Red Hat
Monthly
Use-after-free in Google Chrome's Select component before version 155.0.8059.39 allows unauthenticated remote attackers to execute arbitrary code inside the browser's renderer sandbox, but only after socially engineering a victim into opening a crafted HTML page (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R). The impact is confined to the sandbox, so compromise of the host operating system would require chaining a separate sandbox-escape vulnerability. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google - the reporting party - has released a fixed build.
Remote code execution inside the Chrome renderer sandbox is possible on Chrome builds prior to 155.0.8059.39, where a use-after-free in the WebRTC component can be triggered by a crafted HTML page. The flaw is rated 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and assigned Chromium severity High; no authentication or prior privileges are required, but the victim must open or be redirected to the attacker's page (UI:R). Impact is confined to the renderer sandbox - reaching the host OS would require chaining a separate sandbox-escape vulnerability - and no public exploit was identified at time of analysis; the primary exposure window is the short period before Chrome's auto-update moves users to the fixed build.
Remote code execution inside the Chrome renderer sandbox is possible in Google Chrome builds prior to 155.0.8059.39, where a use-after-free defect in the HTML handling path can be triggered by a crafted HTML page. Any user running an unpatched desktop Chrome who loads attacker-controlled web content (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) can be targeted; no credentials or elevated privileges are required, but mandatory user interaction (UI:R) and the renderer sandbox confinement limit the direct blast radius, since escaping the sandbox to the host OS would require a separate, distinct vulnerability not covered by this CVE. Google has shipped a vendor patch (155.0.8059.39) and the issue was reported through the Chrome vulnerability program with a Chromium severity rating of High; no public exploit code and no confirmed active exploitation have been identified, and the affected-code flaw is consistent across the CPE wildcard for google:chrome.
Use-after-free in Google Chrome's Web Audio implementation affects versions prior to 155.0.8059.39, where a remote attacker can achieve arbitrary code execution inside the browser's renderer sandbox by getting a victim to open a crafted HTML page that exercises the Web Audio API. The flaw carries an assessed CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication or non-default configuration is required, but the attack does depend on user interaction (loading the page) and the resulting code execution is confined to the renderer sandbox, so full host compromise would require chaining a separate sandbox escape. Chromium rates the issue High severity, the vendor has published a fix in 155.0.8059.39, and no public exploit code has been identified at time of analysis; there is no CISA KEV confirmation of active exploitation.
Remote code execution confined to Chrome's renderer sandbox is possible in Google Chrome prior to 155.0.8059.39, where a use-after-free in the browser's Bindings layer can be triggered when a victim opens a crafted HTML page. The attack is unauthenticated (PR:N) but depends on user interaction (UI:R), and because the assessed scope is unchanged (S:U), code execution is contained inside the renderer sandbox - reaching the host would require a separate sandbox-escape vulnerability. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Chrome's automatic update mechanism narrows the realistic exposure window, making this a high-priority patch item rather than an emergency.
Incorrect authorization in Google Chrome's FileSystem component allows a remote attacker to break out of the browser sandbox and potentially execute arbitrary code at the operating system level on desktop builds prior to 155.0.8059.39. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6), no authentication or prior privileges are required, but exploitation is not automatic: the attacker must use social engineering to convince the victim to open a crafted HTML page, which aligns with CISA's SSVC rating of "not automatable" and a technical impact of "total" given the scope change across the sandbox boundary. There is no CISA KEV listing and no public exploit code identified at time of analysis, and a vendor patch is available, so this should be treated as a high-severity, patch-now issue rather than an actively exploited emergency.
Out-of-sandbox code execution is achievable in Google Chrome desktop builds prior to 155.0.8059.39 by exploiting a use-after-free in the browser-process TabStrip component, reached when a victim is socially engineered into opening an attacker-crafted HTML page. The flaw carries a 9.6 CVSS (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) because the corrupted component sits outside the renderer sandbox, so a successful exploit escapes Chrome's primary containment boundary; however, it is not a zero-click bug and no public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with Automatable 'no'. A vendor-released patch (155.0.8059.39) is available, making this a high-priority but currently non-weaponized patch-now item rather than an active incident.
Remote code execution outside the browser sandbox in Google Chrome prior to 155.0.8059.39 allows a remote attacker to execute arbitrary code on a victim's system via a crafted HTML page. The flaw is a use-after-free in the browser's Core component, and exploitation requires the victim to open attacker-controlled web content (UI:R) while no authentication or special privileges are needed (PR:N); the CVSS score is 9.6 with scope change (S:C) reflecting sandbox escape. Despite the high impact, there are no exploitation signals: no public exploit identified at time of analysis and the SSVC assessment lists exploitation as none, though the total technical impact and wide deployment make timely patching a priority.
Use-after-free in Google Chrome's Storage component (all versions prior to 155.0.8059.39) allows a remote attacker to execute arbitrary code outside the sandbox, but only after the attacker has already compromised the renderer process - typically by chaining a separate renderer bug - and only when a victim loads a crafted HTML page (CVSS 8.3, AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Because a prior renderer compromise, user interaction, and non-trivial heap grooming are all required, this is a second-stage sandbox-escape primitive rather than standalone initial access. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none, and Google has shipped a vendor patch in Chrome 155.0.8059.39.
Remote code execution inside the Chrome renderer sandbox is possible in Google Chrome versions prior to 155.0.8059.39 through a race condition in the V8 JavaScript engine, triggered when a victim loads a crafted HTML page. The flaw requires no authentication (PR:N) but does require user interaction (UI:R) and depends on winning a non-deterministic timing window, which is reflected in the assessed AC:H and makes reliable exploitation harder. Resulting code execution stays within the renderer sandbox, so escaping to the host OS would require chaining a separate sandbox-escape vulnerability; no public exploit code has been identified at time of analysis, and vendor patches are available.
Use-after-free in Google Chrome's parser allows remote attackers to execute arbitrary code within the browser's renderer sandbox by convincing a victim to visit a crafted HTML page. All Chrome builds prior to 155.0.8059.39 are affected, and exploitation requires user interaction (UI:R) but no authentication (PR:N). The flaw carries a High Chromium severity rating (CVSS 8.8) and no public exploit has been identified at time of analysis; however, standalone impact is constrained because the description specifies code execution 'inside the sandbox,' meaning a second vulnerability would be needed to escape to the host.
A use-after-free in the Chrome Tabs component of Google Chrome on macOS allows a remote attacker to potentially execute arbitrary code outside the sandbox when a victim loads a crafted HTML page, affecting all builds prior to 155.0.8059.39. Exploitation is unauthenticated (CVSS PR:N) but requires user interaction (UI:R) - the victim must navigate to or open attacker-controlled web content, with no zero-click vector indicated, and reliable code execution additionally depends on successful heap grooming of the freed object. The issue is assessed as a genuine high-priority problem rather than a high-CVSS-but-low-real-risk case (CVSS 9.6, scope-changed), and no public exploit was identified at time of analysis; a vendor patch is available in Chrome 155.0.8059.39.
Use-after-free in Chrome's Tint shader compiler lets a remote attacker achieve code execution outside the browser sandbox when a victim opens a crafted HTML page - the page drives Chrome's WebGPU pipeline so that Tint compiles a malicious WGSL shader that triggers the memory-safety flaw. The flaw affects Google Chrome builds prior to 155.0.8059.39 and is rated 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), with the scope-change sub-score reflecting that successful exploitation escapes the renderer sandbox and yields host-level impact; no authentication is needed, but the attacker must convince the user to visit the page (UI:R). No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no exploitation, so this is currently a high-priority patch-now issue rather than an actively exploited one; a vendor patch is available in the 155.0.8059.39 stable release.
Information disclosure in Google Chrome for iOS Autofill allows an attacker who lures a victim to a crafted HTML page to obtain sensitive form data that the browser failed to properly clear. Only Chrome for iOS builds prior to 155.0.8059.39 are affected; vulnerable instances require the Autofill feature to have been used so that sensitive data is actually present for the incomplete cleanup to expose. Exploitation requires no authentication (PR:N) but is gated by mandatory user interaction and social engineering (UI:R), meaning it cannot be triggered silently; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Note that the vendor-assigned CVSS of 8.8 overstates the impact relative to our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5), which scores confidentiality impact only, with no integrity or availability effect.
Out-of-sandbox code execution in Google Chrome for iOS (versions prior to 155.0.8059.39) stems from a missing authorization check that lets a remote, unauthenticated attacker who socially engineers a victim into opening a crafted HTML page run arbitrary code outside the browser sandbox (CVSS 3.1 base 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, CWE-862). Exploitation is not possible without user interaction - the victim must navigate to or open attacker-controlled content on a vulnerable iOS Chrome build - and no public exploit code was identified at time of analysis, with no KEV confirmation of active exploitation. The combination of a scope-changing sandbox escape with high confidentiality, integrity, and availability impact makes this a high-priority browser flaw, but the mandatory user interaction and the narrow affected population (only unpatched iOS Chrome builds) keep it short of an emergency-patch situation.
Use-after-free in the ANGLE graphics layer of Google Chrome allows a remote, unauthenticated attacker to execute arbitrary code outside the browser sandbox when a victim opens a crafted HTML page; the vulnerable code path is present in Chrome builds prior to 155.0.8059.39. Exploitation is not automatic - the attacker must lure the user into rendering the malicious page (UI:R), but no credentials are required and the assessed CVSS:3.1 vector scores 9.6 with a scope change (S:C) because successful exploitation escapes Chrome's primary containment boundary rather than staying inside the renderer sandbox. Only publicly available exploit code would normally elevate this beyond an urgent patch-now item: at the time of analysis there is no indication of confirmed active exploitation (no CISA KEV listing) and no public exploit identified, while a vendor patch is available. Note that the description scopes the flaw to Chrome on Android, whereas the only vendor reference is the Desktop stable-channel release notes - the affected platform should be verified against the vendor advisory before relying on a platform-specific assumption.
Sandbox escape in Google Chrome versions prior to 155.0.8059.39: a race condition (CWE-362) in the browser's font handling can be triggered when a victim renders a crafted HTML page, potentially allowing a remote, unauthenticated attacker to execute arbitrary code outside the browser sandbox. Exploitation requires the target to load or view the attacker-controlled page (UI:R) and depends on winning a timing-sensitive race (AC:H), which typically demands repeated attempts and precise memory grooming, making this a credible high-priority browser flaw rather than a confirmed emergency. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and a vendor patch is available from Google.
An integer overflow in the WebGL implementation of Google Chrome on Android lets a remote attacker potentially execute arbitrary code outside the browser sandbox on devices running any build prior to 155.0.8059.39. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), meaning exploitation is unauthenticated but requires the victim to open an attacker-controlled HTML page that exercises the vulnerable WebGL code path; the scope change (S:C) reflects the potential escape from Chrome's renderer sandbox rather than a mere renderer crash. At time of analysis there is no public exploit identified, CISA's SSVC assessment records Exploitation: none and Automatable: no, and a vendor patch exists, so the issue is high priority on impact and patch urgency rather than on observed exploitation. Because WebGL is enabled by default on Android Chrome, no special configuration is needed on the victim side beyond navigation to the malicious page.
Arbitrary code execution outside the browser sandbox is possible in Google Chrome on macOS prior to 155.0.8059.39, where a timing-dependent race condition (CWE-367) in the Core component can be won to break out of the renderer's sandbox. Exploitation is conditional rather than a single remote shot: the attacker must already have compromised the renderer process, must socially engineer the victim into opening and interacting with a crafted HTML page (UI:R), and must win a non-deterministic race that the AC:H rating and CISA's SSVC assessment (Exploitation: none, Automatable: no) indicate is unreliable and not readily scriptable. No public exploit code has been identified at time of analysis, and Google has shipped a fixed build, 155.0.8059.39; because the mandatory pre-existing renderer compromise is a high bar, this is best treated as a conditional priority to be handled through normal patching cadence rather than an emergency.
A race condition in Google Chrome's Fonts component prior to version 155.0.8059.39 lets a remote attacker escape the browser sandbox and execute arbitrary code at the browser's privilege level, but only after the attacker has already compromised a sandboxed renderer process through some separate, unrelated vulnerability. The exploit additionally requires the victim to load a crafted HTML page (UI:R) and the attacker to win a timing-dependent race (AC:H), so this is best understood as a sandbox-escape primitive rather than a standalone initial-access vector. There is no public exploit identified at time of analysis - CISA's SSVC assessment rates exploitation as 'none' and the flaw as not automatable - and a vendor-released patch (155.0.8059.39) is available, making this a high-priority defense-in-depth fix rather than a catastrophic unpatched bug.
Type confusion in ANGLE, Chrome's OpenGL ES abstraction layer, lets a remote attacker who has already compromised the renderer process execute arbitrary code outside the browser sandbox in Google Chrome versions prior to 155.0.8059.39. The victim must load attacker-controlled graphics content (crafted HTML invoking WebGL/ANGLE paths), so user interaction is required, and the bug cannot be triggered by merely visiting a page without a separate renderer exploit first - it is a second-stage sandbox-escape primitive in a multi-bug chain rather than an initial-access vector. No public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, but technical impact as total, consistent with the CVSS scope change (S:C), high confidentiality and integrity impact, and the High Chromium security severity rating.
Google Chrome on Android releases before 155.0.8059.39 mishandle Autofill reference resolution, allowing a remote attacker who socially engineers a victim into opening a crafted HTML page to read sensitive information held in the browser's Autofill store. The CVSS vector PR:N means no authentication is needed, but the required user interaction (UI:R) and social-engineering dependency are the main practical barriers; no public exploit code has been identified at time of analysis. Our independent assessment scores this as confidentiality-only (CWE-706, use of incorrectly-resolved name or reference), so it should be treated as an information-disclosure issue rather than code execution or data tampering.
Incorrect authorization (CWE-863) in Google Chrome's SiteIsolation component allows an unauthenticated remote attacker to execute arbitrary code in the browser when a victim loads a crafted HTML page, a flaw Google rates High and that carries a CVSS base score of 9.6. Exploitation is limited by the required user interaction (UI:R) - the victim must visit attacker-controlled or compromised web content on a build older than 155.0.8059.39 - so delivery hinges on drive-by browsing or social engineering rather than unattended compromise, consistent with CISA's SSVC rating of non-automatable. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in Chrome 155.0.8059.39.
Use-after-free in Google Chrome's Track component (versions prior to 155.0.8059.39) allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page. The flaw carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is network-reachable, low-complexity, and requires no authentication, with mandatory user interaction - the victim must navigate to or be redirected to attacker-controlled content - as the only gating prerequisite. Google rates the issue Critical and shipped a fix in the 155.0.8059.39 stable-channel release; no public exploit code has been identified at time of analysis, and the escape from the browser sandbox would require a separate, independent vulnerability.
Memory corruption in Google Chrome's Navigation component - a use-after-free (CWE-416) - allows a remote attacker to execute arbitrary code outside the browser sandbox on any Chrome installation prior to 155.0.8059.39 by getting a user to load a crafted HTML page. The flaw is rated Critical by Chromium with a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H): no authentication is required and delivery is network-based, but exploitation still depends on the victim rendering attacker-controlled content, and the scope change (S:C) reflects that successful exploitation escapes the renderer sandbox to affect the host system. No public exploit has been identified at time of analysis (CISA SSVC Exploitation: none, Automatable: no), and this is a genuine high-priority issue rather than an inflated high-CVSS score.
Use-after-free in the browser-process component of Google Chrome before 155.0.8059.39 lets a remote attacker execute arbitrary code outside the sandbox when a victim opens a crafted HTML page. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N) but requires the user to navigate to attacker-controlled content (UI:R); the scope change and high confidentiality, integrity, and availability ratings reflect that a successful page load escapes the renderer sandbox to reach host-level code execution, which pushes the base score to 9.6 and earns a Chromium security severity of Critical. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, so the practical near-term risk comes from the low complexity of the trigger (phishing, malvertising, or a compromised site) rather than from observed attacks. Vendor-released patch: Chrome 155.0.8059.39.
