Linux
Monthly
Denial of service in the Linux kernel USB gadget CDC ECM function driver (f_ecm) allows a local privileged operator to crash the kernel via a NULL pointer dereference. After a USB gadget bind/unbind cycle, ecm->notify_req is left stale; if a later bind attempt fails, the shared error path tries to free the stale request and dereferences ep->ops->free_request through a NULL endpoint pointer. No public exploit identified at time of analysis and the practical impact is a kernel crash rather than the full confidentiality/integrity loss implied by the assigned 7.8 CVSS score.
Local denial of service in the Linux kernel USB gadget NCM function driver (f_ncm) allows a privileged local user managing a USB peripheral-mode gadget to crash the kernel via a NULL pointer dereference. After a bind/unbind cycle leaves ncm->notify_req stale, a subsequent failing bind reaches a unified error path that frees the stale request, dereferencing ep->ops->free_request on a NULL endpoint. Tagged as Denial of Service; no public exploit identified at time of analysis and EPSS is low (0.19%).
Recursive rwsem deadlock in the Linux kernel's ksmbd SMB server subsystem causes ksmbd worker threads to hang indefinitely when any SMB client opens a named pipe, resulting in denial of service for all SMB connections. The flaw was introduced by commit 305853cce3794, which fixed a race condition in RPC handle list access but inadvertently created a deadlock: ksmbd_session_rpc_open acquires sess->rpc_lock as a write lock, then calls ksmbd_rpc_open → ksmbd_session_rpc_method, which attempts to re-acquire the same lock as a read lock - blocking the kernel worker thread indefinitely. No public exploit code exists and EPSS is 0.14% (4th percentile), but the trigger is deterministic and reliable against any ksmbd deployment once valid SMB credentials are obtained. This vulnerability is not in CISA KEV.
Out-of-bounds memory read in the Linux kernel's hfsplus filesystem driver (fixed in 6.17-rc series) allows a local user to leak adjacent slab memory and crash the system when the kernel parses a maliciously crafted HFS+ volume. The flaw lives in hfsplus_strcasecmp() during B-tree catalog record comparison and is reached through ordinary path lookup on a mounted HFS+ image. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), consistent with a local, filesystem-parsing memory-safety bug rather than a remotely weaponizable one.
Denial of service in the Linux kernel's NFS server (NFSD) allows a pNFS client to crash the host by sending a LAYOUTCOMMIT operation against a FlexFiles-type layout, for which NFSD previously defined no proc_layoutcommit handler. Any system exporting files over pNFS with the FlexFiles layout driver is affected until patched. This is a stability/availability bug (no confirmed data compromise); no public exploit identified at time of analysis and it is not listed in CISA KEV, with a low EPSS of 0.20% (10th percentile).
Out-of-bounds read in the Linux kernel's ksmbd in-kernel SMB server allows a 4-byte read past a declared IPC payload boundary when handle_response() in transport_ipc.c dereferences a message handle without first validating that the payload is at least 4 bytes long. The flaw is triggered by a malformed or truncated message from the userspace ksmbd.mountd helper, potentially leaking a small amount of adjacent kernel memory or crashing the kernel. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low at 0.19% (9th percentile).
Out-of-bounds slab read in the Linux kernel's HFS+ filesystem driver (fs/hfsplus/unicode.c) allows a local low-privileged attacker to read adjacent kernel heap memory by triggering hfsplus_uni2asc() through the listxattr() path on a crafted/malformed HFS+ image. Because hfsplus_listxattr() passes a struct hfsplus_attr_unistr* whose layout differs from the struct hfsplus_unistr* the earlier fix (commit 94458781aee6) assumed, an oversized ustrlen drives the Unicode buffer pointer past the allocation. There is no public exploit identified at time of analysis, and EPSS is low (0.18%), consistent with a memory-disclosure primitive requiring local filesystem access rather than remote mass exploitation.
Local privilege escalation potential in the Linux kernel's ARM Statistical Profiling Extension (arm_spe) perf driver stems from an integer overflow in the PERF_IDX2OFF() calculation when an AUX ring buffer of 2 GiB or larger is used. On affected arm64 systems, a local user with permission to open SPE perf events can trigger the overflow because nr_pages was not cast to unsigned long, producing an incorrect buffer offset and out-of-bounds kernel memory access. This is a resolved kernel bug fixed via stable-tree commits; there is no public exploit identified at time of analysis and EPSS probability is low (0.20%, 10th percentile).
In the Linux kernel, the following vulnerability has been resolved: nbd: restrict sockets to TCP and UDP Recently, syzbot started to abuse NBD with all kinds of sockets. Commit cf1b2326b734 ("nbd: verify socket is supported during setup") made sure the socket supported a shutdown() method. Explicitely accept TCP and UNIX stream sockets.
Kernel panic (and potential memory corruption) in the Linux kernel BPF JIT on the RISC-V architecture allows a local privileged actor to crash the system when a BPF struct_ops program (such as a bpf_qdisc scheduler) returns a pointer. The RISC-V JIT epilogue sign-extended struct_ops return values as if they were 32-bit scalars, violating the RISC-V calling convention and corrupting the returned 64-bit pointer, which the network qdisc path then dereferences. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and this affects only RISC-V builds using the BPF qdisc/struct_ops feature.
In the Linux kernel, the following vulnerability has been resolved: bpf: Explicitly check accesses to bpf_sock_addr Syzkaller found a kernel warning on the following sock_addr program: 0: r0 = 0 1: r2 = *(u32 *)(r1 +60) 2: exit which triggers: verifier bug: error during ctx access conversion (0) This is happening because offset 60 in bpf_sock_addr corresponds to an implicit padding of 4 bytes, right after msg_src_ip4. Access to this padding isn't rejected in sock_addr_is_valid_access and it thus later fails to convert the access. This patch fixes it by explicitly checking the various fields of bpf_sock_addr in sock_addr_is_valid_access. I checked the other ctx structures and is_valid_access functions and didn't find any other similar cases. Other cases of (properly handled) padding are covered in new tests in a subsequent patch.
Information disclosure and memory-safety risk in the Linux kernel's TCP metrics (tcp_metrics) subsystem stems from three call sites using the non-lockdep-safe dst_dev() accessor, now replaced by the RCU-aware dst_dev_net_rcu() helper. Affected are Linux kernel builds prior to the fixing stable commits; a race in device/net dereference during TCP metric handling could expose kernel memory or destabilize the network stack. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the issue is not listed in CISA KEV.
Use-after-free in the Linux kernel IPv4 networking stack allows potential kernel memory disclosure or corruption when destination (dst) entries are accessed without proper RCU protection during ICMP rate-limiting, IP fragment reassembly, and multicast forwarding. The fix converts icmpv4_xrlim_allow(), ip_defrag(), the ipmr multicast transmit paths, and ipv4_neigh_lookup() to the lockdep-enabled dst_dev_rcu() accessor. No public exploit identified at time of analysis, and EPSS probability is low (0.17%, 7th percentile), consistent with a hard-to-win kernel race rather than a readily weaponized flaw.
In the Linux kernel, the following vulnerability has been resolved: pps: fix warning in pps_register_cdev when register device fail Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error handling in __video_register_device()"), the release hook should be set before device_register(). Otherwise, when device_register() return error and put_device() try to callback the release function, the below warning may happen. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567 Modules linked in: CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567 Call Trace: <TASK> kobject_cleanup+0x136/0x410 lib/kobject.c:689 kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0xe9/0x130 lib/kobject.c:737 put_device+0x24/0x30 drivers/base/core.c:3797 pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402 pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108 pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57 tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432 tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563 tiocsetd drivers/tty/tty_io.c:2429 [inline] tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline] __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Before commit c79a39dc8d06 ("pps: Fix a use-after-free"), pps_register_cdev() call device_create() to create pps->dev, which will init dev->release to device_create_release(). Now the comment is outdated, just remove it. Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed in pps_register_source() to avoid a double free in the failure case.
Memory/object reference leak in the Linux kernel's drm/msm (Qualcomm Adreno GPU) driver lets a local user with GPU device access leak kernel object references when the VM_BIND ioctl error path fails a handle lookup partway through, dropping already-obtained GEM object references incorrectly. It affects Linux kernels carrying the newer MSM VM_BIND uAPI and is patched upstream via kernel.org stable commits. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not listed in CISA KEV.
Local privilege-to-data compromise in the Linux kernel NTFS3 driver allows an attacker who can supply a crafted NTFS volume to bypass inode access checks and read or destroy arbitrary on-disk data. The flaw is an unvalidated integer overflow in run_unpack(), which decodes the compressed runlist ($DATA runs) mapping virtual clusters to logical clusters (LCNs); a forged runlist yields out-of-bounds LCNs. Rated CVSS 8.4 (high) with no public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and it is not in CISA KEV.
Local filesystem corruption / potential memory corruption in the Linux kernel's ntfs3 driver arises when an index allocation is performed against a $BITMAP attribute that is empty while index blocks already exist on disk. An attacker who can get a victim to mount a malformed NTFS image can drive the driver into an inconsistent index state during rename() of long filenames, causing subsequent operations to fail (-ENOENT) and reflecting on-disk corruption that the driver previously failed to reject. There is no public exploit identified at time of analysis, the EPSS probability is low (0.19%, 9th percentile), and it is not listed in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local user to trigger a use-after-free of a net_device during a connect() call on an SMC socket. The flaw lives in smc_pnet_find_ism_resource() / smc_pnet_find_roce_resource(), which dereference a destination device (dst->dev) that can be freed and swapped for blackhole_netdev before RTNL is acquired in pnet_find_base_ndev(). It was discovered by syzbot fuzzing; there is no public exploit identified at time of analysis, it is not on CISA KEV, and its EPSS probability is very low (0.17%, 7th percentile).
Memory corruption in the Linux kernel's crypto compression subsystem (scomp/acomp) arises because struct layout randomization can reorder the alloc_ctx and free_ctx function pointers in scomp_alg independently of the crypto_acomp_streams struct that was built to mirror them, introduced by commit 42d9f6c77479. When the CONFIG_RANDSTRUCT hardening feature reorders these pure ops structures inconsistently, the kernel invokes the wrong context allocation/free callback, leading to high-impact confidentiality, integrity, and availability effects for a local low-privileged actor. No public exploit identified at time of analysis and EPSS probability is low (0.17%), so this is a hardening-regression fix rather than an actively exploited flaw.
Local privilege escalation via use-after-free in the Linux kernel's RDMA/rxe (Soft-RoCE) driver allows a low-privileged local user to corrupt kernel memory by winning a race in do_task(). When the task loop exhausts its iteration budget it blindly resets state to TASK_STATE_IDLE, overwriting a concurrent TASK_STATE_DRAINING set during rxe_cleanup_task()/rxe_disable_task() teardown, so a task reschedules against freed structures. No public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with a hard-to-win kernel race rather than a mass-exploited flaw.
Improper enablement of IOMMU dirty page tracking in the Intel VT-d (iommu/vt-d) driver of the Linux kernel allows a misconfiguration where dirty tracking is offered even when the IOMMU performs incoherent page walks. Because the hardware cannot atomically update A/EA/D bits in non-snooped paging-structure entries, this triggers a non-recoverable fault and can corrupt or silently drop dirty-page state used during operations like VM live migration. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and this is a corrective hardening patch rather than an actively exploited flaw.
Use-after-free in the Linux kernel's F2FS (Flash-Friendly File System) encryption write path allows a local user to crash the kernel or corrupt memory during concurrent writes to encrypted files. The flaw lives in f2fs_merge_page_bio(), where a bounce/encrypted page can be freed by the write completion path (f2fs_write_end_io) while another thread still dereferences it via fio->encrypted_page in f2fs_is_cp_guaranteed(), producing a NULL/dangling pointer dereference. It is fixed upstream; no public weaponized exploit is identified, though the commit ships a race reproducer, and EPSS risk is low (0.19%).
