Linux
Monthly
Use-after-free in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges. The flaw arises from a race between concurrent RCU readers re-arming a throttle timer and RCU-deferred deallocation of the BCM operation structure, introduced by commit f1b4e32aca08's replacement of synchronize_rcu() with call_rcu(). No active exploitation has been confirmed (not in CISA KEV) and EPSS is 0.21% (12th percentile), reflecting limited real-world risk outside CAN-enabled environments.
Lockless race condition in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows local low-privileged users to trigger torn reads of socket binding state, silently redirecting CAN traffic to unintended interfaces or leaving broken RX filter operations registered as successful. The vulnerability affects all kernel branches from Linux 2.6.25 through unpatched stable releases across the 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, and 7.1.x series. No public exploit code or CISA KEV listing exists at time of analysis; EPSS probability is 0.22% (13th percentile), consistent with the local-only attack surface and specialized CAN subsystem prerequisite.
Race conditions in the Linux kernel CAN Broadcast Manager (BCM) subsystem allow adjacent attackers on the CAN bus to corrupt kernel timer and filter state in bcm_rx_setup() by racing concurrent frame-reception handlers, with theoretical impact spanning kernel memory disclosure, corruption, and denial of service. KCSAN-detected simultaneous accesses affect all Linux kernel stable branches from 5.4 through 6.15, spanning automotive, industrial, and embedded deployments that rely on CAN BCM sockets. No public exploit has been identified and EPSS sits at 0.21% (11th percentile), indicating very low near-term exploitation probability despite the 8.8 CVSS score; vendor-released patches are available across multiple stable branches.
Missing RCU (Read-Copy-Update) list synchronization primitives in the Linux kernel's CAN BCM (Broadcast Manager) subsystem expose local low-privilege users to a race-condition memory hazard affecting all kernel stable branches from 5.4 through 6.15. Two distinct defects compound the risk: bcm_[rx|tx]_setup() uses plain list_add() instead of list_add_rcu(), allowing bcm_proc_show() to observe partially initialized bcm_op structures under rcu_read_lock(); and bcm_release() invokes bcm_remove_op() - which schedules memory reclamation via call_rcu() - without first calling list_del_rcu(), creating a use-after-free window while the op remains traversable. No public exploit code has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) indicates low current exploitation probability despite the CVSS 7.8 High rating.
Race condition and missing lock coverage in the Linux kernel CAN Broadcast Manager (BCM) subsystem expose kernel frame data and 64-bit timer values to concurrent unsynchronized access. Low-privileged local users with access to AF_CAN BCM sockets can trigger reads of partially written frame content or torn 64-bit ktime_t values - the latter specifically affecting 32-bit kernel builds - with C:H/I:H/A:H impact per the CVSS vector. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) confirms low current exploitation activity, and the vulnerability is not listed in CISA KEV.
Stale state bugs in the Linux kernel CAN Broadcast Manager (BCM) subsystem allow a local low-privileged user to trigger a runaway hrtimer loop and silently suppress CAN frame delivery following network device removal events. Affected systems span Linux 2.6.25 through unpatched stable branches, with fixes released in 6.6.148, 6.12.101, 6.18.42, 7.1.5, and 7.2-rc4. An attacker with local CAN socket access can cause indefinite bcm_tx_timeout_handler() execution and potentially inject CAN frames into a subsequently reused interface index, yielding high integrity and availability impact with no public exploit identified at time of analysis.
Race condition in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows adjacent network attackers to corrupt CAN frame state and trigger spurious RX_TIMEOUT notifications. The flaw exists in ANYDEV rx operations (ifindex == 0) where concurrent frame delivery from multiple CAN interfaces races hrtimer_cancel(), bcm_rx_starttimer(), and bcm_rx_timeout_handler() on different CPUs, leading to last_frames corruption and clobbering of shared rx_ifindex/rx_stamp fields. No public exploit has been identified at time of analysis; EPSS is 0.21% (11th percentile), indicating very low current exploitation probability.
Missing frame length validation in the Linux kernel CAN Broadcast Manager (BCM) subsystem allows a local low-privileged user to trigger kernel memory corruption by supplying a malformed RTR-reply frame via RX_SETUP with the RX_RTR_FRAME flag. While bcm_tx_setup() correctly enforces DLC bounds on TX_SETUP frames, the equivalent check was absent in bcm_rx_setup(), creating an asymmetric validation gap reachable through the CAN socket interface. The CVSS 3.1 score is 7.8 HIGH with full C/I/A impact; no public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog, but patched stable releases are available across multiple kernel branches.
Use-after-free race condition in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows a local low-privileged attacker to trigger a stale filter pointer against freed memory, with potential full CIA impact on affected systems. The flaw exists from kernel 2.6.25 onward in net/can/bcm.c, where concurrent NETDEV_UNREGISTER events could silently bypass can_rx_unregister(), leaving dangling references to freed bcm_op and socket structures. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.21% (11th percentile), indicating very low real-world exploitation probability at this time.
Use-after-free of freed executable memory in the Linux kernel's io_uring/bpf-ops subsystem allows a local attacker with CAP_BPF and CAP_PERFMON capabilities to achieve arbitrary kernel code execution by registering the same io_uring_bpf_ops struct_ops map against multiple io_ring_ctx instances in sequence. The missing re-registration guard on ops->priv causes the first io_ring_ctx to be orphaned with a dangling ctx->loop_step function pointer into a freed BPF trampoline, which is invoked when io_uring_enter() is later called on that ring. No public exploit has been identified at time of analysis, and EPSS at 0.20% reflects low near-term mass-exploitation probability, though the primitive - controlled call into freed executable memory - is a classic kernel privilege escalation building block.
BPF verifier register bounds mismatch in the Linux kernel allows local users with BPF loading capability to bypass BPF memory safety checks via crafted programs targeting LSM hook context loads. The flaw in check_mem_access() causes stale register bounds from prior instructions to corrupt the verifier's abstract interpretation, producing a divergence between the verifier's belief and runtime state that can be exploited to escape the BPF sandbox. Patches are confirmed available in stable branches (6.12.103, 6.18.40, 7.1.5, 7.2-rc1); no public exploit or CISA KEV listing exists, and EPSS is low at 0.22% (13th percentile), indicating limited observed real-world exploitation.
Use-after-free in the Linux kernel's BPF task storage subsystem allows a local low-privileged user to trigger a kernel hang or UAF condition during fork() failure. When copy_process() duplicates a task_struct via dup_task_struct, it copies the parent's bpf_storage pointer verbatim into the nascent child; if a subsequent RLIMIT_NPROC check causes the fork to abort, the cleanup path (bpf_task_storage_free → bpf_local_storage_destroy) operates on this uninitialized copied pointer rather than a valid child-owned one. No public exploit or CISA KEV listing exists at time of analysis, and EPSS is low at 0.21%, but kernel UAF conditions of this class are historically weaponizable into local privilege escalation.
Incomplete cleanup in the Linux kernel's sparx5 Ethernet switch driver leaves a switchdev blocking notifier registered when workqueue allocation fails during initialization, creating a dangling callback that subsequent kernel network events can invoke against uninitialized driver state - enabling potential kernel memory corruption or privilege escalation on affected hardware. Systems running kernels from 5.14 through the unpatched stable branches on Microchip Sparx5 switch ASICs are affected; patches have been backported to five stable kernel series. No public exploit code exists and EPSS probability is 0.21% (12th percentile), though kernel-level C:H/I:H/A:H impact warrants prompt patching on any affected networking appliance.
Metadata snapshot operations in the Linux kernel's device-mapper thin provisioning (dm-thin) subsystem write a partially-updated superblock field to disk when a metadata commit subsequently fails, corrupting the on-disk space map reference counts. Systems using dm-thin storage pools are affected across a wide range of stable kernel branches from 3.2 onward through patched versions. A local attacker with access to dm-thin pool management can deliberately trigger the failure path - for example by constraining the metadata device - causing persistent metadata inconsistency that survives reboots and results in data loss or pool unavailability. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis.
Out-of-bounds memory access in the Linux kernel dm-era (device mapper era) subsystem allows a local privileged attacker to trigger a vmalloc out-of-bounds read by configuring a dm-era table with a non-zero start sector. The era_map() function fails to apply the target offset before calculating the writeset block, passing an absolute block number to writeset_marked() that may exceed the allocated bitset size. No public exploit exists and EPSS probability is 0.22%, but patches are backported across all major stable kernel branches. The provided CVSS score of 8.8 (AV:N/PR:L) materially overstates real-world risk for a flaw requiring CAP_SYS_ADMIN and a specifically misconfigured dm-era table.
Integer wraparound in the Linux kernel's dm-log subsystem on 32-bit architectures allows a local attacker to trigger a bitset_size overflow, potentially causing kernel memory corruption. Specifically, when region_size is close to UINT_MAX and bitset_size is rounded up to a multiple of BITS_PER_LONG, a 32-bit size_t wraps around to zero, leading to an incorrect zero-byte bitmap allocation and subsequent out-of-bounds write conditions. No public exploit is identified at time of analysis, and EPSS probability is low (0.22%, percentile 13%), but the CVSS 7.8 local score reflects the potential for full system compromise once the specific conditions are met.
The Linux kernel dm (device-mapper) subsystem, from version 6.9 onward, leaks the calling process's thread keyring by retaining a reference to the table device file beyond the caller's lifetime, causing LUKS volume keys to silently persist in RAM after `cryptsetup luksSuspend`. This regression, introduced by commit a28d893eb327, breaks a documented security guarantee: `luksSuspend` is expected to wipe the volume key from memory, but an unpatched kernel leaves a second copy in the retained thread keyring recoverable until `luksClose`. Any adversary capable of reading kernel memory - via physical access, cold boot attack, or a separate memory disclosure exploit - can extract the LUKS volume key and decrypt the protected volume. No public exploit is identified, and EPSS of 0.21% (11th percentile) reflects limited automated exploitation probability.
Double-free memory corruption in the Linux kernel's device mapper subsystem allows a local attacker to trigger kernel memory corruption by causing dm_resume failure during early device creation, potentially leading to privilege escalation or system crash. Affected systems run kernel versions from approximately Linux 5.1 through multiple stable branches prior to the respective patch commits; fixes are available across all major stable series from 5.10 through 7.2-rc3. No public exploit code exists and EPSS exploitation probability is extremely low at 0.22% (13th percentile), though the high CVSS impact metrics (C:H/I:H/A:H) reflect the potential severity if the error path is successfully triggered and weaponized.
Deadlock in the Linux kernel's dm-integrity device mapper module allows a local attacker or process with block-device access to permanently freeze I/O on an integrity-protected block device. When dm_integrity_check_limits detects an out-of-bounds bio and returns failure, it exits with DM_MAPIO_KILL while leaving an internal range lock held, so all subsequent I/O operations block indefinitely waiting for a lock that will never be released. No public exploit identified at time of analysis; EPSS is 0.21% at the 11th percentile, consistent with a locally-triggered kernel availability flaw requiring a non-default configuration.
Integrity bypass in the Linux kernel dm-integrity device mapper subsystem allows low-privileged users to undermine block-level data integrity guarantees through a double-increment logic error in hash_offset tracking. The introduced commit 84597a44a9d86ac949900441cea7da0af0f2f473 (present since Linux 5.7) causes the hash_offset variable to advance by two positions per iteration instead of one, meaning integrity hashes are verified against incorrect offsets - allowing corrupted data to pass or valid data to fail integrity checks. No public exploit identified at time of analysis, and EPSS at 0.21% (11th percentile) reflects low near-term exploitation probability.
An out-of-bounds kernel write in the Linux kernel's dm-verity Forward Error Correction (FEC) code allows corruption of adjacent kernel memory when Reed-Solomon erasure recovery is triggered. An off-by-one in the erasure-counting logic lets the erasure count reach roots+1, which is then passed to decode_rs8() and overruns the lambda[] locator polynomial by one element, clobbering the syndrome buffer (syn[0]). It affects Linux systems using dm-verity with FEC enabled; there is no CISA KEV listing, no public exploit identified, and EPSS is low (0.22%, 13th percentile), indicating this is a memory-safety defect rather than an actively exploited threat.
Uninitialized memory dereference in the Linux kernel's dma-fence subsystem allows a local low-privileged user on AMD GPU-equipped systems to trigger memory corruption via the amdgpu userqueue wait path. The root cause is an off-by-one logic error in `dma_fence_dedup_array()` that returns 1 instead of 0 for empty input, which the primary caller guards against but `amdgpu_userq_wait_*()` does not, exposing an uninitialized fence slot to dereference. Patch commits are available for stable branches 6.18.40 and 7.1.5; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), indicating low real-world exploitation activity.
Use-after-free in the Linux kernel's amdxdna DMA buffer memory mapping function exposes systems with AMD XDna AI accelerator hardware to local privilege escalation. When vm_insert_pages() fails inside amdxdna_gem_dmabuf_mmap(), the error path triggers drm_gem_object_put() twice on the same GEM object - once through the VMA close handler and again through the fall-through put_obj label - freeing the object and then accessing freed memory. EPSS sits at 0.21% (11th percentile) and the vulnerability is not listed in CISA KEV, indicating no known active exploitation; however, the CVSS 7.8 high score reflects the full C/H/I:H/A:H kernel memory corruption potential if successfully triggered locally.
