Red Hat
Monthly
Use-after-free in the Linux kernel's IOMMUFD subsystem (iommu/iommufd) exposes systems running VFIO device passthrough to kernel memory corruption by a local low-privileged attacker, with a scope change that may cross security boundaries into the hypervisor layer. The flaw, present since Linux 6.11, stems from a race between IOPF group acceptance by the fault handler and concurrent device detach operations, leaving IOMMUFD's deliver list holding references to memory already freed by the generic pending list cleanup path. No public exploit or active exploitation has been identified at time of analysis - EPSS stands at 0.17% (6th percentile) and the vulnerability is absent from CISA KEV - though the CVSS 3.1 score of 8.8 reflects the severity of potential impact in affected virtualization environments.
Double-free memory corruption in the Linux kernel's pinctrl/devicetree subsystem enables a local low-privileged attacker on systems running affected pinctrl drivers - such as pinctrl-imx on NXP iMX6 platforms - to corrupt kernel heap memory, with theoretical potential for local privilege escalation. The flaw resides in the error-cleanup path of `dt_remember_or_free_map()`: when `kstrdup_const()` fails mid-loop, `dt_free_map()` iterates over all map entries including those never initialized by the core, passing uninitialized `kmalloc()` data to `kfree_const()` - a KASAN-confirmed double-free. No public exploit identified at time of analysis; the EPSS score of 0.18% (8th percentile) reflects very low real-world exploitation probability despite the formal CVSS 7.8 rating.
List corruption in the Linux kernel's hugetlb memory management subsystem (`mm/hugetlb`) allows a local low-privileged attacker to trigger kernel memory corruption, potentially achieving privilege escalation or host crash. The flaw was confirmed as causing real-world KVM host panics in dense virtualization environments where QEMU and SPDK/DPDK vhost-user processes share a hugetlbfs MAP_SHARED mapping; with CONFIG_DEBUG_LIST disabled, the corruption silently embeds a kernel stack address into an active cache list, setting up a use-after-free. No public exploit has been identified at time of analysis; EPSS is 0.17% and the vulnerability is not in CISA KEV, but fixed stable kernel releases are available across all active branches.
KVM on AMD SVM-enabled hosts fails to update x2APIC MSR intercepts when AVIC is inhibited while a nested guest (L2) is running, allowing an L1 guest with root-level privileges to directly access the host's APIC state, send arbitrary interrupts, and crash the host kernel. Affected Linux kernels from 6.0 through multiple stable branches expose the host to interrupt manipulation, task priority changes, and denial-of-service. A functional proof-of-concept demonstrating both spurious interrupt injection and wakeup handler corruption is embedded in the CVE description itself; this vulnerability is not currently listed in the CISA KEV catalog and carries a 0.17% EPSS score consistent with its narrow but severe exploitation conditions.
KVM s390 PCI subsystem in the Linux kernel allows a local low-privileged user to corrupt hypervisor resources by repeatedly calling the adapter interrupt forwarding ioctl for the same zPCI device without prior unregistration. The vulnerability affects IBM Z (s390) systems running Linux KVM with PCI passthrough from commit 3c5a1b6f onwards (Linux 6.0+), with patched stable releases available. No public exploit exists and EPSS sits at 0.17% (6th percentile), reflecting the niche architecture and local-access prerequisite, but the CVSS Scope:Changed designation signals the flaw can cross the guest-to-hypervisor boundary, elevating its priority on affected IBM Z KVM deployments.
Use-after-free in the Linux kernel's dibs loopback subsystem allows a local low-privileged attacker to corrupt kernel memory during concurrent DMB node attach, detach, and unregister operations. The vulnerability arises from a race window between hash table lookup under dmb_ht_lock and the subsequent refcount operation performed after the lock is dropped, enabling a concurrent unregister path to free the node before the refcount transition completes. With a CVSS score of 7.8 and C:H/I:H/A:H impact metrics, successful exploitation can lead to privilege escalation or kernel crash; however, no public exploit is identified at time of analysis and EPSS at 0.17% reflects low current exploitation probability.
Use-after-free in the Linux kernel audit subsystem's `audit_del_rule()` function exposes systems from kernel 4.3 onward to local privilege escalation. The flaw stems from incorrect RCU ordering: fsnotify mark resources tied to `e->rule.exe` are freed before the rule is unlinked from RCU-visible filter lists, creating a window where concurrent `audit_filter()` and `audit_filter_rules()` readers dereference already-freed memory. Patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Linux kernel Bluetooth management subsystem allows a local low-privileged user to corrupt kernel heap memory by racing MGMT_OP_SET_LOCAL_NAME against MGMT_OP_REMOVE_UUID on systems with a powered BR/EDR-capable Bluetooth controller. The race exploits a missing lock acquisition in pending_eir_or_class() and the omission of MGMT_OP_SET_LOCAL_NAME from EIR-serialization logic, enabling a freed pending command entry to be read during EIR reconstruction. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), but the kernel UAF primitive and confirmed 7.8 CVSS score make patching a clear priority for Bluetooth-enabled systems.
Bluetooth HIDP in the Linux kernel exposes an uninitialized-memory read and a peer-controlled out-of-bounds byte access in hidp_session_run() when processing numbered HID report responses. Systems running Linux with active Bluetooth HID sessions are vulnerable to a malicious adjacent Bluetooth peer leveraging this to disclose kernel memory contents (rated C:H, enabling potential KASLR bypass) or manipulate HIDIOCGFEATURE report completion with attacker-controlled data. No public exploit has been identified, EPSS is 0.17% (6th percentile), and this vulnerability is not listed in CISA KEV.
