Red Hat
Monthly
Insecure temporary file handling in Claude Code's `/copy` command exposes privileged users on multi-user systems to two distinct local attacks: passive response disclosure and symlink-based arbitrary file write. The command unconditionally writes AI response content to `/tmp/claude/response.md` - a static, world-readable path in a world-traversable directory - enabling any local user to read output that may contain secrets, credentials, or sensitive data. A more capable local attacker can pre-plant a symlink at the predictable path, causing a privileged process's `/copy` invocation to overwrite an attacker-chosen file. Affected versions span `@anthropic-ai/claude-code` 2.1.59 through 2.1.127; no public exploit has been identified at time of analysis, and no CISA KEV listing exists.
Path traversal in pnpm's global package management flows allows deletion of the global bin directory or its parent when a malicious package with specially crafted bin keys is installed. Packages carrying ".", "..", or "" as bin object keys in their manifest bypass pnpm's bin-name guard; subsequent global remove, update, or add-replacement operations re-derive those names and pass them through path.join(globalBinDir, binName) into removeBin, resolving to the bin directory itself or its parent. No public exploit has been identified at time of analysis, but fixed versions 10.34.2 and 11.5.3 are available and should be applied immediately given the supply-chain delivery mechanism.
Stack out-of-bounds write in Vim's spell suggestion engine allows a crafted `.spl`/`.sug` file pair to corrupt the call stack and crash the editor when spell suggestions are invoked. All Vim releases prior to 9.2.0653 are affected, with the flaw in `tree_count_words()` and `sug_filltree()` inside `src/spellfile.c`, where three fixed-size MAXWLEN-element stack arrays are indexed by an unbounded depth counter. No public exploit identified at time of analysis (CVSS 4.0 E:U), though the upstream fix commit includes a detailed proof-of-concept test case reproducing the out-of-bounds write.
Out-of-bounds read in Vim's text property subsystem allows a crafted undo file to crash the editor and potentially disclose adjacent heap memory. All Vim releases prior to 9.2.0670 are affected; the vulnerability is reachable whenever a user loads a malicious undo file with the persistent-undo feature compiled in and enabled. No public exploit or CISA KEV listing exists at time of analysis, placing real-world risk in the low-to-medium range despite the local crash severity.
Vim crashes with an out-of-bounds read when opening a maliciously crafted file encrypted with the xchacha20poly1305 cipher (VimCrypt~04! or VimCrypt~05!) whose body is shorter than a libsodium secretstream header. An unsigned integer underflow in the length calculation inside crypt_sodium_buffer_decode() causes the subsequent crypto_secretstream_xchacha20poly1305_pull() call to read far past the end of the input buffer, resulting in a denial-of-service crash. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the fix commit includes a concrete reproducer test case confirming the crash path.
Out-of-bounds heap read in Vim 9.2.0320-9.2.0678 allows a crafted undo or swap file to disclose adjacent heap memory or crash the editor when a victim opens it. The flaw resides in the text property (textprop) subsystem: a maliciously encoded virtual-text property with an oversized tp_text_offset is converted directly to a heap pointer without bounds validation in both the undo-restoration path (um_goto_line) and the display path (get_text_props). The CVSS 4.0 score of 6.8 (Medium) reflects local-only exploitation requiring active user interaction; no public exploit is confirmed at time of analysis, though the fix commit includes detailed test scaffolding constituting a near-complete attack blueprint.
Stack out-of-bounds write in Vim's spell_soundfold_sofo() function (src/spell.c) allows local exploitation when a SOFO-based spell language is active and the soundfold path is triggered with a word exceeding MAXWLEN (254) bytes, corrupting the call frame and crashing the editor with theoretical code execution potential. All Vim releases prior to 9.2.0698 carrying the single-byte SOFO branch are affected; the vendor has released a confirmed fix at v9.2.0698. No public exploit code exists and no CISA KEV listing is present; the CVSS 4.0 E:U supplemental metric confirms exploitation remains unproven at time of analysis.
Out-of-bounds read in Nokogiri's `NodeSet#[]` method (all versions before 1.19.4) enables an attacker who can supply a large negative integer index to bypass a 32-bit-truncated bounds check and trigger a read outside the node set's allocated memory. On CRuby (MRI Ruby), this typically crashes the process - denial of service - with ancillary potential for heap memory disclosure; on JRuby, the runtime's managed memory prevents memory corruption, but an incorrect node is silently returned. No public exploit or active exploitation has been identified; exploitation requires the target application to forward attacker-controlled integers directly to the `NodeSet#[]` or `#slice` API.
Sleep-inside-lock in the Linux kernel's SMC networking subsystem (`__smc_setsockopt()`) allows a local low-privilege user to hold the socket lock indefinitely, exhausting kernel worker threads and triggering the hung task watchdog - producing a local denial of service. Affected systems must have the `net/smc` module loaded and a user-space mechanism (userfaultfd or FUSE) available to stall the in-kernel copy operation. No public exploit has been identified at time of analysis, and EPSS at 0.18% (8th percentile) reflects very low mass-exploitation probability; however, the technique is well-understood in kernel security research.
NULL pointer dereference in the ksmbd (in-kernel SMB server) subsystem of the Linux kernel causes a remotely triggerable kernel oops, resulting in denial of service. The race condition in smb2_oplock_break_noti() and smb2_lease_break_noti() allows an authenticated SMB client to crash the kernel by racing an SMB2 LOGOFF against an oplock/lease break notification - setting opinfo->conn to NULL in the window after ci->m_lock is dropped, then dereferencing it in ksmbd_conn_r_count_inc(). No public exploit identified at time of analysis; EPSS is very low at 0.16% (6th percentile), and CISA KEV listing is absent.
Kernel stack memory disclosure and multicast address corruption in the Linux kernel's 6lowpan IPHC subsystem affects all deployments running the vulnerable code path from commit 5609c185f24d onward. A local unprivileged user on a system with an active 6lowpan interface can trigger `lowpan_iphc_mcast_ctx_addr_compress()` to transmit uninitialized kernel stack bytes over the 6lowpan link layer while also corrupting the RIID field in compressed multicast addresses, breaking multicast connectivity. No public exploit identified at time of analysis; EPSS is 0.17% (7th percentile), and this is not listed in CISA KEV.
Memory leak in the Linux kernel devlink subsystem allows a local low-privileged user to trigger resource exhaustion by inducing a Sub-Function (SF) probe failure, leaving a nested devlink relation unreleased. The flaw occurs because devlink_free() does not clear devlink->rel when an instance fails probe before reaching devl_register(), bypassing the normal cleanup path in devl_unregister(). No public exploit has been identified and EPSS is 0.16% (6th percentile), consistent with a low-real-world-risk kernel memory management defect; patch is available across multiple stable branches.
Memory leak in the Linux kernel wifi cfg80211 subsystem allows a local low-privileged user to cause gradual kernel memory exhaustion by repeatedly triggering failed 6 GHz split scans. The leaked object is a 512-byte allocation in rdev->int_scan_req that escapes the cleanup path in ___cfg80211_scan_done() because rdev->scan_req is NULL at freeing time, causing an early return. No public exploit has been identified; EPSS of 0.16% (6th percentile) reflects very low real-world exploitation probability, and this vulnerability is not listed in CISA KEV.
Kernel crash in Linux cfg80211 WiFi subsystem occurs when EHT (Wi-Fi 7 / 802.11be) capability elements are present without matching EHT operation elements, triggering a null pointer dereference in mac80211 and causing a denial of service. Systems running affected kernel versions with Wi-Fi 7 hardware are at risk of a local-privilege kernel panic with no confidentiality or integrity impact. EPSS is extremely low at 0.15% (5th percentile) and no public exploit has been identified; this is not listed in CISA KEV.
Percpu memory leak in the Linux kernel Bluetooth subsystem allows a local low-privileged user to exhaust kernel memory by repeatedly triggering early failures in Bluetooth HCI UART device initialization. Affected kernels spanning stable branches from 5.10 through 6.16-rc4 fail to invoke cleanup_srcu_struct() when hci_register_dev() never completes, causing the SRCU struct allocated early in hci_alloc_dev() to persist indefinitely. No public exploit code has been identified at time of analysis, and EPSS at 0.19% (9th percentile) reflects negligible exploitation interest; however the availability impact is rated High by NVD given the potential for kernel memory exhaustion.
Reference leak in the Linux kernel Bluetooth ISO subsystem allows a local low-privileged user to exhaust kernel resources and cause a denial of service. The `iso_conn_big_sync` function acquires an `hci_dev` reference via `hci_dev_hold()` through `hci_get_route()` but never releases it, violating the borrow contract. No active exploitation has been confirmed and EPSS is very low at 0.18% (7th percentile), but the affected surface - the BLE Audio Broadcast Isochronous Group (BIG) synchronization path - is present on any Linux system with a Bluetooth controller.
Three distinct logic errors in the Linux kernel's MRP (Multiple Registration Protocol) PDU parser `mrp_pdu_parse_vecattr()` allow an attacker to corrupt kernel MRP applicant state and PDU parsing offsets, resulting in denial of service. Affected systems must have the `mrp` kernel module loaded with an active IEEE 802.1ak bridge interface. No public exploit exists and EPSS is 0.18% (8th percentile), reflecting low active targeting, though patches across multiple stable branches are available and should be applied routinely.
Uninitialized stack variable use in the Linux kernel's rseq (restartable sequences) subsystem exposes systems to kernel information leak and denial-of-service. The flaw in `rseq_exit_user_update()` arises from a C standard evaluation-order ambiguity in struct initialization, detected by syzbot's KMSAN (Kernel Memory Sanitizer) as a kernel-infoleak. Affected are Linux 7.0.10 through 7.0.12 and 7.1 release candidates rc3-rc6; exploitation requires local low-privilege access, no public exploit exists, and EPSS is very low at 0.16%.
Stack overread in the Linux kernel ALSA MIDI sequencer dummy client (snd_seq_dummy) allows a local low-privileged user to crash the kernel or potentially leak kernel stack contents by sending a crafted Universal MIDI Packet (UMP) event. The dummy port copies incoming events into a legacy-sized stack temporary, but when the UMP flag remains set the delivery path calls snd_seq_event_packet_size() and copies a larger UMP-sized packet from that undersized allocation, reading past the stack buffer end. No public exploit has been identified and EPSS is 0.18% (7th percentile), placing this firmly in routine-patch rather than emergency-response territory.
Out-of-bounds read in the Linux kernel netlabel subsystem allows a local low-privileged attacker to crash the kernel by submitting a crafted Generic Netlink request with a valid IPv4/IPv6 address attribute paired with a shorter-than-expected mask attribute. The netlbl_unlabel_addrinfo_get() function relied solely on the address attribute length to determine address family, then unconditionally read the mask attribute as a full struct in_addr (4 bytes) or struct in6_addr (16 bytes) without independently validating the mask length. No public exploit or active exploitation has been identified (EPSS 0.18%, 8th percentile); patches are available across all maintained stable branches.
NULL pointer dereference in the Linux kernel's Marvell EBU GPIO driver (gpio/mvebu) causes a kernel oops and system crash during suspend/resume operations on Marvell Armada ARM platforms. The flaw affects all stable kernel branches from 4.12 onward where mvebu_pwm_suspend() and mvebu_pwm_resume() are unconditionally invoked for every GPIO bank, including those where mvchip->mvpwm is NULL due to absent PWM hardware. A local authenticated user with sufficient privileges to trigger system suspend can crash the kernel with no recovery, resulting in full availability loss. No public exploit exists and EPSS is 0.18% (7th percentile), reflecting a niche hardware dependency that sharply limits real-world exposure.
Deadlock in the Linux kernel PHY networking subsystem (net/phy) allows a local low-privileged user to freeze the networking stack on systems using the generic PHY driver (genphy) with SFP cage hardware. When genphy triggers PHY probing - which occurs while holding the RTNL lock - it erroneously calls sfp_bus_add_upstream(), which itself attempts to acquire RTNL, producing a self-deadlock confirmed by reproduction. No public exploit exists and EPSS is 0.16% (6th percentile), reflecting that exploitation requires an uncommon hardware and driver combination.
Invalid pointer free in the Linux kernel's Open vSwitch (OVS) subsystem allows a local low-privileged user to crash the kernel, resulting in denial of service. The net/openvswitch reply skb cleanup code incorrectly assumes allocation always occurs before mutex acquisition; when allocation fails after locking, an ERR_PTR is passed to kfree_skb(), triggering a kernel panic on any host with OVS active. No public exploit has been identified and EPSS is 0.20% (10th percentile), but the crash is likely deterministic once the code path is reached on a vulnerable kernel.