Remote code execution outside the browser sandbox is possible in Google Chrome builds prior to 155.0.8059.39 through a use-after-free flaw in the built-in Chromecast (Cast) component: an attacker who gets a victim to render a crafted HTML page can corrupt freed memory and run arbitrary code with the browser's privileges (CVSS 9.6, Chromium severity Critical). The sole hard prerequisite is user interaction - no credentials or elevated privileges are required per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) - and because Cast ships with standard desktop Chrome rather than as an optional extension, the exposed population is essentially every unpatched Chrome installation. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
Unauthenticated Go pprof debug endpoints exposed on the postgres-exporter metrics listener let any attacker who can reach that port from inside the cluster network read process arguments, full goroutine stacks, and heap memory - potentially leaking database connection strings and credentials - and repeatedly trigger CPU profiling to exhaust resources in a denial-of-service condition. The flaw is tracked as CVE-2026-83550 (CVSS 7.1, AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H per the vendor, C:H for confidentiality in our assessment) and affects postgres-exporter as shipped in Red Hat Multicluster Global Hub, where the CPE covers all tracked versions; exploitation requires adjacent/cluster network reachability rather than internet exposure. No public exploit code has been identified at time of analysis, and no CISA KEV listing indicates active exploitation; risk is best characterized as a real design flaw of moderate priority, with exposure materially reducible through NetworkPolicies that restrict access to the metrics port.
Credential disclosure in the MCP TypeScript SDK OAuth client (npm @modelcontextprotocol/sdk 1.12.0 through 1.30.1, and @modelcontextprotocol/client 2.0.0 through 2.1.0 in narrower configurations) lets a malicious or compromised MCP server direct the client's stored OAuth credentials to an authorization server of the attacker's choosing. Because saved credentials were never bound to the authorization server that issued them, a remote, unauthenticated attacker who controls or compromises the MCP server the victim connects to can silently receive a stored refresh_token and client_secret - or a bundled provider's client_secret or signed assertion - yielding full confidentiality impact (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, per the PR:N vector the request is unauthenticated). No public exploit code and no confirmed active exploitation were identified at time of analysis; exploitation requires the victim application to use the SDK's OAuth client over HTTP and to connect to an MCP server it does not fully trust while holding credentials for a legitimate authorization server.
A label-enforcement bypass in the External Secrets Operator (ESO) webhook generator lets any Kubernetes principal that is permitted to create webhook generator resources point a generator at a victim's Secret that was never labelled for webhook use, and then have its contents exfiltrated to an attacker-controlled URL. The flaw affects ESO releases from 0.10.0 up to (but not including) 1.3.2 and stems from an initialization-order bug that cleared the EnforceLabels flag after it had been set, so the provider-side check for the external-secrets.io/type=webhook label was skipped instead of failing. Exploitation is conditional: it requires an affected version, the webhook generator feature in use, and delegated RBAC rights to create generators.external-secrets.io/v1alpha1 Webhook objects, which is why the assessed vector carries PR:L; clusters that never use webhook generators or that tightly constrain generator creation are not exposed. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, and a vendor patch is available in 1.3.2.
OS command injection in lrzsz before 0.13.0 allows a remote ZMODEM/YMODEM sender to execute arbitrary shell commands as the receiving user by supplying a crafted filename during an lrz receive. The flaw is reachable only when lrz is invoked under a suffixed/alias name such as lrztar and operates in pipe mode, where procheader() in src/lrz.c forwards the unescaped filename to popen() and shell metacharacters are interpreted. Successful exploitation requires the victim to accept or initiate the transfer (UI:P) and yields command execution at the receiver's privilege level only (no cross-system impact per SC:N/SI:N/SA:N); no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-supplied CVSS 4.0 score is 7.7 (High) while an independent assessment rates it CVSS 3.1 8.1 with AC:H given the non-default invocation and interaction prerequisites.
Arbitrary file write through path traversal in lrzsz before 0.13.0 lets a malicious ZMODEM sender place files outside the current directory - including by absolute pathname - when the victim runs the lrz receive utility in restricted mode. Exploitation requires the victim to actively initiate or accept a ZMODEM transfer (UI:P/AT:P), the binary to be built without the --enable-pubdir option (the default, since only that build hardens checkpath()), and the attacker to control the sending side; the primitive is limited to files the receiving user account can already write, though overwriting SSH keys, shell profiles, or cron entries can extend impact. No public exploit identified at time of analysis, and the risk is a conditional integrity/availability issue rather than a mass-exploitation emergency given the user-interaction and build-configuration prerequisites.
A use-after-free and RCU-safety defect in the Linux kernel's IPsec/xfrm transport-mode packet reinjection path can crash or corrupt the kernel, and is reachable by a local low-privilege attacker (CVSS PR:L) who can also trigger network device unregistration. The flaw was introduced when xfrm_trans_reinject() was converted from a tasklet to a workqueue (commit 4f4920669d21), so finish callbacks such as ip6_rcv_finish() now run in process context without an RCU read-side critical section, and queued skbs may hold non-refcounted dst entries whose skb->dev is not kept alive while deferred. Our independent assessment scores this CVSS 3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (availability-only, high attack complexity), and there is no public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile) and no CISA KEV listing exists.
Use-after-free of GUP-pinned zerocopy page buffers in the Linux kernel's IPsec ESP out-of-place output path lets a local, authenticated user (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) who can send MSG_ZEROCOPY traffic over an ESP transform corrupt memory, potentially achieving privilege escalation (C:H/I:H/A:H), while the same code path simultaneously leaks an x->xfrag page per packet. Exploitation requires a host with IPsec ESP configured where esp->inplace == false and where the transmitted skb carries SKBFL_MANAGED_FRAG_REFS, so hosts without ESP or without zerocopy sends on that path do not reach the vulnerable frag mutation. No public exploit has been identified at time of analysis, the issue is not in CISA KEV, and the EPSS score is low (0.17%, 6th percentile), consistent with a moderate-priority local issue; vendor-released patches exist in 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, and 7.3-rc4.
A use-after-free race in the Linux kernel's RDMA/siw (SoftiWARP) driver lets a local, low-privileged user who can issue RDMA verbs operations corrupt kernel memory and potentially escalate privileges or crash the system. The bug is reachable when siw_qp_modify() fails inside siw_accept() and the QP's state_lock is released before the error path clears qp->cep, opening a window in which a concurrent ibv_modify_qp() transition to ERROR frees the same cep object. Exploitation requires the siw module to be loaded and a narrow race to be won, so practical risk is limited to environments using software RDMA; no public exploit code has been identified, EPSS is low (0.17%, 6th percentile), and the issue is not listed in CISA KEV, while vendor patches are available for all supported stable branches.
A use-after-free in the Linux kernel's RDMA/rxe (Soft-RoCE) memory-region re-registration path lets a local attacker who can reach the RDMA user-verbs character device corrupt kernel memory and potentially achieve privilege escalation, scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The bug is reachable only when rxe_rereg_user_mr() is called with both IB_MR_REREG_PD and IB_MR_REREG_ACCESS set while supplying an access bit outside RXE_ACCESS_SUPPORTED_MR, causing the protection domain to be reassigned without the core's use-count being rolled back and leading to a protection domain (and a memory window still referencing it) being freed while in use. Exploitation is realistically narrow: the rdma_rxe module must be loaded and an rxe device configured (not a default configuration), the attacker needs local device access, and an existing memory window must reference the PD; no public exploit code was identified at time of analysis and EPSS is low at 0.16% (4th percentile).
Out-of-bounds read and write in the Linux kernel's RDMA Soft-RoCE (rxe) driver (CVE-2026-98365) lets an unauthenticated peer on an already-established RDMA queue pair send a crafted RDMA-Write or RDMA-Read RETH whose iova+length wraps to zero, bypassing the mr_check_range() bounds check and causing a kernel oops (and possible memory corruption) in rxe_mr_copy_xarray(). No public exploit code was identified at time of analysis and EPSS is low at 0.17% (5th percentile), but realistic exposure is gated by configuration: the rdma_rxe module must be loaded and the host must expose Soft-RoCE on a reachable interface, which is not the default Linux setup. Vendor-released patches are available in stable kernels 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
A race-condition use-after-free in the Linux kernel's xfrm (IPsec) bundle-creation path allows a local attacker with low privileges to trigger a stale net_device pointer dereference, yielding kernel memory corruption with high confidentiality, integrity, and availability impact. The flaw is reachable when an IPv6 UDP send traverses xfrm_lookup_with_ifid()/bundle creation while a concurrent RTM_DELLINK tears down the underlying net_device - a capability typically obtained by an unprivileged user inside a user+network namespace on kernels that permit unprivileged namespaces. Exploitation is local-only and probabilistic (it depends on winning an inherent timing race and on xfrm/IPsec policies being active), so realistic risk is below the vendor CVSS of 7.8; EPSS is low at 0.15% (4th percentile), no public exploit code was identified at time of analysis, and the issue is not in CISA KEV.
Local privilege escalation and data-corruption primitive in the Linux kernel's RDMA/rxe (Soft-RoCE) software-RDMA driver: a missing HMM_PFN_WRITE permission test in the on-demand-paging (ODP) write path lets an unprivileged local user who can register an ODP memory region over a PROT_READ file mapping direct incoming RDMA traffic (RDMA WRITE, RDMA READ responses, SEND payloads, atomics) through kmap into read-only page-cache pages without ever triggering copy-on-write, overwriting files the attacker only holds O_RDONLY - classically /etc/passwd or a setuid binary - in the same primitive class as Dirty COW and CVE-2022-2590. The flaw was introduced by commit 0b261d7c1cd3 ("RDMA/rxe: Break endless pagefault loop for RO pages"), which stripped the access-permission test from rxe_check_pagefault() and left only HMM_PFN_VALID, affecting kernels built from that baseline (reported as Linux 6.16 onward) until the stable fixes. Exploitation is bounded by configuration: the rxe/Soft-RoCE module is not loaded by default on typical servers, and the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) confirms a local, authenticated attacker with low complexity but no network reach; EPSS is low at 0.16% (5th percentile), and no public exploit code or CISA KEV entry has been identified at time of analysis. Vendor patches are available.
A use-after-free in the Linux kernel's Soft-RoCE (rdma_rxe) driver allows a local user who can open the RDMA uverbs interface and issue ATTACH_MCAST on a UD queue pair to trigger freeing of a published multicast-group object while it is still reachable from the driver's mcg_tree, giving high confidentiality, integrity and availability impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The race is only reachable when the backing Ethernet multicast programming step, rxe_mcast_add(), fails mid-operation (for example -ENODEV after the backing netdev is removed, or a propagated dev_mc_add() error), which is why the attack complexity is High and the practical priority is low. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.18% (7th percentile), and vendor patches are available in mainline and multiple stable branches.
Local users with low privileges can drive the Linux kernel into a race condition in the RDMA/core helper ib_get_eth_speed(), which calls a net_device's ethtool callback after that device has already completed NETDEV_UNREGISTER and ndo_uninit during teardown, corrupting or crashing the kernel. Exposure is narrow: the host must have an active RDMA device bound to an Ethernet (RoCE) or InfiniBand link layer and that device must be unregistering while an asynchronous RDMA port query is in flight, so exploitation requires winning a tight timing window (upstream CVSS 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; the independent assessment keeps the same AV:L/AC:H/PR:L vector but rates confidentiality and integrity as low and availability as high). Vendor-released patches exist for stable branches 6.1.189, 6.6.158, 6.12.112, 6.18.54 and 7.2.8 (plus 7.3-rc4); no public exploit code or confirmed active exploitation is known, and EPSS is only 0.17% (5th percentile).
A teardown race in the Linux kernel's iSER target (ib_isert) frees the isert_conn and iscsit_conn structures while a deferred control PDU completion is still queued on isert_comp_wq, so isert_put_cmd() later dereferences freed memory - a slab use-after-free (KASAN splat) rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because it can in principle lead to kernel code execution, data disclosure, or a crash. Exposure is limited to hosts that run the LIO iSER target with the ib_isert module loaded and export an iSER/RDMA transport over an InfiniBand or RoCE fabric; the CVSS vector shows no authentication prerequisite (PR:N), but the attacker must win a narrow race between connection teardown and the workqueue handler, a window so tight that the reporter needed an injected msleep(200) to reproduce it reliably. No public exploit code and no CISA KEV entry are associated with this issue, EPSS is only 0.16% (5th percentile), and vendor-released stable patches are available.
An out-of-bounds read in the Linux kernel's legacy libipw 802.11 stack allows an unauthenticated attacker within wireless range to make affected systems walk roughly 64 KiB past the end of a received management frame buffer. Only machines using the legacy Intel PRO/Wireless ipw2100 or ipw2200 drivers are exposed, because those receive paths validate just the generic 24-byte three-address management header while libipw_process_probe_response() and libipw_network_init() assume the full 36-byte beacon/probe-response prefix; the length arithmetic then underflows and is truncated to 65524. The resulting flaw yields limited information disclosure (C:L) and a high availability impact via kernel crash (A:H) against adjacent-network attackers, though it is sharply constrained by the obsolete hardware requirement. Risk signals are low: EPSS is only 0.17% (6th percentile), there is no CISA KEV listing, and no public exploit has been identified at time of analysis.
Out-of-bounds reads in the Linux kernel's legacy libipw 802.11 management-frame parser, reachable through the ipw2100 and ipw2200 wireless drivers, let an unauthenticated attacker within wireless range crash the kernel by injecting a crafted association response that is shorter than the fixed 30-byte prefix. The root cause is an unsigned integer underflow: stats->len (u16) minus sizeof(*frame) (size_t) is evaluated in size_t and wraps, so the truncated u16 length handed to libipw_parse_info_param becomes a value near 64 KiB and the information-element parser walks well past the receive buffer. Exploitation requires the obsolete Intel PRO/Wireless 2100 or 2200BG hardware and driver stack to be present and processing association responses, so the realistic outcome is a denial-of-service kernel crash with only limited disclosure potential; no public exploit code has been identified at time of analysis, no KEV entry exists, and EPSS is a low 0.17% (6th percentile), while vendor-released patches are available in the 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4 kernels.
A use-after-free in the Linux kernel's cfg80211 wireless configuration subsystem can be triggered locally when a network interface is taken down while a scan is still running, causing cfg80211 to free a scan request that the Wi-Fi driver still believes it owns. Successful exploitation corrupts kernel memory reachable at scan completion (scan_done()), yielding high confidentiality, integrity, and availability impact, though the attacker must already hold local privileges sufficient to manage the wireless interface (CVSS PR:L) and must win a narrow asynchronous-cancellation race (assessed AC:H, versus the vendor's AC:L). There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.17% (6th percentile).
Kernel instability in the Linux wireless stack (cfg80211) lets an attacker-controlled rogue AP or Wi-Fi device within radio range drive a client into an assertion failure inside the BSS rbtree handling, resulting in a WARN_ON that becomes a full system crash when panic_on_warn is enabled. Only systems running the in-tree cfg80211/mac80211 code are affected, and exploitation requires an adjacent attacker plus a victim client actively associated to the malicious device; the malformed BSS type change does not occur in normal operation, so real-world exposure is limited to deliberate rogue-device scenarios. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); EPSS is low at 0.18% (7th percentile), and our independent assessment scores this 5.3 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) rather than the inflated 8.8 base score, reflecting availability-only impact with high attack complexity and adjacent access requirements.
A stale virtual interface entry in the Linux kernel's mac80211 WiFi stack can drive the kernel into a BUG() at net/wireless/core.h:141 (wiphy_to_rdev) and crash or corrupt memory when a network namespace holding a wiphy is destroyed and the wiphy's migration back to init_ns fails on a memory-allocation error. Kernels with mac80211 loaded are affected from the 2.6.32-era lineage carrying commit 463d018323851a608eef52a9427b0585005c647f, with local exploitation requiring namespace-administration privileges (PR:L) plus a racy, largely attacker-uncontrollable allocation failure (AC:H) - CVSS 3.1 base 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), though independent assessment downgrades confidentiality and integrity to LOW while retaining HIGH availability impact. No public exploit code has been identified at time of analysis, the CVE is not in CISA KEV, and EPSS is only 0.18% (7th percentile), so the effective real-world priority is LOW despite the HIGH base score; vendor-released patches exist in 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
Network namespace teardown in the Linux kernel's cfg80211 wireless configuration subsystem can leave a wiphy (wireless device) pointing at a freed network namespace when the interface migration back to the initial namespace fails, producing a kernel mode fault (reported at address 0x30 via genlmsg_multicast_netns / nl80211_notify_wiphy / wiphy_unregister) and crashing the host. The independent assessment rates this availability-only (C:N/I:N/A:H) with AV:L/PR:L, meaning a local attacker with low privileges - CAP_NET_ADMIN or access to an unprivileged user namespace that permits netns creation - is required, and the attack is complicated because it depends on a memory allocation failure occurring at exactly the right moment. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is 0.17% (6th percentile), consistent with a low-priority defensive fix rather than an imminent threat.