Denial of service in the Linux kernel's D-Link dl2k Gigabit Ethernet driver (net/dlink, as used with hardware such as the D-Link DGE-550T) arises because the receive path did not check the return value of netdev_alloc_skb_ip_align() on the copy_thresh small-packet path; on allocation failure the code dereferenced skb->protocol, causing a NULL pointer dereference and kernel crash. Affected systems are Linux hosts using the dl2k driver for legacy D-Link Gigabit NICs. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low (0.21%, 11th percentile), consistent with a memory-pressure-dependent local DoS rather than a readily weaponizable remote flaw.
Improper return-value handling in the Linux kernel's vhost vringh host-side virtqueue library allows a local low-privileged actor (including a malicious or misbehaving guest driving a vhost/vDPA backend) to trigger processing of partially-copied descriptor data, potentially disclosing kernel memory. The vringh code checked copy_from_iter/copy_to_iter results for a negative error that these functions cannot return, so short (incomplete) copies were silently treated as success. No public exploit identified at time of analysis; EPSS is low at 0.20% (10th percentile) and the CVE is not in CISA KEV.
Denial of service in the Linux kernel's uio_hv_generic driver affects Hyper-V guest VMs that expose VMBus channels to userspace UIO drivers, where the kernel driver improperly manipulated the ring-buffer interrupt mask concurrently with user space. This race causes the guest user-mode driver to miss a host interrupt and hang indefinitely inside pread(), stalling the affected service. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and it is not on the CISA KEV list.
Local privilege escalation risk in the Linux kernel's io_uring waitid handling stems from a race condition in io_waitid_wait(), where a successful return failed to prune the task's entry from the wait queue when a cancelation was concurrently in progress, allowing the wait queue callback to be invoked twice against a stale entry. Authenticated local attackers (PR:L per CVSS) could exploit this to corrupt kernel memory with high confidentiality, integrity, and availability impact (CVSS 7.8). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Improper accounting in the Linux kernel's io_uring zero-copy receive (zcrx) path allows a zcrx recv request to return more data than the caller requested, caused by desc->count being adjusted for all received buffers and then double-counted during recursive processing of frag-list skbs, leading to counter underflow. Affected are Linux kernels shipping the io_uring zcrx feature, where a local process using this interface can read beyond the intended receive limit. There is no public exploit identified at time of analysis, and EPSS is low (0.19%, 9th percentile), consistent with an internal kernel-hardening fix rather than an actively exploited flaw.
Memory corruption in the Linux kernel's wcd937x ASoC audio codec driver occurs because the SoundWire port for the HPHL_COMP and HPHR_COMP compander components is set to zero, causing an out-of-bounds access at index -1 of the port_map array during driver operation. Local low-privileged users on devices using this Qualcomm codec can trigger kernel memory corruption (CVSS 7.8). There is no public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and the fix has already been merged upstream.
Out-of-bounds/use-after-free read in the Linux kernel UDF (Universal Disk Format) filesystem driver allows a local attacker to crash the kernel or leak adjacent memory by getting a crafted or corrupted UDF image mounted and accessed. The flaw lies in fs/udf handling of the on-disk lengthAllocDescs field, which was not validated against the block size, causing udf_update_tag() to invoke crc_itu_t() on memory past the buffer. It was found by the Linux Verification Center via Syzkaller; there is no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile).
Uninitialized-memory disclosure in the Linux kernel's NFC NCI subsystem lets a local actor with access to the NCI interface trigger reads of unallocated skb->data by submitting NCI control packets whose declared header length passes the weak nic_valid_size() check but does not match the actual buffer layout expected per opcode. The flaw, found by Syzbot in nci_init_req, affects Linux kernels built with the NFC/NCI stack; it is tagged Information Disclosure with an EPSS of 0.21% (11th percentile) and no public exploit identified at time of analysis. Upstream fixes add per-handler parameter validation and silently drop malformed packets.
Kernel panic (denial of service) in the Linux kernel's LoongArch BPF JIT compiler affects systems running on LoongArch (Loongson) 64-bit CPUs when BPF struct_ops programs - such as a BPF-based qdisc - are attached and their pointer return values are consumed by the kernel networking path. The LoongArch JIT epilogue sign-extended 32-bit return values as it does for ordinary BPF programs, but struct_ops functions must follow the LoongArch calling ABI, so a returned pointer (e.g. an skb from bpf_fifo_dequeue) was truncated/sign-extended into an invalid address that the kernel then dereferenced, causing an unhandled paging fault in __qdisc_run(). This is no public exploit identified at time of analysis and is not on CISA KEV; EPSS is low (0.19%, 9th percentile).
Kernel denial-of-service in the Linux mm/ksm subsystem allows a local low-privileged user to crash or destabilize the kernel by triggering a type-promotion bug in ksm_madvise(). When MADV_UNMERGEABLE is applied to a VMA registered with userfaultfd (UFFD) in MINOR mode, the function incorrectly clears the upper 32 bits of vma->vm_flags due to a C integer promotion defect, producing a UFFD inconsistency that causes a kernel BUG or WARNING at mm/userfaultfd.c:2067 during fd cleanup. No public exploit has been identified and EPSS is 0.33% (26th percentile), but the crash was confirmed via syzkaller fuzzing and patches have been backported across multiple stable kernel branches.
Race conditions in the ksmbd in-kernel SMB server's RPC handle list (sess->rpc_handle_list XArray) expose systems to use-after-free and kernel availability loss. ksmbd_session_rpc_open() incorrectly acquired only a read lock before performing mutating XArray operations, and ksmbd_session_rpc_method() performed xa_load() with no lock at all - creating a window where concurrent session operations can corrupt or dereference freed memory. No public exploit exists and EPSS is 0.13% (3rd percentile), placing real-world exploitation risk very low, though the use-after-free primitive carries latent potential beyond the scored availability impact.
Host denial-of-service in the Linux kernel's KVM AMD (SVM) subsystem allows a guest VM to crash or hang the hypervisor host when the CPU/host is running with next-RIP support disabled (nrips=false). In that mode the WRMSR, HLT and INVD VM-Exit fastpath handlers attempt to decode and emulate the guest instruction to advance RIP, which reads guest memory and can sleep - but these handlers run with IRQs disabled, triggering a 'sleeping function called from invalid context' BUG and destabilizing the host. There is no public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile); despite the 7.1 CVSS the scope-changed availability impact is gated by a non-default configuration.
Local privilege escalation and memory corruption in the Linux kernel's Android binder IPC driver arises from a double-free in the dynamic bitmap (dbitmap) allocator used for per-process reference tracking. When a process's dmap expansion fails, dbitmap_grow() frees the old bitmap, but the pointer is not cleared, so binder_proc_dec_tmpref() frees it a second time at process teardown, corrupting the kernel heap. This is a memory-safety flaw exploitable by any local user with binder access (default on Android and many Linux systems); there is no public exploit identified at time of analysis and the EPSS score is low (0.19%).
Local privilege escalation and denial of service in the Linux kernel's 9p (Plan 9) filesystem transport (net/9p/trans_fd.c) arises from a double request free in p9_fd_cancelled(). A race between p9_read_work() cancelling pending requests and p9_fd_cancelled() cleaning up a flush request causes the same req_list entry to be removed twice via list_del(), corrupting kernel list pointers (the classic 0xdead000000000100 poison), yielding a GPF/KASAN wild-memory-access that a local user can trigger by mounting a malicious 9p share. No public exploit identified at time of analysis; the flaw was found by the Linux Verification Center with Syzkaller, and EPSS is low at 0.22% (12th percentile).
Improper instruction emulation in the Linux kernel's KVM x86 subsystem allows a local user with access to KVM (typically /dev/kvm) to crash or destabilize the host hypervisor by racing port I/O interception changes against a userspace I/O exit. Because KVM re-checks L1 intercepts after it has already committed to emulating an L2 I/O access, a malicious or buggy VMM/guest can leave vcpu->arch.pio.count non-zero and trigger a kernel WARN in emulator_pio_in_out(); the flaw was discovered via a syzkaller reproducer. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.25%).
Local denial-of-service in the Linux kernel's F2FS filesystem allows an attacker who can mount a crafted F2FS image to trigger a kernel BUG_ON panic during a fallocate punch-hole operation. The flaw stems from missing validation of the node footer for non-inode direct nodes (dnodes), which lets a corrupted dnode be misparsed as an inode and produce an invalid truncation count. No public exploit has been identified at time of analysis and EPSS is low (0.17%, 7th percentile); reproduction requires a deliberately fuzzed on-disk image (syzbot-discovered).
Use-after-free in the Linux kernel vhost subsystem allows a local attacker with access to vhost worker devices to trigger access to a freed task_struct, potentially leading to privilege escalation or a kernel crash on hosts running virtio/vhost-backed virtualization. The flaw occurs when a vhost_task exits early via a signal and a pending vhost_task_wake() dereferences the released task structure. There is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with a local race-condition bug rather than a mass-exploitation target.
Use-after-free in the Linux kernel's IPVS (IP Virtual Server) FTP application helper (ip_vs_ftp) allows local privileged users to corrupt kernel memory during network namespace teardown. On the netns cleanup path, __ip_vs_ftp_exit() could unregister ip_vs_ftp before connections still holding valid cp->app pointers were flushed, leaving dangling references that are later dereferenced. The flaw is fixed upstream with stable-tree backports; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.20%, 10th percentile).
Use-after-free and kernel WARNING in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local user to trigger memory corruption via the splice() path on an SMC socket. The smc_lo_register_dmb() loopback path allocates DMB buffers with kzalloc() (kmalloc memory, not page-backed), which are later handed to get_page() in smc_rx_splice(); this fires WARN_ON_ONCE() and can leave the buffer freed before splice_to_pipe() completes, creating a use-after-free. CVSS 7.8 (local, C:H/I:H/A:H); EPSS is low (0.22%, 13th percentile) and there is no public exploit identified at time of analysis.
Local denial of service (and potential memory corruption) in the Linux kernel's hugetlbfs subsystem occurs because remove_inode_single_folio checks folio mapping state without holding the folio lock, racing with page migration; when a hugepage is migrated to a migration entry, folio_mapped() wrongly returns false, migration is then reverted, and the folio ends up mapped after deletion, tripping a BUG in filemap_unaccount_folio. Affected are kernels using hugetlbfs with hole-punch fallocate concurrent with migration (observed on 6.17-rc5 and backported to multiple stable branches). No public exploit identified at time of analysis; EPSS is low (0.24%, 15th percentile) and the issue is not in CISA KEV.
Kernel crash in Linux kernel Cadence QSPI driver (cadence-quadspi) allows authenticated local attackers with moderate privileges to cause denial of service by unbinding the driver during active indirect read or write operations. The vulnerability affects Linux kernel versions including 6.17-rc1 through rc4 and potentially earlier versions; exploitation requires root access to force device removal, but the EPSS score of 0.01% indicates minimal real-world exploitation probability despite the availability of upstream fixes in stable kernel branches.
A use-after-free write in the Linux kernel's Realtek rtw89 Wi-Fi driver lets kernel memory be corrupted when rtw89_core_tx_kick_off_and_wait() races with the TX-completion/status path (rtw89_pci_release_txwd_skb) and dereferences an skb_data buffer that was already freed back to skbuff_head_cache. The flaw was caught by KFENCE during Wi-Fi scan completion and is triggered by a timing race between the waiting and signaling sides of a completion object, affecting systems using Realtek rtw89-supported chipsets. There is no public exploit identified at time of analysis, it is not in CISA KEV, and the EPSS probability is low (0.19%, 9th percentile); the fix has been merged upstream.
Memory disclosure and denial of service in the Linux kernel's SCSI target (LIO) subsystem arises when reading the configfs attribute exposed by target_lu_gp_members_show() in drivers/target/target_core_configfs.c. Because snprintf() returns the length it *would* have written, a combined HBA name plus device name exceeding the 256-byte LU_GROUP_NAME_BUF buffer causes the subsequent memcpy() to copy past the buffer, tripping the kernel's overflow detection and potentially leaking adjacent memory or crashing the host. This is no public exploit identified at time of analysis, with a low EPSS score of 0.24% (15th percentile) and no CISA KEV listing.
