Red Hat
Monthly
Kernel memory corruption in the Linux inet fragment (inet_frag) subsystem arises from a race in inet_frag_create(), which arms the fragment-queue timer before publishing the queue into the fqdir rhashtable. When a network namespace has a fragment timeout of zero or negative, the timer can fire on an unpublished queue, mark it complete, and drop an anticipated hash reference that is never restored, leaving a stale hash node and a use-after-free-style reference imbalance. No public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.21%, 11th percentile), and exploitation depends on a non-default namespace configuration rather than default deployments.
Use-after-free in the Linux kernel's mac802154 (IEEE 802.15.4) subsystem allows a local low-privileged attacker to dereference freed netdev memory, potentially achieving kernel memory corruption and privilege escalation. The race window opens when mac802154_beacon_worker() drops the RCU read lock while still holding references to sdata and wpan_dev, and a concurrent interface teardown via mac802154_stop_beacons_locked() frees those structures before the worker completes. EPSS is very low at 0.21% (11th percentile) and no active exploitation or public exploit code has been identified at time of analysis; practical exploitation is limited by mac802154 hardware availability and the race condition timing requirement.
Use-after-free in the Linux kernel netfilter ebt_nflog subsystem allows a local attacker with low privileges to trigger kernel memory corruption by racing ebtables NFLOG rule execution against nfnetlink_log module teardown. Affected kernels from version 4.12 through multiple stable branches (pre-patch) fail to acquire a module reference on the nfnetlink_log backend before invoking nfulnl_log_packet(), unlike the xt_NFLOG and nft_log frontends. KASAN-confirmed heap use-after-free at instance_lookup_get_rcu can result in full kernel compromise (C:H/I:H/A:H). No public exploit identified at time of analysis; EPSS at 0.22% (13th percentile) reflects low near-term exploitation probability.
Use-after-free race condition in the Linux kernel's IPv4 routing subsystem allows a local low-privileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw is in fib_nhc_update_mtu(), which traverses the PMTU nexthop exception (FNHE) table without proper serialization against concurrent FNHE eviction, creating a window where freed memory is accessed after a completed RCU grace period. No public exploit code has been identified at time of analysis, and an EPSS of 0.22% (13th percentile) reflects very low near-term exploitation probability despite the 7.8 CVSS score.
TX DMA buffer mismanagement in the Linux kernel's Qualcomm GENI serial driver (qcom-geni) allows a local low-privileged user to hang the system indefinitely and potentially corrupt kernel memory on affected Qualcomm hardware. The driver's DMA-mode uart_ops lacks a flush_buffer callback, enabling in-flight DMA transfers to underflow the transmit kfifo and re-submit page-sized transfers indefinitely; a concurrent flaw in the stop path unmaps the DMA buffer while the serial engine is still reading it. No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile), but the user-triggerable hang and DMA use-after-unmap represent a real availability and potential integrity risk on affected Qualcomm platforms.
Use-after-free race condition in the Linux kernel's amba-pl011 serial driver allows a local unprivileged user on ARM-based hardware to corrupt kernel memory, potentially escalating to full system compromise. The RS485 hrtimers embedded in the devm-managed port structure can fire after the port is freed, and the IRQ handler can arm a timer immediately before teardown, creating the race window. No public exploit exists and EPSS is 0.21% (11th percentile), but kernel-level use-after-free primitives are well-understood exploitation targets and patched stable releases are available.
Out-of-bounds read in the Linux kernel's staging RTL8723BS WiFi driver allows adjacent-network unauthenticated attackers to leak kernel heap memory or crash the affected system by transmitting a crafted 802.11 management frame. The flaw lives in rtw_get_wpa_ie(), which accesses fixed byte offsets within a vendor-specific information element without verifying the IE body is at least 6 bytes long, enabling reads past the end of a kmemdup'd allocation when a short trailing IE is present. No active exploitation is confirmed (absent from CISA KEV) and EPSS sits at 0.22% (13th percentile), but the adjacent-network, no-authentication attack vector represents a meaningful risk for embedded and single-board systems carrying RTL8723BS hardware.
Buffer overflow and stale-memory disclosure in the Linux kernel's staging rtl8723bs WiFi driver allow a malicious access point within radio range to corrupt kernel memory or leak sensitive buffer contents before any association occurs. The flaw resides in OnAuthClient(), which copies a WLAN_EID_CHALLENGE element's attacker-controlled length - up to 255 bytes - into a fixed 128-byte chg_txt buffer via memcpy(), enabling an overflow of up to 127 bytes or an underfill that echoes stale kernel memory. No public exploit has been identified at time of analysis and EPSS probability is low (0.26%, 18th percentile), but the adjacent-network unauthenticated attack vector and High impact across confidentiality, integrity, and availability make this a notable risk for any deployment relying on WEP shared-key authentication with this chipset.
Out-of-bounds reads in the staging rtl8723bs WiFi driver's monitor mode transmit path expose Linux kernel systems equipped with Realtek RTL8723BS hardware to memory disclosure, corruption, and denial of service. The driver function rtw_cfg80211_monitor_if_xmit_entry() strips the variable-length radiotap header and then reads the 802.11 frame control field without verifying the socket buffer still contains a minimum MAC header; for data frames it additionally pulls the full calculated 802.11/QoS/SNAP span before confirming the skb holds that much data. A local attacker with low privileges can inject a truncated 802.11 frame to trigger the flaw; no public exploit has been identified at time of analysis and EPSS stands at 0.22%, indicating low automated exploitation probability.
Race condition in the Linux kernel fastrpc driver allows a local low-privileged attacker on Qualcomm DSP-equipped systems to trigger a use-after-free condition by issuing concurrent munmap ioctls, potentially achieving kernel memory corruption and privilege escalation. The flaw exists in `fastrpc_req_munmap_impl()` where the internal buffer list is updated only after the DSP unmap completes, leaving a window in which a concurrent thread can operate on an already-unmapped entry. No public exploit or CISA KEV listing exists at time of analysis, and EPSS remains low at 0.21%, indicating limited observed exploitation activity.
Unprotected list manipulation in the Linux kernel FastRPC subsystem allows a local low-privileged attacker on Qualcomm-based systems to race a signal-interrupted DSP invoke operation against concurrent mmap/munmap operations. The missing `fl->lock` acquisition in `fastrpc_internal_invoke()` during the interrupt path creates a concurrent modification hazard on `fl->mmaps`, potentially yielding kernel memory corruption with full confidentiality, integrity, and availability impact. No public exploit has been identified and EPSS is 0.21% (11th percentile); this CVE is not listed in the CISA KEV catalog.
Unbounded kernel memory access in the Linux kernel's ALSA usx2y driver allows a local user with access to a Tascam US-X2Y USB audio device's hwdep node to read from and write to arbitrary kernel memory pages via a crafted mmap() call with an out-of-bounds page offset. The snd_usb_usx2y module has carried this flaw since Linux 2.6.12; no Linux capability check (CAP_SYS_ADMIN, etc.) is required - only DAC permission to the hwdep character node after completing a mandatory FPGA image upload sequence. The exploit primitive is sufficient for local privilege escalation, but real-world risk is tightly bounded by the requirement for a physically attached Tascam US-X2Y device; no public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.21% (12th percentile) reflects this narrow hardware prerequisite accurately.
Out-of-bounds slab write in the Linux kernel ALSA FCP (FireWire Control Protocol) driver allows local unprivileged processes to corrupt up to 888 bytes of adjacent kernel heap memory by reading audio controls on /dev/snd/controlC0, once a privileged actor has installed an oversized Level Meter map. The mismatch between the driver's 255-entry map limit and the 128-entry ABI array in struct snd_ctl_elem_value creates a persistent, exploitable write primitive reachable by any process with device read access. No public exploit has been identified and no active exploitation is confirmed; vendor-released patches are available in Linux 7.2, 7.1.9, and 6.18.45.
Use-after-free in the Linux kernel perf/core subsystem allows a local low-privileged user to dereference freed kernel memory by racing CPU hot-unplug against perf event group management. When a sibling event is detached via DETACH_GROUP during CPU hotplug, its group_leader pointer is not reset; if the leader is subsequently freed while the sibling's file descriptor remains open, a PERF_IOC_FLAG_GROUP ioctl on the sibling follows the stale pointer into freed memory, potentially enabling kernel crash or privilege escalation to root. No public exploit has been identified at time of analysis and EPSS is low at 0.21% (11th percentile), but the local exploit path with full C:H/I:H/A:H impact warrants prompt patching, particularly on systems permitting unprivileged perf_event_open access.
Out-of-bounds memory read in the Linux kernel's fbdev bitblit subsystem allows a local attacker with tty group write access to /dev/vcsa to crash the kernel or disclose kernel memory by supplying an out-of-range glyph index through the virtual console screen interface. The root cause is a missing bounds check in bit_cursor() in drivers/video/fbdev/core/bitblit.c - a sibling function to bit_putcs_aligned() and bit_putcs_unaligned(), which already received the same clamp in commit 18c4ef4e765a. No public exploit has been released and EPSS of 0.22% (13th percentile) indicates very low active exploitation probability; this is not in CISA KEV.
Use-after-free in the Linux kernel's ring-buffer tracing subsystem exposes non-consuming reader iterators to dangling memory when subbuffer order changes occur while resizing is disabled. The vulnerable function ring_buffer_subbuf_order_set() frees buffer pages without checking the resize_disabled flag, leaving rb_advance_iter() holding stale references to freed memory. Exploitation requires local low-privilege access; no public exploit or CISA KEV listing exists, but vendor patches are available across multiple stable kernel branches.
Race condition in the Linux kernel's mm/huge_memory subsystem allows local low-privilege users to trigger misidentification of the huge zero folio as an ordinary Transparent Huge Page (THP), potentially leading to memory corruption, incorrect folio splitting, and privilege escalation. Affected kernels spanning multiple stable branches from at least 4.19 onward are vulnerable when !CONFIG_PERSISTENT_HUGE_ZERO_FOLIO is in effect, with patched versions available for 6.12, 6.18, 7.1, and 7.2 stable series. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog; EPSS places exploitation probability at the 11th percentile.
Use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local attacker to trigger kernel memory corruption via a refcount underflow in smc_rx_splice(). The flaw arises because pages are handed to splice_to_pipe() before page and socket references are taken, so entries dropped by smc_rx_spd_release() are released without a matching reference, and multi-page splices pair one sock_hold() with multiple sock_put() calls. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.21% (12th percentile), consistent with limited real-world weaponization at this time.
Use-after-free in the Linux kernel's IPv6 stack allows a local low-privileged user to corrupt kernel memory with full high/integrity/availability impact. The race condition exists in in6_dev_get(), where dev->ip6_ptr is read under RCU and its refcount is then unconditionally incremented - device teardown can zero the pointer and drop the final reference between those two operations, resurrecting a freed inet6_dev object. No public exploit identified at time of analysis, though a proof-of-concept reproducer was confirmed functional on the unpatched v7.2-rc3 kernel by OpenAI Security Research and validated by Trail of Bits.
Use-after-free and double-free memory corruption in the Linux kernel's net/dibs network subsystem allows an adjacent network attacker to trigger kernel memory corruption via a race condition between the dibs device interrupt handler and device teardown. The UAF arises because an active interrupt handler can continue accessing dmb_clientid_arr after dibs_dev_del() releases it; a separate double-free path exists when dibs_dev_add() fails during dibs_lo_dev_probe(). No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile), indicating low exploitation likelihood despite the high CVSS score.
Local privilege-relevant kernel memory corruption in the Linux kernel's net/x25 subsystem arises because X.25 socket timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket. The x25_heartbeat_expiry() handler rearms unconditionally and can reinstall sk->sk_timer after __x25_destroy_socket() passes its cancel point, letting a subsequent expiry dereference the kmalloc-2k socket object already freed by close() - a use-after-free confirmed by KASAN. Exploitation requires the ability to create AF_X25 sockets on a host with X.25 support loaded; no active exploitation and no public exploit code have been identified, and EPSS probability is low (0.21%).
Linux kernel zero-copy networking in zerocopy_fill_skb_from_devmem() permits improper mixing of net_iov (device memory) and page-backed fragments within a single socket buffer (skb), causing type confusion and memory corruption in downstream kernel networking code. Affected are kernels from introducing commit bd61848900bff5 across the 6.18.x and 7.x stable series until the respective patch commits were applied. No public exploit or active exploitation is confirmed at time of analysis (EPSS 0.21%, no CISA KEV listing), but the local CVSS 7.8 score reflects credible kernel-level memory corruption risk for systems where devmem TCP zero-copy is configured and in use.
