Red Hat
Monthly
Kernel panic via unchecked error pointer dereference in the Linux kernel's drm/sun4i display backend driver affects Allwinner SoC-based systems running kernel versions from 4.17 up to the patched releases. In sun4i_backend_atomic_check() at drivers/gpu/drm/sun4i/sun4i_backend.c:496, the return value of drm_atomic_get_plane_state() is not validated against IS_ERR() before dereference, allowing a local low-privilege user to crash the kernel. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.16% (6th percentile) reflects negligible real-world exploitation interest.
Resource leak in the Linux kernel ASoC STI audio driver allows a local authenticated user to exhaust kernel memory by repeatedly loading and unloading the driver, degrading system availability. The vulnerability stems from regmap_field objects allocated during STI audio player initialization never being released on driver removal. With EPSS at 0.17% (7th percentile), no KEV listing, and no public exploit, this is a low-priority maintenance fix rather than an actively weaponizable flaw. Vendor-released patches are available across multiple stable kernel branches.
NULL pointer dereference in the Linux kernel dm-cache subsystem crashes the kernel when concurrent writes target the same cached block in passthrough mode. The flaw affects any kernel with a dm-cache device explicitly configured in passthrough mode since version 4.12, allowing a local low-privileged user with write access to the block device to cause a kernel panic and complete denial of service. No public exploit code exists and EPSS at 0.18% (7th percentile) confirms very low exploitation probability; fixed across multiple stable kernel series with patches confirmed by Ubuntu security advisories.
Write operation hang in the Linux kernel dm-cache subsystem's passthrough mode allows a local user with low privileges to stall I/O indefinitely on affected block devices. The defect lies in `invalidate_remove()`, which configures a remapped bio for submission to the cache origin but discards it without dispatching, leaving write operations permanently pending. No public exploit has been identified at time of analysis; EPSS at 0.18% (8th percentile) and a strictly local attack vector place this firmly in the operational-bug category rather than an active threat.
Data loss in the Linux kernel dm-cache subsystem occurs when LVM's table preload feature is used to switch a writeback cache to passthrough mode while dirty mappings exist. The dirty mapping check was designed assuming table reloads happen only after device suspension (which flushes dirty blocks), but LVM's preload path bypasses this assumption, allowing dirty cache blocks to be silently loaded into passthrough mode where they will never be written back to the origin device. No public exploit code exists; reproduction requires a deliberate sequence of dmsetup and fio operations documented in the CVE description itself. EPSS is 0.18% (7th percentile), consistent with a local, configuration-specific data-loss condition rather than a remotely exploitable flaw.
Memory leak in the Linux kernel dm-cache metadata subsystem can be triggered by local users with low privileges to gradually exhaust kernel memory, causing system availability degradation. The flaw resides in dm_cache_metadata_abort, where a temporary block_manager object allocated before acquiring root_lock is not freed when the lock acquisition fails due to a read-only block manager - a condition reproducible by reloading a dm-cache table during metadata error states. No public exploit code and no CISA KEV listing have been identified; EPSS of 0.18% (8th percentile) confirms very low current exploitation probability.
NULL pointer dereference in the Linux kernel's DRM Cadence MHDP8546 DisplayPort bridge driver (cdns-mhdp8546-core) can be triggered by a local low-privileged user on systems with the affected hardware, causing a kernel panic and complete system availability loss. The flaw arises when error recovery paths in cdns_mhdp_modeset_retry_fn() attempt to access a mutex via a connector pointer that has not yet been initialized in the DRM_BRIDGE_ATTACH_NO_CONNECTOR code path. No public exploit code or active exploitation (CISA KEV) has been identified; patches are available across multiple stable kernel branches.
Instability and system crash vulnerability in the Linux kernel's Qualcomm DRM/MSM Display Processing Unit (DPU) driver allows a local low-privileged attacker to trigger a voltage-clock mismatch that causes the MMCX power rail to fall to MIN_SVS while the DPU core clock remains at its maximum frequency. This race condition between power management and clock control during runtime suspend/resume can leave the hardware in an unsustainable electrical state, leading to display subsystem failure or kernel panic. No public exploit identified at time of analysis; EPSS of 0.18% reflects the hardware-specific, local-only nature of this flaw.
Incorrect memory access in the Linux kernel's ASoC Qualcomm QDSP6 audio topology driver can trigger a kernel panic on affected Qualcomm Snapdragon hardware when virtual DAPM widgets are processed without a type guard. The flaw, introduced at commit 36ad9bf1d93d66b901342eab9f8ed6c1537655a6, affects kernel branches from 5.16 onward until the respective stable fixes. No active exploitation has been identified (not in CISA KEV) and the EPSS score of 0.17% (7th percentile) reflects negligible real-world exploitation probability; hardware dependency further constrains the affected population.
Operation sequencing flaw in the Linux kernel's tegra194 PCIe endpoint driver causes a Control Backbone (CBB) timeout when PERST# is deasserted twice in succession. During the second deassert cycle, the driver invokes pci_epc_deinit_notify() and dw_pcie_ep_cleanup() - which access DBI register PCIE_MISC_CONTROL_1_OFF at offset 0x8bc - before reset_control_deassert() powers on the PCIe controller core, triggering a hardware bus timeout and denying availability of the PCIe subsystem. With an EPSS of 0.18% (7th percentile), no CISA KEV listing, and hardware-specific scope limited to NVIDIA Tegra194 SoCs, this is a low-probability exploitation target with real-world impact confined to embedded and automotive Linux deployments.
NULL pointer dereference in the GFS2 filesystem's log release path crashes the Linux kernel during unmount on affected versions. The vulnerability arises because gfs2_log_release() dereferences sdp->sd_jdesc without checking for NULL, which can occur after the journal descriptor has already been freed during the unmount sequence. A prior fix (commit 35264909e9d1) addressed the same class of bug in gfs2_log_flush() but left gfs2_log_release() unprotected. No public exploit exists (EPSS 0.17%), exploitation is limited to local access on GFS2-mounted systems, and patches are available across all affected stable kernel branches.
Heap buffer overflow in the Linux kernel EFI capsule loader arises from an incorrect sizeof operand in a krealloc() call inside __efi_capsule_setup_info(), allocating half the required space on 32-bit PAE systems where phys_addr_t is 64-bit but pointers are 32-bit. When physical addresses are subsequently written via page_to_phys(), the undersized heap buffer is overflowed, corrupting kernel heap metadata and causing a system crash. Exploitation is architecturally constrained to 32-bit PAE kernels; 64-bit systems are unaffected because sizeof(phys_addr_t) equals sizeof(phys_addr_t*). No public exploit exists, EPSS is 0.19% (9th percentile), and no active exploitation has been recorded.
NULL pointer dereference in the Linux kernel's fwctl subsystem allows a local low-privilege user to crash the kernel when CXL memory expansion hardware is present and a device removal is triggered. The defect stems from a deterministic module initialization ordering race between the CXL and fwctl drivers, leaving knode_class uninitialized at device registration time and causing device_del() to dereference it fatally on removal. No public exploit identified at time of analysis; EPSS of 0.17% (6th percentile) reflects very low exploitation probability consistent with the local-only attack surface.
Kernel panic via reachable assertion in the OCFS2 cluster filesystem allows a local, low-privileged user to crash the system by issuing a crafted OCFS2_IOC_GROUP_ADD ioctl. The root cause is that ocfs2_group_add() invokes ocfs2_set_new_buffer_uptodate() on a user-supplied group block number before ocfs2_verify_group_and_input() has validated that number; if the block already exists in the metadata cache, the BUG_ON at uptodate.c:509 fires unconditionally, triggering a kernel oops. No public exploit has been identified and EPSS is 0.18% (7th percentile), but the fix is widely available across maintained stable branches.
Out-of-bounds read in the Linux kernel's IMA (Integrity Measurement Architecture) filesystem subsystem causes a kernel panic during boot on systems with TPM chips advertising hash algorithms unsupported by the kernel. Specifically, when `ima_tpm_chip->allocated_banks[i].crypto_id` is set to the sentinel `HASH_ALGO__LAST` for an unmapped TPM algorithm (demonstrated with TPM_ALG_SHA3_256 = 0x0027), the `create_securityfs_measurement_lists` function dereferences the out-of-range index into `hash_algo_name[]`, triggering a KASAN-detected global-out-of-bounds read and kernel crash. No public exploit has been identified and EPSS is 0.17% (6th percentile), making deliberate exploitation unlikely; the primary risk is inadvertent boot-time denial of service on hardware with qualifying TPM chips.
Deadlock in the Linux kernel's usbhid driver (`hid_post_reset()`) can halt systems connected to composite USB devices that combine HID and block storage or UAS components. When such a device undergoes a reset during block IO error handling, memory allocations using the default GFP_KERNEL flag can trigger block IO reclaim, which deadlocks against the mutex already held by the reset path - producing a kernel hang. No public exploit has been identified, and EPSS of 0.18% (7th percentile) confirms very low exploitation likelihood; the fix replaces GFP_KERNEL with GFP_NOIO across all affected reset callbacks, and patches are available across multiple Linux stable branches.
The Linux kernel's BPF sockmap subsystem deadlocks when a BPF iterator program iterating over AF_UNIX sockets via `bpf_iter_unix_seq_show()` simultaneously attempts to update a sockmap entry during the same execution context. When `lock_sock_fast()` takes the spinlock fast path and holds `slock-AF_UNIX`, any subsequent `sock_map_update_elem()` call within the BPF iterator program spins indefinitely attempting to re-acquire the same spinlock on the same CPU, causing an unrecoverable kernel deadlock and loss of system availability. This is not confirmed actively exploited (not in CISA KEV), no public exploit has been identified, and EPSS at 0.17% (7th percentile) confirms negligible current exploitation interest; the real-world risk is constrained to specialized BPF workloads with specific capability requirements.
Null pointer dereference in the Linux kernel's BPF sockmap subsystem allows a local low-privileged user to crash the system via a race condition between AF_UNIX socket connection and sockmap proto update. The flaw exists because unix_stream_connect() sets sk_state to TCP_ESTABLISHED before assigning the peer pointer, creating a window where unix_stream_bpf_update_proto() dereferences unix_peer(sk) while it is still NULL. No public exploit exists and EPSS sits at the 8th percentile; this is not in CISA KEV, and the narrow race window constrains practical exploitation.
NULL pointer dereference in the Linux kernel's BPF verifier crashes the kernel when a scalar register is stored into a kptr map slot during BPF program loading. Introduced by commit ab6c637ad027, which refactored map_kptr_match_type() to call btf_is_kernel(reg->btf) before the guard that excludes non-BTF register types - exposing scalar registers (reg->btf == NULL) to an immediate NULL dereference. A local user with BPF syscall access can trigger a kernel panic, producing a denial of service. No active exploitation is confirmed (not in CISA KEV), and EPSS is low at 0.17% (6th percentile), consistent with the local-only, DoS-limited impact.
Memory leak in the Linux kernel's Renesas i3c master driver causes local denial of service through kernel memory exhaustion. Specifically, the xfer structure allocated by renesas_i3c_alloc_xfer() inside renesas_i3c_i3c_xfers() is never released, allowing a local user with low privileges on affected Renesas SoC hardware to exhaust kernel memory by repeatedly triggering i3c transfers. No public exploit has been identified at time of analysis, and EPSS probability sits at 0.17% (6th percentile), reflecting low real-world exploitation interest.
Uninitialized variable read in the NTFS3 filesystem driver (`ntfs_iomap_begin()`) of the Linux kernel allows a local authenticated user to crash the system by triggering a zero-length run condition that causes the `lcn` (logical cluster number) variable to be consumed before assignment. The flaw affects Linux 7.0 up to 7.0.10 and Linux 7.1 prior to the stable fix commits, with the defect discovered and confirmed by Google syzbot via KMSAN. No public exploit has been identified and EPSS probability is very low (0.17%, 7th percentile); patches are available in Linux 7.0.10 and 7.1.
Error pointer dereference in the Linux kernel USB Type-C TI Power Delivery (tipd) driver allows a local low-privileged user to crash the kernel (denial of service) on systems with TI CD321x or TPS6598x USB Type-C controller hardware. The flaw in `cd321x_update_work()` at `drivers/usb/typec/tipd/core.c:827` logs a warning when `typec_register_partner()` fails but omits an early return, causing a subsequent unconditional dereference of the error pointer via `typec_partner_set_identity()`. No public exploit code has been identified at time of analysis, EPSS probability is 0.17% (6th percentile), and the vulnerability is not listed in CISA KEV.