A memory-corruption bug in the Linux kernel's PXA DMA engine driver (pxad) causes the software descriptor counter nb_desc to be double-counted, leading to out-of-bounds indexing and freeing of descriptors that were never allocated. Only systems running the Marvell PXA dmaengine driver (CONFIG_PXA_DMA / pxad) and built with gcc 15.1 or clang 22.1 or newer are affected, because the kzalloc_flex() conversion of pxad_alloc_desc() only updates the __counted_by counter when __builtin_counted_by_ref() is available. The flaw requires local access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and a low-privileged user able to trigger DMA descriptor allocation through a consuming client; EPSS is low at 0.16% (5th percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
An out-of-bounds write in the Linux kernel's siw (Soft-iWARP) RDMA driver lets a connected iWARP peer corrupt kernel memory by delivering an extended DDP/RDMAP header split across more than one TCP receive callback; the miscalculated copy length (hdrlen - MIN_DDP_HDR instead of the number of missing bytes) pushes the destination past the header, overwrites the receive state including fpdu_part_rcvd, and a later callback reuses that corrupted value as a copy offset. The upstream CVSS 3.1 vector scores this 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates it AV:N/AC:H (8.1) because exploitation requires the siw driver to be loaded - it is not enabled in default Linux configurations - and requires the attacker to control TCP segmentation so the header spans multiple callbacks; no authentication is needed once an RDMA session exists. Exploitation status: no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and the issue is not listed in CISA KEV, though a vendor patch is available for the stable branches.
Use-after-free in the Linux kernel netfilter flowtable datapath allows a local, authenticated low-privileged user to potentially execute code, corrupt memory, or disclose information by winning a race condition against the RCU grace period. Affected are unpatched kernels in the 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 7.2.x, 7.3-rc, and 6.18.x ranges before their respective fixes; systems without a configured netfilter flowtable offload are not exposed. No public exploit code has been identified at time of analysis, and the EPSS score is 0.22% (11th percentile), indicating low predicted exploitation activity; vendor patches are available.
Memory corruption in the Linux kernel's SMB/CIFS client (cifs.ko) allows a local user with write access to a mounted share to trigger out-of-bounds writes and a massive heap/stack overflow by creating a native symlink whose absolute target lacks an NT drive prefix. Affected code ships in mainline Linux from 6.15.6 onward and is patched in 6.16, with stable backports in 7.2.8 and 7.3-rc4 per EUVD; exploitation requires a Linux client to have mounted a share using default settings (symlinkroot unset) and an attacker able to place a crafted symlink on that share, matching the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector. Impact is high confidentiality, integrity and availability loss through kernel memory corruption, though EPSS is only 0.16% (5th percentile) and no public exploit code has been identified at time of analysis - no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Local use-after-free in the Linux kernel's virt_wifi virtual wireless driver (CVE-2026-98311) lets a low-privileged local attacker with network-admin capability corrupt kernel memory, causing a crash and potentially enabling code execution in kernel context. virt_wifi_newlink() propagates the lower device's operstate before the new netdevice is registered, so a dormant lower device queues the still-uninitialized netdev on the linkwatch event list; if registration later fails - attacker-controllable by supplying an interface name such as 'bad/name' - free_netdev() releases the object and the subsequent linkwatch_fire_event() dereferences freed memory. Exposure is narrow: exploitation is strictly local, requires CAP_NET_ADMIN (attainable via user namespaces on some distributions) plus the rarely deployed virt_wifi module, no public exploit code has been identified, CISA KEV does not list this issue, and EPSS is only 0.22% (11th percentile).
A race condition in the Linux kernel's mxl862xx DSA driver for MaxLinear MxL862xx Ethernet switches allows a stats-polling delayed work item to execute against already-freed dsa_port structures, yielding a use-after-free with high confidentiality, integrity and availability impact. The flaw is reachable only by an authenticated, highly privileged local actor (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H per independent assessment) who can drive a teardown path - switch unregister, driver shutdown, driver unbind, or a failed dsa_register_switch() during probe - and simultaneously win a narrow timing race, since the WORK_STOPPED flag test is not atomic with cancel_delayed_work_sync(). Exploitation additionally requires kernel builds compiled with the mxl862xx driver and actual MaxLinear MxL862xx switch silicon present and bound, so practical exposure is limited; there is no public exploit identified at time of analysis, EPSS is a low 0.16% (5th percentile), and the issue is not in CISA KEV.
A possible kernel deadlock in the Linux kernel's Bluetooth RFCOMM listener teardown path can be reached by an unauthenticated attacker within Bluetooth radio range (AV:A, PR:N per the vector) who races a new incoming RFCOMM connection against the cleanup of a listening socket. Triggering requires Bluetooth to be enabled on the target, a live application listening on an RFCOMM channel, proximity, and a narrow timing window (AC:H); the condition was reported by lockdep as a POSSIBLE lock-order inversion between a child socket lock and rfcomm_mutex, not a confirmed and reliably reproducible crash, and the assessed impact is availability only (C:N/I:N/A:H). No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is very low at 0.18% (7th percentile); vendors have released fixes.
Use-after-free in the Linux kernel's KVM PowerPC Book3S HV nested-virtualization path (kvmhv_emulate_tlbie_all_lpid) lets a local attacker who controls an L1 guest corrupt host kernel memory by racing a tlbie-driven nested-guest free against a vCPU iterating the nested-guest IDR, yielding high confidentiality and integrity impact on the host (assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H; the vendor/NVD vector lists the same impacts with AC:L for 8.8). Exploitation is timing-dependent and limited to PowerPC Book3S HV hosts running KVM with nested virtualization enabled and exercised; there is no public exploit code identified at time of analysis and EPSS is low (0.18%, 7th percentile), so risk is serious but narrow. Vendor fixes are released in Linux 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4 (EUVD-2026-93211).
Memory corruption and scope-changing host impact in the Linux kernel's PowerPC IOMMU TCE handling affect ppc64 systems where a local low-privileged actor can invoke multi-page TCE hypercalls such as H_STUFF_TCE or H_PUT_TCE_INDIRECT with npages greater than 1. The flaw is in iommu_tce_check_ioba(), which used a hardcoded page count of 1 instead of the caller-supplied npages, so the intended bounds check can be bypassed and the TCE table capacity may be exceeded, yielding the assessed full confidentiality, integrity, and availability impact on the host under a scope-changing vector. No public exploit identified at time of analysis, no CISA KEV entry was provided, and EPSS is low at 0.18% (7th percentile); vendor patches are available.
Local privilege escalation in the Linux kernel futex subsystem (CVE-2026-98281) lets an existing local user with the ability to execute binaries corrupt or manipulate the per-mm private futex hash, potentially leading to full compromise of confidentiality, integrity and availability on the affected host. The flaw stems from the kernel failing to allocate the private futex hash when the mm is shared across a vfork() (or other CLONE_VM) boundary, so private futex waiters can exist before that hash is initialized; the fix closes this ordering window. Exploitation requires an authenticated local account (CVSS PR:L) and reliable triggering of the ordering condition, which our assessment rates as high attack complexity despite the vendor's base vector (AV:L/AC:H versus the published AC:L). There is no public exploit identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at roughly 0.17% (6th percentile), indicating a genuine but non-urgent local-privilege-class kernel flaw rather than an internet-facing emergency.
A race condition in the Linux kernel networking stack (sock_gettstamp()) allows a local, authenticated unprivileged user to trigger a slab-use-after-free in the UDP receive path by issuing a SIOCGSTAMPNS_NEW socket-timestamp ioctl on a UDP socket concurrently with a bind() on that same socket. Because sock_enable_timestamp() modifies sk->sk_flags with non-atomic bit operations while the SIOCGSTAMPNS_NEW path does not hold the socket lock, the concurrent read-modify-write can silently drop the SOCK_RCU_FREE bit that udp_lib_get_port() had just set, causing sk_destruct() to free the socket immediately instead of after an RCU grace period while lockless receive lookups still hold a pointer to it. Exploitation is local-only and requires winning a narrow timing window (our assessment rates it AV:L/AC:H/PR:L, versus the vendor-published CVSS 3.1 score of 7.8 with AC:L), EPSS is low at 0.18% (7th percentile), there is no KEV listing and no public exploit identified at time of analysis, and vendor-released patches exist for the affected stable branches.
Kernel memory corruption in the Linux CIFS/SMB client (cifs.ko) allows a malicious or compromised SMB server to have a channel and its primary server structure freed while the client still dereferences them, producing a use-after-free that crashes the kernel and can expose or corrupt freed memory. Exposure is limited to clients that mount a share from an attacker-controlled server with SMB multichannel in use: the vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) indicates no client-side credentials are required, but the victim must initiate the mount and the bug depends on a race/teardown timing window, so the net real-world risk is lower than the 8.1 base score suggests. No public exploit code is identified at time of analysis, EPSS is 0.18% (6th percentile), and vendor-released patches exist for the affected stable branches.
Use-after-free in the Linux kernel's POSIX CPU-timer cleanup path during exec() can corrupt kernel memory and, under the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), potentially lead to local privilege escalation or arbitrary code execution in kernel context. The flaw exists in kernels from Linux 5.7 onward and is triggered when a non-leader thread that has armed a CLOCK_THREAD_CPUTIME_ID timer calls execve(), the exec later fails after bprm->point_of_no_return, and the task is forced into do_exit() before begin_new_exec() reaches posix_cpu_timers_exit(), freeing a k_itimer whose node is still queued in an rbtree. Exploitation requires local code execution as an unprivileged user and winning a narrow timing race around a failing exec path, so it is not remotely reachable; EPSS is low (0.18%, 6th percentile) and no public exploit has been identified at time of analysis, while vendor-released patches exist in 6.6.158, 6.12.112, 6.18.54 and 7.2.8.
Use-after-free in the Linux kernel's POSIX CPU timer subsystem lets a local low-privileged user free a timer that is still queued on the expiry handler's private firing list, corrupting kernel memory and opening the door to privilege escalation or denial of service on kernels built from commit bf635681c906 onward (roughly 6.13 until the referenced stable fixes). Exploitation needs only the standard timer_create/timer_settime/timer_delete calls available to ordinary users, but it is gated by a narrow concurrency window that must be won (assessed CVSS:3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), which keeps real-world risk modest. No public exploit code or confirmed active exploitation is known and EPSS is 0.17% (6th percentile), while vendor patches are available.
A protocol-version negotiation mismatch during RDS-over-RDMA connection setup in the Linux kernel deadlocks the kernel by making an RDMA-CM event handler wait on itself, permanently stalling the RDS connection workqueues and causing denial of service. Only hosts with the RDS stack loaded and bound to an RDMA transport (InfiniBand, RoCE, or iWARP) that expose a reachable RDMA-CM listener are affected; unauthenticated peers able to establish an RDMA-CM connection - typically from the same RDMA fabric or subnet (assessed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - can trigger it by negotiating a protocol version older than RDS_PROTOCOL_COMPAT_VERSION. Impact is availability-only (C:N/I:N/A:H); EPSS is low at 0.18% (7th percentile), no public exploit code has been identified at time of analysis, and vendor patches are available for the affected stable branches.
Use-after-free write in the Linux kernel's signal delivery path lets a local, unprivileged user corrupt a freed POSIX timer sigqueue and potentially escalate privileges on the host. The race triggers when a non-leader thread calls execve() while a blocked SIGEV_THREAD_ID timer signal aimed at the old thread-group leader's TID is being flushed, so the kernel can re-queue the sigqueue onto a task::pending list that release_task()/exit_signals() is concurrently tearing down and then dereference the freed timer via a later tgkill(). Affected builds are those carrying the change that moved the sigqueue flush out of the sighand-locked region (EUVD lists Linux 6.15 era onward); exploitation requires local access and winning a timing/memory-ordering race, no public exploit code has been identified at time of analysis, the CVE is not listed in CISA KEV, and EPSS is 0.17% (6th percentile), so the practical concern is a HIGH-severity (7.8 base, C:H/I:H/A:H) local privilege-escalation primitive rather than mass exploitation.
Incorrect page-frame/offset bookkeeping in the Linux kernel's swiotlb bounce-buffer code (swiotlb_bounce) can place DMA copies one page away from the intended location whenever a non-zero tlb_offset, produced by partial syncs through dma_sync_single_range_for_cpu()/for_device(), crosses a page boundary. Affected are kernels with swiotlb bounce buffering plus meaningful highmem (typically 32-bit or large-memory builds); because the offset and the page frame are taken from mismatched values, DMA_FROM_DEVICE can overwrite the wrong page while leaving the intended page stale, and DMA_TO_DEVICE can feed data from a page the mapping may not cover, and a lowmem-recorded slot can even be adjusted into highmem and then passed to phys_to_virt(). The assessed vector is local, PR:L (authenticated local access), with AC:H reflecting that the flaw is dormant for aligned full-buffer DMA and needs a DMA pattern that produces a page-crossing offset, so although confidentiality, integrity and availability impact are all rated High, reliable targeted exploitation is difficult; no public exploit code has been identified at time of analysis and EPSS is low at 0.18% (6th percentile), with no CISA KEV listing.
A race-condition use-after-free in the Linux kernel's RDMA user-space connection manager (ucma) allows a local user who can open /dev/infiniband/rdma_cm to corrupt kernel memory and potentially escalate privileges. Two concurrent JOIN_MCAST calls for the same multicast address, combined with a forced copy_to_user() failure, can leave a queued RoCE work item dereferencing a ucma_multicast structure that another thread has already freed, because ucma_process_join() dropped ctx->mutex after a successful join and reacquired it only on error. No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA KEV: not listed), EPSS is a low 0.18% (7th percentile), and real-world risk is limited by the requirement for local RDMA/RoCE configuration plus a narrow timing window - so despite the 7.8 base score this is a LOW-priority issue in practice.
Refcount initialization ordering in the Linux kernel's RDMA iWARP port-mapper (iwpm) subsystem allows a local, low-privileged attacker to trigger a kref "addition on 0" race that can lead to premature object release and kernel memory corruption, rated 7.0 High (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Only systems that actually load and use the RDMA stack with iWARP port-mapper netlink traffic are exposed - the iwpm subsystem is not active on default desktop or server installs without InfiniBand/RDMA hardware or the software RDMA drivers (rxe, siw). Exploitation requires local code execution plus winning a narrow timing window on an SMP system, and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is 0.22% (11th percentile).
A race condition in the Linux kernel's Open vSwitch conntrack label handling lets a local user trigger a read of a reallocated-and-freed conntrack extension block, which can leak kernel memory or corrupt state in the OVS datapath. ovs_ct_get_conn_labels() added a label extension even to already-confirmed conntrack entries, so a lockless reader on another CPU could dereference storage that was freed underneath it; the fix restricts extension insertion to unconfirmed conntracks and makes a label operation on a label-less confirmed conntrack fail instead. The flaw exists in kernels carrying the OVS conntrack labels feature (introduced around Linux 4.3) and is fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4. Exploitation is local and authenticated (CVSS:3.1/AV:L/AC:H/PR:L/UI:N per the independent assessment), requires OVS with connection tracking and labels actively configured, and depends on winning a narrow timing window; EPSS is 0.18% (7th percentile) and there is no CISA KEV entry or public exploit identified at time of analysis.
Local use-after-free in the Linux kernel's dma-buf/dma-fence subsystem lets a low-privileged local user with access to a fence-exposing interface (DRM/GPU, sync_file, or other DMA-buf consumers) read freed kernel memory when a fence's timeline or driver name string is retrieved concurrently with the fence being signaled. The regression was introduced by an earlier NULL-pointer dereference fix that replaced the signaled-bit check with an ops-pointer check, which is insufficient because many dma_fence implementations never clear the ops pointer on free and thus lose the RCU protection that keeps the returned string alive. Impact is a kernel crash (denial of service) or disclosure of freed heap contents; exploitation requires local device access and winning a narrow race, and no public exploit has been identified at time of analysis (EPSS 0.16%, 5th percentile; no CISA KEV listing).
Out-of-bounds memory reads in the Linux kernel's IPv6 XFRM local path allow a locally authenticated attacker who can trigger specific XFRM/IPsec routing conditions to miscast a TCP request socket as a full IPv6 socket, disclosing kernel heap memory. The flaw affects Linux 3.2 and later and is triggered only when IPv6 XFRM tunnel routes are configured, an IPv6 TCP service emits SYN-ACKs, and rerouting selects a lower-MTU tunnel so the local PMTU or local error callback runs while the skb is still owned by a TCP_NEW_SYN_RECV request_sock. It requires local access with low privileges (CVSS vector PR:L, AV:L); there is no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and CISA KEV does not list it. Vendor patches are available, and the timing-dependent, non-default XFRM configuration substantially narrows the realistic attack surface below what the raw 7.8 score suggests.