Use-after-free in the Linux kernel's AFS (Andrew File System) subsystem exposes systems running the kafs module to kernel memory corruption exploitable by local low-privileged users, potentially enabling privilege escalation to root. The race condition in afs_make_call() allows the afs_call structure to be freed by an arriving async server response while the sending function - having transferred its reference rather than retaining one - continues to access the freed memory. EPSS is 0.17% (6th percentile), no CISA KEV listing exists, and upstream fix commits are publicly available on stable kernel trees.
Use-after-free in the Linux kernel ALSA timer subsystem allows an unprivileged local user to corrupt kernel heap memory and escalate privileges to root. The flaw stems from snd_timer_close_locked() setting SNDRV_TIMER_IFLG_DEAD but never clearing it after close completes; when snd_seq_timer_open() retries on the same instance after a forced failure, snd_timer_instance_free() frees an object still referenced across multiple kernel data structures. With CVSS 7.8 and a detailed exploitation path described directly in the upstream kernel commit, this is a credible local privilege escalation on desktop and workstation Linux systems, despite a low EPSS score of 0.17% (6th percentile) and no current CISA KEV listing. No public exploit code has been identified at time of analysis.
Missing bounds enforcement in the Linux kernel ALSA USB audio driver's implicit-feedback path allows a physically-connected malicious USB device to inject oversized sync packets that propagate un-clamped into the playback endpoint queue. The un-clamped frame count - potentially exceeding ep->maxframesize - can drive packet transfers beyond hardware frame limits, risking kernel memory corruption with high confidentiality, integrity, and availability impact. No public exploit has been identified and EPSS is 0.17% (6th percentile), but patches are confirmed across multiple stable kernel branches including 6.6.151, 6.12.103, 7.1.8, and 6.18.44.
Use-after-free in the Linux kernel's FOU (Foo-over-UDP) tunnel subsystem allows a local attacker with low privileges to corrupt kernel memory by exploiting a race condition in fou_create(). The struct fou object is published via sk_user_data before being committed to the per-network-namespace port list; when fou_add_to_port_list() subsequently fails on port-0 requests, the error path frees the object while concurrent RCU readers can still dereference it through fou_from_sock(). Two stable-branch upstream commits (a28d8903, b14361ac) provide the fix; no public exploit has been identified at time of analysis, and EPSS sits at the 5th percentile.
A DMA mapping resource leak in the Linux kernel's igbvf driver (Intel 82576 SR-IOV virtual function NIC) occurs on the TX buffer-mapping error path: an off-by-one in the dma_error cleanup loop leaks exactly one DMA mapping (the packet head) whenever a fragment mapping fails after the head was successfully mapped. The bug traces to a 2010 fix for an endless loop and affects a wide range of stable kernels until patched (fixes landed in 6.6.151, 6.12.103, 6.18.44, 7.1.8 and 7.2-rc6). There is no public exploit identified at time of analysis, EPSS is very low (0.17%), and the practical impact is memory/DMA resource exhaustion rather than the remote code execution suggested by the assigned 9.8 score.
Kernel-level use-after-free in the Linux SMC (Shared Memory Communications) subsystem allows a race between socket close and link group termination to write to freed memory. The flaw lives in the net/smc driver where __smc_lgr_terminate() releases conns_lock after locating a connection in lgr->conns_all but before calling sock_hold(), so a concurrent close can free the embedded socket first. Fixed across multiple stable trees; EPSS is low (0.17%), there is no public exploit identified at time of analysis, and it is not on CISA KEV.
Use-after-free in the Linux kernel netfilter ipset subsystem enables local kernel memory corruption with potential for privilege escalation. During an ipset hash resize (`mtype_resize()`), comment pointers are shallow-copied via `memcpy()` rather than deep-copied, causing both old and new table entries to share the same `ip_set_comment_rcu` pointer; an `xt_SET --add-set --exist` packet hitting the old entry during this window calls `ip_set_init_comment()`, freeing the shared pointer and leaving the new table entry with a dangling reference that is later dereferenced in `strlen()` during backlog replay. Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6), no public exploit has been identified, and EPSS sits at 0.17% (6th percentile), indicating very low observed exploitation pressure at time of analysis.
Use-after-free race condition in the Linux Kernel TIPC subsystem allows a low-privileged attacker to trigger stale-pointer dereference during socket poll trace operations, potentially leading to kernel memory corruption and privilege escalation. The flaw arises because tipc_poll() invokes trace_tipc_sk_poll() without holding the socket lock, enabling tipc_list_dump() to walk live queue members while a concurrent thread dequeues and frees socket buffers (skbs). Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8); no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Linux kernel wifi/mac80211 subsystem allows an adjacent network attacker to trigger kernel memory corruption during Block Acknowledgment session teardown. ieee80211_stop_tx_ba_cb() hands tid_tx to kfree_rcu() and then reads tid_tx->ndp after dropping sta->lock without RCU read-side protection, creating a window where the RCU softirq callback can free the object before the read completes. The vulnerability carries a CVSS 8.8 score (AV:A) but EPSS sits at the 5th percentile with no KEV listing, reflecting the race-condition exploitation complexity; no public exploit has been identified at time of analysis.
Use-after-free and out-of-bounds read in the Linux kernel mwifiex WiFi driver (CVSS 8.8, AV:A) allow an unauthenticated attacker on an adjacent WiFi segment to trigger kernel memory corruption by sending crafted A-MSDU frames containing TDLS payloads. Affected kernel versions span from the commit introducing A-MSDU TDLS handling (circa Linux 4.5, commit 776f742040ca) through all stable branches prior to the fixes in 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the flaw is remotely selectable by the sender through control over A-MSDU subframe layout, making TDLS-capable mwifiex deployments meaningfully exposed from the local wireless segment.
