Red Hat
Monthly
Local memory corruption in the Linux kernel's ALSA firewire-motu driver allows a user to trigger a buffer overflow when reading DSP events from the hwdep interface with an undersized buffer. The hwdep_read() path copied the full 8-byte DSP event header regardless of the caller-supplied buffer length, writing past the end of the user-provided buffer; the fix clamps the copy with min_t(). There is no public exploit identified at time of analysis, and EPSS is low (0.20%), consistent with a niche driver requiring MOTU FireWire audio hardware.
Server-Side Request Forgery (SSRF) in HTTParty 0.23.2 and earlier enables remote unauthenticated attackers to force the application to make arbitrary HTTP requests to internal network resources and third-party services, potentially leaking API keys and credentials embedded in outbound requests or accessing internal-only endpoints. Publicly available exploit code exists (GitHub Security Advisory GHSA-hm5p-x4rq-38w4), and the CVSS E:P modifier confirms proof-of-concept exploitation. Vendor-released patch is available via commit 0529bcd, though a tagged release version is not confirmed from provided data. EPSS data not provided, but SSRF vulnerabilities targeting API libraries typically see exploitation within weeks of public disclosure due to their prevalence in cloud-native environments.
TLS renegotiation exhaustion in Keycloak allows unauthenticated remote denial of service via repeated client-initiated TLS 1.2 renegotiation requests that drain CPU resources. Affects Red Hat Single Sign-On deployments using TLS 1.2 with client renegotiation enabled. EPSS exploitation probability and KEV status not available at analysis time; CVSS 7.5 (High) reflects network-accessible attack with low complexity but availability impact only. Red Hat has issued multiple security advisories (RHSA-2025:18254, 18255, 18889, 18890) addressing this flaw.
Concurrency-driven information disclosure in the Linux kernel's veth (virtual Ethernet) driver allows old or uninitialized packet descriptors to be exposed to AF_XDP consumers when veth is run in threaded-NAPI mode with an XDP program attached. Because the BPF redirect/return context was moved from per-CPU storage into the 'current' task_struct (commit 401cb7dae813), two concurrent veth_poll() invocations can nest the xdp_set/clear_return_frame_no_direct() section and race, corrupting the shared BPF net context. Despite an NVD CVSS of 9.8, this is a local, configuration-dependent kernel race with EPSS at 0.16% (6th percentile), no KEV listing, and no public exploit identified at time of analysis.
Denial of service in the Linux kernel's jbd2 (JBD2 journaling layer) used by ext4 allows a local attacker to crash the system by mounting a specially crafted or corrupted ext4 image; when journal metadata is inconsistent (e.g. a block bitmap does not reflect an in-use block), jbd2_journal_get_create_access() hits a J_ASSERT/BUG_ON at fs/jbd2/transaction.c:1289 and panics the machine. Affected products span multiple stable kernel branches, with the fix converting the fatal BUG_ON into a JBD2 abort. No public exploit identified at time of analysis and EPSS is low (0.18%), consistent with a locally-triggered availability-only issue rather than a remotely weaponizable flaw.
Denial-of-service potential in the Linux kernel's spinlock debugging instrumentation (do_raw_write_lock) stems from an unmarked read/write in debug_write_lock_before(), producing a data-race flagged by the Kernel Concurrency Sanitizer (KCSAN). Only kernels built with lock debugging enabled are affected, and the fix completes prior race-hardening work (commit 1a365e822372) by converting the remaining access to WRITE_ONCE(). No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile).
Information disclosure in Storybook for Node.js versions 7.0.0 through 10.1.9 exposes environment variables from `.env` files when using `storybook build` command. Unpatched projects building Storybook in directories containing `.env` files risk bundling sensitive credentials into publicly viewable artifacts. Unauthenticated attackers accessing published Storybook bundles can extract secrets from source code. Runtime dev mode, CI builds using platform environment variables, and co-located applications remain unaffected. No public exploit identified at time of analysis.
Use-after-free memory corruption in Apple's WebKit rendering engine allows remote attackers to crash Safari and iOS/iPadOS applications by processing maliciously crafted web content, requiring only user interaction (page visit) and no authentication. The vulnerability affects Safari 26.2, iOS 18.7.3 and iOS 26.2, iPadOS 18.7.3 and iPadOS 26.2, and macOS Tahoe 26.2 and earlier versions. With an EPSS score of 0.06% and no public exploit confirmed, this represents a low real-world exploitation priority despite the moderate CVSS 4.3 severity rating, with impact limited to denial of service through process termination.
Denial-of-service hardening in the Linux kernel's page_pool subsystem addresses noisy allocation-failure handling on the network receive datapath. Because driver authors frequently omit GFP_NOWARN, ATOMIC page allocations that fail under memory pressure emit full allocation-failure warnings/backtraces; the fix makes page_pool add GFP_NOWARN by default for ATOMIC allocations. Rated CVSS 7.5 for availability impact only (C:N/I:N), with no public exploit identified at time of analysis and a low EPSS score (0.17%, 6th percentile).
Denial of service in the Linux kernel's lan966x Ethernet switch driver (Microchip LAN966x SoC) allows a potential deadlock and kernel warning when network statistics are read while holding an atomic context. The driver incorrectly used a sleeping mutex (lan966x_stats_get) inside an atomic/spinlock-held path, tripping a 'sleeping function called from invalid context' BUG and risking system instability; the fix replaces the mutex with a spinlock. No public exploit identified at time of analysis, and the EPSS score is negligible (0.16%, 6th percentile).
Local privilege-context memory corruption in the Linux kernel's io_uring zero-copy send (zctx) path allows a local user to trigger unsafe handling of chained notification (ubuf_info) contexts. The flaw stems from send-zerocopy operations linking ubuf_info structures that may originate from a different io_uring context than assumed, and the fix adds a check enforcing that only same-context notifications are chained. No public exploit has been identified at time of analysis; EPSS is very low (0.16%, 6th percentile) and the issue is not on the CISA KEV list, but the CVSS base score of 7.8 reflects high confidentiality, integrity, and availability impact for a successful local trigger.
Improper validation of node identifiers (nid) in the Linux kernel's F2FS filesystem allows a crafted or corrupted on-disk image to pass an out-of-range nid (where footer.ino equals footer.nid and both exceed valid bounds) through f2fs_alloc_nid() and free_nid_list, potentially causing out-of-bounds access, memory corruption, or a kernel crash. The upstream fix adds a sanity check to detect this corruption. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 6th percentile). Note the published CVSS 9.8 network vector appears inconsistent with the local, filesystem-image-driven nature of this bug.
Privilege-relevant use-after-free in the Linux kernel's drm/msm (Qualcomm Adreno GPU) driver allows a local user with GPU access to trigger kernel faults because last_fence is not waited on at VM-bind context close, freeing GPU resources while they are still in use. Affected systems run the msm DRM driver on Qualcomm SoCs and use vm_bind contexts. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.15%, 5th percentile), consistent with an in-tree kernel fix rather than an in-the-wild threat.
Use-after-free in the Linux kernel Bluetooth HCI core (hci_core) lets an attacker within Bluetooth range trigger a race between the ACL data RX path (l2cap_recv_acldata) and connection teardown (hci_abort_conn_sync/hci_conn_del), causing the RX handler to dereference a freed hci_conn structure. A syzkaller-reproduced crash confirms the flaw, which primarily manifests as denial of service though memory corruption cannot be excluded; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The issue is resolved upstream by moving the hci_conn lookup into the protocol receive handlers under a single RCU/lock-protected critical section.
Kernel memory corruption in the Linux platform/x86 Intel P-Unit IPC driver (intel_punit_ipc) arises from an interrupt handler dereferencing the address of a global pointer variable (&punit_ipcdev) instead of the pointer itself, so the completion call complete(&ipcdev->cmd_complete) in intel_punit_ioc() writes to an incorrect memory location. Affected systems are those running the punit_ipc driver on specific Intel SoC platforms; a local low-privileged actor able to drive the IPC command path can corrupt kernel memory, most plausibly causing instability or a crash. There is no public exploit identified at time of analysis, EPSS is very low (0.17%, 6th percentile), and the issue is not in CISA KEV.
Denial of service in the Linux kernel's Samsung sxgbe 10G Ethernet driver stems from a NULL pointer dereference in sxgbe_rx(), where the receive path logs an error when an skb is NULL but then dereferences that same NULL skb on the following line. The fix adds a 'break' so the code falls through to sxgbe_rx_refill() instead of crashing, mirroring the handling already used by other NIC drivers such as Calxeda's xgmac_rx(). There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile); the bug was found during code review rather than in-the-wild.
Out-of-bounds kernel write in the Linux 'atlantic' network driver (Aquantia/Marvell AQC-series 10G NICs) occurs when the RX path receives large multi-descriptor packets exceeding MAX_SKB_FRAGS (17) fragments, causing a fragment index to overrun the skb frag array inside skb_add_rx_frag_netmem() and triggering a kernel panic. The flaw was observed crashing production systems equipped with the Aquantia AQC113 10G NIC. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.17% (6th percentile), consistent with a hardware-specific denial-of-service condition rather than a broadly exploitable RCE.
Local privilege escalation and memory corruption in the Linux kernel's io_uring networking subsystem stems from vectored registered buffer imports being tied to the wrong io_kiocb (the request 'req' instead of the notification 'sr->notif'), creating an object-lifetime mismatch. Local low-privileged users on affected kernels can trigger use-after-free-style conditions leading to information disclosure or code execution in kernel context. No public exploit identified at time of analysis, and EPSS is low (0.16%).
Denial of service in the Linux kernel's AMD GPU display driver (amdgpu drm/amd/display) allows a local user to crash the system via a NULL pointer dereference in dc_stream_get_scanoutpos(). The flaw triggers during concurrent atomic modeset and cursor operations - reproducible with the IGT kms_cursor_legacy 'long-nonblocking-modeset-vs-cursor-atomic' test when both an eDP panel and a DP monitor are connected. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and this is not in CISA KEV.
Use-after-free in the Linux kernel's libceph client (the in-kernel Ceph transport shared by CephFS and RBD) lets the mount-time wait loop in __ceph_open_session() read a monmap or osdmap structure after a worker thread has freed and replaced it. The flaw is a race between a mounting task polling have_mon_and_osd_map() without locks and ceph_monc_handle_map()/handle_one_map() swapping in a fresh map under their respective locks, producing a KASAN slab-use-after-free (reproducible with xfstests generic/395 and generic/397). There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is very low at 0.18% (8th percentile).
Out-of-bounds kernel memory write in the Linux kernel's libceph client (handle_auth_session_key) allows a malicious or compromised Ceph server to corrupt kernel memory when a client decrypts the connection secret or processes CephX service tickets. The attacker-controlled 'len' field from network packets was used without boundary checks, enabling potential kernel memory corruption and code execution against any host mounting Ceph/RBD storage. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.18%, 8th percentile).
Remote denial-of-service in the Linux kernel's libceph (Ceph client) module allows a malicious or compromised Ceph OSD/monitor to crash the kernel by sending OSDMap packets containing out-of-bounds OSD indexes. Because libceph previously used BUG_ON assertions on OSD index values drawn directly from untrusted network data, an attacker-controlled index exceeding map->max_osd triggers a kernel panic. This is a fixed issue with upstream stable-tree commits; no public exploit has been identified and EPSS exploitation probability is low (0.17%, 7th percentile).