A use-after-free write in the Linux kernel's lan743x Ethernet driver (Microchip LAN7430/LAN7431) lets a packet that spans more than one RX buffer trigger a kernel memory corruption through a stale skb pointer in the checksum-success path of lan743x_rx_process_buffer(), with the flawed write landing on freed fragment skb metadata. According to the vendor description this multi-buffer condition only arises transiently after an operator performs a live MTU increase, because existing ring entries retain their old, smaller buffer size until they are replenished; the vulnerable driver must be present and the host must be using that specific Microchip hardware. Vendor patches are available in the stable trees (6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4), EPSS is low at 0.18% (7th percentile), and no public exploit code or CISA KEV activity was identified at time of analysis; our independent assessment rates real-world priority LOW despite the vendor-supplied 8.1 CVSS because exploitation is gated on hardware, a concurrent operator-initiated MTU change, and a short-lived window.
A write use-after-free in the Linux kernel's XFRM (IPsec) state framework allows a local attacker who can add and delete xfrm states to corrupt freed slab memory, which in turn spawns a read use-after-free during state lookup. The defect is an incomplete fix: commit 14acf9652e56 switched the bydst/bysrc/byseq/byspi hash lists to hlist_del_init_rcu() but missed state_cache and state_cache_input, so a second __xfrm_state_delete() on the same state writes through the LIST_POISON2 pprev value instead of becoming a harmless no-op. Exploitation requires low privileges (CVSS PR:L, AV:L) - realistically the ability to manipulate xfrm state, normally gated by CAP_NET_ADMIN, which unprivileged users can obtain inside a user plus network namespace - and the attacker must win a timing-dependent delete/delete race (AC:H), so this is a real but not urgent kernel memory-corruption bug rather than a mass-exploitation priority: no public exploit identified at time of analysis, EPSS 0.21% (10th percentile), and no CISA KEV listing.
Use-after-free in the Linux kernel's IPsec/xfrm receive path (xfrm_input) can be triggered by a local attacker with low privileges on hosts that run IPsec with VTI tunnels or XFRM interfaces configured. The receive callbacks for VTI and XFRM interfaces - as well as the XFRM_MAX_DEPTH error path - call secpath_reset(), which can drop the last reference to an xfrm_state that xfrm_input() subsequently dereferences when selecting transport_finish() or reporting the drop-callback protocol; if that state is concurrently deleted, the freed object is accessed, yielding memory corruption with high confidentiality and integrity impact. Successful exploitation requires winning a race between secpath_reset() and concurrent xfrm_state teardown, so the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (note the high attack-complexity, which differs from the NVD-published AC:L value); EPSS is low at 0.21% (10th percentile), there is no KEV listing, and no public exploit identified at time of analysis.
A missing hardware memory-ordering barrier in the Linux kernel's MIPS EYEQ support lets a local, authenticated user crash the kernel on Mobileye EyeQ5 / MIPS I6500 systems. On I6500 cores the lld/scd (LL/SC) instructions provide no ordering guarantees, so arch_cmpxchg() - documented and relied upon as fully ordered - can be reordered and read freed or uninitialized memory, producing a kernel paging fault and oops (observed in anon_pipe_read while stressing an anonymous pipe, whose mutex uses cmpxchg). Exploitation requires CONFIG_EYEQ hardware, local access, and winning a timing/race window; there is no network vector and no impact on x86, ARM, or other MIPS configurations. The fix commit is public and includes a userspace reproducer (pipe_race.c), so publicly available exploit code exists, but no confirmed active exploitation (not in CISA KEV); EPSS is 0.15% (4th percentile), and the observed outcome is a kernel oops rather than a controlled compromise.
Incorrect DMA mmap handling in the Linux kernel's IB/hfi1 Omni-Path driver (PIO_CRED case) lets a local, authenticated user with access to the HFI character device crash the kernel with a corrupted page-table oops or, once only the offset arithmetic is corrected, permanently stall send-PIO transfers. Kernels from 6.3 onward that include the hfi1 driver are affected, but the fault is intermittent-it appears only when the hardware send-context index reaches 64 or 128-and requires Intel Omni-Path 100 hardware plus the PSM2 path to invoke hfi1_file_mmap(). No public exploit code was identified at time of analysis, EPSS is low (0.18%, 6th percentile), and vendor-released fixes exist in 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4; given the local-only vector, mandatory specialized hardware and intermittency, overall risk is assessed as moderate rather than high-priority.
Stale sysfs attributes left behind by the Linux kernel's w83791d hwmon driver after unbind can expose freed memory to local users, because the normal remove path deletes only the w83791d_group but not the optional w83791d_group_fanpwm45 group created when the fan/pwm 4-5 pins are not used as GPIO. Callbacks on those leftover files dereference devm-allocated driver data that is released after unbind, creating a use-after-free condition. The flaw is local-only and highly conditional (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0): it requires a system physically equipped with the Winbond W83791D sensor chip, the fan/pwm 4-5 pins not configured as GPIO, and a driver unbind through the normal teardown path, and exploitation further depends on winning a race against the devm free. There is no public exploit identified at time of analysis, EPSS is low at 0.22% (11th percentile), and vendor patches are available in the stable trees.
A slab use-after-free read in the Linux kernel's drm/msm driver (Qualcomm Adreno GPUs) allows a local, low-privileged user with access to the DRM device node to leak or corrupt freed kernel memory. The flaw arises because msm_ringbuffer_destroy() and msm_gem_vm_free() call drm_sched_fini() and then free objects that still embed a drm_gpu_scheduler with plain kfree(), while a signalled fence exported to userspace (submit out-fence or VM_BIND fence via sync_file/drm_syncobj) still points at that embedded scheduler; an unprivileged SYNC_IOC_FILE_INFO call then reaches drm_sched_fence_get_timeline_name() and dereferences the freed slab. Rated CVSS 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) with EPSS of only 0.21% (10th percentile) and no public exploit identified at time of analysis; the issue is confined to systems where the msm driver is built and loaded, and is fixed by freeing these scheduler-containing objects with kfree_rcu().
Use-after-free in the Linux kernel's CIFS/SMB client can be triggered when the cifs_demultiplex_thread exits while a reconnect work item is still queued on cifsiod_wq, allowing smb2_reconnect_server() to read a server structure that clean_demultiplex_info() has already freed with kfree_sensitive(). The bug is reached unauthenticated per the vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R), but it requires an active CIFS/SMB mount to an attacker-controlled or repeatedly failing SMB server plus a narrow race at connection teardown, which is why the assessed impact is LOW in practice even though the published base score is 7.5. EPSS is 0.21% (10th percentile), no public exploit has been identified at time of analysis, and vendor fixes exist in the 6.6.158, 6.12.112, 6.18.54 and 7.2.8 stable releases.
Kernel memory corruption and crash in the Linux kernel's SMB/CIFS client (cifs.ko) arises from a missing list-head initialization in TCP_Server_Info.rlist combined with a race in cifs_signal_cifsd_for_reconnect(). Because rlist is allocated with kzalloc, its ->next and ->prev pointers are NULL rather than self-referential, so list_empty() always returns false and list_add() dereferences a NULL ->prev; concurrently, multiple cifsd threads can add the same server's rlist node twice, corrupting the list. Only systems actively using the kernel SMB/CIFS client with a mounted share and a reconnect event are affected; the authoritative assessment scores this CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H, i.e. unauthenticated but requiring user interaction and a hard-to-win timing race, with impact limited to a kernel crash (denial of service) rather than code execution or data theft. EPSS is low at 0.18% (6th percentile), and no public exploit has been identified at time of analysis.
Kernel slab memory disclosure in the Linux kernel's SMB/CIFS client (cifs.ko) occurs when a malicious or compromised SMB3 server returns a short reply to a snapshot-enumeration ioctl (FSCTL_SRV_ENUMERATE_SNAPSHOTS), causing smb3_enum_snapshots() to set ret_data_len to sizeof(struct smb_snapshot_array) (12 bytes) without validating the server's actual reply length; the subsequent copy_to_user() then reads past the end of the server-sized retbuf and exposes adjacent kernel heap contents to the requesting user-space process. Only Linux systems acting as SMB clients are affected, and exploitation requires the victim to connect outbound to the attacker-controlled server and actively trigger snapshot enumeration (UI:R) while running a kernel with the vulnerable cifs client code, so unauthenticated remote attackers cannot reach an idle host. There is no public proof-of-concept and no evidence of active exploitation at time of analysis; EPSS is 0.21% (11th percentile), and patches are available in stable releases 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
Use-after-free in the Linux kernel's drm/ttm graphics memory manager (a regression introduced by commit b2ed01e7ad3d, present in roughly 7.0.10 through 7.1 and in stable backports such as Ubuntu 7.0.0-31) allows a locally authenticated user with an active GPU workload to crash the kernel minutes to hours after a swapout event. Because ttm_bo_swapout_cb() skips the bulk_move bookkeeping on successful swapout, a swapped-out resource stays on its buffer object's bulk_move range and on the manager LRU while being unevictable; when it is later freed or the BO leaves the bulk_move, ttm_resource_del_bulk_move() skips it due to its unevictable guard, leaving a dangling cursor that the next ttm_lru_bulk_move_tail() or ttm_resource_add_bulk_move() dereferences. Exploitation requires local presence, an affected AMD/drm-ttm system, and timing-dependent hibernation or memory-pressure conditions (the reporter observed crashes in only 5 of 18 hibernation cycles), and no public exploit code has been identified at time of analysis; EPSS is 0.20% (9th percentile), signalling low near-term exploitation likelihood.
Denial of service in Scrapy 1.4.0 through 2.14.1 allows any web server the crawler visits to terminate the crawler process by returning a crafted Referrer-Policy response header, such as 'sys.exit', which the built-in RefererMiddleware treats as a Python import path and invokes. The flaw is reachable over the network without authentication or user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U, base 7.5 High), and its impact is limited to availability because only importable, zero-argument callables can be triggered, making realistic effect process termination rather than general arbitrary code execution. Any crawler left in its default configuration (RefererMiddleware enabled via REFERER_ENABLED=True) that fetches attacker-controlled pages is exposed; no public exploit identified at time of analysis, and the vendor-released patch is Scrapy 2.14.2.
Prototype pollution in `@graphql-tools/utils` `mergeDeep()` lets a remote, unauthenticated client submit a single aliased GraphQL query that overwrites inherited JavaScript built-ins such as `Function.prototype.call`, causing denial of service against the gateway or schema-stitching service until it is restarted. Only deployments built on @graphql-tools/utils <= 12.0.0 that actually merge objects returned from two subgraphs (the ordinary `@shareable` field or cross-subgraph entity case, e.g. Hive Gateway) invoke the vulnerable code path; single-subgraph servers are not affected. Both CVSS 4.0 (8.2, AV:N/AC:L/AT:P/PR:N/UI:N/VA:H) and the assessor's CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree on high availability impact with no confidentiality or integrity impact, and no public exploit code has been identified at time of analysis.
Local file disclosure in Docling allows crafted HTML to embed readable files from the host filesystem into the rendered page image. When an application explicitly sets HTMLBackendOptions(render_page=True), has the optional Playwright dependency installed, and passes untrusted HTML as a filesystem Path, the HTML backend's browser request filter fails to enforce the enable_local_fetch setting or confine file:// access to the source document's directory, so an <iframe src="file:///..."> can pull in .env files, credentials, or other users' documents that Chromium then renders visibly into the output image. Publicly available exploit code exists and the issue is fixed in 2.118.1; EPSS is low (0.30%, 21st percentile) and there is no indication of active exploitation, so real-world priority is comparatively low despite the 7.5 CVSS, because exploitation demands a specific non-default configuration and disclosure is passive, read-only, and limited to text content Chromium renders in the viewport.
Import-time code execution in Docling 2.27.0 through 2.131.0 lets any distribution already present in the same Python environment that registers an entry point in the 'docling' group run arbitrary code as soon as Docling's plugin factories initialize - even when allow_external_plugins is set to false, because the plugin manager imports every registered module before the namespace allow-list is applied and then misleadingly logs that the plugin was skipped. The assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms this is a local, supply-chain-style prerequisite: an attacker must first get a third-party or compromised package installed and registered, and Docling must then be started by a user, so there is no remote network exploitation path. No public exploit code or active exploitation is known at time of analysis (EPSS 0.11%, percentile 1%; CISA SSVC exploitation: none), and the vendor has shipped a fix in 2.131.0.
Docling 2.94.0 through 2.131.x allows an attacker-supplied LaTeX/TikZ document to read files accessible to the converter process and create or overwrite writable files when the caller has explicitly opted into Tectonic rendering via LatexBackendOptions(tikz_engine="tectonic"); enabling the additional tikz_engine_allow_shell_escape option escalates this to shell command execution through TeX. The default Docling configuration does not enable Tectonic rendering and is not affected, and exploitation further requires a victim or operator to feed the crafted document into the pipeline (UI:R), which is why the practical risk is conditional despite the high CVSS base score. Both docling and docling-slim are affected; the flaw is fully fixed in 2.132.0, EPSS is a low 0.30% (21st percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis.
An out-of-bounds heap read in libexpat's XML_ParseBuffer (expat/lib/xmlparse.c) allows disclosure of adjacent heap memory to the calling application when the caller-supplied len exceeds the remaining capacity of the parse buffer. The vulnerable path is reachable only when a parse buffer already exists - created by a prior XML_GetBuffer call (or a prior XML_Parse call that allocates one internally), otherwise the function returns XML_ERROR_NO_BUFFER - and when the embedding application passes a length that does not match the buffer it actually filled; default parsing where len equals the buffer contents is not affected, and the CVSS 4.0 vector (AV:N/PR:N, no privileges required) confirms this is unauthenticated from the network perspective. Successful reads can disclose heap pointers, libc function pointers and code pointers, undermining ASLR, but exploitation is contingent on application-specific misuse of the API, so no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status is reported. Note that the official CVSS 4.0 score is 8.3 (AT:P reflects the buffer-must-exist precondition), while an independent assessment scored it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L, i.e. information disclosure with no integrity impact and only a low availability impact.
Cache poisoning in BuildKit lets a malicious image advertise DiffIDs that do not match its actual layer contents, so a daemon with a shared or persistent cache can adopt attacker-controlled layers as the base for a victim image and execute attacker code inside the victim build - for example by replacing a commonly executed path such as /bin/sh, reading build secrets mounted into the build, altering output artifacts, or hanging the build. Exploitation is unauthenticated but conditional: the attacker's image must be processed before the victim build on a daemon with a shared or persistent cache (multi-tenant or long-lived CI/build farms), and a victim build must then reference the targeted base image; ephemeral, non-shared caches are unaffected. No public exploit code identified at time of analysis; the vendor patch is BuildKit v0.33.1, and the issue carries a CVSS 7.5 (CVSS 4.0) rating with our independent assessment at CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L.
Resource exhaustion in Apache Struts 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0 allows an unauthenticated remote attacker to amplify a small request into a far larger response, consuming server CPU and outbound network capacity. The issue is conditional: the target application must bind a request parameter to a java.math.BigDecimal property and then render that property through the Struts tag library; applications missing either behavior are not affected per the advisory and independent assessment. No public exploit has been identified at time of analysis, EPSS is low at 0.28% (19th percentile), and the impact is availability-only (CVSS 7.5 with C:N/I:N/A:H).
OGNL expression injection in Apache Struts can lead to remote code execution, but only when an application is explicitly configured with the legacy RESTful action mapper - a non-default setting that standard deployments do not use. All version branches are affected in the abstract (2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0), and on the Struts 7 branch exploitation additionally requires the OGNL allowlist to have been disabled, which is not the default. NVD rates this 9.8 (AV:N/AC:L/PR:N/UI:N), while our independent assessment lowers it to AC:H because the decisive limiting factor is the non-default mapper configuration; where that mapper is absent the flaw is not reachable. No public exploit code or CISA KEV entry has been identified at time of analysis, and EPSS is low at 0.36% (28th percentile), so exposure is driven principally by configuration review rather than by observed exploitation. Fixes are available in Struts 6.12.0 and 7.4.0.