Reception stall denial-of-service in the Linux kernel's ntb_netdev driver allows remote unauthenticated attackers to progressively exhaust the NTB network interface's RX queue by triggering repeated memory allocation failures during packet reception, ultimately halting all inbound packet delivery while the interface remains administratively up. Systems with NTB-capable PCIe hardware (Non-Transparent Bridge interconnects) running affected kernel versions are at risk; standard Linux deployments without this hardware are entirely unaffected. No public exploit has been identified at time of analysis, and EPSS sits at the 10th percentile, consistent with the specialized hardware prerequisite; upstream stable commits confirming the fix are publicly available.
Memory exhaustion in the Linux kernel's netfilter bridge subsystem allows network-adjacent unauthenticated attackers to cause denial of service by sending non-IP Ethernet frames through a bridge host configured with nftables conntrack zone set rules. The root cause is that nf_ct_bridge_pre() overwrites skb->_nfct with IP_CT_UNTRACKED for non-IPv4/non-IPv6 EtherTypes without releasing the existing conntrack template reference, leaking slab memory indefinitely until the host exhausts kernel memory. No public exploit exists and EPSS is 0.22% (13th percentile), indicating low real-world exploitation likelihood despite the High availability impact rating; risk is further bounded by the requirement for a specific non-default nftables configuration.
Deadlock in the Linux kernel's netfilter nf_conntrack subsystem can be triggered remotely by sending malformed TCP or SCTP packets when nfnetlink_log with conntrack export is active as the logging target. The logging emission path re-enters conntrack netlink glue code and attempts to re-acquire ct->lock already held by the conntrack processing path, causing a kernel deadlock and system-wide denial of service. No exploit code is publicly available and EPSS stands at 0.21% (11th percentile), indicating very low current exploitation activity; patches for multiple stable kernel branches are confirmed available.
Unbounded kernel memory exhaustion in the Linux kernel's traffic control connection tracking action (act_ct) allows unauthenticated remote attackers to leak one sk_buff plus its data buffer per malformed IP packet on systems with a clsact TC chain configured with 'action ct'. The defect in tcf_ct_act() causes error paths from header sanity checks to return TC_ACT_CONSUMED - signaling ownership transfer - while the sk_buff is still owned by the caller and never freed, resulting in progressive kernel memory exhaustion. No public exploit has been identified at time of analysis; EPSS is low at 0.21% (percentile 11%), and the vulnerability is not in CISA KEV.
Improper initialization ordering in the Linux kernel's dibs (Direct Internal Buffer Sharing) subsystem leaves dibs->lock uninitialized during early ISM device probe, so a GID-event interrupt arriving between ism_dev_init()/request_irq() and dibs_dev_add() causes ism_handle_irq() to acquire an uninitialized spinlock. This affects s390 systems using ISM/SMC-D devices and can lead to undefined locking behavior and kernel instability. EPSS is low (0.21%), no public exploit is identified, and the issue is a robustness/race fix rather than a remotely triggerable flaw despite the input's 9.8 rating.
Memory corruption in the Linux kernel's XDP (eXpress Data Path) broadcast-redirect path allows corruption of kernel skb_shared_info metadata when cloned XDP frames are converted back into socket buffers. xdpf_clone() packs broadcast copies into a single page with frame_sz set to PAGE_SIZE, but the existing bounds check fails to account for the shared-info tailroom, so a source frame from a larger allocation can extend into the clone's required shared-info area; build_skb_around() then writes skb_shared_info over live packet bytes. The issue is fixed and carries a vendor CVSS of 9.8, but with a low EPSS of 0.21% (12th percentile) and no public exploit identified at time of analysis, real-world risk is far narrower than the base score implies because a non-default XDP broadcast-redirect configuration is required.
Use-after-free in the Linux kernel VXLAN driver allows a local, low-privileged user to corrupt kernel memory, potentially escalating to full kernel compromise. The flaw exists in vxlan_changelink(), which arms age_timer without checking whether the device is up via netif_running(); when the device is subsequently deleted, free_netdev() releases the vxlan_dev struct - including the embedded timer - while that timer remains queued on a timer_base. Because the rtnl operations are netns-scoped, an unprivileged user can trigger the entire sequence inside a new user and network namespace without elevated system privileges. No public exploit or CISA KEV entry is identified at time of analysis; EPSS of 0.22% (13th percentile) reflects low current exploitation activity, though the local-user-namespace reachability makes this a meaningful local privilege escalation risk on any Linux system permitting user namespace creation.
Use-after-free memory corruption in the Linux kernel vsock/virtio subsystem arises from a race condition between virtqueue worker threads and VM suspend/resume cycles. Worker threads (RX, TX, event) read their virtqueue pointer before acquiring the protective mutex and checking the run flag; a worker delayed across a freeze/restore transition retains a dangling pointer to a freed queue while the restoration installs replacement queues. No public exploit has been identified and EPSS probability is low at 0.21%, though successful exploitation could yield full kernel-level memory corruption with high confidentiality, integrity, and availability impact.
Use-after-free in the Linux kernel vsock/virtio RX worker allows a local low-privileged user to trigger memory corruption during device teardown, potentially achieving privilege escalation or kernel panic. The race condition exists because the RX worker's common exit path continues to refill the virtqueue even after rx_run is cleared and virtqueues have been deleted via virtio_vsock_vqs_del(). KASAN-confirmed slab-use-after-free in virtqueue_add_sgs is the direct manifestation. No public exploit or CISA KEV listing at time of analysis; EPSS of 0.22% (13th percentile) reflects low near-term exploitation probability.
Kernel memory disclosure and crash in the Linux kernel's veth driver arises from broken skb length accounting after an XDP program adjusts packet fragments; veth_xdp_rcv_skb() updates skb->data_len but leaves skb->len holding the stale fragment contribution, so skb_headlen() overstates the linear area. On the UDP receive path this caused __skb_datagram_iter() to copy 1024 bytes past the real linear tail into userspace - leaking skb_shared_info contents including nr_frags, xdp_frags_size, and a kernel pointer from frags[0] - while displacing and truncating real packet data. A related path via bpf_xdp_pull_data() leaves the skb non-linear and trips SKB_LINEAR_ASSERT(), crashing the kernel. There is no public exploit identified at time of analysis, and EPSS risk is low (0.21%).
Improper handling of the receive-side message iterator in the Linux kernel's kernel-TLS (kTLS) subsystem lets a remote TLS peer cause recvmsg() to write decrypted bytes into the wrong offsets of a receiver's user-space iovec buffers. When the optimistic TLS 1.3 zero-copy path maps user pages and then falls back to a kernel skb, the iterator is left advanced, so bytes are written a second time past the length recvmsg() reports. Exploitation requires the receiver to have enabled the TLS_RX_EXPECT_NO_PAD socket option; there is no public exploit identified at time of analysis and EPSS is low (0.21%).
Kernel memory corruption in the Linux TLS software path allows an unprivileged local user to trigger a NULL pointer dereference - potentially enabling a kernel crash or privilege escalation. The flaw exists in `tls_sw_sendmsg_locked()`: when the copy path fills the plaintext `sk_msg` scatter-gather ring, it omits setting `full_record`, leaving the full ring unpushed; a subsequent `splice()` call then wraps `sg.end` back to `sg.start`, corrupts live scatterlist entries, and drives the scatterwalk off the end of the list during AES-GCM encryption. No public exploit has been identified and EPSS is 0.21% (11th percentile), but the confirmed kernel memory-corruption primitive and C:H/I:H/A:H CVSS impact make patching urgent for any host where kernel TLS is in use.
Use-after-free race condition in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem allows a local attacker with low-privilege network administration access to corrupt kernel memory, achieving high impact across confidentiality, integrity, and availability. The flaw exists across multiple stable kernel branches from 5.10 through 7.1.x and is triggered by concurrent execution of TIPC bearer teardown against the link supervision timer or receive path. No public exploit or active exploitation has been confirmed; EPSS stands at 0.22% (13th percentile), and patched versions are available across all affected stable series.
Use-after-free in the Linux kernel CIFS/SMB client (cifs_try_adding_channels()) lets a race between SMB multichannel channel setup and an interface-list refresh free an 'iface' object that is then written to via weight_fulfilled, corrupting freed kernel memory. It affects systems that mount SMB shares with multichannel across many stable branches (6.1.x through 6.18.x and 7.x, fixed in 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2). This is a resolved upstream bug with a vendor patch available; there is no public exploit identified at time of analysis and EPSS is low (0.21%).
Race conditions in the Linux kernel KVM/SVM subsystem allow local attackers with low privileges to corrupt the SEV mirror VM list or trigger incorrect reference counting in the hypervisor. Two distinct concurrency flaws exist: sev_migrate_from() modifies the owner's mirror_vms list without holding the owner lock, enabling list corruption when concurrent COPY or destroy operations race with a migration; and sev_vm_destroy() can read a stale enc_context_owner pointer after it changes via a concurrent KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM ioctl, causing kvm_put_kvm() to be called on the wrong VM struct. No public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.21% (11th percentile) reflects the narrow exploitation conditions required.
Use-after-free in the Linux kernel's eventfs subsystem allows a local low-privileged user to corrupt kernel memory by triggering unsafe iterator advancement after recursive child removal in eventfs_remove_rec(). Affected stable branches span Linux 6.6.18 through pre-6.6.152, 6.7.6 through pre-6.8, and related ranges; patched versions (6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2) are available via upstream kernel.org stable commits. No public exploit has been identified at time of analysis and EPSS is very low at 0.21% (11th percentile), though successful exploitation could yield local privilege escalation to root.
Memory corruption in the Linux kernel's eventfs subsystem allows a local low-privileged user to trigger a use-after-free condition via a race between SRCU inode freeing and concurrent list iteration. The root cause is an unsafe union of ei->list with the RCU head, combined with absent memory barriers around the is_freed flag, permitting a racing reader to dereference a pointer that has been overwritten by the RCU freelist mechanism. No public exploit code exists and the CVE is absent from CISA KEV; EPSS of 0.20% (10th percentile) confirms negligible observed exploitation activity, placing real-world risk well below what the 7.8 CVSS score implies.
Use-after-free in the Linux kernel's thermal/hwmon subsystem exposes local attackers to potential kernel memory corruption across a wide range of stable kernel branches. The flaw was introduced by a cosmetic code-style cleanup commit (030a48b0f6ce) that inadvertently removed a valid guard from the error path of thermal_add_hwmon_sysfs(), allowing a freed object to be referenced when the function fails. Patches are backported across six stable kernel series (5.15, 6.1, 6.6, 6.12, 6.18, 7.1, and 7.2); EPSS is low at 0.21% and no active exploitation has been identified.
Out-of-bounds read in the Linux kernel ptp_ocp driver exposes kernel memory and risks availability on systems equipped with OCP PTP time-synchronization hardware. The ptp: ocp driver reads a fixed 13-byte EEPROM board ID field without enforcing a NUL terminator before passing it to devlink_info_version_fixed_put(), causing the function to scan beyond the field boundary as a C string. An attacker with local, low-privilege access on an affected host could trigger this over-read by querying devlink device info, potentially leaking adjacent kernel memory (C:H) or inducing a kernel fault (A:H). No public exploit exists and EPSS is 0.21% (12th percentile), indicating low real-world exploitation activity; however, patches are available across multiple stable kernel branches.
Race condition in the Linux kernel's ring-buffer subsystem (ring_buffer_swap_cpu()) allows a local low-privileged user to trigger inconsistent kernel buffer state, potentially leading to kernel memory corruption or system crash. The flaw exists because the committing counter used to guard against concurrent buffer swaps transiently drops to zero within rb_move_tail(), opening an interrupt-driven window where a swap can succeed mid-write. No public exploit code has been identified at time of analysis, and EPSS of 0.22% (13th percentile) indicates negligible current exploitation pressure - but the local PR:L attack vector with C:H/I:H/A:H impact makes this significant on multi-tenant Linux systems where tracing interfaces are accessible.
Out-of-bounds memory read in the Linux kernel's IPv6 stack exposes up to 8 bytes of adjacent kernel memory per crafted Router Advertisement. The flaw in `rt6_route_rcv()` permits a link-local attacker to send a Route Information option with an RFC 4191-invalid prefix_len/length combination, causing `ipv6_addr_prefix()` to read beyond the option boundary and install the overread bytes as a route prefix visible to unprivileged userspace via `ip -6 route show`. No public exploit has been identified at time of analysis and EPSS is 0.22% (13th percentile), though the attack requires no authentication and only link adjacency.