Local privilege escalation and memory corruption in the Linux kernel's NVMe driver arises from a use-after-free in admin request_queue lifetime management, where namespaces retain stale references to a controller's admin request_queue that can be dereferenced after the controller is torn down. Confirmed via a KASAN slab-use-after-free report in blk_queue_enter() triggered through an nvme ioctl (nvme_submit_user_cmd), the flaw affects hosts running NVMe storage and is fixed upstream by reordering the controller 'put' until after all references are released. EPSS is very low (0.03%, 7th percentile) and there is no public exploit identified at time of analysis; exploitation requires local access and a race against controller teardown.
Use-after-free in Linux ksmbd IPC handler allows remote unauthenticated attackers to trigger memory corruption via race condition in generic netlink reply processing. The flaw (CVSS 9.8 critical, network-reachable) affects ksmbd's ipc_msg_send_request() function where concurrent access to response buffers occurs without proper locking. EPSS data not provided; no CISA KEV listing identified at time of analysis. Multiple upstream kernel commits available across stable branches indicate vendor-released patches exist.
Local denial-of-service in the Linux kernel ext4 filesystem allows a low-privileged user to crash the system by racing inline-data destruction against block mapping. The function ext4_destroy_inline_data_nolock() flips an inode from EXT4_INODE_INLINE_DATA to EXT4_INODE_EXTENTS without holding i_data_sem, so a concurrent ext4_map_blocks() can enter ext4_ind_map_blocks() on an inode that already advertises extents, tripping a BUG_ON at fs/ext4/indirect.c:546 and panicking the kernel. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and the flaw is availability-only (kernel oops), not information disclosure despite the input tag.
Local privilege escalation potential in the Linux kernel's experimental Rust Binder driver (rust_binder) arises from a race condition on a node's death_list where NodeDeath entries can be concurrently manipulated. During Node::release the driver moves death entries to a stack-local list while other threads call an unsafe remove() on the original list, corrupting the prev/next pointers and producing kernel memory corruption (observed as a paging-request Oops on ARM64 Android 6.12 kernels). No public exploit has been identified and EPSS is low (0.20%), but the flaw yields high confidentiality, integrity, and availability impact if a local attacker wins the race.
Denial of service and out-of-bounds memory read in the Linux kernel's staging rtl8723bs Realtek Wi-Fi driver allows an attacker within radio range to crash or hang a vulnerable device by transmitting a malformed 802.11 frame. The rtw_get_ie() Information Element parser trusted the attacker-supplied IE length byte without bounds-checking, so a crafted length can push the parser past the frame buffer, producing OOB reads or an infinite loop. No public exploit is identified at time of analysis (EPSS 0.07%, 21st percentile) and the issue is not in CISA KEV; it has been fixed upstream and shipped in Ubuntu security updates.
Adjacent-network stack buffer overflow in the Linux kernel's rtl8723bs staging Wi-Fi driver lets a nearby malicious station corrupt kernel stack memory by sending a crafted 802.11 Association Request. The OnAssocReq handler copied the Supported Rates IE into a fixed 16-byte stack buffer using the attacker-controlled IE length without bounds checking, enabling denial of service and potentially kernel code execution. Rated CVSS 8.8; no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with an unauthenticated but proximity-limited radio attack.
Out-of-bounds read in the Linux kernel's staging rtl8723bs Realtek Wi-Fi driver allows an adjacent attacker to trigger a kernel panic by broadcasting a malformed 802.11 beacon frame. The OnBeacon handler parses an Extended Supported Rates (ESR) information element positioned at the end of the received frame buffer without bounds validation, reading past the buffer. No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.17%), but the flaw is remotely reachable over the air against any device using this driver.
Spurious kernel warnings in the Linux kernel hung_task blocker-tracking mechanism arise on architectures that align 32-bit values on 2-byte boundaries (e.g., m68k), where the code incorrectly assumes lock pointers are always 4-byte aligned so it can pack a type tag into the lower two pointer bits. The mismatch trips two WARN_ON_ONCE checks; the fix silently ignores non-4-byte-aligned locks, disabling the feature on those platforms. This is an internal kernel robustness fix rather than a remotely reachable attack primitive, with no public exploit identified at time of analysis and a low EPSS score of 0.15% (5th percentile).
Remote unauthenticated denial of service in the Linux kernel's ksmbd in-kernel SMB server allows an attacker to exhaust kernel socket resources by repeatedly tripping the per-IP connection limit. When ksmbd_kthread_fn() rejects a connection that exceeds the per-IP limit, it sets ret = -EAGAIN and continues the accept loop without releasing the just-accepted socket, leaking one socket per rejected attempt from a single source IP. This is a resource-leak DoS with no public exploit identified at time of analysis and a low EPSS score (0.16%, 6th percentile).
Client-identity confusion in the Linux kernel's NFS client allows a low-privileged local user to have an NFS mount silently reuse an existing RPC connection established under a different TLS X.509 client certificate. Because nfs_match_client() failed to compare the cert_serial and privkey_serial fields that define the client's presented identity, a mount intended to use one certificate could be bound to a connection authenticated with another, enabling access to data under the wrong identity. This is an information-disclosure/identity-mismatch flaw (CVSS 7.0); it is not in CISA KEV, has no public exploit identified at time of analysis, and carries a very low EPSS score of 0.10% (1st percentile).
Denial of service in the Linux kernel IPv4 routing subsystem allows a permanent device reference-count leak through a race condition in FIB next-hop exception (fnhe) handling. On systems using tunnel drivers such as sit or gretap, concurrent transmit paths can bind a soon-to-be-freed fnhe to a new dst, leaking the dst and its device reference so the interface can never be unregistered (visible as 'unregister_netdevice: waiting for sitX to become free'). This is availability-only, has no public exploit identified at time of analysis, and carries a low EPSS score of 0.17%.
Local privilege-relevant memory corruption in the Linux kernel's io_uring cmd_net timestamp-retrieval path arises from transposed arguments to skb_queue_splice(), causing SKBs to be spliced in the wrong direction between the socket queue and an on-stack list. Any local user able to issue io_uring network commands with timestamp retrieval could trigger the flawed splice, potentially leading to information disclosure (per source tagging) or broader list/memory corruption. There is no public exploit identified at time of analysis and EPSS is low (0.15%), so this is a code-quality/security hardening fix rather than an actively exploited threat.
Denial of service in the Linux kernel's veth (virtual Ethernet) driver allows a permanently stalled transmit queue and halted network traffic once a lost-wakeup race is triggered under load. The flaw is a regression introduced by commit dc82a33297fc ('veth: apply qdisc backpressure on full ptr_ring'), where the producer in veth_xmit() misuses the __ptr_ring_empty() API to decide whether to re-wake a stopped TXQ; when a consumer on another CPU empties the ring concurrently, the wakeup is lost and the queue stays in QUEUE_STATE_DRV_XOFF. It was observed in production on ARM64 (Ampere Altra Max) systems. There is no public exploit identified at time of analysis, EPSS is low (0.16%), and it is not in CISA KEV.
Use-after-free in the Linux kernel's SMB/CIFS client (cifs module) arises from an incomplete backport of commit bdb596ceb4b7, which left a stale kref_put() call in cfids_invalidation_worker() instead of converting it to close_cached_dir(). The flaw affects the cached-directory (cfid) invalidation path used when a Linux system mounts remote SMB shares, and with a CVSS of 8.8 (C:H/I:H/A:H) could allow memory corruption leading to information disclosure or code execution. There is no public exploit identified at time of analysis and the EPSS probability is low (0.15%).
Denial of service in the Linux kernel's NVMe multipath subsystem allows a lockdep-detected deadlock among disk->open_mutex, the kblockd workqueue, and partition_scan_work completion, which can hang block-device operations. The fix moves partition_scan_work off the kblockd workqueue onto nvme_wq to break the lock-dependency cycle. No public exploit identified at time of analysis; the issue surfaces intermittently during NVMe partition scanning on systems using NVMe multipath.
Improper resource cleanup in the Linux kernel's Intel ice Ethernet driver leaves PTP (Precision Time Protocol) resources leaked when driver probe, PTP initialization, or PTP restart hits an error path. On subsequent driver removal the leaked PF PTP state and un-deinitialized 'ps_lock' mutex trigger a kernel WARNING in ice_adapter_put, and the PTP clock is left registered. No public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and there is no CISA KEV listing; this is a robustness/error-handling defect requiring local privileged access to the NIC driver.
Local privilege-level information disclosure and memory corruption in the Linux kernel's VFS statmount() implementation arises from an uninitialized output-offset pointer ('offp') in statmount_string(). When a caller requests the STATMOUNT_MNT_UIDMAP or STATMOUNT_MNT_GIDMAP fields, those code paths write directly to the struct fields and never assign 'offp', so a later dereference of the uninitialized pointer can leak kernel memory or corrupt state. The CVSS 3.1 vector (AV:L/PR:L) indicates a local, low-privileged attacker is required; there is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile).
Out-of-bounds memory access in the Linux kernel's eBPF verifier (widen_imprecise_scalars()) allows a local actor able to load eBPF programs to read or corrupt kernel memory beyond the bpf_verifier_state stack array. The flaw arises because the verifier assumed an ancestor state (prev_st) shares the same allocated_stack depth as a newly queued state (queued_st), which is false when the same callsite is invoked with differently sized stack frames. No public exploit has been identified at time of analysis; EPSS risk is low (0.17%, 7th percentile) and the issue has been resolved upstream.
Local privilege escalation and memory corruption in the Linux kernel's Intel Xe GPU driver (drm/xe/guc) arises from a use-after-free race during device unbind: the GuC 'Dead CT' worker is not synchronized with the unbind path, so it can access GuC communication-transport resources after they have already been freed. Exploitation requires local access with low privileges (CVSS 7.8, AV:L/PR:L) and can result in high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the low EPSS (0.17%) reflects the niche, timing-dependent nature of the flaw.
Denial of service in the Linux kernel's netfilter nftables connection-tracking (nft_ct) code allows disruption of FTP passive-mode (PASV/EPSV) sessions on hosts acting as NAT gateways. When an nftables FTP conntrack helper is assigned to a connection that already has a NAT binding (helper set after DNAT), the required nfct_seqadj sequence-adjustment extension is never allocated, so the FTP payload mangling path hits a kernel WARNING and tears down the control connection ("Service not available, remote server has closed connection"); on kernels built with panic_on_warn this escalates to a full crash. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%), and it is not in CISA KEV.
Out-of-bounds memory access in the Linux kernel's AMD CPU microcode-matching logic affects systems running on AMD Zen5 processors, where the zen5_rdseed_microcode revision table lacks a terminating sentinel entry. When x86_match_min_microcode_rev() iterates this array during CPU initialization on a Zen5 part, it reads past the array bounds, tripping KASAN and potentially disclosing adjacent kernel memory or causing instability. No public exploit identified at time of analysis, and EPSS risk is low (0.16%, 6th percentile).
Kernel panic (denial of service) in the Linux kernel's qmi_wwan USB WWAN driver occurs because qmimux_rx_fixup() leaves skb->mac_header uninitialized for raw-IP packets that have no MAC header; on ARM64, strict-alignment access to that offset by xfrm/IPsec crashes the machine. The flaw is reachable when IPsec (ESP) traffic is received over a qmimux0 multiplexed interface, as shown by the provided oops in xfrm_input(). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), consistent with a config-specific crash rather than broad remote code execution.
Improper GEM object cleanup in the Linux kernel's drm/msm (Qualcomm Adreno) graphics driver mishandles imported dma-bufs, because the free path only checked object flags without accounting for imported buffers whose reservation object differs from the embedded default. A local user with DRM/GPU access can trigger the faulty path (reproduced during hardware-accelerated IRIS video playback under GNOME Shell) by closing a GEM handle backed by an imported dma-buf, producing a kernel WARNING at msm_gem.c:1127 and potential incorrect reservation-object handling during buffer teardown. There is no public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and this is not on CISA KEV.