Local privilege escalation and memory corruption in the Linux kernel's xc5000 DVB tuner driver (media subsystem) arises from a use-after-free in xc5000_release(): the function used cancel_delayed_work() which does not wait for an already-running timer_sleep delayed work item, so the xc5000_priv structure can be kfree()'d while the work callback still dereferences it. An attacker able to trigger tuner device teardown while the delayed work is active can win the race and cause the callback to operate on freed memory, potentially corrupting kernel memory. There is no public exploit identified at time of analysis and the flaw carries a low EPSS (0.22%); it was found via static analysis and fixed upstream.
Use-after-free in the Linux kernel's iMON RC (remote control) driver (drivers/media/rc/imon.c) allows a local user with access to the device's VFD/LCD character-device interface to trigger memory corruption by racing writes against USB disconnect. The imon_disconnect() path unconditionally calls usb_put_dev() on usbdev_intf0/usbdev_intf1 without coordinating with in-flight writers, so a concurrent vfd_write()/send_packet() dereferences a freed usb_device pointer. Discovered via Syzkaller by the Linux Verification Center; no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.22%).
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() If ab->fw.m3_data points to data, then fw pointer remains null. Further, if m3_mem is not allocated, then fw is dereferenced to be passed to ath11k_err function. Replace fw->size by m3_len. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Local privilege escalation / memory-safety flaw in the Linux kernel eBPF verifier, where get_helper_proto could return a NULL helper function pointer when a required config option was disabled, causing the verifier to accept BPF programs referencing an invalid helper. On affected kernels a local user able to load eBPF programs can trigger a NULL/invalid function pointer condition leading to kernel crash or potential code execution (CVSS 7.8, high confidentiality/integrity/availability impact). No public exploit identified at time of analysis and EPSS is low (0.18%), consistent with a config-dependent, local-only bug rather than a widely exploited one.
Local privilege-context buffer overflow in the Linux kernel's ETAS ES58x CAN USB driver (etas_es58x) lets a user with network capabilities corrupt kernel memory by injecting oversized CAN XL frames. Because the driver never implemented ndo_change_mtu(), an attacker can raise the interface MTU beyond CAN limits, then use a PF_PACKET raw socket with ETH_P_CANXL to smuggle a frame whose length field (up to 0xff) is memcpy'd into an 8-byte buffer, overflowing it by up to 247 bytes. CVSS is 7.8 (High); there is no public exploit identified at time of analysis and EPSS is low (0.22%), consistent with the requirement for local access and specific ETAS hardware.
Local privilege-to-kernel buffer overflow in the Linux kernel's hi311x (Holt HI-3110) CAN controller driver allows a user with network configuration capability to trigger an out-of-bounds heap write by injecting an oversized CAN XL frame. Because the driver never implemented ndo_change_mtu(), an attacker can raise the interface MTU beyond CAN_MTU and push a crafted frame through PF_PACKET whose length field (up to 0xff) is copied verbatim in hi3110_hw_tx(), overflowing an 8-byte buffer by up to 247 bytes. There is no public exploit identified at time of analysis, and the EPSS score is low (0.22%, 13th percentile); the issue has been resolved upstream in the mainline and stable kernel trees.
Local privilege-enabled buffer overflow in the Linux kernel's sun4i_can CAN controller driver (Allwinner A10/A20 SoCs) allows an attacker holding network-admin capability to write out of bounds by injecting oversized CAN XL frames. Because the driver never populated ndo_change_mtu(), the interface MTU can be raised past CAN_MTU, letting a PF_PACKET raw socket push a frame whose length field is misread as a CAN data length, overflowing a fixed buffer by up to 247 bytes. There is no public exploit identified at time of analysis and EPSS is low (0.22%), but the description includes a detailed, working reproduction path.
Local privilege-holders can trigger a kernel heap buffer overflow in the Linux mcba_usb CAN driver (Microchip CAN BUS Analyzer USB adapter) by raising the interface MTU beyond CAN_MTU and injecting a crafted CAN XL frame through a PF_PACKET raw socket. Because the driver never implemented ndo_change_mtu(), an attacker can set an oversized MTU (e.g. 9999), then send an ETH_P_CANXL frame whose flags byte is misread as the classic-CAN length field, causing memcpy to copy up to 247 bytes past the intended 8-byte buffer. This is a memory-corruption issue with high confidentiality, integrity and availability impact (CVSS 7.8); there is no public exploit identified at time of analysis, though the advisory includes a detailed reproduction, and EPSS is low at 0.22%.
Use-after-free in the Linux kernel Bluetooth stack (net/bluetooth/hci_conn.c) allows an in-range attacker to corrupt kernel memory when the host processes an HCI_EV_NUM_COMP_PKTS event without properly locking hdev, letting hci_conn_tx_dequeue read a connection object already freed by a concurrent hci_conn_del/abort path. The flaw was found via KASAN fuzzing on kernel 6.16-rc7 and is fixed upstream; there is no public exploit identified at time of analysis and EPSS risk is low (0.17%).
Use-after-free in the Linux kernel Bluetooth stack (net/bluetooth/hci_sync.c) lets an in-range attacker corrupt kernel memory during HCI ACL/LE connection setup. When a connection object is still pending command submission (conn->state == BT_OPEN), a concurrent HCI Connection Complete event can free the hci_conn structure while hci_acl_create_conn_sync (and hci_le_create_conn_sync) still writes to it. CVSS is 8.8 over an adjacent (Bluetooth-range) vector; there is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile).
Local privilege escalation via memory corruption in the Linux kernel Bluetooth management (MGMT) subsystem allows a local attacker with Bluetooth management access to trigger a use-after-free of a struct mgmt_pending object. The flaw arises from a race between MGMT command completion callbacks and the pending-command list being freed (e.g. during device power-off), enabling reads/writes of freed slab memory that can corrupt kernel state. No public exploit identified at time of analysis, and EPSS is very low (0.03%); it is a KASAN-detected, fuzzer-reported issue rather than one with confirmed in-the-wild use.
In the Linux kernel, the following vulnerability has been resolved: nexthop: Forbid FDB status change while nexthop is in a group The kernel forbids the creation of non-FDB nexthop groups with FDB nexthops: # ip nexthop add id 1 via 192.0.2.1 fdb # ip nexthop add id 2 group 1 Error: Non FDB nexthop group cannot have fdb nexthops. And vice versa: # ip nexthop add id 3 via 192.0.2.2 dev dummy1 # ip nexthop add id 4 group 3 fdb Error: FDB nexthop group can only have fdb nexthops. However, as long as no routes are pointing to a non-FDB nexthop group, the kernel allows changing the type of a nexthop from FDB to non-FDB and vice versa: # ip nexthop add id 5 via 192.0.2.2 dev dummy1 # ip nexthop add id 6 group 5 # ip nexthop replace id 5 via 192.0.2.2 fdb # echo $? 0 This configuration is invalid and can result in a NPD [1] since FDB nexthops are not associated with a nexthop device: # ip route add 198.51.100.1/32 nhid 6 # ping 198.51.100.1 Fix by preventing nexthop FDB status change while the nexthop is in a group: # ip nexthop add id 7 via 192.0.2.2 dev dummy1 # ip nexthop add id 8 group 7 # ip nexthop replace id 7 via 192.0.2.2 fdb Error: Cannot change nexthop FDB status while in a group. [1] BUG: kernel NULL pointer dereference, address: 00000000000003c0 [...] Oops: Oops: 0000 [#1] SMP CPU: 6 UID: 0 PID: 367 Comm: ping Not tainted 6.17.0-rc6-virtme-gb65678cacc03 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:fib_lookup_good_nhc+0x1e/0x80 [...] Call Trace: <TASK> fib_table_lookup+0x541/0x650 ip_route_output_key_hash_rcu+0x2ea/0x970 ip_route_output_key_hash+0x55/0x80 __ip4_datagram_connect+0x250/0x330 udp_connect+0x2b/0x60 __sys_connect+0x9c/0xd0 __x64_sys_connect+0x18/0x20 do_syscall_64+0xa4/0x2a0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
Local privilege escalation and memory corruption in the Linux kernel's Mellanox/NVIDIA mlx5 networking driver arises from a use-after-free in the hardware-steering (HWS) flow-counter release path. When a flow rule tied to a local flow counter is deleted via the RDMA/InfiniBand verbs interface, mlx5_cmd_hws_delete_fte() releases an HWS action whose refcount and mutex were never initialized, and the counter struct may already be freed - allowing a local attacker with the ability to create and destroy flow rules to corrupt kernel memory. No public exploit has been identified at time of analysis; EPSS probability is low (0.17%, 7th percentile), and the issue is not in CISA KEV.
Use-after-free in the Linux kernel's octeontx2-pf network driver allows a local low-privileged user to trigger memory corruption via the otx2_tc_add_flow() traffic-control offload path, where new_node is dereferenced after being queued for freeing with kfree_rcu() outside a valid RCU read-side region. Successful exploitation can cause a denial of service (kernel crash) and, depending on heap state, potential local privilege escalation. There is no public exploit identified at time of analysis, and the low EPSS score (0.19%) reflects the narrow, hardware-specific attack surface.
Local privilege-escalation-class use-after-free in the Linux kernel's futex subsystem (requeue-PI path) lets a low-privileged local user race futex_wait_requeue_pi() against futex_requeue() so a kernel wakeup dereferences an on-stack futex_q structure that has already been freed and returned to userland. The flaw carries high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L). There is no public exploit identified at time of analysis, and EPSS is very low (0.05%, 15th percentile), consistent with a hard-to-weaponize timing race.
Local privilege escalation and memory corruption in the Linux kernel process-creation path arises because copy_process() takes the wrong error-exit label after futex_hash_allocate_default() fails, releasing tasklist_lock and siglock that were never acquired. This lock imbalance can corrupt kernel synchronization state on the fork error path, with a potential for kernel crash or exploitation to gain elevated privileges. No public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a subtle, hard-to-trigger error-handling defect rather than a widely-weaponized bug.
Out-of-bounds memory access in the Linux kernel's in-kernel SMB/CIFS client (smb2_compound_op() in fs/smb/client) stems from wrong index references when iterating over compound SMB2 response buffers; a computed index at or above MAX_COMPOUND drives reads/writes past the response array. A machine mounting a share from a malicious or compromised SMB server can have its kernel process attacker-influenced compound responses, leading to memory corruption, denial of service, or potential privilege escalation. It carries a CNA-assigned CVSS 9.8, but there is no public exploit identified at time of analysis and EPSS is very low (0.19%, 8th percentile), so real-world exploitation pressure is currently minimal.
Guest-to-host memory corruption in the Linux kernel's Intel i40e Ethernet driver arises because the `ring_len` value supplied by an SR-IOV virtual function is written straight into the hardware memory context (HMC) with no bounds or alignment checking. A malicious or compromised VF owner (typically a guest VM given passthrough access to an Intel 700-series NIC) can specify out-of-range or misaligned Tx/Rx queue lengths, corrupting host-side descriptor context and impacting the host beyond the VF's boundary (CVSS 8.8, scope-changed). There is no public exploit identified at time of analysis and EPSS is low (0.20%, 10th percentile), consistent with a driver-level bug requiring a specific virtualization deployment.
Out-of-bounds array access in the Linux kernel's Intel i40e Ethernet driver allows a privileged virtual-function (VF) context to trigger memory corruption on the host by supplying an unvalidated traffic-class index. The flaw is in i40e_validate_queue_map(), where idx was not bounded against the number of active/initialized TCs before indexing vf->ch[idx] during SR-IOV channel/ADQ configuration. No public exploit identified at time of analysis; EPSS is low (0.20%) and it is not listed in CISA KEV, but the CVSS:3.1 score of 8.8 with scope change reflects the guest-to-host boundary crossing.
Privilege escalation and host memory corruption in the Linux kernel's i40e Intel Ethernet driver allows a malicious or buggy SR-IOV virtual function to send a crafted 'config queues' mailbox message with an out-of-range channel index, causing out-of-bounds access to the vf->ch[idx] array in i40e_vc_config_queues_msg(). Exploitation crosses the VF-to-host trust boundary (CVSS scope change) and can disclose or corrupt host kernel memory. The issue is fixed upstream across multiple stable trees; no public exploit and no CISA KEV listing exist, and EPSS is low (0.20%, 10th percentile), indicating no public exploit identified at time of analysis.
