Red Hat
Monthly
Heap out-of-bounds write in OpenEXR's DeepImage API affects all versions prior to 3.2.10, 3.3.12, and 3.4.13, exploitable by processing a crafted deep image EXR file. A coordinate axis confusion bug in `Imf_4_0::SampleCountChannel::set()` uses `dataWindow.min.x` instead of `dataWindow.min.y` when computing a target Y coordinate, causing memory writes before the allocated `_numSamples` heap buffer when `min.x ≠ min.y`. No public exploit identified at time of analysis; SUSE Linux Enterprise distributions have received vendor-released patches confirming active remediation.
Process-aborting denial of service in OpenEXR 3.4.0 through 3.4.12 allows an unauthenticated remote attacker to crash any application that calls exr_start_read() on a crafted HTJ2K-compressed EXR file. The crash originates in the vendored OpenJPH library, which invokes abort() unconditionally when a QCD marker's lower five bits are zero - an assertion failure that OpenEXR's partial error handling cannot intercept because codestream read and construction calls are left unprotected. No public exploit has been identified at time of analysis; the vulnerability is patched in version 3.4.13.
Stack-based out-of-bounds write in OpenEXR's HTJ2K decode path allows remote attackers to crash applications that process crafted EXR image files. Affected are OpenEXR versions 3.4.0 through 3.4.13, where the vendored OpenJPH AVX2 decoder fails to reject JPEG 2000 SIZ marker geometries in which the first tile does not intersect the visible image, leading to invalid codeblock computation and a stack memory corruption that terminates the process. No public exploit identified at time of analysis; a vendor-released patch is available in version 3.4.14.
CRI-O's container-creation code path crashes the daemon with an unrecovered Go runtime panic when processing an OCI image whose config.Env contains a malformed entry lacking an '=' character, under the specific condition that the CreateContainer request supplies a nil CRI Envs field. The crash terminates the crio daemon process, disrupting all container workloads on the affected node until the service is manually restarted - a node-wide denial of service. Affecting Red Hat OpenShift Container Platform 4, this requires high privileges (PR:H) to exploit; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial-of-service in Mistune Python Markdown parser versions 3.3.0-3.3.2 allows remote unauthenticated attackers to crash any process that renders user-supplied Markdown by submitting input with hundreds of consecutive asterisk characters. The recursive HTMLRenderer.render_token() traversal grows proportionally to emphasis nesting depth and exceeds Python's default recursion limit, raising an unhandled RecursionError that terminates the parsing process. No public exploit identified at time of analysis, though the fix commit itself demonstrates the attack pattern explicitly in its regression test suite.
Issuer-validation bypass in joserfc (Python JOSE library) prior to version 1.7.3 allows an attacker to craft a JWT with an array-valued `iss` claim - e.g., `["expected-issuer"]` - that passes the JWTClaimsRegistry equality check via Python membership matching (`in` operator on a list) rather than strict string equality. The same flaw affects `sub` claim validation. No public exploit has been identified at time of analysis, but the commit diff confirms the root cause and fix; EPSS data was not provided in the input.
DNS-based server-side request forgery in jackson-databind exposes any Java application that deserializes user-supplied JSON into objects containing `java.net.InetAddress`-typed fields, causing the library to perform unsolicited outbound DNS lookups against attacker-controlled hostnames. Affected across all major release lines from 2.x through 3.x (com.fasterxml and tools.jackson.core artifact groups), the flaw allows unauthenticated remote attackers to enumerate internal hostnames and map internal network topology via DNS side-channels. No active exploitation or public exploit code has been identified; vendor patches are available across all affected release lines.
Stack exhaustion and a bounded memory over-read in GIMP's file-pix (ESM) plugin allow a crafted PIX image to crash the application and leak 21 bytes of stack memory into an intermediate file. Users running GIMP on Red Hat Enterprise Linux 6 through 9 are affected when opening untrusted PIX format images. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the DoS impact is reliable and the delivery vector - a malicious image file - is realistic for desktop users.
Integer overflow in GIMP's file-pcx plugin on 32-bit builds enables a heap-based buffer overflow when a user opens a specially crafted PCX image, potentially leading to arbitrary code execution or denial of service. The flaw is architecturally constrained to 32-bit builds - 64-bit installations are unaffected - and exploitation additionally requires user interaction to open the malicious file. No active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis.
Header injection via structured-mode CloudEvents in Apache Camel's Knative consumer enables unauthenticated SSRF, path traversal, and message-dispatch redirection against routes that forward to header-driven components. The flaw exists because CloudEvent extension fields in structured content mode (Content-Type: application/cloudevents+json) are copied directly into Camel Exchange headers without applying the KnativeHttpHeaderFilterStrategy that correctly guards the binary content-mode path - an incomplete fix of the same filter-bypass pattern addressed across multiple related CVEs (CVE-2025-27636, CVE-2025-29891, CVE-2025-30177, CVE-2026-40453, CVE-2026-47323). No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface - unauthenticated HTTP POST to a Knative endpoint - requires no special tooling.
JWT claim validation in Apache Camel's Platform HTTP Main component silently fails to enforce issuer and audience constraints when neither jwtIssuer nor jwtAudience is configured, causing the embedded Vert.x HTTP server to accept any unexpired token signed by any key in the trusted keystore. Affected are Apache Camel versions 4.8.0 through 4.21.x across both the application server and management server paths. An attacker who possesses a valid JWT from any identity provider trusted by the configured keystore - such as a token legitimately issued for a different service in a shared IdP environment - can authenticate to the Camel HTTP endpoints without holding credentials intended for that service. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
Incomplete remediation of CVE-2025-9615 in NetworkManager exposes WPA-Enterprise (802.1X) connections to server certificate validation bypass on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. An unprivileged local user can set the 802-1x.ca-path or phase2-ca-path properties of a private connection profile to an attacker-controlled directory because the private_user restriction was never applied to these directory-valued fields. When the victim system subsequently connects to a wireless network, the bypassed CA validation enables credential theft via a rogue access point presenting a certificate signed by the attacker-supplied CA. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis; however, SSVC rates the attack as automatable with total technical impact once local access exists.
SSRF vulnerabilities in AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) allow an authenticated organization notification administrator to cause the AWX control node to issue outbound HTTP requests to internal, loopback, or RFC-1918 addresses that are not externally reachable. Beyond basic SSRF, the webhook backend compounds the risk by following HTTP redirects and replaying configured Basic Authentication credentials to the redirect destination regardless of host change, enabling credential exfiltration to attacker-controlled endpoints; the Grafana backend similarly exposes its API key by forwarding the Authorization header verbatim to any configured target URL. No public exploit has been identified at time of analysis, but the Changed scope and high confidentiality impact in the CVSS vector reflect significant real-world risk given the network position AWX control nodes typically occupy.
Path traversal in AWX's project_archive action plugin allows arbitrary file writes to execution node filesystems outside the intended project directory. Red Hat Ansible Automation Platform 2 is affected when processing zip or tar archives whose member filenames contain directory traversal sequences. An attacker who controls archive content - via admin-level project configuration, a compromised upstream archive source, or a man-in-the-middle attack on an unencrypted HTTP fetch - can write files as the extraction user and escalate to remote code execution through cron entries, SSH authorized_keys injection, or playbook content poisoning. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Use-after-free memory corruption in WebKitGTK exposes Red Hat Enterprise Linux 6 through 9 systems to potential arbitrary code execution when users process attacker-controlled web content. The flaw (CWE-416) stems from improper memory management in the web engine's content rendering pipeline, where a freed heap allocation is subsequently accessed, enabling heap corruption. No public exploit code or CISA KEV listing has been identified at time of analysis; operational urgency derives from the CVSS 8.8 score, the broad RHEL deployment footprint, and the well-understood exploitability of use-after-free conditions in browser engines.
SQL injection in TypeORM's SelectQueryBuilder.distinctOn enables database enumeration against PostgreSQL-backed applications that pass client-controlled values into the API without validation. The distinctOn array is joined and interpolated verbatim into a SELECT DISTINCT ON (...) clause in src/query-builder/SelectQueryBuilder.ts, bypassing the driver's escape helper and the allowlist guard (validateOrderByCondition) that protects the orderBy family. Because the injection point is a parenthesized SQL expression list, attackers can supply correlated subqueries and perform boolean or time-based blind inference against any table reachable by the application's database role, independent of the queried entity. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Symlink-following during ZIP extraction in adm-zip 0.5.9 through 0.6.0 allows a local attacker who can plant a symlink inside the extraction directory to overwrite arbitrary files accessible by the extracting process. Utils.writeFileTo calls fs.openSync without O_NOFOLLOW and performs no pre-write lstat check, so a pre-positioned symlink transparently redirects the write - and a subsequent chmod - to any target outside the extraction root without any path-traversal sequence appearing in the archive. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, but the impact is high in shared or predictable extraction environments such as CI pipelines and multi-tenant temp directories.
Path traversal in webpack-dev-middleware bypasses the incomplete CVE-2024-29180 fix by embedding dot-dot sequences within path segments (e.g., 'assets..') rather than as standalone segments, causing the UP_PATH_REGEXP guard to pass while the subsequent fixed-offset slice produces a parent-directory component that resolves above outputPath on the physical filesystem. Affected versions are precisely 5.3.4+, 6.1.2+, and 7.1.0+ - the releases that introduced the original guard-and-slice logic intended to fix path traversal. Exploitation is constrained to non-default configurations where publicPath lacks a trailing slash and the physical filesystem is in use via writeToDisk: true or a custom outputFileSystem; no public exploit identified at time of analysis, though a functional PoC for the predecessor attack class exists in GHSA-wr3j-pwj9-hqq6.
Improper certificate validation in JSS (Java Security Services) allows the JSSTrustManager class to accept CA certificates from the NSS database that lack TRUSTED_CA trust flags, meaning certificates never explicitly designated as trust anchors can still be used to anchor TLS chains. In non-default deployments where certificate revocation checking has been disabled, this creates a viable path for a man-in-the-middle attacker to forge certificates accepted by PKI client connections, with high confidentiality and low integrity impact. No public exploit has been identified at time of analysis, and the AC:H CVSS rating reflects the meaningful attack complexity - MITM positioning plus a specific non-default configuration must both be present.
Server-side request forgery in Hugo static site generator (versions 0.91.0 through 0.165.0) allows an attacker who can supply a URL through site content - via front-matter fields or a connected CMS - to silently fetch loopback, RFC 1918, or cloud-metadata endpoints during the build process, embedding the internal response directly into the published static output. The security.http.urls allowlist, Hugo's only guard on resources.GetRemote outbound fetches, evaluates hostname strings without performing DNS resolution, meaning any registered domain whose A record points to a private or metadata IP bypasses the policy entirely, and no dial-time hook in the HTTP client provides a second check. No public exploit code has been identified at time of analysis, but the attack requires only DNS control and content-write access, making it operationally straightforward in CI/CD-integrated deployments.
Server-side request forgery and address-policy bypass in fast-uri, the Node.js URI parser used widely in the fastify ecosystem, allows remote unauthenticated attackers to redirect outbound requests from a target application to local or private IPv6 addresses by submitting crafted bracketed IPv6 literals with invalid trailing characters. The custom IPv6 parser silently normalizes malformed literals - collapsing some to the unspecified address (loopback) and others to private-range addresses - and returns no error on the parsed result, defeating any application-level error checking. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no special privileges and low complexity, making automated exploitation plausible against any exposed application that normalizes untrusted URLs through an affected fast-uri version.
Heap exhaustion via unbounded memory leak in micrometer-core affects Java applications using Apache HttpAsyncClient (4.x or 5.x) instrumented with MicrometerHttpClientInterceptor. When asynchronous HTTP requests fail before receiving any server response - due to connection resets, network timeouts, or unreachable endpoints - the per-request tracking state allocated by the interceptor is never released, accumulating indefinitely on the JVM heap. Sustained failure conditions (such as a misbehaving or attacker-controlled upstream server) can drive heap exhaustion to OutOfMemoryError, crashing the instrumented application. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows network-accessible, unauthenticated attackers to supply percent-encoded slashes in the scheme component, causing the library to report host as undefined during parsing while serialization emits a network-path reference with an attacker-controlled authority. Applications that allowlist requests on the parsed host value, or that treat a no-authority parse result as safe to resolve against a base URI, are bypassed - enabling server-side request forgery, off-site redirects, and address-policy evasion. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special configuration, making affected deployments an immediate upgrade priority.
Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and host-policy bypass primitive in versions 2.4.1-2.4.4, 3.1.2-3.1.5, and 4.0.0-4.1.2. The library decodes percent escapes once during hostname parsing and again during authority recomposition, so a single normalize or resolve call on a doubly-encoded input can silently resolve to a different network destination - including loopback addresses - than the encoded form represents. Any application layer sitting fast-uri in front of outbound routing guards, redirect allow-lists, or host-policy checks is therefore vulnerable to SSRF. This is an incomplete-fix variant of CVE-2026-6322; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsistent host canonicalization between the library's own entry points. When a scheme-relative reference (e.g., //unicode-host.example/path) is passed without an explicit scheme, fast-uri's parse, normalize, and equal functions return the host verbatim, while resolve canonicalizes it to ASCII/Punycode - meaning the same input yields different host values depending on which API is called. An application that extracts a host for an allowlist check via one code path and then resolves the URI via another can be tricked into approving one host while the actual request is dispatched to a different one. No public exploit exists and CISA KEV listing is absent, but the EPSS-independent integrity impact (CVSS I:H) is real in applications relying on fast-uri for security-critical URI validation. Fixed versions are 2.4.5, 3.1.6, and 4.1.3.
Out-of-bounds write in warmcat libwebsockets 4.5.0 allows remote unauthenticated attackers to corrupt process memory by submitting crafted CBOR-encoded data to any network-accessible endpoint using the LECP CBOR parser. The root cause is a dual defect in `lecp_parse` and `report_raw_cbor` within `lib/misc/lecp.c`: an equality-only bounds check (`== sizeof(ctx->cbor)`) fails to catch cases where `cbor_pos` has already exceeded the buffer limit, and `cbor_pos` was reset after rather than before the flush callback, creating a window for sequential over-increment. No public exploit identified as confirmed active exploitation (CISA KEV), but a public proof-of-concept is confirmed at the referenced GitHub repository, and a patch commit has been issued upstream.
Heap-based buffer overflow in libtiff's rgb2ycbcr command-line utility enables potential arbitrary code execution when a user processes a specially crafted TIFF image. The root cause is a CWE-190 integer overflow in the cvtRaster() function's strip buffer size computation: the arithmetic wraps to an undersized value, and subsequent YCbCr conversion writes spill beyond the allocated heap region. A publicly shared GitHub gist (okyfh) suggests proof-of-concept material may be available; an upstream fix commit exists in the libtiff GitLab repository, though no tagged release version has been independently confirmed at time of analysis.
Arbitrary code execution in libtiff's tiffcrop utility (commit 85f2ac8e) stems from the process_command_opts() function in tools/tiffcrop.c, classified as CWE-94 code injection. An attacker who can influence the input processed by tiffcrop can trigger execution of arbitrary code. Publicly referenced proof-of-concept material appears to exist via a linked gist, but the flaw is not in CISA KEV and EPSS is low (0.16%, 5th percentile), indicating no evidence of widespread active exploitation.
Race condition in the Linux kernel's GPIO PCA953x driver allows local low-privileged users on systems with PCA953x I2C GPIO expander hardware to trigger incorrect register reads or writes by exploiting missing mutex coverage in pca953x_irq_bus_sync_unlock(). A prior partial fix protected only the interrupt mask register write but left the direction register read unguarded, permitting concurrent threads to interleave I2C transactions and corrupt GPIO expander state on affected kernel stable branches including 6.1.101-6.2, 6.6.42-6.7, and 6.9.11-6.10. No public exploit has been identified and EPSS exploitation probability is 0.20% at the 10th percentile, consistent with negligible real-world exploitation interest.
Use-after-free in the Linux kernel's sched_ext (extensible BPF scheduler) subsystem allows a local low-privileged attacker to corrupt kernel memory, potentially achieving full confidentiality, integrity, and availability compromise of the affected system. The race condition arises when a sub-scheduler enable fails before being linked into the scheduler hierarchy, yet the full teardown path still executes concurrently against root scheduler disable, causing tasks to be re-homed onto an already-freed scheduler hierarchy. No public exploit or POC has been identified at time of analysis, and EPSS at 0.20% (10th percentile) reflects negligible observed exploitation activity.
A use-after-free in the Linux kernel's NFSv4 client can occur when a FREE_STATEID operation is delayed and the associated 'struct nfs_server' is torn down (for example on unmount) while the operation is still in flight, leaving the RPC referencing freed memory. The fix pins the nfs_server by bumping its refcount for the duration of the FREE_STATEID call. This is a client-side race condition, not a server-facing service bug; no public exploit identified at time of analysis, and EPSS is low (0.22%, 13th percentile).
Use-after-free in the Linux kernel's ovpn (in-kernel OpenVPN data-channel offload) module lets a local privileged attacker corrupt kernel memory by racing peer-management operations. A time-of-check/time-of-use window between ovpn_peer_get_by_id() and acquisition of ovpn->lock allows a peer that was concurrently removed to be re-inserted into the rehash tables, resurrecting a peer userspace believes is gone and leaving embedded hash entries linked to memory later freed via call_rcu. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), consistent with a hard-to-win kernel race rather than a mass-exploitable bug.
Null-pointer dereference and promiscuity counter underflow in the Linux kernel bonding driver's ALB monitor can crash the kernel or permanently pin a network interface in promiscuous mode. The bond_alb_monitor() workqueue function reads primary_is_promisc under RCU, drops that lock, then acquires RTNL - allowing the active slave to be removed or changed in the intervening window, leaving the monitor to act on stale state. Linux systems from kernel 2.6.24 through unpatched stable branches (5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, 7.2) with network bonding explicitly configured in ALB mode are affected. No public exploit identified at time of analysis.
Use-after-free in the Linux kernel's enic driver (Cisco VIC Ethernet NIC) allows a local attacker with low privileges to corrupt kernel heap memory during network device removal. The enic_remove() teardown function fails to cancel or disable the tx_hang_reset work item, creating a race window where a TX watchdog timeout can reschedule enic_tx_hang_reset() to execute after free_netdev() has already released the underlying network device structure. No public exploit exists and EPSS probability is 0.21% (11th percentile), though the kernel use-after-free primitive carries high C/I/A impact if reliably triggered.
Out-of-bounds write in the Linux kernel's IPVS subsystem (`ip_vs_nat_icmp`) allows a local attacker with low privileges to corrupt kernel memory by exploiting a TOCTOU race on the IP header length field (`ihl`), which is read multiple times during ICMP packet NAT processing. Affected systems include any Linux kernel from version 2.6.12 through the pre-patch range across multiple stable branches (fixed in 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2). An attacker achieving kernel memory corruption via this path could escalate privileges to full kernel control; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Linux kernel btrfs LZO decompression path allows a crafted btrfs filesystem image to trigger a slab-out-of-bounds (and potentially extent-buffer-boundary) read when an inline LZO-compressed file extent is read. The flaw affects the kernel's btrfs module from 2.6.38 onward and is fixed upstream; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.20%). Despite an input CVSS of 9.8 (network vector), the actual defect requires local mounting/reading of an attacker-crafted image, making it a local availability/disclosure issue rather than remote code execution.
Reference count underflow in the Linux kernel amdxdna (AMD XDNA NPU accelerator) driver allows a local low-privileged user to corrupt kernel memory via a double invocation of vm_ops->close() triggered by failed mmap page insertions. Two error paths in amdxdna_insert_pages() incorrectly release the shmem pages_pin_count and backing GEM object reference while the VMA remains live; the kernel's subsequent VMA teardown fires vm_ops->close() a second time, producing a reference count underflow with potential use-after-free consequences and high impact across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and EPSS is 0.20% (10th percentile), consistent with the niche AMD Ryzen AI hardware requirement limiting real-world exposure.
Privilege escalation in the Linux kernel BPF verifier affects versions from 4.16 through current stable branches due to incomplete pointer state propagation during commuted arithmetic (scalar += pointer) in adjust_ptr_min_max_vals(). Local attackers with BPF program loading privileges can exploit the verifier's failure to copy the full bpf_reg_state structure, potentially bypassing memory safety enforcement and achieving arbitrary kernel memory access. No public exploit has been identified at time of analysis and EPSS is low at 0.22%, but the CVSS score of 7.8 (C:H/I:H/A:H) reflects the severity of kernel-level impact if successfully exploited.
Kernel panic in Linux mlx5 (Mellanox/NVIDIA ConnectX) driver's firmware tracer subsystem allows a system crash when the devlink health reporter fires on a device where fw_tracer initialization returned ERR_PTR rather than NULL. The stored ERR_PTR is never validated against IS_ERR() before dereference in mlx5_fw_tracer_trigger_core_dump_general, resulting in an Oops and fatal kernel panic as confirmed by the full crash trace in the CVE description. No public exploit has been identified at time of analysis; EPSS is 0.22% (13th percentile), and the vulnerability is not listed in CISA KEV - though the availability impact when triggered is total (system crash). Multiple patched stable-kernel versions are available.
Reference imbalance in the Linux kernel's BPF conntrack kfuncs allows a local attacker with BPF privileges to trigger an unmatched put_net() call that can destroy a live network namespace and cause kernel panic. The flaw affects __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry(), where opts->netns_id is read non-atomically from a shared BPF map value during both namespace acquisition and release. No public exploit code exists and EPSS is low (0.20%, 10th percentile), but the kernel panic outcome is confirmed by a crash trace in the advisory. Exploitation requires local BPF capability and a concurrent writer to the shared map.
Use-after-free in the Linux kernel's BPF TCP iterator exposes systems running kernel versions from 5.15 onward to local privilege escalation with high impact across confidentiality, integrity, and availability. The race condition in bpf_iter_tcp_established_batch() allows a low-privileged local attacker to hold a reference to a request_sock whose refcount is still zero, corrupting kernel memory when the publishing CPU's refcount_set() subsequently overwrites the saturated value. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), though the race is described as reproducible within seconds under controlled conditions with tcp_syncookies=0.
Unbounded memory allocation in the Linux kernel's vhost_iotlb subsystem allows availability impact on the host system via exhaustion of kernel memory. The flaw exists in vhost_iotlb_add_range_ctx(), where non-retiring IOTLB tables bypass the configured entry limit and continue allocating entries indefinitely - including via guest-controlled or userspace requests to vhost, mlx5 vDPA, VDUSE, and vhost-vDPA subsystems. No public exploit code has been identified at time of analysis, and EPSS probability is very low (0.20%), but the CVSS scope-change metric (S:C) reflects that a guest workload can impact host kernel availability.
Out-of-bounds kernel slab read in the Linux kernel's mlx5 vDPA driver (vdpa/mlx5) allows a local actor managing vDPA devices to trigger a 16-byte over-read in create_direct_keys(). The flaw stems from a mismatch between the computed input length (which includes the 'out' field) and the pointer passed to cmd_exec() (which skips 'out'), causing mlx5_copy_to_msg() to read past a 4384-byte allocation. No public exploit identified at time of analysis; EPSS is low (0.21%) and it is not in CISA KEV.
Type confusion in the Linux kernel's PMBus hardware monitor driver (`pmbus_notify()`) enables a slab-out-of-bounds read and potential kernel memory corruption on systems with PMBus-capable power management hardware. The `pmbus_notify()` loop unconditionally casts all attribute pointers to `struct sensor_device_attribute`, but the attribute array also contains `struct pmbus_samples_reg` and `struct pmbus_sensor` objects that only embed a base `struct device_attribute`; reading the `index` field of these miscast pointers accesses memory beyond the allocation or overlaps with unrelated kernel struct fields, producing garbage masks that could spuriously match alert conditions. No public exploit has been identified and EPSS is low (0.21%, 11th percentile), but the theoretical impact is full kernel privilege escalation on affected hardware.
Out-of-bounds kernel memory read in the Linux kernel AF_XDP subsystem allows a local low-privileged user to trigger reads beyond registered memory regions by supplying TX metadata shorter than 16 bytes. Affected systems include Linux kernel versions from the introduction of commit 341ac980eab9 through multiple stable branches, with patches available at 6.12.104, 7.1.9, and 7.2. No public exploit has been identified and EPSS is 0.21% (11th percentile), indicating low current exploitation activity despite the high CVSS score.
Memory corruption in the Linux kernel's AF_XDP socket (xsk) subsystem arises from two related flaws: missing size validation for launch-time metadata fields that extend beyond the first 16 bytes of struct xsk_tx_metadata, and a race condition where user space can modify transmit flags concurrently with kernel transmit processing. A local attacker with low-privilege access who can create and configure AF_XDP sockets may trigger out-of-bounds memory access, leading to high-impact compromise of confidentiality, integrity, and availability consistent with the CVSS 7.8 score. No public exploit code has been identified, EPSS sits at 0.21% (11th percentile), and the CVE is absent from CISA KEV, placing practical exploitation risk well below what the raw CVSS score might suggest.