Kernel-memory corruption in the Linux IPv6-in-IPv6 tunnel driver (ip6_tunnel) lets a remote attacker corrupt skb_shared_info by abusing stale socket control-block metadata during ICMPv6 error handling. Affected systems are Linux hosts terminating an ip6ip6 tunnel where an outer ICMPv6 error carrying a Home Address Option is reflected back through icmpv6_send(); a malformed inner destination-options header then drives an out-of-bounds Home Address Option lookup/swap past the quoted packet. Despite the assigned CVSS of 9.8, EPSS is low (0.22%, 13th percentile), there is no public exploit identified at time of analysis, and there is no CISA KEV listing.
Incorrect idmap context in Linux kernel fscrypt allows a low-privileged local user on an idmapped-mount filesystem to bypass ownership checks when setting fscrypt encryption policies via FSCRYPT_IOC_SET_POLICY, and simultaneously causes legitimate directory owners to be wrongly denied access with EACCES. The flaw affects ext4, f2fs, and other fscrypt-capable filesystems mounted with idmapped-mount configurations - a setup common in container runtimes and rootless Kubernetes node deployments from kernel 5.12 onward. No public exploit is identified at time of analysis, and EPSS of 0.14% (3rd percentile) reflects minimal observed exploitation interest.
Use-after-free in the Linux kernel's PSI (Pressure Stall Information) scheduler subsystem exposes local low-privilege users to potential memory corruption and privilege escalation on affected kernel versions. The race condition between psi_schedule_rtpoll_work(), called locklessly from the scheduler hotpath, and psi_trigger_destroy() allows the rtpoll_timer to be re-armed after the cgroup group has been freed, causing poll_timer_fn() to execute on deallocated memory. Vendor-released patches are available across stable branches 6.1.183, 6.6.152, 6.12.104, 7.1.9, 7.2, and 6.18.45; no public exploit has been identified and EPSS is 0.21%.
The IMA (Integrity Measurement Architecture) subsystem in the Linux kernel fails to invalidate action cache flags (IMA_DONE_MASK) when files are truncated, because the file_truncate and path_truncate LSM hooks were not instantiated in IMA's hook logic. Authenticated local users who can truncate a file covered by an active IMA policy can exploit this gap - causing the kernel to skip re-measurement, re-auditing, and re-appraisal on the next file access, effectively bypassing IMA integrity enforcement for that file. No public exploit has been identified, the vulnerability is absent from CISA KEV, and the EPSS score of 0.21% (11th percentile) reflects very low observed exploitation probability despite the assigned CVSS score of 8.1.
Memory corruption in the Linux kernel page cache (mm/filemap) arises when a race condition in __filemap_add_folio() stores a folio at an incorrect, intermediate rounded-down index after a concurrent thread resolves a conflict during the split-a-conflict retry loop. Affecting large-folio-capable kernels (6.15 onward), the flaw manifested in production as rare SIGILLs and SIGSEGVs with executable text landing a page away from its correct location, and tripped a !folio_contains() assertion under CONFIG_DEBUG_VM. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and it is not listed in CISA KEV; the upstream fix restores the original xas.xa_index before each retry.
Race condition exploitation in the Linux kernel's BPF fsverity interface (bpf_get_fsverity_digest()) enables a local low-privileged attacker to crash the kernel or potentially corrupt memory by racing a concurrent modification of dynptr contents against the kfunc's use of arg->digest_size. Affected are Linux kernel versions from 6.8 through multiple stable branches prior to patched releases 6.12.104, 6.18.45, 7.1.9, and 7.2. No public exploit or active exploitation has been confirmed; EPSS at 0.21% (11th percentile) reflects low near-term exploitation probability, and no CISA KEV listing exists at time of analysis.
Use-after-free race condition in the Linux kernel BPF sockmap subsystem allows a local attacker with access to a sockmap-configured TCP socket to corrupt kernel memory, with high impact on confidentiality, integrity, and availability. The flaw exists in tcp_bpf_send_verdict(), where a local pointer copy of psock->sk_redir is made without incrementing the socket reference count before the source socket lock is released, enabling a concurrent sendmsg() thread to free the socket object while the first thread still holds the stale raw pointer. The vulnerability is confirmed by a full KASAN slab-use-after-free trace; no public exploit identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects low current exploitation probability despite the high CVSS base score.
Denial of service (and potential memory corruption) in the Linux kernel SCTP stack arises because __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport, leaving a dangling pointer once the original transport is RCU-freed via an ASCONF Delete-IP peer removal. A subsequent SACK that reneges the TSN clears tsn_gap_acked, and the next SACK dereferences the freed transport in sctp_check_transmitted(), producing a KASAN-confirmed slab-use-after-free. The issue affects hosts actively using SCTP with dynamic address reconfiguration; it carries a published CVSS of 9.8 but low EPSS (0.22%, 13th percentile), and no public exploit has been identified at time of analysis.
Use-after-free and NULL-pointer dereference in the Linux kernel's SCTP stack allow a remote SCTP peer to corrupt kernel memory or crash the host by triggering association-restart handling that leaves the cached ASCONF chunk pointer (addip_last_asconf) dangling. A delayed authenticated ASCONF-ACK then reaches sctp_sf_do_asconf_ack() and operates on freed memory, causing a second release, while clearing the pointer exposes a companion NULL dereference via a racing T4 timer callback. There is no public exploit identified and EPSS is low (0.22%), consistent with a race-condition kernel bug rather than a turnkey remote exploit despite the 9.8 input score.
A remotely triggerable use-after-free in the Linux kernel's SCTP stack (net/sctp) lets an authenticated SCTP peer read freed transport memory in sctp_outq_select_transport(). By sending an ASCONF chunk that both adds a peer transport and then removes it via a wildcard DEL-IP, the newly added transport is freed while asoc->new_transport still points to it; a later HEARTBEAT and address-replacement sequence dereferences the dangling pointer. There is no public exploit identified at time of analysis, EPSS is low (0.22%), and the flaw is not in CISA KEV, though a reliable private reproducer is described.
Kernel memory disclosure in the Linux bnxt_re RDMA driver (Broadcom NetXtreme RDMA) exposes 4092 bytes of stale kernel data to local users holding InfiniBand device access. The bnxt_re_alloc_ucontext() function allocates the user context shared page with __get_free_page(GFP_KERNEL), which does not zero memory, then maps the page into userspace - leaving all bytes beyond the 4-byte AVID write at offset 0x10 uninitialized and fully readable by the calling process. Exploitation requires only a single mmap() call after IB_USER_VERBS_CMD_GET_CONTEXT, making it trivially scriptable; no public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects low observed exploitation activity.
Symlink escape in NLTK's CorpusReader.open() allows local attackers to read arbitrary files outside the designated corpus root, affecting all versions before 3.9.4. Path boundary validation is performed lexically on the string representation of a path rather than on the resolved filesystem target, so an attacker with write access to the corpus directory can plant a symlink that passes the check yet redirects reads to sensitive files anywhere the host process can access. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.9.4.
Unbounded recursion in NLTK's JSONTaggedDecoder.decode_obj() (nltk/jsontags.py) allows unauthenticated remote attackers to crash the Python process by submitting a deeply nested JSON payload exceeding Python's default recursion limit of 1000. All NLTK releases before 3.9.4 are affected; exploitation depends on whether the calling application exposes JSONTaggedDecoder to externally-supplied JSON input. A public proof-of-concept is included in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Arbitrary file read in NLTK before 3.10.0 stems from a logic defect in FileSystemPathPointer.open() where the sandbox path validation compares a normalized path against itself, rendering the security boundary permanently non-functional rather than conditionally bypassable. Authenticated attackers who can influence calls to nltk.data.load() - for example, via an application that accepts user-supplied resource identifiers - can supply file:// URLs to exfiltrate any file accessible to the process account, including credentials, environment files, and application configuration. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code is identified at time of analysis; however, the trivially exploitable nature of the tautological check warrants prompt patching.
StreamBackedCorpusView in NLTK before 3.10.0 allows arbitrary local file reads by calling Python's builtins.open() directly, fully bypassing the pathsec.ENFORCE security boundary regardless of how that control is configured. Web applications and services built on NLTK that pass externally controlled values to the fileid argument are at risk of having sensitive system files, credentials, and configuration data read by remote attackers. A vendor-released patch is available in NLTK 3.10.0; no public exploit has been identified at time of analysis.
Path traversal and pickle deserialization protections in NLTK before 3.10.0 are effectively disabled by default - pathsec.py sets ENFORCE=False, causing all security validation to emit warnings rather than raise blocking exceptions. Any application using NLTK to process untrusted file paths or serialized data is exposed unless operators have explicitly overridden this default. No public exploit has been identified at time of analysis, but the attack surface is significant wherever NLTK handles attacker-controlled inputs, particularly given that Python pickle deserialization can enable arbitrary code execution.
Path traversal in NLTK's FramenetCorpusReader and NKJPCorpusReader (all versions before 3.10.0) enables unauthenticated network-reachable attackers to read arbitrary XML files accessible to the application process by supplying crafted selectors or poisoned index state to methods including frame_by_name, doc, lu, and header. The CVSS 4.0 score of 8.2 reflects high confidentiality impact (VC:H) tempered by high attack complexity (AC:H) and a required attack target condition (AT:P), meaning exploitation depends on application code that exposes these specific corpus reader methods to external input. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Symlink-based path traversal in NLTK's FramenetCorpusReader before version 3.10.2 permits attackers with write access to a corpus subdirectory to read arbitrary XML files outside the intended corpus root. The flaw exists because path validation in frame_by_name(), _lu_file(), and doc() checks only for path separator characters in filenames but does not resolve symbolic links before access, allowing a separator-free symlink name to bypass the guard and dereference an out-of-root target. No public exploit code or CISA KEV listing has been identified; the provided CVSS 4.0 vector of PR:N/AV:N is inconsistent with the filesystem write prerequisite described and warrants verification with the vendor.
Remote code execution in NLTK's TransitionParser component allows arbitrary OS command execution when a victim loads a crafted transition-parser model file. The AllowlistUnpickler in NLTK before 3.10.3 validated only the module string during deserialization, not the global name - enabling attribute traversal via dotted names (e.g., resolving 'sklearn.os.system' through getattr chaining on an allowlisted 'sklearn' namespace) to reach callable sinks the allowlist never intended to expose. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with no authentication prerequisite reflects significant risk for pipelines that ingest externally-sourced NLP models.
Uncontrolled heap allocation in kin-openapi versions 0.124.0 through 0.141.x allows any unauthenticated remote client to crash a Go API service with a single tiny HTTP request. The `sliceMapToSlice` function in `openapi3filter/req_resp_decoder.go` converts attacker-supplied sparse bracket-indexed array values from a `deepObject` query parameter into a dense slice by allocating one slot for every position from zero to the attacker's chosen index - before schema validation, including `maxItems`, ever executes. A 24-byte request such as `?param[items][50000000]=x` triggers approximately 6.1 GiB of heap allocation across two sequential allocations, causing an OOM kill and sustained service restart loop; no public exploit has been separately released but the vendor advisory GHSA-xhj3-7xw9-vr34 contains the complete vulnerable code path and a working example payload.
Nil pointer dereference in kin-openapi's openapi3filter.ConvertErrors allows any unauthenticated remote client to crash a Go web service with a single HTTP request. Applications using kin-openapi 0.10.0 through 0.140.x that validate multipart/form-data request bodies and render errors through the library-provided ValidationErrorEncoder or ConvertErrors helpers are vulnerable; application/json request bodies are explicitly unaffected by this bug. No public exploit identified at time of analysis, but the published GHSA advisory includes exact code paths and a reproduction test case, making exploitation trivial; the vendor-released fix is available in v0.141.0.
Use-after-free in the Linux kernel's route4 (cls_route) traffic classifier fastmap cache allows a local attacker with CAP_NET_ADMIN to read freed kernel heap memory by racing filter deletion against fastmap cache population, potentially escalating to full kernel compromise. Affected versions span Linux 3.18 through current stable branches; the kernel security team backported fixes to eight LTS/stable lines (5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2). No public exploit identified at time of analysis; EPSS of 0.17% (6th percentile) reflects minimal current exploitation activity, though the theoretical impact is severe given the kernel-level UAF primitive.