Resource leak and use-after-free in the Linux kernel's gpio-rockchip driver can crash the kernel on systems using Rockchip GPIO hardware. The driver's remove path fails to call irq_domain_remove_generic_chips(), leaving allocated generic chip structures unreleased and dangling on the global gc_list. After driver unbind or module removal, IRQ subsystem suspend, resume, or shutdown callbacks may subsequently dereference the freed memory, producing a use-after-free condition and kernel panic. No public exploit exists and EPSS sits at the 7th percentile, indicating very low real-world exploitation probability; however, the availability of upstream fix commits makes patching straightforward.
Use-after-free in the Linux kernel ptp_ocp driver crashes the kernel during device removal on systems equipped with Open Compute Platform PTP hardware. The teardown function ptp_ocp_detach() frees pin resources before calling ptp_clock_unregister(), which then accesses those freed resources via ptp_disable_all_events(), introduced by commit a60fc3294a37. EPSS is 0.15% (5th percentile) and this vulnerability is not listed in CISA KEV, indicating no public exploitation and very low real-world risk outside specialized environments.
NULL pointer dereference in the Linux kernel netfilter bridge redirect target crashes the kernel when a bridge port is removed or reassigned between an initial NFQUEUE hook invocation and packet reinject. The affected function ebt_redirect_tg() in the ebtables bridge filtering subsystem calls br_port_get_rcu() without guarding against a NULL return, and the additional complexity noted in the fix is that a mere NULL check would still be insufficient - userspace can move the device into a macvlan while the packet is queued, requiring the packet to be dropped entirely. This flaw has existed since commit f350a0a87374418635689471606454abc7beaa3a (kernel 2.6.36), making it a long-standing latent bug. No public exploit identified at time of analysis; EPSS at 0.18% (7th percentile) signals negligible automated exploitation risk.
Null pointer dereference in the Linux kernel's IPv6 address configuration subsystem crashes the kernel when cleanup_prefix_route() receives the fib6_null_entry sentinel from addrconf_get_prefix_route() and attempts to access its NULL fib6_table pointer without validation. An authenticated local user holding CAP_NET_ADMIN can trigger this by sending a crafted IPv6 DELADDR netlink message, causing a general protection fault and system-wide denial of service. No public exploit or CISA KEV listing exists; EPSS is 0.17% (6th percentile), consistent with a privilege-gated local DoS affecting an extremely widely deployed target.
Memory leak in the Linux kernel's drm/vc4 (Broadcom VideoCore IV DRM) driver allows a local low-privileged user to gradually exhaust kernel memory under allocation-failure conditions. The flaw arises because the return value of krealloc() is assigned directly back to the original pointer without a NULL check - if krealloc() fails and returns NULL, the reference to the previously allocated buffer is silently overwritten, permanently leaking that memory. No public exploit code is identified at time of analysis, and EPSS probability is extremely low at 0.18% (8th percentile), consistent with the local-only, condition-dependent nature of the bug.
Kernel stack information disclosure in the Linux kernel's netfilter nft_meta_bridge subsystem leaks 2 bytes of uninitialized stack data to userspace via the IIFHWADDR register. A local attacker with CAP_NET_ADMIN privileges can craft an nftables bridge rule that reads the full 8-byte register span after a memcpy writes only 6 bytes, exposing stale nft_do_chain() stack content. No public exploit exists and EPSS is 0.17%; however, on hardened systems kernel stack leaks can assist KASLR bypass when chained with other primitives.
Memory leak in the Linux kernel TEE subsystem's register_shm_helper() function allows a local low-privileged user to exhaust kernel memory and degrade system availability. Triggering the leak requires calling the TEE_IOC_SHM_REGISTER ioctl with a length of zero, causing the function to allocate shared memory and then skip its deallocation when iov_iter_npages() returns 0. No public exploit has been identified at time of analysis, and EPSS sits at the 7th percentile, indicating very low real-world exploitation probability.
Bluetooth L2CAP in the Linux kernel fails to enforce the signaling MTU (MTUsig = 48 bytes) in l2cap_sig_channel(), enabling a nearby BR/EDR peer to send a single oversized fixed-channel signaling packet packed with many ECHO_REQ commands before pairing and force a proportional burst of ECHO_RSP frames. In a confirmed test, one 681-byte CID 0x0001 packet containing 168 ECHO_REQ commands caused the target to emit 168 responses over approximately 220 ms - roughly a 250× frame amplification - constituting a traffic-amplification denial-of-service. No active exploitation has been identified at time of analysis; vendor-released patches are available across multiple stable kernel branches.
Recursive spinlock AA deadlock in the Linux kernel's hugetlb memory-failure subsystem allows a local user to hang or panic the kernel by racing two concurrent madvise(MADV_HWPOISON) calls against a concurrent unmap on the same hugetlb folio. The flaw exists because get_huge_page_for_hwpoison() held hugetlb_lock while calling folio_put(), which - when concurrent unmap had already dropped the page-table reference - triggered free_huge_folio() to re-acquire the non-recursive lock, causing an irrecoverable deadlock. No confirmed active exploitation exists (not in CISA KEV), and EPSS sits at 0.18% (8th percentile), indicating negligible real-world exploitation probability at this time.
Missing bounds validation in the Linux kernel's accel/ivpu Intel VPU accelerator driver allows a local low-privileged user on an affected Intel VPU-equipped system to trigger kernel memory allocation errors or a denial of service by supplying a malformed firmware image header specifying improperly aligned or undersized runtime memory. Affected versions include Linux 6.19 and 7.1-rc1 through rc6; fixed commits are available for both the 7.0.x stable series and the 7.1 branch. No public exploit identified at time of analysis; EPSS is 0.16% (6th percentile), and no CISA KEV listing exists, reflecting minimal real-world exploitation interest.
NULL pointer dereference in the Linux kernel's Intel Stratix10 RSU (Remote System Update) firmware driver causes a kernel panic when SMC call timeouts occur during probe initialization. Affected kernels through 7.1-rc7 and 7.0.13 expose a race condition where timeout-driven error paths in stratix10_rsu_probe() free the service channel - setting chan->scl to NULL - but fail to return early, allowing subsequent service kthreads to dereference the now-NULL pointer in their receive callbacks. The vulnerability is a local denial-of-service with no public exploit identified at time of analysis, and EPSS places exploitation probability at only 0.15%.
ABBA deadlock in the Linux kernel xfrm iptfs subsystem causes availability loss on SMP systems when iptfs state is destroyed while its timer callbacks are concurrently executing on another CPU. The vulnerability affects the IP Traffic Flow Secrecy (IPTFS) implementation within the kernel's xfrm IPsec framework, specifically during iptfs_destroy_state() - a function that acquires spinlocks before calling hrtimer_cancel(), creating a circular dependency with softirq timer callbacks that attempt to re-acquire those same locks. No public exploit code has been identified and EPSS is 0.17% (7th percentile), indicating this is a low-probability exploitation target; the impact is a kernel deadlock causing a system hang (DoS) with no confidentiality or integrity impact.
Reference-count leak in the Linux kernel's drm/virtio GPU driver allows a local low-privilege user inside a QEMU/KVM virtual machine to gradually exhaust kernel memory, causing a guest denial of service. The bug exists in virtio_gpu_dma_fence_wait(), where an early error return from inside dma_fence_unwrap_for_each() leaves a dma_fence reference acquired by dma_fence_unwrap_first() unreleased - the only such early-return site in the entire kernel tree. No public exploit is identified at time of analysis and EPSS sits at 0.18% (7th percentile), consistent with the absence from CISA KEV and the non-trivial conditions required to trigger repeated fence-wait failures.
The vsock/VMCI transport in the Linux kernel silently leaks the accept queue counter (sk_ack_backlog) on every failed vsock connection handshake, eventually causing a permanent denial of service on any vsock listener. Repeated handshake failures caused by malformed packets, queue pair allocation failures, or event subscription failures each increment sk_ack_backlog without a corresponding decrement; once the counter reaches sk_max_ack_backlog, the listener rejects all subsequent connections with -ECONNREFUSED until the owning process is restarted. No public exploit identified at time of analysis; EPSS of 0.18% at the 8th percentile reflects low automated exploitation probability, consistent with the VMware-specific exposure requirement.
NULL pointer dereference in the Linux kernel bnxt_en Broadcom NetXtreme Ethernet driver crashes the kernel when PCIe error recovery fires against a closed NIC, causing a denial of service. Affected kernel versions span from 4.17 through multiple LTS and mainline branches up to 7.1-rc4, with patches released across all active stable series. No public exploit exists and EPSS sits at 0.17% (7th percentile), marking this as a reliability and stability concern rather than an actively targeted attack vector.
Unbounded kernel log spam and conditional kernel panic in the Linux kernel's accel/ethosu Arm Ethos-U NPU driver allows any local unprivileged user with DRM device access to exhaust kernel log resources or crash the system. The driver's unimplemented NPU_OP_RESIZE command handler contains an unconditional WARN_ON(1) that fires every time userspace submits this operation via DRM_IOCTL_ETHOSU_GEM_CREATE. On systems where the panic_on_warn kernel parameter is enabled, this becomes a trivial denial-of-service primitive requiring only local DRM device access. No public exploit has been identified at time of analysis, and EPSS sits at the 5th percentile (0.15%), reflecting the niche hardware and non-default configuration requirements.
Kernel crash via FUSE pagecache misuse in the Linux kernel allows a local low-privileged user controlling a FUSE daemon to trigger a WARN_ON() assertion in fuse_parse_cache() by sending FUSE_NOTIFY_STORE or FUSE_NOTIFY_RETRIEVE notifications targeting directory inodes instead of regular files, causing a denial-of-service kernel crash. The vulnerability specifically affects FUSE filesystems that have directory caching (FOPEN_CACHE_DIR) enabled, a non-default configuration that exposes kernel-internal pagecache storage to invalid manipulation. No public exploit has been identified, EPSS sits at 0.18% (7th percentile), and patches have been released across all active Linux stable branches.
NULL pointer dereference in the Linux kernel's futex PI requeue path allows a local low-privileged user to crash the kernel. Triggered via FUTEX_CMP_REQUEUE_PI when a non-top waiter already owns the target PI futex, the deadlock detection path returns -EDEADLK before initializing waiter->task, which remove_waiter() then dereferences unconditionally. Impact is a kernel panic (system-wide denial of service). No public exploit identified at time of analysis and EPSS is at the 7th percentile, but the attack surface is any unprivileged local process on an affected kernel version.
Kernel availability impact in Linux iommu/dma SWIOTLB subsystem allows a local low-privileged user to corrupt IOMMU mappings and trigger a kernel WARN_ON via Thunderbolt NVMe passthrough commands. The iommu_dma_iova_link_swiotlb() function fails to guard against zero-length middle segments in unaligned DMA mappings, causing iommu_map() to receive an illegal zero-size argument; the subsequent error unwind then starts from the wrong offset, corrupting the IOMMU page table state and firing WARN_ON at destruction. No active exploitation is confirmed (not in CISA KEV), and EPSS of 0.17% (6th percentile) signals negligible threat-actor interest, but the bug is reliably reproducible with commodity Thunderbolt NVMe hardware.
Null pointer dereference in the Linux kernel's real-time mutex (rtmutex) subsystem allows a local low-privileged user to crash the kernel via FUTEX_CMP_REQUEUE_PI, causing a denial of service. Affected stable branches span Linux 6.1 through 7.1-rc5; vendor patches are available via kernel.org stable commits. No public exploit has been identified and EPSS is 0.17% (7th percentile), indicating negligible observed exploitation activity.
Integer underflow in the Linux kernel fastrpc misc driver corrupts DMA addresses sent to Qualcomm DSPs, enabling a local low-privileged user to crash the DSP subsystem or induce a kernel panic. The flaw in fastrpc_get_args() affects all major stable kernel branches from 5.15 through 7.1-rc3 and is patched across multiple stable series. No public exploit exists and EPSS probability is 0.17% (7th percentile), indicating low real-world exploitation risk despite broad platform coverage.
NULL pointer dereference in the Linux kernel's fastrpc misc driver crashes the kernel when a Qualcomm DSP sends a glink message before the fastrpc_rpmsg_probe() initialization routine completes. Systems using the Qualcomm FastRPC subsystem - primarily Android and embedded Qualcomm SoC platforms running Linux 5.1 through unpatched 6.x/7.x stable branches - are vulnerable to a local denial-of-service (kernel panic) at boot. No public exploit exists and EPSS is 0.17% (6th percentile), consistent with a hardware-timing race condition requiring specific Qualcomm DSP hardware rather than generic remote exploitation.