Client pointer confusion in the Linux kernel's amdxdna DRM accelerator driver allows a local low-privileged user to trigger cross-process access to another process's hardware context and debug buffer objects via a misrouted SYNC_DIRECT_FROM_DEVICE ioctl. Systems running AMD XDNA NPU hardware (such as AMD Ryzen AI series processors) with the amdxdna kernel module loaded are affected across kernel versions from the driver's introduction up to the patched releases in 7.1.5 and 7.2-rc1. No public exploit exists and the EPSS score of 0.20% (10th percentile) reflects low near-term exploitation probability, though the CVSS 7.8 score correctly captures the high CIA impact should exploitation succeed.
Integer underflow in the Linux kernel's Intel VPU accelerator driver (accel/ivpu) allows a local low-privileged attacker to trigger out-of-bounds kernel memory reads and infinite loops via a malformed firmware log buffer. The vulnerability exists because fw_log_from_bo() never validates that log->size is at least log->header_size before fw_log_print_buffer() computes data_size = log->size - log->header_size - a u32 subtraction that wraps to near-U32_MAX, defeating the bounds checks from commit dd1311bcf0e6 and enabling fw_log_print_lines() to read far past the allocated BO region. No active exploitation is confirmed (not in CISA KEV), and EPSS is 0.21% (11th percentile), indicating low near-term exploitation likelihood despite the 7.1 CVSS score.
Denial of service in the Linux kernel's Xen paravirtualized SCSI backend (xen-scsiback) lets a malicious pvSCSI guest exhaust every command tag of a target LUN's session by driving the pre-submission error paths, which call transport_generic_free_cmd() on an se_cmd whose cmd_kref is still 0. The resulting refcount underflow is a use-after-free that leaks the tag and stops the LUN; on hosts booted with panic_on_warn it crashes the host outright. There is no public exploit identified at time of analysis and EPSS is low (0.21%), but the fix is shipped across multiple stable kernel trees.
Kernel out-of-bounds read in the Linux SCSI target (LIO/TCM) subsystem lets a SCSI initiator crash the host by sending a malformed PERSISTENT RESERVE OUT command. The iSCSI TransportID parser (target_parse_pr_out_transport_id / iscsi_parse_pr_out_transport_id) scans for the ',i,0x' ISID separator with an unbounded strstr(), so a TransportID whose iSCSI name has no separator and no NUL terminator runs the scan off the end of a multi-page vmap buffer into the vmalloc guard page, oopsing the kernel (KASAN: vmalloc-out-of-bounds). It is reachable by any fabric delivering PR OUT to an iSCSI-exported device, including a guest via vhost-scsi. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and it is not in CISA KEV.
Use-after-free in the Linux kernel's LIO SCSI target core (iSCSI transport) lets an initiator that can issue a PERSISTENT RESERVE OUT / REGISTER AND MOVE command trigger reads of an unmapped kernel virtual address, risking information disclosure or a kernel crash. The flaw exists only in the target-mode stack (drivers/target) and only manifests when the PR OUT parameter list exceeds one page (>4096 bytes), forcing transport_kmap_data_sg() down its vmap()/vunmap() path. EPSS is low (0.22%, 13th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
Use-after-free in the Linux kernel's resctrl filesystem subsystem allows a local low-privileged user to dereference freed kernel memory during a race between a concurrent monitoring file reader and resctrl unmount or fatal teardown. The vulnerable code path affects multiple stable kernel series, with fixes confirmed in 6.18.42, 7.1.5, and 7.2-rc3. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% reflects low current exploitation probability, though kernel use-after-free primitives are commonly developed into local privilege escalation exploits.
Use-after-free and initialization-order race conditions in the Linux kernel's mlx5e MACsec hardware offload driver allow a local low-privileged user to corrupt kernel memory during RX Security Channel deletion. The delete path in macsec_del_rxsc_ctx() called metadata_dst_free() unconditionally, bypassing reference counting, while concurrent RX datapath readers operating under rcu_read_lock() could still hold and dereference the freed dst object. A secondary race in the add path published the SC's xarray entry before md_dst was fully initialized, allowing readers to observe NULL or partially-constructed pointers. Patches are available across multiple stable branches (6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2-rc2); no public exploit has been identified at time of analysis.
Use-after-free race condition in the Linux kernel's tracing/user_events subsystem allows a low-privileged local user to corrupt kernel heap memory during fork(), potentially enabling privilege escalation to root. The race is triggered when a multithreaded process concurrently unregisters a user event enabler while calling fork(), causing user_event_mm_dup() to dereference enabler and user_event structures freed without observing the required RCU grace period. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, the low privilege bar and full C/I/A impact make it a meaningful escalation primitive on any multi-user or shared Linux system running an unpatched kernel with CONFIG_USER_EVENTS enabled.
Local privilege escalation / memory corruption in the Linux kernel's PREEMPT_RT locking substitution stems from rt_spin_unlock() (and the rwlock substitution) releasing RCU read-side protection before completing the unlock, creating a use-after-free window where an object freed via kfree_rcu() can be accessed by rt_mutex_cmpxchg_release(). Only PREEMPT_RT (real-time) kernel builds are affected, since regular spinlocks keep preemption disabled across unlock and thus retain full RCU protection. The upstream fix has been merged and backported to multiple stable trees; no public exploit identified at time of analysis, and EPSS is low (0.21%).
Error-masking in the Linux kernel CPU hotplug subsystem allows a failed CPU state transition to silently appear successful to callers, spanning stable branches from 4.14 through 7.1.x. The root cause is that cpuhp_invoke_callback() reuses the ret variable in its rollback path: when one instance callback fails and the subsequent rollback succeeds, the rollback's zero return overwrites the original non-zero error, hiding the failure from higher-level consumers. No active exploitation is confirmed - EPSS sits at 0.22% (13th percentile) and there is no CISA KEV listing - but patches are available across all affected stable branches.
Unbounded sprintf() calls in the Linux kernel's CPU hotplug sysfs interface (states_show()) can overflow the PAGE_SIZE kernel buffer when a sufficient number of hotplug states are registered, enabling a local low-privileged user to corrupt adjacent kernel memory with potential high impact on confidentiality, integrity, and availability. Affected kernel versions span from the 4.6 era through multiple current stable branches (5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x), each with vendor-released patch versions confirmed by ENISA EUVD-2026-59024. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), indicating limited real-world exploitation probability despite the 7.8 CVSS score.
Out-of-bounds memory access in the Linux kernel MANA (Microsoft Azure Network Adapter) Ethernet driver arises because the RX completion queue entry (CQE) packet length reported by the NIC was passed to skb processing without validation. Affected systems are Linux VMs running the mana_en driver, predominantly Azure guests using MANA/SR-IOV networking. A NIC (or malicious hypervisor/device) supplying a crafted oversized length can trigger an out-of-bounds read leading to information disclosure or a kernel crash; the vulnerability is tagged Information Disclosure, has no public exploit identified at time of analysis, and carries a low EPSS of 0.21%.
Missing DMA sync-for-CPU in the Linux kernel's MANA (Microsoft Azure Network Adapter) RX path can hand stale or uninitialized buffer memory to the networking stack on systems that require explicit DMA syncing, such as those booted with swiotlb=force. The flaw affects the mana Ethernet driver when RX buffers come from page-pool fragments (frag_count > 1), where the DMA unmap that normally performs the implicit CPU sync is skipped. There is no public exploit identified at time of analysis, EPSS is low (0.20%), and it is not listed in CISA KEV.
Cross-namespace privilege escalation in the Linux kernel SIT (IPv6-in-IPv4) tunnel driver allows a local attacker with CAP_NET_ADMIN in one network namespace to rewrite SIT tunnel configuration belonging to a distinct, more privileged network namespace, bypassing the intended authorization boundary. This is particularly impactful in containerized environments where network namespace isolation is a primary security boundary, as tenant containers are commonly granted CAP_NET_ADMIN within their own namespace. Patches are confirmed available across all active stable kernel branches (5.10 through 7.x); no public exploit or CISA KEV entry exists at time of analysis, and EPSS is 0.22%, reflecting very low observed exploitation activity.
Metadata corruption in the Linux kernel traffic control connection-tracking action (act_ct) allows remote attackers to crash systems or corrupt qdisc packet-segment state by sending fragmented IP or IPv6 traffic. The flaw exists because tcf_ct_handle_fragments() invokes nf_ct_handle_fragments() without preserving skb->cb, so the netfilter defragmentation helper silently overwrites tc_skb_cb/qdisc_skb_cb in-place - the same memory region. On hosts with panic_on_warn enabled, this triggers a WARN_ON_ONCE in qdisc_pkt_segs() that escalates to a kernel panic. EPSS is low (0.21%, 11th percentile) and the vulnerability is not in CISA KEV, indicating opportunistic exploitation is unlikely but targeted denial-of-service against network appliances or container hosts using tc act_ct is realistic.
Privilege boundary bypass in the Linux kernel's ip6_vti (IPv6 Virtual Tunnel Interface) subsystem allows a local user with CAP_NET_ADMIN in one network namespace to reconfigure VTI6 tunnels residing in a separate, unprivileged network namespace. The rtnl changelink path validates CAP_NET_ADMIN only against dev_net(dev), leaving t->net unchecked when the device spans namespaces - enabling unauthorized rewrites of cross-namespace tunnel configurations with full confidentiality, integrity, and availability impact on the affected namespace. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (12th percentile) reflects low current exploitation probability, though the capability misuse pattern is well-understood in container-escape research.
Privilege escalation in the Linux kernel's IP VTI (Virtual Tunnel Interface) subsystem allows a local attacker holding CAP_NET_ADMIN in one network namespace to reconfigure VTI tunnel endpoints anchored in a separate, more privileged network namespace they do not control. Affected kernel versions span from approximately 3.15 through all stable branches prior to 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code has been identified and no CISA KEV listing exists, but the scope-changed CVSS rating (8.8) reflects real cross-namespace boundary violation risk relevant to container and VNF deployments.
Cross-namespace capability bypass in the Linux kernel's IPIP (IP-in-IP) tunnel driver allows a local process holding CAP_NET_ADMIN within one network namespace to modify IPIP tunnel parameters governed by a separate, more privileged network namespace. By exploiting the missing rtnl_dev_link_net_capable() check in ipip_changelink(), an attacker can redirect or disrupt encapsulated tunnel traffic across namespace boundaries - a meaningful concern in containerized environments where namespace separation is a security boundary. No public exploit code or CISA KEV listing has been identified; EPSS stands at 0.21% (11th percentile), indicating low current exploitation probability despite the high CVSS score of 8.8.
IPv6 GRE tunnel management in the Linux kernel allows a local attacker holding CAP_NET_ADMIN in one network namespace to modify tunnel configurations residing in a separate, unauthorized namespace - effectively escalating privilege across namespace security boundaries. Affected kernels span multiple long-term support trees from at least 4.19.100 onward, with patches released across stable series including 6.12.97, 6.6.145, 6.1.178, 6.18.40, 5.10.261, 5.15.212, and 7.1.5. No public exploit code has been identified at time of analysis; EPSS exploitation probability stands at 0.21% (12th percentile), indicating limited current attacker interest despite the high CVSS score.
Insufficient capability gating in the Linux kernel's IPv6 tunnel subsystem allows a local attacker with CAP_NET_ADMIN in one network namespace to reconfigure tunnel devices residing in a separate, more privileged namespace. Affected versions span from Linux 3.12 through all stable branches prior to 6.6.148, 6.12.101, 6.18.40, and 7.1.5, with the CVSS Scope:Changed metric confirming cross-namespace impact. This vulnerability is not listed in CISA KEV and carries an EPSS score of 0.20% (10th percentile), indicating limited observed exploitation at time of analysis; however, it is a meaningful privilege escalation primitive in containerized deployments where CAP_NET_ADMIN is routinely granted.
Raw AES-128 LLSEC key exposure in the Linux kernel's legacy ieee802154 netlink family allows any local user to extract 16-byte cryptographic key material directly from the kernel keytable on systems running IEEE 802.15.4 (wpan) interfaces with link-layer security configured. Because IEEE 802.15.4 LLSEC uses CCM* mode where the same key both encrypts frames and provides message authentication, key disclosure simultaneously breaks confidentiality and authenticity of the entire 802.15.4 wireless network. No confirmed active exploitation and no public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), consistent with the niche hardware requirement.
Header buffer corruption in the Linux kernel gve (Google Virtual Ethernet) driver's DQO RX datapath lets header bytes from one packet be copied onto another, and lets header buffers be re-posted while the device still owns them, when both header-split and HW-GRO are enabled with many concurrent flows. The gve driver is used by Google Cloud Platform Linux VMs, so exposure is limited to GCP guests running affected kernels with that specific offload configuration. There is no public exploit identified at time of analysis, EPSS is very low (0.20%), and the observed effect is roughly a 30% throughput drop with heavy TCP retransmissions rather than code execution.