Out-of-bounds kernel memory write in the Linux kernel packet socket implementation allows a local low-privilege attacker to corrupt kernel memory by exploiting a race condition between `packet_snd()` reads of `dev->hard_header_len` and concurrent device reconfiguration. When the race is won - for example during a bonding device type change - `skb->data` is positioned before `skb->head`, and the subsequent userspace copy writes beyond the allocated socket buffer, creating a kernel memory corruption primitive suitable for local privilege escalation. No public exploit or CISA KEV listing exists at time of analysis; EPSS of 0.16% reflects very low current exploitation probability, though the primitive is powerful and patch availability across multiple stable branches makes remediation straightforward.
Kernel-level use-after-free in the Linux IPv6 policy-routing (fib6 rules) subsystem allows a suppressed route to leak a released rt6_info back to rt6_lookup() callers, so a subsequent dst_release() operates on freed memory. The flaw affects systems using IPv6 FIB rules with route suppression and realistically manifests as a kernel crash (denial of service) and potential memory corruption. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile); a vendor patch is available across stable trees.
Out-of-bounds host memory access in the Linux kernel vhost subsystem results from a stale metadata cache that is not invalidated when vring addresses or sizes are reconfigured via VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM while a virtqueue is live. Systems running KVM/QEMU virtualization with vhost and a device IOTLB attached - spanning kernel versions from 4.11 through unpatched stable series - are affected, with the scope change (S:C) in the CVSS vector indicating potential read/write access to host memory beyond the vhost subsystem boundary. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (6th percentile), consistent with a complex kernel-internal flaw not yet commoditized.
SSRF in langchain-community's SitemapLoader defeats the documented `restrict_to_same_domain` security control by failing to apply it to nested sitemap index entries, allowing an attacker who influences an ingested sitemap to exfiltrate responses from internal network resources including loopback, link-local, and RFC-1918 addresses. Any LangChain-based pipeline consuming attacker-influenced sitemaps is affected; the CVSS 4.0 score of 7.7 reflects high confidentiality impact on downstream internal systems (SC:H) with no authentication or complexity requirements. No public exploit code has been confirmed and the flaw is not listed in CISA KEV at time of analysis, though the attack path is directly derivable from the vulnerability description.
Catastrophic regex backtracking in NLTK's TweetTokenizer (all versions before 3.10.1) allows unauthenticated remote attackers to stall Python service processes by submitting a few kilobytes of crafted text containing alternating domain label separators. Because TweetTokenizer is explicitly designed to process untrusted social-media input, every public-facing API or pipeline that passes user text through TweetTokenizer.tokenize() or casual_tokenize() is directly exposed to per-request denial of service with no authentication required. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV; the fix is confirmed available in NLTK 3.10.1.
Heap buffer overflow in Capstone's SuperH (SH) architecture floating-point disassembler affects all releases through 6.0.0-Alpha9, allowing a four-byte out-of-bounds write into heap memory when processing crafted SH instructions. The root cause is that opFADD, opFMUL, opFSUB, and related SH FPU decoders in arch/SH/SHDisassembler.c increment op_count as an array index into the fixed-size operands[] array without bounds checking, overflowing the 176-byte sh_info heap allocation. A process that disassembles attacker-controlled SH binary data with the affected mode flags can be crashed; code execution is possible but depends on heap layout. No public exploit has been identified at time of analysis, though a proof-of-concept test case is included in the upstream fix PR. The vendor-released patch is version 6.0.0-Alpha10.
Integer overflow in libvips prior to 8.18.3 allows an attacker who can supply a crafted many-band TIFF image to evade scanline validation in VipsForeignLoadTiff, producing heap-region miscalculations that enable reads or writes at attacker-controlled negative offsets within mmap-resident allocations. Affected deployments include any pipeline - web applications, batch processors, or CLI tools - that pass untrusted TIFF input through libvips, with confirmed impacts of data disclosure via uncompressed .v output and near-certain process crashes; remote code execution has not been demonstrated but is explicitly not ruled out by the vendor. No public exploit or CISA KEV listing exists at time of analysis; the upstream fix is confirmed in v8.18.3.
Sandbox escape in Google Chrome's Linux Toolkit Theming component (prior to 151.0.7922.173) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox via a crafted HTML page. This is a two-stage attack: the renderer must be compromised first, then this CWE-913 flaw in the theming subsystem is leveraged to break out of the sandbox entirely, achieving host-level code execution. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS sits at 0.38% (32nd percentile), consistent with an absence of observed mass exploitation.
Use-after-free in Google Chrome's DOM implementation prior to 151.0.7922.173 enables remote unauthenticated attackers to execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page. The CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact, though execution is constrained within the Chromium sandbox, limiting the blast radius without a secondary escape primitive. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS remains low at 0.38%, suggesting active exploitation is not currently widespread despite the high severity rating.
Remote code execution within the Chrome sandbox is possible via a race condition (TOCTOU) in the V8 JavaScript engine, affecting Google Chrome prior to version 151.0.7922.173. An unauthenticated attacker who persuades a victim to visit a crafted HTML page can trigger the race condition during JavaScript execution, achieving high confidentiality, integrity, and availability impact within the renderer sandbox. No public exploit code has been identified and no CISA KEV listing exists at time of analysis; the EPSS score of 0.28% at the 20th percentile reflects limited observed exploitation activity, consistent with the High attack complexity required to win the race window reliably.
Privilege elevation in Google Chrome's Import feature before version 151.0.7922.173 enables sandbox escape and arbitrary code execution at the OS level, exploitable by a remote attacker who can deliver a crafted file and socially engineer a user into opening it. The vulnerability stems from CWE-250 (Execution with Unnecessary Privileges) within the Import component, yielding full confidentiality, integrity, and availability impact per CVSS C:H/I:H/A:H. No public exploit code has been identified at time of analysis, and SSVC confirms exploitation status as none, though the total technical impact rating and sandbox-escape primitive warrant prompt patching across all Chrome deployments.
Credential exfiltration in RHACM's multicloud-operators-subscription component allows an authenticated tenant with HelmRelease create permissions to bypass Kubernetes namespace isolation by manipulating the `secretRef.Namespace` field, causing the HelmRelease controller to fetch Secrets from arbitrary namespaces and transmit them to an attacker-controlled Helm repository. The CVSS S:C (scope changed) metric confirms this breaks the namespace boundary that Kubernetes multi-tenancy depends on, enabling low-privileged lateral movement across namespace security domains. No public exploit or CISA KEV active exploitation listing is confirmed at time of analysis; however, the attack is mechanically straightforward for any cluster account holding the requisite RBAC permission.
HTTP request smuggling and header injection in libevent's http.c allow remote unauthenticated attackers to desynchronize an upstream proxy from libevent's own parsing, bypassing access controls. Affected are all versions prior to 2.1.13-stable and 2.2.2-alpha, where evhttp_header_is_valid_value accepted obsolete CRLF line folding in header values and evhttp_decode_uri_internal decoded %00 into literal NUL bytes that truncate paths in downstream C string operations. No public exploit identified at time of analysis; the CRLF weakness is patched in 2.1.13/2.2.2-alpha, but the URI NUL-truncation condition is not clearly remediated by the reviewed patches.
HTTP request smuggling in the libevent evhttp server (http.c) affects all versions prior to 2.1.13 and the 2.2.x-alpha line prior to 2.2.2-alpha, letting an unauthenticated remote attacker desynchronize request boundaries when libevent sits behind a differently-framing proxy. Because evhttp mishandles duplicate and comma-listed Transfer-Encoding headers and accepts bare-LF chunk terminators, a smuggled second request can bypass proxy-enforced access controls or poison shared caches. No public exploit identified at time of analysis, and this is not listed in CISA KEV; a vendor patch is available.
Uncontrolled resource consumption in jsoup through version 1.23.2 allows remote unauthenticated attackers to crash JVM-based applications by submitting deeply nested XML with unique namespace declarations per element. The XmlTreeBuilder component copied the full inherited namespace HashMap at every XML start element, producing O(n²) time and memory growth that exhausts heap and triggers an OutOfMemoryError. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the CVSS 4.0 score of 8.7 reflects zero authentication or complexity barriers - any application that feeds user-supplied XML through jsoup is directly at risk.
Privilege escalation in Ubuntu's accountsservice package allows a local low-privileged user to execute arbitrary shell commands as root (real UID 0) by injecting a GNU sed 'e' flag payload into their ~/.pam_environment LANGUAGE entry, which is then processed unsanitized by Ubuntu-specific helper scripts (save-to-pam-env, update-langlist) when the SetLanguage D-Bus method is invoked. All Ubuntu accountsservice packages before version 23.13.9-8ubuntu7 are affected; this is a Ubuntu-specific packaging defect, not an upstream accountsservice issue. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack path is well-described and technically straightforward.
Local privilege escalation in Ubuntu's AccountsService (before 23.13.9-8ubuntu7) lets any low-privileged local user gain full root access by exploiting an incomplete privilege-drop in a Canonical-specific patch. The patch sets the effective UID/GID to the target user before launching language helper scripts but neglects to change the real UID, leaving ruid=0. Any shell spawned by a helper script can call setuid(0) to restore root effective privileges, granting complete system compromise. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
FreeIPA's Kerberos Ticket Granting Service fails to verify Privilege Attribute Certificate (PAC) signatures when processing cross-realm tickets from a trusted Active Directory domain, allowing any authenticated AD user to impersonate arbitrary FreeIPA principals. This grants unauthorized elevated access to FreeIPA services including the web portal, SMB server, and LDAP directory. No active exploitation is confirmed (not in CISA KEV; SSVC Exploitation: none), though SSVC rates technical impact as total and CVSS scores 8.1 - the gap reflects the non-default trust configuration prerequisite that limits real-world exposure.
Stack buffer overflow in GNU binutils 2.46.1 and earlier allows arbitrary code execution when a victim opens a crafted PE (Portable Executable) file using any binutils tool such as objdump or readelf. The out-of-bounds stack write (CWE-787) can corrupt return addresses, enabling attacker-controlled code execution in the victim's user context. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 7.8 High rating reflects full confidentiality, integrity, and availability impact if successfully exploited.
Wireshark's H.245 protocol dissector crashes on malformed H.245 packets across versions 4.6.0-4.6.7 and 4.4.0-4.4.17, enabling unauthenticated remote denial of service against any analyst actively capturing H.323 multimedia traffic. The null pointer dereference (CWE-476) is triggered automatically during dissection, requiring no user interaction beyond running Wireshark on a monitored network. No active exploitation or public proof-of-concept has been identified; EPSS probability sits at 0.10% (1st percentile) and SSVC classifies exploitation as none.
Denial of service in the Wireshark ESS protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, allowing a remote unauthenticated attacker to crash Wireshark by injecting crafted packets into a network segment under active capture. The root cause is CWE-457 (use of an uninitialized variable) in the ESS dissector, which triggers an unhandled crash on malformed ESS traffic. No CISA KEV listing or public exploit has been identified; an EPSS score of 0.25% (16th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world exploitation likelihood despite the high CVSS base score.
Wireshark's C12.22 protocol dissector crashes via a stack-based buffer overflow when processing malformed C12.22 packets, enabling unauthenticated remote denial of service against versions 4.4.0-4.4.18 and 4.6.0-4.6.7. An attacker who can inject crafted C12.22 traffic into a live capture session - or supply a malicious PCAP file - can crash the analyzer process, blinding the analyst to network activity. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in available intelligence.
Heap-based buffer overflow in Wireshark's RDP protocol dissector (CWE-122) crashes the application when processing malformed RDP traffic, causing denial of service across two active release branches. Affected versions span 4.4.0-4.4.17 and 4.6.0-4.6.7 of the Wireshark Foundation's Wireshark (CPE: cpe:2.3:a:wireshark_foundation:wireshark). A proof-of-concept exists per SSVC data, though EPSS (0.17%, 7th percentile) and SSVC's 'Automatable: no' assessment indicate real-world mass exploitation is not occurring; no public exploit identified at time of analysis beyond the poc designation, and the flaw is absent from CISA KEV.
Denial of service in Wireshark's C12.22 protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, where a malformed C12.22 packet triggers a heap buffer overflow (CWE-122) that crashes the application. An attacker who can get crafted traffic in front of a capturing or file-loading analyst can reliably terminate the dissection session. A proof-of-concept is reported via SSVC, but there is no evidence of active exploitation, and the EPSS probability is low (0.27%).
Path traversal in BuildKit prior to v0.31.2 enables an authenticated API client to escape the daemon's controlled state directory by submitting a crafted upload request containing traversal sequences. Affected parties include any deployment where multiple principals share BuildKit API access - such as multi-tenant CI/CD infrastructure or shared Docker build environments. The vulnerability grants a write primitive to arbitrary host filesystem locations, posing high integrity and availability risk; no public exploit or CISA KEV listing has been identified at time of analysis.
