kTLS (kernel TLS) receive path allows use-after-free on socket buffers and stray writes into userspace memory after recv() has returned when async record decryption is used and an atomic skb clone allocation fails. Affected systems are those whose applications enable in-kernel TLS with asynchronous decryption; an attacker able to induce memory pressure while TLS records are inflight can corrupt kernel/user memory or leak data. Tagged as Information Disclosure, EPSS is negligible (0.03%), no public exploit is identified, and the issue is fixed upstream and shipped by distributions (Ubuntu USN-8125-1/USN-8126-1).
In the Linux kernel, the following vulnerability has been resolved: idpf: cleanup remaining SKBs in PTP flows When the driver requests Tx timestamp value, one of the first steps is to clone SKB using. No vendor patch available.
Missing memory-barrier ordering in the x86 memory-management code of the Linux kernel allows stale TLB entries to persist after an address-space switch, because switch_mm_irqs_off() can fail to observe a recent tlb_gen update from flush_tlb_mm_range(). On affected x86 SMP systems a local, low-privileged process could read or corrupt memory mappings it should no longer have access to, mapping to the CVSS 7.8 high/high/high impact. No public exploit identified at time of analysis, and the EPSS score is negligible (0.03%, 10th percentile), indicating this is a subtle correctness/race fix rather than an actively-targeted flaw.
Unbounded network device headroom growth in the Linux kernel's IPv6 tunnel driver (net/ip6_tunnel) lets the dev->needed_headroom value increase perpetually because, unlike its IPv4 counterpart, it lacked a ceiling. The fix ports the IPv4 headroom-growth limit (commit 5ae1e9922bbd) to the IPv6 path, capping repeated headroom adjustments. There is no public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.07%), so this is a stability/robustness hardening fix rather than an actively weaponized flaw.
Memory corruption in the Linux kernel's accel/qaic driver (Qualcomm Cloud AI 100 accelerator) allows a local user to trigger a general protection fault by submitting a DMA transfer request with a zero length, or when the device requests continuation (QAIC_TRANS_DMA_XFER_CONT) after all bytes have already been transferred. In these cases find_and_map_user_pages() returns 0 without allocating the scatter-gather table, and encode_addr_size_pairs() then dereferences the unallocated sgt, faulting the kernel. EPSS is very low (0.03%) and there is no public exploit identified at time of analysis, but distro patches (Ubuntu USN-8125-1/8126-1) are already shipping.
Resource exhaustion in the Linux kernel's NVMe-oF Fibre Channel target driver (nvmet-fc) stems from a reference-counting error in Link Service request handling: when multiple asynchronous LS commands are in flight from __nvmet_fc_send_ls_req, each takes a tgtport reference but only a single put-work item is queued, leaking the surplus references. Systems acting as NVMe-over-Fabrics FC targets are affected, and the leaked references prevent proper teardown of the target port, degrading availability over time. This is a defensive kernel hardening fix with no public exploit identified at time of analysis and a very low EPSS (0.05%).
Local information disclosure and potential use-after-free in the Linux kernel networking stack stems from unprotected reads of the destination cache device pointer (dst->dev) in sk_setup_caps() and related IPv4/IPv6 forwarding paths. Affected builds accessed dst->dev without RCU protection, allowing a concurrent update to free the device while another CPU dereferenced it. There is no public exploit identified at time of analysis, EPSS probability is negligible (0.03%), and the issue is not in CISA KEV; the upstream fix switches these call sites to the RCU-safe dst_dev_rcu()/dst_dev_net_rcu() helpers.
Local privilege-relevant memory corruption in the Linux kernel eBPF verifier arises because check_alu_op() validated the signed 16-bit instruction offset with 'insn->off > 1', which silently accepts negative values such as -1 instead of only 0 and 1. A local user able to load BPF programs can submit malformed ALU instructions (BPF_DIV/BPF_MOD) that bypass verifier bounds, undermining the safety guarantees the verifier is meant to enforce. No public exploit identified at time of analysis; EPSS is negligible (0.03%), and Ubuntu has shipped fixes.
Use-after-free in the Linux kernel's SMC (Shared Memory Communications) protocol handler smc_clc_prfx_match() lets a remote peer potentially trigger memory corruption during connection establishment. The flaw stems from dereferencing a destination cache device pointer (sk_dst_get(sk)->dev) outside RCU/RTNL protection in the listen path, so the dst entry can be freed concurrently. There is no public exploit identified at time of analysis and the EPSS probability is negligible (0.03%); notably the function's return value is unused by its caller, further limiting practical impact.
Denial-of-service in the Linux kernel ext4 filesystem driver allows a local attacker to trigger a kernel BUG_ON (panic) by inducing a victim to mount and access a specially crafted, corrupted ext4 image. The flaw stems from an inode that illegally carries both the INLINE_DATA and EXTENTS flags, which causes extent-tree validation to be skipped and an integer underflow during hole-size calculation in ext4_es_cache_extent(). Discovered via the syzbot fuzzer, it carries a low EPSS score (0.07%, 21st percentile), is not on the CISA KEV list, and has no public exploit identified at time of analysis, though a syzbot reproducer effectively exists.
Improper resource cleanup in the Linux kernel's Intel Xe DRM driver (drm/xe/guc) lets a local user trigger a memory-management fault when destroying a GPU exec queue after the GuC firmware has already been stopped - for example during a forced driver unbind. Because the driver waits for a GuC response that can never arrive, exec queue resources are never freed, leaving the GuC ID manager and VRAM manager in an unclean state and producing kernel WARNING/ERROR traces. The upstream fix (cherry-picked from commit 9b42321a02c5) releases the resources directly when the GuC is not running; EPSS is very low (0.03%) and there is no public exploit identified at time of analysis.
Local resource-leak and kernel-warning condition in the Linux kernel's NXP i.MX8-ISI mem2mem (m2m) media driver (imx8-isi) lets a local user with access to the V4L2 video device leave an ISI channel permanently allocated by terminating a streaming application uncleanly (e.g. Ctrl+C), because imbalanced streamon/streamoff calls prevent the m2m usage_count from reaching zero. On i.MX95-class hardware, streaming with an input line width greater than 2K additionally trips a WARN_ON() in mxc_isi_channel_chain(). This carries a low EPSS (0.03%, 10th percentile), is not on CISA KEV, and has no public exploit identified at time of analysis; a vendor fix is available.
In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix using smp_processor_id() in preemptible code warnings Syzbot reported the following warning: BUG: using. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Stop dl_server before CPU goes offline IBM CI tool reported kernel warning[1] when running a CPU removal operation. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails devm_kasprintf() may return NULL on memory allocation failure,. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: mailbox: zynqmp-ipi: Fix SGI cleanup on unbind The driver incorrectly determines SGI vs SPI interrupts by checking IRQ number < 16,. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: xen/events: Return -EEXIST for bound VIRQs Change find_virq() to return -EEXIST when a VIRQ is bound to a different CPU than the.