Use-after-free in Google Chrome's Select component before version 155.0.8059.39 allows unauthenticated remote attackers to execute arbitrary code inside the browser's renderer sandbox, but only after socially engineering a victim into opening a crafted HTML page (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R). The impact is confined to the sandbox, so compromise of the host operating system would require chaining a separate sandbox-escape vulnerability. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google - the reporting party - has released a fixed build.
Remote code execution inside the Chrome renderer sandbox is possible on Chrome builds prior to 155.0.8059.39, where a use-after-free in the WebRTC component can be triggered by a crafted HTML page. The flaw is rated 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and assigned Chromium severity High; no authentication or prior privileges are required, but the victim must open or be redirected to the attacker's page (UI:R). Impact is confined to the renderer sandbox - reaching the host OS would require chaining a separate sandbox-escape vulnerability - and no public exploit was identified at time of analysis; the primary exposure window is the short period before Chrome's auto-update moves users to the fixed build.
Remote code execution inside the Chrome renderer sandbox is possible in Google Chrome builds prior to 155.0.8059.39, where a use-after-free defect in the HTML handling path can be triggered by a crafted HTML page. Any user running an unpatched desktop Chrome who loads attacker-controlled web content (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) can be targeted; no credentials or elevated privileges are required, but mandatory user interaction (UI:R) and the renderer sandbox confinement limit the direct blast radius, since escaping the sandbox to the host OS would require a separate, distinct vulnerability not covered by this CVE. Google has shipped a vendor patch (155.0.8059.39) and the issue was reported through the Chrome vulnerability program with a Chromium severity rating of High; no public exploit code and no confirmed active exploitation have been identified, and the affected-code flaw is consistent across the CPE wildcard for google:chrome.
Use-after-free in Google Chrome's Web Audio implementation affects versions prior to 155.0.8059.39, where a remote attacker can achieve arbitrary code execution inside the browser's renderer sandbox by getting a victim to open a crafted HTML page that exercises the Web Audio API. The flaw carries an assessed CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication or non-default configuration is required, but the attack does depend on user interaction (loading the page) and the resulting code execution is confined to the renderer sandbox, so full host compromise would require chaining a separate sandbox escape. Chromium rates the issue High severity, the vendor has published a fix in 155.0.8059.39, and no public exploit code has been identified at time of analysis; there is no CISA KEV confirmation of active exploitation.
Remote code execution confined to Chrome's renderer sandbox is possible in Google Chrome prior to 155.0.8059.39, where a use-after-free in the browser's Bindings layer can be triggered when a victim opens a crafted HTML page. The attack is unauthenticated (PR:N) but depends on user interaction (UI:R), and because the assessed scope is unchanged (S:U), code execution is contained inside the renderer sandbox - reaching the host would require a separate sandbox-escape vulnerability. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Chrome's automatic update mechanism narrows the realistic exposure window, making this a high-priority patch item rather than an emergency.
Incorrect authorization in Google Chrome's FileSystem component allows a remote attacker to break out of the browser sandbox and potentially execute arbitrary code at the operating system level on desktop builds prior to 155.0.8059.39. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6), no authentication or prior privileges are required, but exploitation is not automatic: the attacker must use social engineering to convince the victim to open a crafted HTML page, which aligns with CISA's SSVC rating of "not automatable" and a technical impact of "total" given the scope change across the sandbox boundary. There is no CISA KEV listing and no public exploit code identified at time of analysis, and a vendor patch is available, so this should be treated as a high-severity, patch-now issue rather than an actively exploited emergency.
Out-of-sandbox code execution is achievable in Google Chrome desktop builds prior to 155.0.8059.39 by exploiting a use-after-free in the browser-process TabStrip component, reached when a victim is socially engineered into opening an attacker-crafted HTML page. The flaw carries a 9.6 CVSS (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) because the corrupted component sits outside the renderer sandbox, so a successful exploit escapes Chrome's primary containment boundary; however, it is not a zero-click bug and no public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with Automatable 'no'. A vendor-released patch (155.0.8059.39) is available, making this a high-priority but currently non-weaponized patch-now item rather than an active incident.
Remote code execution outside the browser sandbox in Google Chrome prior to 155.0.8059.39 allows a remote attacker to execute arbitrary code on a victim's system via a crafted HTML page. The flaw is a use-after-free in the browser's Core component, and exploitation requires the victim to open attacker-controlled web content (UI:R) while no authentication or special privileges are needed (PR:N); the CVSS score is 9.6 with scope change (S:C) reflecting sandbox escape. Despite the high impact, there are no exploitation signals: no public exploit identified at time of analysis and the SSVC assessment lists exploitation as none, though the total technical impact and wide deployment make timely patching a priority.
Use-after-free in Google Chrome's Storage component (all versions prior to 155.0.8059.39) allows a remote attacker to execute arbitrary code outside the sandbox, but only after the attacker has already compromised the renderer process - typically by chaining a separate renderer bug - and only when a victim loads a crafted HTML page (CVSS 8.3, AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Because a prior renderer compromise, user interaction, and non-trivial heap grooming are all required, this is a second-stage sandbox-escape primitive rather than standalone initial access. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none, and Google has shipped a vendor patch in Chrome 155.0.8059.39.
Remote code execution inside the Chrome renderer sandbox is possible in Google Chrome versions prior to 155.0.8059.39 through a race condition in the V8 JavaScript engine, triggered when a victim loads a crafted HTML page. The flaw requires no authentication (PR:N) but does require user interaction (UI:R) and depends on winning a non-deterministic timing window, which is reflected in the assessed AC:H and makes reliable exploitation harder. Resulting code execution stays within the renderer sandbox, so escaping to the host OS would require chaining a separate sandbox-escape vulnerability; no public exploit code has been identified at time of analysis, and vendor patches are available.
Use-after-free in Google Chrome's parser allows remote attackers to execute arbitrary code within the browser's renderer sandbox by convincing a victim to visit a crafted HTML page. All Chrome builds prior to 155.0.8059.39 are affected, and exploitation requires user interaction (UI:R) but no authentication (PR:N). The flaw carries a High Chromium severity rating (CVSS 8.8) and no public exploit has been identified at time of analysis; however, standalone impact is constrained because the description specifies code execution 'inside the sandbox,' meaning a second vulnerability would be needed to escape to the host.
A use-after-free in the Chrome Tabs component of Google Chrome on macOS allows a remote attacker to potentially execute arbitrary code outside the sandbox when a victim loads a crafted HTML page, affecting all builds prior to 155.0.8059.39. Exploitation is unauthenticated (CVSS PR:N) but requires user interaction (UI:R) - the victim must navigate to or open attacker-controlled web content, with no zero-click vector indicated, and reliable code execution additionally depends on successful heap grooming of the freed object. The issue is assessed as a genuine high-priority problem rather than a high-CVSS-but-low-real-risk case (CVSS 9.6, scope-changed), and no public exploit was identified at time of analysis; a vendor patch is available in Chrome 155.0.8059.39.
Use-after-free in Chrome's Tint shader compiler lets a remote attacker achieve code execution outside the browser sandbox when a victim opens a crafted HTML page - the page drives Chrome's WebGPU pipeline so that Tint compiles a malicious WGSL shader that triggers the memory-safety flaw. The flaw affects Google Chrome builds prior to 155.0.8059.39 and is rated 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), with the scope-change sub-score reflecting that successful exploitation escapes the renderer sandbox and yields host-level impact; no authentication is needed, but the attacker must convince the user to visit the page (UI:R). No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no exploitation, so this is currently a high-priority patch-now issue rather than an actively exploited one; a vendor patch is available in the 155.0.8059.39 stable release.
Information disclosure in Google Chrome for iOS Autofill allows an attacker who lures a victim to a crafted HTML page to obtain sensitive form data that the browser failed to properly clear. Only Chrome for iOS builds prior to 155.0.8059.39 are affected; vulnerable instances require the Autofill feature to have been used so that sensitive data is actually present for the incomplete cleanup to expose. Exploitation requires no authentication (PR:N) but is gated by mandatory user interaction and social engineering (UI:R), meaning it cannot be triggered silently; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Note that the vendor-assigned CVSS of 8.8 overstates the impact relative to our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5), which scores confidentiality impact only, with no integrity or availability effect.
Out-of-sandbox code execution in Google Chrome for iOS (versions prior to 155.0.8059.39) stems from a missing authorization check that lets a remote, unauthenticated attacker who socially engineers a victim into opening a crafted HTML page run arbitrary code outside the browser sandbox (CVSS 3.1 base 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, CWE-862). Exploitation is not possible without user interaction - the victim must navigate to or open attacker-controlled content on a vulnerable iOS Chrome build - and no public exploit code was identified at time of analysis, with no KEV confirmation of active exploitation. The combination of a scope-changing sandbox escape with high confidentiality, integrity, and availability impact makes this a high-priority browser flaw, but the mandatory user interaction and the narrow affected population (only unpatched iOS Chrome builds) keep it short of an emergency-patch situation.
Use-after-free in the ANGLE graphics layer of Google Chrome allows a remote, unauthenticated attacker to execute arbitrary code outside the browser sandbox when a victim opens a crafted HTML page; the vulnerable code path is present in Chrome builds prior to 155.0.8059.39. Exploitation is not automatic - the attacker must lure the user into rendering the malicious page (UI:R), but no credentials are required and the assessed CVSS:3.1 vector scores 9.6 with a scope change (S:C) because successful exploitation escapes Chrome's primary containment boundary rather than staying inside the renderer sandbox. Only publicly available exploit code would normally elevate this beyond an urgent patch-now item: at the time of analysis there is no indication of confirmed active exploitation (no CISA KEV listing) and no public exploit identified, while a vendor patch is available. Note that the description scopes the flaw to Chrome on Android, whereas the only vendor reference is the Desktop stable-channel release notes - the affected platform should be verified against the vendor advisory before relying on a platform-specific assumption.
Sandbox escape in Google Chrome versions prior to 155.0.8059.39: a race condition (CWE-362) in the browser's font handling can be triggered when a victim renders a crafted HTML page, potentially allowing a remote, unauthenticated attacker to execute arbitrary code outside the browser sandbox. Exploitation requires the target to load or view the attacker-controlled page (UI:R) and depends on winning a timing-sensitive race (AC:H), which typically demands repeated attempts and precise memory grooming, making this a credible high-priority browser flaw rather than a confirmed emergency. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and a vendor patch is available from Google.
An integer overflow in the WebGL implementation of Google Chrome on Android lets a remote attacker potentially execute arbitrary code outside the browser sandbox on devices running any build prior to 155.0.8059.39. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), meaning exploitation is unauthenticated but requires the victim to open an attacker-controlled HTML page that exercises the vulnerable WebGL code path; the scope change (S:C) reflects the potential escape from Chrome's renderer sandbox rather than a mere renderer crash. At time of analysis there is no public exploit identified, CISA's SSVC assessment records Exploitation: none and Automatable: no, and a vendor patch exists, so the issue is high priority on impact and patch urgency rather than on observed exploitation. Because WebGL is enabled by default on Android Chrome, no special configuration is needed on the victim side beyond navigation to the malicious page.
Arbitrary code execution outside the browser sandbox is possible in Google Chrome on macOS prior to 155.0.8059.39, where a timing-dependent race condition (CWE-367) in the Core component can be won to break out of the renderer's sandbox. Exploitation is conditional rather than a single remote shot: the attacker must already have compromised the renderer process, must socially engineer the victim into opening and interacting with a crafted HTML page (UI:R), and must win a non-deterministic race that the AC:H rating and CISA's SSVC assessment (Exploitation: none, Automatable: no) indicate is unreliable and not readily scriptable. No public exploit code has been identified at time of analysis, and Google has shipped a fixed build, 155.0.8059.39; because the mandatory pre-existing renderer compromise is a high bar, this is best treated as a conditional priority to be handled through normal patching cadence rather than an emergency.
A race condition in Google Chrome's Fonts component prior to version 155.0.8059.39 lets a remote attacker escape the browser sandbox and execute arbitrary code at the browser's privilege level, but only after the attacker has already compromised a sandboxed renderer process through some separate, unrelated vulnerability. The exploit additionally requires the victim to load a crafted HTML page (UI:R) and the attacker to win a timing-dependent race (AC:H), so this is best understood as a sandbox-escape primitive rather than a standalone initial-access vector. There is no public exploit identified at time of analysis - CISA's SSVC assessment rates exploitation as 'none' and the flaw as not automatable - and a vendor-released patch (155.0.8059.39) is available, making this a high-priority defense-in-depth fix rather than a catastrophic unpatched bug.
Type confusion in ANGLE, Chrome's OpenGL ES abstraction layer, lets a remote attacker who has already compromised the renderer process execute arbitrary code outside the browser sandbox in Google Chrome versions prior to 155.0.8059.39. The victim must load attacker-controlled graphics content (crafted HTML invoking WebGL/ANGLE paths), so user interaction is required, and the bug cannot be triggered by merely visiting a page without a separate renderer exploit first - it is a second-stage sandbox-escape primitive in a multi-bug chain rather than an initial-access vector. No public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, but technical impact as total, consistent with the CVSS scope change (S:C), high confidentiality and integrity impact, and the High Chromium security severity rating.
Google Chrome on Android releases before 155.0.8059.39 mishandle Autofill reference resolution, allowing a remote attacker who socially engineers a victim into opening a crafted HTML page to read sensitive information held in the browser's Autofill store. The CVSS vector PR:N means no authentication is needed, but the required user interaction (UI:R) and social-engineering dependency are the main practical barriers; no public exploit code has been identified at time of analysis. Our independent assessment scores this as confidentiality-only (CWE-706, use of incorrectly-resolved name or reference), so it should be treated as an information-disclosure issue rather than code execution or data tampering.
Incorrect authorization (CWE-863) in Google Chrome's SiteIsolation component allows an unauthenticated remote attacker to execute arbitrary code in the browser when a victim loads a crafted HTML page, a flaw Google rates High and that carries a CVSS base score of 9.6. Exploitation is limited by the required user interaction (UI:R) - the victim must visit attacker-controlled or compromised web content on a build older than 155.0.8059.39 - so delivery hinges on drive-by browsing or social engineering rather than unattended compromise, consistent with CISA's SSVC rating of non-automatable. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in Chrome 155.0.8059.39.
Use-after-free in Google Chrome's Track component (versions prior to 155.0.8059.39) allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page. The flaw carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is network-reachable, low-complexity, and requires no authentication, with mandatory user interaction - the victim must navigate to or be redirected to attacker-controlled content - as the only gating prerequisite. Google rates the issue Critical and shipped a fix in the 155.0.8059.39 stable-channel release; no public exploit code has been identified at time of analysis, and the escape from the browser sandbox would require a separate, independent vulnerability.
Memory corruption in Google Chrome's Navigation component - a use-after-free (CWE-416) - allows a remote attacker to execute arbitrary code outside the browser sandbox on any Chrome installation prior to 155.0.8059.39 by getting a user to load a crafted HTML page. The flaw is rated Critical by Chromium with a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H): no authentication is required and delivery is network-based, but exploitation still depends on the victim rendering attacker-controlled content, and the scope change (S:C) reflects that successful exploitation escapes the renderer sandbox to affect the host system. No public exploit has been identified at time of analysis (CISA SSVC Exploitation: none, Automatable: no), and this is a genuine high-priority issue rather than an inflated high-CVSS score.
Use-after-free in the browser-process component of Google Chrome before 155.0.8059.39 lets a remote attacker execute arbitrary code outside the sandbox when a victim opens a crafted HTML page. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N) but requires the user to navigate to attacker-controlled content (UI:R); the scope change and high confidentiality, integrity, and availability ratings reflect that a successful page load escapes the renderer sandbox to reach host-level code execution, which pushes the base score to 9.6 and earns a Chromium security severity of Critical. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, so the practical near-term risk comes from the low complexity of the trigger (phishing, malvertising, or a compromised site) rather than from observed attacks. Vendor-released patch: Chrome 155.0.8059.39.