Kernel memory corruption in the Linux inet fragment (inet_frag) subsystem arises from a race in inet_frag_create(), which arms the fragment-queue timer before publishing the queue into the fqdir rhashtable. When a network namespace has a fragment timeout of zero or negative, the timer can fire on an unpublished queue, mark it complete, and drop an anticipated hash reference that is never restored, leaving a stale hash node and a use-after-free-style reference imbalance. No public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.21%, 11th percentile), and exploitation depends on a non-default namespace configuration rather than default deployments.
Use-after-free in the Linux kernel's mac802154 (IEEE 802.15.4) subsystem allows a local low-privileged attacker to dereference freed netdev memory, potentially achieving kernel memory corruption and privilege escalation. The race window opens when mac802154_beacon_worker() drops the RCU read lock while still holding references to sdata and wpan_dev, and a concurrent interface teardown via mac802154_stop_beacons_locked() frees those structures before the worker completes. EPSS is very low at 0.21% (11th percentile) and no active exploitation or public exploit code has been identified at time of analysis; practical exploitation is limited by mac802154 hardware availability and the race condition timing requirement.
Use-after-free in the Linux kernel netfilter ebt_nflog subsystem allows a local attacker with low privileges to trigger kernel memory corruption by racing ebtables NFLOG rule execution against nfnetlink_log module teardown. Affected kernels from version 4.12 through multiple stable branches (pre-patch) fail to acquire a module reference on the nfnetlink_log backend before invoking nfulnl_log_packet(), unlike the xt_NFLOG and nft_log frontends. KASAN-confirmed heap use-after-free at instance_lookup_get_rcu can result in full kernel compromise (C:H/I:H/A:H). No public exploit identified at time of analysis; EPSS at 0.22% (13th percentile) reflects low near-term exploitation probability.
Use-after-free race condition in the Linux kernel's IPv4 routing subsystem allows a local low-privileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw is in fib_nhc_update_mtu(), which traverses the PMTU nexthop exception (FNHE) table without proper serialization against concurrent FNHE eviction, creating a window where freed memory is accessed after a completed RCU grace period. No public exploit code has been identified at time of analysis, and an EPSS of 0.22% (13th percentile) reflects very low near-term exploitation probability despite the 7.8 CVSS score.
TX DMA buffer mismanagement in the Linux kernel's Qualcomm GENI serial driver (qcom-geni) allows a local low-privileged user to hang the system indefinitely and potentially corrupt kernel memory on affected Qualcomm hardware. The driver's DMA-mode uart_ops lacks a flush_buffer callback, enabling in-flight DMA transfers to underflow the transmit kfifo and re-submit page-sized transfers indefinitely; a concurrent flaw in the stop path unmaps the DMA buffer while the serial engine is still reading it. No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile), but the user-triggerable hang and DMA use-after-unmap represent a real availability and potential integrity risk on affected Qualcomm platforms.
Use-after-free race condition in the Linux kernel's amba-pl011 serial driver allows a local unprivileged user on ARM-based hardware to corrupt kernel memory, potentially escalating to full system compromise. The RS485 hrtimers embedded in the devm-managed port structure can fire after the port is freed, and the IRQ handler can arm a timer immediately before teardown, creating the race window. No public exploit exists and EPSS is 0.21% (11th percentile), but kernel-level use-after-free primitives are well-understood exploitation targets and patched stable releases are available.
Out-of-bounds read in the Linux kernel's staging RTL8723BS WiFi driver allows adjacent-network unauthenticated attackers to leak kernel heap memory or crash the affected system by transmitting a crafted 802.11 management frame. The flaw lives in rtw_get_wpa_ie(), which accesses fixed byte offsets within a vendor-specific information element without verifying the IE body is at least 6 bytes long, enabling reads past the end of a kmemdup'd allocation when a short trailing IE is present. No active exploitation is confirmed (absent from CISA KEV) and EPSS sits at 0.22% (13th percentile), but the adjacent-network, no-authentication attack vector represents a meaningful risk for embedded and single-board systems carrying RTL8723BS hardware.
Buffer overflow and stale-memory disclosure in the Linux kernel's staging rtl8723bs WiFi driver allow a malicious access point within radio range to corrupt kernel memory or leak sensitive buffer contents before any association occurs. The flaw resides in OnAuthClient(), which copies a WLAN_EID_CHALLENGE element's attacker-controlled length - up to 255 bytes - into a fixed 128-byte chg_txt buffer via memcpy(), enabling an overflow of up to 127 bytes or an underfill that echoes stale kernel memory. No public exploit has been identified at time of analysis and EPSS probability is low (0.26%, 18th percentile), but the adjacent-network unauthenticated attack vector and High impact across confidentiality, integrity, and availability make this a notable risk for any deployment relying on WEP shared-key authentication with this chipset.
Out-of-bounds reads in the staging rtl8723bs WiFi driver's monitor mode transmit path expose Linux kernel systems equipped with Realtek RTL8723BS hardware to memory disclosure, corruption, and denial of service. The driver function rtw_cfg80211_monitor_if_xmit_entry() strips the variable-length radiotap header and then reads the 802.11 frame control field without verifying the socket buffer still contains a minimum MAC header; for data frames it additionally pulls the full calculated 802.11/QoS/SNAP span before confirming the skb holds that much data. A local attacker with low privileges can inject a truncated 802.11 frame to trigger the flaw; no public exploit has been identified at time of analysis and EPSS stands at 0.22%, indicating low automated exploitation probability.
Race condition in the Linux kernel fastrpc driver allows a local low-privileged attacker on Qualcomm DSP-equipped systems to trigger a use-after-free condition by issuing concurrent munmap ioctls, potentially achieving kernel memory corruption and privilege escalation. The flaw exists in `fastrpc_req_munmap_impl()` where the internal buffer list is updated only after the DSP unmap completes, leaving a window in which a concurrent thread can operate on an already-unmapped entry. No public exploit or CISA KEV listing exists at time of analysis, and EPSS remains low at 0.21%, indicating limited observed exploitation activity.
Unprotected list manipulation in the Linux kernel FastRPC subsystem allows a local low-privileged attacker on Qualcomm-based systems to race a signal-interrupted DSP invoke operation against concurrent mmap/munmap operations. The missing `fl->lock` acquisition in `fastrpc_internal_invoke()` during the interrupt path creates a concurrent modification hazard on `fl->mmaps`, potentially yielding kernel memory corruption with full confidentiality, integrity, and availability impact. No public exploit has been identified and EPSS is 0.21% (11th percentile); this CVE is not listed in the CISA KEV catalog.
Unbounded kernel memory access in the Linux kernel's ALSA usx2y driver allows a local user with access to a Tascam US-X2Y USB audio device's hwdep node to read from and write to arbitrary kernel memory pages via a crafted mmap() call with an out-of-bounds page offset. The snd_usb_usx2y module has carried this flaw since Linux 2.6.12; no Linux capability check (CAP_SYS_ADMIN, etc.) is required - only DAC permission to the hwdep character node after completing a mandatory FPGA image upload sequence. The exploit primitive is sufficient for local privilege escalation, but real-world risk is tightly bounded by the requirement for a physically attached Tascam US-X2Y device; no public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.21% (12th percentile) reflects this narrow hardware prerequisite accurately.
Out-of-bounds slab write in the Linux kernel ALSA FCP (FireWire Control Protocol) driver allows local unprivileged processes to corrupt up to 888 bytes of adjacent kernel heap memory by reading audio controls on /dev/snd/controlC0, once a privileged actor has installed an oversized Level Meter map. The mismatch between the driver's 255-entry map limit and the 128-entry ABI array in struct snd_ctl_elem_value creates a persistent, exploitable write primitive reachable by any process with device read access. No public exploit has been identified and no active exploitation is confirmed; vendor-released patches are available in Linux 7.2, 7.1.9, and 6.18.45.
Use-after-free in the Linux kernel perf/core subsystem allows a local low-privileged user to dereference freed kernel memory by racing CPU hot-unplug against perf event group management. When a sibling event is detached via DETACH_GROUP during CPU hotplug, its group_leader pointer is not reset; if the leader is subsequently freed while the sibling's file descriptor remains open, a PERF_IOC_FLAG_GROUP ioctl on the sibling follows the stale pointer into freed memory, potentially enabling kernel crash or privilege escalation to root. No public exploit has been identified at time of analysis and EPSS is low at 0.21% (11th percentile), but the local exploit path with full C:H/I:H/A:H impact warrants prompt patching, particularly on systems permitting unprivileged perf_event_open access.
Out-of-bounds memory read in the Linux kernel's fbdev bitblit subsystem allows a local attacker with tty group write access to /dev/vcsa to crash the kernel or disclose kernel memory by supplying an out-of-range glyph index through the virtual console screen interface. The root cause is a missing bounds check in bit_cursor() in drivers/video/fbdev/core/bitblit.c - a sibling function to bit_putcs_aligned() and bit_putcs_unaligned(), which already received the same clamp in commit 18c4ef4e765a. No public exploit has been released and EPSS of 0.22% (13th percentile) indicates very low active exploitation probability; this is not in CISA KEV.
Use-after-free in the Linux kernel's ring-buffer tracing subsystem exposes non-consuming reader iterators to dangling memory when subbuffer order changes occur while resizing is disabled. The vulnerable function ring_buffer_subbuf_order_set() frees buffer pages without checking the resize_disabled flag, leaving rb_advance_iter() holding stale references to freed memory. Exploitation requires local low-privilege access; no public exploit or CISA KEV listing exists, but vendor patches are available across multiple stable kernel branches.
Race condition in the Linux kernel's mm/huge_memory subsystem allows local low-privilege users to trigger misidentification of the huge zero folio as an ordinary Transparent Huge Page (THP), potentially leading to memory corruption, incorrect folio splitting, and privilege escalation. Affected kernels spanning multiple stable branches from at least 4.19 onward are vulnerable when !CONFIG_PERSISTENT_HUGE_ZERO_FOLIO is in effect, with patched versions available for 6.12, 6.18, 7.1, and 7.2 stable series. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog; EPSS places exploitation probability at the 11th percentile.
Use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local attacker to trigger kernel memory corruption via a refcount underflow in smc_rx_splice(). The flaw arises because pages are handed to splice_to_pipe() before page and socket references are taken, so entries dropped by smc_rx_spd_release() are released without a matching reference, and multi-page splices pair one sock_hold() with multiple sock_put() calls. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.21% (12th percentile), consistent with limited real-world weaponization at this time.
Use-after-free in the Linux kernel's IPv6 stack allows a local low-privileged user to corrupt kernel memory with full high/integrity/availability impact. The race condition exists in in6_dev_get(), where dev->ip6_ptr is read under RCU and its refcount is then unconditionally incremented - device teardown can zero the pointer and drop the final reference between those two operations, resurrecting a freed inet6_dev object. No public exploit identified at time of analysis, though a proof-of-concept reproducer was confirmed functional on the unpatched v7.2-rc3 kernel by OpenAI Security Research and validated by Trail of Bits.
Use-after-free and double-free memory corruption in the Linux kernel's net/dibs network subsystem allows an adjacent network attacker to trigger kernel memory corruption via a race condition between the dibs device interrupt handler and device teardown. The UAF arises because an active interrupt handler can continue accessing dmb_clientid_arr after dibs_dev_del() releases it; a separate double-free path exists when dibs_dev_add() fails during dibs_lo_dev_probe(). No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile), indicating low exploitation likelihood despite the high CVSS score.
Local privilege-relevant kernel memory corruption in the Linux kernel's net/x25 subsystem arises because X.25 socket timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket. The x25_heartbeat_expiry() handler rearms unconditionally and can reinstall sk->sk_timer after __x25_destroy_socket() passes its cancel point, letting a subsequent expiry dereference the kmalloc-2k socket object already freed by close() - a use-after-free confirmed by KASAN. Exploitation requires the ability to create AF_X25 sockets on a host with X.25 support loaded; no active exploitation and no public exploit code have been identified, and EPSS probability is low (0.21%).
Linux kernel zero-copy networking in zerocopy_fill_skb_from_devmem() permits improper mixing of net_iov (device memory) and page-backed fragments within a single socket buffer (skb), causing type confusion and memory corruption in downstream kernel networking code. Affected are kernels from introducing commit bd61848900bff5 across the 6.18.x and 7.x stable series until the respective patch commits were applied. No public exploit or active exploitation is confirmed at time of analysis (EPSS 0.21%, no CISA KEV listing), but the local CVSS 7.8 score reflects credible kernel-level memory corruption risk for systems where devmem TCP zero-copy is configured and in use.