Local privilege-adjacent memory corruption in the Linux kernel's AF_XDP (XSK) transmit path allows a local user with access to an XDP socket to bypass descriptor validation via integer overflow, queuing malformed frames and triggering undefined behavior. The flaw stems from unchecked arithmetic in xp_aligned_validate_desc()/xp_unaligned_validate_desc() when a non-zero tx_metadata_len is combined with a crafted xdp_desc, and carries a CVSS of 7.8. EPSS is very low (0.03%) and there is no public exploit identified at time of analysis; it is not listed in CISA KEV.
Denial-of-service and potential kernel information disclosure in the Linux kernel IPv6 stack arises from a use-after-free in ip6_output(), where the network device destination (dst) could be freed while still referenced during packet transmission. The fix wraps ip6_output() in an RCU read-side critical section and uses dst_dev_rcu() so the device pointer stays valid, removing now-redundant rcu_read_lock/unlock pairs from ip6_finish_output2(). No public exploit identified at time of analysis; EPSS is very low (0.03%) and the flaw is not in CISA KEV, but the CVSS 8.1 rating reflects the memory-safety impact of a UAF in the packet output path.
In the Linux kernel, the following vulnerability has been resolved: EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller When loading the i10nm_edac driver on some Intel Granite Rapids. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() The drv->sram_reg pointer could be set to.
Denial of service (and potential information disclosure) in the Linux kernel's Intel VT-d IOMMU debugfs interface allows a privileged local user to crash the host by reading the domain translation dump. When a device's context entry uses a legacy-mode translation type other than 00b/01b, the SSPTPTR field is uninitialized or zero, and the debugfs code walks it as a valid page-table pointer, producing a general-protection fault on a non-canonical address. No public exploit identified at time of analysis; EPSS is negligible (0.03%) and this is not in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640.
In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: avoid soft lockup when mprotect to large memory area When calling mprotect() to a large hugetlb memory area in our.
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix bootup splat with separate_gpu_drm modparam The drm_gem_for_each_gpuvm_bo() call from lookup_vma() accesses. No vendor patch available.
Local denial of service in the Linux kernel's LoongArch BPF JIT allows a low-privileged local user with BPF tracing capability to crash the system by attaching a trampoline (fentry/fexit) program to a function whose arguments include a struct passed by value. On LoongArch the trampoline code never implemented struct-by-value handling, so the generated code dereferences an invalid address and triggers a kernel oops with subsequent RCU stalls. This is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is 0.03% (10th percentile), consistent with a niche, architecture-specific crash rather than a widely weaponized flaw.
Linux kernel F2FS filesystem implementation contains a race condition between garbage collection and block allocation that causes segment type inconsistencies, leading to filesystem shutdown. The vulnerability affects systems using F2FS with pinned files during concurrent fallocate and writepage operations. While the EPSS score is low at 0.03%, this is a kernel-level denial of service affecting data availability on affected systems.
In the Linux kernel, the following vulnerability has been resolved: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions The function dc_stream_set_cursor_attributes(). No vendor patch available.
Linux kernel block I/O throttling subsystem crashes with a NULL pointer dereference when I/O operations are submitted during early initialization before throttle policy is fully activated, causing denial of service on affected systems. The vulnerability affects the block layer's throttle policy initialization sequence and is triggered sporadically on cold boots when blk_should_throtl() accesses uninitialized throttle group state. With an EPSS score of 0.03% (10th percentile) and no public exploit identified, this is a low-probability but high-impact local crash condition requiring a kernel patch to fully resolve.
In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix potential deadlock while nr_requests grown Allocate and free sched_tags while queue is freezed can deadlock[1], this is. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure When devm_add_action_or_reset() fails, it calls the passed. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: bpf: dont report verifier bug for missing bpf_scc_visit on speculative path Syzbot generated a program that triggers a. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT snd_pcm_group_lock_irq() acquires a spinlock_t and. No vendor patch available.
Memory corruption in the Linux kernel Bluetooth Isochronous (ISO) channel subsystem allows a use-after-free when iso_conn_free() runs without conn->sk being cleared to NULL, mirroring a previously fixed SCO flaw. An attacker within Bluetooth range able to establish or tear down ISO connections can trigger the dangling-pointer condition to corrupt kernel memory, potentially escalating privileges or crashing the host. It carries a CVSS 8.0 (high) score; no public exploit has been identified and EPSS is very low (0.03%), indicating no observed exploitation activity.
Denial-of-service race condition in the Linux kernel's rtl8150 USB-to-Ethernet driver allows a kernel WARNING and double URB submission when the ndo_set_rx_mode path (rtl8150_set_multicast) improperly wakes the TX queue before an in-flight transmit URB completes, colliding with rtl8150_start_xmit. It affects systems using an RTL8150-based USB Ethernet adapter and was surfaced by syzbot fuzzing; no public exploit identified at time of analysis and EPSS is low (0.07%). The supplied 8.8 CVSS (AV:A/C:H/I:H/A:H) appears substantially inflated for what is fundamentally a local driver race with availability impact.
Local denial of service and potential information disclosure in the Linux kernel's SMC (Shared Memory Communications) subsystem arises because smc_clc_prfx_set() dereferences sk_dst_get(sk)->dev during connect() without holding RCU or RTNL, creating a use-after-free window on the destination cache entry. A local user opening an AF_SMC socket can trigger the freed dst->dev access, risking a kernel crash or leaked memory. No public exploit identified at time of analysis, EPSS is negligible (0.03%), and it is not on CISA KEV; the upstream fix switches to __sk_dst_get()/dst_dev_rcu() under rcu_read_lock().
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid NULL pointer dereference in f2fs_check_quota_consistency() syzbot reported a f2fs bug as below: Oops: gen[. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to truncate first page in error path of f2fs_truncate() syzbot reports a bug as below: loop0: detected capacity change.
In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - request reserved interrupt for virtual function The device interrupt vector 3 is an error interrupt for. No vendor patch available.
Use-after-free in the Linux kernel IPv6 stack's ip6_xmit() transmit path allows attackers to corrupt or read freed kernel memory when a destination cache (dst) entry and its associated network device are released concurrently during packet transmission. The fix converts the device dereference to an RCU-protected access via dst_dev_rcu(), closing a race window that could yield information disclosure or memory corruption. No public exploit has been identified at the time of analysis; EPSS exploitation probability is negligible (0.03%, 10th percentile).
In the Linux kernel, the following vulnerability has been resolved: dm: fix NULL pointer dereference in __dm_suspend() There is a race condition between dm device suspend and table load that can lead.
Use-after-free in the Linux kernel's MPTCP (Multipath TCP) subsystem allows potential kernel memory corruption during active connection establishment. The flaw lives in mptcp_active_enable(), reached via subflow_finish_connect()/sk_rx_dst_set(), where the destination cache is dereferenced (sk_dst_get(sk)->dev) outside RCU protection, permitting a freed dst/device pointer to be accessed. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), indicating negligible observed exploitation despite the 8.1 CVSS.
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback In create_sdw_dailink() check that sof_end->codec_info->add_sidecar. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu() In ath12k_dp_mon_rx_deliver_msdu(), peer lookup fails because. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling The cpu_latency_qos_add/remove/update_request interfaces lack. No vendor patch available.