Corrupted reverse-mapping (rmap) state in the Linux kernel's mm/huge_memory subsystem crashes or destabilizes affected systems through a flag misinterpretation in set_pmd_migration_entry() for device-private PMD entries. On x86-64 with CONFIG_MEM_SOFT_DIRTY enabled, the function incorrectly reads the softdirty bit as a write-permission flag - because _PAGE_SWP_SOFT_DIRTY aliases _PAGE_RW - causing migration entries to be marked writable when they should be read-only, ultimately triggering a VM_WARN assertion in __folio_add_anon_rmap() when an AnonExclusive folio reaches entire_mapcount=2. No public exploit exists and no active exploitation is confirmed; a vendor patch is available as of Linux 7.0.13 and 7.1.
Hugetlb VMA reservation leak in the Linux kernel mm/hugetlb subsystem allows a local authenticated user to trigger SIGBUS on a process at a previously reserved huge-page address. Two code paths - the UFFDIO_COPY resubmission path and the fork-time copy-on-write path - fail to call restore_reserve_on_error() after copy_user_large_folio() returns an error, leaving the per-VMA reservation map entry marked consumed. No public exploit exists and EPSS is 0.17% (6th percentile), but patches are available in multiple stable branches.
NULL pointer dereference in the Linux kernel's dw_mmc-rockchip MMC driver triggers kernel panics on systems running legacy Rockchip SoCs (rk2928, rk3066, rk3188) when the MMC subsystem initializes. Commit ff6f0286c896 introduced a mandatory private-data access path that was never populated for these old controllers - which historically had no UHS support and no parse_dt callback - causing a reproducible kernel crash on affected hardware. No active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.17% (6th percentile) reflects negligible real-world exploitation probability; the primary risk is an accidental reliability failure on embedded systems running these legacy SoCs.
Thunderbolt XDomain property validator in the Linux kernel triggers a heap underflow when processing zero-length TEXT property entries, enabling a local low-privileged attacker to crash the kernel (denial of service). The root cause is in tb_property_entry_valid(), which permits length==0 for TEXT entries that subsequently compute an array index of -1 during null-termination (0 * 4 - 1), writing one byte before the allocated buffer. No public exploit has been identified and EPSS is extremely low at 0.18% (8th percentile), indicating negligible opportunistic exploitation pressure despite the kernel's ubiquitous deployment footprint.
NULL pointer dereference in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user to trigger a kernel panic by invoking the kfd_ioctl_set_debug_trap() ioctl with a non-zero num_queues value and a NULL queue_array_ptr. The root flaw is that get_queue_ids() returns NULL in this case rather than ERR_PTR(-EINVAL), and both callers check only IS_ERR() - since IS_ERR(NULL) evaluates false, execution proceeds to q_array_invalidate(), which immediately dereferences the NULL pointer while iterating, crashing the kernel. No public exploit has been identified and the EPSS score of 0.17% (6th percentile) confirms low observed exploitation probability, though the trigger path is mechanically simple for any user with /dev/kfd access.
NULL pointer dereference in the Intel Xe GPU driver (drm/xe) causes a kernel panic during system suspend or shutdown when display hardware is disabled via hardware fuses rather than absent at initial probe. Systems running Linux 6.8 and later with Intel Xe GPUs in fuse-disabled display configurations are affected; a low-privileged local user can trigger an unplanned system crash by initiating suspend or shutdown. No public exploit exists and EPSS is 0.17% (6th percentile), reflecting this as a reliability and local-denial-of-service issue rather than a broad security priority.
Reference counting leaks in the Linux kernel's drm/v3d driver allow a local user to exhaust kernel memory and trigger a denial-of-service condition on systems equipped with Broadcom VideoCore VI GPUs (e.g., Raspberry Pi 4/5). The flaw exists across three code paths in the SET_GLOBAL and CLEAR_GLOBAL perfmon ioctls, as well as in the perfmon destroy path, each of which fails to release references acquired by v3d_perfmon_find(). No public exploit or active exploitation has been identified; EPSS probability stands at 0.17%, reflecting negligible automated exploitation interest.
Memory exhaustion via vaddr leak in the Linux kernel's V3D DRM driver allows a local low-privileged user to degrade or deny service on systems equipped with Broadcom V3D GPUs. The function v3d_rewrite_csd_job_wg_counts_from_indirect() maps two buffer objects (indirect buffer and workgroup buffer) but takes an early return path - without releasing the vaddr mappings - whenever any workgroup count read from the indirect buffer is zero, permanently leaking both BO mappings per triggering job submission. No public exploit has been identified and EPSS sits at the 6th percentile (0.17%), consistent with the hardware-specific, local-only attack surface; this vulnerability is not listed in CISA KEV.
The drm/v3d GPU driver in the Linux kernel mishandles indirect Compute Shader Dispatch (CSD) jobs that carry zeroed workgroup dimension counts, allowing a local low-privilege user with GPU compute access to crash the VideoCore VI GPU subsystem. The hardware interprets a zero workgroup count as 65536 - exceeding the user-space-exposed maximum of 65535 - instead of treating the dispatch as a no-op, causing undefined GPU behavior and a denial-of-service condition. Exploitation is constrained to Broadcom VideoCore VI hardware (Raspberry Pi 4/5 ecosystem); EPSS is 0.17% (6th percentile), no public exploit exists, and the vulnerability is absent from CISA KEV.
NULL pointer dereference and buffer over-read in the Linux kernel's AMD display driver (drm/amd/display) can be triggered by a local user writing to the sdp_message debugfs node, causing a kernel panic and denial of service. The dp_sdp_message_debugfs_write() function fails to check whether connector->base.state->crtc is NULL - a valid transient state after GPU hotplug before an atomic commit - and unconditionally passes 36 bytes to copy_from_user() regardless of the caller-provided size, enabling a second over-read path. No public exploit or CISA KEV listing exists; EPSS is 0.18% (7th percentile), consistent with a localized, hardware-dependent DoS.
KubeVirt's virt-handler domain notify server allows a compromised virt-launcher process to forge lifecycle events for any other VMI scheduled on the same Kubernetes node, causing virt-handler to corrupt that VMI's state and disrupt its lifecycle management. The root cause is that gRPC handlers for HandleDomainEvent and HandleK8SEvent accept VMI namespace/name exclusively from the request body, never cross-checking against the per-VMI pipe socket the connection arrived on. With CVSS 6.5 (AV:L/S:C), the attack requires local access via a compromised container but can impact multiple VMIs across tenants on the same node; no public exploit code or CISA KEV listing has been identified at time of analysis.
Site isolation bypass in Google Chrome's Passwords implementation allows a remote attacker who has already compromised the renderer process to cross origin boundaries via a crafted HTML page. Affected versions are all Chrome releases prior to 149.0.7827.197 on desktop platforms. Google has confirmed this as a High severity Chromium issue; no public exploit code or active exploitation has been identified at time of analysis, and CISA SSVC categorizes exploitation status as none.
Uninitialized GPU memory use in Google Chrome on Android before 149.0.7827.197 exposes process memory contents to remote attackers without requiring authentication. An attacker who induces a user to load a crafted HTML page can read potentially sensitive data from Chrome's GPU process memory, consistent with the High confidentiality impact assigned in the CVSS vector. No public exploit code exists at time of analysis, and CISA's SSVC framework classifies exploitation as none and not automatable with only partial technical impact - indicating this is a patch-cycle priority rather than an emergency response item.
Site isolation bypass in Google Chrome's Navigation component allows an attacker who has already compromised the renderer process to escape Chrome's cross-origin containment boundary via a crafted HTML page, affecting all Chrome versions prior to 149.0.7827.197. The vulnerability stems from insufficient input validation (CWE-20) in the Navigation subsystem, which fails to properly enforce site isolation when navigations are initiated from a compromised renderer. No public exploit code has been identified and CISA SSVC confirms no known active exploitation at time of analysis, though the prerequisite of renderer compromise makes this a meaningful second-stage escalation primitive.
Uninitialized GPU memory use in Google Chrome prior to 149.0.7827.197 enables a second-stage attacker who has already compromised the renderer process to read sensitive data from GPU process memory via a crafted HTML page. Classified as CWE-457 (Use of Uninitialized Variable), the flaw creates an information disclosure path within Chrome's multi-process architecture. No public exploit exists, CISA has not listed this in KEV, and SSVC rates exploitation as none - but the C:H confidentiality impact rating reflects meaningful data exposure if an attacker successfully chains this with a renderer exploit.
Cross-origin data leakage in Google Chrome's Autofill implementation allows a remote attacker who has already achieved renderer process compromise to exfiltrate sensitive cross-origin data via a specially crafted HTML page. Affected versions include all Chrome releases prior to 149.0.7827.197; the flaw was reported by the Chrome security team and rated High severity by Chromium. No public exploit code has been identified and no active exploitation is confirmed, though the vulnerability chains onto a renderer compromise making real-world exploitation a two-stage attack.
Same-origin policy bypass in Google Chrome's DeviceBoundSessionCredentials (DBSC) feature affects all Chrome versions prior to 149.0.7827.197, allowing a remote attacker to read limited cross-origin data via a crafted HTML page. The flaw stems from incorrect origin validation (CWE-346) in the DBSC implementation, a relatively new anti-session-hijacking subsystem. SSVC assessment confirms no exploitation at time of analysis, and no public exploit code has been identified; the CVSS score of 4.3 Medium reflects meaningful but bounded confidentiality impact contingent on user interaction.
Kernel panic via RCU locking imbalance in the DRBD subsystem's drbd_adm_dump_devices() function affects Linux kernel versions from the introduction of commit a55bbd375d18 through multiple stable branches. A locally authenticated low-privilege user who can invoke DRBD administrative operations may trigger a kernel crash by exploiting the unbalanced rcu_read_unlock() call - called without a preceding rcu_read_lock() - leading to a denial-of-service via kernel instability. No public exploit exists and EPSS probability is 0.18% (8th percentile), indicating very low real-world exploitation activity.
Memory leak in the Linux kernel block layer's zone revalidation path allows local low-privileged users to cause kernel memory exhaustion, resulting in a denial-of-service condition. Specifically, blk_revalidate_disk_zones() fails to free the args.zones_cond allocation on error paths after disk_revalidate_zone_resources() succeeds, leaving memory unreleased. No public exploit code exists and no active exploitation has been confirmed; EPSS probability stands at 0.14% (4th percentile), consistent with a low-priority local DoS affecting niche storage configurations.
Reference leak in the Linux kernel blk-cgroup subsystem allows a local low-privileged user to cause kernel disk object memory exhaustion, potentially leading to system instability or denial of service. The flaw exists in blkcg_maybe_throttle_current() since kernel 6.3, where a missing put_disk() call on error paths leaves disk references permanently unreleased. No public exploit exists and EPSS at 0.16% (5th percentile) indicates negligible exploitation probability; patches are available across multiple stable branches.
Improper locking in the Linux kernel's md (Multiple Devices/software RAID) subsystem causes a recursive kobject teardown deadlock when 'clear' is written to the sysfs array_state attribute. A local user with write access to an active md array's sysfs interface can trigger a kernel denial-of-service by exploiting the incorrect ordering of mddev_put() before sysfs_unbreak_active_protection() in md_attr_store(). No public exploit code is identified and EPSS exploitation probability is minimal at 0.17% (7th percentile); no CISA KEV listing indicates active exploitation has not been confirmed.
Availability loss in the Linux kernel ublk (userspace block device) subsystem can permanently hang IO commands when a ublk recovery server dies before issuing fetch commands for all IOs in a queue. The per-IO canceled flag, once set, is only cleared when every IO in the queue is fetched - if the server crashes mid-recovery, surviving IOs with set canceled flags can never be completed because ublk_cancel_cmd is blocked from calling io_uring_cmd_done. This results in a denial-of-service condition affecting systems using ublk-based userspace block devices. No public exploit has been identified at time of analysis, and EPSS is 0.14% (4th percentile), consistent with a low-exploitation-probability kernel logic flaw requiring specific local conditions.
Deadlock in the Linux kernel's md/raid456 subsystem during array reshape allows a local low-privileged user to hang the system indefinitely. When direct I/O spans the reshape position in a RAID 4/5/6 array, the I/O blocks in raid5_make_request() holding an active_io reference while waiting for reshape progress. If an administrator concurrently freezes the reshape and writes to md/suspend_lo or md/suspend_hi, mddev_suspend() deadlocks: it waits for active_io to drain, but the blocked I/O requires reshape progress that the frozen reshape thread can never provide. Exploitation requires a very specific confluence of conditions and no public exploit code or active exploitation (CISA KEV) has been identified; EPSS at 0.17% (7th percentile) confirms low real-world exploitation probability.