Out-of-bounds slab read in the Linux kernel's binfmt_misc subsystem allows local low-privileged users - including those operating within unprivileged user namespaces - to trigger heap memory exposure or a kernel crash by registering a binary format with a flag character ('P', 'O', 'C', or 'F') as the field delimiter. The flaw exists because check_special_flags() consumes flag characters without using the delimiter as a terminator, swallowing the 8-byte padding appended by create_entry() and reading past the end of the allocated buffer. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates low near-term exploitation probability; however, reachability from unprivileged user namespaces on most modern Linux distributions meaningfully broadens the real-world attack surface.
Use-after-free in the Linux kernel's Transparent Huge Page split path exposes systems to kernel memory corruption, potential privilege escalation, or denial of service via a race condition in __folio_split(). Any local low-privilege user on affected kernels prior to the stable fixes in versions 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6 may trigger this by racing a concurrent final iput() against the shmem THP split unlock sequence. No public exploit or PoC has been identified, and the EPSS score of 0.17% (6th percentile) reflects minimal real-world exploitation activity at time of analysis.
Use-After-Free in the Linux kernel's mm/page_reporting subsystem triggers a General Protection Fault during PM suspend and hibernation on systems running virtio_balloon with page reporting enabled. When the PM freezer initiates a suspend or S4 hibernation cycle, the virtio_balloon driver tears down its virtqueues via del_vqs(), but page_reporting_process - scheduled on the non-freezable system_wq workqueue - remains active. If the buddy allocator frees pages during this window (e.g., the balloon shrinker runs during S4 image saving), the reporting worker calls virtballoon_free_page_report() on already-deleted virtqueues, causing kernel memory corruption. No public exploit has been identified at time of analysis; EPSS is 0.18% (8th percentile), reflecting minimal exploitation probability, though this is a confirmed kernel UAF with crash-level impact validated by Google in production virtualization infrastructure.
Use-after-free in the Linux kernel bridge (net/bridge) multicast fast-leave path lets the group-leave handler dereference a freed port-group entry after br_multicast_del_pg() removes it, because the loop keeps walking through the stale next pointer. It affects bridges that had multicast-to-unicast enabled and later disabled while multiple per-source-MAC port groups existed, and can corrupt kernel memory. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not in CISA KEV, so the headline CVSS 9.8 overstates practical risk for most deployments.
Memory corruption in the Linux kernel's User Mode Linux (UML) vector network driver lets a remote peer trigger a use-after-free in vector_mmsg_rx(). When a received packet fails verify_header(), the code frees the skb but skips the slot-cleanup that normal paths perform, so the next RX iteration re-reads and double-frees the same freed buffer, causing a refcount underflow / use-after-free. It affects UML instances using the GRE or L2TPv3 vector transports; any peer on such a transport can trigger it without authentication. No public exploit identified at time of analysis, and EPSS is low (0.20%).
Race-condition torn read in the Linux kernel's VXLAN driver (route_shortcircuit()) allows the neighbour hardware address (n->ha) to be read without holding the n->ha_lock seqlock, producing a partially-updated or corrupted MAC address while the neighbour subsystem concurrently updates it. Fixed by switching to neigh_ha_snapshot() for a seqlock-protected read. No public exploit identified at time of analysis; EPSS is 0.17% (6th percentile), and despite the assigned CVSS of 10.0 the practical impact is a minor data-integrity/read-consistency issue in VXLAN forwarding, not a genuine critical remote compromise.
Out-of-bounds read in the Linux kernel's VXLAN driver stems from route_shortcircuit() validating only 20 bytes from skb->data instead of accounting for the 14-byte MAC header offset, so ip_hdr()->daddr dereferences can read past the pulled linear buffer when packets have non-linear fragments. The flaw affects hosts running VXLAN tunneling with proxy mode, is tagged as an information-disclosure issue, and has no public exploit identified at time of analysis (EPSS 0.17%, 6th percentile). A vendor fix replaces pskb_may_pull() with pskb_network_may_pull() to check the full network header including skb_network_offset().
Use-after-free in the Linux kernel tracing subsystem exposes low-privileged local attackers to kernel memory corruption and potential privilege escalation. The defect, introduced at commit ae63b31e4d0e2ec09c569306ea46f664508ef717, causes trace_module_add_events() to call __add_event_to_tracers() unconditionally even when __register_event() has failed, leaving a trace_event_file holding a dangling pointer to a freed trace_event_call after a module load failure. EPSS is 0.17% (6th percentile) and no public exploit or CISA KEV listing has been identified, but the kernel UAF class carries inherent escalation potential and patches are available across multiple stable branches.
Integer overflow in the Linux kernel SCTP subsystem allows a remote low-privileged attacker to trigger an approximately 8 MiB out-of-bounds write past a socket buffer (skb) tail in kernel heap memory by adding 65,536 unique peer transport addresses to an SCTP association, wrapping the 16-bit transport_count to zero. Affected systems running Linux kernels from the 4.7 era through stable branches prior to 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6 are vulnerable. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates minimal current exploitation activity despite the CVSS 8.8 rating.
Privilege escalation in the Linux kernel's s390/qeth network driver allows any local unprivileged user to invoke three network management ioctls - SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE, and SIOC_QETH_QUERY_OAT - without the CAP_NET_ADMIN capability check that should gate them. Affected deployments are exclusively IBM z Systems (s390) mainframe environments running Linux kernels from commit 18787eeebd7 through the respective stable fix points, limiting real-world exposure to a narrow architectural niche. No public exploit or active exploitation has been identified; EPSS of 0.17% at the 6th percentile is consistent with the specialized environment required.