Denial of service in the Linux kernel's SUNRPC/GSS-Kerberos (krb5) implementation allows remote attackers to crash the system via a zero-length RPCSEC_GSS checksum. When xdr_stream_decode_opaque_auth() decodes an auth token whose checksum length is zero, checksum.data is set to NULL, and gss_krb5_verify_mic_v2() then dereferences that NULL pointer, triggering a kernel panic. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N with A:H only) reflects availability-only impact; EPSS is very low (0.03%, 10th percentile) and there is no public exploit identified at time of analysis, though a vendor patch is available.
In the Linux kernel, the following vulnerability has been resolved: hwrng: ks-sa - fix division by zero in ks_sa_rng_init Fix division by zero in ks_sa_rng_init caused by missing clock pointer.
In the Linux kernel, the following vulnerability has been resolved: sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC The referenced commit introduced exception handlers.
In the Linux kernel, the following vulnerability has been resolved: blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx In __blk_mq_update_nr_hw_queues() the return value.
Local memory-safety mishandling in the Linux kernel's SPARC (UltraSPARC III) copy_from_user/copy_to_user routines causes these functions to return impossibly large "bytes not copied" values when a user-space access faults, because the %o2 register masking was performed after the bulk copy loop instead of before the exception handlers ran. Downstream consumers such as __copy_from_iter propagate the bogus count, which was observed triggering a BUG_ON in ext4 with large folios enabled, and can lead to kernel state corruption, information disclosure of uninitialized memory, or denial of service. No public exploit is identified at time of analysis (EPSS 0.09%, not in CISA KEV); the flaw is limited to legacy SPARC hardware.
Local privilege-constrained denial of service (and potential broader constraint bypass) in the Linux kernel BPF subsystem allows a user who can load BPF programs to bypass expected_attach_type enforcement via tailcall maps. A program can tailcall into an incompatible program whose verifier access rules were relaxed by its expected_attach_type (e.g. an XDP program returning xdp_md->egress_ifindex or a CGROUP_SOCK_ADDR program calling bpf_bind()), reaching code paths that dereference uninitialized state - demonstrated as a NULL pointer dereference of xdp_buff->txq in bpf_prog_test_run_xdp(). No public exploit identified at time of analysis; EPSS probability is very low (0.05%, 16th percentile) and it is not listed in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error When running perf_fuzzer on PTL, sometimes the below "unchecked MSR access. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640.
In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock Prevent USB runtime PM (autosuspend) for AX88772* in bind.
In the Linux kernel, the following vulnerability has been resolved: ext4: fix potential null deref in ext4_mb_init() In ext4_mb_init(), ext4_mb_avg_fragment_size_destroy() may be called when sbi->s_mb_avg_fragment_size remains uninitialized (e.g., if groupinfo slab cache allocation fails). Since ext4_mb_avg_fragment_size_destroy() lacks null pointer checking, this leads to a null pointer dereference. ================================================================== EXT4-fs: no memory for groupinfo slab cache BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0002 [#1] SMP PTI CPU:2 UID: 0 PID: 87 Comm:mount Not tainted 6.17.0-rc2 #1134 PREEMPT(none) RIP: 0010:_raw_spin_lock_irqsave+0x1b/0x40 Call Trace: <TASK> xa_destroy+0x61/0x130 ext4_mb_init+0x483/0x540 __ext4_fill_super+0x116d/0x17b0 ext4_fill_super+0xd3/0x280 get_tree_bdev_flags+0x132/0x1d0 vfs_get_tree+0x29/0xd0 do_new_mount+0x197/0x300 __x64_sys_mount+0x116/0x150 do_syscall_64+0x50/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ================================================================== Therefore, add necessary null check to ext4_mb_avg_fragment_size_destroy() to prevent this issue. The same fix is also applied to ext4_mb_largest_free_orders_destroy().
Memory corruption in the Linux kernel pm80xx SCSI driver (drivers/scsi/pm8001/pm8001_sas.c) lets a privileged local operation trigger an out-of-bounds array write when a module unload (rmmod) occurs on a system with a SAS expander attached. Introduced by commit f7b705c238d1, the flaw causes the driver to index the fixed 16-entry pm8001_ha->phy array with a remote expander phy id (observed index 28), corrupting kernel memory during teardown. No public exploit identified at time of analysis; EPSS is low (0.07%, 21st percentile) and it is not on CISA KEV, consistent with a stability/robustness bug rather than a weaponized escalation path.
Local privilege escalation and memory corruption in the Linux kernel's pci_endpoint_test misc driver stems from an array underflow reachable through the driver's ioctl handler. A regression from commit eefb83790a0d (which added the doorbell test case and introduced NO_BAR = -1 into the pci_barno enum, silently converting it to a signed type) lets a user passing a negative BAR number in pci_endpoint_test_ioctl() drive pci_endpoint_test_bar() to index before the start of the BAR array. There is no public exploit identified at time of analysis and EPSS rates near-term mass exploitation at 0.03%, but the flaw affects the ubiquitous Linux kernel wherever the pci-endpoint-test device node is exposed.
In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup The kthread_run() function returns error pointers so the.
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() During mpt3sas_transport_port_remove(), messages were logged.
In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E The ADSP firmware on X1E has separate firmware binaries for the main firmware. No vendor patch available.
Incorrect fault-handling in the SPARC (Niagara) implementation of copy_from_user and copy_to_user in the Linux kernel causes wrong remaining-byte calculations and a broken epilogue when a user-space memory reference faults, leading to kernel crashes and incorrect return values from these core copy routines. The flaw is SPARC-architecture specific (Niagara/UltraSPARC T-series) and is fixed upstream; it is tagged as a denial-of-service issue. No public exploit identified at time of analysis, and EPSS is very low (0.07%, 21st percentile).
Local privilege-escalation-capable use-after-free in the Linux kernel's vmwgfx DRM driver (drm/vmwgfx) lets a low-privileged local user trigger a stale-pointer dereference during GPU command-buffer validation. During vmw_execbuf_process, a validation node held in the duplicates hashtable is backed by an arena allocator that is bulk-cleared at the end of processing; because the node's resource is destroyed prematurely, it escapes vmw_validation_drop_ht, leaving a dangling reference into freed memory that can be reused. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the CVSS 7.8 rating with full confidentiality/integrity/availability impact makes it a meaningful local escalation primitive on VMware Linux guests.
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a null-ptr access in the cursor snooper Check that the resource which is converted to a surface exists before.
In the Linux kernel, the following vulnerability has been resolved: crypto: rng - Ensure set_ent is always present Ensure that set_ent is always set since only drbg provides it.
In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: Fix blocked task Revert commit 1afa70632c39 ("serial: qcom-geni: Enable PM runtime for serial driver") and its. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled This issue is similar to the.
Memory-management flaw in the Linux kernel VFS layer allows a local user with handle-lookup privileges to leak disconnected directory dentries by calling open_by_handle_at() on uncached inodes, eventually producing a 'Busy inodes after unmount' condition and unreclaimed kernel memory. The bug surfaces when reconnect_one() fails to find the target dentry and creates a replacement that is not flagged as disconnected, so dput() never immediately reclaims it - a regression exposed by commit f1ee616214cb, which stopped tracking most disconnected dentries on sb->s_anon. There is no public exploit identified at time of analysis, EPSS is low (0.19%, 9th percentile), and this is not in CISA KEV.