Broken AFBC (Arm Frame Buffer Compression) handling in the Linux kernel's Mediatek DRM driver on MT8188 (Genio 700) SoCs causes constant vblank timeouts and garbled display output when the 32x8/split/sparse AFBC modifier is used, which Mesa v25.0+ enables by default. A local user with GPU/display access can trigger a hung display pipeline (denial of service) and rendering of stale/garbled framebuffer contents (limited information disclosure). No public exploit identified at time of analysis, and EPSS is very low (0.17%, 7th percentile), consistent with a hardware-specific reliability bug rather than a widely weaponizable flaw.
Integrity protection weakening in the Linux kernel's IMA (Integrity Measurement Architecture) subsystem allows a stored IMA file signature to be silently downgraded to a plain IMA hash. When IMA and EVM run in fix mode (e.g. booting with 'ima_appraise=fix evm=fix ima_policy=appraise_tcb'), the kernel incorrectly clears the IMA_DIGSIG flag whenever a non-IMA security xattr (such as security.selinux or security.evm) or an ACL is set or removed after security.ima was written, so on file close a hash is generated instead of preserving the intended signature. A full C reproducer is embedded in the report, but there is no CISA KEV listing and no public weaponized exploit identified at time of analysis; EPSS is 0.17% (7th percentile).
Memory corruption (use-after-free) in the Linux kernel's Intel iwlwifi wireless driver, specifically in iwl_mld_remove_link(), where the code frees the 'link' object via kfree_rcu() and then dereferences it to read link->fw_id. On systems with Intel WiFi hardware using the newer MLD (multi-link device) code path, a triggered link-removal race can access freed memory, most likely crashing the kernel (denial of service) with only a theoretical path to further corruption. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS probability is low (0.16%, 6th percentile).
Local privilege-escalation-class use-after-free in the Linux kernel's radeon (AMD GPU) DRM driver, triggered on the probe-error and device-removal paths. After the driver switched its main structure to devm_drm_dev_alloc(), the leftover drm_put_dev() calls cause devres to release the already-freed device a second time, producing a refcount underflow ('refcount_t: underflow; use-after-free') and dangling reference. No public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and the issue is not listed in CISA KEV.
Kernel crashes and memory corruption in the Linux kernel on IBM s390/s390x systems occur when the HugeTLB Vmemmap Optimization (HVO) feature is enabled, because s390 architecture rules forbid overwriting an active/valid page table entry with another valid entry without first invalidating it, and the HVO path modifies kernel page tables without a compliant TLB flush. The upstream fix disables ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP on s390, effectively reverting the patch that enabled it. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is tagged as a Denial of Service issue rather than an exploitation primitive.
Local denial-of-service (and potential memory corruption) in the Linux kernel's NXP i.MX8 ISI media capture driver (imx8-isi) allows a low-privileged user with access to an ISI /dev/videoX device to trigger a WARNING and driver error state by simply querying device controls while a capture stream is active. The flaw stems from mxc_isi_video_release() unconditionally tearing down streaming state, so any release call (e.g. from `v4l2-ctl -l`) can free a queue that is still streaming. No public exploit is identified at time of analysis and EPSS risk is negligible (0.03%), though a deterministic crash-reproduction recipe is published in the fix commit.
Local denial-of-service (and potential memory corruption) in the AMD amdkfd (Kernel Fusion Driver) component of the Linux kernel arises from a race between GPU compute-partition switching and asynchronous KFD process teardown. Because the driver's partition-switch path only checks whether the kfd_processes_table is empty - while the actual kfd_process teardown runs later in the kfd_process_wq workqueue - a partition switch can free kfd_node structures still being accessed by an in-flight release, producing a divide-by-zero kernel oops (observed in kfd_get_num_sdma_engines). No public exploit identified at time of analysis, EPSS is low (0.16%), and it is not listed in CISA KEV.
Cross-task FPU state leakage in the Linux kernel x86 XFD (Extended Feature Disable) handling allows a local low-privileged task to trigger an inconsistent AMX/dynamic-feature register state during signal delivery. When a non-AMX task is preempted by an AMX-enabled task that changes the XFD MSR, fpu__clear_user_states() failed to re-synchronize XFD, producing a state mismatch (kernel WARNING) and potential exposure of dynamic FPU register contents. Tagged as an information-disclosure issue; no public exploit identified at time of analysis and EPSS is low (0.17%, 7th percentile).
Kernel memory corruption in the Linux drm/radeon GPU driver occurs because the driver calls kfree() on the rdev main structure that is now managed by devres (via devm_drm_dev_alloc()), causing a double-free when the driver probe fails and devres later cleans up the already-freed allocation. Local users on systems with AMD/ATI Radeon hardware may trigger memory corruption during a failed driver probe, most directly resulting in a kernel crash. There is no public exploit identified at time of analysis, and the EPSS score is low (0.17%, 7th percentile), consistent with an error-path bug rather than a broadly exploitable flaw.
Denial-of-service in the Linux kernel JFS filesystem driver lets a local low-privileged actor crash the system by mounting a JFS volume read-only. Because txInit() started its waitqueue-initialization loop at index 1, TxBlock[0].waitor is left uninitialized; a read-only mount returns tid=0 and the subsequent txEnd(0) dereferences that uninitialized waitqueue, triggering a lockdep 'non-static key' warning and a kernel crash. EPSS is low (0.18%, 8th percentile), there is no public exploit identified at time of analysis, and it is not in CISA KEV - impact is a crash rather than code execution.
Denial-of-service via invalid pointer access exists in the Linux kernel gpiolib debugfs interface, where a failed memory allocation in gpiolib_seq_start() leaves s->private uninitialized and later dereferenced in gpiolib_seq_stop(), crashing the kernel. The flaw affects systems exposing the GPIO debugfs seq_file (/sys/kernel/debug/gpio) and is triggerable only under memory-allocation failure. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and it is not on CISA KEV.
Authorization bypass in the Linux kernel CephFS client (ceph module) lets an authenticated Ceph user exercise MDS auth capabilities granted for one filesystem against a different filesystem in a multi-filesystem (multifs) Ceph cluster. Because the kernel client failed to validate the fsname alongside the associated caps, a user holding read-only rights on 'fsname1' but read-write rights on 'fsname2' would incorrectly gain read-write on 'fsname1', enabling file creation and deletion they should not be permitted. No public exploit identified at time of analysis, and the EPSS score is low (0.25%, 16th percentile), consistent with a specialized storage-cluster condition rather than mass exploitation.
Out-of-bounds memory access in the RISC-V stack unwinder (walk_stackframe) of the Linux kernel lets KASAN trip and read past a task's kernel stack boundary when unwinding a task other than the current one. The defect mirrors a previously fixed x86 issue (commit 84936118bdf3) and is reached through normal task-introspection paths on RISC-V builds. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.03%, 7th percentile), and it is not in CISA KEV; the fix disables KASAN checks for non-current tasks.
Local privilege-relevant memory corruption/disclosure risk exists in the Linux kernel's Rockchip SFC (Serial Flash Controller) SPI driver (spi-rockchip-sfc), where improper DMA-API usage - deriving DMA addresses via virt_to_phys() instead of dma_map_single() - causes the driver to sync DMA memory it never properly mapped. On affected Rockchip-based systems (e.g. ODROID-M1), this triggers a DMA-API debug warning and reflects an underlying unsafe memory-transfer path during SPI-NOR flash operations. No public exploit identified at time of analysis; EPSS probability is low (0.16%, 6th percentile).
Kernel memory corruption in the Linux kernel's AMD Display (amdgpu/DC) driver stems from an undersized dc->links[MAX_LINKS] array and an unchecked link->enc pointer, letting a local attacker on AMD-GPU systems trigger an out-of-bounds access and NULL-pointer dereference during hw_init() for DisplayPort-over-USB4 (DPIA) endpoints. Rated CVSS 7.8 (AV:L/PR:L) and tagged as denial-of-service, it most realistically causes a kernel crash. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.17% (7th percentile).
Memory mishandling in the Linux kernel's mlx5e (NVIDIA/Mellanox ConnectX) RX path lets a loaded XDP program corrupt skb generation on striding RQ, causing kernel warnings, a BUG_ON crash, or erroneous packet buffers. The flaw affects systems using mlx5 NICs where a multi-buffer XDP program calls bpf_xdp_adjust_head() or bpf_xdp_adjust_tail() to change the xdp_buff layout, which the driver wrongly assumed was static. This is a resolved upstream kernel fix with no public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and it is not in CISA KEV.
Out-of-bounds read in the Linux kernel HFS+ (hfsplus) filesystem driver allows a local attacker to crash the kernel via a crafted HFS+ B-tree node whose record offset or length in hfsplus_bmap_alloc exceeds node_size, causing access beyond the node's allocated pages. The flaw is reached during node allocation (hfs_btree_inc_height → hfsplus_brec_insert) when writing to files on a malicious HFS+ image, with KASAN confirming a slab-out-of-bounds read. Reported as a denial-of-service issue with a low EPSS score (0.18%, 8th percentile); no public exploit identified at time of analysis and it is not in CISA KEV.
Denial of service in the Linux kernel's NXP ENETC Ethernet driver (enetc) on Layerscape LS1028A platforms allows the CPU to hang under normal network load, causing RCU stalls on PREEMPT_RT kernels. The flaw stems from recursive acquisition of the read-side enetc_mdio_lock in the enetc_poll NAPI path, which deadlocks when a higher-priority writer is queued between two reader acquisitions. No public exploit identified at time of analysis; EPSS is very low (0.03%, 8th percentile) and it is not CISA KEV listed, consistent with a reliability/self-triggered availability bug rather than an attacker-weaponized flaw.
Keycloak's admin API endpoints for authorization resource management contain an IDOR vulnerability allowing authenticated administrators with fine-grained permissions for one client to delete or modify resources belonging to other clients within the same realm. The flaw exists in ResourceSetService and PermissionTicketService where authorization checks validate the resourceServer (client) ID from the API request, but backend database operations use only the resourceId, creating a permission bypass. Affected administrators can exploit this with standard HTTP requests to cross-client resource boundaries; no public exploit code identified at time of analysis.
Privilege escalation in Red Hat's runtimes-inventory-rhel8-operator lets a standard cluster user act with full cluster-administrator authority on the Red Hat management platform. A misconfigured internal proxy attaches the cluster's main administrative credentials to every command it relays - not just the report traffic it should handle - so any authenticated user can issue admin-level instructions and alter cluster configuration or status. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 12th percentile), and the issue is not in CISA KEV, but the impact is a classic confused-deputy authentication bypass and Red Hat has shipped a fix.
Integer overflow in GLib's GIO escape_byte_string() function enables heap buffer overflow and denial-of-service when processing malicious filesystem attribute values over the network. The vulnerability affects GLib across GNOME, Red Hat Enterprise Linux 7-10, and OpenShift 4.0+, requiring only unauthenticated network access and user interaction. EPSS score of 0.07% (percentile 22) indicates low exploitation probability despite CVSS 6.5, suggesting the attack requires specific file/attribute handling conditions; no public exploit or active exploitation (CISA KEV) confirmed at analysis time.
Heap corruption in GLib (GNOME's core C utility library) lets remote attackers trigger a buffer-underflow in the GVariant parser by supplying maliciously crafted serialized/text input, resulting in denial of service and potentially arbitrary code execution. Any application linking GLib that deserializes untrusted GVariant data is exposed, which spans broad swaths of the Linux desktop and system stack across Red Hat Enterprise Linux 7-10 and SUSE. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.26%, 49th percentile) despite the 9.8 CVSS, indicating the headline severity is not yet matched by observed exploitation interest.