Use-after-free in the Linux kernel's Open vSwitch meter subsystem exposes systems running OVS to local privilege escalation, memory corruption, and potential information disclosure. The flaw affects all Linux 5.8+ kernels up to the patched stable releases and is triggered by a custom userspace application interacting with OVS via Netlink uAPI - standard ovs-vswitchd deployments are not vulnerable. No public exploit has been identified and EPSS sits at the 6th percentile, but the bug was discovered by Trend Micro's Zero Day Initiative (ZDI-CAN-31642), indicating professional security research attention; multiple stable kernel patches are now available.
NULL pointer dereference and use-after-free in the Linux kernel i2c-imx driver (NXP i.MX SoC family) allows a local attacker or concurrent kernel path to trigger kernel memory corruption during I2C slave unregistration. The race condition in i2c_imx_unreg_slave() permits a pending hrtimer callback to fire after the slave pointer has been cleared, causing i2c_imx_slave_finish_op() to dereference a NULL pointer with potential for privilege escalation or system crash. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.17% (6th percentile) confirms low exploitation likelihood, though the CVSS base score of 8.4 reflects high potential impact if triggered.
Double-free heap corruption in the Linux kernel's peak_usb CAN bus USB driver exposes systems with PEAK USB-to-CAN hardware to local privilege escalation, kernel panic, or sensitive memory disclosure. The flaw resides in the peak_usb_start() error-handling path, where a URB transfer buffer is freed explicitly via kfree(buf) before usb_free_urb() frees the same buffer a second time through the URB_FREE_BUFFER flag, corrupting kernel heap allocator metadata. Patched stable kernel releases are confirmed available (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6), no public exploit code has been identified, and EPSS at 0.17% (6th percentile) confirms no observed exploitation activity.
Arbitrary CMA memory corruption via GPU DMA in the Linux kernel's drm/vc4 VideoCore 4 driver affects Raspberry Pi and similar vc4-based platforms running kernels from version 4.13 through multiple stable series. The vc4_overflow_mem_work() function incorrectly programs BPOS with the full 16MB binner BO size instead of the correct 512KB slot size, authorizing the GPU's PTB hardware to scribble tile lists across adjacent in-flight job memory and into unrelated CMA pages beyond the BO boundary. No public exploit has been identified at time of analysis and EPSS is 0.17% (6th percentile), but the memory corruption manifests reliably as GPU hangs, userspace heap corruption, and system crashes under normal GPU workloads that overflow the initial binner slot.
Uninitialized GPU memory reuse in the Linux kernel's drm/vc4 driver (Broadcom VideoCore IV, used in Raspberry Pi) allows a local low-privileged user to trigger GPU hangs, corrupt GPU state, and read stale tile state data left by prior GPU jobs in recycled buffer slots. The vulnerability exists because the 16MB binner Buffer Object is partitioned into 512KB slots that are recycled across jobs without clearing, causing the Primitive Tile Binner (PTB) hardware to act on stale Tile State Data Array (TSDA) contents from previous jobs - producing invalid command and primitive streams. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) reflects low exploitation probability despite the high CVSS base score.
Heap buffer overflow and potential kernel memory mass-zeroing in the Linux kernel drm/panthor GPU driver allow a local attacker to corrupt kernel heap structures or trigger catastrophic out-of-bounds writes by supplying a crafted firmware image to the Arm Mali Valhall (Panthor) DRM subsystem. The root cause is that panthor_fw_load_section_entry() computes section->data.size from raw firmware header fields without bounding it against the allocated section_size, allowing both a memcpy overflow and an unsigned integer underflow in a subsequent memset that could zero arbitrarily large kernel memory regions. No public exploit has been identified and EPSS is low at 0.18% (8th percentile), but the CVSS impact ratings of C:H/I:H/A:H reflect the realistic worst case of full kernel compromise on affected hardware.
Out-of-bounds memory access in the Linux kernel's drm/panthor driver (ARM Mali Valhall GPU) allows a local authenticated attacker to read or corrupt kernel memory by supplying a crafted MCU virtual address near the end of the firmware shared memory section. The underlying flaw is in iface_fw_to_cpu_addr(), which validated only that a firmware-provided address falls within the shared section - not that the full firmware interface structure fits within it - enabling subsequent structure-level accesses to reach past the section boundary. No public exploit code exists and EPSS is 0.17% (6th percentile), indicating no evidence of active exploitation; patches are available in Linux stable releases 6.12.103, 7.1.8, and 6.18.44.
Divide-by-zero panic in the Linux kernel's AMD display driver (drm/amd/display) allows a low-privileged local user to crash the kernel by triggering a zero-area viewport condition in the calculate_mcache_setting function. The vulnerable code path exits early with num_mcaches == 0 and mvmpg_width/height == 0, then proceeds to divide by those zero values, causing both a divide-by-zero panic and potential integer underflow on num_mcaches. EPSS is very low at 0.15% (5th percentile) and no active exploitation or public exploit code has been identified at time of analysis; however, the local trigger mechanism via display mode setting is accessible to low-privileged users on systems with AMD GPU hardware.
Integer overflow in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user with AMD KFD device access to bypass EOP ring buffer size validation on GFX8/GFX9 hardware, enabling out-of-bounds GPU writes that can corrupt adjacent kernel memory or trigger GPU faults. A crafted eop_ring_buffer_size of 0xFFFFF001 exploits the ALIGN macro's typeof-preserved 32-bit arithmetic to wrap the computed size to zero, causing kfd_queue_buffer_get() to skip its exact-size check and accept an undersized buffer object. No public exploit has been identified and this is not in CISA KEV; EPSS stands at 0.17% (6th percentile), reflecting very low in-the-wild exploitation probability despite a CVSS 7.8 score.