Cross-VF/PF LMTLINE physical address disclosure in the Linux kernel's octeontx2-af CN10K driver allows a low-privileged VF caller to read another PF's LMTLINE physical base address and map it into its own LMT table entry. Affected are Linux kernel trees from commit 893ae97214c3 across stable branches 6.6.x before 6.6.148, 6.12.x before 6.12.101, 6.18.x before 6.18.42, and mainline before 7.1.5/7.2-rc1. No public exploit code or CISA KEV listing exists at time of analysis; the EPSS score of 0.20% (10th percentile) indicates low exploitation probability, consistent with the hardware-specific attack surface.
Data corruption in the Linux kernel's LoongArch memory management subsystem allows a local low-privileged user to cause silent loss of written data or potential exposure of stale page contents via a race condition between hardware page table walker behavior and software dirty-bit tracking. Affected systems are those running LoongArch CPUs with hardware PTW enabled - a condition that applies to the architecture by design - across kernel versions from 5.19 through stable branches prior to 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code exists and EPSS stands at 0.21% (11th percentile), though the bug was reliably reproduced via the LTP madvise09 test, confirming it is not theoretical.
Reference count underflow in the Linux kernel IPMI subsystem's handle_read_event_rsp() function enables local privilege escalation on server hardware with active IPMI interfaces. The flaw resides in the error-rollback path: when event delivery fails after successfully allocating receive messages for some users, the rollback incorrectly drops the user reference count twice - once through ipmi_free_recv_msg() and again through a now-stale explicit put - freeing an ipmi_user object that remains linked on intf->users. Subsequent event delivery then dereferences the freed object or trips refcount_t's addition-on-zero guard, enabling kernel memory corruption leading to full system compromise. No public exploit or CISA KEV listing exists; EPSS is 0.20% at the 10th percentile, consistent with no active exploitation at time of analysis.
Memory-accounting corruption in the Linux kernel's espintcp (ESP-in-TCP / IPsec RFC 8229) send path was resolved by switching to sk_msg_free_partial(), which keeps the socket message (skmsg) consistent on partial sends. On affected kernels the previous code mishandled uncharges and offsets when the full payload was not transmitted, corrupting skmsg accounting on a system where TCP encapsulation of IPsec is in use. This is a stable-tree fix carrying an NVD CVSS of 9.8 and the 'Information Disclosure' tag, but EPSS is only 0.20% (10th percentile) and no public exploit is identified at time of analysis.
Kernel panic via NULL pointer dereference in the Linux kernel's multiq traffic scheduler (net/sched/sch_multiq) affects all kernels from 2.6.29 through unpatched stable trees. When multiq pairs with a non-work-conserving child qdisc (such as qfq) routed through a peeking intermediary (such as tbf), multiq_dequeue() invokes the child's raw ->dequeue() method directly instead of qdisc_dequeue_peeked(), orphaning the stash, corrupting qlen/backlog accounting, and triggering a NULL dereference in softirq context during ordinary egress. Exploitation requires local access with CAP_NET_ADMIN and a deliberately constructed qdisc hierarchy; no public exploit code exists and EPSS probability is 0.21% (12th percentile), consistent with the niche configuration requirement.
Kernel panic via NULL pointer dereference in Linux's taprio traffic scheduler (net/sched/sch_taprio) delivers system-level denial of service when a non-work-conserving child qdisc such as qfq is attached to a taprio parent. The defect in taprio_dequeue_from_txq() calls the child's ->dequeue() function pointer directly rather than via qdisc_dequeue_peeked(), bypassing the child's gso_skb stash, orphaning the peeked skb, desyncing qlen/backlog counters, and re-entering the child on an emptied list - triggering a NULL dereference from softirq context during ordinary egress traffic. No public exploit has been identified at time of analysis, and EPSS stands at 0.20% (10th percentile), indicating very low opportunistic exploitation probability; the vulnerability is not listed in CISA KEV.
Null pointer dereference in the Linux kernel's fhandle subsystem allows a local low-privileged user to trigger a kernel panic via a race condition in capable_wrt_mount(). The vulnerable path is reached when open_by_handle_at() processes a file handle whose detached mount - created via open_tree(OPEN_TREE_CLONE) - is concurrently dissolved by fput(), causing umount_tree() to clear mount->mnt_ns to NULL before capable_wrt_mount() can safely dereference mnt_ns->user_ns. No public exploit identified at time of analysis (EPSS 0.20%, no CISA KEV listing), and patched kernel versions 6.12.97, 6.18.40, 7.1.5, and 7.2-rc2 are available from upstream stable trees.
Kernel memory disclosure and denial-of-service in the Linux kernel OrangeFS client affects systems mounting OrangeFS parallel filesystems, where fill_from_part() truncates a 64-bit directory-entry length into a __u32. An entry length near U32_MAX wraps to a small value that slips past the bounds check and is then used to index the directory part, causing an out-of-bounds read that oopses the kernel. The malformed trailer is supplied by the userspace OrangeFS client, and there is no public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and this is not in CISA KEV. Note: the input CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) conflicts with the description, which describes a local, client-supplied-data OOB read rather than remote unauthenticated code execution.
Out-of-bounds memory read and infinite-loop denial of service in the Linux kernel's iosm WWAN driver (net/wwan/iosm) allow a rogue or compromised modem to corrupt kernel memory and exhaust system resources by supplying crafted MUX downlink packets with malicious offsets and circular table references. Affected systems are those running Linux 5.18 and later with Intel WWAN hardware using the iosm driver, where the mux_dl_adb_decode() function failed to validate any of the device-supplied offsets and lengths (first_table_index, next_table_index, table_length, datagram_index, datagram_length) against the received socket buffer boundary. No public exploit exists and EPSS probability is very low at 0.21% (12th percentile); however, the CVSS 8.8 rating with Full C/I/A impact and reproduction confirmed under KASAN make this a credible risk for cellular-enabled Linux deployments awaiting patch application.
Memory corruption in the Linux kernel's compaction subsystem allows a local low-privileged attacker to trigger data corruption or potential privilege escalation by exploiting improper error handling in compaction_free(). The function ignores failure returns from free_pages_prepare(), causing hardware-poisoned pages (PageHWPoison) or bad pages (free_page_is_bad()) to be re-added to the compaction freepages list and subsequently reallocated to kernel or user structures. Exploitation requires low-privilege local access and is not confirmed actively exploited (absent from CISA KEV), with EPSS at a low 0.21% (11th percentile); vendor-released patches are available across multiple stable branches.
Race condition in the Linux kernel mac802154 subsystem allows a local low-privileged attacker to trigger kernel memory corruption by racing hardware teardown against an in-flight asynchronous transmit completion. Affected systems are those running IEEE 802.15.4 wireless networking hardware with the mac802154 module loaded; versions from Linux 3.19 through the respective stable-branch fix commits are vulnerable. No public exploit identified at time of analysis, and EPSS of 0.21% (12th percentile) reflects negligible observed exploitation activity; vendor patches have been released across all active stable kernel branches.
IPVS (IP Virtual Server) SCTP state tracking in the Linux kernel misreads chunk headers for IPv6 packets carrying extension headers, causing incorrect connection state transitions that affect load balancer behavior and resource accounting. The IPVS subsystem, widely deployed in Kubernetes and LVS environments via kube-proxy, can misclassify an SCTP INIT packet as an already-ESTABLISHED connection when the IPv6 packet includes extension headers (e.g., an 8-byte Destination Options header), because set_sctp_state() hardcodes sizeof(struct ipv6hdr) as the transport offset rather than using the offset already resolved by ipv6_find_hdr(). No public exploit identified at time of analysis, and EPSS at 0.21% (12th percentile) confirms very low current exploitation interest despite the CVSS 8.2 score.
Information disclosure and TCP flow corruption in the Linux kernel's IPVS (IP Virtual Server) load balancer arises because ip_vs_conn_new() only zeroes the delta fields of its two ip_vs_seq structures, leaving init_seq and previous_delta filled with stale slab data. A director acting as a connection-sync backup can hash a connection with IP_VS_CONN_F_IN_SEQ/OUT_SEQ flags set (inherited from IP_VS_CONN_F_BACKUP_MASK) while an attacker-supplied sync message omits IPVS_OPT_SEQ_DATA, so an IPVS application helper later rewrites forwarded TCP sequence/ack numbers using uninitialized kernel memory. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and the issue is not in CISA KEV.
Heap out-of-bounds read in the Linux kernel MACsec subsystem (`macsec_encrypt()`) allows a local attacker with CAP_NET_RAW capability to leak 12 bytes of kernel heap memory and emit that raw heap content onto the wire as a malformed Ethernet frame, with additional potential for kernel destabilization. The flaw is triggered exclusively via the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path, where the socket buffer arrives at `macsec_start_xmit()` with `skb->mac_header` unset, resolving `eth_hdr(skb)` to `skb->head + 65535` - far outside valid headroom. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (12th percentile) reflects low exploitation probability; patches have been backported across all active stable kernel series.
Out-of-bounds write in the Linux kernel's dibs loopback subsystem enables a local low-privileged attacker to corrupt kernel memory by supplying a crafted offset or oversized write through the move_data() interface, which calls memcpy() without verifying that offset + size stays within the registered DMB's allocated length. The software loopback omits the memory-region bounds enforcement that real ISM hardware provides natively, leaving peer-supplied parameters unchecked. Patch commits are confirmed across four stable kernel branches (6.12.97, 6.18.40, 7.1.5, 7.2-rc3); the vulnerability is not in CISA KEV and no public exploit code has been identified at time of analysis.
Kernel memory corruption in the Linux kernel's DRBD (Distributed Replicated Block Device) driver lets a malicious or man-in-the-middle replication peer write attacker-chosen bytes past a bio page in a receiving node. The flaw lives in recv_dless_read(), where a peer-supplied payload length is handled as a signed int (data_size) that can be driven negative, and it affects any node that reads from its peer - a diskless node or one using read-balancing - in the default configuration. Rated CVSS 9.8 by NVD; there is no public exploit identified at time of analysis and EPSS probability is low (0.20%).
Use-after-free race condition in the Linux kernel's osnoise tracing subsystem allows a local low-privileged attacker to potentially escalate privileges or destabilize the kernel. The flaw, present in kernels since commit a6ed2aee (Linux 5.17), stems from missing synchronize_rcu() synchronization during osnoise instance unregistration, leaving a window where RCU readers can dereference freed tracer memory. Patched stable releases (6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2-rc3) are available; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Shared MIPI PHY resource mismanagement in the Linux kernel's NXP i.MX93 block-control power domain driver (imx93-blk-ctrl) allows a local attacker with low privileges to trigger kernel-level incorrect behavior - including potential memory corruption, information disclosure, and system instability - by exploiting the fact that the DSI and CSI subdomains share clock and reset control bits without coordination. Patches are available across stable branches (6.18.42, 7.1.5, 7.2-rc4), and exploitation probability is low per EPSS (0.20%, 10th percentile). No public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Linux kernel's rt2x00 WiFi driver stems from improper error handling during device probe, where early allocation failures invoke a full teardown path that assumes work items (intf_work, autowakeup_work, sleep_work) are already initialized. On systems with Ralink/MediaTek rt2x00-compatible WiFi hardware, a local low-privileged attacker who can trigger workqueue allocation failure during driver probe can corrupt uninitialized kernel work_struct objects, as confirmed by DEBUG_OBJECTS reporting invalid work drains. EPSS is low (0.21%, 12th percentile) and this is not listed in CISA KEV, though a QEMU-based proof-of-concept demonstrating the failure path was confirmed by the reporters.
Heap overflow in the Linux kernel brcmfmac/cyw WiFi driver allows a network-adjacent attacker controlling a rogue or compromised access point to corrupt kernel heap memory during WPA3 SAE authentication. The flaw in `brcmf_notify_auth_frame_rx()` causes an unsigned integer underflow when a short auth frame (under 24 bytes) is received, producing a wrap-around copy length that drives `memcpy` far beyond the allocated buffer. With CVSS 8.8 and full C/H/I/H/A/H impact on the vulnerable system, exploitation yields arbitrary kernel memory write capability; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (12th percentile), indicating low observed exploitation pressure despite the critical technical severity.
Integer underflow and overflow flaws in the Linux kernel's Realtek Bluetooth driver (btrtl) corrupt kernel memory during firmware loading, enabling a local attacker with low privileges to achieve full kernel-level compromise. The vulnerability exists in rtlbt_parse_firmware(), where a malformed firmware patch with a length field smaller than 4 causes a subtraction underflow that transforms a subsequent memcpy into an oversized kernel memory write; a separate addition overflow on 32-bit architectures compounds the exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), consistent with the local-only attack vector.
Incorrect IPv6 transport-header offset handling in the Linux kernel's IPVS (IP Virtual Server) load-balancing subsystem causes application-layer helper code and ICMPv6 checksum validation to misread packet headers when IPv6 traffic - particularly packets carrying extension headers - is processed. The IPVS TCP application path wrongly assumed an IPv4 network header even after the ipvsh offset argument was supplied, and ip_vs_out_icmp_v6() used an incorrect ICMPv6 offset. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and this is not on CISA KEV, and for the only in-tree app (FTP) the maintainers note the effect is harmless because port mangling is handled by Netfilter without TCP sequence adjustment.