Kernel availability impact in the Linux NTFS3 filesystem driver allows a local low-privileged user to trigger a WARN_ON(1) in attr_data_get_block_locked() by accessing NTFS volumes containing compressed or sparse attributes with frame-aligned cluster boundaries. The root cause is a missing run-segment load for vcn0 when it resides in a different attribute segment than vcn after cmask rounding, causing run_lookup_entry() to return SPARSE_LCN and fire the kernel warning. No public exploit has been identified and EPSS is 0.15% (5th percentile), confirming this as a low-probability exploitation target despite the confirmed vendor patch.
Missing NUL termination in the Linux kernel's ntfs3 filesystem driver allows a local attacker with filesystem mount privileges to trigger an out-of-bounds memory read, crashing the kernel. The defect in ntfs_fill_super() leaves sbi->volume.label unterminated when a UTF-16 volume label converts to a UTF-8 string that exactly fills the fixed buffer, causing ntfs3_label_show() to read past the buffer boundary via a %s format specifier. No public exploit has been identified at time of analysis and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation interest despite the High availability impact in CVSS.
Unbounded string concatenation in the Linux kernel's Dell WMI BIOS interface driver (dell-wmi-sysman) allows a local low-privileged attacker on Dell hardware to crash the kernel. The populate_enum_data() function bounds each individual firmware-provided string but applies no remaining-space check during cumulative strcat() calls into fixed 512-byte struct members, enabling a buffer overflow that results in complete system availability loss. With an EPSS of 0.17% (7th percentile), no public exploit code, and no CISA KEV listing, this is a low-likelihood but straightforward local denial-of-service on Dell platforms running unpatched kernel versions.
Integer overflow in the Linux kernel SCSI target core allows a local attacker with low privileges to crash the kernel via crafted UNMAP commands. The `sbc_execute_unmap()` function performs a capacity bounds check on LBA + range but fails to guard against 64-bit wraparound, meaning an attacker can supply values that overflow to bypass the check and trigger a kernel panic. No public exploit code or CISA KEV listing exists; EPSS is 0.18% (7th percentile), reflecting the niche attack surface limited to systems actively running SCSI target daemons. Patches are confirmed available across all supported stable kernel branches.
Kernel panic in the SpaceMIT clock controller driver (`clk-spacemit-ccu`) can be triggered during CPU frequency scaling on systems running SpaceMIT RISC-V hardware. The root cause is an inverted boolean condition in `ccu_mix_trigger_fc()` that causes the frequency change trigger to be skipped at the wrong time and fired at the wrong time, crashing the kernel under normal cpufreq governor activity. Exploitation requires only local low-privilege access, but is practically limited to the narrow hardware footprint of SpaceMIT K1-based boards; no public exploit or CISA KEV listing exists, and EPSS is 0.17% (6th percentile).
Kernel panic in the Linux f2fs garbage collector allows a local low-privileged user to crash the system by triggering a VM_BUG_ON_FOLIO assertion when GC attempts to re-read a page already marked uptodate after multiple block relocations. The affected subsystem is f2fs (Flash-Friendly File System); systems using ext4, XFS, or other filesystems are not impacted. EPSS is extremely low (0.17%, 6th percentile) and no active exploitation has been identified, making this a stability/DoS concern primarily relevant to mobile, embedded, and flash-storage Linux deployments.
Data loss in the Linux kernel's f2fs (Flash-Friendly File System) driver exposes files created and synced before any checkpoint has been written to permanent loss on sudden power off. The race condition between fsync on newly created files and concurrent checkpoint operations causes f2fs_need_inode_block_update() to misread prematurely set nat_entry flags (IS_CHECKPOINTED and HAS_LAST_FSYNC), leading fsync to skip the inode block flush it actually requires. No public exploit identified at time of analysis; the EPSS score of 0.16% at the 6th percentile reflects the narrow triggering conditions and local-only attack surface.
Integer truncation in the Linux kernel's EROFS filesystem driver on 32-bit platforms causes logical cluster number (LCN) calculations to overflow at the 4 GiB boundary, resulting in incorrect block addressing and potential kernel-level availability impact. Affected systems are those running 32-bit Linux kernels (where `unsigned long` is 32 bits wide) with EROFS filesystems mounted. No public exploit exists and no active exploitation has been confirmed; EPSS stands at a very low 0.17% (6th percentile), consistent with the niche attack surface of 32-bit deployments.
Kernel panic via skb headroom exhaustion in the Linux kernel's Traffic Control (TC) act_mirred subsystem affects systems using block-cast packet redirection across mixed device types. The root cause is a copy-paste error in tcf_blockcast_redir() where dev_is_mac_header_xmit() is queried against the next device in the iteration (dev) rather than the device currently being transmitted to (dev_prev), causing tcf_mirred_to_dev() to make wrong MAC header push/pull decisions for intermediate devices. In the worst case, skb_push_rcsum is called with an incorrect mac_len, exhausting socket buffer headroom and triggering a kernel panic. No public exploit code has been identified and EPSS is 0.17% at the 6th percentile, consistent with low real-world exploitation interest.
Denial-of-service in the Linux kernel macvlan driver allows local users with network interface management privileges to crash netlink interface dumps by exploiting a missing netlink buffer size reservation for the IFLA_MACVLAN_BC_CUTOFF attribute. When bc_cutoff is set to any value other than the default (1) on a macvlan bridge interface, any subsequent attempt to dump that interface via GETLINK triggers nla_put_s32() to return -EMSGSIZE, fires a WARN_ON in rtnetlink, and prevents the interface from being enumerated. No public exploit tool has been identified and no active exploitation is confirmed; EPSS is 0.17% (6th percentile).
NULL pointer dereference in the Linux kernel ICE (Intel Ethernet Controller) driver allows a local low-privileged attacker to trigger a kernel panic via a race condition during TX timestamp ring teardown. The flaw exists in systems using Intel ICE-series NICs with TX timestamping configured, where concurrent execution of ice_free_tx_tstamp_ring() and ice_tx_map() across CPU cores can cause CPU B to dereference a pointer that CPU A has already set to NULL. No public exploit or active exploitation has been identified; EPSS is 0.15% (5th percentile), consistent with its local, timing-dependent nature.
NULL pointer dereference in the Linux kernel ice driver's error path can cause a kernel panic on systems using Intel E800/E830 series Ethernet adapters. The flaw in ice_set_ringparam() leaves the ICE_TX_RING_FLAGS_TXTIME bit set after nullifying tstamp_ring, so a subsequent failure in ice_setup_tx_ring() triggers a dereference of a NULL tstamp_ring->desc pointer during error unwinding. No public exploit exists and EPSS sits at 0.15% (5th percentile), consistent with the discoverer's note that this was identified by manual code review rather than observed exploitation.
NULL pointer dereference in the Linux kernel's sch_dualpi2 queuing discipline (net/sched) allows a local attacker with low privileges to crash the kernel, causing a denial of service. The flaw exists in dualpi2_change(), which enforces updated queue limits after a qdisc reconfiguration: when traffic is exclusively queued in the L-queue and the C-queue is empty, the function unconditionally dereferences the NULL skb returned by the C-queue dequeue path, triggering a kernel panic. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), consistent with a locally-triggered, configuration-dependent kernel bug.
Resource exhaustion in the Linux kernel ksmbd SMB server allows a low-privileged authenticated SMB client to leak kernel file descriptor references by sending repeated SMB2 CREATE requests with a DURABLE_HANDLE_REQUEST_V2 context that produces a CreateGuid hit but a ClientGUID mismatch. Each such request increments the refcount on a ksmbd_file via ksmbd_fp_get() in ksmbd_lookup_fd_cguid() but the mismatch code path never calls the matching release, causing global_ft entries to be pinned indefinitely. Over time this defeats the durable file scavenger and causes long-lived kernel resource leaks that can degrade or deny availability. No public exploit has been identified at time of analysis and EPSS is 0.19% (9th percentile), indicating low opportunistic exploitation probability.
Stack memory disclosure in the Linux kernel RDS/IB subsystem exposes up to 26 bytes of uninitialized kernel stack contents - including kernel text and data pointers - to local unprivileged users via the getsockopt(SOL_RDS, RDS_INFO_IB_CONNECTIONS) interface. The leak enables KASLR bypass on systems where the kernel was built without CONFIG_INIT_STACK_ALL_ZERO=y, making this a useful primitive for chaining into privilege escalation. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS is very low at 0.18% (7th percentile), but the CVE description itself supplies a complete, step-by-step reproduction recipe that reduces practical exploitation complexity to near-trivial for any local user with AF_RDS socket access.
Improper RLIMIT_MEMLOCK accounting in the Linux kernel's vsock/virtio MSG_ZEROCOPY path allows a local low-privileged user to bypass per-process pinned-page limits, enabling unbounded kernel memory pinning that can drive the system toward memory exhaustion. The flaw is confined to the virtio vsock transport and is not remotely exploitable. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), reflecting low exploitation interest; however, a vendor-confirmed fix is available in stable releases.
Resource leak in the Linux kernel fsnotify subsystem causes hung tasks and local denial of service via a race condition in fsnotify_recalc_mask(). A local low-privilege user can trigger concurrent mark addition and removal on a filesystem connector object, causing an inode pointer returned by __fsnotify_recalc_mask() to be silently discarded rather than released via fsnotify_drop_object() - permanently blocking the umount path as fsnotify_sb_delete() waits indefinitely on the leaked reference. No public exploit exists and EPSS is at the 7th percentile, indicating negligible opportunistic exploitation risk.
Uninitialized memory use in the Linux kernel netdevsim subsystem allows a local low-privileged attacker to cause kernel crashes or potentially expose residual kernel heap contents via dummy packet trap operations. The root defect is in `nsim_dev_trap_skb_build`, where `skb_put` allocated space for a `struct iphdr` without zeroing it, leaving uninitialized kernel memory accessible in a dummy `sk_buff`. No public exploit code exists and the vulnerability is not in CISA KEV; EPSS stands at 0.18% (7th percentile), consistent with negligible opportunistic exploitation risk. Vendor-released patches are confirmed across all actively supported stable kernel branches.
Unbounded queue growth in the Linux kernel's netem (Network Emulator) traffic control subsystem allows a local low-privileged user to exhaust kernel memory and trigger a denial of service. The flaw exists because netem_enqueue() enforces queue depth limits using only q->t_len (packets in the internal tfifo), while packets placed into sch->q via the reorder path (__qdisc_enqueue_head) are silently excluded from that count, allowing total queue occupancy to grow beyond sch->limit without bound. No public exploit has been identified and the EPSS score of 0.18% (8th percentile) places this in the lowest exploitation-probability tier; however, the vulnerability affects a wide range of active stable kernel branches and patched versions are available.
Kernel crash via scheduler state corruption in the Linux kernel's CFS/EEVDF fair scheduler allows a local user to cause a NULL pointer dereference and system denial of service. When a task is forked while the parent's sched_entity has rel_deadline set, the child inherits stale deadline state that __sched_fork() fails to clear; a subsequent sched_yield() call on the child inflates vruntime by approximately 2x (observed: ~9.8e15 jumping to ~1.9e16), corrupting cfs_rq->sum_w_vruntime and ultimately causing pick_next_entity() to return NULL unexpectedly. No active exploitation has been identified (EPSS 0.17%, not in CISA KEV), and upstream stable patches are available across multiple kernel branches.
Race condition in the Linux kernel PSP network subsystem allows a local low-privileged attacker to crash the kernel through a TOCTOU flaw in device association creation. In `psp_assoc_device_get_locked()`, a device reference acquired under RCU becomes stale before the protecting lock is taken if `psp_dev_unregister()` completes concurrently, leaving the kernel operating on freed or invalid device state. No public exploit has been identified and EPSS stands at 0.17% (6th percentile), reflecting minimal active exploitation risk despite the well-characterized code-level race condition.
Missing CAP_NET_ADMIN enforcement in the Linux kernel PSP (PSP Security Protocol) netlink subsystem allows any local user with low privileges within the same network namespace to invoke the dev-set and key-rotate operations - modifying PSP version configuration and rotating cryptographic key material without authorization. The only access control in place, psp_dev_check_access(), validates only network namespace membership and does not enforce administrative capability. This enables unauthorized disruption of PSP-encrypted network communications and unauthorized modification of in-use cryptographic keying material. No public exploit code has been identified at time of analysis, and EPSS exploitation probability is very low at 0.17% (7th percentile).