The AF_XDP zero-copy TX path in the Linux kernel exposes a time-of-check/time-of-use (TOCTOU) race condition that allows a local low-privileged user to bypass TX metadata validation enforced by the kernel. Metadata is validated during descriptor context acquisition but re-read without re-validation when the hardware request is prepared, creating a window during which userspace can overwrite the shared ring buffer entry with arbitrary values. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) reflects low near-term exploitation probability, though the CVSS 7.8 High rating with C:H/I:H/A:H captures the potential for full kernel-level impact on affected systems.
Use-after-free in the Linux kernel's UDP tunnel GSO segmentation path (__skb_udp_tunnel_segment()) occurs when the code dereferences a saved UDP header pointer after a skb_pull() reallocates skb->head, invalidating that pointer. The flaw affects hosts that software-segment UDP-encapsulated tunnel traffic (VXLAN/GENEVE/FoU), and can lead to a kernel crash or potential information disclosure. No public exploit is identified at time of analysis, EPSS is low (0.22%), and the issue is not on CISA KEV; the upstream fix reorders the header fetch to occur after the pull.
Remote denial of service in the Linux kernel's CAKE traffic scheduler (sch_cake) allows an unauthenticated network attacker to trigger a kernel panic or persistent warning-log flood by sending malformed IP packets to a system with the CAKE qdisc actively configured. Affected systems running Linux 4.19 through unpatched versions of the 7.x series face kernel panic if the non-default `panic_on_warn=1` boot parameter is set, or dmesg flooding otherwise. No public exploit has been identified and this CVE is not in the CISA KEV catalog, but the fix is low-risk and multiple patched stable kernel versions are available.
Kernel panic in Linux kernel's vhost-scsi subsystem can be triggered by a malicious guest VM when T10 Protection Information (PI) is negotiated, crashing the host kernel and all co-hosted virtual machines. A guest sends a malformed SCSI request with protection byte lengths equal to or exceeding the payload, causing an integer underflow or zero-count scatterlist that hits an unconditional BUG_ON assertion in sg_alloc_table_chained(). With EPSS at 0.21% (11th percentile), no CISA KEV listing, and no public proof-of-concept identified at time of analysis, exploitation probability is currently low but the guest-to-host scope change makes this a meaningful availability risk in multi-tenant virtualized storage environments.
The vhost-scsi subsystem in the Linux kernel allows a local attacker with low privileges on a KVM virtualization host to trigger a kernel BUG_ON assertion and crash the host by manipulating VIRTIO feature bits after SCSI endpoint setup. The flaw is that vhost_scsi_set_features() incorrectly accepted changes to VIRTIO_SCSI_F_T10_PI after an active endpoint was established, leaving per-command protection scatterlist arrays (prot_sgl) unallocated while the I/O path proceeded under the updated feature state; when a 129-page protection payload arrives, a BUG_ON(nents > SG_CHUNK_SIZE) fires in sg_pool_index(), panicking the host kernel. Patches are confirmed for stable branches 6.18.45 and 7.1.9 and mainline 7.2; no public exploit exists and no CISA KEV listing is present, with an EPSS of 0.21% (11th percentile).
Kernel BUG triggerable in the Open vSwitch (OVS) net subsystem allows a local low-privileged attacker to crash the kernel or potentially escalate privileges by injecting undersized Ethernet frames through a TUN device. Affected kernels from Linux 4.10 onward trust the user-supplied skb->protocol field on ARPHRD_NONE devices without validating that sufficient linear data exists for Ethernet header parsing, causing __skb_pull() to hit an unconditional BUG halt. No public exploit code has been identified and EPSS probability stands at 0.22% (13th percentile), indicating low opportunistic exploitation risk; however, patches are available across all active stable branches.
Use-after-free in the Linux kernel's traffic control classifier API (net/sched/cls_api) allows a local attacker with CAP_NET_ADMIN to corrupt kernel memory by racing two concurrent tc_new_tfilter() calls targeting the same chain and priority with different classifier types. A proof-of-concept is referenced in the upstream kernel commit but is not independently confirmed as publicly released. EPSS is 0.21% and the vulnerability is not listed in CISA KEV, indicating no observed widespread exploitation at time of analysis.
Data corruption in the Linux kernel bnxt_en driver (Broadcom NetXtreme-E) occurs when TCP Packet Aggregation (TPA) is active alongside PCIe Relaxed Ordering (RO) on AGG rings. When EOP (End-of-frame padding) is used, zero-padding bytes appended at the end of one aggregated segment can spill over and overwrite valid data at the start of the subsequent segment. Older chips (P5 generation and earlier, including the Broadcom 57508) do not automatically suppress RO when EOP is active, making ARM-hosted deployments using these adapters particularly vulnerable to silent data corruption in received network traffic. No public exploit is identified at time of analysis, and EPSS probability is low at 0.21% (12th percentile).
TCP Fast Open queue accounting in the Linux kernel becomes inaccurate following SO_REUSEPORT listener migration, permitting far more pending TFO connection requests than the configured TCP_FASTOPEN max_qlen limit allows. The root cause is a counter mismatch: fastopenq.qlen is charged against the original listener during child creation in tcp_fastopen_create_child() but uncharged against a different socket after inet_reqsk_clone() repoints the migrated child's rsk_listener to the new listener, causing the surviving listener's qlen to drift negative and its max_qlen guard to stop firing. No public exploit has been identified and EPSS stands at 0.21% (12th percentile), but any server combining SO_REUSEPORT with TCP Fast Open is vulnerable once listener migration has occurred.
Reference count leak in the Linux kernel netfilter flowtable offload path allows a remote attacker to cause a denial of service by sending network packets through a system with nf_flow_table offload configured. The flaw occurs in nf_flow_offload_ip_hook() and the XFRM offload path when skb_dst_set_noref() overwrites an existing ref-counted dst_entry without first dropping it, leaking the reference and triggering a DEBUG_NET_WARN_ON_ONCE kernel assertion. No public exploit has been identified at time of analysis; EPSS of 0.21% (11th percentile) and absence from CISA KEV confirm low opportunistic exploitation activity. Upstream patch commits and fixed stable releases 6.18.45, 7.1.9, and 7.2 are available.
Kernel memory exhaustion in the Linux net/smc subsystem enables remote denial-of-service against servers using SMC listen sockets. A TOCTOU race between smc_listen_out() and listener socket close allows an unauthenticated remote attacker to enqueue child socket objects onto a dead listener - each leaking a smc_sock, clcsock, and unreleased reference - by flooding TCP connections during the server's close() window. Patches are confirmed available across multiple stable kernel branches (5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2+); no public exploit code or CISA KEV listing has been identified at time of analysis.
Slab-out-of-bounds read in the Linux kernel's ATM subsystem `vcc_setsockopt()` exposes kernel heap memory and can crash the kernel for local low-privileged users. The defect stems from a short-circuited optlen validation - when the caller passes a mismatched `level` parameter, the length check is bypassed entirely, and a secondary path through cgroup BPF setsockopt filters can shrink optlen after a passing check, both leading to `copy_from_sockptr()` reading beyond the supplied buffer. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.24% at the 16th percentile, reflecting low real-world exploitation probability against a legacy subsystem.
Use-after-free in the Linux kernel's SCTP (Stream Control Transmission Protocol) subsystem allows a remote peer to trigger a dangling transport-pointer dereference on the control chunk queue. The flaw arises because sctp_make_heartbeat_ack() caches a destination transport in chunk->transport without holding a reference; when src_out_of_asoc_ok keeps a HEARTBEAT ACK queued and the peer transport is later torn down, the queued chunk retains a stale pointer that is dereferenced on eventual transmission. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is low at 0.22% (13th percentile). A vendor patch is available in multiple stable trees.
Use-after-free race condition in the Linux kernel at91sam9_wdt watchdog driver allows a local attacker with low privileges on affected AT91 SAM9 SoC hardware to corrupt freed memory, potentially achieving kernel-level code execution. The flaw arises because at91_ping() rearms a kernel timer from within its own callback, while timer_delete() neither waits for an in-flight callback to finish nor prevents rearming - leaving a window during probe failure or driver removal where the timer accesses devm-allocated memory that has already been freed. No public exploit has been identified at time of analysis, and EPSS probability is very low (0.21%, 11th percentile), consistent with the hardware-specific and timing-dependent nature of this race.
NULL pointer dereference in the Linux kernel's tap_get_user_xdp() function can be triggered by a local attacker or malicious guest VM to crash the host kernel. The flaw arises because skb->dev is not assigned before tun_vnet_hdr_to_skb() is called in the XDP path, while the parallel code path tap_get_user() had already received a fix for the identical ordering defect. Impact is limited to availability - host kernel panic - with no confidentiality or integrity compromise possible. No public exploit or CISA KEV listing has been identified; EPSS at 0.21% reflects negligible observed exploitation activity.
Memory exhaustion in the Linux kernel's ax88179_178a USB Ethernet driver allows socket buffers to leak on every failed TX linearization attempt under memory pressure. Systems with ASIX AX88179 or AX88178A USB-to-Ethernet adapters loaded with scatter-gather (NETIF_F_SG) enabled are affected: when skb_linearize() fails inside ax88179_tx_fixup(), the function returns NULL without freeing the original skb, and the caller usbnet_start_xmit() never releases it because its local skb pointer is now NULL. No public exploit has been identified and EPSS probability is negligible (0.21%, 12th percentile); the practical risk is gradual kernel memory exhaustion on systems continuously operating under low-memory, high-TX-load conditions with the specific USB hardware connected.
Race condition in the Linux kernel virtual terminal subsystem exposes a use-after-free condition when kbd_keycode() reads vc->port.tty without holding a reference, while con_shutdown() concurrently clears that pointer under a separate lock. Affected versions span every maintained stable series from 5.10 through 7.x; patches are available across all branches. No public exploit code exists and EPSS is very low at 0.22% (13th percentile), but the CVSS 7.8 local score reflects real kernel memory corruption potential that could enable privilege escalation.
Incorrect TLB flush address targeting in the Linux kernel's zap_pte_range memory management function exposes systems running kernel versions prior to 7.1.9 and 7.2 to local privilege escalation and information disclosure, particularly on AMD systems with EFER.TCE enabled and Intel systems using INVPCID. A low-privileged local attacker can exploit a race where the kernel flushes the wrong virtual address after freeing a page table, leaving stale CPU paging-structure-cache entries that can be speculatively accessed or cause the freed table to be reused with potentially attacker-controlled data. No public exploit code or active exploitation (CISA KEV) has been confirmed at time of analysis, and the 0.20% EPSS score reflects the complexity of reliable exploitation.
Out-of-bounds write in the Linux kernel IPVS estimator subsystem allows a low-privileged local attacker to corrupt kernel memory through a race condition between network namespace teardown and IPVS kthread initialization. When ipvs->enable is cleared while kthread 0 is mid-way through its calculation phase, ip_vs_enqueue_estimator() writes past the ticks and tick_len arrays using zero-initialized limits, producing high-impact memory corruption on affected kernels from the 6.6.x through 7.1.x stable series. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) reflects very low near-term exploitation probability despite the high CVSS 3.1 base score of 7.8.
Stack out-of-bounds write in the Linux kernel IPVS (IP Virtual Server) subsystem lets a remote attacker corrupt the __icmp_send() stack when a director rebases ICMP errors for tunneled traffic. In ip_vs_in_icmp() the skb is rebased from the outer ICMP packet to the quoted original request, but IPCB(skb)->opt still describes the outer IPv4 header, so a stale timestamp-option offset points into the quoted transport header and __ip_options_echo() copies an attacker-influenced byte as an option length into fixed-size stack storage. There is no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile), consistent with a subsystem-specific memory-corruption bug rather than a mass-exploitation candidate.
Race condition in the Linux kernel's AF_PACKET TX_RING send path allows a low-privileged local user to trigger kernel heap memory corruption by racing a concurrent netdevice reconfiguration. The tpacket_snd() function reads dev->hard_header_len independently at two points - for SKB headroom allocation and for header construction in tpacket_fill_skb() - so a device reconfiguration between those two reads can cause the reserved headroom to be smaller than what is later pushed, or make copylen minus hard_header_len negative. With a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and patches available across multiple stable kernel branches, this is a patching priority for multi-tenant Linux environments; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds memory access in the Linux kernel's packet socket subsystem (net/packet) allows a local attacker with CAP_NET_RAW or equivalent network namespace privileges to trigger kernel memory corruption via the PACKET_QDISC_BYPASS transmit path. The flaw exists because packet_parse_headers() fails to reset skb->mac_header for SOCK_DGRAM, SOCK_PACKET, and protocol-bound SOCK_RAW sockets, causing any driver that reads eth_hdr(skb) during transmit to dereference an address approximately 64 KiB past the socket buffer head. No public exploit has been identified and no CISA KEV listing exists; patches are available across at least eight stable kernel branches.