Deadlock in the Linux kernel btrfs filesystem subsystem triggers an unrecoverable kernel hang when the flushoncommit mount option is active and a reflink operation copies an inline extent to a destination offset beyond the target inode's i_size. The circular wait arises because the reflink task holds the extent io tree lock while blocking on a pending transaction commit, while the commit's delalloc flush simultaneously blocks trying to acquire that same held lock. No public exploit or CISA KEV listing exists; EPSS is 0.18% (8th percentile), reflecting very low real-world exploitation interest.
Memory leak in the Linux kernel's amd-pstate driver allows local availability impact on systems running AMD CPUs when EPP (Energy Performance Preference) initialization fails. The amd_pstate_epp_cpu_init() function allocates a cpudata object at entry but lacks a corresponding free on the error path triggered when setting the EPP value fails, causing kernel heap memory to leak on each failed CPU initialization event. No public exploit exists and EPSS sits at 0.15% (5th percentile), reflecting negligible adversarial interest; risk is primarily operational - repeated CPU hotplug cycles on affected hardware can progressively exhaust kernel memory.
Unsafe NMI-context invocation of perf_allow_kernel() in the Linux kernel's AMD IBS (Instruction Based Sampling) perf handler can cause a fatal kernel crash on AMD-powered systems running affected stable branches from commit 50a53b60e141d7e3 onward. A local user with perf event access on an AMD system can trigger the IBS NMI handler path, inducing a kernel panic or deadlock as the unsupported function call violates NMI-context restrictions. No public exploit has been identified at time of analysis; EPSS is 0.15% (5th percentile), consistent with a niche hardware-specific kernel subsystem flaw with no current exploitation activity.
Null pointer dereference in the Linux kernel's BPF LWT (Lightweight Tunnel) subsystem allows a local user with BPF syscall privileges to crash the kernel via a denial-of-service. The flaw exists because bpf_prog_test_run_skb constructs a socket buffer (skb) without initializing skb->_skb_refdst; when a BPF program invokes the bpf_lwt_xmit_push_encap helper through this test path, the subsequent dereference of skb_dst(skb)->dev hits a null pointer and triggers a kernel panic. No public exploit or CISA KEV listing exists, and EPSS is very low at 0.18% (7th percentile), consistent with the specialized access required.
PowerPC 64-bit (ppc64le/Book3S64) Linux kernel systems from version 5.8 onward can be crashed via a local race condition between concurrent move_pages() and munmap() operations on Transparent Huge Page (THP) PMD-backed memory. During the PMD migration sequence, a narrow window exists where the PMD entry holds a migration swap entry with pmd_present=0; a concurrent munmap() acquiring the same page table lock during this window triggers a VM_BUG_ON() assertion in pmdp_huge_get_and_clear_full(), causing a kernel panic. No public exploit is identified and EPSS stands at 0.15% (5th percentile), but the DoS impact is confirmed by upstream kernel developers with real hardware traces on IBM POWER10 and is patched in stable releases 7.0.10 and 7.1.
The Marvell Libertas USB WiFi driver in the Linux kernel invokes usb_kill_urb() and usb_kill_anchored_urbs() from interrupt context during the HCD giveback path, causing a kernel BUG() or deadlock because those functions may sleep. Systems with a Marvell Libertas USB WiFi adapter attached can be crashed by a local low-privileged user triggering the race condition, resulting in a denial of service via kernel panic. No public exploit exists and EPSS is 0.15% (5th percentile), indicating negligible exploitation probability; the constraint to specific legacy hardware further limits real-world impact.
BPF local storage deletion in the Linux kernel deadlocks when `bpf_xxx_storage_delete()` helpers execute within a Non-Maskable Interrupt (NMI) context, because the underlying RCU-based freeing mechanisms (`kfree_rcu`, `call_rcu`, `call_rcu_tasks_trace`) are not safe in NMI or reentrant execution paths. Locally privileged users capable of loading BPF programs attached to NMI-triggerable events can exploit this to cause a CPU-level deadlock, denying availability on the affected processor. No public exploit has been identified and EPSS at 0.14% (4th percentile) confirms this is a very low probability of opportunistic exploitation; impact is purely availability.
NULL pointer dereference in the Linux kernel's MediaTek mt76/mt7925 WiFi driver crashes affected systems when the `vif` (virtual interface) pointer is uninitialized at the time `mt7925_mac_write_txwi` calls `ieee80211_vif_is_mld(vif)`. Local low-privilege users on systems equipped with mt7925 hardware and running unpatched kernels can trigger a kernel panic, resulting in a denial of service. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.17% (6th percentile) reflects negligible real-world exploitation probability at this time.
Memory exhaustion in the Linux kernel mt76 WiFi driver allows a local low-privileged user on systems with MediaTek MT76 hardware to cause denial of service through kernel memory leakage during module teardown. The mt76_dma_cleanup routine fails to destroy page_pools associated with WED RRO receive queues (queues not tied to NAPI), and does not return pages to the pool when WED is not enabled - resulting in unreclaimed kernel memory on each module unload cycle. No public exploit exists and EPSS probability sits at 0.17% (6th percentile), consistent with a niche hardware-specific leak with no code-execution path.
Deadlock in the Linux kernel's mt76/mt7925 MediaTek WiFi driver can be triggered by a local low-privileged user, causing the wireless networking subsystem to hang indefinitely. The flaw exists in mt7925_roc_abort_sync(), which calls cancel_work_sync() while already holding dev->mt76.mutex - the same mutex held by roc_work() - producing a classic mutual-wait deadlock with no path to resolution. Systems running affected kernel versions with MediaTek MT7925 WiFi hardware are vulnerable to a local denial of service; no public exploit has been identified and EPSS places exploitation probability at 0.17% (6th percentile), consistent with the niche hardware requirement.
Mutex deadlock in the Linux kernel's mt7921 WiFi driver (mt76/mt7921 subsystem) can render the WiFi subsystem permanently unresponsive on affected systems. The deadlock arises during station removal: the call chain mt76_sta_state() → mt76_sta_remove() → mt7921_mac_sta_remove() → mt7921_roc_abort_sync() invokes cancel_work_sync() while roc_work() holds dev->mt76.mutex and the removal path already owns the same lock - a classic ABBA deadlock with no progress possible. No public exploit is identified and EPSS sits at 0.17% (6th percentile), placing this firmly in the patch-and-move-on category for most organisations, though Linux distributions serving MT7921 hardware (common in consumer laptops) should prioritise kernel updates.
Deadlock in the Linux kernel mt76 WiFi driver's remain-on-channel path allows a local low-privileged user to crash or hang the WiFi subsystem. The flaw affects kernels containing the mt76 driver from commit a8f424c128 through the fixed releases (6.18.33, 7.0.10, 7.1), with no confidentiality or integrity impact - only availability. No public exploit code exists and EPSS sits at 0.17% (6th percentile), consistent with a local, hardware-specific denial-of-service with negligible opportunistic exploitation risk.
Control Flow Integrity (CFI) protection for the BPF subsystem's btf_dtor_kfunc_t type is silently compiled out in affected Linux kernel versions because BPF code references the deprecated CONFIG_CFI_CLANG symbol rather than the renamed CONFIG_CFI, leaving CFI violations in BPF destructor functions unchecked and capable of crashing the kernel. Locally-privileged users on affected kernel builds - those compiled with CFI support, typically Clang-built distributions - can trigger a kernel panic by interacting with the BPF subsystem. This vulnerability is not listed in the CISA KEV catalog, no public exploit has been identified, and the EPSS score of 0.16% (5th percentile) reflects minimal real-world exploitation probability.
BPF subsystem argument-tampering in the Linux kernel allows local attackers with CAP_BPF privileges to abuse the kprobe+freplace program chaining path to overwrite kernel function arguments via a manipulated `struct pt_regs`, causing kernel denial of service or subversion of kernel function behavior. The root mechanism is that freplace programs inherit the `kprobe_write_ctx=true` permission from a parent kprobe program, enabling register writes that should be confined to uprobe contexts. No public exploit or CISA KEV listing is confirmed; EPSS sits at the 6th percentile. Patches are available in Linux 6.18.33, 7.0.10, and the 7.1 mainline branch.
Error pointer dereference in the Linux kernel's brcmfmac Broadcom WiFi driver allows a local low-privilege attacker to crash the kernel via a NULL pointer dereference, resulting in denial of service. The function brcmf_chip_add_core() in brcmf_chip_recognition() can return an ERR_PTR sentinel value that is never validated before being dereferenced at five separate code sites (lines 1010-1022 of chip.c), as identified by Smatch static analysis. No public exploit or active exploitation has been identified; EPSS sits at 0.18% (7th percentile), consistent with a low-priority local DoS affecting only systems with Broadcom WiFi hardware.
Lock ordering deadlock in the Linux kernel BPF task_vma iterator allows a local low-privileged user with BPF program execution rights to trigger a system hang or denial of service. Holding the per-VMA lock across BPF program body execution creates a circular dependency (vm_lock → i_rwsem → mmap_lock → vm_lock) when BPF helpers internally acquire mmap_lock. Patches are available across multiple stable branches; EPSS is low at 0.16% and no public exploit or active exploitation has been identified.
RCU stall denial-of-service in the Linux kernel BPF subsystem allows a local low-privileged user to cause kernel-level availability degradation by triggering map clearing on a large PROG_ARRAY BPF map. The missing cond_resched() call in bpf_fd_array_map_clear() prevents CPU yielding during an expensive per-entry loop, starving the RCU grace period mechanism and triggering watchdog stalls in the deferred workqueue. No active exploitation is confirmed - EPSS is 0.16% (5th percentile) and the vulnerability is absent from CISA KEV - making this a maintenance-tier patch rather than an emergency response priority.
Uninitialized memory read in the Linux kernel's hamradio 6pack TTY driver (net/hamradio/6pack.c) allows a local low-privileged user to crash the kernel, causing a denial of service. The flaw exists across a broad range of stable kernel branches from 2.6.12 through at least 7.0, and patches have been issued across eight stable series. No public exploit code exists and no active exploitation has been reported; with an EPSS of 0.16% at the 6th percentile, real-world risk is constrained by the highly niche deployment context of amateur-radio 6pack hardware.
NULL pointer dereference in the Linux kernel's Traffic Control cls_fw (firewall classifier) module causes a local denial of service via kernel crash. Affected kernels from commit ed76f5edccc9 onward publish TC filters to the shared datapath block before the ->change() validation function runs; an attacker with CAP_NET_ADMIN who adds an invalid 'old-style' cls_fw filter to a shared block can trigger fw_classify() to dereference a NULL 'q->handle' pointer when live traffic hits the unvalidated filter. No public exploit or KEV listing exists at time of analysis, and EPSS sits at the 7th percentile (0.17%), consistent with a kernel-local, capability-gated DoS.
Memory leak in the Linux kernel's network scheduler (net_sched) subsystem allows a local low-privileged user to exhaust kernel memory and degrade system availability. The flaw resides in qdisc_dequeue_drop(), which fails to account for root qdiscs that lack the TCQ_F_DEQUEUE_DROPS flag - leaving packet buffers stranded indefinitely on child qdisc to_free lists during qdisc_run_end() cleanup. No active exploitation is confirmed (not in CISA KEV) and EPSS sits at 0.14% (4th percentile), reflecting the low probability of opportunistic abuse given the local access and specific configuration requirements.
Out-of-bounds read in the Linux kernel's BPF test interface (bpf_prog_test_run_skb) allows local users with BPF syscall access to crash the kernel by supplying a crafted test packet containing only an Ethernet header bearing an IPv4 or IPv6 EtherType but no L3 payload. The code calls eth_type_trans() to set skb->protocol and then unconditionally dereferences ip_hdr(skb) or ipv6_hdr(skb) without first validating that the supplied buffer is large enough to contain an IP or IPv6 header, producing a kernel panic. Patched stable releases are confirmed across eight kernel branches; no public exploit or CISA KEV listing exists, and EPSS probability is 0.16% (6th percentile).
Null pointer dereference in the Linux kernel Bluetooth HCI UART line discipline driver (hci_ldisc) allows local low-privileged users on systems with UART-attached Bluetooth hardware to crash the kernel, causing denial of service. The flaw spans multiple stable kernel branches from 5.4.x through 6.15 and stems from a missing flag clear in the error path of hci_uart_register_dev(). No public exploit code exists and EPSS sits at the 7th percentile (0.17%), indicating low real-world exploitation probability; patched versions are available across all affected stable branches.