Reception stall denial-of-service in the Linux kernel's ntb_netdev driver allows remote unauthenticated attackers to progressively exhaust the NTB network interface's RX queue by triggering repeated memory allocation failures during packet reception, ultimately halting all inbound packet delivery while the interface remains administratively up. Systems with NTB-capable PCIe hardware (Non-Transparent Bridge interconnects) running affected kernel versions are at risk; standard Linux deployments without this hardware are entirely unaffected. No public exploit has been identified at time of analysis, and EPSS sits at the 10th percentile, consistent with the specialized hardware prerequisite; upstream stable commits confirming the fix are publicly available.
Memory exhaustion in the Linux kernel's netfilter bridge subsystem allows network-adjacent unauthenticated attackers to cause denial of service by sending non-IP Ethernet frames through a bridge host configured with nftables conntrack zone set rules. The root cause is that nf_ct_bridge_pre() overwrites skb->_nfct with IP_CT_UNTRACKED for non-IPv4/non-IPv6 EtherTypes without releasing the existing conntrack template reference, leaking slab memory indefinitely until the host exhausts kernel memory. No public exploit exists and EPSS is 0.22% (13th percentile), indicating low real-world exploitation likelihood despite the High availability impact rating; risk is further bounded by the requirement for a specific non-default nftables configuration.
Deadlock in the Linux kernel's netfilter nf_conntrack subsystem can be triggered remotely by sending malformed TCP or SCTP packets when nfnetlink_log with conntrack export is active as the logging target. The logging emission path re-enters conntrack netlink glue code and attempts to re-acquire ct->lock already held by the conntrack processing path, causing a kernel deadlock and system-wide denial of service. No exploit code is publicly available and EPSS stands at 0.21% (11th percentile), indicating very low current exploitation activity; patches for multiple stable kernel branches are confirmed available.
Unbounded kernel memory exhaustion in the Linux kernel's traffic control connection tracking action (act_ct) allows unauthenticated remote attackers to leak one sk_buff plus its data buffer per malformed IP packet on systems with a clsact TC chain configured with 'action ct'. The defect in tcf_ct_act() causes error paths from header sanity checks to return TC_ACT_CONSUMED - signaling ownership transfer - while the sk_buff is still owned by the caller and never freed, resulting in progressive kernel memory exhaustion. No public exploit has been identified at time of analysis; EPSS is low at 0.21% (percentile 11%), and the vulnerability is not in CISA KEV.
Improper initialization ordering in the Linux kernel's dibs (Direct Internal Buffer Sharing) subsystem leaves dibs->lock uninitialized during early ISM device probe, so a GID-event interrupt arriving between ism_dev_init()/request_irq() and dibs_dev_add() causes ism_handle_irq() to acquire an uninitialized spinlock. This affects s390 systems using ISM/SMC-D devices and can lead to undefined locking behavior and kernel instability. EPSS is low (0.21%), no public exploit is identified, and the issue is a robustness/race fix rather than a remotely triggerable flaw despite the input's 9.8 rating.
Memory corruption in the Linux kernel's XDP (eXpress Data Path) broadcast-redirect path allows corruption of kernel skb_shared_info metadata when cloned XDP frames are converted back into socket buffers. xdpf_clone() packs broadcast copies into a single page with frame_sz set to PAGE_SIZE, but the existing bounds check fails to account for the shared-info tailroom, so a source frame from a larger allocation can extend into the clone's required shared-info area; build_skb_around() then writes skb_shared_info over live packet bytes. The issue is fixed and carries a vendor CVSS of 9.8, but with a low EPSS of 0.21% (12th percentile) and no public exploit identified at time of analysis, real-world risk is far narrower than the base score implies because a non-default XDP broadcast-redirect configuration is required.
Use-after-free in the Linux kernel VXLAN driver allows a local, low-privileged user to corrupt kernel memory, potentially escalating to full kernel compromise. The flaw exists in vxlan_changelink(), which arms age_timer without checking whether the device is up via netif_running(); when the device is subsequently deleted, free_netdev() releases the vxlan_dev struct - including the embedded timer - while that timer remains queued on a timer_base. Because the rtnl operations are netns-scoped, an unprivileged user can trigger the entire sequence inside a new user and network namespace without elevated system privileges. No public exploit or CISA KEV entry is identified at time of analysis; EPSS of 0.22% (13th percentile) reflects low current exploitation activity, though the local-user-namespace reachability makes this a meaningful local privilege escalation risk on any Linux system permitting user namespace creation.
Use-after-free memory corruption in the Linux kernel vsock/virtio subsystem arises from a race condition between virtqueue worker threads and VM suspend/resume cycles. Worker threads (RX, TX, event) read their virtqueue pointer before acquiring the protective mutex and checking the run flag; a worker delayed across a freeze/restore transition retains a dangling pointer to a freed queue while the restoration installs replacement queues. No public exploit has been identified and EPSS probability is low at 0.21%, though successful exploitation could yield full kernel-level memory corruption with high confidentiality, integrity, and availability impact.
Use-after-free in the Linux kernel vsock/virtio RX worker allows a local low-privileged user to trigger memory corruption during device teardown, potentially achieving privilege escalation or kernel panic. The race condition exists because the RX worker's common exit path continues to refill the virtqueue even after rx_run is cleared and virtqueues have been deleted via virtio_vsock_vqs_del(). KASAN-confirmed slab-use-after-free in virtqueue_add_sgs is the direct manifestation. No public exploit or CISA KEV listing at time of analysis; EPSS of 0.22% (13th percentile) reflects low near-term exploitation probability.
Kernel memory disclosure and crash in the Linux kernel's veth driver arises from broken skb length accounting after an XDP program adjusts packet fragments; veth_xdp_rcv_skb() updates skb->data_len but leaves skb->len holding the stale fragment contribution, so skb_headlen() overstates the linear area. On the UDP receive path this caused __skb_datagram_iter() to copy 1024 bytes past the real linear tail into userspace - leaking skb_shared_info contents including nr_frags, xdp_frags_size, and a kernel pointer from frags[0] - while displacing and truncating real packet data. A related path via bpf_xdp_pull_data() leaves the skb non-linear and trips SKB_LINEAR_ASSERT(), crashing the kernel. There is no public exploit identified at time of analysis, and EPSS risk is low (0.21%).
Improper handling of the receive-side message iterator in the Linux kernel's kernel-TLS (kTLS) subsystem lets a remote TLS peer cause recvmsg() to write decrypted bytes into the wrong offsets of a receiver's user-space iovec buffers. When the optimistic TLS 1.3 zero-copy path maps user pages and then falls back to a kernel skb, the iterator is left advanced, so bytes are written a second time past the length recvmsg() reports. Exploitation requires the receiver to have enabled the TLS_RX_EXPECT_NO_PAD socket option; there is no public exploit identified at time of analysis and EPSS is low (0.21%).
Kernel memory corruption in the Linux TLS software path allows an unprivileged local user to trigger a NULL pointer dereference - potentially enabling a kernel crash or privilege escalation. The flaw exists in `tls_sw_sendmsg_locked()`: when the copy path fills the plaintext `sk_msg` scatter-gather ring, it omits setting `full_record`, leaving the full ring unpushed; a subsequent `splice()` call then wraps `sg.end` back to `sg.start`, corrupts live scatterlist entries, and drives the scatterwalk off the end of the list during AES-GCM encryption. No public exploit has been identified and EPSS is 0.21% (11th percentile), but the confirmed kernel memory-corruption primitive and C:H/I:H/A:H CVSS impact make patching urgent for any host where kernel TLS is in use.
Use-after-free race condition in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem allows a local attacker with low-privilege network administration access to corrupt kernel memory, achieving high impact across confidentiality, integrity, and availability. The flaw exists across multiple stable kernel branches from 5.10 through 7.1.x and is triggered by concurrent execution of TIPC bearer teardown against the link supervision timer or receive path. No public exploit or active exploitation has been confirmed; EPSS stands at 0.22% (13th percentile), and patched versions are available across all affected stable series.
Use-after-free in the Linux kernel CIFS/SMB client (cifs_try_adding_channels()) lets a race between SMB multichannel channel setup and an interface-list refresh free an 'iface' object that is then written to via weight_fulfilled, corrupting freed kernel memory. It affects systems that mount SMB shares with multichannel across many stable branches (6.1.x through 6.18.x and 7.x, fixed in 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2). This is a resolved upstream bug with a vendor patch available; there is no public exploit identified at time of analysis and EPSS is low (0.21%).
Race conditions in the Linux kernel KVM/SVM subsystem allow local attackers with low privileges to corrupt the SEV mirror VM list or trigger incorrect reference counting in the hypervisor. Two distinct concurrency flaws exist: sev_migrate_from() modifies the owner's mirror_vms list without holding the owner lock, enabling list corruption when concurrent COPY or destroy operations race with a migration; and sev_vm_destroy() can read a stale enc_context_owner pointer after it changes via a concurrent KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM ioctl, causing kvm_put_kvm() to be called on the wrong VM struct. No public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.21% (11th percentile) reflects the narrow exploitation conditions required.
Use-after-free in the Linux kernel's eventfs subsystem allows a local low-privileged user to corrupt kernel memory by triggering unsafe iterator advancement after recursive child removal in eventfs_remove_rec(). Affected stable branches span Linux 6.6.18 through pre-6.6.152, 6.7.6 through pre-6.8, and related ranges; patched versions (6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2) are available via upstream kernel.org stable commits. No public exploit has been identified at time of analysis and EPSS is very low at 0.21% (11th percentile), though successful exploitation could yield local privilege escalation to root.
Memory corruption in the Linux kernel's eventfs subsystem allows a local low-privileged user to trigger a use-after-free condition via a race between SRCU inode freeing and concurrent list iteration. The root cause is an unsafe union of ei->list with the RCU head, combined with absent memory barriers around the is_freed flag, permitting a racing reader to dereference a pointer that has been overwritten by the RCU freelist mechanism. No public exploit code exists and the CVE is absent from CISA KEV; EPSS of 0.20% (10th percentile) confirms negligible observed exploitation activity, placing real-world risk well below what the 7.8 CVSS score implies.
Use-after-free in the Linux kernel's thermal/hwmon subsystem exposes local attackers to potential kernel memory corruption across a wide range of stable kernel branches. The flaw was introduced by a cosmetic code-style cleanup commit (030a48b0f6ce) that inadvertently removed a valid guard from the error path of thermal_add_hwmon_sysfs(), allowing a freed object to be referenced when the function fails. Patches are backported across six stable kernel series (5.15, 6.1, 6.6, 6.12, 6.18, 7.1, and 7.2); EPSS is low at 0.21% and no active exploitation has been identified.
Out-of-bounds read in the Linux kernel ptp_ocp driver exposes kernel memory and risks availability on systems equipped with OCP PTP time-synchronization hardware. The ptp: ocp driver reads a fixed 13-byte EEPROM board ID field without enforcing a NUL terminator before passing it to devlink_info_version_fixed_put(), causing the function to scan beyond the field boundary as a C string. An attacker with local, low-privilege access on an affected host could trigger this over-read by querying devlink device info, potentially leaking adjacent kernel memory (C:H) or inducing a kernel fault (A:H). No public exploit exists and EPSS is 0.21% (12th percentile), indicating low real-world exploitation activity; however, patches are available across multiple stable kernel branches.
Race condition in the Linux kernel's ring-buffer subsystem (ring_buffer_swap_cpu()) allows a local low-privileged user to trigger inconsistent kernel buffer state, potentially leading to kernel memory corruption or system crash. The flaw exists because the committing counter used to guard against concurrent buffer swaps transiently drops to zero within rb_move_tail(), opening an interrupt-driven window where a swap can succeed mid-write. No public exploit code has been identified at time of analysis, and EPSS of 0.22% (13th percentile) indicates negligible current exploitation pressure - but the local PR:L attack vector with C:H/I:H/A:H impact makes this significant on multi-tenant Linux systems where tracing interfaces are accessible.
Out-of-bounds memory read in the Linux kernel's IPv6 stack exposes up to 8 bytes of adjacent kernel memory per crafted Router Advertisement. The flaw in `rt6_route_rcv()` permits a link-local attacker to send a Route Information option with an RFC 4191-invalid prefix_len/length combination, causing `ipv6_addr_prefix()` to read beyond the option boundary and install the overread bytes as a route prefix visible to unprivileged userspace via `ip -6 route show`. No public exploit has been identified at time of analysis and EPSS is 0.22% (13th percentile), though the attack requires no authentication and only link adjacency.