Race condition in the Linux kernel AF_PACKET socket subsystem allows a local low-privileged attacker to dereference stale or NULL ring storage, resulting in kernel memory corruption with full confidentiality, integrity, and availability impact. The flaw arises because packet_set_ring() previously published the tpacket receive mode outside the sk_receive_queue.lock section used for ring state updates, enabling packet_poll() and packet_recvmsg() to run pressure-clearing paths against already-freed ring structures. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS places current exploitation probability at 0.21%.
Kernel memory disclosure in the Linux kernel's generic XDP receive path allows leaking of adjacent kernel memory - including skb_shared_info contents and a raw kernel pointer from skb_shinfo(skb)->frags[0] - into userspace when an attached XDP program shrinks a packet's fragment area. The flaw stems from bpf_prog_run_generic_xdp() updating skb->data_len without adjusting skb->len, leaving skb_headlen() larger than the real linear area so datagram copies read past the linear tail. No public exploit is identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the issue is not CISA KEV-listed, so risk is confined to systems running generic XDP programs that adjust fragments.
Stack exhaustion in Linux kernel net/sched allows a local low-privileged attacker with CAP_NET_ADMIN to crash or potentially compromise the kernel by constructing an excessively deep qdisc hierarchy. The create-and-graft code path lacked depth enforcement, permitting hierarchies that trigger unbounded recursion in qdisc tree walkers, overflowing the kernel stack. No public exploit code exists and EPSS is 0.21% (12th percentile), but the CVSS 7.8 High rating and C:H/I:H/A:H impact vector indicate vendor assessment of a privilege escalation potential beyond simple denial-of-service. Patch-confirmed fixes are available across multiple stable kernel branches.
Kernel memory corruption in the Linux inet fragment (inet_frag) subsystem arises from a race in inet_frag_create(), which arms the fragment-queue timer before publishing the queue into the fqdir rhashtable. When a network namespace has a fragment timeout of zero or negative, the timer can fire on an unpublished queue, mark it complete, and drop an anticipated hash reference that is never restored, leaving a stale hash node and a use-after-free-style reference imbalance. No public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.21%, 11th percentile), and exploitation depends on a non-default namespace configuration rather than default deployments.
Use-after-free in the Linux kernel's mac802154 (IEEE 802.15.4) subsystem allows a local low-privileged attacker to dereference freed netdev memory, potentially achieving kernel memory corruption and privilege escalation. The race window opens when mac802154_beacon_worker() drops the RCU read lock while still holding references to sdata and wpan_dev, and a concurrent interface teardown via mac802154_stop_beacons_locked() frees those structures before the worker completes. EPSS is very low at 0.21% (11th percentile) and no active exploitation or public exploit code has been identified at time of analysis; practical exploitation is limited by mac802154 hardware availability and the race condition timing requirement.
Use-after-free in the Linux kernel netfilter ebt_nflog subsystem allows a local attacker with low privileges to trigger kernel memory corruption by racing ebtables NFLOG rule execution against nfnetlink_log module teardown. Affected kernels from version 4.12 through multiple stable branches (pre-patch) fail to acquire a module reference on the nfnetlink_log backend before invoking nfulnl_log_packet(), unlike the xt_NFLOG and nft_log frontends. KASAN-confirmed heap use-after-free at instance_lookup_get_rcu can result in full kernel compromise (C:H/I:H/A:H). No public exploit identified at time of analysis; EPSS at 0.22% (13th percentile) reflects low near-term exploitation probability.
Use-after-free race condition in the Linux kernel's IPv4 routing subsystem allows a local low-privileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw is in fib_nhc_update_mtu(), which traverses the PMTU nexthop exception (FNHE) table without proper serialization against concurrent FNHE eviction, creating a window where freed memory is accessed after a completed RCU grace period. No public exploit code has been identified at time of analysis, and an EPSS of 0.22% (13th percentile) reflects very low near-term exploitation probability despite the 7.8 CVSS score.
TX DMA buffer mismanagement in the Linux kernel's Qualcomm GENI serial driver (qcom-geni) allows a local low-privileged user to hang the system indefinitely and potentially corrupt kernel memory on affected Qualcomm hardware. The driver's DMA-mode uart_ops lacks a flush_buffer callback, enabling in-flight DMA transfers to underflow the transmit kfifo and re-submit page-sized transfers indefinitely; a concurrent flaw in the stop path unmaps the DMA buffer while the serial engine is still reading it. No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile), but the user-triggerable hang and DMA use-after-unmap represent a real availability and potential integrity risk on affected Qualcomm platforms.
Use-after-free race condition in the Linux kernel's amba-pl011 serial driver allows a local unprivileged user on ARM-based hardware to corrupt kernel memory, potentially escalating to full system compromise. The RS485 hrtimers embedded in the devm-managed port structure can fire after the port is freed, and the IRQ handler can arm a timer immediately before teardown, creating the race window. No public exploit exists and EPSS is 0.21% (11th percentile), but kernel-level use-after-free primitives are well-understood exploitation targets and patched stable releases are available.
Out-of-bounds read in the Linux kernel's staging RTL8723BS WiFi driver allows adjacent-network unauthenticated attackers to leak kernel heap memory or crash the affected system by transmitting a crafted 802.11 management frame. The flaw lives in rtw_get_wpa_ie(), which accesses fixed byte offsets within a vendor-specific information element without verifying the IE body is at least 6 bytes long, enabling reads past the end of a kmemdup'd allocation when a short trailing IE is present. No active exploitation is confirmed (absent from CISA KEV) and EPSS sits at 0.22% (13th percentile), but the adjacent-network, no-authentication attack vector represents a meaningful risk for embedded and single-board systems carrying RTL8723BS hardware.
Buffer overflow and stale-memory disclosure in the Linux kernel's staging rtl8723bs WiFi driver allow a malicious access point within radio range to corrupt kernel memory or leak sensitive buffer contents before any association occurs. The flaw resides in OnAuthClient(), which copies a WLAN_EID_CHALLENGE element's attacker-controlled length - up to 255 bytes - into a fixed 128-byte chg_txt buffer via memcpy(), enabling an overflow of up to 127 bytes or an underfill that echoes stale kernel memory. No public exploit has been identified at time of analysis and EPSS probability is low (0.26%, 18th percentile), but the adjacent-network unauthenticated attack vector and High impact across confidentiality, integrity, and availability make this a notable risk for any deployment relying on WEP shared-key authentication with this chipset.
Out-of-bounds reads in the staging rtl8723bs WiFi driver's monitor mode transmit path expose Linux kernel systems equipped with Realtek RTL8723BS hardware to memory disclosure, corruption, and denial of service. The driver function rtw_cfg80211_monitor_if_xmit_entry() strips the variable-length radiotap header and then reads the 802.11 frame control field without verifying the socket buffer still contains a minimum MAC header; for data frames it additionally pulls the full calculated 802.11/QoS/SNAP span before confirming the skb holds that much data. A local attacker with low privileges can inject a truncated 802.11 frame to trigger the flaw; no public exploit has been identified at time of analysis and EPSS stands at 0.22%, indicating low automated exploitation probability.
Race condition in the Linux kernel fastrpc driver allows a local low-privileged attacker on Qualcomm DSP-equipped systems to trigger a use-after-free condition by issuing concurrent munmap ioctls, potentially achieving kernel memory corruption and privilege escalation. The flaw exists in `fastrpc_req_munmap_impl()` where the internal buffer list is updated only after the DSP unmap completes, leaving a window in which a concurrent thread can operate on an already-unmapped entry. No public exploit or CISA KEV listing exists at time of analysis, and EPSS remains low at 0.21%, indicating limited observed exploitation activity.
Unprotected list manipulation in the Linux kernel FastRPC subsystem allows a local low-privileged attacker on Qualcomm-based systems to race a signal-interrupted DSP invoke operation against concurrent mmap/munmap operations. The missing `fl->lock` acquisition in `fastrpc_internal_invoke()` during the interrupt path creates a concurrent modification hazard on `fl->mmaps`, potentially yielding kernel memory corruption with full confidentiality, integrity, and availability impact. No public exploit has been identified and EPSS is 0.21% (11th percentile); this CVE is not listed in the CISA KEV catalog.
Unbounded kernel memory access in the Linux kernel's ALSA usx2y driver allows a local user with access to a Tascam US-X2Y USB audio device's hwdep node to read from and write to arbitrary kernel memory pages via a crafted mmap() call with an out-of-bounds page offset. The snd_usb_usx2y module has carried this flaw since Linux 2.6.12; no Linux capability check (CAP_SYS_ADMIN, etc.) is required - only DAC permission to the hwdep character node after completing a mandatory FPGA image upload sequence. The exploit primitive is sufficient for local privilege escalation, but real-world risk is tightly bounded by the requirement for a physically attached Tascam US-X2Y device; no public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.21% (12th percentile) reflects this narrow hardware prerequisite accurately.
Out-of-bounds slab write in the Linux kernel ALSA FCP (FireWire Control Protocol) driver allows local unprivileged processes to corrupt up to 888 bytes of adjacent kernel heap memory by reading audio controls on /dev/snd/controlC0, once a privileged actor has installed an oversized Level Meter map. The mismatch between the driver's 255-entry map limit and the 128-entry ABI array in struct snd_ctl_elem_value creates a persistent, exploitable write primitive reachable by any process with device read access. No public exploit has been identified and no active exploitation is confirmed; vendor-released patches are available in Linux 7.2, 7.1.9, and 6.18.45.
Use-after-free in the Linux kernel perf/core subsystem allows a local low-privileged user to dereference freed kernel memory by racing CPU hot-unplug against perf event group management. When a sibling event is detached via DETACH_GROUP during CPU hotplug, its group_leader pointer is not reset; if the leader is subsequently freed while the sibling's file descriptor remains open, a PERF_IOC_FLAG_GROUP ioctl on the sibling follows the stale pointer into freed memory, potentially enabling kernel crash or privilege escalation to root. No public exploit has been identified at time of analysis and EPSS is low at 0.21% (11th percentile), but the local exploit path with full C:H/I:H/A:H impact warrants prompt patching, particularly on systems permitting unprivileged perf_event_open access.
Out-of-bounds memory read in the Linux kernel's fbdev bitblit subsystem allows a local attacker with tty group write access to /dev/vcsa to crash the kernel or disclose kernel memory by supplying an out-of-range glyph index through the virtual console screen interface. The root cause is a missing bounds check in bit_cursor() in drivers/video/fbdev/core/bitblit.c - a sibling function to bit_putcs_aligned() and bit_putcs_unaligned(), which already received the same clamp in commit 18c4ef4e765a. No public exploit has been released and EPSS of 0.22% (13th percentile) indicates very low active exploitation probability; this is not in CISA KEV.
Use-after-free in the Linux kernel's ring-buffer tracing subsystem exposes non-consuming reader iterators to dangling memory when subbuffer order changes occur while resizing is disabled. The vulnerable function ring_buffer_subbuf_order_set() frees buffer pages without checking the resize_disabled flag, leaving rb_advance_iter() holding stale references to freed memory. Exploitation requires local low-privilege access; no public exploit or CISA KEV listing exists, but vendor patches are available across multiple stable kernel branches.
Race condition in the Linux kernel's mm/huge_memory subsystem allows local low-privilege users to trigger misidentification of the huge zero folio as an ordinary Transparent Huge Page (THP), potentially leading to memory corruption, incorrect folio splitting, and privilege escalation. Affected kernels spanning multiple stable branches from at least 4.19 onward are vulnerable when !CONFIG_PERSISTENT_HUGE_ZERO_FOLIO is in effect, with patched versions available for 6.12, 6.18, 7.1, and 7.2 stable series. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog; EPSS places exploitation probability at the 11th percentile.
Use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local attacker to trigger kernel memory corruption via a refcount underflow in smc_rx_splice(). The flaw arises because pages are handed to splice_to_pipe() before page and socket references are taken, so entries dropped by smc_rx_spd_release() are released without a matching reference, and multi-page splices pair one sock_hold() with multiple sock_put() calls. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.21% (12th percentile), consistent with limited real-world weaponization at this time.
Use-after-free in the Linux kernel's IPv6 stack allows a local low-privileged user to corrupt kernel memory with full high/integrity/availability impact. The race condition exists in in6_dev_get(), where dev->ip6_ptr is read under RCU and its refcount is then unconditionally incremented - device teardown can zero the pointer and drop the final reference between those two operations, resurrecting a freed inet6_dev object. No public exploit identified at time of analysis, though a proof-of-concept reproducer was confirmed functional on the unpatched v7.2-rc3 kernel by OpenAI Security Research and validated by Trail of Bits.