Insecure temporary file handling in Claude Code's `/copy` command exposes privileged users on multi-user systems to two distinct local attacks: passive response disclosure and symlink-based arbitrary file write. The command unconditionally writes AI response content to `/tmp/claude/response.md` - a static, world-readable path in a world-traversable directory - enabling any local user to read output that may contain secrets, credentials, or sensitive data. A more capable local attacker can pre-plant a symlink at the predictable path, causing a privileged process's `/copy` invocation to overwrite an attacker-chosen file. Affected versions span `@anthropic-ai/claude-code` 2.1.59 through 2.1.127; no public exploit has been identified at time of analysis, and no CISA KEV listing exists.
Path traversal in pnpm's global package management flows allows deletion of the global bin directory or its parent when a malicious package with specially crafted bin keys is installed. Packages carrying ".", "..", or "" as bin object keys in their manifest bypass pnpm's bin-name guard; subsequent global remove, update, or add-replacement operations re-derive those names and pass them through path.join(globalBinDir, binName) into removeBin, resolving to the bin directory itself or its parent. No public exploit has been identified at time of analysis, but fixed versions 10.34.2 and 11.5.3 are available and should be applied immediately given the supply-chain delivery mechanism.
Stack out-of-bounds write in Vim's spell suggestion engine allows a crafted `.spl`/`.sug` file pair to corrupt the call stack and crash the editor when spell suggestions are invoked. All Vim releases prior to 9.2.0653 are affected, with the flaw in `tree_count_words()` and `sug_filltree()` inside `src/spellfile.c`, where three fixed-size MAXWLEN-element stack arrays are indexed by an unbounded depth counter. No public exploit identified at time of analysis (CVSS 4.0 E:U), though the upstream fix commit includes a detailed proof-of-concept test case reproducing the out-of-bounds write.
Out-of-bounds read in Vim's text property subsystem allows a crafted undo file to crash the editor and potentially disclose adjacent heap memory. All Vim releases prior to 9.2.0670 are affected; the vulnerability is reachable whenever a user loads a malicious undo file with the persistent-undo feature compiled in and enabled. No public exploit or CISA KEV listing exists at time of analysis, placing real-world risk in the low-to-medium range despite the local crash severity.
Vim crashes with an out-of-bounds read when opening a maliciously crafted file encrypted with the xchacha20poly1305 cipher (VimCrypt~04! or VimCrypt~05!) whose body is shorter than a libsodium secretstream header. An unsigned integer underflow in the length calculation inside crypt_sodium_buffer_decode() causes the subsequent crypto_secretstream_xchacha20poly1305_pull() call to read far past the end of the input buffer, resulting in a denial-of-service crash. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the fix commit includes a concrete reproducer test case confirming the crash path.
Out-of-bounds heap read in Vim 9.2.0320-9.2.0678 allows a crafted undo or swap file to disclose adjacent heap memory or crash the editor when a victim opens it. The flaw resides in the text property (textprop) subsystem: a maliciously encoded virtual-text property with an oversized tp_text_offset is converted directly to a heap pointer without bounds validation in both the undo-restoration path (um_goto_line) and the display path (get_text_props). The CVSS 4.0 score of 6.8 (Medium) reflects local-only exploitation requiring active user interaction; no public exploit is confirmed at time of analysis, though the fix commit includes detailed test scaffolding constituting a near-complete attack blueprint.
Stack out-of-bounds write in Vim's spell_soundfold_sofo() function (src/spell.c) allows local exploitation when a SOFO-based spell language is active and the soundfold path is triggered with a word exceeding MAXWLEN (254) bytes, corrupting the call frame and crashing the editor with theoretical code execution potential. All Vim releases prior to 9.2.0698 carrying the single-byte SOFO branch are affected; the vendor has released a confirmed fix at v9.2.0698. No public exploit code exists and no CISA KEV listing is present; the CVSS 4.0 E:U supplemental metric confirms exploitation remains unproven at time of analysis.
Out-of-bounds read in Nokogiri's `NodeSet#[]` method (all versions before 1.19.4) enables an attacker who can supply a large negative integer index to bypass a 32-bit-truncated bounds check and trigger a read outside the node set's allocated memory. On CRuby (MRI Ruby), this typically crashes the process - denial of service - with ancillary potential for heap memory disclosure; on JRuby, the runtime's managed memory prevents memory corruption, but an incorrect node is silently returned. No public exploit or active exploitation has been identified; exploitation requires the target application to forward attacker-controlled integers directly to the `NodeSet#[]` or `#slice` API.
Sleep-inside-lock in the Linux kernel's SMC networking subsystem (`__smc_setsockopt()`) allows a local low-privilege user to hold the socket lock indefinitely, exhausting kernel worker threads and triggering the hung task watchdog - producing a local denial of service. Affected systems must have the `net/smc` module loaded and a user-space mechanism (userfaultfd or FUSE) available to stall the in-kernel copy operation. No public exploit has been identified at time of analysis, and EPSS at 0.18% (8th percentile) reflects very low mass-exploitation probability; however, the technique is well-understood in kernel security research.
NULL pointer dereference in the ksmbd (in-kernel SMB server) subsystem of the Linux kernel causes a remotely triggerable kernel oops, resulting in denial of service. The race condition in smb2_oplock_break_noti() and smb2_lease_break_noti() allows an authenticated SMB client to crash the kernel by racing an SMB2 LOGOFF against an oplock/lease break notification - setting opinfo->conn to NULL in the window after ci->m_lock is dropped, then dereferencing it in ksmbd_conn_r_count_inc(). No public exploit identified at time of analysis; EPSS is very low at 0.16% (6th percentile), and CISA KEV listing is absent.
Kernel stack memory disclosure and multicast address corruption in the Linux kernel's 6lowpan IPHC subsystem affects all deployments running the vulnerable code path from commit 5609c185f24d onward. A local unprivileged user on a system with an active 6lowpan interface can trigger `lowpan_iphc_mcast_ctx_addr_compress()` to transmit uninitialized kernel stack bytes over the 6lowpan link layer while also corrupting the RIID field in compressed multicast addresses, breaking multicast connectivity. No public exploit identified at time of analysis; EPSS is 0.17% (7th percentile), and this is not listed in CISA KEV.
Memory leak in the Linux kernel devlink subsystem allows a local low-privileged user to trigger resource exhaustion by inducing a Sub-Function (SF) probe failure, leaving a nested devlink relation unreleased. The flaw occurs because devlink_free() does not clear devlink->rel when an instance fails probe before reaching devl_register(), bypassing the normal cleanup path in devl_unregister(). No public exploit has been identified and EPSS is 0.16% (6th percentile), consistent with a low-real-world-risk kernel memory management defect; patch is available across multiple stable branches.
Memory leak in the Linux kernel wifi cfg80211 subsystem allows a local low-privileged user to cause gradual kernel memory exhaustion by repeatedly triggering failed 6 GHz split scans. The leaked object is a 512-byte allocation in rdev->int_scan_req that escapes the cleanup path in ___cfg80211_scan_done() because rdev->scan_req is NULL at freeing time, causing an early return. No public exploit has been identified; EPSS of 0.16% (6th percentile) reflects very low real-world exploitation probability, and this vulnerability is not listed in CISA KEV.
Kernel crash in Linux cfg80211 WiFi subsystem occurs when EHT (Wi-Fi 7 / 802.11be) capability elements are present without matching EHT operation elements, triggering a null pointer dereference in mac80211 and causing a denial of service. Systems running affected kernel versions with Wi-Fi 7 hardware are at risk of a local-privilege kernel panic with no confidentiality or integrity impact. EPSS is extremely low at 0.15% (5th percentile) and no public exploit has been identified; this is not listed in CISA KEV.
Percpu memory leak in the Linux kernel Bluetooth subsystem allows a local low-privileged user to exhaust kernel memory by repeatedly triggering early failures in Bluetooth HCI UART device initialization. Affected kernels spanning stable branches from 5.10 through 6.16-rc4 fail to invoke cleanup_srcu_struct() when hci_register_dev() never completes, causing the SRCU struct allocated early in hci_alloc_dev() to persist indefinitely. No public exploit code has been identified at time of analysis, and EPSS at 0.19% (9th percentile) reflects negligible exploitation interest; however the availability impact is rated High by NVD given the potential for kernel memory exhaustion.
Reference leak in the Linux kernel Bluetooth ISO subsystem allows a local low-privileged user to exhaust kernel resources and cause a denial of service. The `iso_conn_big_sync` function acquires an `hci_dev` reference via `hci_dev_hold()` through `hci_get_route()` but never releases it, violating the borrow contract. No active exploitation has been confirmed and EPSS is very low at 0.18% (7th percentile), but the affected surface - the BLE Audio Broadcast Isochronous Group (BIG) synchronization path - is present on any Linux system with a Bluetooth controller.
Three distinct logic errors in the Linux kernel's MRP (Multiple Registration Protocol) PDU parser `mrp_pdu_parse_vecattr()` allow an attacker to corrupt kernel MRP applicant state and PDU parsing offsets, resulting in denial of service. Affected systems must have the `mrp` kernel module loaded with an active IEEE 802.1ak bridge interface. No public exploit exists and EPSS is 0.18% (8th percentile), reflecting low active targeting, though patches across multiple stable branches are available and should be applied routinely.
Uninitialized stack variable use in the Linux kernel's rseq (restartable sequences) subsystem exposes systems to kernel information leak and denial-of-service. The flaw in `rseq_exit_user_update()` arises from a C standard evaluation-order ambiguity in struct initialization, detected by syzbot's KMSAN (Kernel Memory Sanitizer) as a kernel-infoleak. Affected are Linux 7.0.10 through 7.0.12 and 7.1 release candidates rc3-rc6; exploitation requires local low-privilege access, no public exploit exists, and EPSS is very low at 0.16%.
Stack overread in the Linux kernel ALSA MIDI sequencer dummy client (snd_seq_dummy) allows a local low-privileged user to crash the kernel or potentially leak kernel stack contents by sending a crafted Universal MIDI Packet (UMP) event. The dummy port copies incoming events into a legacy-sized stack temporary, but when the UMP flag remains set the delivery path calls snd_seq_event_packet_size() and copies a larger UMP-sized packet from that undersized allocation, reading past the stack buffer end. No public exploit has been identified and EPSS is 0.18% (7th percentile), placing this firmly in routine-patch rather than emergency-response territory.
Out-of-bounds read in the Linux kernel netlabel subsystem allows a local low-privileged attacker to crash the kernel by submitting a crafted Generic Netlink request with a valid IPv4/IPv6 address attribute paired with a shorter-than-expected mask attribute. The netlbl_unlabel_addrinfo_get() function relied solely on the address attribute length to determine address family, then unconditionally read the mask attribute as a full struct in_addr (4 bytes) or struct in6_addr (16 bytes) without independently validating the mask length. No public exploit or active exploitation has been identified (EPSS 0.18%, 8th percentile); patches are available across all maintained stable branches.
NULL pointer dereference in the Linux kernel's Marvell EBU GPIO driver (gpio/mvebu) causes a kernel oops and system crash during suspend/resume operations on Marvell Armada ARM platforms. The flaw affects all stable kernel branches from 4.12 onward where mvebu_pwm_suspend() and mvebu_pwm_resume() are unconditionally invoked for every GPIO bank, including those where mvchip->mvpwm is NULL due to absent PWM hardware. A local authenticated user with sufficient privileges to trigger system suspend can crash the kernel with no recovery, resulting in full availability loss. No public exploit exists and EPSS is 0.18% (7th percentile), reflecting a niche hardware dependency that sharply limits real-world exposure.
Deadlock in the Linux kernel PHY networking subsystem (net/phy) allows a local low-privileged user to freeze the networking stack on systems using the generic PHY driver (genphy) with SFP cage hardware. When genphy triggers PHY probing - which occurs while holding the RTNL lock - it erroneously calls sfp_bus_add_upstream(), which itself attempts to acquire RTNL, producing a self-deadlock confirmed by reproduction. No public exploit exists and EPSS is 0.16% (6th percentile), reflecting that exploitation requires an uncommon hardware and driver combination.
Invalid pointer free in the Linux kernel's Open vSwitch (OVS) subsystem allows a local low-privileged user to crash the kernel, resulting in denial of service. The net/openvswitch reply skb cleanup code incorrectly assumes allocation always occurs before mutex acquisition; when allocation fails after locking, an ERR_PTR is passed to kfree_skb(), triggering a kernel panic on any host with OVS active. No public exploit has been identified and EPSS is 0.20% (10th percentile), but the crash is likely deterministic once the code path is reached on a vulnerable kernel.