The CNI portmap plugin versions 1.6.0 through 1.8.0 contain a traffic interception vulnerability when configured with the nftables backend, allowing containers to receive and intercept all traffic destined for their configured HostPort regardless of destination IP address. This affects Linux Foundation's CNI Network Plugins, and an attacker with local privileges and control over a container can intercept traffic intended for other containers or services on the same node. The vulnerability has a published patch available in version 1.9.0, an extremely low EPSS score of 0.02% indicates minimal real-world exploitation likelihood, and there is no indication of active exploitation in the wild.
A slab use-after-free in the Linux kernel's Intel AVS (Audio Voice Speech / Smart Sound Technology) ASoC driver lets a local user with access to a HOST HDAudio PCM stream corrupt kernel memory by racing PCM close against period-elapsed IRQ work. When avs_dai_fe_shutdown() frees the DAI's private context while the period-elapsed work is still servicing interrupts, the freed structure can be accessed concurrently, yielding a use-after-free with high confidentiality, integrity and availability impact (CVSS 7.8, AV:L). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.20%, 10th percentile), reflecting the local-only, hardware-specific nature of the flaw.
Denial-of-service (kernel use-after-free/double-free) in the Linux kernel's nvmet-fc NVMe-over-Fibre-Channel target driver allows a local privileged operator to crash the kernel by forcibly shutting down an NVMe target port via configfs. When a port is torn down, nvmet_port_subsys_drop_link() calls both nvmet_port_del_ctrls() and nvmet_disable_port(), each of which can schedule the same association-deletion work item; the first run frees all resources and the second reuses freed memory. This is a fix already merged upstream in the stable trees, with no public exploit identified at time of analysis and a low EPSS score (0.21%, 11th percentile).
Denial of service and potential memory corruption in the Linux kernel's NVMe over Fibre Channel (nvme-fc) transport arises because nvme_fc_create_association reads the remote port_state and increments the rport active count without holding a lock, racing against nvme_fc_unregister_remote which can free the remote port when no active association exists. An attacker or fault condition on the FC fabric able to trigger reconnect events concurrently with port teardown can drive a use-after-free style condition on the rport object. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile).
Data-integrity corruption in the Linux kernel's stmmac (Synopsys DesignWare/STMMAC) Ethernet driver allows malformed packets that failed hardware checksum validation to be accepted as valid by the network stack. When hardware checksum offload (CoE) is enabled, the Rx path marked known IP-ethertype frames as CHECKSUM_UNNECESSARY without honoring the hardware's reported header/payload checksum error, so corrupt frames bypass the stack's own validation. There is no public exploit identified at time of analysis, KEV status is not listed, and EPSS is low (0.20%, 11th percentile).
Local privilege-escalation and memory-disclosure flaw in the Linux kernel's DRM GPU SVM (Shared Virtual Memory) subsystem, where incorrect use of hmm_pfn_to_map_order() mishandles an HMM range that only partially covers a huge page (e.g. 2MB), causing the driver to map physical memory outside the intended range - memory that may not even belong to the faulting process's address space. Affecting recent kernels carrying the drm/gpusvm code (associated with the Intel Xe GPU driver's userptr/SVM path), a local user with GPU access can trigger cross-boundary mappings leading to information disclosure or memory corruption. There is no public exploit identified at time of analysis, and EPSS is low at 0.19% (9th percentile).
Local memory-safety flaw in the Linux kernel's AMD GPU (amdgpu) driver allows an authenticated local user to submit a user queue (userq) whose buffer virtual address and size are not validated against a legitimate VM mapping. Because the driver failed to confirm the userq object resides in a valid GPU virtual-memory mapping before use, a low-privileged process with GPU device access could reference out-of-bounds or unmapped memory, tagged as an information-disclosure issue with additional integrity and availability impact. No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile), consistent with a local-only kernel driver bug rather than a mass-exploited network flaw.
Local privilege-relevant out-of-bounds kernel write in the Linux kernel's SCTP subsystem lets an unprivileged local user corrupt kernel heap memory by exploiting a time-of-check/time-of-use (TOCTOU) gap in the SCTP diagnostic dump path (sctp_diag_dump → sctp_for_each_endpoint → sctp_ep_dump), which runs without holding the socket lock. Because the address list can grow between buffer allocation and the subsequent write, an attacker who races the dump against concurrent address additions can force a write past the allocated bounds, yielding potential memory corruption (CVSS 7.8, C/I/A High). There is no public exploit identified at time of analysis and EPSS is low (0.21%, 12th percentile), consistent with a race-dependent local flaw rather than a mass-exploited network bug.
Use-after-free in the Linux kernel's SMB client (cifs) cached-directory handling lets a race between find_or_create_cached_dir() and smb2_close_cached_fid() free a cfid object while a new reference is being taken, corrupting kernel memory on a host mounting an SMB/CIFS share. The flaw is a reference-counting gap fixed by switching to kref_put_lock() so cfid_release() runs under cfid_list_lock. No public exploit identified at time of analysis, EPSS is low (0.20%, 11th percentile), and it is not listed in CISA KEV.
Multiple memory corruption flaws in Firefox and Thunderbird enable remote code execution via network-accessible attack vectors. Mozilla Firefox ESR 140.5, Firefox 145, Thunderbird ESR 140.5, and Thunderbird 145 contain memory safety bugs with evidence of corruption that Mozilla presumes exploitable for arbitrary code execution. Authentication requirements not confirmed from available data (CVSS vector shows PR:N). Vendor-released patches available: Firefox 146, Firefox ESR 140.6, Thunderbird 146, Thunderbird 140.6. EPSS probability is low (0.09%, 25th percentile), and no public exploit identified at time of analysis.
Memory corruption vulnerabilities in Mozilla Firefox 145 and Thunderbird 145 enable remote code execution via multiple memory safety bugs. Unauthenticated remote attackers can exploit these flaws (CWE-787 buffer overflow) through network-based attack vectors with low complexity, requiring no user interaction. Mozilla has released patches in Firefox 146 and Thunderbird 146. EPSS score of 0.07% (21st percentile) suggests low observed exploitation probability, and no public exploit identified at time of analysis, though the vendor's assessment indicates memory corruption with exploitable potential.
Same-origin policy bypass in Firefox and Thunderbird request handling allows unauthenticated remote attackers to access sensitive information from cross-origin resources with low attack complexity and no user interaction required. The vulnerability affects Firefox versions below 146, Firefox ESR below 115.31 and 140.6, Thunderbird below 146, and Thunderbird ESR below 140.6. No public exploit code has been identified at time of analysis, and the EPSS score of 0.04% indicates low real-world exploitation probability despite the moderate CVSS rating.
Just-In-Time (JIT) compilation flaws in Mozilla's JavaScript engine allow unauthenticated remote attackers to achieve arbitrary code execution with high integrity and availability impact across Firefox and Thunderbird. Affects Firefox <146, Firefox ESR <140.6, Thunderbird <146, and Thunderbird ESR <140.6. Despite a critical CVSS 9.8 score, EPSS probability remains low at 0.09% (25th percentile), and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis. Vendor-released patches are available across all affected product lines.
Privilege escalation in Mozilla Firefox and Thunderbird Netmonitor component allows remote attackers to execute arbitrary code with elevated privileges when users interact with malicious content. Affects Firefox versions prior to 146, Firefox ESR prior to 140.6, Thunderbird prior to 146, and Thunderbird ESR prior to 140.6. Mozilla released patches in January 2025 across all product lines. EPSS score of 0.07% (22nd percentile) indicates low current exploitation probability, with no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. CVSS 8.8 reflects the high impact potential despite requiring user interaction.
Privilege escalation in Mozilla Firefox and Thunderbird's Netmonitor component allows unauthenticated remote attackers to gain elevated privileges via user interaction. Affects Firefox <146, Firefox ESR <140.6, Thunderbird <146, and Thunderbird ESR <140.6. With an 8.8 CVSS score but only 0.07% EPSS (22nd percentile), no public exploit identified at time of analysis, and vendor-released patches available. Not listed in CISA KEV, indicating no confirmed active exploitation.
Downloads Panel in Mozilla Firefox and Thunderbird allows remote spoofing attacks enabling integrity compromise without authentication. Affects Firefox <146, Thunderbird <146, Firefox ESR <140.7, and Thunderbird ESR <140.7. The authentication bypass flaw (CWE-290) permits network-based attackers to manipulate download information displayed to users with low attack complexity and no user interaction required. Despite CVSS 7.5 (High), EPSS score of 0.02% (3rd percentile) indicates minimal real-world exploitation likelihood. No active exploitation confirmed (not in CISA KEV), and no public exploit identified at time of analysis.
Remote code execution in Mozilla Firefox and Thunderbird (pre-146) allows unauthenticated network attackers to execute arbitrary code via a use-after-free flaw in the GMP (Gecko Media Plugin) audio/video component. Despite a critical CVSS 9.8 rating, EPSS probability remains low (0.08%, 23rd percentile), and no public exploit identified at time of analysis. Mozilla patched both products in version 146, with vendor advisories and technical details available via Bugzilla.
JIT compiler miscompilation in Mozilla Firefox and Thunderbird's JavaScript engine enables remote attackers to achieve limited confidentiality, integrity, and availability impact without authentication or user interaction. Affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird ESR < 140.6. Vendor-released patches available in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. No public exploit identified at time of analysis, with EPSS score of 0.11% (30th percentile) indicating low predicted exploitation probability.
JIT compiler miscompilation in Mozilla's JavaScript engine allows remote code execution without authentication in Firefox (versions <146, <115.31 ESR, <140.6 ESR) and Thunderbird (versions <146, <140.6 ESR). The CVSS 9.8 critical score reflects network-based exploitation requiring no user interaction. EPSS score of 0.10% (27th percentile) suggests low predicted exploitation probability despite severity. No public exploit identified at time of analysis, and vendor-released patches are available across all affected product lines per Mozilla security advisories MFSA2025-92 through MFSA2025-96.
Privilege escalation in Mozilla Firefox and Thunderbird's DOM Notifications component enables unauthenticated remote attackers to achieve high-severity impacts (confidentiality, integrity, availability) via user interaction. Affects Firefox <146, Firefox ESR <115.31 and <140.6, Thunderbird <146 and <140.6. EPSS exploitation probability is low (0.08%, 23rd percentile), and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis. Vendor-released patches are available across all affected product lines.
Sandbox escape in Mozilla Firefox and Thunderbird's CanvasWebGL component allows remote attackers to bypass security boundaries via crafted web content with user interaction. Affects Firefox <146, Firefox ESR <115.31 and <140.6, Thunderbird <146 and Thunderbird ESR <140.6. EPSS probability is low (0.06%, 20th percentile), and no public exploit identified at time of analysis. The CVSS score of 8.0 reflects high confidentiality and integrity impact with scope change, though attack complexity is high and requires user interaction.
Remote code execution via use-after-free in Mozilla Firefox and Thunderbird WebRTC signaling allows unauthenticated network attackers to execute arbitrary code without user interaction. Affects Firefox <146, Firefox ESR <140.6, Thunderbird <146, and Thunderbird ESR <140.6. Vendor-released patches available (Firefox 146, Firefox ESR 140.6, Thunderbird 146, Thunderbird 140.6). CVSS 9.8 (critical) reflects maximum technical severity, though EPSS 0.09% (25th percentile) and absence from CISA KEV suggest limited real-world exploitation at time of analysis. No public exploit identified at time of analysis.
c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.