Local denial-of-service in the Linux kernel's ixgbevf driver (Intel 10G SR-IOV virtual function driver) arises from broken mailbox API negotiation between PF and VF drivers. Since API 1.4/1.5/1.6, VF-specific features (IPsec offload, ESX enhanced mailbox) were bolted on without a feature-negotiation mechanism, causing crashes when the VF driver assumes support the underlying PF/kernel ixgbe driver does not actually implement. The fix introduces a new mailbox op so the VF queries the PF for supported features before enabling IPsec or ESX-specific paths. No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile) and there is no KEV listing.
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of uninitialized garbage for routing / injecting the exception. In one case the injection code and the hyp disagree on whether the vCPU has a 32bit EL1 and put the vCPU into an illegal mode for AArch64, tripping the BUG() in exception_target_el() during the next injection: kernel BUG at arch/arm64/kvm/inject_fault.c:40! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 3 UID: 0 PID: 318 Comm: repro Not tainted 6.17.0-rc4-00104-g10fd0285305d #6 PREEMPT Hardware name: linux,dummy-virt (DT) pstate: 21402009 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : exception_target_el+0x88/0x8c lr : pend_serror_exception+0x18/0x13c sp : ffff800082f03a10 x29: ffff800082f03a10 x28: ffff0000cb132280 x27: 0000000000000000 x26: 0000000000000000 x25: ffff0000c2a99c20 x24: 0000000000000000 x23: 0000000000008000 x22: 0000000000000002 x21: 0000000000000004 x20: 0000000000008000 x19: ffff0000c2a99c20 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200000c0 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff800082f03af8 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff800080f621f0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 000000000040009b x1 : 0000000000000003 x0 : ffff0000c2a99c20 Call trace: exception_target_el+0x88/0x8c (P) kvm_inject_serror_esr+0x40/0x3b4 __kvm_arm_vcpu_set_events+0xf0/0x100 kvm_arch_vcpu_ioctl+0x180/0x9d4 kvm_vcpu_ioctl+0x60c/0x9f4 __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xf0 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: f946bc01 b4fffe61 9101e020 17fffff2 (d4210000) Reject the ioctls outright as no sane VMM would call these before KVM_ARM_VCPU_INIT anyway. Even if it did the exception would've been thrown away by the eventual reset of the vCPU's state.
Out-of-bounds memory access in the Linux kernel's CIFS/SMB client (parse_dfs_referrals) allows a malicious or compromised SMB server to trigger memory corruption on connecting clients by returning a malformed FSCTL_DFS_GET_REFERRALS reply. The flaw affects Linux systems that mount SMB/CIFS shares and process DFS referrals, where a reply shorter than struct get_dfs_referral_rsp or claiming more referrals than it contains drives reads past the buffer. No public exploit identified at time of analysis, and EPSS is low (0.19%, 9th percentile), consistent with a client-side, server-triggered condition rather than mass-exploitable exposure.
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() Return value of a function acpi_evaluate_dsm() is dereferenced without checking for NULL, but it is usually checked for this function. acpi_evaluate_dsm() may return NULL, when acpi_evaluate_object() returns acpi_status other than ACPI_SUCCESS, so add a check to prevent the crach. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Local memory corruption in the Linux kernel's DRM GPU scheduler (drm/sched) stems from a double free in drm_sched_job_add_resv_dependencies(), where a dma_fence reference that drm_sched_job_add_dependency() already consumed on its failure path is released a second time when the backing xarray fails to expand. Any local user able to submit GPU jobs on an affected kernel can trigger the flaw, leading to kernel memory corruption and denial of service. There is no public exploit identified at time of analysis, EPSS is low (0.19%), and it is not listed in CISA KEV.
Denial of service in the Linux kernel's USB gadget RNDIS function driver (f_rndis) lets a local privileged user crash the kernel via a NULL pointer dereference. After a bind/unbind cycle leaves rndis->notify_req stale, a subsequently failing bind reaches a unified error path that calls free_request on the stale request, dereferencing ep->ops->free_request on freed/NULL state. Tagged as Denial of Service; no public exploit is identified, EPSS is low (0.19%, 9th percentile), and it is not on CISA KEV.
Kernel NULL pointer dereference in the Linux USB gadget ACM function (f_acm) allows a local privileged operator to crash the kernel after a USB gadget bind/unbind cycle. After unbind, acm->notify_req is left stale; if a subsequent bind fails, the shared error path frees the stale request and dereferences a NULL ep->ops->free_request pointer in usb_ep_free_request(), producing a fatal oops. Tagged as a Denial of Service issue; EPSS is low (0.19%, 9th percentile), no public exploit is identified, and it is not listed in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix kfd process ref leaking when userptr unmapping kfd_lookup_process_by_pid hold the kfd process reference to ensure. No vendor patch available.
Filesystem corruption and denial of service in the Linux kernel's ext4 extended-attribute (EA) inode handling allows a local attacker who can mount a crafted or corrupted ext4 image to trigger a reference-count underflow in ext4_xattr_inode_update_ref(). Because the code previously read an EA inode refcount that was already <= 0 and still applied the change (typically -1), it proceeded on a bogus negative value, spawning EXT4-fs errors and orphan/cleanup churn. No public exploit identified at time of analysis, and the EPSS score is very low (0.07%), consistent with a corruption-triggered fault rather than a readily weaponized remote flaw.
In the Linux kernel, the following vulnerability has been resolved: net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx_read_raw_eeprom Syzbot reported read of uninitialized. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: pwm: berlin: Fix wrong register in suspend/resume The 'enable' register should be BERLIN_PWM_EN rather than BERLIN_PWM_ENABLE,.
Denial of service in the Linux kernel's SCTP stack (net/sctp) allows a NULL-pointer dereference in the sctp_sf_do_5_1D_ce() COOKIE ECHO state-machine handler, crashing the kernel. When processing an incoming SCTP association setup, if the peer adaptation indication is zero and the authkey ulpevent allocation returns NULL, the uninitialized ai_ev pointer is passed to sctp_ulpevent_free() and dereferenced, panicking the system. The issue affects hosts actively using SCTP; there is no public exploit identified at time of analysis and EPSS risk is low (0.07%).
Memory corruption in the Linux kernel TCP stack allows a race between closing a listening socket and processing an in-flight TCP Fast Open (TFO) connection request to trigger a refcount underflow and double-free of the request socket, originally caught by syzbot. The flaw sits in tcp_conn_request(), which redundantly calls reqsk_fastopen_remove() after inet_child_forget()/tcp_disconnect() has already released the request socket, corrupting the listener's refcount. There is no public exploit identified at time of analysis and EPSS is very low (0.07%), but as a remotely reachable kernel use-after-free it warrants patching on IPv4/IPv6 servers that accept TFO connections.