Kernel-memory corruption in the Linux IPv6-in-IPv6 tunnel driver (ip6_tunnel) lets a remote attacker corrupt skb_shared_info by abusing stale socket control-block metadata during ICMPv6 error handling. Affected systems are Linux hosts terminating an ip6ip6 tunnel where an outer ICMPv6 error carrying a Home Address Option is reflected back through icmpv6_send(); a malformed inner destination-options header then drives an out-of-bounds Home Address Option lookup/swap past the quoted packet. Despite the assigned CVSS of 9.8, EPSS is low (0.22%, 13th percentile), there is no public exploit identified at time of analysis, and there is no CISA KEV listing.
Incorrect idmap context in Linux kernel fscrypt allows a low-privileged local user on an idmapped-mount filesystem to bypass ownership checks when setting fscrypt encryption policies via FSCRYPT_IOC_SET_POLICY, and simultaneously causes legitimate directory owners to be wrongly denied access with EACCES. The flaw affects ext4, f2fs, and other fscrypt-capable filesystems mounted with idmapped-mount configurations - a setup common in container runtimes and rootless Kubernetes node deployments from kernel 5.12 onward. No public exploit is identified at time of analysis, and EPSS of 0.14% (3rd percentile) reflects minimal observed exploitation interest.
Use-after-free in the Linux kernel's PSI (Pressure Stall Information) scheduler subsystem exposes local low-privilege users to potential memory corruption and privilege escalation on affected kernel versions. The race condition between psi_schedule_rtpoll_work(), called locklessly from the scheduler hotpath, and psi_trigger_destroy() allows the rtpoll_timer to be re-armed after the cgroup group has been freed, causing poll_timer_fn() to execute on deallocated memory. Vendor-released patches are available across stable branches 6.1.183, 6.6.152, 6.12.104, 7.1.9, 7.2, and 6.18.45; no public exploit has been identified and EPSS is 0.21%.
The IMA (Integrity Measurement Architecture) subsystem in the Linux kernel fails to invalidate action cache flags (IMA_DONE_MASK) when files are truncated, because the file_truncate and path_truncate LSM hooks were not instantiated in IMA's hook logic. Authenticated local users who can truncate a file covered by an active IMA policy can exploit this gap - causing the kernel to skip re-measurement, re-auditing, and re-appraisal on the next file access, effectively bypassing IMA integrity enforcement for that file. No public exploit has been identified, the vulnerability is absent from CISA KEV, and the EPSS score of 0.21% (11th percentile) reflects very low observed exploitation probability despite the assigned CVSS score of 8.1.
Memory corruption in the Linux kernel page cache (mm/filemap) arises when a race condition in __filemap_add_folio() stores a folio at an incorrect, intermediate rounded-down index after a concurrent thread resolves a conflict during the split-a-conflict retry loop. Affecting large-folio-capable kernels (6.15 onward), the flaw manifested in production as rare SIGILLs and SIGSEGVs with executable text landing a page away from its correct location, and tripped a !folio_contains() assertion under CONFIG_DEBUG_VM. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and it is not listed in CISA KEV; the upstream fix restores the original xas.xa_index before each retry.
Race condition exploitation in the Linux kernel's BPF fsverity interface (bpf_get_fsverity_digest()) enables a local low-privileged attacker to crash the kernel or potentially corrupt memory by racing a concurrent modification of dynptr contents against the kfunc's use of arg->digest_size. Affected are Linux kernel versions from 6.8 through multiple stable branches prior to patched releases 6.12.104, 6.18.45, 7.1.9, and 7.2. No public exploit or active exploitation has been confirmed; EPSS at 0.21% (11th percentile) reflects low near-term exploitation probability, and no CISA KEV listing exists at time of analysis.
Use-after-free race condition in the Linux kernel BPF sockmap subsystem allows a local attacker with access to a sockmap-configured TCP socket to corrupt kernel memory, with high impact on confidentiality, integrity, and availability. The flaw exists in tcp_bpf_send_verdict(), where a local pointer copy of psock->sk_redir is made without incrementing the socket reference count before the source socket lock is released, enabling a concurrent sendmsg() thread to free the socket object while the first thread still holds the stale raw pointer. The vulnerability is confirmed by a full KASAN slab-use-after-free trace; no public exploit identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects low current exploitation probability despite the high CVSS base score.
Denial of service (and potential memory corruption) in the Linux kernel SCTP stack arises because __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport, leaving a dangling pointer once the original transport is RCU-freed via an ASCONF Delete-IP peer removal. A subsequent SACK that reneges the TSN clears tsn_gap_acked, and the next SACK dereferences the freed transport in sctp_check_transmitted(), producing a KASAN-confirmed slab-use-after-free. The issue affects hosts actively using SCTP with dynamic address reconfiguration; it carries a published CVSS of 9.8 but low EPSS (0.22%, 13th percentile), and no public exploit has been identified at time of analysis.
Use-after-free and NULL-pointer dereference in the Linux kernel's SCTP stack allow a remote SCTP peer to corrupt kernel memory or crash the host by triggering association-restart handling that leaves the cached ASCONF chunk pointer (addip_last_asconf) dangling. A delayed authenticated ASCONF-ACK then reaches sctp_sf_do_asconf_ack() and operates on freed memory, causing a second release, while clearing the pointer exposes a companion NULL dereference via a racing T4 timer callback. There is no public exploit identified and EPSS is low (0.22%), consistent with a race-condition kernel bug rather than a turnkey remote exploit despite the 9.8 input score.
A remotely triggerable use-after-free in the Linux kernel's SCTP stack (net/sctp) lets an authenticated SCTP peer read freed transport memory in sctp_outq_select_transport(). By sending an ASCONF chunk that both adds a peer transport and then removes it via a wildcard DEL-IP, the newly added transport is freed while asoc->new_transport still points to it; a later HEARTBEAT and address-replacement sequence dereferences the dangling pointer. There is no public exploit identified at time of analysis, EPSS is low (0.22%), and the flaw is not in CISA KEV, though a reliable private reproducer is described.
Kernel memory disclosure in the Linux bnxt_re RDMA driver (Broadcom NetXtreme RDMA) exposes 4092 bytes of stale kernel data to local users holding InfiniBand device access. The bnxt_re_alloc_ucontext() function allocates the user context shared page with __get_free_page(GFP_KERNEL), which does not zero memory, then maps the page into userspace - leaving all bytes beyond the 4-byte AVID write at offset 0x10 uninitialized and fully readable by the calling process. Exploitation requires only a single mmap() call after IB_USER_VERBS_CMD_GET_CONTEXT, making it trivially scriptable; no public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects low observed exploitation activity.
Symlink escape in NLTK's CorpusReader.open() allows local attackers to read arbitrary files outside the designated corpus root, affecting all versions before 3.9.4. Path boundary validation is performed lexically on the string representation of a path rather than on the resolved filesystem target, so an attacker with write access to the corpus directory can plant a symlink that passes the check yet redirects reads to sensitive files anywhere the host process can access. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.9.4.
Unbounded recursion in NLTK's JSONTaggedDecoder.decode_obj() (nltk/jsontags.py) allows unauthenticated remote attackers to crash the Python process by submitting a deeply nested JSON payload exceeding Python's default recursion limit of 1000. All NLTK releases before 3.9.4 are affected; exploitation depends on whether the calling application exposes JSONTaggedDecoder to externally-supplied JSON input. A public proof-of-concept is included in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Arbitrary file read in NLTK before 3.10.0 stems from a logic defect in FileSystemPathPointer.open() where the sandbox path validation compares a normalized path against itself, rendering the security boundary permanently non-functional rather than conditionally bypassable. Authenticated attackers who can influence calls to nltk.data.load() - for example, via an application that accepts user-supplied resource identifiers - can supply file:// URLs to exfiltrate any file accessible to the process account, including credentials, environment files, and application configuration. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code is identified at time of analysis; however, the trivially exploitable nature of the tautological check warrants prompt patching.
StreamBackedCorpusView in NLTK before 3.10.0 allows arbitrary local file reads by calling Python's builtins.open() directly, fully bypassing the pathsec.ENFORCE security boundary regardless of how that control is configured. Web applications and services built on NLTK that pass externally controlled values to the fileid argument are at risk of having sensitive system files, credentials, and configuration data read by remote attackers. A vendor-released patch is available in NLTK 3.10.0; no public exploit has been identified at time of analysis.
Path traversal and pickle deserialization protections in NLTK before 3.10.0 are effectively disabled by default - pathsec.py sets ENFORCE=False, causing all security validation to emit warnings rather than raise blocking exceptions. Any application using NLTK to process untrusted file paths or serialized data is exposed unless operators have explicitly overridden this default. No public exploit has been identified at time of analysis, but the attack surface is significant wherever NLTK handles attacker-controlled inputs, particularly given that Python pickle deserialization can enable arbitrary code execution.
Path traversal in NLTK's FramenetCorpusReader and NKJPCorpusReader (all versions before 3.10.0) enables unauthenticated network-reachable attackers to read arbitrary XML files accessible to the application process by supplying crafted selectors or poisoned index state to methods including frame_by_name, doc, lu, and header. The CVSS 4.0 score of 8.2 reflects high confidentiality impact (VC:H) tempered by high attack complexity (AC:H) and a required attack target condition (AT:P), meaning exploitation depends on application code that exposes these specific corpus reader methods to external input. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Symlink-based path traversal in NLTK's FramenetCorpusReader before version 3.10.2 permits attackers with write access to a corpus subdirectory to read arbitrary XML files outside the intended corpus root. The flaw exists because path validation in frame_by_name(), _lu_file(), and doc() checks only for path separator characters in filenames but does not resolve symbolic links before access, allowing a separator-free symlink name to bypass the guard and dereference an out-of-root target. No public exploit code or CISA KEV listing has been identified; the provided CVSS 4.0 vector of PR:N/AV:N is inconsistent with the filesystem write prerequisite described and warrants verification with the vendor.
Remote code execution in NLTK's TransitionParser component allows arbitrary OS command execution when a victim loads a crafted transition-parser model file. The AllowlistUnpickler in NLTK before 3.10.3 validated only the module string during deserialization, not the global name - enabling attribute traversal via dotted names (e.g., resolving 'sklearn.os.system' through getattr chaining on an allowlisted 'sklearn' namespace) to reach callable sinks the allowlist never intended to expose. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with no authentication prerequisite reflects significant risk for pipelines that ingest externally-sourced NLP models.
Uncontrolled heap allocation in kin-openapi versions 0.124.0 through 0.141.x allows any unauthenticated remote client to crash a Go API service with a single tiny HTTP request. The `sliceMapToSlice` function in `openapi3filter/req_resp_decoder.go` converts attacker-supplied sparse bracket-indexed array values from a `deepObject` query parameter into a dense slice by allocating one slot for every position from zero to the attacker's chosen index - before schema validation, including `maxItems`, ever executes. A 24-byte request such as `?param[items][50000000]=x` triggers approximately 6.1 GiB of heap allocation across two sequential allocations, causing an OOM kill and sustained service restart loop; no public exploit has been separately released but the vendor advisory GHSA-xhj3-7xw9-vr34 contains the complete vulnerable code path and a working example payload.
Nil pointer dereference in kin-openapi's openapi3filter.ConvertErrors allows any unauthenticated remote client to crash a Go web service with a single HTTP request. Applications using kin-openapi 0.10.0 through 0.140.x that validate multipart/form-data request bodies and render errors through the library-provided ValidationErrorEncoder or ConvertErrors helpers are vulnerable; application/json request bodies are explicitly unaffected by this bug. No public exploit identified at time of analysis, but the published GHSA advisory includes exact code paths and a reproduction test case, making exploitation trivial; the vendor-released fix is available in v0.141.0.
Use-after-free in the Linux kernel's route4 (cls_route) traffic classifier fastmap cache allows a local attacker with CAP_NET_ADMIN to read freed kernel heap memory by racing filter deletion against fastmap cache population, potentially escalating to full kernel compromise. Affected versions span Linux 3.18 through current stable branches; the kernel security team backported fixes to eight LTS/stable lines (5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2). No public exploit identified at time of analysis; EPSS of 0.17% (6th percentile) reflects minimal current exploitation activity, though the theoretical impact is severe given the kernel-level UAF primitive.