Out-of-bounds access in the Linux kernel's Intel i40e (40GbE) Ethernet driver arises from a flawed bounds check on the 'action_meta' value used during traffic-control/hardware-offload configuration, allowing a local user with network-configuration privileges to trigger an out-of-bounds dereference. The upstream fix corrects the comparison to 'greater or equal' so that indices at the array boundary are rejected. No public exploit identified at time of analysis, EPSS is low (0.20%), and the issue is not in CISA KEV; the assigned CVSS is 8.8 (Local, low complexity), reflecting high impact to a system carrying this Intel NIC and driver.
Improper VF-state validation in the Linux kernel's i40e (Intel Ethernet 700-series) driver lets a virtual function request PF resources it should not be able to obtain, because the resource-allocation check keyed on I40E_VF_STATE_ACTIVE rather than the narrower I40E_VF_STATE_RESOURCES_LOADED state. In SR-IOV deployments this can allow a low-privileged local actor controlling a VF to cross the VF/host trust boundary (CVSS scope-change), with claimed high confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not in CISA KEV.
Resource-exhaustion denial of service in the Linux kernel's Intel i40e (700-series Ethernet) driver allows a malicious or compromised Virtual Function to request an unbounded number of MAC/VLAN filters against its Physical Function, because the driver never enforced a maximum filter count. A guest controlling an SR-IOV VF can degrade or crash networking for the host PF and other VFs (CVSS 7.3, scope-changed). There is no public exploit identified at time of analysis, and the EPSS probability is low (0.20%, 10th percentile).
Local privilege escalation and memory corruption in the Linux kernel's fbcon (framebuffer console) subsystem stems from integer overflows in fbcon_do_set_font() when computing font buffer sizes from user-controlled parameters. A local, low-privileged attacker who can invoke the font-setting ioctl can trigger undersized allocations followed by heap buffer overflows during font data copying, potentially achieving code execution in kernel context. EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis; the fix has been merged and backported across stable kernel trees.
Local privilege escalation via memory corruption in the Linux kernel's iommufd subsystem allows a low-privileged local user to trigger a use-after-free by racing the abort path of IOMMU object allocation. Because fput() defers file release to a workqueue while the code immediately kfree()s the tied iommufd_object, the deferred release() decrements a users refcount on already-freed memory, corrupting the slab. Only pre-release 6.17-rc kernels are affected; EPSS is 0.10% (1st percentile) and there is no public exploit identified at time of analysis.
Use-after-free in the Linux kernel xfrm subsystem allows a local low-privileged user to crash the kernel via improper SPI=0 handling introduced by commit 94f39804d891. The regression causes xfrm_alloc_spi to insert states with SPI value 0 (the sentinel for 'no SPI assigned') into the byspi hash table, while __xfrm_state_delete skips cleanup of those entries on deletion, leaving dangling pointers that produce a UAF on next byspi traversal. No public exploit code exists and EPSS probability is 0.17% (7th percentile), indicating no active exploitation pressure.
Local privilege-boundary corruption in the Linux kernel's io_uring zero-copy notification path (io_link_skb) affects the 6.17 release-candidate series (rc1 through rc6). A copy-paste style bug assigned prev_notif from the current 'nd' instead of 'prev_nd', so the context-validation check compares a notification against itself and never enforces the intended same-context constraint, allowing a local low-privileged user to link skb notifications across mismatched io_uring contexts with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile).
Kernel-level memory corruption in the Linux kernel's rxrpc/RxGK subsystem allows an out-of-bounds access when the rxgk_yfs_decode_ticket() function parses an authentication response packet. The flaw stems from an unchecked unsigned subtraction ('ticket_len - 10 * 4') on attacker-influenced length data, which can underflow and drive an out-of-bounds write (CWE-787). It affects Linux 6.17 release-candidate kernels (rc1 through rc6); there is no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.13% (3rd percentile).
Race condition in the Linux kernel's AMD IOMMU host page table subsystem (iommu/amd/pgtbl) allows a local low-privileged attacker to cause IOMMU unmap failures and trigger WARN_ON conditions, resulting in a denial of service. The flaw arises because iommu_v1_unmap_pages() calls fetch_pte() to read pgtable->root and pgtable->mode without holding the spinlock, while increase_address_space() updates those fields non-atomically under lock on another CPU, creating a window where the reader observes a torn state (new root, old mode). No active exploitation is confirmed - EPSS stands at 0.10% (1st percentile) and this CVE is not in CISA KEV - making this primarily a kernel stability and reliability concern for systems with AMD IOMMU hardware.
Local privilege escalation and kernel memory disclosure in the Linux kernel's GPIO ACPI subsystem (gpiolib) affects development builds 6.17-rc1 through 6.17-rc6, where an uninitialized acpi_gpio_info structure is passed to __acpi_find_gpio() and its stale info->quirks field is later consumed in acpi_populate_gpio_lookup(). The regression, introduced by commit 7c010d463372, breaks the i2c_hid_acpi driver (probe fails with -EINVAL / 'has not been provided an Int IRQ') and causes the kernel to act on uninitialized stack memory. No public exploit identified at time of analysis, and EPSS is low at 0.14% (4th percentile), consistent with a hard-to-weaponize local memory-safety regression confined to release candidates.
Denial of wireless scanning in the Linux kernel's mac80211 subsystem occurs on Sub-1GHz (S1G / 802.11ah) hardware because the S1G capability element is not counted in scan_ies_len, causing a buffer-length validation failure in ieee80211_prep_hw_scan() and a triggered WARN in __ieee80211_start_scan(). Affected builds are Linux 6.17 release candidates (rc1-rc4); the result is that hardware scanning stops functioning on S1G-capable adapters. There is no public exploit identified at time of analysis, EPSS is very low (0.14%), and the upstream fix is available via kernel.org stable commits.
Kernel panic in the Linux igc Ethernet driver (Intel I225/I226/I227) triggers when igc_led_setup() fails during driver probe and igc_probe() propagates that failure without calling unregister_netdev() first, causing free_netdev() to hit a BUG assertion at net/core/dev.c:12047. Systems running Linux kernel 6.17-rc1 through rc6 with Intel I225/I226/I227 NICs are affected; a local low-privileged user who can induce an LED setup allocation failure - naturally under memory pressure or deliberately via the kernel fault-injection framework - can crash the host. No public exploit exists and EPSS sits at the 5th percentile, reflecting negligible opportunistic exploitation probability.
A local privilege-boundary/state-handling flaw in the Linux kernel's TCP stack lets an unprivileged user leave a stale TCP Fast Open request socket (fastopen_rsk) attached to a socket after tcp_disconnect(), which the retransmit timer later dereferences. By abusing accept() → connect(AF_UNSPEC) → connect() on a server-side TFO socket before the 3-way handshake completes, an attacker drives the socket into TCP_ESTABLISHED while retaining fastopen_rsk, triggering a kernel WARNING in tcp_retransmit_timer() and a failed retransmission. There is no public exploit identified at time of analysis, and the issue is not in CISA KEV; it was found by syzbot and resolved upstream by calling reqsk_fastopen_remove() in tcp_disconnect().
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: call disconnect callback before deleting conn In hci_cs_disconnect, we do hci_conn_del even if disconnection. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix use after free in midcomms commit While working on processing dlm message in softirq context I experienced the. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
In the Linux kernel, the following vulnerability has been resolved: blk-mq: use quiesced elevator switch when reinitializing queues The hctx's run_work may be racing with the elevator switch when. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
A null pointer dereference vulnerability exists in the Linux kernel's AMD display driver (drm/amd/display) within the dm_resume() function, where the aconnector->dc_link pointer is dereferenced without proper null checks. An unprivileged local attacker with user-level access can trigger a kernel panic and cause a denial of service by inducing a display resume operation. While the CVSS score is moderate (5.5) and EPSS exploitation probability is very low (0.01%), this vulnerability is straightforward to trigger given local access and affects all Linux kernel versions with the vulnerable AMD display driver code.
A logic error in the Linux kernel's device mapper thin pool module causes infinite loops and system hangs when metadata commits fail. The vulnerability affects Linux kernel systems with dm-thin storage pools; when a commit fails during btree metadata operations, the pmd->root pointer is not properly restored to the last valid transaction state, causing subsequent read operations to traverse a corrupted btree structure. An unprivileged local attacker with access to the system can trigger this denial of service condition, resulting in kernel softlockups and system hangs. While no public exploit code is widely distributed, the vulnerability is straightforward to trigger through storage I/O operations on affected systems.
A null pointer dereference vulnerability exists in the Linux kernel's WiFi mac80211 MLME (MAC Layer Management Entity) implementation that crashes the kernel during WiFi association tracing when an AP connection without link 0 fails. The vulnerability affects all Linux kernel versions with the vulnerable code path in the mac80211 wireless driver subsystem, allowing a local authenticated attacker to trigger a denial of service condition. The EPSS score of 0.01% indicates this is rarely exploited in practice, though patches are publicly available from kernel.org.
A resource leak vulnerability exists in the Linux kernel's mpt3sas SCSI transport driver where the sas_rphy_add() function can fail without properly freeing allocated resources, leading to a NULL pointer dereference and kernel crash during device removal. This affects Linux kernel implementations across multiple versions that use the mpt3sas driver for SAS (Serial Attached SCSI) HBA management. An unprivileged local attacker with sufficient privileges to trigger transport port operations can cause a denial of service by inducing a kernel panic, though the low EPSS score of 0.01% suggests exploitation is not practically demonstrated in the wild.
An information leak vulnerability exists in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem within the tipc_topsrv_kern_subscr() function. The vulnerability occurs due to incomplete initialization of the sub.usr_handle field, leaving four bytes uninitialized when setsockopt() is called with SOL_TIPC options, allowing kernel memory contents to be leaked to user space. This affects Linux kernel versions including 6.1-rc1 and potentially others; while the EPSS score is extremely low at 0.01% percentile, the vulnerability requires local access and low privileges to trigger, making it a lower-priority but real information disclosure issue that has been patched by multiple vendors.
A null pointer dereference vulnerability exists in the Linux kernel's block layer (blk-mq) memory allocation path that can be triggered by a local, low-privileged user to cause a denial of service. The vulnerability affects Linux kernel versions including 6.1-rc1 and potentially other versions where a failed memory allocation during block queue tag initialization leaves a dangling pointer that is later dereferenced during cleanup. While the EPSS score is low (0.02%, percentile 4%), the vulnerability is straightforward to trigger under memory pressure conditions, requires only local access with minimal privileges, and has vendor patches available.
A memory leak vulnerability exists in the Linux kernel's test_firmware module initialization function (test_firmware_init) where allocated memory for test_fw_config->name is not properly freed when misc_register() fails. This affects all versions of the Linux kernel with the test_firmware module compiled, allowing local authenticated attackers to exhaust kernel memory and cause a denial of service. The vulnerability has a patch available from the Linux kernel maintainers, with an EPSS score of 0.01% indicating very low real-world exploitation probability despite the moderate CVSS score.
A memory leakage and potential segmentation fault vulnerability exists in the Linux kernel's AMD KFD (Kernel Fusion Driver) GPU memory management subsystem, specifically in the _gpuvm_import_dmabuf() function. The vulnerability affects Linux kernel versions across multiple branches and can be exploited by local users with low privilege levels to cause denial of service through memory corruption. Patches are available from the Linux kernel stable branches, and while the EPSS score is very low (0.01%, percentile 3%), the vulnerability has moderate CVSS severity (5.5) due to its ability to cause system availability impact.
A null pointer dereference vulnerability exists in the Linux kernel's AMD GPU (amdgpu) driver in the amdgpu_bo_validate_size() function. When validating buffer object sizes for non-exclusive memory domains, the function fails to verify that the TTM (Translation Table Maps) domain manager exists before dereferencing it, leading to a kernel oops and denial of service. Local attackers with unprivileged user privileges can trigger this vulnerability to crash the system. While patches are available from the vendor, the EPSS score of 0.01% and very low exploitation probability suggest this is a low-priority issue in practice despite the denial-of-service impact.