Local memory corruption in the Linux kernel's ALSA firewire-motu driver allows a user to trigger a buffer overflow when reading DSP events from the hwdep interface with an undersized buffer. The hwdep_read() path copied the full 8-byte DSP event header regardless of the caller-supplied buffer length, writing past the end of the user-provided buffer; the fix clamps the copy with min_t(). There is no public exploit identified at time of analysis, and EPSS is low (0.20%), consistent with a niche driver requiring MOTU FireWire audio hardware.
Server-Side Request Forgery (SSRF) in HTTParty 0.23.2 and earlier enables remote unauthenticated attackers to force the application to make arbitrary HTTP requests to internal network resources and third-party services, potentially leaking API keys and credentials embedded in outbound requests or accessing internal-only endpoints. Publicly available exploit code exists (GitHub Security Advisory GHSA-hm5p-x4rq-38w4), and the CVSS E:P modifier confirms proof-of-concept exploitation. Vendor-released patch is available via commit 0529bcd, though a tagged release version is not confirmed from provided data. EPSS data not provided, but SSRF vulnerabilities targeting API libraries typically see exploitation within weeks of public disclosure due to their prevalence in cloud-native environments.
TLS renegotiation exhaustion in Keycloak allows unauthenticated remote denial of service via repeated client-initiated TLS 1.2 renegotiation requests that drain CPU resources. Affects Red Hat Single Sign-On deployments using TLS 1.2 with client renegotiation enabled. EPSS exploitation probability and KEV status not available at analysis time; CVSS 7.5 (High) reflects network-accessible attack with low complexity but availability impact only. Red Hat has issued multiple security advisories (RHSA-2025:18254, 18255, 18889, 18890) addressing this flaw.
Concurrency-driven information disclosure in the Linux kernel's veth (virtual Ethernet) driver allows old or uninitialized packet descriptors to be exposed to AF_XDP consumers when veth is run in threaded-NAPI mode with an XDP program attached. Because the BPF redirect/return context was moved from per-CPU storage into the 'current' task_struct (commit 401cb7dae813), two concurrent veth_poll() invocations can nest the xdp_set/clear_return_frame_no_direct() section and race, corrupting the shared BPF net context. Despite an NVD CVSS of 9.8, this is a local, configuration-dependent kernel race with EPSS at 0.16% (6th percentile), no KEV listing, and no public exploit identified at time of analysis.
Denial of service in the Linux kernel's jbd2 (JBD2 journaling layer) used by ext4 allows a local attacker to crash the system by mounting a specially crafted or corrupted ext4 image; when journal metadata is inconsistent (e.g. a block bitmap does not reflect an in-use block), jbd2_journal_get_create_access() hits a J_ASSERT/BUG_ON at fs/jbd2/transaction.c:1289 and panics the machine. Affected products span multiple stable kernel branches, with the fix converting the fatal BUG_ON into a JBD2 abort. No public exploit identified at time of analysis and EPSS is low (0.18%), consistent with a locally-triggered availability-only issue rather than a remotely weaponizable flaw.
Denial-of-service potential in the Linux kernel's spinlock debugging instrumentation (do_raw_write_lock) stems from an unmarked read/write in debug_write_lock_before(), producing a data-race flagged by the Kernel Concurrency Sanitizer (KCSAN). Only kernels built with lock debugging enabled are affected, and the fix completes prior race-hardening work (commit 1a365e822372) by converting the remaining access to WRITE_ONCE(). No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile).
Information disclosure in Storybook for Node.js versions 7.0.0 through 10.1.9 exposes environment variables from `.env` files when using `storybook build` command. Unpatched projects building Storybook in directories containing `.env` files risk bundling sensitive credentials into publicly viewable artifacts. Unauthenticated attackers accessing published Storybook bundles can extract secrets from source code. Runtime dev mode, CI builds using platform environment variables, and co-located applications remain unaffected. No public exploit identified at time of analysis.
Use-after-free memory corruption in Apple's WebKit rendering engine allows remote attackers to crash Safari and iOS/iPadOS applications by processing maliciously crafted web content, requiring only user interaction (page visit) and no authentication. The vulnerability affects Safari 26.2, iOS 18.7.3 and iOS 26.2, iPadOS 18.7.3 and iPadOS 26.2, and macOS Tahoe 26.2 and earlier versions. With an EPSS score of 0.06% and no public exploit confirmed, this represents a low real-world exploitation priority despite the moderate CVSS 4.3 severity rating, with impact limited to denial of service through process termination.
Denial-of-service hardening in the Linux kernel's page_pool subsystem addresses noisy allocation-failure handling on the network receive datapath. Because driver authors frequently omit GFP_NOWARN, ATOMIC page allocations that fail under memory pressure emit full allocation-failure warnings/backtraces; the fix makes page_pool add GFP_NOWARN by default for ATOMIC allocations. Rated CVSS 7.5 for availability impact only (C:N/I:N), with no public exploit identified at time of analysis and a low EPSS score (0.17%, 6th percentile).
Denial of service in the Linux kernel's lan966x Ethernet switch driver (Microchip LAN966x SoC) allows a potential deadlock and kernel warning when network statistics are read while holding an atomic context. The driver incorrectly used a sleeping mutex (lan966x_stats_get) inside an atomic/spinlock-held path, tripping a 'sleeping function called from invalid context' BUG and risking system instability; the fix replaces the mutex with a spinlock. No public exploit identified at time of analysis, and the EPSS score is negligible (0.16%, 6th percentile).
Local privilege-context memory corruption in the Linux kernel's io_uring zero-copy send (zctx) path allows a local user to trigger unsafe handling of chained notification (ubuf_info) contexts. The flaw stems from send-zerocopy operations linking ubuf_info structures that may originate from a different io_uring context than assumed, and the fix adds a check enforcing that only same-context notifications are chained. No public exploit has been identified at time of analysis; EPSS is very low (0.16%, 6th percentile) and the issue is not on the CISA KEV list, but the CVSS base score of 7.8 reflects high confidentiality, integrity, and availability impact for a successful local trigger.
Improper validation of node identifiers (nid) in the Linux kernel's F2FS filesystem allows a crafted or corrupted on-disk image to pass an out-of-range nid (where footer.ino equals footer.nid and both exceed valid bounds) through f2fs_alloc_nid() and free_nid_list, potentially causing out-of-bounds access, memory corruption, or a kernel crash. The upstream fix adds a sanity check to detect this corruption. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 6th percentile). Note the published CVSS 9.8 network vector appears inconsistent with the local, filesystem-image-driven nature of this bug.
Privilege-relevant use-after-free in the Linux kernel's drm/msm (Qualcomm Adreno GPU) driver allows a local user with GPU access to trigger kernel faults because last_fence is not waited on at VM-bind context close, freeing GPU resources while they are still in use. Affected systems run the msm DRM driver on Qualcomm SoCs and use vm_bind contexts. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.15%, 5th percentile), consistent with an in-tree kernel fix rather than an in-the-wild threat.
Use-after-free in the Linux kernel Bluetooth HCI core (hci_core) lets an attacker within Bluetooth range trigger a race between the ACL data RX path (l2cap_recv_acldata) and connection teardown (hci_abort_conn_sync/hci_conn_del), causing the RX handler to dereference a freed hci_conn structure. A syzkaller-reproduced crash confirms the flaw, which primarily manifests as denial of service though memory corruption cannot be excluded; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The issue is resolved upstream by moving the hci_conn lookup into the protocol receive handlers under a single RCU/lock-protected critical section.
Kernel memory corruption in the Linux platform/x86 Intel P-Unit IPC driver (intel_punit_ipc) arises from an interrupt handler dereferencing the address of a global pointer variable (&punit_ipcdev) instead of the pointer itself, so the completion call complete(&ipcdev->cmd_complete) in intel_punit_ioc() writes to an incorrect memory location. Affected systems are those running the punit_ipc driver on specific Intel SoC platforms; a local low-privileged actor able to drive the IPC command path can corrupt kernel memory, most plausibly causing instability or a crash. There is no public exploit identified at time of analysis, EPSS is very low (0.17%, 6th percentile), and the issue is not in CISA KEV.
Denial of service in the Linux kernel's Samsung sxgbe 10G Ethernet driver stems from a NULL pointer dereference in sxgbe_rx(), where the receive path logs an error when an skb is NULL but then dereferences that same NULL skb on the following line. The fix adds a 'break' so the code falls through to sxgbe_rx_refill() instead of crashing, mirroring the handling already used by other NIC drivers such as Calxeda's xgmac_rx(). There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile); the bug was found during code review rather than in-the-wild.
Out-of-bounds kernel write in the Linux 'atlantic' network driver (Aquantia/Marvell AQC-series 10G NICs) occurs when the RX path receives large multi-descriptor packets exceeding MAX_SKB_FRAGS (17) fragments, causing a fragment index to overrun the skb frag array inside skb_add_rx_frag_netmem() and triggering a kernel panic. The flaw was observed crashing production systems equipped with the Aquantia AQC113 10G NIC. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.17% (6th percentile), consistent with a hardware-specific denial-of-service condition rather than a broadly exploitable RCE.
Local privilege escalation and memory corruption in the Linux kernel's io_uring networking subsystem stems from vectored registered buffer imports being tied to the wrong io_kiocb (the request 'req' instead of the notification 'sr->notif'), creating an object-lifetime mismatch. Local low-privileged users on affected kernels can trigger use-after-free-style conditions leading to information disclosure or code execution in kernel context. No public exploit identified at time of analysis, and EPSS is low (0.16%).
Denial of service in the Linux kernel's AMD GPU display driver (amdgpu drm/amd/display) allows a local user to crash the system via a NULL pointer dereference in dc_stream_get_scanoutpos(). The flaw triggers during concurrent atomic modeset and cursor operations - reproducible with the IGT kms_cursor_legacy 'long-nonblocking-modeset-vs-cursor-atomic' test when both an eDP panel and a DP monitor are connected. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and this is not in CISA KEV.
Use-after-free in the Linux kernel's libceph client (the in-kernel Ceph transport shared by CephFS and RBD) lets the mount-time wait loop in __ceph_open_session() read a monmap or osdmap structure after a worker thread has freed and replaced it. The flaw is a race between a mounting task polling have_mon_and_osd_map() without locks and ceph_monc_handle_map()/handle_one_map() swapping in a fresh map under their respective locks, producing a KASAN slab-use-after-free (reproducible with xfstests generic/395 and generic/397). There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is very low at 0.18% (8th percentile).
Out-of-bounds kernel memory write in the Linux kernel's libceph client (handle_auth_session_key) allows a malicious or compromised Ceph server to corrupt kernel memory when a client decrypts the connection secret or processes CephX service tickets. The attacker-controlled 'len' field from network packets was used without boundary checks, enabling potential kernel memory corruption and code execution against any host mounting Ceph/RBD storage. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.18%, 8th percentile).
Remote denial-of-service in the Linux kernel's libceph (Ceph client) module allows a malicious or compromised Ceph OSD/monitor to crash the kernel by sending OSDMap packets containing out-of-bounds OSD indexes. Because libceph previously used BUG_ON assertions on OSD index values drawn directly from untrusted network data, an attacker-controlled index exceeding map->max_osd triggers a kernel panic. This is a fixed issue with upstream stable-tree commits; no public exploit has been identified and EPSS exploitation probability is low (0.17%, 7th percentile).