Kernel availability impact in the Linux DRM PRIME buffer-sharing subsystem results from a pointer replacement logic error introduced by commit 5e28b7b94408, where the new IDR object pointer fails to overwrite the original handle's pointer at the correct location during the 'change handle' flow. Local users with low privileges holding access to a DRM device node can trigger a kernel WARNING assertion failure in drm_prime_destroy_file_private (drm_prime.c:224) upon file close, destabilizing the system. No public exploit exists and EPSS sits at 0.19% (8th percentile), indicating low real-world exploitation probability; the vendor patch is available in Linux stable trees at 7.0.10 and 6.18.33.
An infinite loop condition in the Linux kernel's DRM/TTM GPU memory management subsystem allows a local unprivileged user to cause a system-level denial of service. When `ttm_bo_swapout()` encounters a swapout failure, the error recovery path incorrectly repositions the buffer object at the tail of the LRU list - placing it ahead of the walk cursor's hitch node - so the subsequent `list_for_each_entry_continue()` repeatedly processes the same resource indefinitely, hanging the kernel's memory reclaim path. No public exploit has been identified and EPSS probability is 0.17% (6th percentile), but the stable kernel patch is confirmed available via two upstream commits.
Out-of-bounds descriptor read in the Linux kernel ALSA USB MIDI 2.0 subsystem allows a physically proximate or low-privileged local attacker to crash the kernel by presenting a malformed USB audio device with crafted MIDI 2.0 endpoint descriptors. The USB MIDI 2.0 endpoint parser validates bLength against bNumGrpTrmBlock but omits validation against remaining bytes in the endpoint-extra scan, allowing baAssoGrpTrmBlkID[] reads to advance past the descriptor buffer boundary. No public exploit is identified; EPSS stands at 0.18% (7th percentile), consistent with narrow, hardware-dependent attack surface and no active exploitation.
Out-of-bounds read in the Linux kernel's ALSA USB MIDI subsystem (`snd_usbmidi_get_ms_info()`) allows a local attacker to trigger a kernel panic and denial of service by presenting a crafted USB MIDI device with a malformed endpoint descriptor `bLength` field. The descriptor walker fails to verify that `bLength` stays within the remaining endpoint-extra scan bytes, leaving flexible-array reads of `baAssocJackID[]` potentially unbounded by the actual buffer limit. No public exploit is identified at time of analysis, and EPSS places exploitation probability at 0.18% (8th percentile), consistent with the local attack vector.
Infinite LRU list traversal in the Linux kernel's drm/ttm memory management subsystem allows a local low-privileged user to cause a kernel hang or denial of service on GPU-equipped systems. The flaw resides in ttm_bo_shrink(), where the bulk-move removal step was executed before confirming successful buffer object backup, leaving the LRU list in a corrupted state that loops indefinitely on backup failure. Notably, the 'Information Disclosure' tag in source intelligence conflicts with the CVSS C:N metric - the actual impact is availability only. No public exploit code has been identified, and EPSS exploitation probability is very low at 0.16% (6th percentile).
Integer overflow in the Linux kernel i2c character device driver allows a local low-privileged user to corrupt the SMBus controller state machine and cause a persistent Denial of Service. By supplying a crafted large timeout value (e.g., 429496729) to the I2C_TIMEOUT ioctl that passes the INT_MAX bounds check but overflows to a negative integer after multiplication by 10, an attacker forces wait_for_completion_timeout() to receive a sign-extended negative 64-bit value, triggering schedule_timeout kernel warnings and leaving the SMBus adapter in an unrecoverable state. No public exploit has been identified at time of analysis and EPSS is 0.18% (8th percentile), reflecting low mass-exploitation risk; however, the flaw is mechanically straightforward on any system granting unprivileged access to /dev/i2c-* nodes.
Cross-site request forgery in the Jenkins Pipeline: Groovy Plugin (versions up to and including 4331.v9d06ed4658ff) enables authenticated low-privilege users to instantiate arbitrary Java types related to job or system configuration by exploiting the unprotected Pipeline Snippet Generator endpoint. The attacker can reach types outside the normally permitted set of Pipeline steps, potentially influencing configuration objects that should be off-limits at their privilege level. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with non-automatable delivery.
Out-of-bounds read in ImageMagick's ConnectedComponentsImage() function allows local attackers to trigger access violations by supplying malformed connected-components artifact definitions via the CLI, leading to denial of service or potential arbitrary code execution. All ImageMagick releases before 7.1.2-19 are affected, as are Magick.NET NuGet packages before 14.12.0. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the RCE and information-disclosure tags warrant attention in environments that process untrusted image inputs through automated pipelines.
Memory exhaustion via unfreed heap allocations in ImageMagick before 7.1.2-15 enables remote denial of service against services that process untrusted images through the affected raw-pixel-data coders. The flaw (CWE-401) causes 160-byte objects to accumulate on the heap with each crafted image processed, progressively starving the host process of memory. No public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.3 reflects network reachability offset by high attack complexity and partial attack requirements, limiting realistic mass exploitation.
NULL pointer dereference in the Linux kernel SMC subsystem's smc_msg_event tracepoint crashes the kernel when SMC-D socket traffic is processed while the tracepoint is active. Affected kernels from commit aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 across multiple stable branches dereference conn->lnk unconditionally in the tracepoint, though this pointer is only valid for SMC-R connections and is NULL for SMC-D. While activating the tracepoint requires root, the crash itself can be triggered by any unprivileged user via AF_SMC socket operations on SMC-D capable systems (s390 natively, or x86 with loopback ISM loaded). No public exploit or active exploitation confirmed; EPSS sits at 0.16%.
Kernel stack memory disclosure in the Linux TUN driver exposes 14 bytes of uninitialized stack data to unprivileged local users on every read of a non-tunnel packet. The flaw affects Linux systems where a local user can open a TUN device and issue the TUNSETVNETHDRSZ ioctl to set the vnet header size to 24 bytes. No public exploit or active exploitation has been identified; EPSS is 0.15% (5th percentile), consistent with a local-only information disclosure requiring deliberate TUN device configuration.
NULL pointer dereference in the Linux kernel RDS/InfiniBand subsystem allows an unprivileged local user to trigger a kernel panic by sending an atomic cmsg over an active RDS/IB connection. The completion handler rds_ib_send_unmap_op() lacks switch cases for masked atomic opcodes (IB_WR_MASKED_ATOMIC_CMP_AND_SWP, IB_WR_MASKED_ATOMIC_FETCH_AND_ADD), returning rm=NULL while the send operation remains flagged, leading to a fatal NULL dereference at rm->m_final_op in softirq context. No public exploit has been identified and EPSS is 0.16% (6th percentile), but the crash is deterministic and reproducible on any system with mlx4/mlx5 InfiniBand hardware running an unpatched kernel with active RDS/IB connections.
NULL pointer dereference in the Linux kernel's BPF socket storage subsystem (net/core/bpf_sk_storage.c) allows a local low-privileged user to crash the kernel. The race condition between bpf_selem_unlink_nofail() - which nulls smap before removing the element from the hlist - and concurrent RCU readers in bpf_sk_storage_clone() and bpf_sk_storage_diag_put_all() can be triggered during TCP SYN handling (socket cloning path), producing a kernel panic. No public exploit identified at time of analysis; EPSS of 0.14% (4th percentile) confirms negligible observed exploitation probability.
Stack information disclosure in the Linux kernel's tap/macvtap driver exposes 8 bytes of uninitialized kernel stack contents to local users via the SIOCGIFHWADDR ioctl, leaking kernel .text and direct-map pointers that defeat KASLR. The affected code path in tap_ioctl() copies a 16-byte sockaddr_storage to userspace while netif_get_mac_address() initializes only 8 bytes (sa_family plus 6-byte Ethernet address), leaving the trailing 8 bytes unread. No public exploit is identified at time of analysis and EPSS sits at 0.15% (5th percentile), but KASLR bypass primitives of this type are routinely chained with local privilege-escalation exploits to gain kernel code-execution. NOTE: The provided CVSS vector (C:N/I:N/A:H) appears to misclassify this vulnerability - confidentiality is the impacted property, not availability; the assessed vector below corrects this.
CPU stall vulnerability in the Linux kernel jitterentropy subsystem allows local low-privileged users to trigger prolonged non-preemptible spinlock holds by spawning concurrent entropy requests through jent_kcapi_random(), which holds a spinlock across expensive SHA3 conditioning and jitter collection. Systems running kernel versions from approximately 4.2 through pre-fix stable branches face entropy starvation and CPU busy-wait degradation under parallel getrandom() load. No public exploit identified at time of analysis; EPSS is 0.16% at the 5th percentile and no CISA KEV listing applies, making this a low-urgency, operator-pace patch for most deployments.
Availability disruption in the Linux kernel's AF_UNIX socket subsystem allows a local low-privileged user to trigger an unhandled code path by issuing a SIOCATMARK ioctl on non-stream (SOCK_DGRAM or SOCK_SEQPACKET) AF_UNIX sockets, which the kernel incorrectly permits to proceed into receive-queue inspection logic intended only for SOCK_STREAM. The flaw stems from a logic inconsistency: while SOCK_DGRAM and SOCK_SEQPACKET already reject MSG_OOB in sendmsg()/recvmsg(), the SIOCATMARK ioctl handler lacked the corresponding guard, creating an exploitable divergence. No public exploit or CISA KEV listing exists; EPSS at 0.16% (5th percentile) reflects a very low real-world exploitation probability.
Stale gateway pointer in the Linux kernel's batman-adv mesh networking subsystem causes availability failures during mesh teardown and recreation. The batman-adv gateway cleanup function `batadv_gw_node_free()` frees gateway list entries without clearing `bat_priv->gw.curr_gw`, leaving a dangling reference that persists across cleanup and breaks subsequent mesh recreation attempts. No public exploit exists and EPSS sits at 0.16% (6th percentile), indicating negligible opportunistic exploitation interest at time of analysis.
NULL pointer dereference in the Linux kernel VRF (Virtual Routing and Forwarding) subsystem allows a local low-privileged user to crash the kernel via a race condition between RCU readers and VRF port removal operations, resulting in a complete denial of service on affected systems. Systems using VRF network segmentation are at risk specifically when VRF port membership is dynamically modified concurrent with socket bind() operations. EPSS is 0.16% (6th percentile) and the vulnerability is not listed in CISA KEV; no public exploit code has been identified, but patched kernel versions are available across all active stable branches.
Denial of service in the Linux kernel netfilter ipset subsystem allows a local low-privileged user to disrupt availability by triggering an iterator overrun in hash:ip,mark, hash:ip,port, hash:ip,port,ip, or hash:ip,port,net set types during IPv4 range iteration. The 32-bit loop iterator is not properly bounded, allowing it to advance past the last address in the requested range; subsequent retry passes then resume from an unintended position, corrupting traversal state. No public exploit is identified at time of analysis, and the EPSS score of 0.16% (6th percentile) confirms very low exploitation probability, making this a routine patching priority rather than an emergency response.
Stack exhaustion in the Linux kernel batman-adv mesh networking subsystem allows an attacker on the same batman-adv mesh to crash the kernel by sending matryoshka-nested BATADV_UNICAST_FRAG packets. The reassembled payload's packet type is not validated before re-processing, enabling unbounded recursion in batadv_batman_skb_recv() that exhausts kernel stack and causes a hard system crash. No active exploitation is recorded in CISA KEV and EPSS sits at 0.18% (7th percentile), making this a targeted DoS risk limited to environments running batman-adv mesh networking.
NULL pointer dereference in the Linux kernel's batman-adv OGMv2 subsystem allows a local low-privilege user to crash the kernel by racing interface teardown against OGM dispatch. When a batman-adv hard interface is disabled and its mesh_iface pointer is set to NULL, the batadv_v_ogm_queue_on_if() function continues to call netdev_priv() on that NULL pointer, triggering a kernel panic. No public exploit exists and EPSS is 0.18% (7th percentile), making this low operational priority except on systems actively running batman-adv mesh networking.
@JsonView access-control bypass in jackson-databind 2.21.0-2.21.3 and 3.0.0-3.1.3 allows remote attackers to write values into setterless Collection/Map properties that are restricted by a @JsonView annotation, defeating view-based mass-assignment protection during deserialization. The regression was introduced when SetterlessProperty.isMerging() was changed to return true, routing these properties through an unguarded buffering branch in BeanDeserializer._deserializeUsingPropertyBased that lacked the prop.visibleInView(activeView) check applied to creator properties. No public exploit code has been identified and this is not listed in CISA KEV; however, applications relying on @JsonView for security-critical field-level access control - such as role or permission gating - are directly and completely bypassed.