Memory-safety defect in the Linux kernel IPVS (IP Virtual Server) subsystem where __ip_vs_get_out_rt() calls skb_ensure_writable(), which can reallocate skb->head, leaving a stale IP-header pointer that is then dereferenced. Affected hosts are Linux systems acting as IPVS load balancers/directors; the flaw can lead to reads of freed/relocated packet memory (information disclosure) or kernel instability. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile); the upstream fix reloads the IP header after reallocation.
Out-of-bounds memory access in the Linux kernel's spufs (SPU filesystem) subsystem on PowerPC Cell Broadband Engine architectures allows a local low-privileged user to read or write beyond the SPU local store buffer via a flawed bounds check in `spufs_mem_mmap_access()`. The function computes the mmap offset correctly but validates it against `vma->vm_end` rather than `LS_SIZE`, causing the guard to never fire on 64-bit systems and leaving the length parameter unconstrained relative to the actual local store buffer. Vendor-released patches are confirmed across multiple stable kernel branches; no public exploit has been identified and EPSS is 0.21% at the 12th percentile.
PowerPC E500 systems running Linux kernel 7.0 through 7.1.4 and 7.2-rc4 silently lose kernel address-masking protection due to a compile-time preprocessor symbol typo - `CONFIG_E500` instead of `CONFIG_PPC_E500` - causing `mask_user_address_isel()` to be omitted from E500 builds entirely. A local low-privileged user on affected E500 hardware can exploit the absent address-masking primitive to achieve high-impact memory disclosure, integrity corruption, or denial of service against the kernel. No public exploit exists, EPSS is 0.19% (9th percentile), and this vulnerability is not in CISA KEV, indicating very limited current exploitation activity despite a CVSS score of 7.8.
Out-of-bounds read in the Linux kernel cfg80211 WiFi subsystem allows an adjacent-network unauthenticated attacker to disclose kernel memory or crash the system by sending a crafted EHT Multi-Link Element inside an MBSSID beacon frame. Affected kernels fail to call ieee80211_mle_type_ok() before passing the element to ieee80211_mle_get_mld_id(), violating the helper's documented contract and allowing reads past the IE boundary. No public exploit exists and EPSS is 0.20% (10th percentile), but the attack requires only radio proximity to a device with Wi-Fi scanning active - no authentication and no user interaction needed.
Insufficient Multi-Link Element (MLE) common info length validation in the Linux kernel's IEEE 802.11 WiFi stack exposes adjacent-network attackers to high-impact memory corruption. Kernels from commit 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 onward failed to validate the advertised common-info length field for Reconfiguration and Priority Access MLE types - and also omitted the length octet when computing the minimum common size for Reconfiguration MLEs - meaning a malformed MLE frame crafted by a nearby attacker can trigger out-of-bounds access. The CVSS score of 8.8 (AV:A) and EPSS of 0.20% (10th percentile) together indicate high potential impact but no public exploit activity at time of analysis; no public exploit and no CISA KEV listing have been identified.
Remote kernel memory corruption in the Linux mac80211 WiFi subsystem allows an unauthenticated attacker within WiFi range to trigger out-of-bounds memory accesses by sending crafted 802.11 extension frames that bypass subtype validation and reach generic RX path code expecting regular 802.11 header layouts. Affected systems include any Linux host with an active mac80211-based WiFi driver across a broad range of kernel versions spanning 5.10 through pre-patch 7.x releases. The CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact at the kernel level; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Wrong MTD geometry is applied in the Linux kernel's mchp23k256 SPI SRAM driver when the chip is matched via the SPI id-table rather than via Device Tree, potentially exposing or corrupting unintended SRAM address regions. The driver's probe function calls of_device_get_match_data() exclusively, causing any non-OF SPI modalias match to silently fall back to the default mchp23k256_caps structure regardless of which part was actually selected by the SPI id-table, leading to incorrect chip capacity and address geometry. No public exploit exists and EPSS places this at the 7th percentile (0.17%), but the C:H/I:H/A:H CVSS impact flags reflect that incorrect geometry can expose the entire SRAM contents or allow out-of-bounds writes on affected embedded systems.
Kernel memory corruption in the Linux MTD raw NAND driver for NXP LPC32xx SLC hardware arises because lpc32xx_xmit_dma() silently discards the return value of wait_for_completion_timeout(), treating an expired DMA transfer as successful. The timed-out DMA engine can continue accessing a scatterlist buffer after it has been unmapped and potentially reused by the NAND read/write path, creating a use-after-free condition in kernel space. Exploitation requires local access to an embedded Linux system built on LPC32xx silicon with NAND flash; no public exploit has been identified and EPSS probability sits at 0.18% (7th percentile), indicating limited real-world exploitation interest.
The BPF verifier in the Linux kernel incorrectly accepts constant negative offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF pointer accesses, enabling a local attacker with BPF program loading privileges to perform out-of-bounds kernel memory reads and writes by bypassing the boundary enforcement in __check_buffer_access(). The regression was introduced when commit 022ac0750883 moved constant pointer offsets from reg->off to reg->var_off without updating the corresponding validation logic, leaving a signedness blind spot that allows programs with negative var_off values to load and attach to raw tracepoints undetected. No public exploit code has been identified at time of analysis and the vulnerability is absent from the CISA KEV catalog, but the well-documented commit trail makes independent derivation feasible for a skilled kernel researcher.
Uninitialized pointer dereference in the Linux kernel's `fwnode_init()` function exposes systems to local privilege escalation or kernel crash via a garbage `secondary` pointer in `struct fwnode_handle`. When firmware nodes are allocated on the stack or via non-zeroing heap allocators, `fwnode_init()` leaves `fwnode->secondary` containing arbitrary memory content; subsequent kernel functions such as `dev_to_swnode()` that check `IS_ERR_OR_NULL()` before dereferencing will silently proceed with the garbage pointer. Patches are confirmed available across all active stable kernel branches (5.15.x through 7.x); no public exploit code exists and this CVE is not listed in the CISA KEV catalog.
The Linux kernel's binder IPC driver contains a use-after-clear bug in binder_transaction() where lsmctx.len is re-read after security_release_secctx() has already zeroed the field via memset, causing sg_buf_end_offset to be inflated by the full aligned LSM security context size on every transaction to a txn_security_ctx binder node. This allows BINDER_TYPE_PTR scatter-gather copies to overrun into bytes already populated with the secctx data, enabling LSM security context disclosure and potential kernel buffer corruption. No public exploit or CISA KEV listing exists at time of analysis; the EPSS score of 0.17% reflects low current exploitation probability, though the low-privilege local attack vector is meaningful on Android where binder IPC is the foundational IPC mechanism.
Improper credential context in the Linux kernel's in-kernel SMB3 server (ksmbd) allows an attacker with an open SMB handle to have SET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION FSCTL operations executed under the ksmbd worker's credentials instead of the credentials captured when the file was opened. Because the underlying VFS xattr, fallocate and fileattr helpers revalidate inode permissions, ownership and LSM policy against those worker credentials rather than the SMB handle's access mask, an attacker can corrupt or zero file data and alter file attributes beyond what their handle should permit (CVSS 9.1, I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not in CISA KEV; the upstream fix is merged into stable kernels.
Use-after-free / torn-entry race in the Linux kernel's Intel VT-d IOMMU driver (iommu/vt-d) lets the hardware walk a stale scalable-mode context entry pointing at freed PASID directory memory during device_pasid_table_teardown(), producing spurious DMA faults, unpredictable IOMMU behavior, and potential memory corruption. It affects Linux 6.8.2 through the 6.x/7.x stable series on systems using Intel scalable-mode (PASID) IOMMU translation. There is no public exploit identified at time of analysis and EPSS is low (0.16%), but the vendor-released fix is available in the stable trees.
Buffer overflow and missing locking in the Linux kernel's sun4i-ss PRNG driver expose local low-privilege users on AllWinner sun4i SoC hardware to potential kernel memory corruption and privilege escalation. Two distinct flaws exist: sun4i_ss_prng_seed() lacks mutual exclusion and accepts input without bounds checking, while sun4i_ss_prng_generate() truncates output length and fails to synchronize with hardware before reading bytes, producing cryptographically unreliable output. No public exploit has been identified, EPSS sits at 0.18% (8th percentile), and the kernel maintainers resolved the issue by removing the entire dead code block rather than patching individual bugs.
Use-after-free in the Linux kernel's AF_RXRPC (rxrpc) networking subsystem lets a freed struct rxrpc_backlog be reused when kernel accept preallocation races against socket teardown. The flaw affects kernels using the rxrpc transport (notably kAFS/AFS clients) prior to the fixed stable releases; a kernel worker calling rxrpc_kernel_charge_accept() reads rx->backlog with no lock while rxrpc_discard_prealloc() concurrently NULLs and frees it, corrupting backlog head/tail pointers and array slots. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.16% (5th percentile).
NULL pointer dereference in the Linux kernel's rxrpc subsystem allows a remote unauthenticated attacker to crash the kernel, causing a denial of service. The flaw exists in rxrpc_verify_data(), which skips allocating the rx_dec_buffer when the associated skb private length is zero, while its caller rxrpc_recvmsg_data() unconditionally assumes the buffer is populated after a successful return. A crafted RxRPC network packet with zero-length payload data can trigger this path, passing a NULL pointer to skb_copy_bits() and causing a kernel panic. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is very low at 0.16% (5th percentile), consistent with a niche kernel subsystem.
Memory corruption and use-after-free in the Linux kernel's AF_RXRPC subsystem (rxrpc) let a local process trigger a double-free and connection refcount underflow by reading an out-of-band challenge message with MSG_PEEK. Because rxrpc_recvmsg_oob() guards only the unlink from recvmsg_oobq under MSG_PEEK but always moves the skb onto pending_oobq, the same singly-referenced skb becomes linked into both a list and an rbtree that share storage, corrupting linkage and freeing the skb and its connection reference twice on socket close. The NVD-assigned CVSS is 9.8, but EPSS is only 0.15% (5th percentile) and there is no public exploit identified at time of analysis; the fix is upstream in the stable trees.
Memory corruption in the Linux kernel's rxrpc networking subsystem (rxgk/GSS Kerberos security class) affects kernels from 6.16 onward, where rxgk_issue_challenge() frees the page holding challenge content before a tracepoint reads the wire header (whdr) that still points into that freed page, creating a use-after-free. The flaw is patched in stable releases 6.18.40, 7.1.5 and 7.2-rc1, and is triggerable only where the rxrpc RxGK security class is active (primarily kAFS deployments). There is no public exploit identified at time of analysis, and the EPSS score is very low at 0.15% (5th percentile), indicating negligible observed exploitation interest.
Denial of service in the Linux kernel's rxrpc subsystem allows remote, unauthenticated attackers to trigger an infinite loop in rxrpc_recvmsg() by sending packets that populate the out-of-band (OOB) queue, which the wait condition fails to check. Systems exposing RxRPC endpoints - primarily AFS (Andrew File System) clients and servers - are affected from the introducing commit through Linux 7.1.4 and 6.18.39. No public exploit exists and EPSS sits at 0.15% (5th percentile), signaling negligible real-world exploitation probability; this is not listed in CISA KEV.
Null-pointer dereference in the Linux kernel's rxrpc subsystem allows a remote unauthenticated attacker to crash the kernel by sending a forged ACKALL control packet to an exposed rxrpc service. Affected systems run Linux from commit b341a0263b1b804d329f864c2dc24815364510ec through the fixes landed in stable releases 6.18.40 and 7.1.5; Linux 6.14 is explicitly confirmed affected. No public exploit has been identified and EPSS probability is very low at 0.15%, but the network-accessible, no-authentication attack path warrants immediate patching on any system actively serving rxrpc traffic.
Kernel panic via rxrpc protocol mishandling in the Linux kernel allows a network-positioned attacker to crash an AFS client system by sending a premature reply DATA packet before any request packets have been transmitted on a client call. The flaw resides in rxrpc_receiving_reply(), which fails to verify call exposure state before invoking rxrpc_rotate_tx_window() - a function whose do...while loop oopses on an empty transmit queue. Fixes have been backported to stable branches 7.1.5 and 6.18.40; no public exploit has been identified and EPSS exploitation probability is extremely low at 0.15% (5th percentile), indicating no known active exploitation.
Denial of service (and potential memory corruption) in the Linux kernel's AF_RXRPC networking stack stems from a double unlock in rxrpc_recvmsg() triggered while handling out-of-band (OOB) messages, affecting kernels from roughly 6.16 up to the fixed 6.18.40, 7.1.5 and 7.2-rc1 releases. Releasing an already-released lock corrupts kernel lock state and can crash the host or open a race window. No public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile).
Use-after-free / stale work-item race in the Linux kernel's kAFS (Andrew File System client) network-namespace teardown path allows a use-after-free when an afs netns is destroyed. Fixed upstream (this issue was found by AI review), the flaw stems from afs_charge_preallocation() and afs_rx_new_call() failing to stop the rxrpc preallocation 'charger' work item before incoming calls are disabled during net-namespace deletion, so the charger can run against freed/torn-down state. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and it is not in CISA KEV, so this is a correctness/stability defect far below the raw CVSS 9.8 rating.