Concurrent event manipulation during CRIU checkpointing in the Linux kernel's AMD GPU driver (drm/amdkfd) exposes a race condition leading to heap out-of-bounds writes or use-after-free memory corruption. A low-privileged local attacker on a system with an AMD GPU can exploit the unprotected gap between the event count and IDR walk in kfd_criu_checkpoint_events() by racing event creation or destruction from a second thread within the same process, producing kernel heap corruption primitives exploitable for local privilege escalation. No public exploit code and no CISA KEV entry have been identified at time of analysis; EPSS is 0.17% (6th percentile), reflecting low current adversary interest despite the high C:H/I:H/A:H CVSS impact triad.
Out-of-bounds kernel memory read in the Linux kernel's vmwgfx DRM driver exposes systems running VMware-virtualized graphics to local privilege escalation or sensitive information disclosure. The flaw in vmw_cmd_draw() allows a low-privilege local user to supply a crafted DRAW_PRIMITIVES command stream header with an undersized size field, triggering unsigned integer underflow that produces a near-4 GiB loop bound and causes the kernel to dereference memory far beyond the allocated command bounce buffer. Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6); no active exploitation has been confirmed and the vulnerability is not listed in CISA KEV.
Pointer underflow in the VMware graphics driver (drm/vmwgfx) of the Linux kernel enables local low-privileged users to perform a TOCTOU attack on the DMA command stream inside a bounce buffer, allowing one crafted command to overwrite authenticated fields (GMR id, surface id) of a previously verified command. This bypasses kernel command authentication and can lead to unauthorized access to graphics memory regions or escalated privileges within a VMware guest. EPSS is 0.17% (6th percentile) and the vulnerability is not listed in CISA KEV, suggesting no confirmed widespread exploitation at the time of analysis.
Race condition in the Linux kernel's drm/xe Intel GPU driver allows a locally-authenticated user to schedule a GPU job that executes concurrently with an in-flight kernel memory management operation on an external buffer object, violating the DMA_RESV_USAGE_KERNEL cross-driver synchronization contract. Affected systems are those running Linux 6.8 or later with compatible Intel Xe-architecture GPU hardware and the xe driver loaded; the race can result in reading or writing memory that is simultaneously being evicted or relocated. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV), consistent with the low EPSS score of 0.17% at the 6th percentile.
Heap out-of-bounds write in the Perl DBI module before version 1.652 lets an attacker who reaches the preparse() routine with attacker-controlled SQL corrupt heap memory when the ':pN' / ':N' (named-to-numbered) placeholder return style is used. A numeric placeholder such as ':2147483648' is parsed with atoi() and stored in the binder counter with no range check; on glibc it wraps negative, and each following '?' then expands to a 14-byte ':p-2147483648' string into a buffer that budgeted only 7 bytes per input byte. Exploitation status: no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile), and it is not in CISA KEV.
Heap out-of-bounds write in Perl's DBI module before 1.652 lets an attacker who can feed an oversized untrusted statement to the preparse() function corrupt heap memory on 32-bit perl builds, writing hundreds of megabytes of attacker-controlled data past a tiny allocation. The flaw stems from an integer wraparound (CWE-190) in the output-buffer sizing arithmetic and could lead to code execution or crashes. No public exploit has been identified and EPSS is low (0.20%), but a vendor patch (DBI 1.652) is available.
Unbounded locale cache growth in Apache Struts allows unauthenticated remote attackers to exhaust JVM heap memory and deny service to all users of the application. The vulnerability spans an exceptionally wide version range - from 2.0.0 through 7.2.1 across four release branches - and is exploitable only when no fixed locale is configured, a condition common in multilingual deployments. No public exploit has been identified at time of analysis, and EPSS at 0.19% (9th percentile) reflects low observed exploitation activity; however, the network vector with zero prerequisites on vulnerable configurations makes this a meaningful DoS risk in exposed environments.
Heap buffer overflow in the Linux kernel ASoC SOF IPC3 audio subsystem allows a local low-privilege attacker to write past an allocated buffer via a missing bounds check in `snd_sof_update_control()`, potentially enabling kernel memory corruption, privilege escalation, or system crash. Affected systems span Linux 5.18 through multiple stable branches (6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x) on hosts with Intel SOF-capable audio DSP hardware. No public exploit is known and EPSS is low at 0.21%, but the CVSS 7.8 score reflects the severity of the potential kernel-level impact once local access is obtained.
NULL pointer dereference in the Linux kernel netfilter nft_fib subsystem crashes the kernel when a FIB expression is placed in a netdev egress base chain, enabling denial of service against any system carrying that configuration. The root cause is a hook namespace collision where NF_NETDEV_EGRESS aliases NF_INET_LOCAL_IN numerically, causing nft_fib_validate() to incorrectly approve egress chain placement and then dereference nft_in(pkt) - which is NULL on the transmit path. No public exploit exists and EPSS is 0.21% (11th percentile), but systems running custom nftables egress FIB rules are at immediate kernel crash risk until patched.
Memory-safety flaw in the Linux kernel's netfilter SIP NAT helper (net/netfilter/nf_nat_sip.c) allows a stale, freed data pointer to be used after skb_ensure_writable() reallocates a cloned socket buffer, potentially corrupting kernel memory or crashing the host when SIP connection tracking and NAT are active. The bug affects systems using the nf_nat_sip application-layer gateway; because SIP conntrack linearizes SKBs, only clones (not fragments) trigger it, and a secondary error path could invoke UDP mangling on a TCP stream. No public exploit is identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not in CISA KEV.