Denial of service in the Linux kernel USB gadget CDC ECM function driver (f_ecm) allows a local privileged operator to crash the kernel via a NULL pointer dereference. After a USB gadget bind/unbind cycle, ecm->notify_req is left stale; if a later bind attempt fails, the shared error path tries to free the stale request and dereferences ep->ops->free_request through a NULL endpoint pointer. No public exploit identified at time of analysis and the practical impact is a kernel crash rather than the full confidentiality/integrity loss implied by the assigned 7.8 CVSS score.
Local denial of service in the Linux kernel USB gadget NCM function driver (f_ncm) allows a privileged local user managing a USB peripheral-mode gadget to crash the kernel via a NULL pointer dereference. After a bind/unbind cycle leaves ncm->notify_req stale, a subsequent failing bind reaches a unified error path that frees the stale request, dereferencing ep->ops->free_request on a NULL endpoint. Tagged as Denial of Service; no public exploit identified at time of analysis and EPSS is low (0.19%).
Recursive rwsem deadlock in the Linux kernel's ksmbd SMB server subsystem causes ksmbd worker threads to hang indefinitely when any SMB client opens a named pipe, resulting in denial of service for all SMB connections. The flaw was introduced by commit 305853cce3794, which fixed a race condition in RPC handle list access but inadvertently created a deadlock: ksmbd_session_rpc_open acquires sess->rpc_lock as a write lock, then calls ksmbd_rpc_open → ksmbd_session_rpc_method, which attempts to re-acquire the same lock as a read lock - blocking the kernel worker thread indefinitely. No public exploit code exists and EPSS is 0.14% (4th percentile), but the trigger is deterministic and reliable against any ksmbd deployment once valid SMB credentials are obtained. This vulnerability is not in CISA KEV.
Out-of-bounds memory read in the Linux kernel's hfsplus filesystem driver (fixed in 6.17-rc series) allows a local user to leak adjacent slab memory and crash the system when the kernel parses a maliciously crafted HFS+ volume. The flaw lives in hfsplus_strcasecmp() during B-tree catalog record comparison and is reached through ordinary path lookup on a mounted HFS+ image. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), consistent with a local, filesystem-parsing memory-safety bug rather than a remotely weaponizable one.
Denial of service in the Linux kernel's NFS server (NFSD) allows a pNFS client to crash the host by sending a LAYOUTCOMMIT operation against a FlexFiles-type layout, for which NFSD previously defined no proc_layoutcommit handler. Any system exporting files over pNFS with the FlexFiles layout driver is affected until patched. This is a stability/availability bug (no confirmed data compromise); no public exploit identified at time of analysis and it is not listed in CISA KEV, with a low EPSS of 0.20% (10th percentile).
Out-of-bounds read in the Linux kernel's ksmbd in-kernel SMB server allows a 4-byte read past a declared IPC payload boundary when handle_response() in transport_ipc.c dereferences a message handle without first validating that the payload is at least 4 bytes long. The flaw is triggered by a malformed or truncated message from the userspace ksmbd.mountd helper, potentially leaking a small amount of adjacent kernel memory or crashing the kernel. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low at 0.19% (9th percentile).
Out-of-bounds slab read in the Linux kernel's HFS+ filesystem driver (fs/hfsplus/unicode.c) allows a local low-privileged attacker to read adjacent kernel heap memory by triggering hfsplus_uni2asc() through the listxattr() path on a crafted/malformed HFS+ image. Because hfsplus_listxattr() passes a struct hfsplus_attr_unistr* whose layout differs from the struct hfsplus_unistr* the earlier fix (commit 94458781aee6) assumed, an oversized ustrlen drives the Unicode buffer pointer past the allocation. There is no public exploit identified at time of analysis, and EPSS is low (0.18%), consistent with a memory-disclosure primitive requiring local filesystem access rather than remote mass exploitation.
Local privilege escalation potential in the Linux kernel's ARM Statistical Profiling Extension (arm_spe) perf driver stems from an integer overflow in the PERF_IDX2OFF() calculation when an AUX ring buffer of 2 GiB or larger is used. On affected arm64 systems, a local user with permission to open SPE perf events can trigger the overflow because nr_pages was not cast to unsigned long, producing an incorrect buffer offset and out-of-bounds kernel memory access. This is a resolved kernel bug fixed via stable-tree commits; there is no public exploit identified at time of analysis and EPSS probability is low (0.20%, 10th percentile).
In the Linux kernel, the following vulnerability has been resolved: nbd: restrict sockets to TCP and UDP Recently, syzbot started to abuse NBD with all kinds of sockets. Commit cf1b2326b734 ("nbd: verify socket is supported during setup") made sure the socket supported a shutdown() method. Explicitely accept TCP and UNIX stream sockets.
Kernel panic (and potential memory corruption) in the Linux kernel BPF JIT on the RISC-V architecture allows a local privileged actor to crash the system when a BPF struct_ops program (such as a bpf_qdisc scheduler) returns a pointer. The RISC-V JIT epilogue sign-extended struct_ops return values as if they were 32-bit scalars, violating the RISC-V calling convention and corrupting the returned 64-bit pointer, which the network qdisc path then dereferences. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and this affects only RISC-V builds using the BPF qdisc/struct_ops feature.
In the Linux kernel, the following vulnerability has been resolved: bpf: Explicitly check accesses to bpf_sock_addr Syzkaller found a kernel warning on the following sock_addr program: 0: r0 = 0 1: r2 = *(u32 *)(r1 +60) 2: exit which triggers: verifier bug: error during ctx access conversion (0) This is happening because offset 60 in bpf_sock_addr corresponds to an implicit padding of 4 bytes, right after msg_src_ip4. Access to this padding isn't rejected in sock_addr_is_valid_access and it thus later fails to convert the access. This patch fixes it by explicitly checking the various fields of bpf_sock_addr in sock_addr_is_valid_access. I checked the other ctx structures and is_valid_access functions and didn't find any other similar cases. Other cases of (properly handled) padding are covered in new tests in a subsequent patch.
Information disclosure and memory-safety risk in the Linux kernel's TCP metrics (tcp_metrics) subsystem stems from three call sites using the non-lockdep-safe dst_dev() accessor, now replaced by the RCU-aware dst_dev_net_rcu() helper. Affected are Linux kernel builds prior to the fixing stable commits; a race in device/net dereference during TCP metric handling could expose kernel memory or destabilize the network stack. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the issue is not listed in CISA KEV.
Use-after-free in the Linux kernel IPv4 networking stack allows potential kernel memory disclosure or corruption when destination (dst) entries are accessed without proper RCU protection during ICMP rate-limiting, IP fragment reassembly, and multicast forwarding. The fix converts icmpv4_xrlim_allow(), ip_defrag(), the ipmr multicast transmit paths, and ipv4_neigh_lookup() to the lockdep-enabled dst_dev_rcu() accessor. No public exploit identified at time of analysis, and EPSS probability is low (0.17%, 7th percentile), consistent with a hard-to-win kernel race rather than a readily weaponized flaw.
In the Linux kernel, the following vulnerability has been resolved: pps: fix warning in pps_register_cdev when register device fail Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error handling in __video_register_device()"), the release hook should be set before device_register(). Otherwise, when device_register() return error and put_device() try to callback the release function, the below warning may happen. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567 Modules linked in: CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567 Call Trace: <TASK> kobject_cleanup+0x136/0x410 lib/kobject.c:689 kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0xe9/0x130 lib/kobject.c:737 put_device+0x24/0x30 drivers/base/core.c:3797 pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402 pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108 pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57 tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432 tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563 tiocsetd drivers/tty/tty_io.c:2429 [inline] tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline] __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Before commit c79a39dc8d06 ("pps: Fix a use-after-free"), pps_register_cdev() call device_create() to create pps->dev, which will init dev->release to device_create_release(). Now the comment is outdated, just remove it. Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed in pps_register_source() to avoid a double free in the failure case.
Memory/object reference leak in the Linux kernel's drm/msm (Qualcomm Adreno GPU) driver lets a local user with GPU device access leak kernel object references when the VM_BIND ioctl error path fails a handle lookup partway through, dropping already-obtained GEM object references incorrectly. It affects Linux kernels carrying the newer MSM VM_BIND uAPI and is patched upstream via kernel.org stable commits. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not listed in CISA KEV.
Local privilege-to-data compromise in the Linux kernel NTFS3 driver allows an attacker who can supply a crafted NTFS volume to bypass inode access checks and read or destroy arbitrary on-disk data. The flaw is an unvalidated integer overflow in run_unpack(), which decodes the compressed runlist ($DATA runs) mapping virtual clusters to logical clusters (LCNs); a forged runlist yields out-of-bounds LCNs. Rated CVSS 8.4 (high) with no public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and it is not in CISA KEV.
Local filesystem corruption / potential memory corruption in the Linux kernel's ntfs3 driver arises when an index allocation is performed against a $BITMAP attribute that is empty while index blocks already exist on disk. An attacker who can get a victim to mount a malformed NTFS image can drive the driver into an inconsistent index state during rename() of long filenames, causing subsequent operations to fail (-ENOENT) and reflecting on-disk corruption that the driver previously failed to reject. There is no public exploit identified at time of analysis, the EPSS probability is low (0.19%, 9th percentile), and it is not listed in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local user to trigger a use-after-free of a net_device during a connect() call on an SMC socket. The flaw lives in smc_pnet_find_ism_resource() / smc_pnet_find_roce_resource(), which dereference a destination device (dst->dev) that can be freed and swapped for blackhole_netdev before RTNL is acquired in pnet_find_base_ndev(). It was discovered by syzbot fuzzing; there is no public exploit identified at time of analysis, it is not on CISA KEV, and its EPSS probability is very low (0.17%, 7th percentile).
Memory corruption in the Linux kernel's crypto compression subsystem (scomp/acomp) arises because struct layout randomization can reorder the alloc_ctx and free_ctx function pointers in scomp_alg independently of the crypto_acomp_streams struct that was built to mirror them, introduced by commit 42d9f6c77479. When the CONFIG_RANDSTRUCT hardening feature reorders these pure ops structures inconsistently, the kernel invokes the wrong context allocation/free callback, leading to high-impact confidentiality, integrity, and availability effects for a local low-privileged actor. No public exploit identified at time of analysis and EPSS probability is low (0.17%), so this is a hardening-regression fix rather than an actively exploited flaw.
Local privilege escalation via use-after-free in the Linux kernel's RDMA/rxe (Soft-RoCE) driver allows a low-privileged local user to corrupt kernel memory by winning a race in do_task(). When the task loop exhausts its iteration budget it blindly resets state to TASK_STATE_IDLE, overwriting a concurrent TASK_STATE_DRAINING set during rxe_cleanup_task()/rxe_disable_task() teardown, so a task reschedules against freed structures. No public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with a hard-to-win kernel race rather than a mass-exploited flaw.
Improper enablement of IOMMU dirty page tracking in the Intel VT-d (iommu/vt-d) driver of the Linux kernel allows a misconfiguration where dirty tracking is offered even when the IOMMU performs incoherent page walks. Because the hardware cannot atomically update A/EA/D bits in non-snooped paging-structure entries, this triggers a non-recoverable fault and can corrupt or silently drop dirty-page state used during operations like VM live migration. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and this is a corrective hardening patch rather than an actively exploited flaw.
Use-after-free in the Linux kernel's F2FS (Flash-Friendly File System) encryption write path allows a local user to crash the kernel or corrupt memory during concurrent writes to encrypted files. The flaw lives in f2fs_merge_page_bio(), where a bounce/encrypted page can be freed by the write completion path (f2fs_write_end_io) while another thread still dereferences it via fio->encrypted_page in f2fs_is_cp_guaranteed(), producing a NULL/dangling pointer dereference. It is fixed upstream; no public weaponized exploit is identified, though the commit ships a race reproducer, and EPSS risk is low (0.19%).