Use-after-free in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges. The flaw arises from a race between concurrent RCU readers re-arming a throttle timer and RCU-deferred deallocation of the BCM operation structure, introduced by commit f1b4e32aca08's replacement of synchronize_rcu() with call_rcu(). No active exploitation has been confirmed (not in CISA KEV) and EPSS is 0.21% (12th percentile), reflecting limited real-world risk outside CAN-enabled environments.
Lockless race condition in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows local low-privileged users to trigger torn reads of socket binding state, silently redirecting CAN traffic to unintended interfaces or leaving broken RX filter operations registered as successful. The vulnerability affects all kernel branches from Linux 2.6.25 through unpatched stable releases across the 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, and 7.1.x series. No public exploit code or CISA KEV listing exists at time of analysis; EPSS probability is 0.22% (13th percentile), consistent with the local-only attack surface and specialized CAN subsystem prerequisite.
Race conditions in the Linux kernel CAN Broadcast Manager (BCM) subsystem allow adjacent attackers on the CAN bus to corrupt kernel timer and filter state in bcm_rx_setup() by racing concurrent frame-reception handlers, with theoretical impact spanning kernel memory disclosure, corruption, and denial of service. KCSAN-detected simultaneous accesses affect all Linux kernel stable branches from 5.4 through 6.15, spanning automotive, industrial, and embedded deployments that rely on CAN BCM sockets. No public exploit has been identified and EPSS sits at 0.21% (11th percentile), indicating very low near-term exploitation probability despite the 8.8 CVSS score; vendor-released patches are available across multiple stable branches.
Missing RCU (Read-Copy-Update) list synchronization primitives in the Linux kernel's CAN BCM (Broadcast Manager) subsystem expose local low-privilege users to a race-condition memory hazard affecting all kernel stable branches from 5.4 through 6.15. Two distinct defects compound the risk: bcm_[rx|tx]_setup() uses plain list_add() instead of list_add_rcu(), allowing bcm_proc_show() to observe partially initialized bcm_op structures under rcu_read_lock(); and bcm_release() invokes bcm_remove_op() - which schedules memory reclamation via call_rcu() - without first calling list_del_rcu(), creating a use-after-free window while the op remains traversable. No public exploit code has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) indicates low current exploitation probability despite the CVSS 7.8 High rating.
Race condition and missing lock coverage in the Linux kernel CAN Broadcast Manager (BCM) subsystem expose kernel frame data and 64-bit timer values to concurrent unsynchronized access. Low-privileged local users with access to AF_CAN BCM sockets can trigger reads of partially written frame content or torn 64-bit ktime_t values - the latter specifically affecting 32-bit kernel builds - with C:H/I:H/A:H impact per the CVSS vector. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) confirms low current exploitation activity, and the vulnerability is not listed in CISA KEV.
Stale state bugs in the Linux kernel CAN Broadcast Manager (BCM) subsystem allow a local low-privileged user to trigger a runaway hrtimer loop and silently suppress CAN frame delivery following network device removal events. Affected systems span Linux 2.6.25 through unpatched stable branches, with fixes released in 6.6.148, 6.12.101, 6.18.42, 7.1.5, and 7.2-rc4. An attacker with local CAN socket access can cause indefinite bcm_tx_timeout_handler() execution and potentially inject CAN frames into a subsequently reused interface index, yielding high integrity and availability impact with no public exploit identified at time of analysis.
Race condition in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows adjacent network attackers to corrupt CAN frame state and trigger spurious RX_TIMEOUT notifications. The flaw exists in ANYDEV rx operations (ifindex == 0) where concurrent frame delivery from multiple CAN interfaces races hrtimer_cancel(), bcm_rx_starttimer(), and bcm_rx_timeout_handler() on different CPUs, leading to last_frames corruption and clobbering of shared rx_ifindex/rx_stamp fields. No public exploit has been identified at time of analysis; EPSS is 0.21% (11th percentile), indicating very low current exploitation probability.
Missing frame length validation in the Linux kernel CAN Broadcast Manager (BCM) subsystem allows a local low-privileged user to trigger kernel memory corruption by supplying a malformed RTR-reply frame via RX_SETUP with the RX_RTR_FRAME flag. While bcm_tx_setup() correctly enforces DLC bounds on TX_SETUP frames, the equivalent check was absent in bcm_rx_setup(), creating an asymmetric validation gap reachable through the CAN socket interface. The CVSS 3.1 score is 7.8 HIGH with full C/I/A impact; no public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog, but patched stable releases are available across multiple kernel branches.
Use-after-free race condition in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows a local low-privileged attacker to trigger a stale filter pointer against freed memory, with potential full CIA impact on affected systems. The flaw exists from kernel 2.6.25 onward in net/can/bcm.c, where concurrent NETDEV_UNREGISTER events could silently bypass can_rx_unregister(), leaving dangling references to freed bcm_op and socket structures. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.21% (11th percentile), indicating very low real-world exploitation probability at this time.
Use-after-free of freed executable memory in the Linux kernel's io_uring/bpf-ops subsystem allows a local attacker with CAP_BPF and CAP_PERFMON capabilities to achieve arbitrary kernel code execution by registering the same io_uring_bpf_ops struct_ops map against multiple io_ring_ctx instances in sequence. The missing re-registration guard on ops->priv causes the first io_ring_ctx to be orphaned with a dangling ctx->loop_step function pointer into a freed BPF trampoline, which is invoked when io_uring_enter() is later called on that ring. No public exploit has been identified at time of analysis, and EPSS at 0.20% reflects low near-term mass-exploitation probability, though the primitive - controlled call into freed executable memory - is a classic kernel privilege escalation building block.
BPF verifier register bounds mismatch in the Linux kernel allows local users with BPF loading capability to bypass BPF memory safety checks via crafted programs targeting LSM hook context loads. The flaw in check_mem_access() causes stale register bounds from prior instructions to corrupt the verifier's abstract interpretation, producing a divergence between the verifier's belief and runtime state that can be exploited to escape the BPF sandbox. Patches are confirmed available in stable branches (6.12.103, 6.18.40, 7.1.5, 7.2-rc1); no public exploit or CISA KEV listing exists, and EPSS is low at 0.22% (13th percentile), indicating limited observed real-world exploitation.
Use-after-free in the Linux kernel's BPF task storage subsystem allows a local low-privileged user to trigger a kernel hang or UAF condition during fork() failure. When copy_process() duplicates a task_struct via dup_task_struct, it copies the parent's bpf_storage pointer verbatim into the nascent child; if a subsequent RLIMIT_NPROC check causes the fork to abort, the cleanup path (bpf_task_storage_free → bpf_local_storage_destroy) operates on this uninitialized copied pointer rather than a valid child-owned one. No public exploit or CISA KEV listing exists at time of analysis, and EPSS is low at 0.21%, but kernel UAF conditions of this class are historically weaponizable into local privilege escalation.
Incomplete cleanup in the Linux kernel's sparx5 Ethernet switch driver leaves a switchdev blocking notifier registered when workqueue allocation fails during initialization, creating a dangling callback that subsequent kernel network events can invoke against uninitialized driver state - enabling potential kernel memory corruption or privilege escalation on affected hardware. Systems running kernels from 5.14 through the unpatched stable branches on Microchip Sparx5 switch ASICs are affected; patches have been backported to five stable kernel series. No public exploit code exists and EPSS probability is 0.21% (12th percentile), though kernel-level C:H/I:H/A:H impact warrants prompt patching on any affected networking appliance.
Metadata snapshot operations in the Linux kernel's device-mapper thin provisioning (dm-thin) subsystem write a partially-updated superblock field to disk when a metadata commit subsequently fails, corrupting the on-disk space map reference counts. Systems using dm-thin storage pools are affected across a wide range of stable kernel branches from 3.2 onward through patched versions. A local attacker with access to dm-thin pool management can deliberately trigger the failure path - for example by constraining the metadata device - causing persistent metadata inconsistency that survives reboots and results in data loss or pool unavailability. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis.
Out-of-bounds memory access in the Linux kernel dm-era (device mapper era) subsystem allows a local privileged attacker to trigger a vmalloc out-of-bounds read by configuring a dm-era table with a non-zero start sector. The era_map() function fails to apply the target offset before calculating the writeset block, passing an absolute block number to writeset_marked() that may exceed the allocated bitset size. No public exploit exists and EPSS probability is 0.22%, but patches are backported across all major stable kernel branches. The provided CVSS score of 8.8 (AV:N/PR:L) materially overstates real-world risk for a flaw requiring CAP_SYS_ADMIN and a specifically misconfigured dm-era table.
Integer wraparound in the Linux kernel's dm-log subsystem on 32-bit architectures allows a local attacker to trigger a bitset_size overflow, potentially causing kernel memory corruption. Specifically, when region_size is close to UINT_MAX and bitset_size is rounded up to a multiple of BITS_PER_LONG, a 32-bit size_t wraps around to zero, leading to an incorrect zero-byte bitmap allocation and subsequent out-of-bounds write conditions. No public exploit is identified at time of analysis, and EPSS probability is low (0.22%, percentile 13%), but the CVSS 7.8 local score reflects the potential for full system compromise once the specific conditions are met.
The Linux kernel dm (device-mapper) subsystem, from version 6.9 onward, leaks the calling process's thread keyring by retaining a reference to the table device file beyond the caller's lifetime, causing LUKS volume keys to silently persist in RAM after `cryptsetup luksSuspend`. This regression, introduced by commit a28d893eb327, breaks a documented security guarantee: `luksSuspend` is expected to wipe the volume key from memory, but an unpatched kernel leaves a second copy in the retained thread keyring recoverable until `luksClose`. Any adversary capable of reading kernel memory - via physical access, cold boot attack, or a separate memory disclosure exploit - can extract the LUKS volume key and decrypt the protected volume. No public exploit is identified, and EPSS of 0.21% (11th percentile) reflects limited automated exploitation probability.
Double-free memory corruption in the Linux kernel's device mapper subsystem allows a local attacker to trigger kernel memory corruption by causing dm_resume failure during early device creation, potentially leading to privilege escalation or system crash. Affected systems run kernel versions from approximately Linux 5.1 through multiple stable branches prior to the respective patch commits; fixes are available across all major stable series from 5.10 through 7.2-rc3. No public exploit code exists and EPSS exploitation probability is extremely low at 0.22% (13th percentile), though the high CVSS impact metrics (C:H/I:H/A:H) reflect the potential severity if the error path is successfully triggered and weaponized.
Deadlock in the Linux kernel's dm-integrity device mapper module allows a local attacker or process with block-device access to permanently freeze I/O on an integrity-protected block device. When dm_integrity_check_limits detects an out-of-bounds bio and returns failure, it exits with DM_MAPIO_KILL while leaving an internal range lock held, so all subsequent I/O operations block indefinitely waiting for a lock that will never be released. No public exploit identified at time of analysis; EPSS is 0.21% at the 11th percentile, consistent with a locally-triggered kernel availability flaw requiring a non-default configuration.
Integrity bypass in the Linux kernel dm-integrity device mapper subsystem allows low-privileged users to undermine block-level data integrity guarantees through a double-increment logic error in hash_offset tracking. The introduced commit 84597a44a9d86ac949900441cea7da0af0f2f473 (present since Linux 5.7) causes the hash_offset variable to advance by two positions per iteration instead of one, meaning integrity hashes are verified against incorrect offsets - allowing corrupted data to pass or valid data to fail integrity checks. No public exploit identified at time of analysis, and EPSS at 0.21% (11th percentile) reflects low near-term exploitation probability.
An out-of-bounds kernel write in the Linux kernel's dm-verity Forward Error Correction (FEC) code allows corruption of adjacent kernel memory when Reed-Solomon erasure recovery is triggered. An off-by-one in the erasure-counting logic lets the erasure count reach roots+1, which is then passed to decode_rs8() and overruns the lambda[] locator polynomial by one element, clobbering the syndrome buffer (syn[0]). It affects Linux systems using dm-verity with FEC enabled; there is no CISA KEV listing, no public exploit identified, and EPSS is low (0.22%, 13th percentile), indicating this is a memory-safety defect rather than an actively exploited threat.
Uninitialized memory dereference in the Linux kernel's dma-fence subsystem allows a local low-privileged user on AMD GPU-equipped systems to trigger memory corruption via the amdgpu userqueue wait path. The root cause is an off-by-one logic error in `dma_fence_dedup_array()` that returns 1 instead of 0 for empty input, which the primary caller guards against but `amdgpu_userq_wait_*()` does not, exposing an uninitialized fence slot to dereference. Patch commits are available for stable branches 6.18.40 and 7.1.5; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), indicating low real-world exploitation activity.
Use-after-free in the Linux kernel's amdxdna DMA buffer memory mapping function exposes systems with AMD XDna AI accelerator hardware to local privilege escalation. When vm_insert_pages() fails inside amdxdna_gem_dmabuf_mmap(), the error path triggers drm_gem_object_put() twice on the same GEM object - once through the VMA close handler and again through the fall-through put_obj label - freeing the object and then accessing freed memory. EPSS sits at 0.21% (11th percentile) and the vulnerability is not listed in CISA KEV, indicating no known active exploitation; however, the CVSS 7.8 high score reflects the full C/H/I:H/A:H kernel memory corruption potential if successfully triggered locally.