Remote code execution outside the browser sandbox is possible in Google Chrome builds prior to 155.0.8059.39 through a use-after-free flaw in the built-in Chromecast (Cast) component: an attacker who gets a victim to render a crafted HTML page can corrupt freed memory and run arbitrary code with the browser's privileges (CVSS 9.6, Chromium severity Critical). The sole hard prerequisite is user interaction - no credentials or elevated privileges are required per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) - and because Cast ships with standard desktop Chrome rather than as an optional extension, the exposed population is essentially every unpatched Chrome installation. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
Unauthenticated Go pprof debug endpoints exposed on the postgres-exporter metrics listener let any attacker who can reach that port from inside the cluster network read process arguments, full goroutine stacks, and heap memory - potentially leaking database connection strings and credentials - and repeatedly trigger CPU profiling to exhaust resources in a denial-of-service condition. The flaw is tracked as CVE-2026-83550 (CVSS 7.1, AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H per the vendor, C:H for confidentiality in our assessment) and affects postgres-exporter as shipped in Red Hat Multicluster Global Hub, where the CPE covers all tracked versions; exploitation requires adjacent/cluster network reachability rather than internet exposure. No public exploit code has been identified at time of analysis, and no CISA KEV listing indicates active exploitation; risk is best characterized as a real design flaw of moderate priority, with exposure materially reducible through NetworkPolicies that restrict access to the metrics port.
Credential disclosure in the MCP TypeScript SDK OAuth client (npm @modelcontextprotocol/sdk 1.12.0 through 1.30.1, and @modelcontextprotocol/client 2.0.0 through 2.1.0 in narrower configurations) lets a malicious or compromised MCP server direct the client's stored OAuth credentials to an authorization server of the attacker's choosing. Because saved credentials were never bound to the authorization server that issued them, a remote, unauthenticated attacker who controls or compromises the MCP server the victim connects to can silently receive a stored refresh_token and client_secret - or a bundled provider's client_secret or signed assertion - yielding full confidentiality impact (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, per the PR:N vector the request is unauthenticated). No public exploit code and no confirmed active exploitation were identified at time of analysis; exploitation requires the victim application to use the SDK's OAuth client over HTTP and to connect to an MCP server it does not fully trust while holding credentials for a legitimate authorization server.
A label-enforcement bypass in the External Secrets Operator (ESO) webhook generator lets any Kubernetes principal that is permitted to create webhook generator resources point a generator at a victim's Secret that was never labelled for webhook use, and then have its contents exfiltrated to an attacker-controlled URL. The flaw affects ESO releases from 0.10.0 up to (but not including) 1.3.2 and stems from an initialization-order bug that cleared the EnforceLabels flag after it had been set, so the provider-side check for the external-secrets.io/type=webhook label was skipped instead of failing. Exploitation is conditional: it requires an affected version, the webhook generator feature in use, and delegated RBAC rights to create generators.external-secrets.io/v1alpha1 Webhook objects, which is why the assessed vector carries PR:L; clusters that never use webhook generators or that tightly constrain generator creation are not exposed. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, and a vendor patch is available in 1.3.2.
OS command injection in lrzsz before 0.13.0 allows a remote ZMODEM/YMODEM sender to execute arbitrary shell commands as the receiving user by supplying a crafted filename during an lrz receive. The flaw is reachable only when lrz is invoked under a suffixed/alias name such as lrztar and operates in pipe mode, where procheader() in src/lrz.c forwards the unescaped filename to popen() and shell metacharacters are interpreted. Successful exploitation requires the victim to accept or initiate the transfer (UI:P) and yields command execution at the receiver's privilege level only (no cross-system impact per SC:N/SI:N/SA:N); no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-supplied CVSS 4.0 score is 7.7 (High) while an independent assessment rates it CVSS 3.1 8.1 with AC:H given the non-default invocation and interaction prerequisites.
Arbitrary file write through path traversal in lrzsz before 0.13.0 lets a malicious ZMODEM sender place files outside the current directory - including by absolute pathname - when the victim runs the lrz receive utility in restricted mode. Exploitation requires the victim to actively initiate or accept a ZMODEM transfer (UI:P/AT:P), the binary to be built without the --enable-pubdir option (the default, since only that build hardens checkpath()), and the attacker to control the sending side; the primitive is limited to files the receiving user account can already write, though overwriting SSH keys, shell profiles, or cron entries can extend impact. No public exploit identified at time of analysis, and the risk is a conditional integrity/availability issue rather than a mass-exploitation emergency given the user-interaction and build-configuration prerequisites.
A use-after-free and RCU-safety defect in the Linux kernel's IPsec/xfrm transport-mode packet reinjection path can crash or corrupt the kernel, and is reachable by a local low-privilege attacker (CVSS PR:L) who can also trigger network device unregistration. The flaw was introduced when xfrm_trans_reinject() was converted from a tasklet to a workqueue (commit 4f4920669d21), so finish callbacks such as ip6_rcv_finish() now run in process context without an RCU read-side critical section, and queued skbs may hold non-refcounted dst entries whose skb->dev is not kept alive while deferred. Our independent assessment scores this CVSS 3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (availability-only, high attack complexity), and there is no public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile) and no CISA KEV listing exists.
Use-after-free of GUP-pinned zerocopy page buffers in the Linux kernel's IPsec ESP out-of-place output path lets a local, authenticated user (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) who can send MSG_ZEROCOPY traffic over an ESP transform corrupt memory, potentially achieving privilege escalation (C:H/I:H/A:H), while the same code path simultaneously leaks an x->xfrag page per packet. Exploitation requires a host with IPsec ESP configured where esp->inplace == false and where the transmitted skb carries SKBFL_MANAGED_FRAG_REFS, so hosts without ESP or without zerocopy sends on that path do not reach the vulnerable frag mutation. No public exploit has been identified at time of analysis, the issue is not in CISA KEV, and the EPSS score is low (0.17%, 6th percentile), consistent with a moderate-priority local issue; vendor-released patches exist in 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, and 7.3-rc4.
A use-after-free race in the Linux kernel's RDMA/siw (SoftiWARP) driver lets a local, low-privileged user who can issue RDMA verbs operations corrupt kernel memory and potentially escalate privileges or crash the system. The bug is reachable when siw_qp_modify() fails inside siw_accept() and the QP's state_lock is released before the error path clears qp->cep, opening a window in which a concurrent ibv_modify_qp() transition to ERROR frees the same cep object. Exploitation requires the siw module to be loaded and a narrow race to be won, so practical risk is limited to environments using software RDMA; no public exploit code has been identified, EPSS is low (0.17%, 6th percentile), and the issue is not listed in CISA KEV, while vendor patches are available for all supported stable branches.
A use-after-free in the Linux kernel's RDMA/rxe (Soft-RoCE) memory-region re-registration path lets a local attacker who can reach the RDMA user-verbs character device corrupt kernel memory and potentially achieve privilege escalation, scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The bug is reachable only when rxe_rereg_user_mr() is called with both IB_MR_REREG_PD and IB_MR_REREG_ACCESS set while supplying an access bit outside RXE_ACCESS_SUPPORTED_MR, causing the protection domain to be reassigned without the core's use-count being rolled back and leading to a protection domain (and a memory window still referencing it) being freed while in use. Exploitation is realistically narrow: the rdma_rxe module must be loaded and an rxe device configured (not a default configuration), the attacker needs local device access, and an existing memory window must reference the PD; no public exploit code was identified at time of analysis and EPSS is low at 0.16% (4th percentile).
Out-of-bounds read and write in the Linux kernel's RDMA Soft-RoCE (rxe) driver (CVE-2026-98365) lets an unauthenticated peer on an already-established RDMA queue pair send a crafted RDMA-Write or RDMA-Read RETH whose iova+length wraps to zero, bypassing the mr_check_range() bounds check and causing a kernel oops (and possible memory corruption) in rxe_mr_copy_xarray(). No public exploit code was identified at time of analysis and EPSS is low at 0.17% (5th percentile), but realistic exposure is gated by configuration: the rdma_rxe module must be loaded and the host must expose Soft-RoCE on a reachable interface, which is not the default Linux setup. Vendor-released patches are available in stable kernels 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
A race-condition use-after-free in the Linux kernel's xfrm (IPsec) bundle-creation path allows a local attacker with low privileges to trigger a stale net_device pointer dereference, yielding kernel memory corruption with high confidentiality, integrity, and availability impact. The flaw is reachable when an IPv6 UDP send traverses xfrm_lookup_with_ifid()/bundle creation while a concurrent RTM_DELLINK tears down the underlying net_device - a capability typically obtained by an unprivileged user inside a user+network namespace on kernels that permit unprivileged namespaces. Exploitation is local-only and probabilistic (it depends on winning an inherent timing race and on xfrm/IPsec policies being active), so realistic risk is below the vendor CVSS of 7.8; EPSS is low at 0.15% (4th percentile), no public exploit code was identified at time of analysis, and the issue is not in CISA KEV.
Local privilege escalation and data-corruption primitive in the Linux kernel's RDMA/rxe (Soft-RoCE) software-RDMA driver: a missing HMM_PFN_WRITE permission test in the on-demand-paging (ODP) write path lets an unprivileged local user who can register an ODP memory region over a PROT_READ file mapping direct incoming RDMA traffic (RDMA WRITE, RDMA READ responses, SEND payloads, atomics) through kmap into read-only page-cache pages without ever triggering copy-on-write, overwriting files the attacker only holds O_RDONLY - classically /etc/passwd or a setuid binary - in the same primitive class as Dirty COW and CVE-2022-2590. The flaw was introduced by commit 0b261d7c1cd3 ("RDMA/rxe: Break endless pagefault loop for RO pages"), which stripped the access-permission test from rxe_check_pagefault() and left only HMM_PFN_VALID, affecting kernels built from that baseline (reported as Linux 6.16 onward) until the stable fixes. Exploitation is bounded by configuration: the rxe/Soft-RoCE module is not loaded by default on typical servers, and the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) confirms a local, authenticated attacker with low complexity but no network reach; EPSS is low at 0.16% (5th percentile), and no public exploit code or CISA KEV entry has been identified at time of analysis. Vendor patches are available.
A use-after-free in the Linux kernel's Soft-RoCE (rdma_rxe) driver allows a local user who can open the RDMA uverbs interface and issue ATTACH_MCAST on a UD queue pair to trigger freeing of a published multicast-group object while it is still reachable from the driver's mcg_tree, giving high confidentiality, integrity and availability impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The race is only reachable when the backing Ethernet multicast programming step, rxe_mcast_add(), fails mid-operation (for example -ENODEV after the backing netdev is removed, or a propagated dev_mc_add() error), which is why the attack complexity is High and the practical priority is low. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.18% (7th percentile), and vendor patches are available in mainline and multiple stable branches.
Local users with low privileges can drive the Linux kernel into a race condition in the RDMA/core helper ib_get_eth_speed(), which calls a net_device's ethtool callback after that device has already completed NETDEV_UNREGISTER and ndo_uninit during teardown, corrupting or crashing the kernel. Exposure is narrow: the host must have an active RDMA device bound to an Ethernet (RoCE) or InfiniBand link layer and that device must be unregistering while an asynchronous RDMA port query is in flight, so exploitation requires winning a tight timing window (upstream CVSS 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; the independent assessment keeps the same AV:L/AC:H/PR:L vector but rates confidentiality and integrity as low and availability as high). Vendor-released patches exist for stable branches 6.1.189, 6.6.158, 6.12.112, 6.18.54 and 7.2.8 (plus 7.3-rc4); no public exploit code or confirmed active exploitation is known, and EPSS is only 0.17% (5th percentile).
A teardown race in the Linux kernel's iSER target (ib_isert) frees the isert_conn and iscsit_conn structures while a deferred control PDU completion is still queued on isert_comp_wq, so isert_put_cmd() later dereferences freed memory - a slab use-after-free (KASAN splat) rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because it can in principle lead to kernel code execution, data disclosure, or a crash. Exposure is limited to hosts that run the LIO iSER target with the ib_isert module loaded and export an iSER/RDMA transport over an InfiniBand or RoCE fabric; the CVSS vector shows no authentication prerequisite (PR:N), but the attacker must win a narrow race between connection teardown and the workqueue handler, a window so tight that the reporter needed an injected msleep(200) to reproduce it reliably. No public exploit code and no CISA KEV entry are associated with this issue, EPSS is only 0.16% (5th percentile), and vendor-released stable patches are available.
An out-of-bounds read in the Linux kernel's legacy libipw 802.11 stack allows an unauthenticated attacker within wireless range to make affected systems walk roughly 64 KiB past the end of a received management frame buffer. Only machines using the legacy Intel PRO/Wireless ipw2100 or ipw2200 drivers are exposed, because those receive paths validate just the generic 24-byte three-address management header while libipw_process_probe_response() and libipw_network_init() assume the full 36-byte beacon/probe-response prefix; the length arithmetic then underflows and is truncated to 65524. The resulting flaw yields limited information disclosure (C:L) and a high availability impact via kernel crash (A:H) against adjacent-network attackers, though it is sharply constrained by the obsolete hardware requirement. Risk signals are low: EPSS is only 0.17% (6th percentile), there is no CISA KEV listing, and no public exploit has been identified at time of analysis.
Out-of-bounds reads in the Linux kernel's legacy libipw 802.11 management-frame parser, reachable through the ipw2100 and ipw2200 wireless drivers, let an unauthenticated attacker within wireless range crash the kernel by injecting a crafted association response that is shorter than the fixed 30-byte prefix. The root cause is an unsigned integer underflow: stats->len (u16) minus sizeof(*frame) (size_t) is evaluated in size_t and wraps, so the truncated u16 length handed to libipw_parse_info_param becomes a value near 64 KiB and the information-element parser walks well past the receive buffer. Exploitation requires the obsolete Intel PRO/Wireless 2100 or 2200BG hardware and driver stack to be present and processing association responses, so the realistic outcome is a denial-of-service kernel crash with only limited disclosure potential; no public exploit code has been identified at time of analysis, no KEV entry exists, and EPSS is a low 0.17% (6th percentile), while vendor-released patches are available in the 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4 kernels.
A use-after-free in the Linux kernel's cfg80211 wireless configuration subsystem can be triggered locally when a network interface is taken down while a scan is still running, causing cfg80211 to free a scan request that the Wi-Fi driver still believes it owns. Successful exploitation corrupts kernel memory reachable at scan completion (scan_done()), yielding high confidentiality, integrity, and availability impact, though the attacker must already hold local privileges sufficient to manage the wireless interface (CVSS PR:L) and must win a narrow asynchronous-cancellation race (assessed AC:H, versus the vendor's AC:L). There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.17% (6th percentile).
Kernel instability in the Linux wireless stack (cfg80211) lets an attacker-controlled rogue AP or Wi-Fi device within radio range drive a client into an assertion failure inside the BSS rbtree handling, resulting in a WARN_ON that becomes a full system crash when panic_on_warn is enabled. Only systems running the in-tree cfg80211/mac80211 code are affected, and exploitation requires an adjacent attacker plus a victim client actively associated to the malicious device; the malformed BSS type change does not occur in normal operation, so real-world exposure is limited to deliberate rogue-device scenarios. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); EPSS is low at 0.18% (7th percentile), and our independent assessment scores this 5.3 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) rather than the inflated 8.8 base score, reflecting availability-only impact with high attack complexity and adjacent access requirements.
A stale virtual interface entry in the Linux kernel's mac80211 WiFi stack can drive the kernel into a BUG() at net/wireless/core.h:141 (wiphy_to_rdev) and crash or corrupt memory when a network namespace holding a wiphy is destroyed and the wiphy's migration back to init_ns fails on a memory-allocation error. Kernels with mac80211 loaded are affected from the 2.6.32-era lineage carrying commit 463d018323851a608eef52a9427b0585005c647f, with local exploitation requiring namespace-administration privileges (PR:L) plus a racy, largely attacker-uncontrollable allocation failure (AC:H) - CVSS 3.1 base 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), though independent assessment downgrades confidentiality and integrity to LOW while retaining HIGH availability impact. No public exploit code has been identified at time of analysis, the CVE is not in CISA KEV, and EPSS is only 0.18% (7th percentile), so the effective real-world priority is LOW despite the HIGH base score; vendor-released patches exist in 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
Network namespace teardown in the Linux kernel's cfg80211 wireless configuration subsystem can leave a wiphy (wireless device) pointing at a freed network namespace when the interface migration back to the initial namespace fails, producing a kernel mode fault (reported at address 0x30 via genlmsg_multicast_netns / nl80211_notify_wiphy / wiphy_unregister) and crashing the host. The independent assessment rates this availability-only (C:N/I:N/A:H) with AV:L/PR:L, meaning a local attacker with low privileges - CAP_NET_ADMIN or access to an unprivileged user namespace that permits netns creation - is required, and the attack is complicated because it depends on a memory allocation failure occurring at exactly the right moment. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is 0.17% (6th percentile), consistent with a low-priority defensive fix rather than an imminent threat.