Resource leak and use-after-free in the Linux kernel's gpio-rockchip driver can crash the kernel on systems using Rockchip GPIO hardware. The driver's remove path fails to call irq_domain_remove_generic_chips(), leaving allocated generic chip structures unreleased and dangling on the global gc_list. After driver unbind or module removal, IRQ subsystem suspend, resume, or shutdown callbacks may subsequently dereference the freed memory, producing a use-after-free condition and kernel panic. No public exploit exists and EPSS sits at the 7th percentile, indicating very low real-world exploitation probability; however, the availability of upstream fix commits makes patching straightforward.
Use-after-free in the Linux kernel ptp_ocp driver crashes the kernel during device removal on systems equipped with Open Compute Platform PTP hardware. The teardown function ptp_ocp_detach() frees pin resources before calling ptp_clock_unregister(), which then accesses those freed resources via ptp_disable_all_events(), introduced by commit a60fc3294a37. EPSS is 0.15% (5th percentile) and this vulnerability is not listed in CISA KEV, indicating no public exploitation and very low real-world risk outside specialized environments.
NULL pointer dereference in the Linux kernel netfilter bridge redirect target crashes the kernel when a bridge port is removed or reassigned between an initial NFQUEUE hook invocation and packet reinject. The affected function ebt_redirect_tg() in the ebtables bridge filtering subsystem calls br_port_get_rcu() without guarding against a NULL return, and the additional complexity noted in the fix is that a mere NULL check would still be insufficient - userspace can move the device into a macvlan while the packet is queued, requiring the packet to be dropped entirely. This flaw has existed since commit f350a0a87374418635689471606454abc7beaa3a (kernel 2.6.36), making it a long-standing latent bug. No public exploit identified at time of analysis; EPSS at 0.18% (7th percentile) signals negligible automated exploitation risk.
Null pointer dereference in the Linux kernel's IPv6 address configuration subsystem crashes the kernel when cleanup_prefix_route() receives the fib6_null_entry sentinel from addrconf_get_prefix_route() and attempts to access its NULL fib6_table pointer without validation. An authenticated local user holding CAP_NET_ADMIN can trigger this by sending a crafted IPv6 DELADDR netlink message, causing a general protection fault and system-wide denial of service. No public exploit or CISA KEV listing exists; EPSS is 0.17% (6th percentile), consistent with a privilege-gated local DoS affecting an extremely widely deployed target.
Memory leak in the Linux kernel's drm/vc4 (Broadcom VideoCore IV DRM) driver allows a local low-privileged user to gradually exhaust kernel memory under allocation-failure conditions. The flaw arises because the return value of krealloc() is assigned directly back to the original pointer without a NULL check - if krealloc() fails and returns NULL, the reference to the previously allocated buffer is silently overwritten, permanently leaking that memory. No public exploit code is identified at time of analysis, and EPSS probability is extremely low at 0.18% (8th percentile), consistent with the local-only, condition-dependent nature of the bug.
Kernel stack information disclosure in the Linux kernel's netfilter nft_meta_bridge subsystem leaks 2 bytes of uninitialized stack data to userspace via the IIFHWADDR register. A local attacker with CAP_NET_ADMIN privileges can craft an nftables bridge rule that reads the full 8-byte register span after a memcpy writes only 6 bytes, exposing stale nft_do_chain() stack content. No public exploit exists and EPSS is 0.17%; however, on hardened systems kernel stack leaks can assist KASLR bypass when chained with other primitives.
Memory leak in the Linux kernel TEE subsystem's register_shm_helper() function allows a local low-privileged user to exhaust kernel memory and degrade system availability. Triggering the leak requires calling the TEE_IOC_SHM_REGISTER ioctl with a length of zero, causing the function to allocate shared memory and then skip its deallocation when iov_iter_npages() returns 0. No public exploit has been identified at time of analysis, and EPSS sits at the 7th percentile, indicating very low real-world exploitation probability.
Bluetooth L2CAP in the Linux kernel fails to enforce the signaling MTU (MTUsig = 48 bytes) in l2cap_sig_channel(), enabling a nearby BR/EDR peer to send a single oversized fixed-channel signaling packet packed with many ECHO_REQ commands before pairing and force a proportional burst of ECHO_RSP frames. In a confirmed test, one 681-byte CID 0x0001 packet containing 168 ECHO_REQ commands caused the target to emit 168 responses over approximately 220 ms - roughly a 250× frame amplification - constituting a traffic-amplification denial-of-service. No active exploitation has been identified at time of analysis; vendor-released patches are available across multiple stable kernel branches.
Recursive spinlock AA deadlock in the Linux kernel's hugetlb memory-failure subsystem allows a local user to hang or panic the kernel by racing two concurrent madvise(MADV_HWPOISON) calls against a concurrent unmap on the same hugetlb folio. The flaw exists because get_huge_page_for_hwpoison() held hugetlb_lock while calling folio_put(), which - when concurrent unmap had already dropped the page-table reference - triggered free_huge_folio() to re-acquire the non-recursive lock, causing an irrecoverable deadlock. No confirmed active exploitation exists (not in CISA KEV), and EPSS sits at 0.18% (8th percentile), indicating negligible real-world exploitation probability at this time.
Missing bounds validation in the Linux kernel's accel/ivpu Intel VPU accelerator driver allows a local low-privileged user on an affected Intel VPU-equipped system to trigger kernel memory allocation errors or a denial of service by supplying a malformed firmware image header specifying improperly aligned or undersized runtime memory. Affected versions include Linux 6.19 and 7.1-rc1 through rc6; fixed commits are available for both the 7.0.x stable series and the 7.1 branch. No public exploit identified at time of analysis; EPSS is 0.16% (6th percentile), and no CISA KEV listing exists, reflecting minimal real-world exploitation interest.
NULL pointer dereference in the Linux kernel's Intel Stratix10 RSU (Remote System Update) firmware driver causes a kernel panic when SMC call timeouts occur during probe initialization. Affected kernels through 7.1-rc7 and 7.0.13 expose a race condition where timeout-driven error paths in stratix10_rsu_probe() free the service channel - setting chan->scl to NULL - but fail to return early, allowing subsequent service kthreads to dereference the now-NULL pointer in their receive callbacks. The vulnerability is a local denial-of-service with no public exploit identified at time of analysis, and EPSS places exploitation probability at only 0.15%.
ABBA deadlock in the Linux kernel xfrm iptfs subsystem causes availability loss on SMP systems when iptfs state is destroyed while its timer callbacks are concurrently executing on another CPU. The vulnerability affects the IP Traffic Flow Secrecy (IPTFS) implementation within the kernel's xfrm IPsec framework, specifically during iptfs_destroy_state() - a function that acquires spinlocks before calling hrtimer_cancel(), creating a circular dependency with softirq timer callbacks that attempt to re-acquire those same locks. No public exploit code has been identified and EPSS is 0.17% (7th percentile), indicating this is a low-probability exploitation target; the impact is a kernel deadlock causing a system hang (DoS) with no confidentiality or integrity impact.
Reference-count leak in the Linux kernel's drm/virtio GPU driver allows a local low-privilege user inside a QEMU/KVM virtual machine to gradually exhaust kernel memory, causing a guest denial of service. The bug exists in virtio_gpu_dma_fence_wait(), where an early error return from inside dma_fence_unwrap_for_each() leaves a dma_fence reference acquired by dma_fence_unwrap_first() unreleased - the only such early-return site in the entire kernel tree. No public exploit is identified at time of analysis and EPSS sits at 0.18% (7th percentile), consistent with the absence from CISA KEV and the non-trivial conditions required to trigger repeated fence-wait failures.
The vsock/VMCI transport in the Linux kernel silently leaks the accept queue counter (sk_ack_backlog) on every failed vsock connection handshake, eventually causing a permanent denial of service on any vsock listener. Repeated handshake failures caused by malformed packets, queue pair allocation failures, or event subscription failures each increment sk_ack_backlog without a corresponding decrement; once the counter reaches sk_max_ack_backlog, the listener rejects all subsequent connections with -ECONNREFUSED until the owning process is restarted. No public exploit identified at time of analysis; EPSS of 0.18% at the 8th percentile reflects low automated exploitation probability, consistent with the VMware-specific exposure requirement.
NULL pointer dereference in the Linux kernel bnxt_en Broadcom NetXtreme Ethernet driver crashes the kernel when PCIe error recovery fires against a closed NIC, causing a denial of service. Affected kernel versions span from 4.17 through multiple LTS and mainline branches up to 7.1-rc4, with patches released across all active stable series. No public exploit exists and EPSS sits at 0.17% (7th percentile), marking this as a reliability and stability concern rather than an actively targeted attack vector.
Unbounded kernel log spam and conditional kernel panic in the Linux kernel's accel/ethosu Arm Ethos-U NPU driver allows any local unprivileged user with DRM device access to exhaust kernel log resources or crash the system. The driver's unimplemented NPU_OP_RESIZE command handler contains an unconditional WARN_ON(1) that fires every time userspace submits this operation via DRM_IOCTL_ETHOSU_GEM_CREATE. On systems where the panic_on_warn kernel parameter is enabled, this becomes a trivial denial-of-service primitive requiring only local DRM device access. No public exploit has been identified at time of analysis, and EPSS sits at the 5th percentile (0.15%), reflecting the niche hardware and non-default configuration requirements.
Kernel crash via FUSE pagecache misuse in the Linux kernel allows a local low-privileged user controlling a FUSE daemon to trigger a WARN_ON() assertion in fuse_parse_cache() by sending FUSE_NOTIFY_STORE or FUSE_NOTIFY_RETRIEVE notifications targeting directory inodes instead of regular files, causing a denial-of-service kernel crash. The vulnerability specifically affects FUSE filesystems that have directory caching (FOPEN_CACHE_DIR) enabled, a non-default configuration that exposes kernel-internal pagecache storage to invalid manipulation. No public exploit has been identified, EPSS sits at 0.18% (7th percentile), and patches have been released across all active Linux stable branches.
NULL pointer dereference in the Linux kernel's futex PI requeue path allows a local low-privileged user to crash the kernel. Triggered via FUTEX_CMP_REQUEUE_PI when a non-top waiter already owns the target PI futex, the deadlock detection path returns -EDEADLK before initializing waiter->task, which remove_waiter() then dereferences unconditionally. Impact is a kernel panic (system-wide denial of service). No public exploit identified at time of analysis and EPSS is at the 7th percentile, but the attack surface is any unprivileged local process on an affected kernel version.
Kernel availability impact in Linux iommu/dma SWIOTLB subsystem allows a local low-privileged user to corrupt IOMMU mappings and trigger a kernel WARN_ON via Thunderbolt NVMe passthrough commands. The iommu_dma_iova_link_swiotlb() function fails to guard against zero-length middle segments in unaligned DMA mappings, causing iommu_map() to receive an illegal zero-size argument; the subsequent error unwind then starts from the wrong offset, corrupting the IOMMU page table state and firing WARN_ON at destruction. No active exploitation is confirmed (not in CISA KEV), and EPSS of 0.17% (6th percentile) signals negligible threat-actor interest, but the bug is reliably reproducible with commodity Thunderbolt NVMe hardware.
Null pointer dereference in the Linux kernel's real-time mutex (rtmutex) subsystem allows a local low-privileged user to crash the kernel via FUTEX_CMP_REQUEUE_PI, causing a denial of service. Affected stable branches span Linux 6.1 through 7.1-rc5; vendor patches are available via kernel.org stable commits. No public exploit has been identified and EPSS is 0.17% (7th percentile), indicating negligible observed exploitation activity.
Integer underflow in the Linux kernel fastrpc misc driver corrupts DMA addresses sent to Qualcomm DSPs, enabling a local low-privileged user to crash the DSP subsystem or induce a kernel panic. The flaw in fastrpc_get_args() affects all major stable kernel branches from 5.15 through 7.1-rc3 and is patched across multiple stable series. No public exploit exists and EPSS probability is 0.17% (7th percentile), indicating low real-world exploitation risk despite broad platform coverage.
NULL pointer dereference in the Linux kernel's fastrpc misc driver crashes the kernel when a Qualcomm DSP sends a glink message before the fastrpc_rpmsg_probe() initialization routine completes. Systems using the Qualcomm FastRPC subsystem - primarily Android and embedded Qualcomm SoC platforms running Linux 5.1 through unpatched 6.x/7.x stable branches - are vulnerable to a local denial-of-service (kernel panic) at boot. No public exploit exists and EPSS is 0.17% (6th percentile), consistent with a hardware-timing race condition requiring specific Qualcomm DSP hardware rather than generic remote exploitation.