Client pointer confusion in the Linux kernel's amdxdna DRM accelerator driver allows a local low-privileged user to trigger cross-process access to another process's hardware context and debug buffer objects via a misrouted SYNC_DIRECT_FROM_DEVICE ioctl. Systems running AMD XDNA NPU hardware (such as AMD Ryzen AI series processors) with the amdxdna kernel module loaded are affected across kernel versions from the driver's introduction up to the patched releases in 7.1.5 and 7.2-rc1. No public exploit exists and the EPSS score of 0.20% (10th percentile) reflects low near-term exploitation probability, though the CVSS 7.8 score correctly captures the high CIA impact should exploitation succeed.
Integer underflow in the Linux kernel's Intel VPU accelerator driver (accel/ivpu) allows a local low-privileged attacker to trigger out-of-bounds kernel memory reads and infinite loops via a malformed firmware log buffer. The vulnerability exists because fw_log_from_bo() never validates that log->size is at least log->header_size before fw_log_print_buffer() computes data_size = log->size - log->header_size - a u32 subtraction that wraps to near-U32_MAX, defeating the bounds checks from commit dd1311bcf0e6 and enabling fw_log_print_lines() to read far past the allocated BO region. No active exploitation is confirmed (not in CISA KEV), and EPSS is 0.21% (11th percentile), indicating low near-term exploitation likelihood despite the 7.1 CVSS score.
Denial of service in the Linux kernel's Xen paravirtualized SCSI backend (xen-scsiback) lets a malicious pvSCSI guest exhaust every command tag of a target LUN's session by driving the pre-submission error paths, which call transport_generic_free_cmd() on an se_cmd whose cmd_kref is still 0. The resulting refcount underflow is a use-after-free that leaks the tag and stops the LUN; on hosts booted with panic_on_warn it crashes the host outright. There is no public exploit identified at time of analysis and EPSS is low (0.21%), but the fix is shipped across multiple stable kernel trees.
Kernel out-of-bounds read in the Linux SCSI target (LIO/TCM) subsystem lets a SCSI initiator crash the host by sending a malformed PERSISTENT RESERVE OUT command. The iSCSI TransportID parser (target_parse_pr_out_transport_id / iscsi_parse_pr_out_transport_id) scans for the ',i,0x' ISID separator with an unbounded strstr(), so a TransportID whose iSCSI name has no separator and no NUL terminator runs the scan off the end of a multi-page vmap buffer into the vmalloc guard page, oopsing the kernel (KASAN: vmalloc-out-of-bounds). It is reachable by any fabric delivering PR OUT to an iSCSI-exported device, including a guest via vhost-scsi. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and it is not in CISA KEV.
Use-after-free in the Linux kernel's LIO SCSI target core (iSCSI transport) lets an initiator that can issue a PERSISTENT RESERVE OUT / REGISTER AND MOVE command trigger reads of an unmapped kernel virtual address, risking information disclosure or a kernel crash. The flaw exists only in the target-mode stack (drivers/target) and only manifests when the PR OUT parameter list exceeds one page (>4096 bytes), forcing transport_kmap_data_sg() down its vmap()/vunmap() path. EPSS is low (0.22%, 13th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
Use-after-free in the Linux kernel's resctrl filesystem subsystem allows a local low-privileged user to dereference freed kernel memory during a race between a concurrent monitoring file reader and resctrl unmount or fatal teardown. The vulnerable code path affects multiple stable kernel series, with fixes confirmed in 6.18.42, 7.1.5, and 7.2-rc3. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% reflects low current exploitation probability, though kernel use-after-free primitives are commonly developed into local privilege escalation exploits.
Use-after-free and initialization-order race conditions in the Linux kernel's mlx5e MACsec hardware offload driver allow a local low-privileged user to corrupt kernel memory during RX Security Channel deletion. The delete path in macsec_del_rxsc_ctx() called metadata_dst_free() unconditionally, bypassing reference counting, while concurrent RX datapath readers operating under rcu_read_lock() could still hold and dereference the freed dst object. A secondary race in the add path published the SC's xarray entry before md_dst was fully initialized, allowing readers to observe NULL or partially-constructed pointers. Patches are available across multiple stable branches (6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2-rc2); no public exploit has been identified at time of analysis.
Use-after-free race condition in the Linux kernel's tracing/user_events subsystem allows a low-privileged local user to corrupt kernel heap memory during fork(), potentially enabling privilege escalation to root. The race is triggered when a multithreaded process concurrently unregisters a user event enabler while calling fork(), causing user_event_mm_dup() to dereference enabler and user_event structures freed without observing the required RCU grace period. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, the low privilege bar and full C/I/A impact make it a meaningful escalation primitive on any multi-user or shared Linux system running an unpatched kernel with CONFIG_USER_EVENTS enabled.
Local privilege escalation / memory corruption in the Linux kernel's PREEMPT_RT locking substitution stems from rt_spin_unlock() (and the rwlock substitution) releasing RCU read-side protection before completing the unlock, creating a use-after-free window where an object freed via kfree_rcu() can be accessed by rt_mutex_cmpxchg_release(). Only PREEMPT_RT (real-time) kernel builds are affected, since regular spinlocks keep preemption disabled across unlock and thus retain full RCU protection. The upstream fix has been merged and backported to multiple stable trees; no public exploit identified at time of analysis, and EPSS is low (0.21%).
Error-masking in the Linux kernel CPU hotplug subsystem allows a failed CPU state transition to silently appear successful to callers, spanning stable branches from 4.14 through 7.1.x. The root cause is that cpuhp_invoke_callback() reuses the ret variable in its rollback path: when one instance callback fails and the subsequent rollback succeeds, the rollback's zero return overwrites the original non-zero error, hiding the failure from higher-level consumers. No active exploitation is confirmed - EPSS sits at 0.22% (13th percentile) and there is no CISA KEV listing - but patches are available across all affected stable branches.
Unbounded sprintf() calls in the Linux kernel's CPU hotplug sysfs interface (states_show()) can overflow the PAGE_SIZE kernel buffer when a sufficient number of hotplug states are registered, enabling a local low-privileged user to corrupt adjacent kernel memory with potential high impact on confidentiality, integrity, and availability. Affected kernel versions span from the 4.6 era through multiple current stable branches (5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x), each with vendor-released patch versions confirmed by ENISA EUVD-2026-59024. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), indicating limited real-world exploitation probability despite the 7.8 CVSS score.
Out-of-bounds memory access in the Linux kernel MANA (Microsoft Azure Network Adapter) Ethernet driver arises because the RX completion queue entry (CQE) packet length reported by the NIC was passed to skb processing without validation. Affected systems are Linux VMs running the mana_en driver, predominantly Azure guests using MANA/SR-IOV networking. A NIC (or malicious hypervisor/device) supplying a crafted oversized length can trigger an out-of-bounds read leading to information disclosure or a kernel crash; the vulnerability is tagged Information Disclosure, has no public exploit identified at time of analysis, and carries a low EPSS of 0.21%.
Missing DMA sync-for-CPU in the Linux kernel's MANA (Microsoft Azure Network Adapter) RX path can hand stale or uninitialized buffer memory to the networking stack on systems that require explicit DMA syncing, such as those booted with swiotlb=force. The flaw affects the mana Ethernet driver when RX buffers come from page-pool fragments (frag_count > 1), where the DMA unmap that normally performs the implicit CPU sync is skipped. There is no public exploit identified at time of analysis, EPSS is low (0.20%), and it is not listed in CISA KEV.
Cross-namespace privilege escalation in the Linux kernel SIT (IPv6-in-IPv4) tunnel driver allows a local attacker with CAP_NET_ADMIN in one network namespace to rewrite SIT tunnel configuration belonging to a distinct, more privileged network namespace, bypassing the intended authorization boundary. This is particularly impactful in containerized environments where network namespace isolation is a primary security boundary, as tenant containers are commonly granted CAP_NET_ADMIN within their own namespace. Patches are confirmed available across all active stable kernel branches (5.10 through 7.x); no public exploit or CISA KEV entry exists at time of analysis, and EPSS is 0.22%, reflecting very low observed exploitation activity.
Metadata corruption in the Linux kernel traffic control connection-tracking action (act_ct) allows remote attackers to crash systems or corrupt qdisc packet-segment state by sending fragmented IP or IPv6 traffic. The flaw exists because tcf_ct_handle_fragments() invokes nf_ct_handle_fragments() without preserving skb->cb, so the netfilter defragmentation helper silently overwrites tc_skb_cb/qdisc_skb_cb in-place - the same memory region. On hosts with panic_on_warn enabled, this triggers a WARN_ON_ONCE in qdisc_pkt_segs() that escalates to a kernel panic. EPSS is low (0.21%, 11th percentile) and the vulnerability is not in CISA KEV, indicating opportunistic exploitation is unlikely but targeted denial-of-service against network appliances or container hosts using tc act_ct is realistic.
Privilege boundary bypass in the Linux kernel's ip6_vti (IPv6 Virtual Tunnel Interface) subsystem allows a local user with CAP_NET_ADMIN in one network namespace to reconfigure VTI6 tunnels residing in a separate, unprivileged network namespace. The rtnl changelink path validates CAP_NET_ADMIN only against dev_net(dev), leaving t->net unchecked when the device spans namespaces - enabling unauthorized rewrites of cross-namespace tunnel configurations with full confidentiality, integrity, and availability impact on the affected namespace. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (12th percentile) reflects low current exploitation probability, though the capability misuse pattern is well-understood in container-escape research.
Privilege escalation in the Linux kernel's IP VTI (Virtual Tunnel Interface) subsystem allows a local attacker holding CAP_NET_ADMIN in one network namespace to reconfigure VTI tunnel endpoints anchored in a separate, more privileged network namespace they do not control. Affected kernel versions span from approximately 3.15 through all stable branches prior to 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code has been identified and no CISA KEV listing exists, but the scope-changed CVSS rating (8.8) reflects real cross-namespace boundary violation risk relevant to container and VNF deployments.
Cross-namespace capability bypass in the Linux kernel's IPIP (IP-in-IP) tunnel driver allows a local process holding CAP_NET_ADMIN within one network namespace to modify IPIP tunnel parameters governed by a separate, more privileged network namespace. By exploiting the missing rtnl_dev_link_net_capable() check in ipip_changelink(), an attacker can redirect or disrupt encapsulated tunnel traffic across namespace boundaries - a meaningful concern in containerized environments where namespace separation is a security boundary. No public exploit code or CISA KEV listing has been identified; EPSS stands at 0.21% (11th percentile), indicating low current exploitation probability despite the high CVSS score of 8.8.
IPv6 GRE tunnel management in the Linux kernel allows a local attacker holding CAP_NET_ADMIN in one network namespace to modify tunnel configurations residing in a separate, unauthorized namespace - effectively escalating privilege across namespace security boundaries. Affected kernels span multiple long-term support trees from at least 4.19.100 onward, with patches released across stable series including 6.12.97, 6.6.145, 6.1.178, 6.18.40, 5.10.261, 5.15.212, and 7.1.5. No public exploit code has been identified at time of analysis; EPSS exploitation probability stands at 0.21% (12th percentile), indicating limited current attacker interest despite the high CVSS score.
Insufficient capability gating in the Linux kernel's IPv6 tunnel subsystem allows a local attacker with CAP_NET_ADMIN in one network namespace to reconfigure tunnel devices residing in a separate, more privileged namespace. Affected versions span from Linux 3.12 through all stable branches prior to 6.6.148, 6.12.101, 6.18.40, and 7.1.5, with the CVSS Scope:Changed metric confirming cross-namespace impact. This vulnerability is not listed in CISA KEV and carries an EPSS score of 0.20% (10th percentile), indicating limited observed exploitation at time of analysis; however, it is a meaningful privilege escalation primitive in containerized deployments where CAP_NET_ADMIN is routinely granted.
Raw AES-128 LLSEC key exposure in the Linux kernel's legacy ieee802154 netlink family allows any local user to extract 16-byte cryptographic key material directly from the kernel keytable on systems running IEEE 802.15.4 (wpan) interfaces with link-layer security configured. Because IEEE 802.15.4 LLSEC uses CCM* mode where the same key both encrypts frames and provides message authentication, key disclosure simultaneously breaks confidentiality and authenticity of the entire 802.15.4 wireless network. No confirmed active exploitation and no public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), consistent with the niche hardware requirement.
Header buffer corruption in the Linux kernel gve (Google Virtual Ethernet) driver's DQO RX datapath lets header bytes from one packet be copied onto another, and lets header buffers be re-posted while the device still owns them, when both header-split and HW-GRO are enabled with many concurrent flows. The gve driver is used by Google Cloud Platform Linux VMs, so exposure is limited to GCP guests running affected kernels with that specific offload configuration. There is no public exploit identified at time of analysis, EPSS is very low (0.20%), and the observed effect is roughly a 30% throughput drop with heavy TCP retransmissions rather than code execution.