Integrity bypass in jackson-databind 2.21.0-2.21.3 and 3.0.0-3.1.3 allows unauthenticated network attackers to write to private backing fields that application developers intended as read-only. The flaw occurs when a POJO uses @JsonProperty on a getter with @JsonIgnore on the setter - a common read-only-over-the-wire pattern - and MapperFeature.INFER_PROPERTY_MUTATORS is enabled (the default). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The GHSA advisory characterizes the impact as property tampering and mass assignment; maintainers rate it minor despite a reporter-assessed HIGH severity.
Per-property @JsonIgnoreProperties filtering in jackson-databind is silently bypassed when the same property also carries @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES), enabling unauthenticated network attackers (per CVSS AV:N/PR:N) to write to fields the application explicitly excluded from deserialization. The flaw spans versions from 2.8.0 through the 2.18.x, 2.19-2.21.x, and 3.1.x release lines and constitutes a mass-assignment integrity risk wherever ignored fields guard sensitive state such as privilege or role attributes. No public exploit tool or CISA KEV listing has been identified at time of analysis; vendor-released patches (2.18.9, 2.21.5, 3.1.4) were published 2026-06-04.
Eager DNS resolution during InetSocketAddress deserialization in jackson-databind (versions 2.0.0 through pre-fix releases across the 2.18, 2.21, and 3.x lines) allows any attacker who can supply untrusted JSON to an affected endpoint to force outbound DNS lookups for attacker-chosen hostnames at readValue() time - before application validation or connect logic can intervene. This DNS-based SSRF (CWE-918) enables internal resolver probing, network topology enumeration, and DNS out-of-band interaction signals against applications that deserialize untrusted JSON into types containing InetSocketAddress fields. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS data was not available in the provided intelligence sources.
Jackson-databind's `@JsonView` authorization boundary is bypassed for constructor parameters that combine `@JsonUnwrapped` and `@JsonView` annotations, affecting versions 2.21.0-2.21.3 and 3.0.0-3.1.3. The deserialization code path in `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` replays buffered JSON into creator parameters without calling `prop.visibleInView(activeView)`, while the standard property path correctly enforces this check. Applications that rely on `@JsonView` as a write-side access control boundary are exposed: an attacker supplying crafted JSON can populate admin-restricted constructor fields even when the application activates a less-privileged view. No public exploit identified at time of analysis; upstream patches are confirmed in 2.21.4 and 3.1.4.
Uncontrolled resource consumption in jackson-databind 2.10.0 through 2.13.5 allows unauthenticated remote attackers to cause a Denial-of-Service by submitting small (~2kB), deeply nested JSON payloads that trigger a StackOverflowError when a service reads the input via ObjectMapper.readTree() and serializes the resulting JsonNode using JsonNode.toString(). The root cause is recursive serialization in the toString() call path, which was replaced with an iterative IteratorStack-based implementation in version 2.14.0. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Heap use-after-free in ImageMagick's meta coder allows remote attackers to crash the process by submitting a specially crafted image file that triggers a memory allocation failure, causing a single byte write to a stale (freed) pointer. Affected versions are ImageMagick before 7.1.2-15 and 6.9.13-40, as well as Magick.NET NuGet wrapper packages before 14.10.3. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 6.3 with AC:H and AT:P reflects that reliable exploitation requires specific memory allocation failure conditions rather than straightforward request-and-crash triggering.
Memory exhaustion in ImageMagick's TXT file coder (coders/txt.c) leaks heap allocations each time a crafted TXT file carrying a texture attribute is processed and GetTypeMetrics subsequently fails. Affected are ImageMagick before 7.1.2-15 and 6.9.13-40, and transitively Magick.NET NuGet packages before 14.10.3. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the deterministic failure path makes repeated triggering straightforward in any service that accepts and processes user-supplied TXT files through ImageMagick.
Denial of service in OpenLink Virtuoso OpenSource v7.2.11 allows remote attackers to crash the database server by submitting crafted SQL statements that trigger a fault in the sqlo_try_in_loop SQL optimizer component. No public exploit identified at time of analysis, though SSVC indicates a proof-of-concept exists in the referenced GitHub issue. The flaw is tagged as SQLi-class (CWE-89) but the demonstrated impact is availability-only, with no confidentiality or integrity loss per the CVSS vector.
Denial of service in OpenLink Virtuoso OpenSource v7.2.11 allows remote attackers to crash the database server by submitting specially crafted SQL statements that trigger a flaw in the sqlo_untry query-optimization component. The CVSS 7.5 score reflects unauthenticated network exploitability with high availability impact, but no public exploit identified at time of analysis and the issue is currently tracked only as an upstream GitHub issue without a released fix.
Denial of service in OpenLink Virtuoso Open Source Edition v7.2.11 allows remote attackers to crash the database engine by submitting crafted SQL statements that mishandle column predicate processing inside the sqlo_tb_col_preds query optimizer component. CVSS 7.5 reflects high availability impact with no authentication required, though no public exploit identified at time of analysis and the issue is tracked only as an upstream GitHub bug report.
Denial of service in OpenLink Virtuoso OpenSource v7.2.11 allows remote attackers to crash the database server by submitting crafted SQL statements that trigger a fault in the sslr_qst_get component. The flaw is classified under CWE-89 (SQL injection class) but the documented impact is availability-only with no confidentiality or integrity loss per the CVSS vector. No public exploit identified at time of analysis, and the issue is tracked only via an upstream GitHub issue (#1229) rather than a tagged fixed release.
Denial of service in OpenLink Virtuoso Open Source Edition 7.2.11 lets attackers crash the database server by submitting crafted SQL statements that trigger a fault in the sqlo_natural_join_cond query-optimizer component. The flaw carries no confidentiality or integrity impact but fully degrades availability (CVSS 7.5, A:H). There is no public exploit identified at time of analysis and EPSS is low (0.15%), indicating limited near-term exploitation likelihood; only a GitHub issue documenting the defect is published.
Denial of service in OpenLink Virtuoso Open Source Edition 7.2.11 lets attackers crash the database engine by submitting crafted SQL statements that mishandle the internal t_set_push routine. The flaw carries availability-only impact (CVSS 7.5, A:H) with no confidentiality or integrity loss. EPSS is low (0.15%, 4th percentile), there is no public exploit identified at time of analysis, and it is not listed in CISA KEV - so risk is theoretical rather than actively exploited.
Denial of service in OpenLink Virtuoso Open-Source Edition 7.2.11 lets attackers crash the database server by submitting crafted SQL statements that mishandle the sqlo_key_part_best query-optimizer routine. The flaw carries no confidentiality or integrity impact (availability-only, CVSS 7.5) and there is no public exploit identified at time of analysis; EPSS is low at 0.15% (4th percentile), and it is not listed in CISA KEV. The only public reference is the upstream GitHub issue (#1222) tracking the crash.
DNS rebinding against the Glances XML-RPC server (`glances -s`) allows a network-adjacent or remote attacker to exfiltrate the full system monitoring dataset - including process command lines that routinely contain secrets - from a victim's browser without any authentication. The `GlancesXMLRPCHandler` in `glances/server.py` accepts arbitrary HTTP `Host` headers without validation, an omission that persists while the REST/WebUI server received an equivalent fix (TrustedHostMiddleware, v4.5.2) and the MCP server was protected since v4.5.1. No active exploitation is confirmed (not in CISA KEV), but a detailed proof-of-concept is published in the vendor's GitHub security advisory GHSA-w856-8p3r-p338 and the attack is materially amplified by the companion CORS wildcard issue CVE-2026-46608.
Infinite loop denial-of-service in pypdf prior to 6.13.1 allows an attacker to hang any process that merges a crafted PDF containing cyclic article/thread structures. The vulnerability exists in the `_add_articles_thread()` method of `_writer.py`, which traversed PDF article bead linked-list structures without cycle detection, permitting a self-referential `/N` (Next) pointer chain to create an irrecoverable loop. No public exploit code or CISA KEV listing exists at time of analysis, but the upstream PR diff publicly discloses the precise triggering structure, lowering the bar for exploitation against vulnerable merge pipelines.
Path traversal in Keras 3.14.0 exposes local file systems to arbitrary file and directory creation when processing maliciously crafted model files. The DiskIOStore.make method constructs directory paths from user-supplied layer names without sanitizing directory traversal sequences (..); since only forward slashes are blocked, embedding .. components in a layer name allows escape from the intended temporary working directory during model save or load operations. No active exploitation (CISA KEV) and no public proof-of-concept has been identified at time of analysis; however, EPSS data was not provided, leaving probabilistic exploitation likelihood unquantified.
Use-after-free in libexpat before 2.8.2 arises from the `doCdataSection` function omitting `beforeHandler`/`afterHandler` depth-tracking calls for `XML_TOK_DATA_CHARS` tokens during CDATA section parsing - an incomplete fix for the related CVE-2026-50219. When a policy violation occurs during handler callback invocation in this code path, the parser's internal call-depth counter becomes inconsistent, enabling a use-after-free condition. An attacker supplying specially crafted XML to any libexpat-consuming application may trigger limited memory corruption, information disclosure, or availability impact under high-complexity conditions; no public exploit is identified at time of analysis and no CISA KEV listing exists.
Integer overflow in the xmlwf utility bundled with libexpat before 2.8.2 enables heap corruption via XML documents containing an excessive number of NOTATION declarations in a DOCTYPE block. The flaw in endDoctypeDecl allows a crafted XML file to wrap a signed integer counter, producing an undersized heap allocation that can be overflowed with high confidentiality and integrity impact. No confirmed active exploitation (not in CISA KEV) and no public exploit code have been identified at time of analysis; vendor-released patch is available in libexpat 2.8.2.
Integer overflow in libexpat's xmlwf tool allows an attacker supplying a crafted XML file with an excessively long DOCTYPE system identifier to trigger a heap buffer overflow via the resolveSystemId function. All libexpat versions before 2.8.2 are affected; the root cause is an unchecked size_t arithmetic operation - both the addition of string lengths and the subsequent multiplication by sizeof(XML_Char) - before a malloc call. No public exploit has been identified at time of analysis, and exploitation requires local access under high-complexity conditions per the CVSS:3.1/AV:L/AC:H vector.
Integer overflow in libexpat before 2.8.2 allows heap corruption during XML prolog parsing when accumulated entity value pool length exceeds INT_MAX, yielding high confidentiality and integrity impact per CVSS. The flaw resides in doProlog and the related storeSelfEntityValue path, where poolLength() return values are cast to signed integers without bounds validation - a gap closed in the upstream fix via explicit INT_MAX guards. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, but the widespread use of libexpat as a dependency across system tools, language runtimes, and XML-processing services means the blast radius of a weaponized exploit would be broad.
Integer overflow in libexpat's XML_ParseBuffer function allows potential heap corruption leading to high-confidentiality and high-integrity impact in all libexpat versions before 2.8.2. The overflow occurs because XML_ParseBuffer lacked a bounds check on the byte index accumulator that was already present in the sibling XML_Parse function - a defensive guard omitted asymmetrically between two code paths. Any application that routes XML input through XML_ParseBuffer (a common pattern in incremental parsing) is exposed. No public exploit has been identified at time of analysis and no KEV listing exists, but the high C and I CVSS impact ratings reflect the potential for code execution via heap corruption.
Integer overflow in libexpat's getAttributeId routine exposes any application embedding libexpat before version 2.8.2 to memory corruption with high confidentiality and integrity impact when parsing specially crafted XML documents. The flaw occurs when an internal counter traversing the attribute ID table reaches INT_MAX and wraps, producing an invalid index that can corrupt adjacent heap memory. No public exploit has been identified at time of analysis, and CISA has not listed this in the KEV catalog, but a vendor-released patch is available in libexpat 2.8.2 and upgrade is the recommended remediation.
Integer overflow in libexpat's addBinding function (xmlparse.c) before version 2.8.2 allows memory corruption during XML namespace binding processing, with high confidentiality and integrity impact. All libexpat releases from 0 through 2.8.2-pre are affected (CPE: cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*), encompassing a significant downstream attack surface given the library's widespread use in Python, PHP, and system utilities. No public exploit or active exploitation has been confirmed at time of analysis; the official CVSS 3.1 score of 6.9 reflects meaningful impact tempered by high attack complexity and a local attack vector.