Heap out-of-bounds write in OpenEXR's DeepImage API affects all versions prior to 3.2.10, 3.3.12, and 3.4.13, exploitable by processing a crafted deep image EXR file. A coordinate axis confusion bug in `Imf_4_0::SampleCountChannel::set()` uses `dataWindow.min.x` instead of `dataWindow.min.y` when computing a target Y coordinate, causing memory writes before the allocated `_numSamples` heap buffer when `min.x ≠ min.y`. No public exploit identified at time of analysis; SUSE Linux Enterprise distributions have received vendor-released patches confirming active remediation.
Process-aborting denial of service in OpenEXR 3.4.0 through 3.4.12 allows an unauthenticated remote attacker to crash any application that calls exr_start_read() on a crafted HTJ2K-compressed EXR file. The crash originates in the vendored OpenJPH library, which invokes abort() unconditionally when a QCD marker's lower five bits are zero - an assertion failure that OpenEXR's partial error handling cannot intercept because codestream read and construction calls are left unprotected. No public exploit has been identified at time of analysis; the vulnerability is patched in version 3.4.13.
Stack-based out-of-bounds write in OpenEXR's HTJ2K decode path allows remote attackers to crash applications that process crafted EXR image files. Affected are OpenEXR versions 3.4.0 through 3.4.13, where the vendored OpenJPH AVX2 decoder fails to reject JPEG 2000 SIZ marker geometries in which the first tile does not intersect the visible image, leading to invalid codeblock computation and a stack memory corruption that terminates the process. No public exploit identified at time of analysis; a vendor-released patch is available in version 3.4.14.
CRI-O's container-creation code path crashes the daemon with an unrecovered Go runtime panic when processing an OCI image whose config.Env contains a malformed entry lacking an '=' character, under the specific condition that the CreateContainer request supplies a nil CRI Envs field. The crash terminates the crio daemon process, disrupting all container workloads on the affected node until the service is manually restarted - a node-wide denial of service. Affecting Red Hat OpenShift Container Platform 4, this requires high privileges (PR:H) to exploit; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial-of-service in Mistune Python Markdown parser versions 3.3.0-3.3.2 allows remote unauthenticated attackers to crash any process that renders user-supplied Markdown by submitting input with hundreds of consecutive asterisk characters. The recursive HTMLRenderer.render_token() traversal grows proportionally to emphasis nesting depth and exceeds Python's default recursion limit, raising an unhandled RecursionError that terminates the parsing process. No public exploit identified at time of analysis, though the fix commit itself demonstrates the attack pattern explicitly in its regression test suite.
Issuer-validation bypass in joserfc (Python JOSE library) prior to version 1.7.3 allows an attacker to craft a JWT with an array-valued `iss` claim - e.g., `["expected-issuer"]` - that passes the JWTClaimsRegistry equality check via Python membership matching (`in` operator on a list) rather than strict string equality. The same flaw affects `sub` claim validation. No public exploit has been identified at time of analysis, but the commit diff confirms the root cause and fix; EPSS data was not provided in the input.
DNS-based server-side request forgery in jackson-databind exposes any Java application that deserializes user-supplied JSON into objects containing `java.net.InetAddress`-typed fields, causing the library to perform unsolicited outbound DNS lookups against attacker-controlled hostnames. Affected across all major release lines from 2.x through 3.x (com.fasterxml and tools.jackson.core artifact groups), the flaw allows unauthenticated remote attackers to enumerate internal hostnames and map internal network topology via DNS side-channels. No active exploitation or public exploit code has been identified; vendor patches are available across all affected release lines.
Stack exhaustion and a bounded memory over-read in GIMP's file-pix (ESM) plugin allow a crafted PIX image to crash the application and leak 21 bytes of stack memory into an intermediate file. Users running GIMP on Red Hat Enterprise Linux 6 through 9 are affected when opening untrusted PIX format images. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the DoS impact is reliable and the delivery vector - a malicious image file - is realistic for desktop users.
Integer overflow in GIMP's file-pcx plugin on 32-bit builds enables a heap-based buffer overflow when a user opens a specially crafted PCX image, potentially leading to arbitrary code execution or denial of service. The flaw is architecturally constrained to 32-bit builds - 64-bit installations are unaffected - and exploitation additionally requires user interaction to open the malicious file. No active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis.
Header injection via structured-mode CloudEvents in Apache Camel's Knative consumer enables unauthenticated SSRF, path traversal, and message-dispatch redirection against routes that forward to header-driven components. The flaw exists because CloudEvent extension fields in structured content mode (Content-Type: application/cloudevents+json) are copied directly into Camel Exchange headers without applying the KnativeHttpHeaderFilterStrategy that correctly guards the binary content-mode path - an incomplete fix of the same filter-bypass pattern addressed across multiple related CVEs (CVE-2025-27636, CVE-2025-29891, CVE-2025-30177, CVE-2026-40453, CVE-2026-47323). No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface - unauthenticated HTTP POST to a Knative endpoint - requires no special tooling.
JWT claim validation in Apache Camel's Platform HTTP Main component silently fails to enforce issuer and audience constraints when neither jwtIssuer nor jwtAudience is configured, causing the embedded Vert.x HTTP server to accept any unexpired token signed by any key in the trusted keystore. Affected are Apache Camel versions 4.8.0 through 4.21.x across both the application server and management server paths. An attacker who possesses a valid JWT from any identity provider trusted by the configured keystore - such as a token legitimately issued for a different service in a shared IdP environment - can authenticate to the Camel HTTP endpoints without holding credentials intended for that service. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
Incomplete remediation of CVE-2025-9615 in NetworkManager exposes WPA-Enterprise (802.1X) connections to server certificate validation bypass on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. An unprivileged local user can set the 802-1x.ca-path or phase2-ca-path properties of a private connection profile to an attacker-controlled directory because the private_user restriction was never applied to these directory-valued fields. When the victim system subsequently connects to a wireless network, the bypassed CA validation enables credential theft via a rogue access point presenting a certificate signed by the attacker-supplied CA. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis; however, SSVC rates the attack as automatable with total technical impact once local access exists.
SSRF vulnerabilities in AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) allow an authenticated organization notification administrator to cause the AWX control node to issue outbound HTTP requests to internal, loopback, or RFC-1918 addresses that are not externally reachable. Beyond basic SSRF, the webhook backend compounds the risk by following HTTP redirects and replaying configured Basic Authentication credentials to the redirect destination regardless of host change, enabling credential exfiltration to attacker-controlled endpoints; the Grafana backend similarly exposes its API key by forwarding the Authorization header verbatim to any configured target URL. No public exploit has been identified at time of analysis, but the Changed scope and high confidentiality impact in the CVSS vector reflect significant real-world risk given the network position AWX control nodes typically occupy.
Path traversal in AWX's project_archive action plugin allows arbitrary file writes to execution node filesystems outside the intended project directory. Red Hat Ansible Automation Platform 2 is affected when processing zip or tar archives whose member filenames contain directory traversal sequences. An attacker who controls archive content - via admin-level project configuration, a compromised upstream archive source, or a man-in-the-middle attack on an unencrypted HTTP fetch - can write files as the extraction user and escalate to remote code execution through cron entries, SSH authorized_keys injection, or playbook content poisoning. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Use-after-free memory corruption in WebKitGTK exposes Red Hat Enterprise Linux 6 through 9 systems to potential arbitrary code execution when users process attacker-controlled web content. The flaw (CWE-416) stems from improper memory management in the web engine's content rendering pipeline, where a freed heap allocation is subsequently accessed, enabling heap corruption. No public exploit code or CISA KEV listing has been identified at time of analysis; operational urgency derives from the CVSS 8.8 score, the broad RHEL deployment footprint, and the well-understood exploitability of use-after-free conditions in browser engines.
SQL injection in TypeORM's SelectQueryBuilder.distinctOn enables database enumeration against PostgreSQL-backed applications that pass client-controlled values into the API without validation. The distinctOn array is joined and interpolated verbatim into a SELECT DISTINCT ON (...) clause in src/query-builder/SelectQueryBuilder.ts, bypassing the driver's escape helper and the allowlist guard (validateOrderByCondition) that protects the orderBy family. Because the injection point is a parenthesized SQL expression list, attackers can supply correlated subqueries and perform boolean or time-based blind inference against any table reachable by the application's database role, independent of the queried entity. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Symlink-following during ZIP extraction in adm-zip 0.5.9 through 0.6.0 allows a local attacker who can plant a symlink inside the extraction directory to overwrite arbitrary files accessible by the extracting process. Utils.writeFileTo calls fs.openSync without O_NOFOLLOW and performs no pre-write lstat check, so a pre-positioned symlink transparently redirects the write - and a subsequent chmod - to any target outside the extraction root without any path-traversal sequence appearing in the archive. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, but the impact is high in shared or predictable extraction environments such as CI pipelines and multi-tenant temp directories.
Path traversal in webpack-dev-middleware bypasses the incomplete CVE-2024-29180 fix by embedding dot-dot sequences within path segments (e.g., 'assets..') rather than as standalone segments, causing the UP_PATH_REGEXP guard to pass while the subsequent fixed-offset slice produces a parent-directory component that resolves above outputPath on the physical filesystem. Affected versions are precisely 5.3.4+, 6.1.2+, and 7.1.0+ - the releases that introduced the original guard-and-slice logic intended to fix path traversal. Exploitation is constrained to non-default configurations where publicPath lacks a trailing slash and the physical filesystem is in use via writeToDisk: true or a custom outputFileSystem; no public exploit identified at time of analysis, though a functional PoC for the predecessor attack class exists in GHSA-wr3j-pwj9-hqq6.
Improper certificate validation in JSS (Java Security Services) allows the JSSTrustManager class to accept CA certificates from the NSS database that lack TRUSTED_CA trust flags, meaning certificates never explicitly designated as trust anchors can still be used to anchor TLS chains. In non-default deployments where certificate revocation checking has been disabled, this creates a viable path for a man-in-the-middle attacker to forge certificates accepted by PKI client connections, with high confidentiality and low integrity impact. No public exploit has been identified at time of analysis, and the AC:H CVSS rating reflects the meaningful attack complexity - MITM positioning plus a specific non-default configuration must both be present.
Server-side request forgery in Hugo static site generator (versions 0.91.0 through 0.165.0) allows an attacker who can supply a URL through site content - via front-matter fields or a connected CMS - to silently fetch loopback, RFC 1918, or cloud-metadata endpoints during the build process, embedding the internal response directly into the published static output. The security.http.urls allowlist, Hugo's only guard on resources.GetRemote outbound fetches, evaluates hostname strings without performing DNS resolution, meaning any registered domain whose A record points to a private or metadata IP bypasses the policy entirely, and no dial-time hook in the HTTP client provides a second check. No public exploit code has been identified at time of analysis, but the attack requires only DNS control and content-write access, making it operationally straightforward in CI/CD-integrated deployments.
Server-side request forgery and address-policy bypass in fast-uri, the Node.js URI parser used widely in the fastify ecosystem, allows remote unauthenticated attackers to redirect outbound requests from a target application to local or private IPv6 addresses by submitting crafted bracketed IPv6 literals with invalid trailing characters. The custom IPv6 parser silently normalizes malformed literals - collapsing some to the unspecified address (loopback) and others to private-range addresses - and returns no error on the parsed result, defeating any application-level error checking. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no special privileges and low complexity, making automated exploitation plausible against any exposed application that normalizes untrusted URLs through an affected fast-uri version.
Heap exhaustion via unbounded memory leak in micrometer-core affects Java applications using Apache HttpAsyncClient (4.x or 5.x) instrumented with MicrometerHttpClientInterceptor. When asynchronous HTTP requests fail before receiving any server response - due to connection resets, network timeouts, or unreachable endpoints - the per-request tracking state allocated by the interceptor is never released, accumulating indefinitely on the JVM heap. Sustained failure conditions (such as a misbehaving or attacker-controlled upstream server) can drive heap exhaustion to OutOfMemoryError, crashing the instrumented application. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows network-accessible, unauthenticated attackers to supply percent-encoded slashes in the scheme component, causing the library to report host as undefined during parsing while serialization emits a network-path reference with an attacker-controlled authority. Applications that allowlist requests on the parsed host value, or that treat a no-authority parse result as safe to resolve against a base URI, are bypassed - enabling server-side request forgery, off-site redirects, and address-policy evasion. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special configuration, making affected deployments an immediate upgrade priority.
Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and host-policy bypass primitive in versions 2.4.1-2.4.4, 3.1.2-3.1.5, and 4.0.0-4.1.2. The library decodes percent escapes once during hostname parsing and again during authority recomposition, so a single normalize or resolve call on a doubly-encoded input can silently resolve to a different network destination - including loopback addresses - than the encoded form represents. Any application layer sitting fast-uri in front of outbound routing guards, redirect allow-lists, or host-policy checks is therefore vulnerable to SSRF. This is an incomplete-fix variant of CVE-2026-6322; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsistent host canonicalization between the library's own entry points. When a scheme-relative reference (e.g., //unicode-host.example/path) is passed without an explicit scheme, fast-uri's parse, normalize, and equal functions return the host verbatim, while resolve canonicalizes it to ASCII/Punycode - meaning the same input yields different host values depending on which API is called. An application that extracts a host for an allowlist check via one code path and then resolves the URI via another can be tricked into approving one host while the actual request is dispatched to a different one. No public exploit exists and CISA KEV listing is absent, but the EPSS-independent integrity impact (CVSS I:H) is real in applications relying on fast-uri for security-critical URI validation. Fixed versions are 2.4.5, 3.1.6, and 4.1.3.
Out-of-bounds write in warmcat libwebsockets 4.5.0 allows remote unauthenticated attackers to corrupt process memory by submitting crafted CBOR-encoded data to any network-accessible endpoint using the LECP CBOR parser. The root cause is a dual defect in `lecp_parse` and `report_raw_cbor` within `lib/misc/lecp.c`: an equality-only bounds check (`== sizeof(ctx->cbor)`) fails to catch cases where `cbor_pos` has already exceeded the buffer limit, and `cbor_pos` was reset after rather than before the flush callback, creating a window for sequential over-increment. No public exploit identified as confirmed active exploitation (CISA KEV), but a public proof-of-concept is confirmed at the referenced GitHub repository, and a patch commit has been issued upstream.
Heap-based buffer overflow in libtiff's rgb2ycbcr command-line utility enables potential arbitrary code execution when a user processes a specially crafted TIFF image. The root cause is a CWE-190 integer overflow in the cvtRaster() function's strip buffer size computation: the arithmetic wraps to an undersized value, and subsequent YCbCr conversion writes spill beyond the allocated heap region. A publicly shared GitHub gist (okyfh) suggests proof-of-concept material may be available; an upstream fix commit exists in the libtiff GitLab repository, though no tagged release version has been independently confirmed at time of analysis.
Arbitrary code execution in libtiff's tiffcrop utility (commit 85f2ac8e) stems from the process_command_opts() function in tools/tiffcrop.c, classified as CWE-94 code injection. An attacker who can influence the input processed by tiffcrop can trigger execution of arbitrary code. Publicly referenced proof-of-concept material appears to exist via a linked gist, but the flaw is not in CISA KEV and EPSS is low (0.16%, 5th percentile), indicating no evidence of widespread active exploitation.
Race condition in the Linux kernel's GPIO PCA953x driver allows local low-privileged users on systems with PCA953x I2C GPIO expander hardware to trigger incorrect register reads or writes by exploiting missing mutex coverage in pca953x_irq_bus_sync_unlock(). A prior partial fix protected only the interrupt mask register write but left the direction register read unguarded, permitting concurrent threads to interleave I2C transactions and corrupt GPIO expander state on affected kernel stable branches including 6.1.101-6.2, 6.6.42-6.7, and 6.9.11-6.10. No public exploit has been identified and EPSS exploitation probability is 0.20% at the 10th percentile, consistent with negligible real-world exploitation interest.
Use-after-free in the Linux kernel's sched_ext (extensible BPF scheduler) subsystem allows a local low-privileged attacker to corrupt kernel memory, potentially achieving full confidentiality, integrity, and availability compromise of the affected system. The race condition arises when a sub-scheduler enable fails before being linked into the scheduler hierarchy, yet the full teardown path still executes concurrently against root scheduler disable, causing tasks to be re-homed onto an already-freed scheduler hierarchy. No public exploit or POC has been identified at time of analysis, and EPSS at 0.20% (10th percentile) reflects negligible observed exploitation activity.
A use-after-free in the Linux kernel's NFSv4 client can occur when a FREE_STATEID operation is delayed and the associated 'struct nfs_server' is torn down (for example on unmount) while the operation is still in flight, leaving the RPC referencing freed memory. The fix pins the nfs_server by bumping its refcount for the duration of the FREE_STATEID call. This is a client-side race condition, not a server-facing service bug; no public exploit identified at time of analysis, and EPSS is low (0.22%, 13th percentile).
Use-after-free in the Linux kernel's ovpn (in-kernel OpenVPN data-channel offload) module lets a local privileged attacker corrupt kernel memory by racing peer-management operations. A time-of-check/time-of-use window between ovpn_peer_get_by_id() and acquisition of ovpn->lock allows a peer that was concurrently removed to be re-inserted into the rehash tables, resurrecting a peer userspace believes is gone and leaving embedded hash entries linked to memory later freed via call_rcu. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), consistent with a hard-to-win kernel race rather than a mass-exploitable bug.
Null-pointer dereference and promiscuity counter underflow in the Linux kernel bonding driver's ALB monitor can crash the kernel or permanently pin a network interface in promiscuous mode. The bond_alb_monitor() workqueue function reads primary_is_promisc under RCU, drops that lock, then acquires RTNL - allowing the active slave to be removed or changed in the intervening window, leaving the monitor to act on stale state. Linux systems from kernel 2.6.24 through unpatched stable branches (5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, 7.2) with network bonding explicitly configured in ALB mode are affected. No public exploit identified at time of analysis.
Use-after-free in the Linux kernel's enic driver (Cisco VIC Ethernet NIC) allows a local attacker with low privileges to corrupt kernel heap memory during network device removal. The enic_remove() teardown function fails to cancel or disable the tx_hang_reset work item, creating a race window where a TX watchdog timeout can reschedule enic_tx_hang_reset() to execute after free_netdev() has already released the underlying network device structure. No public exploit exists and EPSS probability is 0.21% (11th percentile), though the kernel use-after-free primitive carries high C/I/A impact if reliably triggered.
Out-of-bounds write in the Linux kernel's IPVS subsystem (`ip_vs_nat_icmp`) allows a local attacker with low privileges to corrupt kernel memory by exploiting a TOCTOU race on the IP header length field (`ihl`), which is read multiple times during ICMP packet NAT processing. Affected systems include any Linux kernel from version 2.6.12 through the pre-patch range across multiple stable branches (fixed in 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2). An attacker achieving kernel memory corruption via this path could escalate privileges to full kernel control; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Linux kernel btrfs LZO decompression path allows a crafted btrfs filesystem image to trigger a slab-out-of-bounds (and potentially extent-buffer-boundary) read when an inline LZO-compressed file extent is read. The flaw affects the kernel's btrfs module from 2.6.38 onward and is fixed upstream; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.20%). Despite an input CVSS of 9.8 (network vector), the actual defect requires local mounting/reading of an attacker-crafted image, making it a local availability/disclosure issue rather than remote code execution.
Reference count underflow in the Linux kernel amdxdna (AMD XDNA NPU accelerator) driver allows a local low-privileged user to corrupt kernel memory via a double invocation of vm_ops->close() triggered by failed mmap page insertions. Two error paths in amdxdna_insert_pages() incorrectly release the shmem pages_pin_count and backing GEM object reference while the VMA remains live; the kernel's subsequent VMA teardown fires vm_ops->close() a second time, producing a reference count underflow with potential use-after-free consequences and high impact across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and EPSS is 0.20% (10th percentile), consistent with the niche AMD Ryzen AI hardware requirement limiting real-world exposure.
Privilege escalation in the Linux kernel BPF verifier affects versions from 4.16 through current stable branches due to incomplete pointer state propagation during commuted arithmetic (scalar += pointer) in adjust_ptr_min_max_vals(). Local attackers with BPF program loading privileges can exploit the verifier's failure to copy the full bpf_reg_state structure, potentially bypassing memory safety enforcement and achieving arbitrary kernel memory access. No public exploit has been identified at time of analysis and EPSS is low at 0.22%, but the CVSS score of 7.8 (C:H/I:H/A:H) reflects the severity of kernel-level impact if successfully exploited.
Kernel panic in Linux mlx5 (Mellanox/NVIDIA ConnectX) driver's firmware tracer subsystem allows a system crash when the devlink health reporter fires on a device where fw_tracer initialization returned ERR_PTR rather than NULL. The stored ERR_PTR is never validated against IS_ERR() before dereference in mlx5_fw_tracer_trigger_core_dump_general, resulting in an Oops and fatal kernel panic as confirmed by the full crash trace in the CVE description. No public exploit has been identified at time of analysis; EPSS is 0.22% (13th percentile), and the vulnerability is not listed in CISA KEV - though the availability impact when triggered is total (system crash). Multiple patched stable-kernel versions are available.
Reference imbalance in the Linux kernel's BPF conntrack kfuncs allows a local attacker with BPF privileges to trigger an unmatched put_net() call that can destroy a live network namespace and cause kernel panic. The flaw affects __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry(), where opts->netns_id is read non-atomically from a shared BPF map value during both namespace acquisition and release. No public exploit code exists and EPSS is low (0.20%, 10th percentile), but the kernel panic outcome is confirmed by a crash trace in the advisory. Exploitation requires local BPF capability and a concurrent writer to the shared map.
Use-after-free in the Linux kernel's BPF TCP iterator exposes systems running kernel versions from 5.15 onward to local privilege escalation with high impact across confidentiality, integrity, and availability. The race condition in bpf_iter_tcp_established_batch() allows a low-privileged local attacker to hold a reference to a request_sock whose refcount is still zero, corrupting kernel memory when the publishing CPU's refcount_set() subsequently overwrites the saturated value. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), though the race is described as reproducible within seconds under controlled conditions with tcp_syncookies=0.
Unbounded memory allocation in the Linux kernel's vhost_iotlb subsystem allows availability impact on the host system via exhaustion of kernel memory. The flaw exists in vhost_iotlb_add_range_ctx(), where non-retiring IOTLB tables bypass the configured entry limit and continue allocating entries indefinitely - including via guest-controlled or userspace requests to vhost, mlx5 vDPA, VDUSE, and vhost-vDPA subsystems. No public exploit code has been identified at time of analysis, and EPSS probability is very low (0.20%), but the CVSS scope-change metric (S:C) reflects that a guest workload can impact host kernel availability.
Out-of-bounds kernel slab read in the Linux kernel's mlx5 vDPA driver (vdpa/mlx5) allows a local actor managing vDPA devices to trigger a 16-byte over-read in create_direct_keys(). The flaw stems from a mismatch between the computed input length (which includes the 'out' field) and the pointer passed to cmd_exec() (which skips 'out'), causing mlx5_copy_to_msg() to read past a 4384-byte allocation. No public exploit identified at time of analysis; EPSS is low (0.21%) and it is not in CISA KEV.
Type confusion in the Linux kernel's PMBus hardware monitor driver (`pmbus_notify()`) enables a slab-out-of-bounds read and potential kernel memory corruption on systems with PMBus-capable power management hardware. The `pmbus_notify()` loop unconditionally casts all attribute pointers to `struct sensor_device_attribute`, but the attribute array also contains `struct pmbus_samples_reg` and `struct pmbus_sensor` objects that only embed a base `struct device_attribute`; reading the `index` field of these miscast pointers accesses memory beyond the allocation or overlaps with unrelated kernel struct fields, producing garbage masks that could spuriously match alert conditions. No public exploit has been identified and EPSS is low (0.21%, 11th percentile), but the theoretical impact is full kernel privilege escalation on affected hardware.
Out-of-bounds kernel memory read in the Linux kernel AF_XDP subsystem allows a local low-privileged user to trigger reads beyond registered memory regions by supplying TX metadata shorter than 16 bytes. Affected systems include Linux kernel versions from the introduction of commit 341ac980eab9 through multiple stable branches, with patches available at 6.12.104, 7.1.9, and 7.2. No public exploit has been identified and EPSS is 0.21% (11th percentile), indicating low current exploitation activity despite the high CVSS score.
Memory corruption in the Linux kernel's AF_XDP socket (xsk) subsystem arises from two related flaws: missing size validation for launch-time metadata fields that extend beyond the first 16 bytes of struct xsk_tx_metadata, and a race condition where user space can modify transmit flags concurrently with kernel transmit processing. A local attacker with low-privilege access who can create and configure AF_XDP sockets may trigger out-of-bounds memory access, leading to high-impact compromise of confidentiality, integrity, and availability consistent with the CVSS 7.8 score. No public exploit code has been identified, EPSS sits at 0.21% (11th percentile), and the CVE is absent from CISA KEV, placing practical exploitation risk well below what the raw CVSS score might suggest.