Netfilter IPv6 fragment reassembly in the Linux kernel incorrectly advances the sk_buff MAC header offset on the NF_INET_LOCAL_OUT path, where no link-layer header exists, causing a u16 integer wrap that leaves the MAC header pointer aimed at kernel headroom. All Linux kernels from version 2.6.15 through the stable-branch patch releases (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5) are affected when the nf_conntrack_ipv6 module is loaded. A local low-privilege attacker can send crafted IPv6 fragmented packets to trigger the vulnerable reassembly code path, potentially achieving information disclosure of kernel memory or a kernel panic; no public exploit or active exploitation has been identified at time of analysis.
Incorrect route selection in the Linux kernel's netfilter flowtable IPIP-encapsulation offload path causes the headroom and IP fragment-offset (iph->frag_off) to be computed from the reverse-direction dst instead of the current direction when pushing the IPIP header. Affecting kernel 6.19 and development branches through the 7.x line, the flaw can lead to malformed encapsulated packets and potential memory/headroom mishandling in the fast-path offload; it is tagged as information disclosure. The input CVSS of 9.8 (RCE-grade) is a CNA auto-score that overstates a config-dependent packet-handling bug, and EPSS is low at 0.20% (10th percentile) with no public exploit or KEV listing.
Denial of service in the Linux kernel netfilter flowtable subsystem allows a crash in the tunnel transmit path when IPIP tunnel offload is combined with a direct-xmit device such as a bridge. Because no dst_entry is supplied, the code performs invalid dst usage while checking skb headroom and setting iph->frag_off, leading to a kernel crash. Rated CVSS 9.8 by automated scoring, but vendor tags classify it as Denial Of Service; EPSS is 0.20% (10th percentile), it is not in CISA KEV, and no public exploit was identified at time of analysis.
Connection limit bypass in the Linux kernel's netfilter nf_conncount subsystem allows network-reachable attackers to exhaust host resources by exploiting incorrect zone direction bitmask handling in tuple deduplication. The bug in __nf_conncount_add() conflates the u8 zone direction bitmask (NF_CT_ZONE_DIR_ORIG=1, NF_CT_ZONE_DIR_REPL=2, NF_CT_DEFAULT_ZONE_DIR=3) with the ip_conntrack_dir enum (IP_CT_DIR_ORIGINAL=0, IP_CT_DIR_REPLY=1), causing non-default directional zones to be erroneously treated as equivalent and bypassing per-connection counting. No active exploitation is confirmed (EPSS 0.22%, 13th percentile); upstream fixes have been committed across multiple stable kernel branches.
Local privilege escalation in the Linux kernel's GPU buddy memory allocator (gpu/buddy) allows a low-privileged authenticated local user to exploit a misalignment logic error in the try_harder contiguous fallback path, achieving high confidentiality, integrity, and availability impact (CVSS 7.8). The defect, introduced at commit 0a1844bf0b532d84324453374ad6845f64066c28, caused the allocator to return candidate blocks whose start offsets were not aligned to the caller's min_block_size, violating allocation invariants on both the RHS and LHS paths. No public exploit identified at time of analysis; EPSS exploitation probability is 0.21% (11th percentile), consistent with low near-term exploitation likelihood.
SELinux mandatory access control bypass in the Linux kernel allows local low-privilege users to circumvent connect-related network policy enforcement by initiating TCP connections via TCP Fast Open (MSG_FASTOPEN). The kernel's SELinux LSM hook for socket_sendmsg() was never updated to invoke selinux_socket_connect() when the MSG_FASTOPEN flag is passed, meaning connections using this path skip SELinux policy checks entirely. With a CVSS 8.4, Scope Changed, and confirmed patches across six stable branches, this is a meaningful MAC bypass in SELinux-enforcing environments - no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile).
Weakened AMD SEV-SNP memory-integrity enforcement in the Linux kernel results from a race between WBINVD IPIs and dirty-cacheline migration that can leave Reverse Map Table (RMP) memory with un-flushed dirty cache lines when SNP_INIT_EX is invoked with INIT_RMP=1, violating SNP firmware requirement (spec section 8.8). Affected are Linux 7.1 hosts that had adopted commit 99cf1fb58e68 (which dropped the pre-SNPEn WBINVD); the fix reverts that change so wbinvd_on_all_cpus() again runs before setting MSR_AMD64_SYSCFG_SNP_EN, while the RMP is not yet in use. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not CISA KEV-listed.
Use-after-free in the Linux kernel's batman-adv mesh networking driver allows adjacent unauthenticated attackers to achieve kernel memory corruption with potential for code execution, information disclosure, or denial of service. The flaw exists in batadv_interface_rx(), where pskb_may_pull() may reallocate the socket buffer during RX processing - the VLAN header pointer was correctly refreshed post-reallocation, but the ethernet header pointer was not, leaving a dangling reference used subsequently in Translation Table and AP isolation logic. EPSS is low at 0.22% (13th percentile) and no CISA KEV listing exists, limiting real-world risk primarily to environments actively running batman-adv mesh deployments. Vendor-released patches are confirmed across multiple stable kernel branches.
Use-after-free in the Linux kernel's batman-adv mesh networking module (net/batman-adv unicast path) occurs because the unicast_packet pointer is not reassigned after pskb_may_pull() inside batadv_get_vid() may reallocate the socket buffer, leaving a stale pointer into freed memory. Systems running batman-adv B.A.T.M.A.N. advanced mesh routing are affected across a wide range of stable kernel series. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.22%, 13th percentile).