Kernel panic via unchecked error pointer dereference in the Linux kernel's drm/sun4i display backend driver affects Allwinner SoC-based systems running kernel versions from 4.17 up to the patched releases. In sun4i_backend_atomic_check() at drivers/gpu/drm/sun4i/sun4i_backend.c:496, the return value of drm_atomic_get_plane_state() is not validated against IS_ERR() before dereference, allowing a local low-privilege user to crash the kernel. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.16% (6th percentile) reflects negligible real-world exploitation interest.
Resource leak in the Linux kernel ASoC STI audio driver allows a local authenticated user to exhaust kernel memory by repeatedly loading and unloading the driver, degrading system availability. The vulnerability stems from regmap_field objects allocated during STI audio player initialization never being released on driver removal. With EPSS at 0.17% (7th percentile), no KEV listing, and no public exploit, this is a low-priority maintenance fix rather than an actively weaponizable flaw. Vendor-released patches are available across multiple stable kernel branches.
NULL pointer dereference in the Linux kernel dm-cache subsystem crashes the kernel when concurrent writes target the same cached block in passthrough mode. The flaw affects any kernel with a dm-cache device explicitly configured in passthrough mode since version 4.12, allowing a local low-privileged user with write access to the block device to cause a kernel panic and complete denial of service. No public exploit code exists and EPSS at 0.18% (7th percentile) confirms very low exploitation probability; fixed across multiple stable kernel series with patches confirmed by Ubuntu security advisories.
Write operation hang in the Linux kernel dm-cache subsystem's passthrough mode allows a local user with low privileges to stall I/O indefinitely on affected block devices. The defect lies in `invalidate_remove()`, which configures a remapped bio for submission to the cache origin but discards it without dispatching, leaving write operations permanently pending. No public exploit has been identified at time of analysis; EPSS at 0.18% (8th percentile) and a strictly local attack vector place this firmly in the operational-bug category rather than an active threat.
Data loss in the Linux kernel dm-cache subsystem occurs when LVM's table preload feature is used to switch a writeback cache to passthrough mode while dirty mappings exist. The dirty mapping check was designed assuming table reloads happen only after device suspension (which flushes dirty blocks), but LVM's preload path bypasses this assumption, allowing dirty cache blocks to be silently loaded into passthrough mode where they will never be written back to the origin device. No public exploit code exists; reproduction requires a deliberate sequence of dmsetup and fio operations documented in the CVE description itself. EPSS is 0.18% (7th percentile), consistent with a local, configuration-specific data-loss condition rather than a remotely exploitable flaw.
Memory leak in the Linux kernel dm-cache metadata subsystem can be triggered by local users with low privileges to gradually exhaust kernel memory, causing system availability degradation. The flaw resides in dm_cache_metadata_abort, where a temporary block_manager object allocated before acquiring root_lock is not freed when the lock acquisition fails due to a read-only block manager - a condition reproducible by reloading a dm-cache table during metadata error states. No public exploit code and no CISA KEV listing have been identified; EPSS of 0.18% (8th percentile) confirms very low current exploitation probability.
NULL pointer dereference in the Linux kernel's DRM Cadence MHDP8546 DisplayPort bridge driver (cdns-mhdp8546-core) can be triggered by a local low-privileged user on systems with the affected hardware, causing a kernel panic and complete system availability loss. The flaw arises when error recovery paths in cdns_mhdp_modeset_retry_fn() attempt to access a mutex via a connector pointer that has not yet been initialized in the DRM_BRIDGE_ATTACH_NO_CONNECTOR code path. No public exploit code or active exploitation (CISA KEV) has been identified; patches are available across multiple stable kernel branches.
Instability and system crash vulnerability in the Linux kernel's Qualcomm DRM/MSM Display Processing Unit (DPU) driver allows a local low-privileged attacker to trigger a voltage-clock mismatch that causes the MMCX power rail to fall to MIN_SVS while the DPU core clock remains at its maximum frequency. This race condition between power management and clock control during runtime suspend/resume can leave the hardware in an unsustainable electrical state, leading to display subsystem failure or kernel panic. No public exploit identified at time of analysis; EPSS of 0.18% reflects the hardware-specific, local-only nature of this flaw.
Incorrect memory access in the Linux kernel's ASoC Qualcomm QDSP6 audio topology driver can trigger a kernel panic on affected Qualcomm Snapdragon hardware when virtual DAPM widgets are processed without a type guard. The flaw, introduced at commit 36ad9bf1d93d66b901342eab9f8ed6c1537655a6, affects kernel branches from 5.16 onward until the respective stable fixes. No active exploitation has been identified (not in CISA KEV) and the EPSS score of 0.17% (7th percentile) reflects negligible real-world exploitation probability; hardware dependency further constrains the affected population.
Operation sequencing flaw in the Linux kernel's tegra194 PCIe endpoint driver causes a Control Backbone (CBB) timeout when PERST# is deasserted twice in succession. During the second deassert cycle, the driver invokes pci_epc_deinit_notify() and dw_pcie_ep_cleanup() - which access DBI register PCIE_MISC_CONTROL_1_OFF at offset 0x8bc - before reset_control_deassert() powers on the PCIe controller core, triggering a hardware bus timeout and denying availability of the PCIe subsystem. With an EPSS of 0.18% (7th percentile), no CISA KEV listing, and hardware-specific scope limited to NVIDIA Tegra194 SoCs, this is a low-probability exploitation target with real-world impact confined to embedded and automotive Linux deployments.
NULL pointer dereference in the GFS2 filesystem's log release path crashes the Linux kernel during unmount on affected versions. The vulnerability arises because gfs2_log_release() dereferences sdp->sd_jdesc without checking for NULL, which can occur after the journal descriptor has already been freed during the unmount sequence. A prior fix (commit 35264909e9d1) addressed the same class of bug in gfs2_log_flush() but left gfs2_log_release() unprotected. No public exploit exists (EPSS 0.17%), exploitation is limited to local access on GFS2-mounted systems, and patches are available across all affected stable kernel branches.
Heap buffer overflow in the Linux kernel EFI capsule loader arises from an incorrect sizeof operand in a krealloc() call inside __efi_capsule_setup_info(), allocating half the required space on 32-bit PAE systems where phys_addr_t is 64-bit but pointers are 32-bit. When physical addresses are subsequently written via page_to_phys(), the undersized heap buffer is overflowed, corrupting kernel heap metadata and causing a system crash. Exploitation is architecturally constrained to 32-bit PAE kernels; 64-bit systems are unaffected because sizeof(phys_addr_t) equals sizeof(phys_addr_t*). No public exploit exists, EPSS is 0.19% (9th percentile), and no active exploitation has been recorded.
NULL pointer dereference in the Linux kernel's fwctl subsystem allows a local low-privilege user to crash the kernel when CXL memory expansion hardware is present and a device removal is triggered. The defect stems from a deterministic module initialization ordering race between the CXL and fwctl drivers, leaving knode_class uninitialized at device registration time and causing device_del() to dereference it fatally on removal. No public exploit identified at time of analysis; EPSS of 0.17% (6th percentile) reflects very low exploitation probability consistent with the local-only attack surface.
Kernel panic via reachable assertion in the OCFS2 cluster filesystem allows a local, low-privileged user to crash the system by issuing a crafted OCFS2_IOC_GROUP_ADD ioctl. The root cause is that ocfs2_group_add() invokes ocfs2_set_new_buffer_uptodate() on a user-supplied group block number before ocfs2_verify_group_and_input() has validated that number; if the block already exists in the metadata cache, the BUG_ON at uptodate.c:509 fires unconditionally, triggering a kernel oops. No public exploit has been identified and EPSS is 0.18% (7th percentile), but the fix is widely available across maintained stable branches.
Out-of-bounds read in the Linux kernel's IMA (Integrity Measurement Architecture) filesystem subsystem causes a kernel panic during boot on systems with TPM chips advertising hash algorithms unsupported by the kernel. Specifically, when `ima_tpm_chip->allocated_banks[i].crypto_id` is set to the sentinel `HASH_ALGO__LAST` for an unmapped TPM algorithm (demonstrated with TPM_ALG_SHA3_256 = 0x0027), the `create_securityfs_measurement_lists` function dereferences the out-of-range index into `hash_algo_name[]`, triggering a KASAN-detected global-out-of-bounds read and kernel crash. No public exploit has been identified and EPSS is 0.17% (6th percentile), making deliberate exploitation unlikely; the primary risk is inadvertent boot-time denial of service on hardware with qualifying TPM chips.
Deadlock in the Linux kernel's usbhid driver (`hid_post_reset()`) can halt systems connected to composite USB devices that combine HID and block storage or UAS components. When such a device undergoes a reset during block IO error handling, memory allocations using the default GFP_KERNEL flag can trigger block IO reclaim, which deadlocks against the mutex already held by the reset path - producing a kernel hang. No public exploit has been identified, and EPSS of 0.18% (7th percentile) confirms very low exploitation likelihood; the fix replaces GFP_KERNEL with GFP_NOIO across all affected reset callbacks, and patches are available across multiple Linux stable branches.
The Linux kernel's BPF sockmap subsystem deadlocks when a BPF iterator program iterating over AF_UNIX sockets via `bpf_iter_unix_seq_show()` simultaneously attempts to update a sockmap entry during the same execution context. When `lock_sock_fast()` takes the spinlock fast path and holds `slock-AF_UNIX`, any subsequent `sock_map_update_elem()` call within the BPF iterator program spins indefinitely attempting to re-acquire the same spinlock on the same CPU, causing an unrecoverable kernel deadlock and loss of system availability. This is not confirmed actively exploited (not in CISA KEV), no public exploit has been identified, and EPSS at 0.17% (7th percentile) confirms negligible current exploitation interest; the real-world risk is constrained to specialized BPF workloads with specific capability requirements.
Null pointer dereference in the Linux kernel's BPF sockmap subsystem allows a local low-privileged user to crash the system via a race condition between AF_UNIX socket connection and sockmap proto update. The flaw exists because unix_stream_connect() sets sk_state to TCP_ESTABLISHED before assigning the peer pointer, creating a window where unix_stream_bpf_update_proto() dereferences unix_peer(sk) while it is still NULL. No public exploit exists and EPSS sits at the 8th percentile; this is not in CISA KEV, and the narrow race window constrains practical exploitation.
NULL pointer dereference in the Linux kernel's BPF verifier crashes the kernel when a scalar register is stored into a kptr map slot during BPF program loading. Introduced by commit ab6c637ad027, which refactored map_kptr_match_type() to call btf_is_kernel(reg->btf) before the guard that excludes non-BTF register types - exposing scalar registers (reg->btf == NULL) to an immediate NULL dereference. A local user with BPF syscall access can trigger a kernel panic, producing a denial of service. No active exploitation is confirmed (not in CISA KEV), and EPSS is low at 0.17% (6th percentile), consistent with the local-only, DoS-limited impact.
Memory leak in the Linux kernel's Renesas i3c master driver causes local denial of service through kernel memory exhaustion. Specifically, the xfer structure allocated by renesas_i3c_alloc_xfer() inside renesas_i3c_i3c_xfers() is never released, allowing a local user with low privileges on affected Renesas SoC hardware to exhaust kernel memory by repeatedly triggering i3c transfers. No public exploit has been identified at time of analysis, and EPSS probability sits at 0.17% (6th percentile), reflecting low real-world exploitation interest.
Uninitialized variable read in the NTFS3 filesystem driver (`ntfs_iomap_begin()`) of the Linux kernel allows a local authenticated user to crash the system by triggering a zero-length run condition that causes the `lcn` (logical cluster number) variable to be consumed before assignment. The flaw affects Linux 7.0 up to 7.0.10 and Linux 7.1 prior to the stable fix commits, with the defect discovered and confirmed by Google syzbot via KMSAN. No public exploit has been identified and EPSS probability is very low (0.17%, 7th percentile); patches are available in Linux 7.0.10 and 7.1.
Error pointer dereference in the Linux kernel USB Type-C TI Power Delivery (tipd) driver allows a local low-privileged user to crash the kernel (denial of service) on systems with TI CD321x or TPS6598x USB Type-C controller hardware. The flaw in `cd321x_update_work()` at `drivers/usb/typec/tipd/core.c:827` logs a warning when `typec_register_partner()` fails but omits an early return, causing a subsequent unconditional dereference of the error pointer via `typec_partner_set_identity()`. No public exploit code has been identified at time of analysis, EPSS probability is 0.17% (6th percentile), and the vulnerability is not listed in CISA KEV.