In the Linux kernel, the following vulnerability has been resolved: ice: ice_adapter: release xa entry on adapter allocation failure When ice_adapter_new() fails, the reserved XArray entry created by. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix debug checking for np-guests using huge mappings When running with transparent huge pages and CONFIG_NVHE_EL2_DEBUG. No vendor patch available.
Resource exhaustion in the Linux kernel's BPF subsystem allows gradual, unbounded kernel memory consumption (kmalloc-256 slab) leading to denial of service on hosts using the bpf_redirect_neigh() helper on the collect-metadata vxlan datapath. The __bpf_redirect_neigh_v4/v6 code called skb_dst_set() to attach a new dst entry without first releasing the metadata_dst that vxlan had already attached, leaking one dst object per redirected packet. The condition was observed in production on Cilium egress-gateway deployments, where decapsulated Pod traffic is forwarded via bpf_redirect_neigh(); EPSS is low (0.07%) and there is no public exploit identified at time of analysis.
Local privilege-escalation and memory-corruption in the Linux kernel's crypto skcipher (symmetric block cipher) framework allows a low-privileged local user to corrupt kernel memory by exercising an skcipher algorithm that declares its request size via the new cra_reqsize field. The regression stems from commit afddce13ce81d, which added cra_reqsize for ahash/acomp but left skcipher's framework paths unaware of it, so per-request scratch buffers are undersized. EPSS is negligible (0.03%), the issue is not on the CISA KEV list, and no public exploit is identified - the tags characterize the practical outcome as denial of service (kernel crash), though memory corruption leaves privilege escalation theoretically possible.
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP When running as an SNP or TDX guest under KVM, force the. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop The cleanup loop was starting at the wrong array index,.
In the Linux kernel, the following vulnerability has been resolved: ext4: verify orphan file size is not too big In principle orphan file can be arbitrarily large.
In the Linux kernel, the following vulnerability has been resolved: pid: Add a judgment for ns null in pid_nr_ns __task_pid_nr_ns ns = task_active_pid_ns(current);.
In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Fix bootlog initialization ordering As soon as we queue MHI buffers to receive the bootlog from the device, we could be. No vendor patch available.
Memory-safety fault in the Linux kernel's kTLS (kernel TLS) receive path allows use-after-free on socket buffers and stray writes into userspace memory after recv() has returned when async record decryption is used and an atomic skb clone allocation fails. Affected systems are those whose applications enable in-kernel TLS with asynchronous decryption; an attacker able to induce memory pressure while TLS records are inflight can corrupt kernel/user memory or leak data. Tagged as Information Disclosure, EPSS is negligible (0.03%), no public exploit is identified, and the issue is fixed upstream and shipped by distributions (Ubuntu USN-8125-1/USN-8126-1).
In the Linux kernel, the following vulnerability has been resolved: idpf: cleanup remaining SKBs in PTP flows When the driver requests Tx timestamp value, one of the first steps is to clone SKB using. No vendor patch available.
Missing memory-barrier ordering in the x86 memory-management code of the Linux kernel allows stale TLB entries to persist after an address-space switch, because switch_mm_irqs_off() can fail to observe a recent tlb_gen update from flush_tlb_mm_range(). On affected x86 SMP systems a local, low-privileged process could read or corrupt memory mappings it should no longer have access to, mapping to the CVSS 7.8 high/high/high impact. No public exploit identified at time of analysis, and the EPSS score is negligible (0.03%, 10th percentile), indicating this is a subtle correctness/race fix rather than an actively-targeted flaw.
Unbounded network device headroom growth in the Linux kernel's IPv6 tunnel driver (net/ip6_tunnel) lets the dev->needed_headroom value increase perpetually because, unlike its IPv4 counterpart, it lacked a ceiling. The fix ports the IPv4 headroom-growth limit (commit 5ae1e9922bbd) to the IPv6 path, capping repeated headroom adjustments. There is no public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.07%), so this is a stability/robustness hardening fix rather than an actively weaponized flaw.
Memory corruption in the Linux kernel's accel/qaic driver (Qualcomm Cloud AI 100 accelerator) allows a local user to trigger a general protection fault by submitting a DMA transfer request with a zero length, or when the device requests continuation (QAIC_TRANS_DMA_XFER_CONT) after all bytes have already been transferred. In these cases find_and_map_user_pages() returns 0 without allocating the scatter-gather table, and encode_addr_size_pairs() then dereferences the unallocated sgt, faulting the kernel. EPSS is very low (0.03%) and there is no public exploit identified at time of analysis, but distro patches (Ubuntu USN-8125-1/8126-1) are already shipping.
Resource exhaustion in the Linux kernel's NVMe-oF Fibre Channel target driver (nvmet-fc) stems from a reference-counting error in Link Service request handling: when multiple asynchronous LS commands are in flight from __nvmet_fc_send_ls_req, each takes a tgtport reference but only a single put-work item is queued, leaking the surplus references. Systems acting as NVMe-over-Fabrics FC targets are affected, and the leaked references prevent proper teardown of the target port, degrading availability over time. This is a defensive kernel hardening fix with no public exploit identified at time of analysis and a very low EPSS (0.05%).
Local information disclosure and potential use-after-free in the Linux kernel networking stack stems from unprotected reads of the destination cache device pointer (dst->dev) in sk_setup_caps() and related IPv4/IPv6 forwarding paths. Affected builds accessed dst->dev without RCU protection, allowing a concurrent update to free the device while another CPU dereferenced it. There is no public exploit identified at time of analysis, EPSS probability is negligible (0.03%), and the issue is not in CISA KEV; the upstream fix switches these call sites to the RCU-safe dst_dev_rcu()/dst_dev_net_rcu() helpers.
Local privilege-relevant memory corruption in the Linux kernel eBPF verifier arises because check_alu_op() validated the signed 16-bit instruction offset with 'insn->off > 1', which silently accepts negative values such as -1 instead of only 0 and 1. A local user able to load BPF programs can submit malformed ALU instructions (BPF_DIV/BPF_MOD) that bypass verifier bounds, undermining the safety guarantees the verifier is meant to enforce. No public exploit identified at time of analysis; EPSS is negligible (0.03%), and Ubuntu has shipped fixes.
Use-after-free in the Linux kernel's SMC (Shared Memory Communications) protocol handler smc_clc_prfx_match() lets a remote peer potentially trigger memory corruption during connection establishment. The flaw stems from dereferencing a destination cache device pointer (sk_dst_get(sk)->dev) outside RCU/RTNL protection in the listen path, so the dst entry can be freed concurrently. There is no public exploit identified at time of analysis and the EPSS probability is negligible (0.03%); notably the function's return value is unused by its caller, further limiting practical impact.
Denial-of-service in the Linux kernel ext4 filesystem driver allows a local attacker to trigger a kernel BUG_ON (panic) by inducing a victim to mount and access a specially crafted, corrupted ext4 image. The flaw stems from an inode that illegally carries both the INLINE_DATA and EXTENTS flags, which causes extent-tree validation to be skipped and an integer underflow during hole-size calculation in ext4_es_cache_extent(). Discovered via the syzbot fuzzer, it carries a low EPSS score (0.07%, 21st percentile), is not on the CISA KEV list, and has no public exploit identified at time of analysis, though a syzbot reproducer effectively exists.