Corrupted reverse-mapping (rmap) state in the Linux kernel's mm/huge_memory subsystem crashes or destabilizes affected systems through a flag misinterpretation in set_pmd_migration_entry() for device-private PMD entries. On x86-64 with CONFIG_MEM_SOFT_DIRTY enabled, the function incorrectly reads the softdirty bit as a write-permission flag - because _PAGE_SWP_SOFT_DIRTY aliases _PAGE_RW - causing migration entries to be marked writable when they should be read-only, ultimately triggering a VM_WARN assertion in __folio_add_anon_rmap() when an AnonExclusive folio reaches entire_mapcount=2. No public exploit exists and no active exploitation is confirmed; a vendor patch is available as of Linux 7.0.13 and 7.1.
Hugetlb VMA reservation leak in the Linux kernel mm/hugetlb subsystem allows a local authenticated user to trigger SIGBUS on a process at a previously reserved huge-page address. Two code paths - the UFFDIO_COPY resubmission path and the fork-time copy-on-write path - fail to call restore_reserve_on_error() after copy_user_large_folio() returns an error, leaving the per-VMA reservation map entry marked consumed. No public exploit exists and EPSS is 0.17% (6th percentile), but patches are available in multiple stable branches.
NULL pointer dereference in the Linux kernel's dw_mmc-rockchip MMC driver triggers kernel panics on systems running legacy Rockchip SoCs (rk2928, rk3066, rk3188) when the MMC subsystem initializes. Commit ff6f0286c896 introduced a mandatory private-data access path that was never populated for these old controllers - which historically had no UHS support and no parse_dt callback - causing a reproducible kernel crash on affected hardware. No active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.17% (6th percentile) reflects negligible real-world exploitation probability; the primary risk is an accidental reliability failure on embedded systems running these legacy SoCs.
Thunderbolt XDomain property validator in the Linux kernel triggers a heap underflow when processing zero-length TEXT property entries, enabling a local low-privileged attacker to crash the kernel (denial of service). The root cause is in tb_property_entry_valid(), which permits length==0 for TEXT entries that subsequently compute an array index of -1 during null-termination (0 * 4 - 1), writing one byte before the allocated buffer. No public exploit has been identified and EPSS is extremely low at 0.18% (8th percentile), indicating negligible opportunistic exploitation pressure despite the kernel's ubiquitous deployment footprint.
NULL pointer dereference in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user to trigger a kernel panic by invoking the kfd_ioctl_set_debug_trap() ioctl with a non-zero num_queues value and a NULL queue_array_ptr. The root flaw is that get_queue_ids() returns NULL in this case rather than ERR_PTR(-EINVAL), and both callers check only IS_ERR() - since IS_ERR(NULL) evaluates false, execution proceeds to q_array_invalidate(), which immediately dereferences the NULL pointer while iterating, crashing the kernel. No public exploit has been identified and the EPSS score of 0.17% (6th percentile) confirms low observed exploitation probability, though the trigger path is mechanically simple for any user with /dev/kfd access.
NULL pointer dereference in the Intel Xe GPU driver (drm/xe) causes a kernel panic during system suspend or shutdown when display hardware is disabled via hardware fuses rather than absent at initial probe. Systems running Linux 6.8 and later with Intel Xe GPUs in fuse-disabled display configurations are affected; a low-privileged local user can trigger an unplanned system crash by initiating suspend or shutdown. No public exploit exists and EPSS is 0.17% (6th percentile), reflecting this as a reliability and local-denial-of-service issue rather than a broad security priority.
Reference counting leaks in the Linux kernel's drm/v3d driver allow a local user to exhaust kernel memory and trigger a denial-of-service condition on systems equipped with Broadcom VideoCore VI GPUs (e.g., Raspberry Pi 4/5). The flaw exists across three code paths in the SET_GLOBAL and CLEAR_GLOBAL perfmon ioctls, as well as in the perfmon destroy path, each of which fails to release references acquired by v3d_perfmon_find(). No public exploit or active exploitation has been identified; EPSS probability stands at 0.17%, reflecting negligible automated exploitation interest.
Memory exhaustion via vaddr leak in the Linux kernel's V3D DRM driver allows a local low-privileged user to degrade or deny service on systems equipped with Broadcom V3D GPUs. The function v3d_rewrite_csd_job_wg_counts_from_indirect() maps two buffer objects (indirect buffer and workgroup buffer) but takes an early return path - without releasing the vaddr mappings - whenever any workgroup count read from the indirect buffer is zero, permanently leaking both BO mappings per triggering job submission. No public exploit has been identified and EPSS sits at the 6th percentile (0.17%), consistent with the hardware-specific, local-only attack surface; this vulnerability is not listed in CISA KEV.
The drm/v3d GPU driver in the Linux kernel mishandles indirect Compute Shader Dispatch (CSD) jobs that carry zeroed workgroup dimension counts, allowing a local low-privilege user with GPU compute access to crash the VideoCore VI GPU subsystem. The hardware interprets a zero workgroup count as 65536 - exceeding the user-space-exposed maximum of 65535 - instead of treating the dispatch as a no-op, causing undefined GPU behavior and a denial-of-service condition. Exploitation is constrained to Broadcom VideoCore VI hardware (Raspberry Pi 4/5 ecosystem); EPSS is 0.17% (6th percentile), no public exploit exists, and the vulnerability is absent from CISA KEV.
NULL pointer dereference and buffer over-read in the Linux kernel's AMD display driver (drm/amd/display) can be triggered by a local user writing to the sdp_message debugfs node, causing a kernel panic and denial of service. The dp_sdp_message_debugfs_write() function fails to check whether connector->base.state->crtc is NULL - a valid transient state after GPU hotplug before an atomic commit - and unconditionally passes 36 bytes to copy_from_user() regardless of the caller-provided size, enabling a second over-read path. No public exploit or CISA KEV listing exists; EPSS is 0.18% (7th percentile), consistent with a localized, hardware-dependent DoS.
KubeVirt's virt-handler domain notify server allows a compromised virt-launcher process to forge lifecycle events for any other VMI scheduled on the same Kubernetes node, causing virt-handler to corrupt that VMI's state and disrupt its lifecycle management. The root cause is that gRPC handlers for HandleDomainEvent and HandleK8SEvent accept VMI namespace/name exclusively from the request body, never cross-checking against the per-VMI pipe socket the connection arrived on. With CVSS 6.5 (AV:L/S:C), the attack requires local access via a compromised container but can impact multiple VMIs across tenants on the same node; no public exploit code or CISA KEV listing has been identified at time of analysis.
Site isolation bypass in Google Chrome's Passwords implementation allows a remote attacker who has already compromised the renderer process to cross origin boundaries via a crafted HTML page. Affected versions are all Chrome releases prior to 149.0.7827.197 on desktop platforms. Google has confirmed this as a High severity Chromium issue; no public exploit code or active exploitation has been identified at time of analysis, and CISA SSVC categorizes exploitation status as none.
Uninitialized GPU memory use in Google Chrome on Android before 149.0.7827.197 exposes process memory contents to remote attackers without requiring authentication. An attacker who induces a user to load a crafted HTML page can read potentially sensitive data from Chrome's GPU process memory, consistent with the High confidentiality impact assigned in the CVSS vector. No public exploit code exists at time of analysis, and CISA's SSVC framework classifies exploitation as none and not automatable with only partial technical impact - indicating this is a patch-cycle priority rather than an emergency response item.
Site isolation bypass in Google Chrome's Navigation component allows an attacker who has already compromised the renderer process to escape Chrome's cross-origin containment boundary via a crafted HTML page, affecting all Chrome versions prior to 149.0.7827.197. The vulnerability stems from insufficient input validation (CWE-20) in the Navigation subsystem, which fails to properly enforce site isolation when navigations are initiated from a compromised renderer. No public exploit code has been identified and CISA SSVC confirms no known active exploitation at time of analysis, though the prerequisite of renderer compromise makes this a meaningful second-stage escalation primitive.
Uninitialized GPU memory use in Google Chrome prior to 149.0.7827.197 enables a second-stage attacker who has already compromised the renderer process to read sensitive data from GPU process memory via a crafted HTML page. Classified as CWE-457 (Use of Uninitialized Variable), the flaw creates an information disclosure path within Chrome's multi-process architecture. No public exploit exists, CISA has not listed this in KEV, and SSVC rates exploitation as none - but the C:H confidentiality impact rating reflects meaningful data exposure if an attacker successfully chains this with a renderer exploit.
Cross-origin data leakage in Google Chrome's Autofill implementation allows a remote attacker who has already achieved renderer process compromise to exfiltrate sensitive cross-origin data via a specially crafted HTML page. Affected versions include all Chrome releases prior to 149.0.7827.197; the flaw was reported by the Chrome security team and rated High severity by Chromium. No public exploit code has been identified and no active exploitation is confirmed, though the vulnerability chains onto a renderer compromise making real-world exploitation a two-stage attack.
Same-origin policy bypass in Google Chrome's DeviceBoundSessionCredentials (DBSC) feature affects all Chrome versions prior to 149.0.7827.197, allowing a remote attacker to read limited cross-origin data via a crafted HTML page. The flaw stems from incorrect origin validation (CWE-346) in the DBSC implementation, a relatively new anti-session-hijacking subsystem. SSVC assessment confirms no exploitation at time of analysis, and no public exploit code has been identified; the CVSS score of 4.3 Medium reflects meaningful but bounded confidentiality impact contingent on user interaction.
Kernel panic via RCU locking imbalance in the DRBD subsystem's drbd_adm_dump_devices() function affects Linux kernel versions from the introduction of commit a55bbd375d18 through multiple stable branches. A locally authenticated low-privilege user who can invoke DRBD administrative operations may trigger a kernel crash by exploiting the unbalanced rcu_read_unlock() call - called without a preceding rcu_read_lock() - leading to a denial-of-service via kernel instability. No public exploit exists and EPSS probability is 0.18% (8th percentile), indicating very low real-world exploitation activity.
Memory leak in the Linux kernel block layer's zone revalidation path allows local low-privileged users to cause kernel memory exhaustion, resulting in a denial-of-service condition. Specifically, blk_revalidate_disk_zones() fails to free the args.zones_cond allocation on error paths after disk_revalidate_zone_resources() succeeds, leaving memory unreleased. No public exploit code exists and no active exploitation has been confirmed; EPSS probability stands at 0.14% (4th percentile), consistent with a low-priority local DoS affecting niche storage configurations.
Reference leak in the Linux kernel blk-cgroup subsystem allows a local low-privileged user to cause kernel disk object memory exhaustion, potentially leading to system instability or denial of service. The flaw exists in blkcg_maybe_throttle_current() since kernel 6.3, where a missing put_disk() call on error paths leaves disk references permanently unreleased. No public exploit exists and EPSS at 0.16% (5th percentile) indicates negligible exploitation probability; patches are available across multiple stable branches.
Improper locking in the Linux kernel's md (Multiple Devices/software RAID) subsystem causes a recursive kobject teardown deadlock when 'clear' is written to the sysfs array_state attribute. A local user with write access to an active md array's sysfs interface can trigger a kernel denial-of-service by exploiting the incorrect ordering of mddev_put() before sysfs_unbreak_active_protection() in md_attr_store(). No public exploit code is identified and EPSS exploitation probability is minimal at 0.17% (7th percentile); no CISA KEV listing indicates active exploitation has not been confirmed.
Availability loss in the Linux kernel ublk (userspace block device) subsystem can permanently hang IO commands when a ublk recovery server dies before issuing fetch commands for all IOs in a queue. The per-IO canceled flag, once set, is only cleared when every IO in the queue is fetched - if the server crashes mid-recovery, surviving IOs with set canceled flags can never be completed because ublk_cancel_cmd is blocked from calling io_uring_cmd_done. This results in a denial-of-service condition affecting systems using ublk-based userspace block devices. No public exploit has been identified at time of analysis, and EPSS is 0.14% (4th percentile), consistent with a low-exploitation-probability kernel logic flaw requiring specific local conditions.
Deadlock in the Linux kernel's md/raid456 subsystem during array reshape allows a local low-privileged user to hang the system indefinitely. When direct I/O spans the reshape position in a RAID 4/5/6 array, the I/O blocks in raid5_make_request() holding an active_io reference while waiting for reshape progress. If an administrator concurrently freezes the reshape and writes to md/suspend_lo or md/suspend_hi, mddev_suspend() deadlocks: it waits for active_io to drain, but the blocked I/O requires reshape progress that the frozen reshape thread can never provide. Exploitation requires a very specific confluence of conditions and no public exploit code or active exploitation (CISA KEV) has been identified; EPSS at 0.17% (7th percentile) confirms low real-world exploitation probability.