Kernel availability impact in the Linux NTFS3 filesystem driver allows a local low-privileged user to trigger a WARN_ON(1) in attr_data_get_block_locked() by accessing NTFS volumes containing compressed or sparse attributes with frame-aligned cluster boundaries. The root cause is a missing run-segment load for vcn0 when it resides in a different attribute segment than vcn after cmask rounding, causing run_lookup_entry() to return SPARSE_LCN and fire the kernel warning. No public exploit has been identified and EPSS is 0.15% (5th percentile), confirming this as a low-probability exploitation target despite the confirmed vendor patch.
Missing NUL termination in the Linux kernel's ntfs3 filesystem driver allows a local attacker with filesystem mount privileges to trigger an out-of-bounds memory read, crashing the kernel. The defect in ntfs_fill_super() leaves sbi->volume.label unterminated when a UTF-16 volume label converts to a UTF-8 string that exactly fills the fixed buffer, causing ntfs3_label_show() to read past the buffer boundary via a %s format specifier. No public exploit has been identified at time of analysis and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation interest despite the High availability impact in CVSS.
Unbounded string concatenation in the Linux kernel's Dell WMI BIOS interface driver (dell-wmi-sysman) allows a local low-privileged attacker on Dell hardware to crash the kernel. The populate_enum_data() function bounds each individual firmware-provided string but applies no remaining-space check during cumulative strcat() calls into fixed 512-byte struct members, enabling a buffer overflow that results in complete system availability loss. With an EPSS of 0.17% (7th percentile), no public exploit code, and no CISA KEV listing, this is a low-likelihood but straightforward local denial-of-service on Dell platforms running unpatched kernel versions.
Integer overflow in the Linux kernel SCSI target core allows a local attacker with low privileges to crash the kernel via crafted UNMAP commands. The `sbc_execute_unmap()` function performs a capacity bounds check on LBA + range but fails to guard against 64-bit wraparound, meaning an attacker can supply values that overflow to bypass the check and trigger a kernel panic. No public exploit code or CISA KEV listing exists; EPSS is 0.18% (7th percentile), reflecting the niche attack surface limited to systems actively running SCSI target daemons. Patches are confirmed available across all supported stable kernel branches.
Kernel panic in the SpaceMIT clock controller driver (`clk-spacemit-ccu`) can be triggered during CPU frequency scaling on systems running SpaceMIT RISC-V hardware. The root cause is an inverted boolean condition in `ccu_mix_trigger_fc()` that causes the frequency change trigger to be skipped at the wrong time and fired at the wrong time, crashing the kernel under normal cpufreq governor activity. Exploitation requires only local low-privilege access, but is practically limited to the narrow hardware footprint of SpaceMIT K1-based boards; no public exploit or CISA KEV listing exists, and EPSS is 0.17% (6th percentile).
Kernel panic in the Linux f2fs garbage collector allows a local low-privileged user to crash the system by triggering a VM_BUG_ON_FOLIO assertion when GC attempts to re-read a page already marked uptodate after multiple block relocations. The affected subsystem is f2fs (Flash-Friendly File System); systems using ext4, XFS, or other filesystems are not impacted. EPSS is extremely low (0.17%, 6th percentile) and no active exploitation has been identified, making this a stability/DoS concern primarily relevant to mobile, embedded, and flash-storage Linux deployments.
Data loss in the Linux kernel's f2fs (Flash-Friendly File System) driver exposes files created and synced before any checkpoint has been written to permanent loss on sudden power off. The race condition between fsync on newly created files and concurrent checkpoint operations causes f2fs_need_inode_block_update() to misread prematurely set nat_entry flags (IS_CHECKPOINTED and HAS_LAST_FSYNC), leading fsync to skip the inode block flush it actually requires. No public exploit identified at time of analysis; the EPSS score of 0.16% at the 6th percentile reflects the narrow triggering conditions and local-only attack surface.
Integer truncation in the Linux kernel's EROFS filesystem driver on 32-bit platforms causes logical cluster number (LCN) calculations to overflow at the 4 GiB boundary, resulting in incorrect block addressing and potential kernel-level availability impact. Affected systems are those running 32-bit Linux kernels (where `unsigned long` is 32 bits wide) with EROFS filesystems mounted. No public exploit exists and no active exploitation has been confirmed; EPSS stands at a very low 0.17% (6th percentile), consistent with the niche attack surface of 32-bit deployments.
Kernel panic via skb headroom exhaustion in the Linux kernel's Traffic Control (TC) act_mirred subsystem affects systems using block-cast packet redirection across mixed device types. The root cause is a copy-paste error in tcf_blockcast_redir() where dev_is_mac_header_xmit() is queried against the next device in the iteration (dev) rather than the device currently being transmitted to (dev_prev), causing tcf_mirred_to_dev() to make wrong MAC header push/pull decisions for intermediate devices. In the worst case, skb_push_rcsum is called with an incorrect mac_len, exhausting socket buffer headroom and triggering a kernel panic. No public exploit code has been identified and EPSS is 0.17% at the 6th percentile, consistent with low real-world exploitation interest.
Denial-of-service in the Linux kernel macvlan driver allows local users with network interface management privileges to crash netlink interface dumps by exploiting a missing netlink buffer size reservation for the IFLA_MACVLAN_BC_CUTOFF attribute. When bc_cutoff is set to any value other than the default (1) on a macvlan bridge interface, any subsequent attempt to dump that interface via GETLINK triggers nla_put_s32() to return -EMSGSIZE, fires a WARN_ON in rtnetlink, and prevents the interface from being enumerated. No public exploit tool has been identified and no active exploitation is confirmed; EPSS is 0.17% (6th percentile).
NULL pointer dereference in the Linux kernel ICE (Intel Ethernet Controller) driver allows a local low-privileged attacker to trigger a kernel panic via a race condition during TX timestamp ring teardown. The flaw exists in systems using Intel ICE-series NICs with TX timestamping configured, where concurrent execution of ice_free_tx_tstamp_ring() and ice_tx_map() across CPU cores can cause CPU B to dereference a pointer that CPU A has already set to NULL. No public exploit or active exploitation has been identified; EPSS is 0.15% (5th percentile), consistent with its local, timing-dependent nature.
NULL pointer dereference in the Linux kernel ice driver's error path can cause a kernel panic on systems using Intel E800/E830 series Ethernet adapters. The flaw in ice_set_ringparam() leaves the ICE_TX_RING_FLAGS_TXTIME bit set after nullifying tstamp_ring, so a subsequent failure in ice_setup_tx_ring() triggers a dereference of a NULL tstamp_ring->desc pointer during error unwinding. No public exploit exists and EPSS sits at 0.15% (5th percentile), consistent with the discoverer's note that this was identified by manual code review rather than observed exploitation.
NULL pointer dereference in the Linux kernel's sch_dualpi2 queuing discipline (net/sched) allows a local attacker with low privileges to crash the kernel, causing a denial of service. The flaw exists in dualpi2_change(), which enforces updated queue limits after a qdisc reconfiguration: when traffic is exclusively queued in the L-queue and the C-queue is empty, the function unconditionally dereferences the NULL skb returned by the C-queue dequeue path, triggering a kernel panic. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), consistent with a locally-triggered, configuration-dependent kernel bug.
Resource exhaustion in the Linux kernel ksmbd SMB server allows a low-privileged authenticated SMB client to leak kernel file descriptor references by sending repeated SMB2 CREATE requests with a DURABLE_HANDLE_REQUEST_V2 context that produces a CreateGuid hit but a ClientGUID mismatch. Each such request increments the refcount on a ksmbd_file via ksmbd_fp_get() in ksmbd_lookup_fd_cguid() but the mismatch code path never calls the matching release, causing global_ft entries to be pinned indefinitely. Over time this defeats the durable file scavenger and causes long-lived kernel resource leaks that can degrade or deny availability. No public exploit has been identified at time of analysis and EPSS is 0.19% (9th percentile), indicating low opportunistic exploitation probability.
Stack memory disclosure in the Linux kernel RDS/IB subsystem exposes up to 26 bytes of uninitialized kernel stack contents - including kernel text and data pointers - to local unprivileged users via the getsockopt(SOL_RDS, RDS_INFO_IB_CONNECTIONS) interface. The leak enables KASLR bypass on systems where the kernel was built without CONFIG_INIT_STACK_ALL_ZERO=y, making this a useful primitive for chaining into privilege escalation. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS is very low at 0.18% (7th percentile), but the CVE description itself supplies a complete, step-by-step reproduction recipe that reduces practical exploitation complexity to near-trivial for any local user with AF_RDS socket access.
Improper RLIMIT_MEMLOCK accounting in the Linux kernel's vsock/virtio MSG_ZEROCOPY path allows a local low-privileged user to bypass per-process pinned-page limits, enabling unbounded kernel memory pinning that can drive the system toward memory exhaustion. The flaw is confined to the virtio vsock transport and is not remotely exploitable. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), reflecting low exploitation interest; however, a vendor-confirmed fix is available in stable releases.
Resource leak in the Linux kernel fsnotify subsystem causes hung tasks and local denial of service via a race condition in fsnotify_recalc_mask(). A local low-privilege user can trigger concurrent mark addition and removal on a filesystem connector object, causing an inode pointer returned by __fsnotify_recalc_mask() to be silently discarded rather than released via fsnotify_drop_object() - permanently blocking the umount path as fsnotify_sb_delete() waits indefinitely on the leaked reference. No public exploit exists and EPSS is at the 7th percentile, indicating negligible opportunistic exploitation risk.
Uninitialized memory use in the Linux kernel netdevsim subsystem allows a local low-privileged attacker to cause kernel crashes or potentially expose residual kernel heap contents via dummy packet trap operations. The root defect is in `nsim_dev_trap_skb_build`, where `skb_put` allocated space for a `struct iphdr` without zeroing it, leaving uninitialized kernel memory accessible in a dummy `sk_buff`. No public exploit code exists and the vulnerability is not in CISA KEV; EPSS stands at 0.18% (7th percentile), consistent with negligible opportunistic exploitation risk. Vendor-released patches are confirmed across all actively supported stable kernel branches.
Unbounded queue growth in the Linux kernel's netem (Network Emulator) traffic control subsystem allows a local low-privileged user to exhaust kernel memory and trigger a denial of service. The flaw exists because netem_enqueue() enforces queue depth limits using only q->t_len (packets in the internal tfifo), while packets placed into sch->q via the reorder path (__qdisc_enqueue_head) are silently excluded from that count, allowing total queue occupancy to grow beyond sch->limit without bound. No public exploit has been identified and the EPSS score of 0.18% (8th percentile) places this in the lowest exploitation-probability tier; however, the vulnerability affects a wide range of active stable kernel branches and patched versions are available.
Kernel crash via scheduler state corruption in the Linux kernel's CFS/EEVDF fair scheduler allows a local user to cause a NULL pointer dereference and system denial of service. When a task is forked while the parent's sched_entity has rel_deadline set, the child inherits stale deadline state that __sched_fork() fails to clear; a subsequent sched_yield() call on the child inflates vruntime by approximately 2x (observed: ~9.8e15 jumping to ~1.9e16), corrupting cfs_rq->sum_w_vruntime and ultimately causing pick_next_entity() to return NULL unexpectedly. No active exploitation has been identified (EPSS 0.17%, not in CISA KEV), and upstream stable patches are available across multiple kernel branches.
Race condition in the Linux kernel PSP network subsystem allows a local low-privileged attacker to crash the kernel through a TOCTOU flaw in device association creation. In `psp_assoc_device_get_locked()`, a device reference acquired under RCU becomes stale before the protecting lock is taken if `psp_dev_unregister()` completes concurrently, leaving the kernel operating on freed or invalid device state. No public exploit has been identified and EPSS stands at 0.17% (6th percentile), reflecting minimal active exploitation risk despite the well-characterized code-level race condition.
Missing CAP_NET_ADMIN enforcement in the Linux kernel PSP (PSP Security Protocol) netlink subsystem allows any local user with low privileges within the same network namespace to invoke the dev-set and key-rotate operations - modifying PSP version configuration and rotating cryptographic key material without authorization. The only access control in place, psp_dev_check_access(), validates only network namespace membership and does not enforce administrative capability. This enables unauthorized disruption of PSP-encrypted network communications and unauthorized modification of in-use cryptographic keying material. No public exploit code has been identified at time of analysis, and EPSS exploitation probability is very low at 0.17% (7th percentile).