The AF_XDP zero-copy TX path in the Linux kernel exposes a time-of-check/time-of-use (TOCTOU) race condition that allows a local low-privileged user to bypass TX metadata validation enforced by the kernel. Metadata is validated during descriptor context acquisition but re-read without re-validation when the hardware request is prepared, creating a window during which userspace can overwrite the shared ring buffer entry with arbitrary values. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) reflects low near-term exploitation probability, though the CVSS 7.8 High rating with C:H/I:H/A:H captures the potential for full kernel-level impact on affected systems.
Use-after-free in the Linux kernel's UDP tunnel GSO segmentation path (__skb_udp_tunnel_segment()) occurs when the code dereferences a saved UDP header pointer after a skb_pull() reallocates skb->head, invalidating that pointer. The flaw affects hosts that software-segment UDP-encapsulated tunnel traffic (VXLAN/GENEVE/FoU), and can lead to a kernel crash or potential information disclosure. No public exploit is identified at time of analysis, EPSS is low (0.22%), and the issue is not on CISA KEV; the upstream fix reorders the header fetch to occur after the pull.
Remote denial of service in the Linux kernel's CAKE traffic scheduler (sch_cake) allows an unauthenticated network attacker to trigger a kernel panic or persistent warning-log flood by sending malformed IP packets to a system with the CAKE qdisc actively configured. Affected systems running Linux 4.19 through unpatched versions of the 7.x series face kernel panic if the non-default `panic_on_warn=1` boot parameter is set, or dmesg flooding otherwise. No public exploit has been identified and this CVE is not in the CISA KEV catalog, but the fix is low-risk and multiple patched stable kernel versions are available.
Kernel panic in Linux kernel's vhost-scsi subsystem can be triggered by a malicious guest VM when T10 Protection Information (PI) is negotiated, crashing the host kernel and all co-hosted virtual machines. A guest sends a malformed SCSI request with protection byte lengths equal to or exceeding the payload, causing an integer underflow or zero-count scatterlist that hits an unconditional BUG_ON assertion in sg_alloc_table_chained(). With EPSS at 0.21% (11th percentile), no CISA KEV listing, and no public proof-of-concept identified at time of analysis, exploitation probability is currently low but the guest-to-host scope change makes this a meaningful availability risk in multi-tenant virtualized storage environments.
The vhost-scsi subsystem in the Linux kernel allows a local attacker with low privileges on a KVM virtualization host to trigger a kernel BUG_ON assertion and crash the host by manipulating VIRTIO feature bits after SCSI endpoint setup. The flaw is that vhost_scsi_set_features() incorrectly accepted changes to VIRTIO_SCSI_F_T10_PI after an active endpoint was established, leaving per-command protection scatterlist arrays (prot_sgl) unallocated while the I/O path proceeded under the updated feature state; when a 129-page protection payload arrives, a BUG_ON(nents > SG_CHUNK_SIZE) fires in sg_pool_index(), panicking the host kernel. Patches are confirmed for stable branches 6.18.45 and 7.1.9 and mainline 7.2; no public exploit exists and no CISA KEV listing is present, with an EPSS of 0.21% (11th percentile).
Kernel BUG triggerable in the Open vSwitch (OVS) net subsystem allows a local low-privileged attacker to crash the kernel or potentially escalate privileges by injecting undersized Ethernet frames through a TUN device. Affected kernels from Linux 4.10 onward trust the user-supplied skb->protocol field on ARPHRD_NONE devices without validating that sufficient linear data exists for Ethernet header parsing, causing __skb_pull() to hit an unconditional BUG halt. No public exploit code has been identified and EPSS probability stands at 0.22% (13th percentile), indicating low opportunistic exploitation risk; however, patches are available across all active stable branches.
Use-after-free in the Linux kernel's traffic control classifier API (net/sched/cls_api) allows a local attacker with CAP_NET_ADMIN to corrupt kernel memory by racing two concurrent tc_new_tfilter() calls targeting the same chain and priority with different classifier types. A proof-of-concept is referenced in the upstream kernel commit but is not independently confirmed as publicly released. EPSS is 0.21% and the vulnerability is not listed in CISA KEV, indicating no observed widespread exploitation at time of analysis.
Data corruption in the Linux kernel bnxt_en driver (Broadcom NetXtreme-E) occurs when TCP Packet Aggregation (TPA) is active alongside PCIe Relaxed Ordering (RO) on AGG rings. When EOP (End-of-frame padding) is used, zero-padding bytes appended at the end of one aggregated segment can spill over and overwrite valid data at the start of the subsequent segment. Older chips (P5 generation and earlier, including the Broadcom 57508) do not automatically suppress RO when EOP is active, making ARM-hosted deployments using these adapters particularly vulnerable to silent data corruption in received network traffic. No public exploit is identified at time of analysis, and EPSS probability is low at 0.21% (12th percentile).
TCP Fast Open queue accounting in the Linux kernel becomes inaccurate following SO_REUSEPORT listener migration, permitting far more pending TFO connection requests than the configured TCP_FASTOPEN max_qlen limit allows. The root cause is a counter mismatch: fastopenq.qlen is charged against the original listener during child creation in tcp_fastopen_create_child() but uncharged against a different socket after inet_reqsk_clone() repoints the migrated child's rsk_listener to the new listener, causing the surviving listener's qlen to drift negative and its max_qlen guard to stop firing. No public exploit has been identified and EPSS stands at 0.21% (12th percentile), but any server combining SO_REUSEPORT with TCP Fast Open is vulnerable once listener migration has occurred.
Reference count leak in the Linux kernel netfilter flowtable offload path allows a remote attacker to cause a denial of service by sending network packets through a system with nf_flow_table offload configured. The flaw occurs in nf_flow_offload_ip_hook() and the XFRM offload path when skb_dst_set_noref() overwrites an existing ref-counted dst_entry without first dropping it, leaking the reference and triggering a DEBUG_NET_WARN_ON_ONCE kernel assertion. No public exploit has been identified at time of analysis; EPSS of 0.21% (11th percentile) and absence from CISA KEV confirm low opportunistic exploitation activity. Upstream patch commits and fixed stable releases 6.18.45, 7.1.9, and 7.2 are available.
Kernel memory exhaustion in the Linux net/smc subsystem enables remote denial-of-service against servers using SMC listen sockets. A TOCTOU race between smc_listen_out() and listener socket close allows an unauthenticated remote attacker to enqueue child socket objects onto a dead listener - each leaking a smc_sock, clcsock, and unreleased reference - by flooding TCP connections during the server's close() window. Patches are confirmed available across multiple stable kernel branches (5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2+); no public exploit code or CISA KEV listing has been identified at time of analysis.
Slab-out-of-bounds read in the Linux kernel's ATM subsystem `vcc_setsockopt()` exposes kernel heap memory and can crash the kernel for local low-privileged users. The defect stems from a short-circuited optlen validation - when the caller passes a mismatched `level` parameter, the length check is bypassed entirely, and a secondary path through cgroup BPF setsockopt filters can shrink optlen after a passing check, both leading to `copy_from_sockptr()` reading beyond the supplied buffer. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.24% at the 16th percentile, reflecting low real-world exploitation probability against a legacy subsystem.
Use-after-free in the Linux kernel's SCTP (Stream Control Transmission Protocol) subsystem allows a remote peer to trigger a dangling transport-pointer dereference on the control chunk queue. The flaw arises because sctp_make_heartbeat_ack() caches a destination transport in chunk->transport without holding a reference; when src_out_of_asoc_ok keeps a HEARTBEAT ACK queued and the peer transport is later torn down, the queued chunk retains a stale pointer that is dereferenced on eventual transmission. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is low at 0.22% (13th percentile). A vendor patch is available in multiple stable trees.
Use-after-free race condition in the Linux kernel at91sam9_wdt watchdog driver allows a local attacker with low privileges on affected AT91 SAM9 SoC hardware to corrupt freed memory, potentially achieving kernel-level code execution. The flaw arises because at91_ping() rearms a kernel timer from within its own callback, while timer_delete() neither waits for an in-flight callback to finish nor prevents rearming - leaving a window during probe failure or driver removal where the timer accesses devm-allocated memory that has already been freed. No public exploit has been identified at time of analysis, and EPSS probability is very low (0.21%, 11th percentile), consistent with the hardware-specific and timing-dependent nature of this race.
NULL pointer dereference in the Linux kernel's tap_get_user_xdp() function can be triggered by a local attacker or malicious guest VM to crash the host kernel. The flaw arises because skb->dev is not assigned before tun_vnet_hdr_to_skb() is called in the XDP path, while the parallel code path tap_get_user() had already received a fix for the identical ordering defect. Impact is limited to availability - host kernel panic - with no confidentiality or integrity compromise possible. No public exploit or CISA KEV listing has been identified; EPSS at 0.21% reflects negligible observed exploitation activity.
Memory exhaustion in the Linux kernel's ax88179_178a USB Ethernet driver allows socket buffers to leak on every failed TX linearization attempt under memory pressure. Systems with ASIX AX88179 or AX88178A USB-to-Ethernet adapters loaded with scatter-gather (NETIF_F_SG) enabled are affected: when skb_linearize() fails inside ax88179_tx_fixup(), the function returns NULL without freeing the original skb, and the caller usbnet_start_xmit() never releases it because its local skb pointer is now NULL. No public exploit has been identified and EPSS probability is negligible (0.21%, 12th percentile); the practical risk is gradual kernel memory exhaustion on systems continuously operating under low-memory, high-TX-load conditions with the specific USB hardware connected.
Race condition in the Linux kernel virtual terminal subsystem exposes a use-after-free condition when kbd_keycode() reads vc->port.tty without holding a reference, while con_shutdown() concurrently clears that pointer under a separate lock. Affected versions span every maintained stable series from 5.10 through 7.x; patches are available across all branches. No public exploit code exists and EPSS is very low at 0.22% (13th percentile), but the CVSS 7.8 local score reflects real kernel memory corruption potential that could enable privilege escalation.
Incorrect TLB flush address targeting in the Linux kernel's zap_pte_range memory management function exposes systems running kernel versions prior to 7.1.9 and 7.2 to local privilege escalation and information disclosure, particularly on AMD systems with EFER.TCE enabled and Intel systems using INVPCID. A low-privileged local attacker can exploit a race where the kernel flushes the wrong virtual address after freeing a page table, leaving stale CPU paging-structure-cache entries that can be speculatively accessed or cause the freed table to be reused with potentially attacker-controlled data. No public exploit code or active exploitation (CISA KEV) has been confirmed at time of analysis, and the 0.20% EPSS score reflects the complexity of reliable exploitation.
Out-of-bounds write in the Linux kernel IPVS estimator subsystem allows a low-privileged local attacker to corrupt kernel memory through a race condition between network namespace teardown and IPVS kthread initialization. When ipvs->enable is cleared while kthread 0 is mid-way through its calculation phase, ip_vs_enqueue_estimator() writes past the ticks and tick_len arrays using zero-initialized limits, producing high-impact memory corruption on affected kernels from the 6.6.x through 7.1.x stable series. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) reflects very low near-term exploitation probability despite the high CVSS 3.1 base score of 7.8.
Stack out-of-bounds write in the Linux kernel IPVS (IP Virtual Server) subsystem lets a remote attacker corrupt the __icmp_send() stack when a director rebases ICMP errors for tunneled traffic. In ip_vs_in_icmp() the skb is rebased from the outer ICMP packet to the quoted original request, but IPCB(skb)->opt still describes the outer IPv4 header, so a stale timestamp-option offset points into the quoted transport header and __ip_options_echo() copies an attacker-influenced byte as an option length into fixed-size stack storage. There is no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile), consistent with a subsystem-specific memory-corruption bug rather than a mass-exploitation candidate.
Race condition in the Linux kernel's AF_PACKET TX_RING send path allows a low-privileged local user to trigger kernel heap memory corruption by racing a concurrent netdevice reconfiguration. The tpacket_snd() function reads dev->hard_header_len independently at two points - for SKB headroom allocation and for header construction in tpacket_fill_skb() - so a device reconfiguration between those two reads can cause the reserved headroom to be smaller than what is later pushed, or make copylen minus hard_header_len negative. With a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and patches available across multiple stable kernel branches, this is a patching priority for multi-tenant Linux environments; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds memory access in the Linux kernel's packet socket subsystem (net/packet) allows a local attacker with CAP_NET_RAW or equivalent network namespace privileges to trigger kernel memory corruption via the PACKET_QDISC_BYPASS transmit path. The flaw exists because packet_parse_headers() fails to reset skb->mac_header for SOCK_DGRAM, SOCK_PACKET, and protocol-bound SOCK_RAW sockets, causing any driver that reads eth_hdr(skb) during transmit to dereference an address approximately 64 KiB past the socket buffer head. No public exploit has been identified and no CISA KEV listing exists; patches are available across at least eight stable kernel branches.