A memory-corruption bug in the Linux kernel's PXA DMA engine driver (pxad) causes the software descriptor counter nb_desc to be double-counted, leading to out-of-bounds indexing and freeing of descriptors that were never allocated. Only systems running the Marvell PXA dmaengine driver (CONFIG_PXA_DMA / pxad) and built with gcc 15.1 or clang 22.1 or newer are affected, because the kzalloc_flex() conversion of pxad_alloc_desc() only updates the __counted_by counter when __builtin_counted_by_ref() is available. The flaw requires local access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and a low-privileged user able to trigger DMA descriptor allocation through a consuming client; EPSS is low at 0.16% (5th percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
An out-of-bounds write in the Linux kernel's siw (Soft-iWARP) RDMA driver lets a connected iWARP peer corrupt kernel memory by delivering an extended DDP/RDMAP header split across more than one TCP receive callback; the miscalculated copy length (hdrlen - MIN_DDP_HDR instead of the number of missing bytes) pushes the destination past the header, overwrites the receive state including fpdu_part_rcvd, and a later callback reuses that corrupted value as a copy offset. The upstream CVSS 3.1 vector scores this 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates it AV:N/AC:H (8.1) because exploitation requires the siw driver to be loaded - it is not enabled in default Linux configurations - and requires the attacker to control TCP segmentation so the header spans multiple callbacks; no authentication is needed once an RDMA session exists. Exploitation status: no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and the issue is not listed in CISA KEV, though a vendor patch is available for the stable branches.
Use-after-free in the Linux kernel netfilter flowtable datapath allows a local, authenticated low-privileged user to potentially execute code, corrupt memory, or disclose information by winning a race condition against the RCU grace period. Affected are unpatched kernels in the 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 7.2.x, 7.3-rc, and 6.18.x ranges before their respective fixes; systems without a configured netfilter flowtable offload are not exposed. No public exploit code has been identified at time of analysis, and the EPSS score is 0.22% (11th percentile), indicating low predicted exploitation activity; vendor patches are available.
Memory corruption in the Linux kernel's SMB/CIFS client (cifs.ko) allows a local user with write access to a mounted share to trigger out-of-bounds writes and a massive heap/stack overflow by creating a native symlink whose absolute target lacks an NT drive prefix. Affected code ships in mainline Linux from 6.15.6 onward and is patched in 6.16, with stable backports in 7.2.8 and 7.3-rc4 per EUVD; exploitation requires a Linux client to have mounted a share using default settings (symlinkroot unset) and an attacker able to place a crafted symlink on that share, matching the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector. Impact is high confidentiality, integrity and availability loss through kernel memory corruption, though EPSS is only 0.16% (5th percentile) and no public exploit code has been identified at time of analysis - no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Local use-after-free in the Linux kernel's virt_wifi virtual wireless driver (CVE-2026-98311) lets a low-privileged local attacker with network-admin capability corrupt kernel memory, causing a crash and potentially enabling code execution in kernel context. virt_wifi_newlink() propagates the lower device's operstate before the new netdevice is registered, so a dormant lower device queues the still-uninitialized netdev on the linkwatch event list; if registration later fails - attacker-controllable by supplying an interface name such as 'bad/name' - free_netdev() releases the object and the subsequent linkwatch_fire_event() dereferences freed memory. Exposure is narrow: exploitation is strictly local, requires CAP_NET_ADMIN (attainable via user namespaces on some distributions) plus the rarely deployed virt_wifi module, no public exploit code has been identified, CISA KEV does not list this issue, and EPSS is only 0.22% (11th percentile).
A race condition in the Linux kernel's mxl862xx DSA driver for MaxLinear MxL862xx Ethernet switches allows a stats-polling delayed work item to execute against already-freed dsa_port structures, yielding a use-after-free with high confidentiality, integrity and availability impact. The flaw is reachable only by an authenticated, highly privileged local actor (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H per independent assessment) who can drive a teardown path - switch unregister, driver shutdown, driver unbind, or a failed dsa_register_switch() during probe - and simultaneously win a narrow timing race, since the WORK_STOPPED flag test is not atomic with cancel_delayed_work_sync(). Exploitation additionally requires kernel builds compiled with the mxl862xx driver and actual MaxLinear MxL862xx switch silicon present and bound, so practical exposure is limited; there is no public exploit identified at time of analysis, EPSS is a low 0.16% (5th percentile), and the issue is not in CISA KEV.
A possible kernel deadlock in the Linux kernel's Bluetooth RFCOMM listener teardown path can be reached by an unauthenticated attacker within Bluetooth radio range (AV:A, PR:N per the vector) who races a new incoming RFCOMM connection against the cleanup of a listening socket. Triggering requires Bluetooth to be enabled on the target, a live application listening on an RFCOMM channel, proximity, and a narrow timing window (AC:H); the condition was reported by lockdep as a POSSIBLE lock-order inversion between a child socket lock and rfcomm_mutex, not a confirmed and reliably reproducible crash, and the assessed impact is availability only (C:N/I:N/A:H). No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is very low at 0.18% (7th percentile); vendors have released fixes.
Use-after-free in the Linux kernel's KVM PowerPC Book3S HV nested-virtualization path (kvmhv_emulate_tlbie_all_lpid) lets a local attacker who controls an L1 guest corrupt host kernel memory by racing a tlbie-driven nested-guest free against a vCPU iterating the nested-guest IDR, yielding high confidentiality and integrity impact on the host (assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H; the vendor/NVD vector lists the same impacts with AC:L for 8.8). Exploitation is timing-dependent and limited to PowerPC Book3S HV hosts running KVM with nested virtualization enabled and exercised; there is no public exploit code identified at time of analysis and EPSS is low (0.18%, 7th percentile), so risk is serious but narrow. Vendor fixes are released in Linux 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4 (EUVD-2026-93211).
Memory corruption and scope-changing host impact in the Linux kernel's PowerPC IOMMU TCE handling affect ppc64 systems where a local low-privileged actor can invoke multi-page TCE hypercalls such as H_STUFF_TCE or H_PUT_TCE_INDIRECT with npages greater than 1. The flaw is in iommu_tce_check_ioba(), which used a hardcoded page count of 1 instead of the caller-supplied npages, so the intended bounds check can be bypassed and the TCE table capacity may be exceeded, yielding the assessed full confidentiality, integrity, and availability impact on the host under a scope-changing vector. No public exploit identified at time of analysis, no CISA KEV entry was provided, and EPSS is low at 0.18% (7th percentile); vendor patches are available.
Local privilege escalation in the Linux kernel futex subsystem (CVE-2026-98281) lets an existing local user with the ability to execute binaries corrupt or manipulate the per-mm private futex hash, potentially leading to full compromise of confidentiality, integrity and availability on the affected host. The flaw stems from the kernel failing to allocate the private futex hash when the mm is shared across a vfork() (or other CLONE_VM) boundary, so private futex waiters can exist before that hash is initialized; the fix closes this ordering window. Exploitation requires an authenticated local account (CVSS PR:L) and reliable triggering of the ordering condition, which our assessment rates as high attack complexity despite the vendor's base vector (AV:L/AC:H versus the published AC:L). There is no public exploit identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at roughly 0.17% (6th percentile), indicating a genuine but non-urgent local-privilege-class kernel flaw rather than an internet-facing emergency.
A race condition in the Linux kernel networking stack (sock_gettstamp()) allows a local, authenticated unprivileged user to trigger a slab-use-after-free in the UDP receive path by issuing a SIOCGSTAMPNS_NEW socket-timestamp ioctl on a UDP socket concurrently with a bind() on that same socket. Because sock_enable_timestamp() modifies sk->sk_flags with non-atomic bit operations while the SIOCGSTAMPNS_NEW path does not hold the socket lock, the concurrent read-modify-write can silently drop the SOCK_RCU_FREE bit that udp_lib_get_port() had just set, causing sk_destruct() to free the socket immediately instead of after an RCU grace period while lockless receive lookups still hold a pointer to it. Exploitation is local-only and requires winning a narrow timing window (our assessment rates it AV:L/AC:H/PR:L, versus the vendor-published CVSS 3.1 score of 7.8 with AC:L), EPSS is low at 0.18% (7th percentile), there is no KEV listing and no public exploit identified at time of analysis, and vendor-released patches exist for the affected stable branches.
Kernel memory corruption in the Linux CIFS/SMB client (cifs.ko) allows a malicious or compromised SMB server to have a channel and its primary server structure freed while the client still dereferences them, producing a use-after-free that crashes the kernel and can expose or corrupt freed memory. Exposure is limited to clients that mount a share from an attacker-controlled server with SMB multichannel in use: the vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) indicates no client-side credentials are required, but the victim must initiate the mount and the bug depends on a race/teardown timing window, so the net real-world risk is lower than the 8.1 base score suggests. No public exploit code is identified at time of analysis, EPSS is 0.18% (6th percentile), and vendor-released patches exist for the affected stable branches.
Use-after-free in the Linux kernel's POSIX CPU-timer cleanup path during exec() can corrupt kernel memory and, under the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), potentially lead to local privilege escalation or arbitrary code execution in kernel context. The flaw exists in kernels from Linux 5.7 onward and is triggered when a non-leader thread that has armed a CLOCK_THREAD_CPUTIME_ID timer calls execve(), the exec later fails after bprm->point_of_no_return, and the task is forced into do_exit() before begin_new_exec() reaches posix_cpu_timers_exit(), freeing a k_itimer whose node is still queued in an rbtree. Exploitation requires local code execution as an unprivileged user and winning a narrow timing race around a failing exec path, so it is not remotely reachable; EPSS is low (0.18%, 6th percentile) and no public exploit has been identified at time of analysis, while vendor-released patches exist in 6.6.158, 6.12.112, 6.18.54 and 7.2.8.
Use-after-free in the Linux kernel's POSIX CPU timer subsystem lets a local low-privileged user free a timer that is still queued on the expiry handler's private firing list, corrupting kernel memory and opening the door to privilege escalation or denial of service on kernels built from commit bf635681c906 onward (roughly 6.13 until the referenced stable fixes). Exploitation needs only the standard timer_create/timer_settime/timer_delete calls available to ordinary users, but it is gated by a narrow concurrency window that must be won (assessed CVSS:3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), which keeps real-world risk modest. No public exploit code or confirmed active exploitation is known and EPSS is 0.17% (6th percentile), while vendor patches are available.
A protocol-version negotiation mismatch during RDS-over-RDMA connection setup in the Linux kernel deadlocks the kernel by making an RDMA-CM event handler wait on itself, permanently stalling the RDS connection workqueues and causing denial of service. Only hosts with the RDS stack loaded and bound to an RDMA transport (InfiniBand, RoCE, or iWARP) that expose a reachable RDMA-CM listener are affected; unauthenticated peers able to establish an RDMA-CM connection - typically from the same RDMA fabric or subnet (assessed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - can trigger it by negotiating a protocol version older than RDS_PROTOCOL_COMPAT_VERSION. Impact is availability-only (C:N/I:N/A:H); EPSS is low at 0.18% (7th percentile), no public exploit code has been identified at time of analysis, and vendor patches are available for the affected stable branches.
Use-after-free write in the Linux kernel's signal delivery path lets a local, unprivileged user corrupt a freed POSIX timer sigqueue and potentially escalate privileges on the host. The race triggers when a non-leader thread calls execve() while a blocked SIGEV_THREAD_ID timer signal aimed at the old thread-group leader's TID is being flushed, so the kernel can re-queue the sigqueue onto a task::pending list that release_task()/exit_signals() is concurrently tearing down and then dereference the freed timer via a later tgkill(). Affected builds are those carrying the change that moved the sigqueue flush out of the sighand-locked region (EUVD lists Linux 6.15 era onward); exploitation requires local access and winning a timing/memory-ordering race, no public exploit code has been identified at time of analysis, the CVE is not listed in CISA KEV, and EPSS is 0.17% (6th percentile), so the practical concern is a HIGH-severity (7.8 base, C:H/I:H/A:H) local privilege-escalation primitive rather than mass exploitation.
Incorrect page-frame/offset bookkeeping in the Linux kernel's swiotlb bounce-buffer code (swiotlb_bounce) can place DMA copies one page away from the intended location whenever a non-zero tlb_offset, produced by partial syncs through dma_sync_single_range_for_cpu()/for_device(), crosses a page boundary. Affected are kernels with swiotlb bounce buffering plus meaningful highmem (typically 32-bit or large-memory builds); because the offset and the page frame are taken from mismatched values, DMA_FROM_DEVICE can overwrite the wrong page while leaving the intended page stale, and DMA_TO_DEVICE can feed data from a page the mapping may not cover, and a lowmem-recorded slot can even be adjusted into highmem and then passed to phys_to_virt(). The assessed vector is local, PR:L (authenticated local access), with AC:H reflecting that the flaw is dormant for aligned full-buffer DMA and needs a DMA pattern that produces a page-crossing offset, so although confidentiality, integrity and availability impact are all rated High, reliable targeted exploitation is difficult; no public exploit code has been identified at time of analysis and EPSS is low at 0.18% (6th percentile), with no CISA KEV listing.
A race-condition use-after-free in the Linux kernel's RDMA user-space connection manager (ucma) allows a local user who can open /dev/infiniband/rdma_cm to corrupt kernel memory and potentially escalate privileges. Two concurrent JOIN_MCAST calls for the same multicast address, combined with a forced copy_to_user() failure, can leave a queued RoCE work item dereferencing a ucma_multicast structure that another thread has already freed, because ucma_process_join() dropped ctx->mutex after a successful join and reacquired it only on error. No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA KEV: not listed), EPSS is a low 0.18% (7th percentile), and real-world risk is limited by the requirement for local RDMA/RoCE configuration plus a narrow timing window - so despite the 7.8 base score this is a LOW-priority issue in practice.
Refcount initialization ordering in the Linux kernel's RDMA iWARP port-mapper (iwpm) subsystem allows a local, low-privileged attacker to trigger a kref "addition on 0" race that can lead to premature object release and kernel memory corruption, rated 7.0 High (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Only systems that actually load and use the RDMA stack with iWARP port-mapper netlink traffic are exposed - the iwpm subsystem is not active on default desktop or server installs without InfiniBand/RDMA hardware or the software RDMA drivers (rxe, siw). Exploitation requires local code execution plus winning a narrow timing window on an SMP system, and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is 0.22% (11th percentile).
A race condition in the Linux kernel's Open vSwitch conntrack label handling lets a local user trigger a read of a reallocated-and-freed conntrack extension block, which can leak kernel memory or corrupt state in the OVS datapath. ovs_ct_get_conn_labels() added a label extension even to already-confirmed conntrack entries, so a lockless reader on another CPU could dereference storage that was freed underneath it; the fix restricts extension insertion to unconfirmed conntracks and makes a label operation on a label-less confirmed conntrack fail instead. The flaw exists in kernels carrying the OVS conntrack labels feature (introduced around Linux 4.3) and is fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4. Exploitation is local and authenticated (CVSS:3.1/AV:L/AC:H/PR:L/UI:N per the independent assessment), requires OVS with connection tracking and labels actively configured, and depends on winning a narrow timing window; EPSS is 0.18% (7th percentile) and there is no CISA KEV entry or public exploit identified at time of analysis.
Local use-after-free in the Linux kernel's dma-buf/dma-fence subsystem lets a low-privileged local user with access to a fence-exposing interface (DRM/GPU, sync_file, or other DMA-buf consumers) read freed kernel memory when a fence's timeline or driver name string is retrieved concurrently with the fence being signaled. The regression was introduced by an earlier NULL-pointer dereference fix that replaced the signaled-bit check with an ops-pointer check, which is insufficient because many dma_fence implementations never clear the ops pointer on free and thus lose the RCU protection that keeps the returned string alive. Impact is a kernel crash (denial of service) or disclosure of freed heap contents; exploitation requires local device access and winning a narrow race, and no public exploit has been identified at time of analysis (EPSS 0.16%, 5th percentile; no CISA KEV listing).
Out-of-bounds memory reads in the Linux kernel's IPv6 XFRM local path allow a locally authenticated attacker who can trigger specific XFRM/IPsec routing conditions to miscast a TCP request socket as a full IPv6 socket, disclosing kernel heap memory. The flaw affects Linux 3.2 and later and is triggered only when IPv6 XFRM tunnel routes are configured, an IPv6 TCP service emits SYN-ACKs, and rerouting selects a lower-MTU tunnel so the local PMTU or local error callback runs while the skb is still owned by a TCP_NEW_SYN_RECV request_sock. It requires local access with low privileges (CVSS vector PR:L, AV:L); there is no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and CISA KEV does not list it. Vendor patches are available, and the timing-dependent, non-default XFRM configuration substantially narrows the realistic attack surface below what the raw 7.8 score suggests.