Improper resource cleanup in the Linux kernel's Intel Xe DRM driver (drm/xe/guc) lets a local user trigger a memory-management fault when destroying a GPU exec queue after the GuC firmware has already been stopped - for example during a forced driver unbind. Because the driver waits for a GuC response that can never arrive, exec queue resources are never freed, leaving the GuC ID manager and VRAM manager in an unclean state and producing kernel WARNING/ERROR traces. The upstream fix (cherry-picked from commit 9b42321a02c5) releases the resources directly when the GuC is not running; EPSS is very low (0.03%) and there is no public exploit identified at time of analysis.
Local resource-leak and kernel-warning condition in the Linux kernel's NXP i.MX8-ISI mem2mem (m2m) media driver (imx8-isi) lets a local user with access to the V4L2 video device leave an ISI channel permanently allocated by terminating a streaming application uncleanly (e.g. Ctrl+C), because imbalanced streamon/streamoff calls prevent the m2m usage_count from reaching zero. On i.MX95-class hardware, streaming with an input line width greater than 2K additionally trips a WARN_ON() in mxc_isi_channel_chain(). This carries a low EPSS (0.03%, 10th percentile), is not on CISA KEV, and has no public exploit identified at time of analysis; a vendor fix is available.
In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix using smp_processor_id() in preemptible code warnings Syzbot reported the following warning: BUG: using. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Stop dl_server before CPU goes offline IBM CI tool reported kernel warning[1] when running a CPU removal operation. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails devm_kasprintf() may return NULL on memory allocation failure,. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: mailbox: zynqmp-ipi: Fix SGI cleanup on unbind The driver incorrectly determines SGI vs SPI interrupts by checking IRQ number < 16,. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: xen/events: Return -EEXIST for bound VIRQs Change find_virq() to return -EEXIST when a VIRQ is bound to a different CPU than the.
Local privilege-adjacent memory corruption in the Linux kernel's AF_XDP (XSK) transmit path allows a local user with access to an XDP socket to bypass descriptor validation via integer overflow, queuing malformed frames and triggering undefined behavior. The flaw stems from unchecked arithmetic in xp_aligned_validate_desc()/xp_unaligned_validate_desc() when a non-zero tx_metadata_len is combined with a crafted xdp_desc, and carries a CVSS of 7.8. EPSS is very low (0.03%) and there is no public exploit identified at time of analysis; it is not listed in CISA KEV.
Denial-of-service and potential kernel information disclosure in the Linux kernel IPv6 stack arises from a use-after-free in ip6_output(), where the network device destination (dst) could be freed while still referenced during packet transmission. The fix wraps ip6_output() in an RCU read-side critical section and uses dst_dev_rcu() so the device pointer stays valid, removing now-redundant rcu_read_lock/unlock pairs from ip6_finish_output2(). No public exploit identified at time of analysis; EPSS is very low (0.03%) and the flaw is not in CISA KEV, but the CVSS 8.1 rating reflects the memory-safety impact of a UAF in the packet output path.
In the Linux kernel, the following vulnerability has been resolved: EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller When loading the i10nm_edac driver on some Intel Granite Rapids. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() The drv->sram_reg pointer could be set to.
Denial of service (and potential information disclosure) in the Linux kernel's Intel VT-d IOMMU debugfs interface allows a privileged local user to crash the host by reading the domain translation dump. When a device's context entry uses a legacy-mode translation type other than 00b/01b, the SSPTPTR field is uninitialized or zero, and the debugfs code walks it as a valid page-table pointer, producing a general-protection fault on a non-canonical address. No public exploit identified at time of analysis; EPSS is negligible (0.03%) and this is not in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640.
In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: avoid soft lockup when mprotect to large memory area When calling mprotect() to a large hugetlb memory area in our.
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix bootup splat with separate_gpu_drm modparam The drm_gem_for_each_gpuvm_bo() call from lookup_vma() accesses. No vendor patch available.
Local denial of service in the Linux kernel's LoongArch BPF JIT allows a low-privileged local user with BPF tracing capability to crash the system by attaching a trampoline (fentry/fexit) program to a function whose arguments include a struct passed by value. On LoongArch the trampoline code never implemented struct-by-value handling, so the generated code dereferences an invalid address and triggers a kernel oops with subsequent RCU stalls. This is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is 0.03% (10th percentile), consistent with a niche, architecture-specific crash rather than a widely weaponized flaw.
Linux kernel F2FS filesystem implementation contains a race condition between garbage collection and block allocation that causes segment type inconsistencies, leading to filesystem shutdown. The vulnerability affects systems using F2FS with pinned files during concurrent fallocate and writepage operations. While the EPSS score is low at 0.03%, this is a kernel-level denial of service affecting data availability on affected systems.
In the Linux kernel, the following vulnerability has been resolved: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions The function dc_stream_set_cursor_attributes(). No vendor patch available.
Linux kernel block I/O throttling subsystem crashes with a NULL pointer dereference when I/O operations are submitted during early initialization before throttle policy is fully activated, causing denial of service on affected systems. The vulnerability affects the block layer's throttle policy initialization sequence and is triggered sporadically on cold boots when blk_should_throtl() accesses uninitialized throttle group state. With an EPSS score of 0.03% (10th percentile) and no public exploit identified, this is a low-probability but high-impact local crash condition requiring a kernel patch to fully resolve.
In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix potential deadlock while nr_requests grown Allocate and free sched_tags while queue is freezed can deadlock[1], this is. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure When devm_add_action_or_reset() fails, it calls the passed. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: bpf: dont report verifier bug for missing bpf_scc_visit on speculative path Syzbot generated a program that triggers a. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT snd_pcm_group_lock_irq() acquires a spinlock_t and. No vendor patch available.
Memory corruption in the Linux kernel Bluetooth Isochronous (ISO) channel subsystem allows a use-after-free when iso_conn_free() runs without conn->sk being cleared to NULL, mirroring a previously fixed SCO flaw. An attacker within Bluetooth range able to establish or tear down ISO connections can trigger the dangling-pointer condition to corrupt kernel memory, potentially escalating privileges or crashing the host. It carries a CVSS 8.0 (high) score; no public exploit has been identified and EPSS is very low (0.03%), indicating no observed exploitation activity.
Denial-of-service race condition in the Linux kernel's rtl8150 USB-to-Ethernet driver allows a kernel WARNING and double URB submission when the ndo_set_rx_mode path (rtl8150_set_multicast) improperly wakes the TX queue before an in-flight transmit URB completes, colliding with rtl8150_start_xmit. It affects systems using an RTL8150-based USB Ethernet adapter and was surfaced by syzbot fuzzing; no public exploit identified at time of analysis and EPSS is low (0.07%). The supplied 8.8 CVSS (AV:A/C:H/I:H/A:H) appears substantially inflated for what is fundamentally a local driver race with availability impact.