Use-after-free in the Linux kernel's batman-adv Bridge Loop Avoidance (BLA) subsystem allows an unauthenticated attacker on the same Layer 2 network segment to corrupt kernel memory, potentially achieving arbitrary code execution or system crash. The flaw originates from pskb_may_pull() silently reallocating the socket buffer during backbone gateway processing in batadv_bla_is_backbone_gw(), leaving cached gateway address pointers dangling against the freed old buffer. Affected kernels span from commit 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 (approximately Linux 4.12) through multiple stable branches; patches are available across all active stable series. No public exploit or CISA KEV listing exists at time of analysis, and the very low EPSS of 0.22% (13th percentile) reflects the niche deployment footprint of batman-adv BLA.
Out-of-bounds buffer read in the Linux kernel's batman-adv (batadv) mesh networking driver allows a local user with eBPF TC hook access to trigger reads beyond allocated packet buffer boundaries inside batadv_interface_tx(). The vulnerability spans many stable kernel series from 2.6.38 through pre-patch releases of 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, and 7.1 branches. No public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), though the high CVSS impact metrics (C:H/I:H/A:H) reflect potential for kernel heap memory disclosure or corruption if the out-of-bounds read extends into sensitive kernel state.
Request storm vulnerability in the Linux kernel's batman-adv mesh networking subsystem (B.A.T.M.A.N. Advanced) exposes nodes to availability degradation through an inverted boolean condition in batadv_send_tt_request(). When a send buffer allocation fails, an incorrect check (ret == true instead of ret == false) causes the tt_req_node tracking structure to be retained rather than cleaned up, breaking the de-duplication mechanism that prevents simultaneous TT requests to the same originator. The result is that repeated, redundant translation table requests can flood a mesh peer - a request storm - degrading availability of nodes on the batman-adv overlay. No public exploit code exists and EPSS exploitation probability is very low (0.22%, 13th percentile); no active exploitation is confirmed.
Out-of-bounds read in the Linux kernel's batman-adv multicast tracker exposes adjacent-network unauthenticated attackers to kernel memory disclosure or denial-of-service via a crafted TVLV mcast tracker packet. The root cause is a C macro misuse - offsetof() on the first struct member always evaluates to 0, making the bounds check a no-op that permits access to num_dests even when only 0 or 1 byte is in the received packet instead of the required 2. EPSS is 0.21% (11th percentile), no CISA KEV entry exists, and no public exploit is identified; vendor-released patches are available in Linux 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3.
Integer-overflow-driven out-of-bounds access in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh networking module allows a node on the same mesh to corrupt translation-table processing via a crafted TT unicast TVLV. The VLAN count (u16) multiplied by the 8-byte batadv_tvlv_tt_vlan_data size overflows the u16 length variable, defeating every downstream bounds check that guards the TVLV buffer. This is a fixed, patched kernel bug with a low EPSS (0.22%, 13th percentile) and no public exploit identified at time of analysis; it is not listed in CISA KEV.
Use-after-free in the Linux kernel's sunrpc server-side TLS handshake path (svc_tcp_handshake/svc_sock) allows the asynchronous tlshd handshake-completion callback to write through a freed struct svc_sock, corrupting slab memory on any NFS server configured for RPC-with-TLS. Two close-versus-cancel races let svc_sock_free() kfree() the socket while svc_tcp_handshake_done() is still updating xpt_flags and walking the embedded wait queue, yielding an attacker-influenceable slab-corruption primitive rather than a benign read. No public exploit identified at time of analysis and EPSS is low (0.20%), but the fix is upstream in stable kernels.
Kernel-side race condition in the Linux SUNRPC server's TLS handshake path (svc_tcp_handshake) allows a lost cancellation race to corrupt an embedded swait_queue or prematurely tear down a succeeding handshake, leading to kernel memory corruption or connection instability on NFS/RPC servers using RPC-with-TLS. Affects servers that terminate kernel RPC TLS sessions; it is a resolved upstream kernel bug with no public exploit and a very low EPSS (0.21%, 11th percentile), and it is not in CISA KEV. Despite the NVD-propagated 9.8 rating typical of auto-generated kernel CVEs, the practical impact is a narrow timing window affecting availability/state integrity rather than turnkey remote code execution.
Memory-corruption (double-free / use-after-free) in the Linux kernel's SunRPC server layer allows the rq_procinfo->pc_release hook to fire against stale, reused request state when a worker thread hits an early error path (unsupported protocol, short frame, or bad auth) before a valid procinfo is installed. It affects Linux 6.18 (and the shared SunRPC code reachable via kernel RPC servers such as nfsd), and successful triggering corrupts kernel heap state, risking denial of service or privilege escalation. The issue is patched upstream; there is no public exploit identified at time of analysis and EPSS is low (0.21%), so it is not currently known to be exploited.
Out-of-bounds slab write in the Linux kernel SUNRPC layer (xdr_buf_to_bvec()) lets a remote NFS client corrupt kernel memory via the in-kernel NFS server (nfsd) write path. The function stores a bio_vec into the caller's rq_bvec array before verifying the slot is in range - and the head branch stores with no check at all - so when the exactly-sized rq_maxpages budget is used up, one bio_vec lands past the array into adjacent slab memory, with attacker-influenced bv_len and bv_offset values taken from client-supplied RPC payload sizes. Rated CVSS 9.8 by the source, but with low EPSS (0.21%), no CISA KEV listing, and no public exploit identified at time of analysis.
Page-counter underflow in Linux kernel's hugetlb cgroup accounting allows a local low-privileged user to corrupt memory accounting state, causing integrity and availability impacts on affected systems. The flaw exists in alloc_hugetlb_folio() where a shared h_cg pointer is overwritten during sequential rsvd and non-rsvd hugetlb cgroup charges, causing the wrong cgroup to be committed to the folio's reserved slot. When the folio is freed, the mismatched uncharge path decrements a counter on a cgroup that was never charged, triggering a page_counter underflow (WARNING: mm/page_counter.c:61). No public exploit exists and EPSS sits at 0.21% (11th percentile), but the flaw affects a broad swath of kernel versions from 5.7 onward.