Denial of service in the Linux kernel's D-Link dl2k Gigabit Ethernet driver (net/dlink, as used with hardware such as the D-Link DGE-550T) arises because the receive path did not check the return value of netdev_alloc_skb_ip_align() on the copy_thresh small-packet path; on allocation failure the code dereferenced skb->protocol, causing a NULL pointer dereference and kernel crash. Affected systems are Linux hosts using the dl2k driver for legacy D-Link Gigabit NICs. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low (0.21%, 11th percentile), consistent with a memory-pressure-dependent local DoS rather than a readily weaponizable remote flaw.
Improper return-value handling in the Linux kernel's vhost vringh host-side virtqueue library allows a local low-privileged actor (including a malicious or misbehaving guest driving a vhost/vDPA backend) to trigger processing of partially-copied descriptor data, potentially disclosing kernel memory. The vringh code checked copy_from_iter/copy_to_iter results for a negative error that these functions cannot return, so short (incomplete) copies were silently treated as success. No public exploit identified at time of analysis; EPSS is low at 0.20% (10th percentile) and the CVE is not in CISA KEV.
Denial of service in the Linux kernel's uio_hv_generic driver affects Hyper-V guest VMs that expose VMBus channels to userspace UIO drivers, where the kernel driver improperly manipulated the ring-buffer interrupt mask concurrently with user space. This race causes the guest user-mode driver to miss a host interrupt and hang indefinitely inside pread(), stalling the affected service. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and it is not on the CISA KEV list.
Local privilege escalation risk in the Linux kernel's io_uring waitid handling stems from a race condition in io_waitid_wait(), where a successful return failed to prune the task's entry from the wait queue when a cancelation was concurrently in progress, allowing the wait queue callback to be invoked twice against a stale entry. Authenticated local attackers (PR:L per CVSS) could exploit this to corrupt kernel memory with high confidentiality, integrity, and availability impact (CVSS 7.8). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Improper accounting in the Linux kernel's io_uring zero-copy receive (zcrx) path allows a zcrx recv request to return more data than the caller requested, caused by desc->count being adjusted for all received buffers and then double-counted during recursive processing of frag-list skbs, leading to counter underflow. Affected are Linux kernels shipping the io_uring zcrx feature, where a local process using this interface can read beyond the intended receive limit. There is no public exploit identified at time of analysis, and EPSS is low (0.19%, 9th percentile), consistent with an internal kernel-hardening fix rather than an actively exploited flaw.
Memory corruption in the Linux kernel's wcd937x ASoC audio codec driver occurs because the SoundWire port for the HPHL_COMP and HPHR_COMP compander components is set to zero, causing an out-of-bounds access at index -1 of the port_map array during driver operation. Local low-privileged users on devices using this Qualcomm codec can trigger kernel memory corruption (CVSS 7.8). There is no public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and the fix has already been merged upstream.
Out-of-bounds/use-after-free read in the Linux kernel UDF (Universal Disk Format) filesystem driver allows a local attacker to crash the kernel or leak adjacent memory by getting a crafted or corrupted UDF image mounted and accessed. The flaw lies in fs/udf handling of the on-disk lengthAllocDescs field, which was not validated against the block size, causing udf_update_tag() to invoke crc_itu_t() on memory past the buffer. It was found by the Linux Verification Center via Syzkaller; there is no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile).
Uninitialized-memory disclosure in the Linux kernel's NFC NCI subsystem lets a local actor with access to the NCI interface trigger reads of unallocated skb->data by submitting NCI control packets whose declared header length passes the weak nic_valid_size() check but does not match the actual buffer layout expected per opcode. The flaw, found by Syzbot in nci_init_req, affects Linux kernels built with the NFC/NCI stack; it is tagged Information Disclosure with an EPSS of 0.21% (11th percentile) and no public exploit identified at time of analysis. Upstream fixes add per-handler parameter validation and silently drop malformed packets.
Kernel panic (denial of service) in the Linux kernel's LoongArch BPF JIT compiler affects systems running on LoongArch (Loongson) 64-bit CPUs when BPF struct_ops programs - such as a BPF-based qdisc - are attached and their pointer return values are consumed by the kernel networking path. The LoongArch JIT epilogue sign-extended 32-bit return values as it does for ordinary BPF programs, but struct_ops functions must follow the LoongArch calling ABI, so a returned pointer (e.g. an skb from bpf_fifo_dequeue) was truncated/sign-extended into an invalid address that the kernel then dereferenced, causing an unhandled paging fault in __qdisc_run(). This is no public exploit identified at time of analysis and is not on CISA KEV; EPSS is low (0.19%, 9th percentile).
Kernel denial-of-service in the Linux mm/ksm subsystem allows a local low-privileged user to crash or destabilize the kernel by triggering a type-promotion bug in ksm_madvise(). When MADV_UNMERGEABLE is applied to a VMA registered with userfaultfd (UFFD) in MINOR mode, the function incorrectly clears the upper 32 bits of vma->vm_flags due to a C integer promotion defect, producing a UFFD inconsistency that causes a kernel BUG or WARNING at mm/userfaultfd.c:2067 during fd cleanup. No public exploit has been identified and EPSS is 0.33% (26th percentile), but the crash was confirmed via syzkaller fuzzing and patches have been backported across multiple stable kernel branches.
Race conditions in the ksmbd in-kernel SMB server's RPC handle list (sess->rpc_handle_list XArray) expose systems to use-after-free and kernel availability loss. ksmbd_session_rpc_open() incorrectly acquired only a read lock before performing mutating XArray operations, and ksmbd_session_rpc_method() performed xa_load() with no lock at all - creating a window where concurrent session operations can corrupt or dereference freed memory. No public exploit exists and EPSS is 0.13% (3rd percentile), placing real-world exploitation risk very low, though the use-after-free primitive carries latent potential beyond the scored availability impact.
Host denial-of-service in the Linux kernel's KVM AMD (SVM) subsystem allows a guest VM to crash or hang the hypervisor host when the CPU/host is running with next-RIP support disabled (nrips=false). In that mode the WRMSR, HLT and INVD VM-Exit fastpath handlers attempt to decode and emulate the guest instruction to advance RIP, which reads guest memory and can sleep - but these handlers run with IRQs disabled, triggering a 'sleeping function called from invalid context' BUG and destabilizing the host. There is no public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile); despite the 7.1 CVSS the scope-changed availability impact is gated by a non-default configuration.
Local privilege escalation and memory corruption in the Linux kernel's Android binder IPC driver arises from a double-free in the dynamic bitmap (dbitmap) allocator used for per-process reference tracking. When a process's dmap expansion fails, dbitmap_grow() frees the old bitmap, but the pointer is not cleared, so binder_proc_dec_tmpref() frees it a second time at process teardown, corrupting the kernel heap. This is a memory-safety flaw exploitable by any local user with binder access (default on Android and many Linux systems); there is no public exploit identified at time of analysis and the EPSS score is low (0.19%).
Local privilege escalation and denial of service in the Linux kernel's 9p (Plan 9) filesystem transport (net/9p/trans_fd.c) arises from a double request free in p9_fd_cancelled(). A race between p9_read_work() cancelling pending requests and p9_fd_cancelled() cleaning up a flush request causes the same req_list entry to be removed twice via list_del(), corrupting kernel list pointers (the classic 0xdead000000000100 poison), yielding a GPF/KASAN wild-memory-access that a local user can trigger by mounting a malicious 9p share. No public exploit identified at time of analysis; the flaw was found by the Linux Verification Center with Syzkaller, and EPSS is low at 0.22% (12th percentile).
Improper instruction emulation in the Linux kernel's KVM x86 subsystem allows a local user with access to KVM (typically /dev/kvm) to crash or destabilize the host hypervisor by racing port I/O interception changes against a userspace I/O exit. Because KVM re-checks L1 intercepts after it has already committed to emulating an L2 I/O access, a malicious or buggy VMM/guest can leave vcpu->arch.pio.count non-zero and trigger a kernel WARN in emulator_pio_in_out(); the flaw was discovered via a syzkaller reproducer. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.25%).
Local denial-of-service in the Linux kernel's F2FS filesystem allows an attacker who can mount a crafted F2FS image to trigger a kernel BUG_ON panic during a fallocate punch-hole operation. The flaw stems from missing validation of the node footer for non-inode direct nodes (dnodes), which lets a corrupted dnode be misparsed as an inode and produce an invalid truncation count. No public exploit has been identified at time of analysis and EPSS is low (0.17%, 7th percentile); reproduction requires a deliberately fuzzed on-disk image (syzbot-discovered).
Use-after-free in the Linux kernel vhost subsystem allows a local attacker with access to vhost worker devices to trigger access to a freed task_struct, potentially leading to privilege escalation or a kernel crash on hosts running virtio/vhost-backed virtualization. The flaw occurs when a vhost_task exits early via a signal and a pending vhost_task_wake() dereferences the released task structure. There is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with a local race-condition bug rather than a mass-exploitation target.
Use-after-free in the Linux kernel's IPVS (IP Virtual Server) FTP application helper (ip_vs_ftp) allows local privileged users to corrupt kernel memory during network namespace teardown. On the netns cleanup path, __ip_vs_ftp_exit() could unregister ip_vs_ftp before connections still holding valid cp->app pointers were flushed, leaving dangling references that are later dereferenced. The flaw is fixed upstream with stable-tree backports; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.20%, 10th percentile).
Use-after-free and kernel WARNING in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local user to trigger memory corruption via the splice() path on an SMC socket. The smc_lo_register_dmb() loopback path allocates DMB buffers with kzalloc() (kmalloc memory, not page-backed), which are later handed to get_page() in smc_rx_splice(); this fires WARN_ON_ONCE() and can leave the buffer freed before splice_to_pipe() completes, creating a use-after-free. CVSS 7.8 (local, C:H/I:H/A:H); EPSS is low (0.22%, 13th percentile) and there is no public exploit identified at time of analysis.
Local denial of service (and potential memory corruption) in the Linux kernel's hugetlbfs subsystem occurs because remove_inode_single_folio checks folio mapping state without holding the folio lock, racing with page migration; when a hugepage is migrated to a migration entry, folio_mapped() wrongly returns false, migration is then reverted, and the folio ends up mapped after deletion, tripping a BUG in filemap_unaccount_folio. Affected are kernels using hugetlbfs with hole-punch fallocate concurrent with migration (observed on 6.17-rc5 and backported to multiple stable branches). No public exploit identified at time of analysis; EPSS is low (0.24%, 15th percentile) and the issue is not in CISA KEV.
Kernel crash in Linux kernel Cadence QSPI driver (cadence-quadspi) allows authenticated local attackers with moderate privileges to cause denial of service by unbinding the driver during active indirect read or write operations. The vulnerability affects Linux kernel versions including 6.17-rc1 through rc4 and potentially earlier versions; exploitation requires root access to force device removal, but the EPSS score of 0.01% indicates minimal real-world exploitation probability despite the availability of upstream fixes in stable kernel branches.
A use-after-free write in the Linux kernel's Realtek rtw89 Wi-Fi driver lets kernel memory be corrupted when rtw89_core_tx_kick_off_and_wait() races with the TX-completion/status path (rtw89_pci_release_txwd_skb) and dereferences an skb_data buffer that was already freed back to skbuff_head_cache. The flaw was caught by KFENCE during Wi-Fi scan completion and is triggered by a timing race between the waiting and signaling sides of a completion object, affecting systems using Realtek rtw89-supported chipsets. There is no public exploit identified at time of analysis, it is not in CISA KEV, and the EPSS probability is low (0.19%, 9th percentile); the fix has been merged upstream.
Memory disclosure and denial of service in the Linux kernel's SCSI target (LIO) subsystem arises when reading the configfs attribute exposed by target_lu_gp_members_show() in drivers/target/target_core_configfs.c. Because snprintf() returns the length it *would* have written, a combined HBA name plus device name exceeding the 256-byte LU_GROUP_NAME_BUF buffer causes the subsequent memcpy() to copy past the buffer, tripping the kernel's overflow detection and potentially leaking adjacent memory or crashing the host. This is no public exploit identified at time of analysis, with a low EPSS score of 0.24% (15th percentile) and no CISA KEV listing.