Local denial of service and potential information disclosure in the Linux kernel's SMC (Shared Memory Communications) subsystem arises because smc_clc_prfx_set() dereferences sk_dst_get(sk)->dev during connect() without holding RCU or RTNL, creating a use-after-free window on the destination cache entry. A local user opening an AF_SMC socket can trigger the freed dst->dev access, risking a kernel crash or leaked memory. No public exploit identified at time of analysis, EPSS is negligible (0.03%), and it is not on CISA KEV; the upstream fix switches to __sk_dst_get()/dst_dev_rcu() under rcu_read_lock().
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid NULL pointer dereference in f2fs_check_quota_consistency() syzbot reported a f2fs bug as below: Oops: gen[. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to truncate first page in error path of f2fs_truncate() syzbot reports a bug as below: loop0: detected capacity change.
In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - request reserved interrupt for virtual function The device interrupt vector 3 is an error interrupt for. No vendor patch available.
Use-after-free in the Linux kernel IPv6 stack's ip6_xmit() transmit path allows attackers to corrupt or read freed kernel memory when a destination cache (dst) entry and its associated network device are released concurrently during packet transmission. The fix converts the device dereference to an RCU-protected access via dst_dev_rcu(), closing a race window that could yield information disclosure or memory corruption. No public exploit has been identified at the time of analysis; EPSS exploitation probability is negligible (0.03%, 10th percentile).
In the Linux kernel, the following vulnerability has been resolved: dm: fix NULL pointer dereference in __dm_suspend() There is a race condition between dm device suspend and table load that can lead.
Use-after-free in the Linux kernel's MPTCP (Multipath TCP) subsystem allows potential kernel memory corruption during active connection establishment. The flaw lives in mptcp_active_enable(), reached via subflow_finish_connect()/sk_rx_dst_set(), where the destination cache is dereferenced (sk_dst_get(sk)->dev) outside RCU protection, permitting a freed dst/device pointer to be accessed. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), indicating negligible observed exploitation despite the 8.1 CVSS.
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback In create_sdw_dailink() check that sof_end->codec_info->add_sidecar. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu() In ath12k_dp_mon_rx_deliver_msdu(), peer lookup fails because. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling The cpu_latency_qos_add/remove/update_request interfaces lack. No vendor patch available.
Denial of service in the Linux kernel's SUNRPC/GSS-Kerberos (krb5) implementation allows remote attackers to crash the system via a zero-length RPCSEC_GSS checksum. When xdr_stream_decode_opaque_auth() decodes an auth token whose checksum length is zero, checksum.data is set to NULL, and gss_krb5_verify_mic_v2() then dereferences that NULL pointer, triggering a kernel panic. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N with A:H only) reflects availability-only impact; EPSS is very low (0.03%, 10th percentile) and there is no public exploit identified at time of analysis, though a vendor patch is available.
In the Linux kernel, the following vulnerability has been resolved: hwrng: ks-sa - fix division by zero in ks_sa_rng_init Fix division by zero in ks_sa_rng_init caused by missing clock pointer.
In the Linux kernel, the following vulnerability has been resolved: sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC The referenced commit introduced exception handlers.
In the Linux kernel, the following vulnerability has been resolved: blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx In __blk_mq_update_nr_hw_queues() the return value.
Local memory-safety mishandling in the Linux kernel's SPARC (UltraSPARC III) copy_from_user/copy_to_user routines causes these functions to return impossibly large "bytes not copied" values when a user-space access faults, because the %o2 register masking was performed after the bulk copy loop instead of before the exception handlers ran. Downstream consumers such as __copy_from_iter propagate the bogus count, which was observed triggering a BUG_ON in ext4 with large folios enabled, and can lead to kernel state corruption, information disclosure of uninitialized memory, or denial of service. No public exploit is identified at time of analysis (EPSS 0.09%, not in CISA KEV); the flaw is limited to legacy SPARC hardware.
Local privilege-constrained denial of service (and potential broader constraint bypass) in the Linux kernel BPF subsystem allows a user who can load BPF programs to bypass expected_attach_type enforcement via tailcall maps. A program can tailcall into an incompatible program whose verifier access rules were relaxed by its expected_attach_type (e.g. an XDP program returning xdp_md->egress_ifindex or a CGROUP_SOCK_ADDR program calling bpf_bind()), reaching code paths that dereference uninitialized state - demonstrated as a NULL pointer dereference of xdp_buff->txq in bpf_prog_test_run_xdp(). No public exploit identified at time of analysis; EPSS probability is very low (0.05%, 16th percentile) and it is not listed in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error When running perf_fuzzer on PTL, sometimes the below "unchecked MSR access. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640.
In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock Prevent USB runtime PM (autosuspend) for AX88772* in bind.
In the Linux kernel, the following vulnerability has been resolved: ext4: fix potential null deref in ext4_mb_init() In ext4_mb_init(), ext4_mb_avg_fragment_size_destroy() may be called when sbi->s_mb_avg_fragment_size remains uninitialized (e.g., if groupinfo slab cache allocation fails). Since ext4_mb_avg_fragment_size_destroy() lacks null pointer checking, this leads to a null pointer dereference. ================================================================== EXT4-fs: no memory for groupinfo slab cache BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0002 [#1] SMP PTI CPU:2 UID: 0 PID: 87 Comm:mount Not tainted 6.17.0-rc2 #1134 PREEMPT(none) RIP: 0010:_raw_spin_lock_irqsave+0x1b/0x40 Call Trace: <TASK> xa_destroy+0x61/0x130 ext4_mb_init+0x483/0x540 __ext4_fill_super+0x116d/0x17b0 ext4_fill_super+0xd3/0x280 get_tree_bdev_flags+0x132/0x1d0 vfs_get_tree+0x29/0xd0 do_new_mount+0x197/0x300 __x64_sys_mount+0x116/0x150 do_syscall_64+0x50/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ================================================================== Therefore, add necessary null check to ext4_mb_avg_fragment_size_destroy() to prevent this issue. The same fix is also applied to ext4_mb_largest_free_orders_destroy().
Memory corruption in the Linux kernel pm80xx SCSI driver (drivers/scsi/pm8001/pm8001_sas.c) lets a privileged local operation trigger an out-of-bounds array write when a module unload (rmmod) occurs on a system with a SAS expander attached. Introduced by commit f7b705c238d1, the flaw causes the driver to index the fixed 16-entry pm8001_ha->phy array with a remote expander phy id (observed index 28), corrupting kernel memory during teardown. No public exploit identified at time of analysis; EPSS is low (0.07%, 21st percentile) and it is not on CISA KEV, consistent with a stability/robustness bug rather than a weaponized escalation path.
Local privilege escalation and memory corruption in the Linux kernel's pci_endpoint_test misc driver stems from an array underflow reachable through the driver's ioctl handler. A regression from commit eefb83790a0d (which added the doorbell test case and introduced NO_BAR = -1 into the pci_barno enum, silently converting it to a signed type) lets a user passing a negative BAR number in pci_endpoint_test_ioctl() drive pci_endpoint_test_bar() to index before the start of the BAR array. There is no public exploit identified at time of analysis and EPSS rates near-term mass exploitation at 0.03%, but the flaw affects the ubiquitous Linux kernel wherever the pci-endpoint-test device node is exposed.