Race condition in the Linux kernel AF_PACKET socket subsystem allows a local low-privileged attacker to dereference stale or NULL ring storage, resulting in kernel memory corruption with full confidentiality, integrity, and availability impact. The flaw arises because packet_set_ring() previously published the tpacket receive mode outside the sk_receive_queue.lock section used for ring state updates, enabling packet_poll() and packet_recvmsg() to run pressure-clearing paths against already-freed ring structures. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS places current exploitation probability at 0.21%.
Kernel memory disclosure in the Linux kernel's generic XDP receive path allows leaking of adjacent kernel memory - including skb_shared_info contents and a raw kernel pointer from skb_shinfo(skb)->frags[0] - into userspace when an attached XDP program shrinks a packet's fragment area. The flaw stems from bpf_prog_run_generic_xdp() updating skb->data_len without adjusting skb->len, leaving skb_headlen() larger than the real linear area so datagram copies read past the linear tail. No public exploit is identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the issue is not CISA KEV-listed, so risk is confined to systems running generic XDP programs that adjust fragments.
Stack exhaustion in Linux kernel net/sched allows a local low-privileged attacker with CAP_NET_ADMIN to crash or potentially compromise the kernel by constructing an excessively deep qdisc hierarchy. The create-and-graft code path lacked depth enforcement, permitting hierarchies that trigger unbounded recursion in qdisc tree walkers, overflowing the kernel stack. No public exploit code exists and EPSS is 0.21% (12th percentile), but the CVSS 7.8 High rating and C:H/I:H/A:H impact vector indicate vendor assessment of a privilege escalation potential beyond simple denial-of-service. Patch-confirmed fixes are available across multiple stable kernel branches.
Kernel memory corruption in the Linux inet fragment (inet_frag) subsystem arises from a race in inet_frag_create(), which arms the fragment-queue timer before publishing the queue into the fqdir rhashtable. When a network namespace has a fragment timeout of zero or negative, the timer can fire on an unpublished queue, mark it complete, and drop an anticipated hash reference that is never restored, leaving a stale hash node and a use-after-free-style reference imbalance. No public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.21%, 11th percentile), and exploitation depends on a non-default namespace configuration rather than default deployments.
Use-after-free in the Linux kernel's mac802154 (IEEE 802.15.4) subsystem allows a local low-privileged attacker to dereference freed netdev memory, potentially achieving kernel memory corruption and privilege escalation. The race window opens when mac802154_beacon_worker() drops the RCU read lock while still holding references to sdata and wpan_dev, and a concurrent interface teardown via mac802154_stop_beacons_locked() frees those structures before the worker completes. EPSS is very low at 0.21% (11th percentile) and no active exploitation or public exploit code has been identified at time of analysis; practical exploitation is limited by mac802154 hardware availability and the race condition timing requirement.
Use-after-free in the Linux kernel netfilter ebt_nflog subsystem allows a local attacker with low privileges to trigger kernel memory corruption by racing ebtables NFLOG rule execution against nfnetlink_log module teardown. Affected kernels from version 4.12 through multiple stable branches (pre-patch) fail to acquire a module reference on the nfnetlink_log backend before invoking nfulnl_log_packet(), unlike the xt_NFLOG and nft_log frontends. KASAN-confirmed heap use-after-free at instance_lookup_get_rcu can result in full kernel compromise (C:H/I:H/A:H). No public exploit identified at time of analysis; EPSS at 0.22% (13th percentile) reflects low near-term exploitation probability.
Use-after-free race condition in the Linux kernel's IPv4 routing subsystem allows a local low-privileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw is in fib_nhc_update_mtu(), which traverses the PMTU nexthop exception (FNHE) table without proper serialization against concurrent FNHE eviction, creating a window where freed memory is accessed after a completed RCU grace period. No public exploit code has been identified at time of analysis, and an EPSS of 0.22% (13th percentile) reflects very low near-term exploitation probability despite the 7.8 CVSS score.
TX DMA buffer mismanagement in the Linux kernel's Qualcomm GENI serial driver (qcom-geni) allows a local low-privileged user to hang the system indefinitely and potentially corrupt kernel memory on affected Qualcomm hardware. The driver's DMA-mode uart_ops lacks a flush_buffer callback, enabling in-flight DMA transfers to underflow the transmit kfifo and re-submit page-sized transfers indefinitely; a concurrent flaw in the stop path unmaps the DMA buffer while the serial engine is still reading it. No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile), but the user-triggerable hang and DMA use-after-unmap represent a real availability and potential integrity risk on affected Qualcomm platforms.
Use-after-free race condition in the Linux kernel's amba-pl011 serial driver allows a local unprivileged user on ARM-based hardware to corrupt kernel memory, potentially escalating to full system compromise. The RS485 hrtimers embedded in the devm-managed port structure can fire after the port is freed, and the IRQ handler can arm a timer immediately before teardown, creating the race window. No public exploit exists and EPSS is 0.21% (11th percentile), but kernel-level use-after-free primitives are well-understood exploitation targets and patched stable releases are available.
Out-of-bounds read in the Linux kernel's staging RTL8723BS WiFi driver allows adjacent-network unauthenticated attackers to leak kernel heap memory or crash the affected system by transmitting a crafted 802.11 management frame. The flaw lives in rtw_get_wpa_ie(), which accesses fixed byte offsets within a vendor-specific information element without verifying the IE body is at least 6 bytes long, enabling reads past the end of a kmemdup'd allocation when a short trailing IE is present. No active exploitation is confirmed (absent from CISA KEV) and EPSS sits at 0.22% (13th percentile), but the adjacent-network, no-authentication attack vector represents a meaningful risk for embedded and single-board systems carrying RTL8723BS hardware.
Buffer overflow and stale-memory disclosure in the Linux kernel's staging rtl8723bs WiFi driver allow a malicious access point within radio range to corrupt kernel memory or leak sensitive buffer contents before any association occurs. The flaw resides in OnAuthClient(), which copies a WLAN_EID_CHALLENGE element's attacker-controlled length - up to 255 bytes - into a fixed 128-byte chg_txt buffer via memcpy(), enabling an overflow of up to 127 bytes or an underfill that echoes stale kernel memory. No public exploit has been identified at time of analysis and EPSS probability is low (0.26%, 18th percentile), but the adjacent-network unauthenticated attack vector and High impact across confidentiality, integrity, and availability make this a notable risk for any deployment relying on WEP shared-key authentication with this chipset.
Out-of-bounds reads in the staging rtl8723bs WiFi driver's monitor mode transmit path expose Linux kernel systems equipped with Realtek RTL8723BS hardware to memory disclosure, corruption, and denial of service. The driver function rtw_cfg80211_monitor_if_xmit_entry() strips the variable-length radiotap header and then reads the 802.11 frame control field without verifying the socket buffer still contains a minimum MAC header; for data frames it additionally pulls the full calculated 802.11/QoS/SNAP span before confirming the skb holds that much data. A local attacker with low privileges can inject a truncated 802.11 frame to trigger the flaw; no public exploit has been identified at time of analysis and EPSS stands at 0.22%, indicating low automated exploitation probability.
Race condition in the Linux kernel fastrpc driver allows a local low-privileged attacker on Qualcomm DSP-equipped systems to trigger a use-after-free condition by issuing concurrent munmap ioctls, potentially achieving kernel memory corruption and privilege escalation. The flaw exists in `fastrpc_req_munmap_impl()` where the internal buffer list is updated only after the DSP unmap completes, leaving a window in which a concurrent thread can operate on an already-unmapped entry. No public exploit or CISA KEV listing exists at time of analysis, and EPSS remains low at 0.21%, indicating limited observed exploitation activity.
Unprotected list manipulation in the Linux kernel FastRPC subsystem allows a local low-privileged attacker on Qualcomm-based systems to race a signal-interrupted DSP invoke operation against concurrent mmap/munmap operations. The missing `fl->lock` acquisition in `fastrpc_internal_invoke()` during the interrupt path creates a concurrent modification hazard on `fl->mmaps`, potentially yielding kernel memory corruption with full confidentiality, integrity, and availability impact. No public exploit has been identified and EPSS is 0.21% (11th percentile); this CVE is not listed in the CISA KEV catalog.
Unbounded kernel memory access in the Linux kernel's ALSA usx2y driver allows a local user with access to a Tascam US-X2Y USB audio device's hwdep node to read from and write to arbitrary kernel memory pages via a crafted mmap() call with an out-of-bounds page offset. The snd_usb_usx2y module has carried this flaw since Linux 2.6.12; no Linux capability check (CAP_SYS_ADMIN, etc.) is required - only DAC permission to the hwdep character node after completing a mandatory FPGA image upload sequence. The exploit primitive is sufficient for local privilege escalation, but real-world risk is tightly bounded by the requirement for a physically attached Tascam US-X2Y device; no public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.21% (12th percentile) reflects this narrow hardware prerequisite accurately.
Out-of-bounds slab write in the Linux kernel ALSA FCP (FireWire Control Protocol) driver allows local unprivileged processes to corrupt up to 888 bytes of adjacent kernel heap memory by reading audio controls on /dev/snd/controlC0, once a privileged actor has installed an oversized Level Meter map. The mismatch between the driver's 255-entry map limit and the 128-entry ABI array in struct snd_ctl_elem_value creates a persistent, exploitable write primitive reachable by any process with device read access. No public exploit has been identified and no active exploitation is confirmed; vendor-released patches are available in Linux 7.2, 7.1.9, and 6.18.45.
Use-after-free in the Linux kernel perf/core subsystem allows a local low-privileged user to dereference freed kernel memory by racing CPU hot-unplug against perf event group management. When a sibling event is detached via DETACH_GROUP during CPU hotplug, its group_leader pointer is not reset; if the leader is subsequently freed while the sibling's file descriptor remains open, a PERF_IOC_FLAG_GROUP ioctl on the sibling follows the stale pointer into freed memory, potentially enabling kernel crash or privilege escalation to root. No public exploit has been identified at time of analysis and EPSS is low at 0.21% (11th percentile), but the local exploit path with full C:H/I:H/A:H impact warrants prompt patching, particularly on systems permitting unprivileged perf_event_open access.
Out-of-bounds memory read in the Linux kernel's fbdev bitblit subsystem allows a local attacker with tty group write access to /dev/vcsa to crash the kernel or disclose kernel memory by supplying an out-of-range glyph index through the virtual console screen interface. The root cause is a missing bounds check in bit_cursor() in drivers/video/fbdev/core/bitblit.c - a sibling function to bit_putcs_aligned() and bit_putcs_unaligned(), which already received the same clamp in commit 18c4ef4e765a. No public exploit has been released and EPSS of 0.22% (13th percentile) indicates very low active exploitation probability; this is not in CISA KEV.
Use-after-free in the Linux kernel's ring-buffer tracing subsystem exposes non-consuming reader iterators to dangling memory when subbuffer order changes occur while resizing is disabled. The vulnerable function ring_buffer_subbuf_order_set() frees buffer pages without checking the resize_disabled flag, leaving rb_advance_iter() holding stale references to freed memory. Exploitation requires local low-privilege access; no public exploit or CISA KEV listing exists, but vendor patches are available across multiple stable kernel branches.
Race condition in the Linux kernel's mm/huge_memory subsystem allows local low-privilege users to trigger misidentification of the huge zero folio as an ordinary Transparent Huge Page (THP), potentially leading to memory corruption, incorrect folio splitting, and privilege escalation. Affected kernels spanning multiple stable branches from at least 4.19 onward are vulnerable when !CONFIG_PERSISTENT_HUGE_ZERO_FOLIO is in effect, with patched versions available for 6.12, 6.18, 7.1, and 7.2 stable series. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog; EPSS places exploitation probability at the 11th percentile.
Use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local attacker to trigger kernel memory corruption via a refcount underflow in smc_rx_splice(). The flaw arises because pages are handed to splice_to_pipe() before page and socket references are taken, so entries dropped by smc_rx_spd_release() are released without a matching reference, and multi-page splices pair one sock_hold() with multiple sock_put() calls. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.21% (12th percentile), consistent with limited real-world weaponization at this time.
Use-after-free in the Linux kernel's IPv6 stack allows a local low-privileged user to corrupt kernel memory with full high/integrity/availability impact. The race condition exists in in6_dev_get(), where dev->ip6_ptr is read under RCU and its refcount is then unconditionally incremented - device teardown can zero the pointer and drop the final reference between those two operations, resurrecting a freed inet6_dev object. No public exploit identified at time of analysis, though a proof-of-concept reproducer was confirmed functional on the unpatched v7.2-rc3 kernel by OpenAI Security Research and validated by Trail of Bits.