Cross-VF/PF LMTLINE physical address disclosure in the Linux kernel's octeontx2-af CN10K driver allows a low-privileged VF caller to read another PF's LMTLINE physical base address and map it into its own LMT table entry. Affected are Linux kernel trees from commit 893ae97214c3 across stable branches 6.6.x before 6.6.148, 6.12.x before 6.12.101, 6.18.x before 6.18.42, and mainline before 7.1.5/7.2-rc1. No public exploit code or CISA KEV listing exists at time of analysis; the EPSS score of 0.20% (10th percentile) indicates low exploitation probability, consistent with the hardware-specific attack surface.
Data corruption in the Linux kernel's LoongArch memory management subsystem allows a local low-privileged user to cause silent loss of written data or potential exposure of stale page contents via a race condition between hardware page table walker behavior and software dirty-bit tracking. Affected systems are those running LoongArch CPUs with hardware PTW enabled - a condition that applies to the architecture by design - across kernel versions from 5.19 through stable branches prior to 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code exists and EPSS stands at 0.21% (11th percentile), though the bug was reliably reproduced via the LTP madvise09 test, confirming it is not theoretical.
Reference count underflow in the Linux kernel IPMI subsystem's handle_read_event_rsp() function enables local privilege escalation on server hardware with active IPMI interfaces. The flaw resides in the error-rollback path: when event delivery fails after successfully allocating receive messages for some users, the rollback incorrectly drops the user reference count twice - once through ipmi_free_recv_msg() and again through a now-stale explicit put - freeing an ipmi_user object that remains linked on intf->users. Subsequent event delivery then dereferences the freed object or trips refcount_t's addition-on-zero guard, enabling kernel memory corruption leading to full system compromise. No public exploit or CISA KEV listing exists; EPSS is 0.20% at the 10th percentile, consistent with no active exploitation at time of analysis.
Memory-accounting corruption in the Linux kernel's espintcp (ESP-in-TCP / IPsec RFC 8229) send path was resolved by switching to sk_msg_free_partial(), which keeps the socket message (skmsg) consistent on partial sends. On affected kernels the previous code mishandled uncharges and offsets when the full payload was not transmitted, corrupting skmsg accounting on a system where TCP encapsulation of IPsec is in use. This is a stable-tree fix carrying an NVD CVSS of 9.8 and the 'Information Disclosure' tag, but EPSS is only 0.20% (10th percentile) and no public exploit is identified at time of analysis.
Kernel panic via NULL pointer dereference in the Linux kernel's multiq traffic scheduler (net/sched/sch_multiq) affects all kernels from 2.6.29 through unpatched stable trees. When multiq pairs with a non-work-conserving child qdisc (such as qfq) routed through a peeking intermediary (such as tbf), multiq_dequeue() invokes the child's raw ->dequeue() method directly instead of qdisc_dequeue_peeked(), orphaning the stash, corrupting qlen/backlog accounting, and triggering a NULL dereference in softirq context during ordinary egress. Exploitation requires local access with CAP_NET_ADMIN and a deliberately constructed qdisc hierarchy; no public exploit code exists and EPSS probability is 0.21% (12th percentile), consistent with the niche configuration requirement.
Kernel panic via NULL pointer dereference in Linux's taprio traffic scheduler (net/sched/sch_taprio) delivers system-level denial of service when a non-work-conserving child qdisc such as qfq is attached to a taprio parent. The defect in taprio_dequeue_from_txq() calls the child's ->dequeue() function pointer directly rather than via qdisc_dequeue_peeked(), bypassing the child's gso_skb stash, orphaning the peeked skb, desyncing qlen/backlog counters, and re-entering the child on an emptied list - triggering a NULL dereference from softirq context during ordinary egress traffic. No public exploit has been identified at time of analysis, and EPSS stands at 0.20% (10th percentile), indicating very low opportunistic exploitation probability; the vulnerability is not listed in CISA KEV.
Null pointer dereference in the Linux kernel's fhandle subsystem allows a local low-privileged user to trigger a kernel panic via a race condition in capable_wrt_mount(). The vulnerable path is reached when open_by_handle_at() processes a file handle whose detached mount - created via open_tree(OPEN_TREE_CLONE) - is concurrently dissolved by fput(), causing umount_tree() to clear mount->mnt_ns to NULL before capable_wrt_mount() can safely dereference mnt_ns->user_ns. No public exploit identified at time of analysis (EPSS 0.20%, no CISA KEV listing), and patched kernel versions 6.12.97, 6.18.40, 7.1.5, and 7.2-rc2 are available from upstream stable trees.
Kernel memory disclosure and denial-of-service in the Linux kernel OrangeFS client affects systems mounting OrangeFS parallel filesystems, where fill_from_part() truncates a 64-bit directory-entry length into a __u32. An entry length near U32_MAX wraps to a small value that slips past the bounds check and is then used to index the directory part, causing an out-of-bounds read that oopses the kernel. The malformed trailer is supplied by the userspace OrangeFS client, and there is no public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and this is not in CISA KEV. Note: the input CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) conflicts with the description, which describes a local, client-supplied-data OOB read rather than remote unauthenticated code execution.
Out-of-bounds memory read and infinite-loop denial of service in the Linux kernel's iosm WWAN driver (net/wwan/iosm) allow a rogue or compromised modem to corrupt kernel memory and exhaust system resources by supplying crafted MUX downlink packets with malicious offsets and circular table references. Affected systems are those running Linux 5.18 and later with Intel WWAN hardware using the iosm driver, where the mux_dl_adb_decode() function failed to validate any of the device-supplied offsets and lengths (first_table_index, next_table_index, table_length, datagram_index, datagram_length) against the received socket buffer boundary. No public exploit exists and EPSS probability is very low at 0.21% (12th percentile); however, the CVSS 8.8 rating with Full C/I/A impact and reproduction confirmed under KASAN make this a credible risk for cellular-enabled Linux deployments awaiting patch application.
Memory corruption in the Linux kernel's compaction subsystem allows a local low-privileged attacker to trigger data corruption or potential privilege escalation by exploiting improper error handling in compaction_free(). The function ignores failure returns from free_pages_prepare(), causing hardware-poisoned pages (PageHWPoison) or bad pages (free_page_is_bad()) to be re-added to the compaction freepages list and subsequently reallocated to kernel or user structures. Exploitation requires low-privilege local access and is not confirmed actively exploited (absent from CISA KEV), with EPSS at a low 0.21% (11th percentile); vendor-released patches are available across multiple stable branches.
Race condition in the Linux kernel mac802154 subsystem allows a local low-privileged attacker to trigger kernel memory corruption by racing hardware teardown against an in-flight asynchronous transmit completion. Affected systems are those running IEEE 802.15.4 wireless networking hardware with the mac802154 module loaded; versions from Linux 3.19 through the respective stable-branch fix commits are vulnerable. No public exploit identified at time of analysis, and EPSS of 0.21% (12th percentile) reflects negligible observed exploitation activity; vendor patches have been released across all active stable kernel branches.
IPVS (IP Virtual Server) SCTP state tracking in the Linux kernel misreads chunk headers for IPv6 packets carrying extension headers, causing incorrect connection state transitions that affect load balancer behavior and resource accounting. The IPVS subsystem, widely deployed in Kubernetes and LVS environments via kube-proxy, can misclassify an SCTP INIT packet as an already-ESTABLISHED connection when the IPv6 packet includes extension headers (e.g., an 8-byte Destination Options header), because set_sctp_state() hardcodes sizeof(struct ipv6hdr) as the transport offset rather than using the offset already resolved by ipv6_find_hdr(). No public exploit identified at time of analysis, and EPSS at 0.21% (12th percentile) confirms very low current exploitation interest despite the CVSS 8.2 score.
Information disclosure and TCP flow corruption in the Linux kernel's IPVS (IP Virtual Server) load balancer arises because ip_vs_conn_new() only zeroes the delta fields of its two ip_vs_seq structures, leaving init_seq and previous_delta filled with stale slab data. A director acting as a connection-sync backup can hash a connection with IP_VS_CONN_F_IN_SEQ/OUT_SEQ flags set (inherited from IP_VS_CONN_F_BACKUP_MASK) while an attacker-supplied sync message omits IPVS_OPT_SEQ_DATA, so an IPVS application helper later rewrites forwarded TCP sequence/ack numbers using uninitialized kernel memory. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and the issue is not in CISA KEV.
Heap out-of-bounds read in the Linux kernel MACsec subsystem (`macsec_encrypt()`) allows a local attacker with CAP_NET_RAW capability to leak 12 bytes of kernel heap memory and emit that raw heap content onto the wire as a malformed Ethernet frame, with additional potential for kernel destabilization. The flaw is triggered exclusively via the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path, where the socket buffer arrives at `macsec_start_xmit()` with `skb->mac_header` unset, resolving `eth_hdr(skb)` to `skb->head + 65535` - far outside valid headroom. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (12th percentile) reflects low exploitation probability; patches have been backported across all active stable kernel series.
Out-of-bounds write in the Linux kernel's dibs loopback subsystem enables a local low-privileged attacker to corrupt kernel memory by supplying a crafted offset or oversized write through the move_data() interface, which calls memcpy() without verifying that offset + size stays within the registered DMB's allocated length. The software loopback omits the memory-region bounds enforcement that real ISM hardware provides natively, leaving peer-supplied parameters unchecked. Patch commits are confirmed across four stable kernel branches (6.12.97, 6.18.40, 7.1.5, 7.2-rc3); the vulnerability is not in CISA KEV and no public exploit code has been identified at time of analysis.
Kernel memory corruption in the Linux kernel's DRBD (Distributed Replicated Block Device) driver lets a malicious or man-in-the-middle replication peer write attacker-chosen bytes past a bio page in a receiving node. The flaw lives in recv_dless_read(), where a peer-supplied payload length is handled as a signed int (data_size) that can be driven negative, and it affects any node that reads from its peer - a diskless node or one using read-balancing - in the default configuration. Rated CVSS 9.8 by NVD; there is no public exploit identified at time of analysis and EPSS probability is low (0.20%).
Use-after-free race condition in the Linux kernel's osnoise tracing subsystem allows a local low-privileged attacker to potentially escalate privileges or destabilize the kernel. The flaw, present in kernels since commit a6ed2aee (Linux 5.17), stems from missing synchronize_rcu() synchronization during osnoise instance unregistration, leaving a window where RCU readers can dereference freed tracer memory. Patched stable releases (6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2-rc3) are available; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Shared MIPI PHY resource mismanagement in the Linux kernel's NXP i.MX93 block-control power domain driver (imx93-blk-ctrl) allows a local attacker with low privileges to trigger kernel-level incorrect behavior - including potential memory corruption, information disclosure, and system instability - by exploiting the fact that the DSI and CSI subdomains share clock and reset control bits without coordination. Patches are available across stable branches (6.18.42, 7.1.5, 7.2-rc4), and exploitation probability is low per EPSS (0.20%, 10th percentile). No public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Linux kernel's rt2x00 WiFi driver stems from improper error handling during device probe, where early allocation failures invoke a full teardown path that assumes work items (intf_work, autowakeup_work, sleep_work) are already initialized. On systems with Ralink/MediaTek rt2x00-compatible WiFi hardware, a local low-privileged attacker who can trigger workqueue allocation failure during driver probe can corrupt uninitialized kernel work_struct objects, as confirmed by DEBUG_OBJECTS reporting invalid work drains. EPSS is low (0.21%, 12th percentile) and this is not listed in CISA KEV, though a QEMU-based proof-of-concept demonstrating the failure path was confirmed by the reporters.
Heap overflow in the Linux kernel brcmfmac/cyw WiFi driver allows a network-adjacent attacker controlling a rogue or compromised access point to corrupt kernel heap memory during WPA3 SAE authentication. The flaw in `brcmf_notify_auth_frame_rx()` causes an unsigned integer underflow when a short auth frame (under 24 bytes) is received, producing a wrap-around copy length that drives `memcpy` far beyond the allocated buffer. With CVSS 8.8 and full C/H/I/H/A/H impact on the vulnerable system, exploitation yields arbitrary kernel memory write capability; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (12th percentile), indicating low observed exploitation pressure despite the critical technical severity.
Integer underflow and overflow flaws in the Linux kernel's Realtek Bluetooth driver (btrtl) corrupt kernel memory during firmware loading, enabling a local attacker with low privileges to achieve full kernel-level compromise. The vulnerability exists in rtlbt_parse_firmware(), where a malformed firmware patch with a length field smaller than 4 causes a subtraction underflow that transforms a subsequent memcpy into an oversized kernel memory write; a separate addition overflow on 32-bit architectures compounds the exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), consistent with the local-only attack vector.
Incorrect IPv6 transport-header offset handling in the Linux kernel's IPVS (IP Virtual Server) load-balancing subsystem causes application-layer helper code and ICMPv6 checksum validation to misread packet headers when IPv6 traffic - particularly packets carrying extension headers - is processed. The IPVS TCP application path wrongly assumed an IPv4 network header even after the ipvsh offset argument was supplied, and ip_vs_out_icmp_v6() used an incorrect ICMPv6 offset. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and this is not on CISA KEV, and for the only in-tree app (FTP) the maintainers note the effect is harmless because port mangling is handled by Netfilter without TCP sequence adjustment.