Local privilege escalation and memory corruption in the Linux kernel's NVMe driver arises from a use-after-free in admin request_queue lifetime management, where namespaces retain stale references to a controller's admin request_queue that can be dereferenced after the controller is torn down. Confirmed via a KASAN slab-use-after-free report in blk_queue_enter() triggered through an nvme ioctl (nvme_submit_user_cmd), the flaw affects hosts running NVMe storage and is fixed upstream by reordering the controller 'put' until after all references are released. EPSS is very low (0.03%, 7th percentile) and there is no public exploit identified at time of analysis; exploitation requires local access and a race against controller teardown.
Use-after-free in Linux ksmbd IPC handler allows remote unauthenticated attackers to trigger memory corruption via race condition in generic netlink reply processing. The flaw (CVSS 9.8 critical, network-reachable) affects ksmbd's ipc_msg_send_request() function where concurrent access to response buffers occurs without proper locking. EPSS data not provided; no CISA KEV listing identified at time of analysis. Multiple upstream kernel commits available across stable branches indicate vendor-released patches exist.
Local denial-of-service in the Linux kernel ext4 filesystem allows a low-privileged user to crash the system by racing inline-data destruction against block mapping. The function ext4_destroy_inline_data_nolock() flips an inode from EXT4_INODE_INLINE_DATA to EXT4_INODE_EXTENTS without holding i_data_sem, so a concurrent ext4_map_blocks() can enter ext4_ind_map_blocks() on an inode that already advertises extents, tripping a BUG_ON at fs/ext4/indirect.c:546 and panicking the kernel. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and the flaw is availability-only (kernel oops), not information disclosure despite the input tag.
Local privilege escalation potential in the Linux kernel's experimental Rust Binder driver (rust_binder) arises from a race condition on a node's death_list where NodeDeath entries can be concurrently manipulated. During Node::release the driver moves death entries to a stack-local list while other threads call an unsafe remove() on the original list, corrupting the prev/next pointers and producing kernel memory corruption (observed as a paging-request Oops on ARM64 Android 6.12 kernels). No public exploit has been identified and EPSS is low (0.20%), but the flaw yields high confidentiality, integrity, and availability impact if a local attacker wins the race.
Denial of service and out-of-bounds memory read in the Linux kernel's staging rtl8723bs Realtek Wi-Fi driver allows an attacker within radio range to crash or hang a vulnerable device by transmitting a malformed 802.11 frame. The rtw_get_ie() Information Element parser trusted the attacker-supplied IE length byte without bounds-checking, so a crafted length can push the parser past the frame buffer, producing OOB reads or an infinite loop. No public exploit is identified at time of analysis (EPSS 0.07%, 21st percentile) and the issue is not in CISA KEV; it has been fixed upstream and shipped in Ubuntu security updates.
Adjacent-network stack buffer overflow in the Linux kernel's rtl8723bs staging Wi-Fi driver lets a nearby malicious station corrupt kernel stack memory by sending a crafted 802.11 Association Request. The OnAssocReq handler copied the Supported Rates IE into a fixed 16-byte stack buffer using the attacker-controlled IE length without bounds checking, enabling denial of service and potentially kernel code execution. Rated CVSS 8.8; no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with an unauthenticated but proximity-limited radio attack.
Out-of-bounds read in the Linux kernel's staging rtl8723bs Realtek Wi-Fi driver allows an adjacent attacker to trigger a kernel panic by broadcasting a malformed 802.11 beacon frame. The OnBeacon handler parses an Extended Supported Rates (ESR) information element positioned at the end of the received frame buffer without bounds validation, reading past the buffer. No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.17%), but the flaw is remotely reachable over the air against any device using this driver.
Spurious kernel warnings in the Linux kernel hung_task blocker-tracking mechanism arise on architectures that align 32-bit values on 2-byte boundaries (e.g., m68k), where the code incorrectly assumes lock pointers are always 4-byte aligned so it can pack a type tag into the lower two pointer bits. The mismatch trips two WARN_ON_ONCE checks; the fix silently ignores non-4-byte-aligned locks, disabling the feature on those platforms. This is an internal kernel robustness fix rather than a remotely reachable attack primitive, with no public exploit identified at time of analysis and a low EPSS score of 0.15% (5th percentile).
Remote unauthenticated denial of service in the Linux kernel's ksmbd in-kernel SMB server allows an attacker to exhaust kernel socket resources by repeatedly tripping the per-IP connection limit. When ksmbd_kthread_fn() rejects a connection that exceeds the per-IP limit, it sets ret = -EAGAIN and continues the accept loop without releasing the just-accepted socket, leaking one socket per rejected attempt from a single source IP. This is a resource-leak DoS with no public exploit identified at time of analysis and a low EPSS score (0.16%, 6th percentile).
Client-identity confusion in the Linux kernel's NFS client allows a low-privileged local user to have an NFS mount silently reuse an existing RPC connection established under a different TLS X.509 client certificate. Because nfs_match_client() failed to compare the cert_serial and privkey_serial fields that define the client's presented identity, a mount intended to use one certificate could be bound to a connection authenticated with another, enabling access to data under the wrong identity. This is an information-disclosure/identity-mismatch flaw (CVSS 7.0); it is not in CISA KEV, has no public exploit identified at time of analysis, and carries a very low EPSS score of 0.10% (1st percentile).
Denial of service in the Linux kernel IPv4 routing subsystem allows a permanent device reference-count leak through a race condition in FIB next-hop exception (fnhe) handling. On systems using tunnel drivers such as sit or gretap, concurrent transmit paths can bind a soon-to-be-freed fnhe to a new dst, leaking the dst and its device reference so the interface can never be unregistered (visible as 'unregister_netdevice: waiting for sitX to become free'). This is availability-only, has no public exploit identified at time of analysis, and carries a low EPSS score of 0.17%.
Local privilege-relevant memory corruption in the Linux kernel's io_uring cmd_net timestamp-retrieval path arises from transposed arguments to skb_queue_splice(), causing SKBs to be spliced in the wrong direction between the socket queue and an on-stack list. Any local user able to issue io_uring network commands with timestamp retrieval could trigger the flawed splice, potentially leading to information disclosure (per source tagging) or broader list/memory corruption. There is no public exploit identified at time of analysis and EPSS is low (0.15%), so this is a code-quality/security hardening fix rather than an actively exploited threat.
Denial of service in the Linux kernel's veth (virtual Ethernet) driver allows a permanently stalled transmit queue and halted network traffic once a lost-wakeup race is triggered under load. The flaw is a regression introduced by commit dc82a33297fc ('veth: apply qdisc backpressure on full ptr_ring'), where the producer in veth_xmit() misuses the __ptr_ring_empty() API to decide whether to re-wake a stopped TXQ; when a consumer on another CPU empties the ring concurrently, the wakeup is lost and the queue stays in QUEUE_STATE_DRV_XOFF. It was observed in production on ARM64 (Ampere Altra Max) systems. There is no public exploit identified at time of analysis, EPSS is low (0.16%), and it is not in CISA KEV.
Use-after-free in the Linux kernel's SMB/CIFS client (cifs module) arises from an incomplete backport of commit bdb596ceb4b7, which left a stale kref_put() call in cfids_invalidation_worker() instead of converting it to close_cached_dir(). The flaw affects the cached-directory (cfid) invalidation path used when a Linux system mounts remote SMB shares, and with a CVSS of 8.8 (C:H/I:H/A:H) could allow memory corruption leading to information disclosure or code execution. There is no public exploit identified at time of analysis and the EPSS probability is low (0.15%).
Denial of service in the Linux kernel's NVMe multipath subsystem allows a lockdep-detected deadlock among disk->open_mutex, the kblockd workqueue, and partition_scan_work completion, which can hang block-device operations. The fix moves partition_scan_work off the kblockd workqueue onto nvme_wq to break the lock-dependency cycle. No public exploit identified at time of analysis; the issue surfaces intermittently during NVMe partition scanning on systems using NVMe multipath.
Improper resource cleanup in the Linux kernel's Intel ice Ethernet driver leaves PTP (Precision Time Protocol) resources leaked when driver probe, PTP initialization, or PTP restart hits an error path. On subsequent driver removal the leaked PF PTP state and un-deinitialized 'ps_lock' mutex trigger a kernel WARNING in ice_adapter_put, and the PTP clock is left registered. No public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and there is no CISA KEV listing; this is a robustness/error-handling defect requiring local privileged access to the NIC driver.
Local privilege-level information disclosure and memory corruption in the Linux kernel's VFS statmount() implementation arises from an uninitialized output-offset pointer ('offp') in statmount_string(). When a caller requests the STATMOUNT_MNT_UIDMAP or STATMOUNT_MNT_GIDMAP fields, those code paths write directly to the struct fields and never assign 'offp', so a later dereference of the uninitialized pointer can leak kernel memory or corrupt state. The CVSS 3.1 vector (AV:L/PR:L) indicates a local, low-privileged attacker is required; there is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile).
Out-of-bounds memory access in the Linux kernel's eBPF verifier (widen_imprecise_scalars()) allows a local actor able to load eBPF programs to read or corrupt kernel memory beyond the bpf_verifier_state stack array. The flaw arises because the verifier assumed an ancestor state (prev_st) shares the same allocated_stack depth as a newly queued state (queued_st), which is false when the same callsite is invoked with differently sized stack frames. No public exploit has been identified at time of analysis; EPSS risk is low (0.17%, 7th percentile) and the issue has been resolved upstream.
Local privilege escalation and memory corruption in the Linux kernel's Intel Xe GPU driver (drm/xe/guc) arises from a use-after-free race during device unbind: the GuC 'Dead CT' worker is not synchronized with the unbind path, so it can access GuC communication-transport resources after they have already been freed. Exploitation requires local access with low privileges (CVSS 7.8, AV:L/PR:L) and can result in high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the low EPSS (0.17%) reflects the niche, timing-dependent nature of the flaw.
Denial of service in the Linux kernel's netfilter nftables connection-tracking (nft_ct) code allows disruption of FTP passive-mode (PASV/EPSV) sessions on hosts acting as NAT gateways. When an nftables FTP conntrack helper is assigned to a connection that already has a NAT binding (helper set after DNAT), the required nfct_seqadj sequence-adjustment extension is never allocated, so the FTP payload mangling path hits a kernel WARNING and tears down the control connection ("Service not available, remote server has closed connection"); on kernels built with panic_on_warn this escalates to a full crash. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%), and it is not in CISA KEV.
Out-of-bounds memory access in the Linux kernel's AMD CPU microcode-matching logic affects systems running on AMD Zen5 processors, where the zen5_rdseed_microcode revision table lacks a terminating sentinel entry. When x86_match_min_microcode_rev() iterates this array during CPU initialization on a Zen5 part, it reads past the array bounds, tripping KASAN and potentially disclosing adjacent kernel memory or causing instability. No public exploit identified at time of analysis, and EPSS risk is low (0.16%, 6th percentile).
Kernel panic (denial of service) in the Linux kernel's qmi_wwan USB WWAN driver occurs because qmimux_rx_fixup() leaves skb->mac_header uninitialized for raw-IP packets that have no MAC header; on ARM64, strict-alignment access to that offset by xfrm/IPsec crashes the machine. The flaw is reachable when IPsec (ESP) traffic is received over a qmimux0 multiplexed interface, as shown by the provided oops in xfrm_input(). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), consistent with a config-specific crash rather than broad remote code execution.
Improper GEM object cleanup in the Linux kernel's drm/msm (Qualcomm Adreno) graphics driver mishandles imported dma-bufs, because the free path only checked object flags without accounting for imported buffers whose reservation object differs from the embedded default. A local user with DRM/GPU access can trigger the faulty path (reproduced during hardware-accelerated IRIS video playback under GNOME Shell) by closing a GEM handle backed by an imported dma-buf, producing a kernel WARNING at msm_gem.c:1127 and potential incorrect reservation-object handling during buffer teardown. There is no public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and this is not on CISA KEV.