In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup The kthread_run() function returns error pointers so the.
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() During mpt3sas_transport_port_remove(), messages were logged.
In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E The ADSP firmware on X1E has separate firmware binaries for the main firmware. No vendor patch available.
Incorrect fault-handling in the SPARC (Niagara) implementation of copy_from_user and copy_to_user in the Linux kernel causes wrong remaining-byte calculations and a broken epilogue when a user-space memory reference faults, leading to kernel crashes and incorrect return values from these core copy routines. The flaw is SPARC-architecture specific (Niagara/UltraSPARC T-series) and is fixed upstream; it is tagged as a denial-of-service issue. No public exploit identified at time of analysis, and EPSS is very low (0.07%, 21st percentile).
Local privilege-escalation-capable use-after-free in the Linux kernel's vmwgfx DRM driver (drm/vmwgfx) lets a low-privileged local user trigger a stale-pointer dereference during GPU command-buffer validation. During vmw_execbuf_process, a validation node held in the duplicates hashtable is backed by an arena allocator that is bulk-cleared at the end of processing; because the node's resource is destroyed prematurely, it escapes vmw_validation_drop_ht, leaving a dangling reference into freed memory that can be reused. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the CVSS 7.8 rating with full confidentiality/integrity/availability impact makes it a meaningful local escalation primitive on VMware Linux guests.
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a null-ptr access in the cursor snooper Check that the resource which is converted to a surface exists before.
In the Linux kernel, the following vulnerability has been resolved: crypto: rng - Ensure set_ent is always present Ensure that set_ent is always set since only drbg provides it.
In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: Fix blocked task Revert commit 1afa70632c39 ("serial: qcom-geni: Enable PM runtime for serial driver") and its. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled This issue is similar to the.
Memory-management flaw in the Linux kernel VFS layer allows a local user with handle-lookup privileges to leak disconnected directory dentries by calling open_by_handle_at() on uncached inodes, eventually producing a 'Busy inodes after unmount' condition and unreclaimed kernel memory. The bug surfaces when reconnect_one() fails to find the target dentry and creates a replacement that is not flagged as disconnected, so dput() never immediately reclaims it - a regression exposed by commit f1ee616214cb, which stopped tracking most disconnected dentries on sb->s_anon. There is no public exploit identified at time of analysis, EPSS is low (0.19%, 9th percentile), and this is not in CISA KEV.
Local denial-of-service in the Linux kernel's ixgbevf driver (Intel 10G SR-IOV virtual function driver) arises from broken mailbox API negotiation between PF and VF drivers. Since API 1.4/1.5/1.6, VF-specific features (IPsec offload, ESX enhanced mailbox) were bolted on without a feature-negotiation mechanism, causing crashes when the VF driver assumes support the underlying PF/kernel ixgbe driver does not actually implement. The fix introduces a new mailbox op so the VF queries the PF for supported features before enabling IPsec or ESX-specific paths. No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile) and there is no KEV listing.
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of uninitialized garbage for routing / injecting the exception. In one case the injection code and the hyp disagree on whether the vCPU has a 32bit EL1 and put the vCPU into an illegal mode for AArch64, tripping the BUG() in exception_target_el() during the next injection: kernel BUG at arch/arm64/kvm/inject_fault.c:40! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 3 UID: 0 PID: 318 Comm: repro Not tainted 6.17.0-rc4-00104-g10fd0285305d #6 PREEMPT Hardware name: linux,dummy-virt (DT) pstate: 21402009 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : exception_target_el+0x88/0x8c lr : pend_serror_exception+0x18/0x13c sp : ffff800082f03a10 x29: ffff800082f03a10 x28: ffff0000cb132280 x27: 0000000000000000 x26: 0000000000000000 x25: ffff0000c2a99c20 x24: 0000000000000000 x23: 0000000000008000 x22: 0000000000000002 x21: 0000000000000004 x20: 0000000000008000 x19: ffff0000c2a99c20 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200000c0 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff800082f03af8 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff800080f621f0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 000000000040009b x1 : 0000000000000003 x0 : ffff0000c2a99c20 Call trace: exception_target_el+0x88/0x8c (P) kvm_inject_serror_esr+0x40/0x3b4 __kvm_arm_vcpu_set_events+0xf0/0x100 kvm_arch_vcpu_ioctl+0x180/0x9d4 kvm_vcpu_ioctl+0x60c/0x9f4 __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xf0 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: f946bc01 b4fffe61 9101e020 17fffff2 (d4210000) Reject the ioctls outright as no sane VMM would call these before KVM_ARM_VCPU_INIT anyway. Even if it did the exception would've been thrown away by the eventual reset of the vCPU's state.
Out-of-bounds memory access in the Linux kernel's CIFS/SMB client (parse_dfs_referrals) allows a malicious or compromised SMB server to trigger memory corruption on connecting clients by returning a malformed FSCTL_DFS_GET_REFERRALS reply. The flaw affects Linux systems that mount SMB/CIFS shares and process DFS referrals, where a reply shorter than struct get_dfs_referral_rsp or claiming more referrals than it contains drives reads past the buffer. No public exploit identified at time of analysis, and EPSS is low (0.19%, 9th percentile), consistent with a client-side, server-triggered condition rather than mass-exploitable exposure.
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() Return value of a function acpi_evaluate_dsm() is dereferenced without checking for NULL, but it is usually checked for this function. acpi_evaluate_dsm() may return NULL, when acpi_evaluate_object() returns acpi_status other than ACPI_SUCCESS, so add a check to prevent the crach. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Local memory corruption in the Linux kernel's DRM GPU scheduler (drm/sched) stems from a double free in drm_sched_job_add_resv_dependencies(), where a dma_fence reference that drm_sched_job_add_dependency() already consumed on its failure path is released a second time when the backing xarray fails to expand. Any local user able to submit GPU jobs on an affected kernel can trigger the flaw, leading to kernel memory corruption and denial of service. There is no public exploit identified at time of analysis, EPSS is low (0.19%), and it is not listed in CISA KEV.
Denial of service in the Linux kernel's USB gadget RNDIS function driver (f_rndis) lets a local privileged user crash the kernel via a NULL pointer dereference. After a bind/unbind cycle leaves rndis->notify_req stale, a subsequently failing bind reaches a unified error path that calls free_request on the stale request, dereferencing ep->ops->free_request on freed/NULL state. Tagged as Denial of Service; no public exploit is identified, EPSS is low (0.19%, 9th percentile), and it is not on CISA KEV.
Kernel NULL pointer dereference in the Linux USB gadget ACM function (f_acm) allows a local privileged operator to crash the kernel after a USB gadget bind/unbind cycle. After unbind, acm->notify_req is left stale; if a subsequent bind fails, the shared error path frees the stale request and dereferences a NULL ep->ops->free_request pointer in usb_ep_free_request(), producing a fatal oops. Tagged as a Denial of Service issue; EPSS is low (0.19%, 9th percentile), no public exploit is identified, and it is not listed in CISA KEV.