Deadlock in the Linux kernel btrfs filesystem subsystem triggers an unrecoverable kernel hang when the flushoncommit mount option is active and a reflink operation copies an inline extent to a destination offset beyond the target inode's i_size. The circular wait arises because the reflink task holds the extent io tree lock while blocking on a pending transaction commit, while the commit's delalloc flush simultaneously blocks trying to acquire that same held lock. No public exploit or CISA KEV listing exists; EPSS is 0.18% (8th percentile), reflecting very low real-world exploitation interest.
Memory leak in the Linux kernel's amd-pstate driver allows local availability impact on systems running AMD CPUs when EPP (Energy Performance Preference) initialization fails. The amd_pstate_epp_cpu_init() function allocates a cpudata object at entry but lacks a corresponding free on the error path triggered when setting the EPP value fails, causing kernel heap memory to leak on each failed CPU initialization event. No public exploit exists and EPSS sits at 0.15% (5th percentile), reflecting negligible adversarial interest; risk is primarily operational - repeated CPU hotplug cycles on affected hardware can progressively exhaust kernel memory.
Unsafe NMI-context invocation of perf_allow_kernel() in the Linux kernel's AMD IBS (Instruction Based Sampling) perf handler can cause a fatal kernel crash on AMD-powered systems running affected stable branches from commit 50a53b60e141d7e3 onward. A local user with perf event access on an AMD system can trigger the IBS NMI handler path, inducing a kernel panic or deadlock as the unsupported function call violates NMI-context restrictions. No public exploit has been identified at time of analysis; EPSS is 0.15% (5th percentile), consistent with a niche hardware-specific kernel subsystem flaw with no current exploitation activity.
Null pointer dereference in the Linux kernel's BPF LWT (Lightweight Tunnel) subsystem allows a local user with BPF syscall privileges to crash the kernel via a denial-of-service. The flaw exists because bpf_prog_test_run_skb constructs a socket buffer (skb) without initializing skb->_skb_refdst; when a BPF program invokes the bpf_lwt_xmit_push_encap helper through this test path, the subsequent dereference of skb_dst(skb)->dev hits a null pointer and triggers a kernel panic. No public exploit or CISA KEV listing exists, and EPSS is very low at 0.18% (7th percentile), consistent with the specialized access required.
PowerPC 64-bit (ppc64le/Book3S64) Linux kernel systems from version 5.8 onward can be crashed via a local race condition between concurrent move_pages() and munmap() operations on Transparent Huge Page (THP) PMD-backed memory. During the PMD migration sequence, a narrow window exists where the PMD entry holds a migration swap entry with pmd_present=0; a concurrent munmap() acquiring the same page table lock during this window triggers a VM_BUG_ON() assertion in pmdp_huge_get_and_clear_full(), causing a kernel panic. No public exploit is identified and EPSS stands at 0.15% (5th percentile), but the DoS impact is confirmed by upstream kernel developers with real hardware traces on IBM POWER10 and is patched in stable releases 7.0.10 and 7.1.
The Marvell Libertas USB WiFi driver in the Linux kernel invokes usb_kill_urb() and usb_kill_anchored_urbs() from interrupt context during the HCD giveback path, causing a kernel BUG() or deadlock because those functions may sleep. Systems with a Marvell Libertas USB WiFi adapter attached can be crashed by a local low-privileged user triggering the race condition, resulting in a denial of service via kernel panic. No public exploit exists and EPSS is 0.15% (5th percentile), indicating negligible exploitation probability; the constraint to specific legacy hardware further limits real-world impact.
BPF local storage deletion in the Linux kernel deadlocks when `bpf_xxx_storage_delete()` helpers execute within a Non-Maskable Interrupt (NMI) context, because the underlying RCU-based freeing mechanisms (`kfree_rcu`, `call_rcu`, `call_rcu_tasks_trace`) are not safe in NMI or reentrant execution paths. Locally privileged users capable of loading BPF programs attached to NMI-triggerable events can exploit this to cause a CPU-level deadlock, denying availability on the affected processor. No public exploit has been identified and EPSS at 0.14% (4th percentile) confirms this is a very low probability of opportunistic exploitation; impact is purely availability.
NULL pointer dereference in the Linux kernel's MediaTek mt76/mt7925 WiFi driver crashes affected systems when the `vif` (virtual interface) pointer is uninitialized at the time `mt7925_mac_write_txwi` calls `ieee80211_vif_is_mld(vif)`. Local low-privilege users on systems equipped with mt7925 hardware and running unpatched kernels can trigger a kernel panic, resulting in a denial of service. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.17% (6th percentile) reflects negligible real-world exploitation probability at this time.
Memory exhaustion in the Linux kernel mt76 WiFi driver allows a local low-privileged user on systems with MediaTek MT76 hardware to cause denial of service through kernel memory leakage during module teardown. The mt76_dma_cleanup routine fails to destroy page_pools associated with WED RRO receive queues (queues not tied to NAPI), and does not return pages to the pool when WED is not enabled - resulting in unreclaimed kernel memory on each module unload cycle. No public exploit exists and EPSS probability sits at 0.17% (6th percentile), consistent with a niche hardware-specific leak with no code-execution path.
Deadlock in the Linux kernel's mt76/mt7925 MediaTek WiFi driver can be triggered by a local low-privileged user, causing the wireless networking subsystem to hang indefinitely. The flaw exists in mt7925_roc_abort_sync(), which calls cancel_work_sync() while already holding dev->mt76.mutex - the same mutex held by roc_work() - producing a classic mutual-wait deadlock with no path to resolution. Systems running affected kernel versions with MediaTek MT7925 WiFi hardware are vulnerable to a local denial of service; no public exploit has been identified and EPSS places exploitation probability at 0.17% (6th percentile), consistent with the niche hardware requirement.
Mutex deadlock in the Linux kernel's mt7921 WiFi driver (mt76/mt7921 subsystem) can render the WiFi subsystem permanently unresponsive on affected systems. The deadlock arises during station removal: the call chain mt76_sta_state() → mt76_sta_remove() → mt7921_mac_sta_remove() → mt7921_roc_abort_sync() invokes cancel_work_sync() while roc_work() holds dev->mt76.mutex and the removal path already owns the same lock - a classic ABBA deadlock with no progress possible. No public exploit is identified and EPSS sits at 0.17% (6th percentile), placing this firmly in the patch-and-move-on category for most organisations, though Linux distributions serving MT7921 hardware (common in consumer laptops) should prioritise kernel updates.
Deadlock in the Linux kernel mt76 WiFi driver's remain-on-channel path allows a local low-privileged user to crash or hang the WiFi subsystem. The flaw affects kernels containing the mt76 driver from commit a8f424c128 through the fixed releases (6.18.33, 7.0.10, 7.1), with no confidentiality or integrity impact - only availability. No public exploit code exists and EPSS sits at 0.17% (6th percentile), consistent with a local, hardware-specific denial-of-service with negligible opportunistic exploitation risk.
Control Flow Integrity (CFI) protection for the BPF subsystem's btf_dtor_kfunc_t type is silently compiled out in affected Linux kernel versions because BPF code references the deprecated CONFIG_CFI_CLANG symbol rather than the renamed CONFIG_CFI, leaving CFI violations in BPF destructor functions unchecked and capable of crashing the kernel. Locally-privileged users on affected kernel builds - those compiled with CFI support, typically Clang-built distributions - can trigger a kernel panic by interacting with the BPF subsystem. This vulnerability is not listed in the CISA KEV catalog, no public exploit has been identified, and the EPSS score of 0.16% (5th percentile) reflects minimal real-world exploitation probability.
BPF subsystem argument-tampering in the Linux kernel allows local attackers with CAP_BPF privileges to abuse the kprobe+freplace program chaining path to overwrite kernel function arguments via a manipulated `struct pt_regs`, causing kernel denial of service or subversion of kernel function behavior. The root mechanism is that freplace programs inherit the `kprobe_write_ctx=true` permission from a parent kprobe program, enabling register writes that should be confined to uprobe contexts. No public exploit or CISA KEV listing is confirmed; EPSS sits at the 6th percentile. Patches are available in Linux 6.18.33, 7.0.10, and the 7.1 mainline branch.
Error pointer dereference in the Linux kernel's brcmfmac Broadcom WiFi driver allows a local low-privilege attacker to crash the kernel via a NULL pointer dereference, resulting in denial of service. The function brcmf_chip_add_core() in brcmf_chip_recognition() can return an ERR_PTR sentinel value that is never validated before being dereferenced at five separate code sites (lines 1010-1022 of chip.c), as identified by Smatch static analysis. No public exploit or active exploitation has been identified; EPSS sits at 0.18% (7th percentile), consistent with a low-priority local DoS affecting only systems with Broadcom WiFi hardware.
Lock ordering deadlock in the Linux kernel BPF task_vma iterator allows a local low-privileged user with BPF program execution rights to trigger a system hang or denial of service. Holding the per-VMA lock across BPF program body execution creates a circular dependency (vm_lock → i_rwsem → mmap_lock → vm_lock) when BPF helpers internally acquire mmap_lock. Patches are available across multiple stable branches; EPSS is low at 0.16% and no public exploit or active exploitation has been identified.
RCU stall denial-of-service in the Linux kernel BPF subsystem allows a local low-privileged user to cause kernel-level availability degradation by triggering map clearing on a large PROG_ARRAY BPF map. The missing cond_resched() call in bpf_fd_array_map_clear() prevents CPU yielding during an expensive per-entry loop, starving the RCU grace period mechanism and triggering watchdog stalls in the deferred workqueue. No active exploitation is confirmed - EPSS is 0.16% (5th percentile) and the vulnerability is absent from CISA KEV - making this a maintenance-tier patch rather than an emergency response priority.
Uninitialized memory read in the Linux kernel's hamradio 6pack TTY driver (net/hamradio/6pack.c) allows a local low-privileged user to crash the kernel, causing a denial of service. The flaw exists across a broad range of stable kernel branches from 2.6.12 through at least 7.0, and patches have been issued across eight stable series. No public exploit code exists and no active exploitation has been reported; with an EPSS of 0.16% at the 6th percentile, real-world risk is constrained by the highly niche deployment context of amateur-radio 6pack hardware.
NULL pointer dereference in the Linux kernel's Traffic Control cls_fw (firewall classifier) module causes a local denial of service via kernel crash. Affected kernels from commit ed76f5edccc9 onward publish TC filters to the shared datapath block before the ->change() validation function runs; an attacker with CAP_NET_ADMIN who adds an invalid 'old-style' cls_fw filter to a shared block can trigger fw_classify() to dereference a NULL 'q->handle' pointer when live traffic hits the unvalidated filter. No public exploit or KEV listing exists at time of analysis, and EPSS sits at the 7th percentile (0.17%), consistent with a kernel-local, capability-gated DoS.
Memory leak in the Linux kernel's network scheduler (net_sched) subsystem allows a local low-privileged user to exhaust kernel memory and degrade system availability. The flaw resides in qdisc_dequeue_drop(), which fails to account for root qdiscs that lack the TCQ_F_DEQUEUE_DROPS flag - leaving packet buffers stranded indefinitely on child qdisc to_free lists during qdisc_run_end() cleanup. No active exploitation is confirmed (not in CISA KEV) and EPSS sits at 0.14% (4th percentile), reflecting the low probability of opportunistic abuse given the local access and specific configuration requirements.
Out-of-bounds read in the Linux kernel's BPF test interface (bpf_prog_test_run_skb) allows local users with BPF syscall access to crash the kernel by supplying a crafted test packet containing only an Ethernet header bearing an IPv4 or IPv6 EtherType but no L3 payload. The code calls eth_type_trans() to set skb->protocol and then unconditionally dereferences ip_hdr(skb) or ipv6_hdr(skb) without first validating that the supplied buffer is large enough to contain an IP or IPv6 header, producing a kernel panic. Patched stable releases are confirmed across eight kernel branches; no public exploit or CISA KEV listing exists, and EPSS probability is 0.16% (6th percentile).
Null pointer dereference in the Linux kernel Bluetooth HCI UART line discipline driver (hci_ldisc) allows local low-privileged users on systems with UART-attached Bluetooth hardware to crash the kernel, causing denial of service. The flaw spans multiple stable kernel branches from 5.4.x through 6.15 and stems from a missing flag clear in the error path of hci_uart_register_dev(). No public exploit code exists and EPSS sits at the 7th percentile (0.17%), indicating low real-world exploitation probability; patched versions are available across all affected stable branches.