Broken AFBC (Arm Frame Buffer Compression) handling in the Linux kernel's Mediatek DRM driver on MT8188 (Genio 700) SoCs causes constant vblank timeouts and garbled display output when the 32x8/split/sparse AFBC modifier is used, which Mesa v25.0+ enables by default. A local user with GPU/display access can trigger a hung display pipeline (denial of service) and rendering of stale/garbled framebuffer contents (limited information disclosure). No public exploit identified at time of analysis, and EPSS is very low (0.17%, 7th percentile), consistent with a hardware-specific reliability bug rather than a widely weaponizable flaw.
Integrity protection weakening in the Linux kernel's IMA (Integrity Measurement Architecture) subsystem allows a stored IMA file signature to be silently downgraded to a plain IMA hash. When IMA and EVM run in fix mode (e.g. booting with 'ima_appraise=fix evm=fix ima_policy=appraise_tcb'), the kernel incorrectly clears the IMA_DIGSIG flag whenever a non-IMA security xattr (such as security.selinux or security.evm) or an ACL is set or removed after security.ima was written, so on file close a hash is generated instead of preserving the intended signature. A full C reproducer is embedded in the report, but there is no CISA KEV listing and no public weaponized exploit identified at time of analysis; EPSS is 0.17% (7th percentile).
Memory corruption (use-after-free) in the Linux kernel's Intel iwlwifi wireless driver, specifically in iwl_mld_remove_link(), where the code frees the 'link' object via kfree_rcu() and then dereferences it to read link->fw_id. On systems with Intel WiFi hardware using the newer MLD (multi-link device) code path, a triggered link-removal race can access freed memory, most likely crashing the kernel (denial of service) with only a theoretical path to further corruption. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS probability is low (0.16%, 6th percentile).
Local privilege-escalation-class use-after-free in the Linux kernel's radeon (AMD GPU) DRM driver, triggered on the probe-error and device-removal paths. After the driver switched its main structure to devm_drm_dev_alloc(), the leftover drm_put_dev() calls cause devres to release the already-freed device a second time, producing a refcount underflow ('refcount_t: underflow; use-after-free') and dangling reference. No public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and the issue is not listed in CISA KEV.
Kernel crashes and memory corruption in the Linux kernel on IBM s390/s390x systems occur when the HugeTLB Vmemmap Optimization (HVO) feature is enabled, because s390 architecture rules forbid overwriting an active/valid page table entry with another valid entry without first invalidating it, and the HVO path modifies kernel page tables without a compliant TLB flush. The upstream fix disables ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP on s390, effectively reverting the patch that enabled it. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is tagged as a Denial of Service issue rather than an exploitation primitive.
Local denial-of-service (and potential memory corruption) in the Linux kernel's NXP i.MX8 ISI media capture driver (imx8-isi) allows a low-privileged user with access to an ISI /dev/videoX device to trigger a WARNING and driver error state by simply querying device controls while a capture stream is active. The flaw stems from mxc_isi_video_release() unconditionally tearing down streaming state, so any release call (e.g. from `v4l2-ctl -l`) can free a queue that is still streaming. No public exploit is identified at time of analysis and EPSS risk is negligible (0.03%), though a deterministic crash-reproduction recipe is published in the fix commit.
Local denial-of-service (and potential memory corruption) in the AMD amdkfd (Kernel Fusion Driver) component of the Linux kernel arises from a race between GPU compute-partition switching and asynchronous KFD process teardown. Because the driver's partition-switch path only checks whether the kfd_processes_table is empty - while the actual kfd_process teardown runs later in the kfd_process_wq workqueue - a partition switch can free kfd_node structures still being accessed by an in-flight release, producing a divide-by-zero kernel oops (observed in kfd_get_num_sdma_engines). No public exploit identified at time of analysis, EPSS is low (0.16%), and it is not listed in CISA KEV.
Cross-task FPU state leakage in the Linux kernel x86 XFD (Extended Feature Disable) handling allows a local low-privileged task to trigger an inconsistent AMX/dynamic-feature register state during signal delivery. When a non-AMX task is preempted by an AMX-enabled task that changes the XFD MSR, fpu__clear_user_states() failed to re-synchronize XFD, producing a state mismatch (kernel WARNING) and potential exposure of dynamic FPU register contents. Tagged as an information-disclosure issue; no public exploit identified at time of analysis and EPSS is low (0.17%, 7th percentile).
Kernel memory corruption in the Linux drm/radeon GPU driver occurs because the driver calls kfree() on the rdev main structure that is now managed by devres (via devm_drm_dev_alloc()), causing a double-free when the driver probe fails and devres later cleans up the already-freed allocation. Local users on systems with AMD/ATI Radeon hardware may trigger memory corruption during a failed driver probe, most directly resulting in a kernel crash. There is no public exploit identified at time of analysis, and the EPSS score is low (0.17%, 7th percentile), consistent with an error-path bug rather than a broadly exploitable flaw.
Denial-of-service in the Linux kernel JFS filesystem driver lets a local low-privileged actor crash the system by mounting a JFS volume read-only. Because txInit() started its waitqueue-initialization loop at index 1, TxBlock[0].waitor is left uninitialized; a read-only mount returns tid=0 and the subsequent txEnd(0) dereferences that uninitialized waitqueue, triggering a lockdep 'non-static key' warning and a kernel crash. EPSS is low (0.18%, 8th percentile), there is no public exploit identified at time of analysis, and it is not in CISA KEV - impact is a crash rather than code execution.
Denial-of-service via invalid pointer access exists in the Linux kernel gpiolib debugfs interface, where a failed memory allocation in gpiolib_seq_start() leaves s->private uninitialized and later dereferenced in gpiolib_seq_stop(), crashing the kernel. The flaw affects systems exposing the GPIO debugfs seq_file (/sys/kernel/debug/gpio) and is triggerable only under memory-allocation failure. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and it is not on CISA KEV.
Authorization bypass in the Linux kernel CephFS client (ceph module) lets an authenticated Ceph user exercise MDS auth capabilities granted for one filesystem against a different filesystem in a multi-filesystem (multifs) Ceph cluster. Because the kernel client failed to validate the fsname alongside the associated caps, a user holding read-only rights on 'fsname1' but read-write rights on 'fsname2' would incorrectly gain read-write on 'fsname1', enabling file creation and deletion they should not be permitted. No public exploit identified at time of analysis, and the EPSS score is low (0.25%, 16th percentile), consistent with a specialized storage-cluster condition rather than mass exploitation.
Out-of-bounds memory access in the RISC-V stack unwinder (walk_stackframe) of the Linux kernel lets KASAN trip and read past a task's kernel stack boundary when unwinding a task other than the current one. The defect mirrors a previously fixed x86 issue (commit 84936118bdf3) and is reached through normal task-introspection paths on RISC-V builds. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.03%, 7th percentile), and it is not in CISA KEV; the fix disables KASAN checks for non-current tasks.
Local privilege-relevant memory corruption/disclosure risk exists in the Linux kernel's Rockchip SFC (Serial Flash Controller) SPI driver (spi-rockchip-sfc), where improper DMA-API usage - deriving DMA addresses via virt_to_phys() instead of dma_map_single() - causes the driver to sync DMA memory it never properly mapped. On affected Rockchip-based systems (e.g. ODROID-M1), this triggers a DMA-API debug warning and reflects an underlying unsafe memory-transfer path during SPI-NOR flash operations. No public exploit identified at time of analysis; EPSS probability is low (0.16%, 6th percentile).
Kernel memory corruption in the Linux kernel's AMD Display (amdgpu/DC) driver stems from an undersized dc->links[MAX_LINKS] array and an unchecked link->enc pointer, letting a local attacker on AMD-GPU systems trigger an out-of-bounds access and NULL-pointer dereference during hw_init() for DisplayPort-over-USB4 (DPIA) endpoints. Rated CVSS 7.8 (AV:L/PR:L) and tagged as denial-of-service, it most realistically causes a kernel crash. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.17% (7th percentile).
Memory mishandling in the Linux kernel's mlx5e (NVIDIA/Mellanox ConnectX) RX path lets a loaded XDP program corrupt skb generation on striding RQ, causing kernel warnings, a BUG_ON crash, or erroneous packet buffers. The flaw affects systems using mlx5 NICs where a multi-buffer XDP program calls bpf_xdp_adjust_head() or bpf_xdp_adjust_tail() to change the xdp_buff layout, which the driver wrongly assumed was static. This is a resolved upstream kernel fix with no public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and it is not in CISA KEV.
Out-of-bounds read in the Linux kernel HFS+ (hfsplus) filesystem driver allows a local attacker to crash the kernel via a crafted HFS+ B-tree node whose record offset or length in hfsplus_bmap_alloc exceeds node_size, causing access beyond the node's allocated pages. The flaw is reached during node allocation (hfs_btree_inc_height → hfsplus_brec_insert) when writing to files on a malicious HFS+ image, with KASAN confirming a slab-out-of-bounds read. Reported as a denial-of-service issue with a low EPSS score (0.18%, 8th percentile); no public exploit identified at time of analysis and it is not in CISA KEV.
Denial of service in the Linux kernel's NXP ENETC Ethernet driver (enetc) on Layerscape LS1028A platforms allows the CPU to hang under normal network load, causing RCU stalls on PREEMPT_RT kernels. The flaw stems from recursive acquisition of the read-side enetc_mdio_lock in the enetc_poll NAPI path, which deadlocks when a higher-priority writer is queued between two reader acquisitions. No public exploit identified at time of analysis; EPSS is very low (0.03%, 8th percentile) and it is not CISA KEV listed, consistent with a reliability/self-triggered availability bug rather than an attacker-weaponized flaw.
Keycloak's admin API endpoints for authorization resource management contain an IDOR vulnerability allowing authenticated administrators with fine-grained permissions for one client to delete or modify resources belonging to other clients within the same realm. The flaw exists in ResourceSetService and PermissionTicketService where authorization checks validate the resourceServer (client) ID from the API request, but backend database operations use only the resourceId, creating a permission bypass. Affected administrators can exploit this with standard HTTP requests to cross-client resource boundaries; no public exploit code identified at time of analysis.
Privilege escalation in Red Hat's runtimes-inventory-rhel8-operator lets a standard cluster user act with full cluster-administrator authority on the Red Hat management platform. A misconfigured internal proxy attaches the cluster's main administrative credentials to every command it relays - not just the report traffic it should handle - so any authenticated user can issue admin-level instructions and alter cluster configuration or status. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 12th percentile), and the issue is not in CISA KEV, but the impact is a classic confused-deputy authentication bypass and Red Hat has shipped a fix.
Integer overflow in GLib's GIO escape_byte_string() function enables heap buffer overflow and denial-of-service when processing malicious filesystem attribute values over the network. The vulnerability affects GLib across GNOME, Red Hat Enterprise Linux 7-10, and OpenShift 4.0+, requiring only unauthenticated network access and user interaction. EPSS score of 0.07% (percentile 22) indicates low exploitation probability despite CVSS 6.5, suggesting the attack requires specific file/attribute handling conditions; no public exploit or active exploitation (CISA KEV) confirmed at analysis time.
Heap corruption in GLib (GNOME's core C utility library) lets remote attackers trigger a buffer-underflow in the GVariant parser by supplying maliciously crafted serialized/text input, resulting in denial of service and potentially arbitrary code execution. Any application linking GLib that deserializes untrusted GVariant data is exposed, which spans broad swaths of the Linux desktop and system stack across Red Hat Enterprise Linux 7-10 and SUSE. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.26%, 49th percentile) despite the 9.8 CVSS, indicating the headline severity is not yet matched by observed exploitation interest.