Local privilege escalation and memory corruption in the Linux kernel's xc5000 DVB tuner driver (media subsystem) arises from a use-after-free in xc5000_release(): the function used cancel_delayed_work() which does not wait for an already-running timer_sleep delayed work item, so the xc5000_priv structure can be kfree()'d while the work callback still dereferences it. An attacker able to trigger tuner device teardown while the delayed work is active can win the race and cause the callback to operate on freed memory, potentially corrupting kernel memory. There is no public exploit identified at time of analysis and the flaw carries a low EPSS (0.22%); it was found via static analysis and fixed upstream.
Use-after-free in the Linux kernel's iMON RC (remote control) driver (drivers/media/rc/imon.c) allows a local user with access to the device's VFD/LCD character-device interface to trigger memory corruption by racing writes against USB disconnect. The imon_disconnect() path unconditionally calls usb_put_dev() on usbdev_intf0/usbdev_intf1 without coordinating with in-flight writers, so a concurrent vfd_write()/send_packet() dereferences a freed usb_device pointer. Discovered via Syzkaller by the Linux Verification Center; no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.22%).
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() If ab->fw.m3_data points to data, then fw pointer remains null. Further, if m3_mem is not allocated, then fw is dereferenced to be passed to ath11k_err function. Replace fw->size by m3_len. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Local privilege escalation / memory-safety flaw in the Linux kernel eBPF verifier, where get_helper_proto could return a NULL helper function pointer when a required config option was disabled, causing the verifier to accept BPF programs referencing an invalid helper. On affected kernels a local user able to load eBPF programs can trigger a NULL/invalid function pointer condition leading to kernel crash or potential code execution (CVSS 7.8, high confidentiality/integrity/availability impact). No public exploit identified at time of analysis and EPSS is low (0.18%), consistent with a config-dependent, local-only bug rather than a widely exploited one.
Local privilege-context buffer overflow in the Linux kernel's ETAS ES58x CAN USB driver (etas_es58x) lets a user with network capabilities corrupt kernel memory by injecting oversized CAN XL frames. Because the driver never implemented ndo_change_mtu(), an attacker can raise the interface MTU beyond CAN limits, then use a PF_PACKET raw socket with ETH_P_CANXL to smuggle a frame whose length field (up to 0xff) is memcpy'd into an 8-byte buffer, overflowing it by up to 247 bytes. CVSS is 7.8 (High); there is no public exploit identified at time of analysis and EPSS is low (0.22%), consistent with the requirement for local access and specific ETAS hardware.
Local privilege-to-kernel buffer overflow in the Linux kernel's hi311x (Holt HI-3110) CAN controller driver allows a user with network configuration capability to trigger an out-of-bounds heap write by injecting an oversized CAN XL frame. Because the driver never implemented ndo_change_mtu(), an attacker can raise the interface MTU beyond CAN_MTU and push a crafted frame through PF_PACKET whose length field (up to 0xff) is copied verbatim in hi3110_hw_tx(), overflowing an 8-byte buffer by up to 247 bytes. There is no public exploit identified at time of analysis, and the EPSS score is low (0.22%, 13th percentile); the issue has been resolved upstream in the mainline and stable kernel trees.
Local privilege-enabled buffer overflow in the Linux kernel's sun4i_can CAN controller driver (Allwinner A10/A20 SoCs) allows an attacker holding network-admin capability to write out of bounds by injecting oversized CAN XL frames. Because the driver never populated ndo_change_mtu(), the interface MTU can be raised past CAN_MTU, letting a PF_PACKET raw socket push a frame whose length field is misread as a CAN data length, overflowing a fixed buffer by up to 247 bytes. There is no public exploit identified at time of analysis and EPSS is low (0.22%), but the description includes a detailed, working reproduction path.
Local privilege-holders can trigger a kernel heap buffer overflow in the Linux mcba_usb CAN driver (Microchip CAN BUS Analyzer USB adapter) by raising the interface MTU beyond CAN_MTU and injecting a crafted CAN XL frame through a PF_PACKET raw socket. Because the driver never implemented ndo_change_mtu(), an attacker can set an oversized MTU (e.g. 9999), then send an ETH_P_CANXL frame whose flags byte is misread as the classic-CAN length field, causing memcpy to copy up to 247 bytes past the intended 8-byte buffer. This is a memory-corruption issue with high confidentiality, integrity and availability impact (CVSS 7.8); there is no public exploit identified at time of analysis, though the advisory includes a detailed reproduction, and EPSS is low at 0.22%.
Use-after-free in the Linux kernel Bluetooth stack (net/bluetooth/hci_conn.c) allows an in-range attacker to corrupt kernel memory when the host processes an HCI_EV_NUM_COMP_PKTS event without properly locking hdev, letting hci_conn_tx_dequeue read a connection object already freed by a concurrent hci_conn_del/abort path. The flaw was found via KASAN fuzzing on kernel 6.16-rc7 and is fixed upstream; there is no public exploit identified at time of analysis and EPSS risk is low (0.17%).
Use-after-free in the Linux kernel Bluetooth stack (net/bluetooth/hci_sync.c) lets an in-range attacker corrupt kernel memory during HCI ACL/LE connection setup. When a connection object is still pending command submission (conn->state == BT_OPEN), a concurrent HCI Connection Complete event can free the hci_conn structure while hci_acl_create_conn_sync (and hci_le_create_conn_sync) still writes to it. CVSS is 8.8 over an adjacent (Bluetooth-range) vector; there is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile).
Local privilege escalation via memory corruption in the Linux kernel Bluetooth management (MGMT) subsystem allows a local attacker with Bluetooth management access to trigger a use-after-free of a struct mgmt_pending object. The flaw arises from a race between MGMT command completion callbacks and the pending-command list being freed (e.g. during device power-off), enabling reads/writes of freed slab memory that can corrupt kernel state. No public exploit identified at time of analysis, and EPSS is very low (0.03%); it is a KASAN-detected, fuzzer-reported issue rather than one with confirmed in-the-wild use.
In the Linux kernel, the following vulnerability has been resolved: nexthop: Forbid FDB status change while nexthop is in a group The kernel forbids the creation of non-FDB nexthop groups with FDB nexthops: # ip nexthop add id 1 via 192.0.2.1 fdb # ip nexthop add id 2 group 1 Error: Non FDB nexthop group cannot have fdb nexthops. And vice versa: # ip nexthop add id 3 via 192.0.2.2 dev dummy1 # ip nexthop add id 4 group 3 fdb Error: FDB nexthop group can only have fdb nexthops. However, as long as no routes are pointing to a non-FDB nexthop group, the kernel allows changing the type of a nexthop from FDB to non-FDB and vice versa: # ip nexthop add id 5 via 192.0.2.2 dev dummy1 # ip nexthop add id 6 group 5 # ip nexthop replace id 5 via 192.0.2.2 fdb # echo $? 0 This configuration is invalid and can result in a NPD [1] since FDB nexthops are not associated with a nexthop device: # ip route add 198.51.100.1/32 nhid 6 # ping 198.51.100.1 Fix by preventing nexthop FDB status change while the nexthop is in a group: # ip nexthop add id 7 via 192.0.2.2 dev dummy1 # ip nexthop add id 8 group 7 # ip nexthop replace id 7 via 192.0.2.2 fdb Error: Cannot change nexthop FDB status while in a group. [1] BUG: kernel NULL pointer dereference, address: 00000000000003c0 [...] Oops: Oops: 0000 [#1] SMP CPU: 6 UID: 0 PID: 367 Comm: ping Not tainted 6.17.0-rc6-virtme-gb65678cacc03 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:fib_lookup_good_nhc+0x1e/0x80 [...] Call Trace: <TASK> fib_table_lookup+0x541/0x650 ip_route_output_key_hash_rcu+0x2ea/0x970 ip_route_output_key_hash+0x55/0x80 __ip4_datagram_connect+0x250/0x330 udp_connect+0x2b/0x60 __sys_connect+0x9c/0xd0 __x64_sys_connect+0x18/0x20 do_syscall_64+0xa4/0x2a0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
Local privilege escalation and memory corruption in the Linux kernel's Mellanox/NVIDIA mlx5 networking driver arises from a use-after-free in the hardware-steering (HWS) flow-counter release path. When a flow rule tied to a local flow counter is deleted via the RDMA/InfiniBand verbs interface, mlx5_cmd_hws_delete_fte() releases an HWS action whose refcount and mutex were never initialized, and the counter struct may already be freed - allowing a local attacker with the ability to create and destroy flow rules to corrupt kernel memory. No public exploit has been identified at time of analysis; EPSS probability is low (0.17%, 7th percentile), and the issue is not in CISA KEV.
Use-after-free in the Linux kernel's octeontx2-pf network driver allows a local low-privileged user to trigger memory corruption via the otx2_tc_add_flow() traffic-control offload path, where new_node is dereferenced after being queued for freeing with kfree_rcu() outside a valid RCU read-side region. Successful exploitation can cause a denial of service (kernel crash) and, depending on heap state, potential local privilege escalation. There is no public exploit identified at time of analysis, and the low EPSS score (0.19%) reflects the narrow, hardware-specific attack surface.
Local privilege-escalation-class use-after-free in the Linux kernel's futex subsystem (requeue-PI path) lets a low-privileged local user race futex_wait_requeue_pi() against futex_requeue() so a kernel wakeup dereferences an on-stack futex_q structure that has already been freed and returned to userland. The flaw carries high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L). There is no public exploit identified at time of analysis, and EPSS is very low (0.05%, 15th percentile), consistent with a hard-to-weaponize timing race.
Local privilege escalation and memory corruption in the Linux kernel process-creation path arises because copy_process() takes the wrong error-exit label after futex_hash_allocate_default() fails, releasing tasklist_lock and siglock that were never acquired. This lock imbalance can corrupt kernel synchronization state on the fork error path, with a potential for kernel crash or exploitation to gain elevated privileges. No public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a subtle, hard-to-trigger error-handling defect rather than a widely-weaponized bug.
Out-of-bounds memory access in the Linux kernel's in-kernel SMB/CIFS client (smb2_compound_op() in fs/smb/client) stems from wrong index references when iterating over compound SMB2 response buffers; a computed index at or above MAX_COMPOUND drives reads/writes past the response array. A machine mounting a share from a malicious or compromised SMB server can have its kernel process attacker-influenced compound responses, leading to memory corruption, denial of service, or potential privilege escalation. It carries a CNA-assigned CVSS 9.8, but there is no public exploit identified at time of analysis and EPSS is very low (0.19%, 8th percentile), so real-world exploitation pressure is currently minimal.
Guest-to-host memory corruption in the Linux kernel's Intel i40e Ethernet driver arises because the `ring_len` value supplied by an SR-IOV virtual function is written straight into the hardware memory context (HMC) with no bounds or alignment checking. A malicious or compromised VF owner (typically a guest VM given passthrough access to an Intel 700-series NIC) can specify out-of-range or misaligned Tx/Rx queue lengths, corrupting host-side descriptor context and impacting the host beyond the VF's boundary (CVSS 8.8, scope-changed). There is no public exploit identified at time of analysis and EPSS is low (0.20%, 10th percentile), consistent with a driver-level bug requiring a specific virtualization deployment.
Out-of-bounds array access in the Linux kernel's Intel i40e Ethernet driver allows a privileged virtual-function (VF) context to trigger memory corruption on the host by supplying an unvalidated traffic-class index. The flaw is in i40e_validate_queue_map(), where idx was not bounded against the number of active/initialized TCs before indexing vf->ch[idx] during SR-IOV channel/ADQ configuration. No public exploit identified at time of analysis; EPSS is low (0.20%) and it is not listed in CISA KEV, but the CVSS:3.1 score of 8.8 with scope change reflects the guest-to-host boundary crossing.
Privilege escalation and host memory corruption in the Linux kernel's i40e Intel Ethernet driver allows a malicious or buggy SR-IOV virtual function to send a crafted 'config queues' mailbox message with an out-of-range channel index, causing out-of-bounds access to the vf->ch[idx] array in i40e_vc_config_queues_msg(). Exploitation crosses the VF-to-host trust boundary (CVSS scope change) and can disclose or corrupt host kernel memory. The issue is fixed upstream across multiple stable trees; no public exploit and no CISA KEV listing exist, and EPSS is low (0.20%, 10th percentile), indicating no public exploit identified at time of analysis.