Memory-safety defect in the Linux kernel IPVS (IP Virtual Server) subsystem where __ip_vs_get_out_rt() calls skb_ensure_writable(), which can reallocate skb->head, leaving a stale IP-header pointer that is then dereferenced. Affected hosts are Linux systems acting as IPVS load balancers/directors; the flaw can lead to reads of freed/relocated packet memory (information disclosure) or kernel instability. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile); the upstream fix reloads the IP header after reallocation.
Out-of-bounds memory access in the Linux kernel's spufs (SPU filesystem) subsystem on PowerPC Cell Broadband Engine architectures allows a local low-privileged user to read or write beyond the SPU local store buffer via a flawed bounds check in `spufs_mem_mmap_access()`. The function computes the mmap offset correctly but validates it against `vma->vm_end` rather than `LS_SIZE`, causing the guard to never fire on 64-bit systems and leaving the length parameter unconstrained relative to the actual local store buffer. Vendor-released patches are confirmed across multiple stable kernel branches; no public exploit has been identified and EPSS is 0.21% at the 12th percentile.
PowerPC E500 systems running Linux kernel 7.0 through 7.1.4 and 7.2-rc4 silently lose kernel address-masking protection due to a compile-time preprocessor symbol typo - `CONFIG_E500` instead of `CONFIG_PPC_E500` - causing `mask_user_address_isel()` to be omitted from E500 builds entirely. A local low-privileged user on affected E500 hardware can exploit the absent address-masking primitive to achieve high-impact memory disclosure, integrity corruption, or denial of service against the kernel. No public exploit exists, EPSS is 0.19% (9th percentile), and this vulnerability is not in CISA KEV, indicating very limited current exploitation activity despite a CVSS score of 7.8.
Out-of-bounds read in the Linux kernel cfg80211 WiFi subsystem allows an adjacent-network unauthenticated attacker to disclose kernel memory or crash the system by sending a crafted EHT Multi-Link Element inside an MBSSID beacon frame. Affected kernels fail to call ieee80211_mle_type_ok() before passing the element to ieee80211_mle_get_mld_id(), violating the helper's documented contract and allowing reads past the IE boundary. No public exploit exists and EPSS is 0.20% (10th percentile), but the attack requires only radio proximity to a device with Wi-Fi scanning active - no authentication and no user interaction needed.
Insufficient Multi-Link Element (MLE) common info length validation in the Linux kernel's IEEE 802.11 WiFi stack exposes adjacent-network attackers to high-impact memory corruption. Kernels from commit 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 onward failed to validate the advertised common-info length field for Reconfiguration and Priority Access MLE types - and also omitted the length octet when computing the minimum common size for Reconfiguration MLEs - meaning a malformed MLE frame crafted by a nearby attacker can trigger out-of-bounds access. The CVSS score of 8.8 (AV:A) and EPSS of 0.20% (10th percentile) together indicate high potential impact but no public exploit activity at time of analysis; no public exploit and no CISA KEV listing have been identified.
Remote kernel memory corruption in the Linux mac80211 WiFi subsystem allows an unauthenticated attacker within WiFi range to trigger out-of-bounds memory accesses by sending crafted 802.11 extension frames that bypass subtype validation and reach generic RX path code expecting regular 802.11 header layouts. Affected systems include any Linux host with an active mac80211-based WiFi driver across a broad range of kernel versions spanning 5.10 through pre-patch 7.x releases. The CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact at the kernel level; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Wrong MTD geometry is applied in the Linux kernel's mchp23k256 SPI SRAM driver when the chip is matched via the SPI id-table rather than via Device Tree, potentially exposing or corrupting unintended SRAM address regions. The driver's probe function calls of_device_get_match_data() exclusively, causing any non-OF SPI modalias match to silently fall back to the default mchp23k256_caps structure regardless of which part was actually selected by the SPI id-table, leading to incorrect chip capacity and address geometry. No public exploit exists and EPSS places this at the 7th percentile (0.17%), but the C:H/I:H/A:H CVSS impact flags reflect that incorrect geometry can expose the entire SRAM contents or allow out-of-bounds writes on affected embedded systems.
Kernel memory corruption in the Linux MTD raw NAND driver for NXP LPC32xx SLC hardware arises because lpc32xx_xmit_dma() silently discards the return value of wait_for_completion_timeout(), treating an expired DMA transfer as successful. The timed-out DMA engine can continue accessing a scatterlist buffer after it has been unmapped and potentially reused by the NAND read/write path, creating a use-after-free condition in kernel space. Exploitation requires local access to an embedded Linux system built on LPC32xx silicon with NAND flash; no public exploit has been identified and EPSS probability sits at 0.18% (7th percentile), indicating limited real-world exploitation interest.
The BPF verifier in the Linux kernel incorrectly accepts constant negative offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF pointer accesses, enabling a local attacker with BPF program loading privileges to perform out-of-bounds kernel memory reads and writes by bypassing the boundary enforcement in __check_buffer_access(). The regression was introduced when commit 022ac0750883 moved constant pointer offsets from reg->off to reg->var_off without updating the corresponding validation logic, leaving a signedness blind spot that allows programs with negative var_off values to load and attach to raw tracepoints undetected. No public exploit code has been identified at time of analysis and the vulnerability is absent from the CISA KEV catalog, but the well-documented commit trail makes independent derivation feasible for a skilled kernel researcher.
Uninitialized pointer dereference in the Linux kernel's `fwnode_init()` function exposes systems to local privilege escalation or kernel crash via a garbage `secondary` pointer in `struct fwnode_handle`. When firmware nodes are allocated on the stack or via non-zeroing heap allocators, `fwnode_init()` leaves `fwnode->secondary` containing arbitrary memory content; subsequent kernel functions such as `dev_to_swnode()` that check `IS_ERR_OR_NULL()` before dereferencing will silently proceed with the garbage pointer. Patches are confirmed available across all active stable kernel branches (5.15.x through 7.x); no public exploit code exists and this CVE is not listed in the CISA KEV catalog.
The Linux kernel's binder IPC driver contains a use-after-clear bug in binder_transaction() where lsmctx.len is re-read after security_release_secctx() has already zeroed the field via memset, causing sg_buf_end_offset to be inflated by the full aligned LSM security context size on every transaction to a txn_security_ctx binder node. This allows BINDER_TYPE_PTR scatter-gather copies to overrun into bytes already populated with the secctx data, enabling LSM security context disclosure and potential kernel buffer corruption. No public exploit or CISA KEV listing exists at time of analysis; the EPSS score of 0.17% reflects low current exploitation probability, though the low-privilege local attack vector is meaningful on Android where binder IPC is the foundational IPC mechanism.
Improper credential context in the Linux kernel's in-kernel SMB3 server (ksmbd) allows an attacker with an open SMB handle to have SET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION FSCTL operations executed under the ksmbd worker's credentials instead of the credentials captured when the file was opened. Because the underlying VFS xattr, fallocate and fileattr helpers revalidate inode permissions, ownership and LSM policy against those worker credentials rather than the SMB handle's access mask, an attacker can corrupt or zero file data and alter file attributes beyond what their handle should permit (CVSS 9.1, I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not in CISA KEV; the upstream fix is merged into stable kernels.
Use-after-free / torn-entry race in the Linux kernel's Intel VT-d IOMMU driver (iommu/vt-d) lets the hardware walk a stale scalable-mode context entry pointing at freed PASID directory memory during device_pasid_table_teardown(), producing spurious DMA faults, unpredictable IOMMU behavior, and potential memory corruption. It affects Linux 6.8.2 through the 6.x/7.x stable series on systems using Intel scalable-mode (PASID) IOMMU translation. There is no public exploit identified at time of analysis and EPSS is low (0.16%), but the vendor-released fix is available in the stable trees.
Buffer overflow and missing locking in the Linux kernel's sun4i-ss PRNG driver expose local low-privilege users on AllWinner sun4i SoC hardware to potential kernel memory corruption and privilege escalation. Two distinct flaws exist: sun4i_ss_prng_seed() lacks mutual exclusion and accepts input without bounds checking, while sun4i_ss_prng_generate() truncates output length and fails to synchronize with hardware before reading bytes, producing cryptographically unreliable output. No public exploit has been identified, EPSS sits at 0.18% (8th percentile), and the kernel maintainers resolved the issue by removing the entire dead code block rather than patching individual bugs.
Use-after-free in the Linux kernel's AF_RXRPC (rxrpc) networking subsystem lets a freed struct rxrpc_backlog be reused when kernel accept preallocation races against socket teardown. The flaw affects kernels using the rxrpc transport (notably kAFS/AFS clients) prior to the fixed stable releases; a kernel worker calling rxrpc_kernel_charge_accept() reads rx->backlog with no lock while rxrpc_discard_prealloc() concurrently NULLs and frees it, corrupting backlog head/tail pointers and array slots. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.16% (5th percentile).
NULL pointer dereference in the Linux kernel's rxrpc subsystem allows a remote unauthenticated attacker to crash the kernel, causing a denial of service. The flaw exists in rxrpc_verify_data(), which skips allocating the rx_dec_buffer when the associated skb private length is zero, while its caller rxrpc_recvmsg_data() unconditionally assumes the buffer is populated after a successful return. A crafted RxRPC network packet with zero-length payload data can trigger this path, passing a NULL pointer to skb_copy_bits() and causing a kernel panic. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is very low at 0.16% (5th percentile), consistent with a niche kernel subsystem.
Memory corruption and use-after-free in the Linux kernel's AF_RXRPC subsystem (rxrpc) let a local process trigger a double-free and connection refcount underflow by reading an out-of-band challenge message with MSG_PEEK. Because rxrpc_recvmsg_oob() guards only the unlink from recvmsg_oobq under MSG_PEEK but always moves the skb onto pending_oobq, the same singly-referenced skb becomes linked into both a list and an rbtree that share storage, corrupting linkage and freeing the skb and its connection reference twice on socket close. The NVD-assigned CVSS is 9.8, but EPSS is only 0.15% (5th percentile) and there is no public exploit identified at time of analysis; the fix is upstream in the stable trees.
Memory corruption in the Linux kernel's rxrpc networking subsystem (rxgk/GSS Kerberos security class) affects kernels from 6.16 onward, where rxgk_issue_challenge() frees the page holding challenge content before a tracepoint reads the wire header (whdr) that still points into that freed page, creating a use-after-free. The flaw is patched in stable releases 6.18.40, 7.1.5 and 7.2-rc1, and is triggerable only where the rxrpc RxGK security class is active (primarily kAFS deployments). There is no public exploit identified at time of analysis, and the EPSS score is very low at 0.15% (5th percentile), indicating negligible observed exploitation interest.
Denial of service in the Linux kernel's rxrpc subsystem allows remote, unauthenticated attackers to trigger an infinite loop in rxrpc_recvmsg() by sending packets that populate the out-of-band (OOB) queue, which the wait condition fails to check. Systems exposing RxRPC endpoints - primarily AFS (Andrew File System) clients and servers - are affected from the introducing commit through Linux 7.1.4 and 6.18.39. No public exploit exists and EPSS sits at 0.15% (5th percentile), signaling negligible real-world exploitation probability; this is not listed in CISA KEV.
Null-pointer dereference in the Linux kernel's rxrpc subsystem allows a remote unauthenticated attacker to crash the kernel by sending a forged ACKALL control packet to an exposed rxrpc service. Affected systems run Linux from commit b341a0263b1b804d329f864c2dc24815364510ec through the fixes landed in stable releases 6.18.40 and 7.1.5; Linux 6.14 is explicitly confirmed affected. No public exploit has been identified and EPSS probability is very low at 0.15%, but the network-accessible, no-authentication attack path warrants immediate patching on any system actively serving rxrpc traffic.
Kernel panic via rxrpc protocol mishandling in the Linux kernel allows a network-positioned attacker to crash an AFS client system by sending a premature reply DATA packet before any request packets have been transmitted on a client call. The flaw resides in rxrpc_receiving_reply(), which fails to verify call exposure state before invoking rxrpc_rotate_tx_window() - a function whose do...while loop oopses on an empty transmit queue. Fixes have been backported to stable branches 7.1.5 and 6.18.40; no public exploit has been identified and EPSS exploitation probability is extremely low at 0.15% (5th percentile), indicating no known active exploitation.
Denial of service (and potential memory corruption) in the Linux kernel's AF_RXRPC networking stack stems from a double unlock in rxrpc_recvmsg() triggered while handling out-of-band (OOB) messages, affecting kernels from roughly 6.16 up to the fixed 6.18.40, 7.1.5 and 7.2-rc1 releases. Releasing an already-released lock corrupts kernel lock state and can crash the host or open a race window. No public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile).
Use-after-free / stale work-item race in the Linux kernel's kAFS (Andrew File System client) network-namespace teardown path allows a use-after-free when an afs netns is destroyed. Fixed upstream (this issue was found by AI review), the flaw stems from afs_charge_preallocation() and afs_rx_new_call() failing to stop the rxrpc preallocation 'charger' work item before incoming calls are disabled during net-namespace deletion, so the charger can run against freed/torn-down state. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and it is not in CISA KEV, so this is a correctness/stability defect far below the raw CVSS 9.8 rating.