Kernel availability impact in the Linux DRM PRIME buffer-sharing subsystem results from a pointer replacement logic error introduced by commit 5e28b7b94408, where the new IDR object pointer fails to overwrite the original handle's pointer at the correct location during the 'change handle' flow. Local users with low privileges holding access to a DRM device node can trigger a kernel WARNING assertion failure in drm_prime_destroy_file_private (drm_prime.c:224) upon file close, destabilizing the system. No public exploit exists and EPSS sits at 0.19% (8th percentile), indicating low real-world exploitation probability; the vendor patch is available in Linux stable trees at 7.0.10 and 6.18.33.
An infinite loop condition in the Linux kernel's DRM/TTM GPU memory management subsystem allows a local unprivileged user to cause a system-level denial of service. When `ttm_bo_swapout()` encounters a swapout failure, the error recovery path incorrectly repositions the buffer object at the tail of the LRU list - placing it ahead of the walk cursor's hitch node - so the subsequent `list_for_each_entry_continue()` repeatedly processes the same resource indefinitely, hanging the kernel's memory reclaim path. No public exploit has been identified and EPSS probability is 0.17% (6th percentile), but the stable kernel patch is confirmed available via two upstream commits.
Out-of-bounds descriptor read in the Linux kernel ALSA USB MIDI 2.0 subsystem allows a physically proximate or low-privileged local attacker to crash the kernel by presenting a malformed USB audio device with crafted MIDI 2.0 endpoint descriptors. The USB MIDI 2.0 endpoint parser validates bLength against bNumGrpTrmBlock but omits validation against remaining bytes in the endpoint-extra scan, allowing baAssoGrpTrmBlkID[] reads to advance past the descriptor buffer boundary. No public exploit is identified; EPSS stands at 0.18% (7th percentile), consistent with narrow, hardware-dependent attack surface and no active exploitation.
Out-of-bounds read in the Linux kernel's ALSA USB MIDI subsystem (`snd_usbmidi_get_ms_info()`) allows a local attacker to trigger a kernel panic and denial of service by presenting a crafted USB MIDI device with a malformed endpoint descriptor `bLength` field. The descriptor walker fails to verify that `bLength` stays within the remaining endpoint-extra scan bytes, leaving flexible-array reads of `baAssocJackID[]` potentially unbounded by the actual buffer limit. No public exploit is identified at time of analysis, and EPSS places exploitation probability at 0.18% (8th percentile), consistent with the local attack vector.
Infinite LRU list traversal in the Linux kernel's drm/ttm memory management subsystem allows a local low-privileged user to cause a kernel hang or denial of service on GPU-equipped systems. The flaw resides in ttm_bo_shrink(), where the bulk-move removal step was executed before confirming successful buffer object backup, leaving the LRU list in a corrupted state that loops indefinitely on backup failure. Notably, the 'Information Disclosure' tag in source intelligence conflicts with the CVSS C:N metric - the actual impact is availability only. No public exploit code has been identified, and EPSS exploitation probability is very low at 0.16% (6th percentile).
Integer overflow in the Linux kernel i2c character device driver allows a local low-privileged user to corrupt the SMBus controller state machine and cause a persistent Denial of Service. By supplying a crafted large timeout value (e.g., 429496729) to the I2C_TIMEOUT ioctl that passes the INT_MAX bounds check but overflows to a negative integer after multiplication by 10, an attacker forces wait_for_completion_timeout() to receive a sign-extended negative 64-bit value, triggering schedule_timeout kernel warnings and leaving the SMBus adapter in an unrecoverable state. No public exploit has been identified at time of analysis and EPSS is 0.18% (8th percentile), reflecting low mass-exploitation risk; however, the flaw is mechanically straightforward on any system granting unprivileged access to /dev/i2c-* nodes.
Cross-site request forgery in the Jenkins Pipeline: Groovy Plugin (versions up to and including 4331.v9d06ed4658ff) enables authenticated low-privilege users to instantiate arbitrary Java types related to job or system configuration by exploiting the unprotected Pipeline Snippet Generator endpoint. The attacker can reach types outside the normally permitted set of Pipeline steps, potentially influencing configuration objects that should be off-limits at their privilege level. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with non-automatable delivery.
Out-of-bounds read in ImageMagick's ConnectedComponentsImage() function allows local attackers to trigger access violations by supplying malformed connected-components artifact definitions via the CLI, leading to denial of service or potential arbitrary code execution. All ImageMagick releases before 7.1.2-19 are affected, as are Magick.NET NuGet packages before 14.12.0. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the RCE and information-disclosure tags warrant attention in environments that process untrusted image inputs through automated pipelines.
Memory exhaustion via unfreed heap allocations in ImageMagick before 7.1.2-15 enables remote denial of service against services that process untrusted images through the affected raw-pixel-data coders. The flaw (CWE-401) causes 160-byte objects to accumulate on the heap with each crafted image processed, progressively starving the host process of memory. No public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.3 reflects network reachability offset by high attack complexity and partial attack requirements, limiting realistic mass exploitation.
NULL pointer dereference in the Linux kernel SMC subsystem's smc_msg_event tracepoint crashes the kernel when SMC-D socket traffic is processed while the tracepoint is active. Affected kernels from commit aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 across multiple stable branches dereference conn->lnk unconditionally in the tracepoint, though this pointer is only valid for SMC-R connections and is NULL for SMC-D. While activating the tracepoint requires root, the crash itself can be triggered by any unprivileged user via AF_SMC socket operations on SMC-D capable systems (s390 natively, or x86 with loopback ISM loaded). No public exploit or active exploitation confirmed; EPSS sits at 0.16%.
Kernel stack memory disclosure in the Linux TUN driver exposes 14 bytes of uninitialized stack data to unprivileged local users on every read of a non-tunnel packet. The flaw affects Linux systems where a local user can open a TUN device and issue the TUNSETVNETHDRSZ ioctl to set the vnet header size to 24 bytes. No public exploit or active exploitation has been identified; EPSS is 0.15% (5th percentile), consistent with a local-only information disclosure requiring deliberate TUN device configuration.
NULL pointer dereference in the Linux kernel RDS/InfiniBand subsystem allows an unprivileged local user to trigger a kernel panic by sending an atomic cmsg over an active RDS/IB connection. The completion handler rds_ib_send_unmap_op() lacks switch cases for masked atomic opcodes (IB_WR_MASKED_ATOMIC_CMP_AND_SWP, IB_WR_MASKED_ATOMIC_FETCH_AND_ADD), returning rm=NULL while the send operation remains flagged, leading to a fatal NULL dereference at rm->m_final_op in softirq context. No public exploit has been identified and EPSS is 0.16% (6th percentile), but the crash is deterministic and reproducible on any system with mlx4/mlx5 InfiniBand hardware running an unpatched kernel with active RDS/IB connections.
NULL pointer dereference in the Linux kernel's BPF socket storage subsystem (net/core/bpf_sk_storage.c) allows a local low-privileged user to crash the kernel. The race condition between bpf_selem_unlink_nofail() - which nulls smap before removing the element from the hlist - and concurrent RCU readers in bpf_sk_storage_clone() and bpf_sk_storage_diag_put_all() can be triggered during TCP SYN handling (socket cloning path), producing a kernel panic. No public exploit identified at time of analysis; EPSS of 0.14% (4th percentile) confirms negligible observed exploitation probability.
Stack information disclosure in the Linux kernel's tap/macvtap driver exposes 8 bytes of uninitialized kernel stack contents to local users via the SIOCGIFHWADDR ioctl, leaking kernel .text and direct-map pointers that defeat KASLR. The affected code path in tap_ioctl() copies a 16-byte sockaddr_storage to userspace while netif_get_mac_address() initializes only 8 bytes (sa_family plus 6-byte Ethernet address), leaving the trailing 8 bytes unread. No public exploit is identified at time of analysis and EPSS sits at 0.15% (5th percentile), but KASLR bypass primitives of this type are routinely chained with local privilege-escalation exploits to gain kernel code-execution. NOTE: The provided CVSS vector (C:N/I:N/A:H) appears to misclassify this vulnerability - confidentiality is the impacted property, not availability; the assessed vector below corrects this.
CPU stall vulnerability in the Linux kernel jitterentropy subsystem allows local low-privileged users to trigger prolonged non-preemptible spinlock holds by spawning concurrent entropy requests through jent_kcapi_random(), which holds a spinlock across expensive SHA3 conditioning and jitter collection. Systems running kernel versions from approximately 4.2 through pre-fix stable branches face entropy starvation and CPU busy-wait degradation under parallel getrandom() load. No public exploit identified at time of analysis; EPSS is 0.16% at the 5th percentile and no CISA KEV listing applies, making this a low-urgency, operator-pace patch for most deployments.
Availability disruption in the Linux kernel's AF_UNIX socket subsystem allows a local low-privileged user to trigger an unhandled code path by issuing a SIOCATMARK ioctl on non-stream (SOCK_DGRAM or SOCK_SEQPACKET) AF_UNIX sockets, which the kernel incorrectly permits to proceed into receive-queue inspection logic intended only for SOCK_STREAM. The flaw stems from a logic inconsistency: while SOCK_DGRAM and SOCK_SEQPACKET already reject MSG_OOB in sendmsg()/recvmsg(), the SIOCATMARK ioctl handler lacked the corresponding guard, creating an exploitable divergence. No public exploit or CISA KEV listing exists; EPSS at 0.16% (5th percentile) reflects a very low real-world exploitation probability.
Stale gateway pointer in the Linux kernel's batman-adv mesh networking subsystem causes availability failures during mesh teardown and recreation. The batman-adv gateway cleanup function `batadv_gw_node_free()` frees gateway list entries without clearing `bat_priv->gw.curr_gw`, leaving a dangling reference that persists across cleanup and breaks subsequent mesh recreation attempts. No public exploit exists and EPSS sits at 0.16% (6th percentile), indicating negligible opportunistic exploitation interest at time of analysis.
NULL pointer dereference in the Linux kernel VRF (Virtual Routing and Forwarding) subsystem allows a local low-privileged user to crash the kernel via a race condition between RCU readers and VRF port removal operations, resulting in a complete denial of service on affected systems. Systems using VRF network segmentation are at risk specifically when VRF port membership is dynamically modified concurrent with socket bind() operations. EPSS is 0.16% (6th percentile) and the vulnerability is not listed in CISA KEV; no public exploit code has been identified, but patched kernel versions are available across all active stable branches.
Denial of service in the Linux kernel netfilter ipset subsystem allows a local low-privileged user to disrupt availability by triggering an iterator overrun in hash:ip,mark, hash:ip,port, hash:ip,port,ip, or hash:ip,port,net set types during IPv4 range iteration. The 32-bit loop iterator is not properly bounded, allowing it to advance past the last address in the requested range; subsequent retry passes then resume from an unintended position, corrupting traversal state. No public exploit is identified at time of analysis, and the EPSS score of 0.16% (6th percentile) confirms very low exploitation probability, making this a routine patching priority rather than an emergency response.
Stack exhaustion in the Linux kernel batman-adv mesh networking subsystem allows an attacker on the same batman-adv mesh to crash the kernel by sending matryoshka-nested BATADV_UNICAST_FRAG packets. The reassembled payload's packet type is not validated before re-processing, enabling unbounded recursion in batadv_batman_skb_recv() that exhausts kernel stack and causes a hard system crash. No active exploitation is recorded in CISA KEV and EPSS sits at 0.18% (7th percentile), making this a targeted DoS risk limited to environments running batman-adv mesh networking.
NULL pointer dereference in the Linux kernel's batman-adv OGMv2 subsystem allows a local low-privilege user to crash the kernel by racing interface teardown against OGM dispatch. When a batman-adv hard interface is disabled and its mesh_iface pointer is set to NULL, the batadv_v_ogm_queue_on_if() function continues to call netdev_priv() on that NULL pointer, triggering a kernel panic. No public exploit exists and EPSS is 0.18% (7th percentile), making this low operational priority except on systems actively running batman-adv mesh networking.
@JsonView access-control bypass in jackson-databind 2.21.0-2.21.3 and 3.0.0-3.1.3 allows remote attackers to write values into setterless Collection/Map properties that are restricted by a @JsonView annotation, defeating view-based mass-assignment protection during deserialization. The regression was introduced when SetterlessProperty.isMerging() was changed to return true, routing these properties through an unguarded buffering branch in BeanDeserializer._deserializeUsingPropertyBased that lacked the prop.visibleInView(activeView) check applied to creator properties. No public exploit code has been identified and this is not listed in CISA KEV; however, applications relying on @JsonView for security-critical field-level access control - such as role or permission gating - are directly and completely bypassed.