Out-of-bounds access in the Linux kernel's Intel i40e (40GbE) Ethernet driver arises from a flawed bounds check on the 'action_meta' value used during traffic-control/hardware-offload configuration, allowing a local user with network-configuration privileges to trigger an out-of-bounds dereference. The upstream fix corrects the comparison to 'greater or equal' so that indices at the array boundary are rejected. No public exploit identified at time of analysis, EPSS is low (0.20%), and the issue is not in CISA KEV; the assigned CVSS is 8.8 (Local, low complexity), reflecting high impact to a system carrying this Intel NIC and driver.
Improper VF-state validation in the Linux kernel's i40e (Intel Ethernet 700-series) driver lets a virtual function request PF resources it should not be able to obtain, because the resource-allocation check keyed on I40E_VF_STATE_ACTIVE rather than the narrower I40E_VF_STATE_RESOURCES_LOADED state. In SR-IOV deployments this can allow a low-privileged local actor controlling a VF to cross the VF/host trust boundary (CVSS scope-change), with claimed high confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not in CISA KEV.
Resource-exhaustion denial of service in the Linux kernel's Intel i40e (700-series Ethernet) driver allows a malicious or compromised Virtual Function to request an unbounded number of MAC/VLAN filters against its Physical Function, because the driver never enforced a maximum filter count. A guest controlling an SR-IOV VF can degrade or crash networking for the host PF and other VFs (CVSS 7.3, scope-changed). There is no public exploit identified at time of analysis, and the EPSS probability is low (0.20%, 10th percentile).
Local privilege escalation and memory corruption in the Linux kernel's fbcon (framebuffer console) subsystem stems from integer overflows in fbcon_do_set_font() when computing font buffer sizes from user-controlled parameters. A local, low-privileged attacker who can invoke the font-setting ioctl can trigger undersized allocations followed by heap buffer overflows during font data copying, potentially achieving code execution in kernel context. EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis; the fix has been merged and backported across stable kernel trees.
Local privilege escalation via memory corruption in the Linux kernel's iommufd subsystem allows a low-privileged local user to trigger a use-after-free by racing the abort path of IOMMU object allocation. Because fput() defers file release to a workqueue while the code immediately kfree()s the tied iommufd_object, the deferred release() decrements a users refcount on already-freed memory, corrupting the slab. Only pre-release 6.17-rc kernels are affected; EPSS is 0.10% (1st percentile) and there is no public exploit identified at time of analysis.
Use-after-free in the Linux kernel xfrm subsystem allows a local low-privileged user to crash the kernel via improper SPI=0 handling introduced by commit 94f39804d891. The regression causes xfrm_alloc_spi to insert states with SPI value 0 (the sentinel for 'no SPI assigned') into the byspi hash table, while __xfrm_state_delete skips cleanup of those entries on deletion, leaving dangling pointers that produce a UAF on next byspi traversal. No public exploit code exists and EPSS probability is 0.17% (7th percentile), indicating no active exploitation pressure.
Local privilege-boundary corruption in the Linux kernel's io_uring zero-copy notification path (io_link_skb) affects the 6.17 release-candidate series (rc1 through rc6). A copy-paste style bug assigned prev_notif from the current 'nd' instead of 'prev_nd', so the context-validation check compares a notification against itself and never enforces the intended same-context constraint, allowing a local low-privileged user to link skb notifications across mismatched io_uring contexts with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile).
Kernel-level memory corruption in the Linux kernel's rxrpc/RxGK subsystem allows an out-of-bounds access when the rxgk_yfs_decode_ticket() function parses an authentication response packet. The flaw stems from an unchecked unsigned subtraction ('ticket_len - 10 * 4') on attacker-influenced length data, which can underflow and drive an out-of-bounds write (CWE-787). It affects Linux 6.17 release-candidate kernels (rc1 through rc6); there is no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.13% (3rd percentile).
Race condition in the Linux kernel's AMD IOMMU host page table subsystem (iommu/amd/pgtbl) allows a local low-privileged attacker to cause IOMMU unmap failures and trigger WARN_ON conditions, resulting in a denial of service. The flaw arises because iommu_v1_unmap_pages() calls fetch_pte() to read pgtable->root and pgtable->mode without holding the spinlock, while increase_address_space() updates those fields non-atomically under lock on another CPU, creating a window where the reader observes a torn state (new root, old mode). No active exploitation is confirmed - EPSS stands at 0.10% (1st percentile) and this CVE is not in CISA KEV - making this primarily a kernel stability and reliability concern for systems with AMD IOMMU hardware.
Local privilege escalation and kernel memory disclosure in the Linux kernel's GPIO ACPI subsystem (gpiolib) affects development builds 6.17-rc1 through 6.17-rc6, where an uninitialized acpi_gpio_info structure is passed to __acpi_find_gpio() and its stale info->quirks field is later consumed in acpi_populate_gpio_lookup(). The regression, introduced by commit 7c010d463372, breaks the i2c_hid_acpi driver (probe fails with -EINVAL / 'has not been provided an Int IRQ') and causes the kernel to act on uninitialized stack memory. No public exploit identified at time of analysis, and EPSS is low at 0.14% (4th percentile), consistent with a hard-to-weaponize local memory-safety regression confined to release candidates.
Denial of wireless scanning in the Linux kernel's mac80211 subsystem occurs on Sub-1GHz (S1G / 802.11ah) hardware because the S1G capability element is not counted in scan_ies_len, causing a buffer-length validation failure in ieee80211_prep_hw_scan() and a triggered WARN in __ieee80211_start_scan(). Affected builds are Linux 6.17 release candidates (rc1-rc4); the result is that hardware scanning stops functioning on S1G-capable adapters. There is no public exploit identified at time of analysis, EPSS is very low (0.14%), and the upstream fix is available via kernel.org stable commits.
Kernel panic in the Linux igc Ethernet driver (Intel I225/I226/I227) triggers when igc_led_setup() fails during driver probe and igc_probe() propagates that failure without calling unregister_netdev() first, causing free_netdev() to hit a BUG assertion at net/core/dev.c:12047. Systems running Linux kernel 6.17-rc1 through rc6 with Intel I225/I226/I227 NICs are affected; a local low-privileged user who can induce an LED setup allocation failure - naturally under memory pressure or deliberately via the kernel fault-injection framework - can crash the host. No public exploit exists and EPSS sits at the 5th percentile, reflecting negligible opportunistic exploitation probability.
A local privilege-boundary/state-handling flaw in the Linux kernel's TCP stack lets an unprivileged user leave a stale TCP Fast Open request socket (fastopen_rsk) attached to a socket after tcp_disconnect(), which the retransmit timer later dereferences. By abusing accept() → connect(AF_UNSPEC) → connect() on a server-side TFO socket before the 3-way handshake completes, an attacker drives the socket into TCP_ESTABLISHED while retaining fastopen_rsk, triggering a kernel WARNING in tcp_retransmit_timer() and a failed retransmission. There is no public exploit identified at time of analysis, and the issue is not in CISA KEV; it was found by syzbot and resolved upstream by calling reqsk_fastopen_remove() in tcp_disconnect().
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: call disconnect callback before deleting conn In hci_cs_disconnect, we do hci_conn_del even if disconnection. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix use after free in midcomms commit While working on processing dlm message in softirq context I experienced the. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
In the Linux kernel, the following vulnerability has been resolved: blk-mq: use quiesced elevator switch when reinitializing queues The hctx's run_work may be racing with the elevator switch when. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
A null pointer dereference vulnerability exists in the Linux kernel's AMD display driver (drm/amd/display) within the dm_resume() function, where the aconnector->dc_link pointer is dereferenced without proper null checks. An unprivileged local attacker with user-level access can trigger a kernel panic and cause a denial of service by inducing a display resume operation. While the CVSS score is moderate (5.5) and EPSS exploitation probability is very low (0.01%), this vulnerability is straightforward to trigger given local access and affects all Linux kernel versions with the vulnerable AMD display driver code.
A logic error in the Linux kernel's device mapper thin pool module causes infinite loops and system hangs when metadata commits fail. The vulnerability affects Linux kernel systems with dm-thin storage pools; when a commit fails during btree metadata operations, the pmd->root pointer is not properly restored to the last valid transaction state, causing subsequent read operations to traverse a corrupted btree structure. An unprivileged local attacker with access to the system can trigger this denial of service condition, resulting in kernel softlockups and system hangs. While no public exploit code is widely distributed, the vulnerability is straightforward to trigger through storage I/O operations on affected systems.
A null pointer dereference vulnerability exists in the Linux kernel's WiFi mac80211 MLME (MAC Layer Management Entity) implementation that crashes the kernel during WiFi association tracing when an AP connection without link 0 fails. The vulnerability affects all Linux kernel versions with the vulnerable code path in the mac80211 wireless driver subsystem, allowing a local authenticated attacker to trigger a denial of service condition. The EPSS score of 0.01% indicates this is rarely exploited in practice, though patches are publicly available from kernel.org.
A resource leak vulnerability exists in the Linux kernel's mpt3sas SCSI transport driver where the sas_rphy_add() function can fail without properly freeing allocated resources, leading to a NULL pointer dereference and kernel crash during device removal. This affects Linux kernel implementations across multiple versions that use the mpt3sas driver for SAS (Serial Attached SCSI) HBA management. An unprivileged local attacker with sufficient privileges to trigger transport port operations can cause a denial of service by inducing a kernel panic, though the low EPSS score of 0.01% suggests exploitation is not practically demonstrated in the wild.
An information leak vulnerability exists in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem within the tipc_topsrv_kern_subscr() function. The vulnerability occurs due to incomplete initialization of the sub.usr_handle field, leaving four bytes uninitialized when setsockopt() is called with SOL_TIPC options, allowing kernel memory contents to be leaked to user space. This affects Linux kernel versions including 6.1-rc1 and potentially others; while the EPSS score is extremely low at 0.01% percentile, the vulnerability requires local access and low privileges to trigger, making it a lower-priority but real information disclosure issue that has been patched by multiple vendors.
A null pointer dereference vulnerability exists in the Linux kernel's block layer (blk-mq) memory allocation path that can be triggered by a local, low-privileged user to cause a denial of service. The vulnerability affects Linux kernel versions including 6.1-rc1 and potentially other versions where a failed memory allocation during block queue tag initialization leaves a dangling pointer that is later dereferenced during cleanup. While the EPSS score is low (0.02%, percentile 4%), the vulnerability is straightforward to trigger under memory pressure conditions, requires only local access with minimal privileges, and has vendor patches available.
A memory leak vulnerability exists in the Linux kernel's test_firmware module initialization function (test_firmware_init) where allocated memory for test_fw_config->name is not properly freed when misc_register() fails. This affects all versions of the Linux kernel with the test_firmware module compiled, allowing local authenticated attackers to exhaust kernel memory and cause a denial of service. The vulnerability has a patch available from the Linux kernel maintainers, with an EPSS score of 0.01% indicating very low real-world exploitation probability despite the moderate CVSS score.
A memory leakage and potential segmentation fault vulnerability exists in the Linux kernel's AMD KFD (Kernel Fusion Driver) GPU memory management subsystem, specifically in the _gpuvm_import_dmabuf() function. The vulnerability affects Linux kernel versions across multiple branches and can be exploited by local users with low privilege levels to cause denial of service through memory corruption. Patches are available from the Linux kernel stable branches, and while the EPSS score is very low (0.01%, percentile 3%), the vulnerability has moderate CVSS severity (5.5) due to its ability to cause system availability impact.
A null pointer dereference vulnerability exists in the Linux kernel's AMD GPU (amdgpu) driver in the amdgpu_bo_validate_size() function. When validating buffer object sizes for non-exclusive memory domains, the function fails to verify that the TTM (Translation Table Maps) domain manager exists before dereferencing it, leading to a kernel oops and denial of service. Local attackers with unprivileged user privileges can trigger this vulnerability to crash the system. While patches are available from the vendor, the EPSS score of 0.01% and very low exploitation probability suggest this is a low-priority issue in practice despite the denial-of-service impact.