The CNI portmap plugin versions 1.6.0 through 1.8.0 contain a traffic interception vulnerability when configured with the nftables backend, allowing containers to receive and intercept all traffic destined for their configured HostPort regardless of destination IP address. This affects Linux Foundation's CNI Network Plugins, and an attacker with local privileges and control over a container can intercept traffic intended for other containers or services on the same node. The vulnerability has a published patch available in version 1.9.0, an extremely low EPSS score of 0.02% indicates minimal real-world exploitation likelihood, and there is no indication of active exploitation in the wild.
A slab use-after-free in the Linux kernel's Intel AVS (Audio Voice Speech / Smart Sound Technology) ASoC driver lets a local user with access to a HOST HDAudio PCM stream corrupt kernel memory by racing PCM close against period-elapsed IRQ work. When avs_dai_fe_shutdown() frees the DAI's private context while the period-elapsed work is still servicing interrupts, the freed structure can be accessed concurrently, yielding a use-after-free with high confidentiality, integrity and availability impact (CVSS 7.8, AV:L). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.20%, 10th percentile), reflecting the local-only, hardware-specific nature of the flaw.
Denial-of-service (kernel use-after-free/double-free) in the Linux kernel's nvmet-fc NVMe-over-Fibre-Channel target driver allows a local privileged operator to crash the kernel by forcibly shutting down an NVMe target port via configfs. When a port is torn down, nvmet_port_subsys_drop_link() calls both nvmet_port_del_ctrls() and nvmet_disable_port(), each of which can schedule the same association-deletion work item; the first run frees all resources and the second reuses freed memory. This is a fix already merged upstream in the stable trees, with no public exploit identified at time of analysis and a low EPSS score (0.21%, 11th percentile).
Denial of service and potential memory corruption in the Linux kernel's NVMe over Fibre Channel (nvme-fc) transport arises because nvme_fc_create_association reads the remote port_state and increments the rport active count without holding a lock, racing against nvme_fc_unregister_remote which can free the remote port when no active association exists. An attacker or fault condition on the FC fabric able to trigger reconnect events concurrently with port teardown can drive a use-after-free style condition on the rport object. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile).
Data-integrity corruption in the Linux kernel's stmmac (Synopsys DesignWare/STMMAC) Ethernet driver allows malformed packets that failed hardware checksum validation to be accepted as valid by the network stack. When hardware checksum offload (CoE) is enabled, the Rx path marked known IP-ethertype frames as CHECKSUM_UNNECESSARY without honoring the hardware's reported header/payload checksum error, so corrupt frames bypass the stack's own validation. There is no public exploit identified at time of analysis, KEV status is not listed, and EPSS is low (0.20%, 11th percentile).
Local privilege-escalation and memory-disclosure flaw in the Linux kernel's DRM GPU SVM (Shared Virtual Memory) subsystem, where incorrect use of hmm_pfn_to_map_order() mishandles an HMM range that only partially covers a huge page (e.g. 2MB), causing the driver to map physical memory outside the intended range - memory that may not even belong to the faulting process's address space. Affecting recent kernels carrying the drm/gpusvm code (associated with the Intel Xe GPU driver's userptr/SVM path), a local user with GPU access can trigger cross-boundary mappings leading to information disclosure or memory corruption. There is no public exploit identified at time of analysis, and EPSS is low at 0.19% (9th percentile).
Local memory-safety flaw in the Linux kernel's AMD GPU (amdgpu) driver allows an authenticated local user to submit a user queue (userq) whose buffer virtual address and size are not validated against a legitimate VM mapping. Because the driver failed to confirm the userq object resides in a valid GPU virtual-memory mapping before use, a low-privileged process with GPU device access could reference out-of-bounds or unmapped memory, tagged as an information-disclosure issue with additional integrity and availability impact. No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile), consistent with a local-only kernel driver bug rather than a mass-exploited network flaw.
Local privilege-relevant out-of-bounds kernel write in the Linux kernel's SCTP subsystem lets an unprivileged local user corrupt kernel heap memory by exploiting a time-of-check/time-of-use (TOCTOU) gap in the SCTP diagnostic dump path (sctp_diag_dump → sctp_for_each_endpoint → sctp_ep_dump), which runs without holding the socket lock. Because the address list can grow between buffer allocation and the subsequent write, an attacker who races the dump against concurrent address additions can force a write past the allocated bounds, yielding potential memory corruption (CVSS 7.8, C/I/A High). There is no public exploit identified at time of analysis and EPSS is low (0.21%, 12th percentile), consistent with a race-dependent local flaw rather than a mass-exploited network bug.
Use-after-free in the Linux kernel's SMB client (cifs) cached-directory handling lets a race between find_or_create_cached_dir() and smb2_close_cached_fid() free a cfid object while a new reference is being taken, corrupting kernel memory on a host mounting an SMB/CIFS share. The flaw is a reference-counting gap fixed by switching to kref_put_lock() so cfid_release() runs under cfid_list_lock. No public exploit identified at time of analysis, EPSS is low (0.20%, 11th percentile), and it is not listed in CISA KEV.
Multiple memory corruption flaws in Firefox and Thunderbird enable remote code execution via network-accessible attack vectors. Mozilla Firefox ESR 140.5, Firefox 145, Thunderbird ESR 140.5, and Thunderbird 145 contain memory safety bugs with evidence of corruption that Mozilla presumes exploitable for arbitrary code execution. Authentication requirements not confirmed from available data (CVSS vector shows PR:N). Vendor-released patches available: Firefox 146, Firefox ESR 140.6, Thunderbird 146, Thunderbird 140.6. EPSS probability is low (0.09%, 25th percentile), and no public exploit identified at time of analysis.
Memory corruption vulnerabilities in Mozilla Firefox 145 and Thunderbird 145 enable remote code execution via multiple memory safety bugs. Unauthenticated remote attackers can exploit these flaws (CWE-787 buffer overflow) through network-based attack vectors with low complexity, requiring no user interaction. Mozilla has released patches in Firefox 146 and Thunderbird 146. EPSS score of 0.07% (21st percentile) suggests low observed exploitation probability, and no public exploit identified at time of analysis, though the vendor's assessment indicates memory corruption with exploitable potential.
Same-origin policy bypass in Firefox and Thunderbird request handling allows unauthenticated remote attackers to access sensitive information from cross-origin resources with low attack complexity and no user interaction required. The vulnerability affects Firefox versions below 146, Firefox ESR below 115.31 and 140.6, Thunderbird below 146, and Thunderbird ESR below 140.6. No public exploit code has been identified at time of analysis, and the EPSS score of 0.04% indicates low real-world exploitation probability despite the moderate CVSS rating.
Just-In-Time (JIT) compilation flaws in Mozilla's JavaScript engine allow unauthenticated remote attackers to achieve arbitrary code execution with high integrity and availability impact across Firefox and Thunderbird. Affects Firefox <146, Firefox ESR <140.6, Thunderbird <146, and Thunderbird ESR <140.6. Despite a critical CVSS 9.8 score, EPSS probability remains low at 0.09% (25th percentile), and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis. Vendor-released patches are available across all affected product lines.
Privilege escalation in Mozilla Firefox and Thunderbird Netmonitor component allows remote attackers to execute arbitrary code with elevated privileges when users interact with malicious content. Affects Firefox versions prior to 146, Firefox ESR prior to 140.6, Thunderbird prior to 146, and Thunderbird ESR prior to 140.6. Mozilla released patches in January 2025 across all product lines. EPSS score of 0.07% (22nd percentile) indicates low current exploitation probability, with no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. CVSS 8.8 reflects the high impact potential despite requiring user interaction.
Privilege escalation in Mozilla Firefox and Thunderbird's Netmonitor component allows unauthenticated remote attackers to gain elevated privileges via user interaction. Affects Firefox <146, Firefox ESR <140.6, Thunderbird <146, and Thunderbird ESR <140.6. With an 8.8 CVSS score but only 0.07% EPSS (22nd percentile), no public exploit identified at time of analysis, and vendor-released patches available. Not listed in CISA KEV, indicating no confirmed active exploitation.
Downloads Panel in Mozilla Firefox and Thunderbird allows remote spoofing attacks enabling integrity compromise without authentication. Affects Firefox <146, Thunderbird <146, Firefox ESR <140.7, and Thunderbird ESR <140.7. The authentication bypass flaw (CWE-290) permits network-based attackers to manipulate download information displayed to users with low attack complexity and no user interaction required. Despite CVSS 7.5 (High), EPSS score of 0.02% (3rd percentile) indicates minimal real-world exploitation likelihood. No active exploitation confirmed (not in CISA KEV), and no public exploit identified at time of analysis.
Remote code execution in Mozilla Firefox and Thunderbird (pre-146) allows unauthenticated network attackers to execute arbitrary code via a use-after-free flaw in the GMP (Gecko Media Plugin) audio/video component. Despite a critical CVSS 9.8 rating, EPSS probability remains low (0.08%, 23rd percentile), and no public exploit identified at time of analysis. Mozilla patched both products in version 146, with vendor advisories and technical details available via Bugzilla.
JIT compiler miscompilation in Mozilla Firefox and Thunderbird's JavaScript engine enables remote attackers to achieve limited confidentiality, integrity, and availability impact without authentication or user interaction. Affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird ESR < 140.6. Vendor-released patches available in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. No public exploit identified at time of analysis, with EPSS score of 0.11% (30th percentile) indicating low predicted exploitation probability.
JIT compiler miscompilation in Mozilla's JavaScript engine allows remote code execution without authentication in Firefox (versions <146, <115.31 ESR, <140.6 ESR) and Thunderbird (versions <146, <140.6 ESR). The CVSS 9.8 critical score reflects network-based exploitation requiring no user interaction. EPSS score of 0.10% (27th percentile) suggests low predicted exploitation probability despite severity. No public exploit identified at time of analysis, and vendor-released patches are available across all affected product lines per Mozilla security advisories MFSA2025-92 through MFSA2025-96.
Privilege escalation in Mozilla Firefox and Thunderbird's DOM Notifications component enables unauthenticated remote attackers to achieve high-severity impacts (confidentiality, integrity, availability) via user interaction. Affects Firefox <146, Firefox ESR <115.31 and <140.6, Thunderbird <146 and <140.6. EPSS exploitation probability is low (0.08%, 23rd percentile), and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis. Vendor-released patches are available across all affected product lines.
Sandbox escape in Mozilla Firefox and Thunderbird's CanvasWebGL component allows remote attackers to bypass security boundaries via crafted web content with user interaction. Affects Firefox <146, Firefox ESR <115.31 and <140.6, Thunderbird <146 and Thunderbird ESR <140.6. EPSS probability is low (0.06%, 20th percentile), and no public exploit identified at time of analysis. The CVSS score of 8.0 reflects high confidentiality and integrity impact with scope change, though attack complexity is high and requires user interaction.
Remote code execution via use-after-free in Mozilla Firefox and Thunderbird WebRTC signaling allows unauthenticated network attackers to execute arbitrary code without user interaction. Affects Firefox <146, Firefox ESR <140.6, Thunderbird <146, and Thunderbird ESR <140.6. Vendor-released patches available (Firefox 146, Firefox ESR 140.6, Thunderbird 146, Thunderbird 140.6). CVSS 9.8 (critical) reflects maximum technical severity, though EPSS 0.09% (25th percentile) and absence from CISA KEV suggest limited real-world exploitation at time of analysis. No public exploit identified at time of analysis.
c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.