A use-after-free write in the Linux kernel's lan743x Ethernet driver (Microchip LAN7430/LAN7431) lets a packet that spans more than one RX buffer trigger a kernel memory corruption through a stale skb pointer in the checksum-success path of lan743x_rx_process_buffer(), with the flawed write landing on freed fragment skb metadata. According to the vendor description this multi-buffer condition only arises transiently after an operator performs a live MTU increase, because existing ring entries retain their old, smaller buffer size until they are replenished; the vulnerable driver must be present and the host must be using that specific Microchip hardware. Vendor patches are available in the stable trees (6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4), EPSS is low at 0.18% (7th percentile), and no public exploit code or CISA KEV activity was identified at time of analysis; our independent assessment rates real-world priority LOW despite the vendor-supplied 8.1 CVSS because exploitation is gated on hardware, a concurrent operator-initiated MTU change, and a short-lived window.
A write use-after-free in the Linux kernel's XFRM (IPsec) state framework allows a local attacker who can add and delete xfrm states to corrupt freed slab memory, which in turn spawns a read use-after-free during state lookup. The defect is an incomplete fix: commit 14acf9652e56 switched the bydst/bysrc/byseq/byspi hash lists to hlist_del_init_rcu() but missed state_cache and state_cache_input, so a second __xfrm_state_delete() on the same state writes through the LIST_POISON2 pprev value instead of becoming a harmless no-op. Exploitation requires low privileges (CVSS PR:L, AV:L) - realistically the ability to manipulate xfrm state, normally gated by CAP_NET_ADMIN, which unprivileged users can obtain inside a user plus network namespace - and the attacker must win a timing-dependent delete/delete race (AC:H), so this is a real but not urgent kernel memory-corruption bug rather than a mass-exploitation priority: no public exploit identified at time of analysis, EPSS 0.21% (10th percentile), and no CISA KEV listing.
Use-after-free in the Linux kernel's IPsec/xfrm receive path (xfrm_input) can be triggered by a local attacker with low privileges on hosts that run IPsec with VTI tunnels or XFRM interfaces configured. The receive callbacks for VTI and XFRM interfaces - as well as the XFRM_MAX_DEPTH error path - call secpath_reset(), which can drop the last reference to an xfrm_state that xfrm_input() subsequently dereferences when selecting transport_finish() or reporting the drop-callback protocol; if that state is concurrently deleted, the freed object is accessed, yielding memory corruption with high confidentiality and integrity impact. Successful exploitation requires winning a race between secpath_reset() and concurrent xfrm_state teardown, so the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (note the high attack-complexity, which differs from the NVD-published AC:L value); EPSS is low at 0.21% (10th percentile), there is no KEV listing, and no public exploit identified at time of analysis.
A missing hardware memory-ordering barrier in the Linux kernel's MIPS EYEQ support lets a local, authenticated user crash the kernel on Mobileye EyeQ5 / MIPS I6500 systems. On I6500 cores the lld/scd (LL/SC) instructions provide no ordering guarantees, so arch_cmpxchg() - documented and relied upon as fully ordered - can be reordered and read freed or uninitialized memory, producing a kernel paging fault and oops (observed in anon_pipe_read while stressing an anonymous pipe, whose mutex uses cmpxchg). Exploitation requires CONFIG_EYEQ hardware, local access, and winning a timing/race window; there is no network vector and no impact on x86, ARM, or other MIPS configurations. The fix commit is public and includes a userspace reproducer (pipe_race.c), so publicly available exploit code exists, but no confirmed active exploitation (not in CISA KEV); EPSS is 0.15% (4th percentile), and the observed outcome is a kernel oops rather than a controlled compromise.
Incorrect DMA mmap handling in the Linux kernel's IB/hfi1 Omni-Path driver (PIO_CRED case) lets a local, authenticated user with access to the HFI character device crash the kernel with a corrupted page-table oops or, once only the offset arithmetic is corrected, permanently stall send-PIO transfers. Kernels from 6.3 onward that include the hfi1 driver are affected, but the fault is intermittent-it appears only when the hardware send-context index reaches 64 or 128-and requires Intel Omni-Path 100 hardware plus the PSM2 path to invoke hfi1_file_mmap(). No public exploit code was identified at time of analysis, EPSS is low (0.18%, 6th percentile), and vendor-released fixes exist in 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4; given the local-only vector, mandatory specialized hardware and intermittency, overall risk is assessed as moderate rather than high-priority.
Stale sysfs attributes left behind by the Linux kernel's w83791d hwmon driver after unbind can expose freed memory to local users, because the normal remove path deletes only the w83791d_group but not the optional w83791d_group_fanpwm45 group created when the fan/pwm 4-5 pins are not used as GPIO. Callbacks on those leftover files dereference devm-allocated driver data that is released after unbind, creating a use-after-free condition. The flaw is local-only and highly conditional (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0): it requires a system physically equipped with the Winbond W83791D sensor chip, the fan/pwm 4-5 pins not configured as GPIO, and a driver unbind through the normal teardown path, and exploitation further depends on winning a race against the devm free. There is no public exploit identified at time of analysis, EPSS is low at 0.22% (11th percentile), and vendor patches are available in the stable trees.
A slab use-after-free read in the Linux kernel's drm/msm driver (Qualcomm Adreno GPUs) allows a local, low-privileged user with access to the DRM device node to leak or corrupt freed kernel memory. The flaw arises because msm_ringbuffer_destroy() and msm_gem_vm_free() call drm_sched_fini() and then free objects that still embed a drm_gpu_scheduler with plain kfree(), while a signalled fence exported to userspace (submit out-fence or VM_BIND fence via sync_file/drm_syncobj) still points at that embedded scheduler; an unprivileged SYNC_IOC_FILE_INFO call then reaches drm_sched_fence_get_timeline_name() and dereferences the freed slab. Rated CVSS 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) with EPSS of only 0.21% (10th percentile) and no public exploit identified at time of analysis; the issue is confined to systems where the msm driver is built and loaded, and is fixed by freeing these scheduler-containing objects with kfree_rcu().
Use-after-free in the Linux kernel's CIFS/SMB client can be triggered when the cifs_demultiplex_thread exits while a reconnect work item is still queued on cifsiod_wq, allowing smb2_reconnect_server() to read a server structure that clean_demultiplex_info() has already freed with kfree_sensitive(). The bug is reached unauthenticated per the vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R), but it requires an active CIFS/SMB mount to an attacker-controlled or repeatedly failing SMB server plus a narrow race at connection teardown, which is why the assessed impact is LOW in practice even though the published base score is 7.5. EPSS is 0.21% (10th percentile), no public exploit has been identified at time of analysis, and vendor fixes exist in the 6.6.158, 6.12.112, 6.18.54 and 7.2.8 stable releases.
Kernel memory corruption and crash in the Linux kernel's SMB/CIFS client (cifs.ko) arises from a missing list-head initialization in TCP_Server_Info.rlist combined with a race in cifs_signal_cifsd_for_reconnect(). Because rlist is allocated with kzalloc, its ->next and ->prev pointers are NULL rather than self-referential, so list_empty() always returns false and list_add() dereferences a NULL ->prev; concurrently, multiple cifsd threads can add the same server's rlist node twice, corrupting the list. Only systems actively using the kernel SMB/CIFS client with a mounted share and a reconnect event are affected; the authoritative assessment scores this CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H, i.e. unauthenticated but requiring user interaction and a hard-to-win timing race, with impact limited to a kernel crash (denial of service) rather than code execution or data theft. EPSS is low at 0.18% (6th percentile), and no public exploit has been identified at time of analysis.
Kernel slab memory disclosure in the Linux kernel's SMB/CIFS client (cifs.ko) occurs when a malicious or compromised SMB3 server returns a short reply to a snapshot-enumeration ioctl (FSCTL_SRV_ENUMERATE_SNAPSHOTS), causing smb3_enum_snapshots() to set ret_data_len to sizeof(struct smb_snapshot_array) (12 bytes) without validating the server's actual reply length; the subsequent copy_to_user() then reads past the end of the server-sized retbuf and exposes adjacent kernel heap contents to the requesting user-space process. Only Linux systems acting as SMB clients are affected, and exploitation requires the victim to connect outbound to the attacker-controlled server and actively trigger snapshot enumeration (UI:R) while running a kernel with the vulnerable cifs client code, so unauthenticated remote attackers cannot reach an idle host. There is no public proof-of-concept and no evidence of active exploitation at time of analysis; EPSS is 0.21% (11th percentile), and patches are available in stable releases 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
Use-after-free in the Linux kernel's drm/ttm graphics memory manager (a regression introduced by commit b2ed01e7ad3d, present in roughly 7.0.10 through 7.1 and in stable backports such as Ubuntu 7.0.0-31) allows a locally authenticated user with an active GPU workload to crash the kernel minutes to hours after a swapout event. Because ttm_bo_swapout_cb() skips the bulk_move bookkeeping on successful swapout, a swapped-out resource stays on its buffer object's bulk_move range and on the manager LRU while being unevictable; when it is later freed or the BO leaves the bulk_move, ttm_resource_del_bulk_move() skips it due to its unevictable guard, leaving a dangling cursor that the next ttm_lru_bulk_move_tail() or ttm_resource_add_bulk_move() dereferences. Exploitation requires local presence, an affected AMD/drm-ttm system, and timing-dependent hibernation or memory-pressure conditions (the reporter observed crashes in only 5 of 18 hibernation cycles), and no public exploit code has been identified at time of analysis; EPSS is 0.20% (9th percentile), signalling low near-term exploitation likelihood.
Denial of service in Scrapy 1.4.0 through 2.14.1 allows any web server the crawler visits to terminate the crawler process by returning a crafted Referrer-Policy response header, such as 'sys.exit', which the built-in RefererMiddleware treats as a Python import path and invokes. The flaw is reachable over the network without authentication or user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U, base 7.5 High), and its impact is limited to availability because only importable, zero-argument callables can be triggered, making realistic effect process termination rather than general arbitrary code execution. Any crawler left in its default configuration (RefererMiddleware enabled via REFERER_ENABLED=True) that fetches attacker-controlled pages is exposed; no public exploit identified at time of analysis, and the vendor-released patch is Scrapy 2.14.2.
Prototype pollution in `@graphql-tools/utils` `mergeDeep()` lets a remote, unauthenticated client submit a single aliased GraphQL query that overwrites inherited JavaScript built-ins such as `Function.prototype.call`, causing denial of service against the gateway or schema-stitching service until it is restarted. Only deployments built on @graphql-tools/utils <= 12.0.0 that actually merge objects returned from two subgraphs (the ordinary `@shareable` field or cross-subgraph entity case, e.g. Hive Gateway) invoke the vulnerable code path; single-subgraph servers are not affected. Both CVSS 4.0 (8.2, AV:N/AC:L/AT:P/PR:N/UI:N/VA:H) and the assessor's CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree on high availability impact with no confidentiality or integrity impact, and no public exploit code has been identified at time of analysis.
Local file disclosure in Docling allows crafted HTML to embed readable files from the host filesystem into the rendered page image. When an application explicitly sets HTMLBackendOptions(render_page=True), has the optional Playwright dependency installed, and passes untrusted HTML as a filesystem Path, the HTML backend's browser request filter fails to enforce the enable_local_fetch setting or confine file:// access to the source document's directory, so an <iframe src="file:///..."> can pull in .env files, credentials, or other users' documents that Chromium then renders visibly into the output image. Publicly available exploit code exists and the issue is fixed in 2.118.1; EPSS is low (0.30%, 21st percentile) and there is no indication of active exploitation, so real-world priority is comparatively low despite the 7.5 CVSS, because exploitation demands a specific non-default configuration and disclosure is passive, read-only, and limited to text content Chromium renders in the viewport.
Import-time code execution in Docling 2.27.0 through 2.131.0 lets any distribution already present in the same Python environment that registers an entry point in the 'docling' group run arbitrary code as soon as Docling's plugin factories initialize - even when allow_external_plugins is set to false, because the plugin manager imports every registered module before the namespace allow-list is applied and then misleadingly logs that the plugin was skipped. The assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms this is a local, supply-chain-style prerequisite: an attacker must first get a third-party or compromised package installed and registered, and Docling must then be started by a user, so there is no remote network exploitation path. No public exploit code or active exploitation is known at time of analysis (EPSS 0.11%, percentile 1%; CISA SSVC exploitation: none), and the vendor has shipped a fix in 2.131.0.
Docling 2.94.0 through 2.131.x allows an attacker-supplied LaTeX/TikZ document to read files accessible to the converter process and create or overwrite writable files when the caller has explicitly opted into Tectonic rendering via LatexBackendOptions(tikz_engine="tectonic"); enabling the additional tikz_engine_allow_shell_escape option escalates this to shell command execution through TeX. The default Docling configuration does not enable Tectonic rendering and is not affected, and exploitation further requires a victim or operator to feed the crafted document into the pipeline (UI:R), which is why the practical risk is conditional despite the high CVSS base score. Both docling and docling-slim are affected; the flaw is fully fixed in 2.132.0, EPSS is a low 0.30% (21st percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis.
An out-of-bounds heap read in libexpat's XML_ParseBuffer (expat/lib/xmlparse.c) allows disclosure of adjacent heap memory to the calling application when the caller-supplied len exceeds the remaining capacity of the parse buffer. The vulnerable path is reachable only when a parse buffer already exists - created by a prior XML_GetBuffer call (or a prior XML_Parse call that allocates one internally), otherwise the function returns XML_ERROR_NO_BUFFER - and when the embedding application passes a length that does not match the buffer it actually filled; default parsing where len equals the buffer contents is not affected, and the CVSS 4.0 vector (AV:N/PR:N, no privileges required) confirms this is unauthenticated from the network perspective. Successful reads can disclose heap pointers, libc function pointers and code pointers, undermining ASLR, but exploitation is contingent on application-specific misuse of the API, so no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status is reported. Note that the official CVSS 4.0 score is 8.3 (AT:P reflects the buffer-must-exist precondition), while an independent assessment scored it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L, i.e. information disclosure with no integrity impact and only a low availability impact.
Cache poisoning in BuildKit lets a malicious image advertise DiffIDs that do not match its actual layer contents, so a daemon with a shared or persistent cache can adopt attacker-controlled layers as the base for a victim image and execute attacker code inside the victim build - for example by replacing a commonly executed path such as /bin/sh, reading build secrets mounted into the build, altering output artifacts, or hanging the build. Exploitation is unauthenticated but conditional: the attacker's image must be processed before the victim build on a daemon with a shared or persistent cache (multi-tenant or long-lived CI/build farms), and a victim build must then reference the targeted base image; ephemeral, non-shared caches are unaffected. No public exploit code identified at time of analysis; the vendor patch is BuildKit v0.33.1, and the issue carries a CVSS 7.5 (CVSS 4.0) rating with our independent assessment at CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L.
Resource exhaustion in Apache Struts 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0 allows an unauthenticated remote attacker to amplify a small request into a far larger response, consuming server CPU and outbound network capacity. The issue is conditional: the target application must bind a request parameter to a java.math.BigDecimal property and then render that property through the Struts tag library; applications missing either behavior are not affected per the advisory and independent assessment. No public exploit has been identified at time of analysis, EPSS is low at 0.28% (19th percentile), and the impact is availability-only (CVSS 7.5 with C:N/I:N/A:H).
OGNL expression injection in Apache Struts can lead to remote code execution, but only when an application is explicitly configured with the legacy RESTful action mapper - a non-default setting that standard deployments do not use. All version branches are affected in the abstract (2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0), and on the Struts 7 branch exploitation additionally requires the OGNL allowlist to have been disabled, which is not the default. NVD rates this 9.8 (AV:N/AC:L/PR:N/UI:N), while our independent assessment lowers it to AC:H because the decisive limiting factor is the non-default mapper configuration; where that mapper is absent the flaw is not reachable. No public exploit code or CISA KEV entry has been identified at time of analysis, and EPSS is low at 0.36% (28th percentile), so exposure is driven principally by configuration review rather than by observed exploitation. Fixes are available in Struts 6.12.0 and 7.4.0.