Out-of-bounds kernel memory write in the Linux kernel packet socket implementation allows a local low-privilege attacker to corrupt kernel memory by exploiting a race condition between `packet_snd()` reads of `dev->hard_header_len` and concurrent device reconfiguration. When the race is won - for example during a bonding device type change - `skb->data` is positioned before `skb->head`, and the subsequent userspace copy writes beyond the allocated socket buffer, creating a kernel memory corruption primitive suitable for local privilege escalation. No public exploit or CISA KEV listing exists at time of analysis; EPSS of 0.16% reflects very low current exploitation probability, though the primitive is powerful and patch availability across multiple stable branches makes remediation straightforward.
Kernel-level use-after-free in the Linux IPv6 policy-routing (fib6 rules) subsystem allows a suppressed route to leak a released rt6_info back to rt6_lookup() callers, so a subsequent dst_release() operates on freed memory. The flaw affects systems using IPv6 FIB rules with route suppression and realistically manifests as a kernel crash (denial of service) and potential memory corruption. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile); a vendor patch is available across stable trees.
Out-of-bounds host memory access in the Linux kernel vhost subsystem results from a stale metadata cache that is not invalidated when vring addresses or sizes are reconfigured via VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM while a virtqueue is live. Systems running KVM/QEMU virtualization with vhost and a device IOTLB attached - spanning kernel versions from 4.11 through unpatched stable series - are affected, with the scope change (S:C) in the CVSS vector indicating potential read/write access to host memory beyond the vhost subsystem boundary. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (6th percentile), consistent with a complex kernel-internal flaw not yet commoditized.
SSRF in langchain-community's SitemapLoader defeats the documented `restrict_to_same_domain` security control by failing to apply it to nested sitemap index entries, allowing an attacker who influences an ingested sitemap to exfiltrate responses from internal network resources including loopback, link-local, and RFC-1918 addresses. Any LangChain-based pipeline consuming attacker-influenced sitemaps is affected; the CVSS 4.0 score of 7.7 reflects high confidentiality impact on downstream internal systems (SC:H) with no authentication or complexity requirements. No public exploit code has been confirmed and the flaw is not listed in CISA KEV at time of analysis, though the attack path is directly derivable from the vulnerability description.
Catastrophic regex backtracking in NLTK's TweetTokenizer (all versions before 3.10.1) allows unauthenticated remote attackers to stall Python service processes by submitting a few kilobytes of crafted text containing alternating domain label separators. Because TweetTokenizer is explicitly designed to process untrusted social-media input, every public-facing API or pipeline that passes user text through TweetTokenizer.tokenize() or casual_tokenize() is directly exposed to per-request denial of service with no authentication required. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV; the fix is confirmed available in NLTK 3.10.1.
Heap buffer overflow in Capstone's SuperH (SH) architecture floating-point disassembler affects all releases through 6.0.0-Alpha9, allowing a four-byte out-of-bounds write into heap memory when processing crafted SH instructions. The root cause is that opFADD, opFMUL, opFSUB, and related SH FPU decoders in arch/SH/SHDisassembler.c increment op_count as an array index into the fixed-size operands[] array without bounds checking, overflowing the 176-byte sh_info heap allocation. A process that disassembles attacker-controlled SH binary data with the affected mode flags can be crashed; code execution is possible but depends on heap layout. No public exploit has been identified at time of analysis, though a proof-of-concept test case is included in the upstream fix PR. The vendor-released patch is version 6.0.0-Alpha10.
Integer overflow in libvips prior to 8.18.3 allows an attacker who can supply a crafted many-band TIFF image to evade scanline validation in VipsForeignLoadTiff, producing heap-region miscalculations that enable reads or writes at attacker-controlled negative offsets within mmap-resident allocations. Affected deployments include any pipeline - web applications, batch processors, or CLI tools - that pass untrusted TIFF input through libvips, with confirmed impacts of data disclosure via uncompressed .v output and near-certain process crashes; remote code execution has not been demonstrated but is explicitly not ruled out by the vendor. No public exploit or CISA KEV listing exists at time of analysis; the upstream fix is confirmed in v8.18.3.
Sandbox escape in Google Chrome's Linux Toolkit Theming component (prior to 151.0.7922.173) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox via a crafted HTML page. This is a two-stage attack: the renderer must be compromised first, then this CWE-913 flaw in the theming subsystem is leveraged to break out of the sandbox entirely, achieving host-level code execution. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS sits at 0.38% (32nd percentile), consistent with an absence of observed mass exploitation.
Use-after-free in Google Chrome's DOM implementation prior to 151.0.7922.173 enables remote unauthenticated attackers to execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page. The CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact, though execution is constrained within the Chromium sandbox, limiting the blast radius without a secondary escape primitive. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS remains low at 0.38%, suggesting active exploitation is not currently widespread despite the high severity rating.
Remote code execution within the Chrome sandbox is possible via a race condition (TOCTOU) in the V8 JavaScript engine, affecting Google Chrome prior to version 151.0.7922.173. An unauthenticated attacker who persuades a victim to visit a crafted HTML page can trigger the race condition during JavaScript execution, achieving high confidentiality, integrity, and availability impact within the renderer sandbox. No public exploit code has been identified and no CISA KEV listing exists at time of analysis; the EPSS score of 0.28% at the 20th percentile reflects limited observed exploitation activity, consistent with the High attack complexity required to win the race window reliably.
Privilege elevation in Google Chrome's Import feature before version 151.0.7922.173 enables sandbox escape and arbitrary code execution at the OS level, exploitable by a remote attacker who can deliver a crafted file and socially engineer a user into opening it. The vulnerability stems from CWE-250 (Execution with Unnecessary Privileges) within the Import component, yielding full confidentiality, integrity, and availability impact per CVSS C:H/I:H/A:H. No public exploit code has been identified at time of analysis, and SSVC confirms exploitation status as none, though the total technical impact rating and sandbox-escape primitive warrant prompt patching across all Chrome deployments.
Credential exfiltration in RHACM's multicloud-operators-subscription component allows an authenticated tenant with HelmRelease create permissions to bypass Kubernetes namespace isolation by manipulating the `secretRef.Namespace` field, causing the HelmRelease controller to fetch Secrets from arbitrary namespaces and transmit them to an attacker-controlled Helm repository. The CVSS S:C (scope changed) metric confirms this breaks the namespace boundary that Kubernetes multi-tenancy depends on, enabling low-privileged lateral movement across namespace security domains. No public exploit or CISA KEV active exploitation listing is confirmed at time of analysis; however, the attack is mechanically straightforward for any cluster account holding the requisite RBAC permission.
HTTP request smuggling and header injection in libevent's http.c allow remote unauthenticated attackers to desynchronize an upstream proxy from libevent's own parsing, bypassing access controls. Affected are all versions prior to 2.1.13-stable and 2.2.2-alpha, where evhttp_header_is_valid_value accepted obsolete CRLF line folding in header values and evhttp_decode_uri_internal decoded %00 into literal NUL bytes that truncate paths in downstream C string operations. No public exploit identified at time of analysis; the CRLF weakness is patched in 2.1.13/2.2.2-alpha, but the URI NUL-truncation condition is not clearly remediated by the reviewed patches.
HTTP request smuggling in the libevent evhttp server (http.c) affects all versions prior to 2.1.13 and the 2.2.x-alpha line prior to 2.2.2-alpha, letting an unauthenticated remote attacker desynchronize request boundaries when libevent sits behind a differently-framing proxy. Because evhttp mishandles duplicate and comma-listed Transfer-Encoding headers and accepts bare-LF chunk terminators, a smuggled second request can bypass proxy-enforced access controls or poison shared caches. No public exploit identified at time of analysis, and this is not listed in CISA KEV; a vendor patch is available.
Uncontrolled resource consumption in jsoup through version 1.23.2 allows remote unauthenticated attackers to crash JVM-based applications by submitting deeply nested XML with unique namespace declarations per element. The XmlTreeBuilder component copied the full inherited namespace HashMap at every XML start element, producing O(n²) time and memory growth that exhausts heap and triggers an OutOfMemoryError. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the CVSS 4.0 score of 8.7 reflects zero authentication or complexity barriers - any application that feeds user-supplied XML through jsoup is directly at risk.
Privilege escalation in Ubuntu's accountsservice package allows a local low-privileged user to execute arbitrary shell commands as root (real UID 0) by injecting a GNU sed 'e' flag payload into their ~/.pam_environment LANGUAGE entry, which is then processed unsanitized by Ubuntu-specific helper scripts (save-to-pam-env, update-langlist) when the SetLanguage D-Bus method is invoked. All Ubuntu accountsservice packages before version 23.13.9-8ubuntu7 are affected; this is a Ubuntu-specific packaging defect, not an upstream accountsservice issue. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack path is well-described and technically straightforward.
Local privilege escalation in Ubuntu's AccountsService (before 23.13.9-8ubuntu7) lets any low-privileged local user gain full root access by exploiting an incomplete privilege-drop in a Canonical-specific patch. The patch sets the effective UID/GID to the target user before launching language helper scripts but neglects to change the real UID, leaving ruid=0. Any shell spawned by a helper script can call setuid(0) to restore root effective privileges, granting complete system compromise. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
FreeIPA's Kerberos Ticket Granting Service fails to verify Privilege Attribute Certificate (PAC) signatures when processing cross-realm tickets from a trusted Active Directory domain, allowing any authenticated AD user to impersonate arbitrary FreeIPA principals. This grants unauthorized elevated access to FreeIPA services including the web portal, SMB server, and LDAP directory. No active exploitation is confirmed (not in CISA KEV; SSVC Exploitation: none), though SSVC rates technical impact as total and CVSS scores 8.1 - the gap reflects the non-default trust configuration prerequisite that limits real-world exposure.
Stack buffer overflow in GNU binutils 2.46.1 and earlier allows arbitrary code execution when a victim opens a crafted PE (Portable Executable) file using any binutils tool such as objdump or readelf. The out-of-bounds stack write (CWE-787) can corrupt return addresses, enabling attacker-controlled code execution in the victim's user context. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 7.8 High rating reflects full confidentiality, integrity, and availability impact if successfully exploited.
Wireshark's H.245 protocol dissector crashes on malformed H.245 packets across versions 4.6.0-4.6.7 and 4.4.0-4.4.17, enabling unauthenticated remote denial of service against any analyst actively capturing H.323 multimedia traffic. The null pointer dereference (CWE-476) is triggered automatically during dissection, requiring no user interaction beyond running Wireshark on a monitored network. No active exploitation or public proof-of-concept has been identified; EPSS probability sits at 0.10% (1st percentile) and SSVC classifies exploitation as none.
Denial of service in the Wireshark ESS protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, allowing a remote unauthenticated attacker to crash Wireshark by injecting crafted packets into a network segment under active capture. The root cause is CWE-457 (use of an uninitialized variable) in the ESS dissector, which triggers an unhandled crash on malformed ESS traffic. No CISA KEV listing or public exploit has been identified; an EPSS score of 0.25% (16th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world exploitation likelihood despite the high CVSS base score.
Wireshark's C12.22 protocol dissector crashes via a stack-based buffer overflow when processing malformed C12.22 packets, enabling unauthenticated remote denial of service against versions 4.4.0-4.4.18 and 4.6.0-4.6.7. An attacker who can inject crafted C12.22 traffic into a live capture session - or supply a malicious PCAP file - can crash the analyzer process, blinding the analyst to network activity. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in available intelligence.
Heap-based buffer overflow in Wireshark's RDP protocol dissector (CWE-122) crashes the application when processing malformed RDP traffic, causing denial of service across two active release branches. Affected versions span 4.4.0-4.4.17 and 4.6.0-4.6.7 of the Wireshark Foundation's Wireshark (CPE: cpe:2.3:a:wireshark_foundation:wireshark). A proof-of-concept exists per SSVC data, though EPSS (0.17%, 7th percentile) and SSVC's 'Automatable: no' assessment indicate real-world mass exploitation is not occurring; no public exploit identified at time of analysis beyond the poc designation, and the flaw is absent from CISA KEV.
Denial of service in Wireshark's C12.22 protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, where a malformed C12.22 packet triggers a heap buffer overflow (CWE-122) that crashes the application. An attacker who can get crafted traffic in front of a capturing or file-loading analyst can reliably terminate the dissection session. A proof-of-concept is reported via SSVC, but there is no evidence of active exploitation, and the EPSS probability is low (0.27%).
Path traversal in BuildKit prior to v0.31.2 enables an authenticated API client to escape the daemon's controlled state directory by submitting a crafted upload request containing traversal sequences. Affected parties include any deployment where multiple principals share BuildKit API access - such as multi-tenant CI/CD infrastructure or shared Docker build environments. The vulnerability grants a write primitive to arbitrary host filesystem locations, posing high integrity and availability risk; no public exploit or CISA KEV listing has been identified at time of analysis.