Integrity bypass in jackson-databind 2.21.0-2.21.3 and 3.0.0-3.1.3 allows unauthenticated network attackers to write to private backing fields that application developers intended as read-only. The flaw occurs when a POJO uses @JsonProperty on a getter with @JsonIgnore on the setter - a common read-only-over-the-wire pattern - and MapperFeature.INFER_PROPERTY_MUTATORS is enabled (the default). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The GHSA advisory characterizes the impact as property tampering and mass assignment; maintainers rate it minor despite a reporter-assessed HIGH severity.
Per-property @JsonIgnoreProperties filtering in jackson-databind is silently bypassed when the same property also carries @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES), enabling unauthenticated network attackers (per CVSS AV:N/PR:N) to write to fields the application explicitly excluded from deserialization. The flaw spans versions from 2.8.0 through the 2.18.x, 2.19-2.21.x, and 3.1.x release lines and constitutes a mass-assignment integrity risk wherever ignored fields guard sensitive state such as privilege or role attributes. No public exploit tool or CISA KEV listing has been identified at time of analysis; vendor-released patches (2.18.9, 2.21.5, 3.1.4) were published 2026-06-04.
Eager DNS resolution during InetSocketAddress deserialization in jackson-databind (versions 2.0.0 through pre-fix releases across the 2.18, 2.21, and 3.x lines) allows any attacker who can supply untrusted JSON to an affected endpoint to force outbound DNS lookups for attacker-chosen hostnames at readValue() time - before application validation or connect logic can intervene. This DNS-based SSRF (CWE-918) enables internal resolver probing, network topology enumeration, and DNS out-of-band interaction signals against applications that deserialize untrusted JSON into types containing InetSocketAddress fields. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS data was not available in the provided intelligence sources.
Jackson-databind's `@JsonView` authorization boundary is bypassed for constructor parameters that combine `@JsonUnwrapped` and `@JsonView` annotations, affecting versions 2.21.0-2.21.3 and 3.0.0-3.1.3. The deserialization code path in `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` replays buffered JSON into creator parameters without calling `prop.visibleInView(activeView)`, while the standard property path correctly enforces this check. Applications that rely on `@JsonView` as a write-side access control boundary are exposed: an attacker supplying crafted JSON can populate admin-restricted constructor fields even when the application activates a less-privileged view. No public exploit identified at time of analysis; upstream patches are confirmed in 2.21.4 and 3.1.4.
Uncontrolled resource consumption in jackson-databind 2.10.0 through 2.13.5 allows unauthenticated remote attackers to cause a Denial-of-Service by submitting small (~2kB), deeply nested JSON payloads that trigger a StackOverflowError when a service reads the input via ObjectMapper.readTree() and serializes the resulting JsonNode using JsonNode.toString(). The root cause is recursive serialization in the toString() call path, which was replaced with an iterative IteratorStack-based implementation in version 2.14.0. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Heap use-after-free in ImageMagick's meta coder allows remote attackers to crash the process by submitting a specially crafted image file that triggers a memory allocation failure, causing a single byte write to a stale (freed) pointer. Affected versions are ImageMagick before 7.1.2-15 and 6.9.13-40, as well as Magick.NET NuGet wrapper packages before 14.10.3. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 6.3 with AC:H and AT:P reflects that reliable exploitation requires specific memory allocation failure conditions rather than straightforward request-and-crash triggering.
Memory exhaustion in ImageMagick's TXT file coder (coders/txt.c) leaks heap allocations each time a crafted TXT file carrying a texture attribute is processed and GetTypeMetrics subsequently fails. Affected are ImageMagick before 7.1.2-15 and 6.9.13-40, and transitively Magick.NET NuGet packages before 14.10.3. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the deterministic failure path makes repeated triggering straightforward in any service that accepts and processes user-supplied TXT files through ImageMagick.
Denial of service in OpenLink Virtuoso OpenSource v7.2.11 allows remote attackers to crash the database server by submitting crafted SQL statements that trigger a fault in the sqlo_try_in_loop SQL optimizer component. No public exploit identified at time of analysis, though SSVC indicates a proof-of-concept exists in the referenced GitHub issue. The flaw is tagged as SQLi-class (CWE-89) but the demonstrated impact is availability-only, with no confidentiality or integrity loss per the CVSS vector.
Denial of service in OpenLink Virtuoso OpenSource v7.2.11 allows remote attackers to crash the database server by submitting specially crafted SQL statements that trigger a flaw in the sqlo_untry query-optimization component. The CVSS 7.5 score reflects unauthenticated network exploitability with high availability impact, but no public exploit identified at time of analysis and the issue is currently tracked only as an upstream GitHub issue without a released fix.
Denial of service in OpenLink Virtuoso Open Source Edition v7.2.11 allows remote attackers to crash the database engine by submitting crafted SQL statements that mishandle column predicate processing inside the sqlo_tb_col_preds query optimizer component. CVSS 7.5 reflects high availability impact with no authentication required, though no public exploit identified at time of analysis and the issue is tracked only as an upstream GitHub bug report.
Denial of service in OpenLink Virtuoso OpenSource v7.2.11 allows remote attackers to crash the database server by submitting crafted SQL statements that trigger a fault in the sslr_qst_get component. The flaw is classified under CWE-89 (SQL injection class) but the documented impact is availability-only with no confidentiality or integrity loss per the CVSS vector. No public exploit identified at time of analysis, and the issue is tracked only via an upstream GitHub issue (#1229) rather than a tagged fixed release.
Denial of service in OpenLink Virtuoso Open Source Edition 7.2.11 lets attackers crash the database server by submitting crafted SQL statements that trigger a fault in the sqlo_natural_join_cond query-optimizer component. The flaw carries no confidentiality or integrity impact but fully degrades availability (CVSS 7.5, A:H). There is no public exploit identified at time of analysis and EPSS is low (0.15%), indicating limited near-term exploitation likelihood; only a GitHub issue documenting the defect is published.
Denial of service in OpenLink Virtuoso Open Source Edition 7.2.11 lets attackers crash the database engine by submitting crafted SQL statements that mishandle the internal t_set_push routine. The flaw carries availability-only impact (CVSS 7.5, A:H) with no confidentiality or integrity loss. EPSS is low (0.15%, 4th percentile), there is no public exploit identified at time of analysis, and it is not listed in CISA KEV - so risk is theoretical rather than actively exploited.
Denial of service in OpenLink Virtuoso Open-Source Edition 7.2.11 lets attackers crash the database server by submitting crafted SQL statements that mishandle the sqlo_key_part_best query-optimizer routine. The flaw carries no confidentiality or integrity impact (availability-only, CVSS 7.5) and there is no public exploit identified at time of analysis; EPSS is low at 0.15% (4th percentile), and it is not listed in CISA KEV. The only public reference is the upstream GitHub issue (#1222) tracking the crash.
DNS rebinding against the Glances XML-RPC server (`glances -s`) allows a network-adjacent or remote attacker to exfiltrate the full system monitoring dataset - including process command lines that routinely contain secrets - from a victim's browser without any authentication. The `GlancesXMLRPCHandler` in `glances/server.py` accepts arbitrary HTTP `Host` headers without validation, an omission that persists while the REST/WebUI server received an equivalent fix (TrustedHostMiddleware, v4.5.2) and the MCP server was protected since v4.5.1. No active exploitation is confirmed (not in CISA KEV), but a detailed proof-of-concept is published in the vendor's GitHub security advisory GHSA-w856-8p3r-p338 and the attack is materially amplified by the companion CORS wildcard issue CVE-2026-46608.
Infinite loop denial-of-service in pypdf prior to 6.13.1 allows an attacker to hang any process that merges a crafted PDF containing cyclic article/thread structures. The vulnerability exists in the `_add_articles_thread()` method of `_writer.py`, which traversed PDF article bead linked-list structures without cycle detection, permitting a self-referential `/N` (Next) pointer chain to create an irrecoverable loop. No public exploit code or CISA KEV listing exists at time of analysis, but the upstream PR diff publicly discloses the precise triggering structure, lowering the bar for exploitation against vulnerable merge pipelines.
Path traversal in Keras 3.14.0 exposes local file systems to arbitrary file and directory creation when processing maliciously crafted model files. The DiskIOStore.make method constructs directory paths from user-supplied layer names without sanitizing directory traversal sequences (..); since only forward slashes are blocked, embedding .. components in a layer name allows escape from the intended temporary working directory during model save or load operations. No active exploitation (CISA KEV) and no public proof-of-concept has been identified at time of analysis; however, EPSS data was not provided, leaving probabilistic exploitation likelihood unquantified.
Use-after-free in libexpat before 2.8.2 arises from the `doCdataSection` function omitting `beforeHandler`/`afterHandler` depth-tracking calls for `XML_TOK_DATA_CHARS` tokens during CDATA section parsing - an incomplete fix for the related CVE-2026-50219. When a policy violation occurs during handler callback invocation in this code path, the parser's internal call-depth counter becomes inconsistent, enabling a use-after-free condition. An attacker supplying specially crafted XML to any libexpat-consuming application may trigger limited memory corruption, information disclosure, or availability impact under high-complexity conditions; no public exploit is identified at time of analysis and no CISA KEV listing exists.
Integer overflow in the xmlwf utility bundled with libexpat before 2.8.2 enables heap corruption via XML documents containing an excessive number of NOTATION declarations in a DOCTYPE block. The flaw in endDoctypeDecl allows a crafted XML file to wrap a signed integer counter, producing an undersized heap allocation that can be overflowed with high confidentiality and integrity impact. No confirmed active exploitation (not in CISA KEV) and no public exploit code have been identified at time of analysis; vendor-released patch is available in libexpat 2.8.2.
Integer overflow in libexpat's xmlwf tool allows an attacker supplying a crafted XML file with an excessively long DOCTYPE system identifier to trigger a heap buffer overflow via the resolveSystemId function. All libexpat versions before 2.8.2 are affected; the root cause is an unchecked size_t arithmetic operation - both the addition of string lengths and the subsequent multiplication by sizeof(XML_Char) - before a malloc call. No public exploit has been identified at time of analysis, and exploitation requires local access under high-complexity conditions per the CVSS:3.1/AV:L/AC:H vector.
Integer overflow in libexpat before 2.8.2 allows heap corruption during XML prolog parsing when accumulated entity value pool length exceeds INT_MAX, yielding high confidentiality and integrity impact per CVSS. The flaw resides in doProlog and the related storeSelfEntityValue path, where poolLength() return values are cast to signed integers without bounds validation - a gap closed in the upstream fix via explicit INT_MAX guards. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, but the widespread use of libexpat as a dependency across system tools, language runtimes, and XML-processing services means the blast radius of a weaponized exploit would be broad.
Integer overflow in libexpat's XML_ParseBuffer function allows potential heap corruption leading to high-confidentiality and high-integrity impact in all libexpat versions before 2.8.2. The overflow occurs because XML_ParseBuffer lacked a bounds check on the byte index accumulator that was already present in the sibling XML_Parse function - a defensive guard omitted asymmetrically between two code paths. Any application that routes XML input through XML_ParseBuffer (a common pattern in incremental parsing) is exposed. No public exploit has been identified at time of analysis and no KEV listing exists, but the high C and I CVSS impact ratings reflect the potential for code execution via heap corruption.
Integer overflow in libexpat's getAttributeId routine exposes any application embedding libexpat before version 2.8.2 to memory corruption with high confidentiality and integrity impact when parsing specially crafted XML documents. The flaw occurs when an internal counter traversing the attribute ID table reaches INT_MAX and wraps, producing an invalid index that can corrupt adjacent heap memory. No public exploit has been identified at time of analysis, and CISA has not listed this in the KEV catalog, but a vendor-released patch is available in libexpat 2.8.2 and upgrade is the recommended remediation.
Integer overflow in libexpat's addBinding function (xmlparse.c) before version 2.8.2 allows memory corruption during XML namespace binding processing, with high confidentiality and integrity impact. All libexpat releases from 0 through 2.8.2-pre are affected (CPE: cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*), encompassing a significant downstream attack surface given the library's widespread use in Python, PHP, and system utilities. No public exploit or active exploitation has been confirmed at time of analysis; the official CVSS 3.1 score of 6.9 reflects meaningful impact tempered by high attack complexity and a local attack vector.