Filesystem consistency flaw in the Linux kernel NTFS driver's ntfs_ir_reparent() index-root reparenting path allows a transient on-disk/in-memory layout that $INDEX_ROOT validation rejects as corrupt, surfacing as generic/013 xfstests failures and ntfsck 'Corrupt index root' errors. The bug is a metadata-ordering error triggered during NTFS write operations that grow an index root and hit -ENOSPC, not a remotely exploitable memory-safety issue; no public exploit identified at time of analysis and it is not in CISA KEV. Fixed in stable 7.1.5 and mainline 7.2-rc1.
Out-of-bounds read in the Linux kernel's NTFS driver (ntfs_mapping_pairs_decompress) lets a crafted NTFS attribute record trigger a one-byte read past the attribute boundary. It stems from off-by-one bounds checks that use strict greater-than instead of >=, so mapping-pair data extending exactly to attr_end passes validation and buf[b] reads one byte too far. No public exploit is identified at time of analysis, EPSS is low (0.20%), and it is not on CISA KEV; exploitation requires the kernel to parse an attacker-controlled NTFS volume.
Out-of-bounds kernel memory read in the legacy NTFS filesystem driver of the Linux kernel (affecting builds derived from commit 6ceb4cc8 up to the 7.1.x and 7.2-rc series) occurs when the driver parses a crafted NTFS image whose $FILE_NAME attribute declares a small resident value_length but an oversized file_name_length. Callers trust file_name_length and read past the resident attribute value during name conversion/comparison, producing a slab-out-of-bounds read confirmed under KASAN from the kmalloc-1k MFT record copy. There is no public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and despite the source-assigned 9.8 CVSS this is a local filesystem-parsing bug rather than a remote-unauthenticated flaw.
Out-of-bounds read in the Linux kernel's NTFS driver allows a local attacker to leak adjacent kernel memory or crash the system by parsing extended attribute (EA) entries on a crafted NTFS volume. The ntfs_ea_lookup and ntfs_listxattr routines dereferenced the next_entry_offset field of an EA entry without first verifying that enough space remained in the buffer. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is tagged as Information Disclosure rather than code execution.
On-disk NTFS metadata corruption in the Linux kernel's NTFS3 driver arises because ntfs_resident_attr_resize() may select zero-length resident $DATA attributes when converting attributes to non-resident to free MFT record space, producing 0-byte non-resident $DATA that fsck flags as filesystem corruption. The flaw affects Linux systems writing to NTFS volumes and is a data-integrity/consistency defect rather than a memory-safety or remote-code issue; it is fixed in stable 7.1.5 and 7.2-rc1. There is no public exploit identified at time of analysis, EPSS probability is low (0.20%, 10th percentile), and it is not listed in CISA KEV. The published CVSS of 9.8 (network vector) is not consistent with a local filesystem write path and appears to be an automated over-assessment.
Out-of-bounds access in the Linux kernel's legacy NTFS filesystem driver arises from insufficient validation of INDEX_HEADER geometry within INDX directory-index blocks; a crafted NTFS volume can drive ntfs_lookup_inode_by_name() to read past block boundaries. The fix hardens ntfs_index_block_inconsisent() to strictly validate index-block header fields before use, affecting systems that mount attacker-controlled NTFS media. There is no public exploit identified at time of analysis, KEV does not list it, and EPSS is low (0.20%, 10th percentile), consistent with a filesystem-parsing bug that requires a malicious volume rather than remote reach.
Inconsistent $INDEX_ROOT attribute header validation in the Linux kernel's legacy ntfs filesystem driver exposes systems to potential kernel-level memory corruption when processing maliciously crafted NTFS volumes. Kernel versions from the initial NTFS implementation through 7.1.4 stable are affected across both directory inode and named index inode read paths, with fix releases confirmed at 7.1.5 stable and 7.2-rc1 mainline. No public exploit has been identified at time of analysis, and EPSS exploitation probability is 0.20% (10th percentile), though the CVSS 8.4 High score reflects the theoretical severity of kernel-space memory corruption if the vulnerability is successfully reached.
Deadlock in the Linux kernel NTFS driver allows local users with write access to an NTFS-mounted volume to render the system completely unresponsive by triggering an ABBA lock ordering race between concurrent VFS writeback paths. The vulnerability affects kernels since commit 6994acf33bae and manifests when inode writeback (acquiring extent_lock then mrec_lock) races with MFT folio writeback (holding mrec_lock while attempting extent_lock). No active exploitation has been confirmed - EPSS places this at the 10th percentile (0.20%) - reflecting the narrow real-world surface: production Linux systems rarely mount NTFS volumes. Patches are available in Linux 7.1.5 and 7.2-rc1.
Indefinite thread blocking in the Linux kernel's NTFS driver can cause a local denial of service on systems mounting NTFS volumes under memory pressure. Specifically, `get_nr_free_clusters()` and `__get_nr_free_mft_records()` allocate heap memory for a readahead state structure; if that allocation fails, neither `NVolFreeClusterKnown()` is set nor `vol->free_waitq` is woken, leaving any waiting kernel thread blocked indefinitely. Kernels prior to 7.1.5 and 7.2-rc1 are affected; no public exploit has been identified and EPSS is 0.20% (10th percentile).
Improper validation of NTFS index entries in the Linux kernel's NTFS filesystem driver allows a crafted or corrupted NTFS volume to be processed without adequate bounds checking during index root and index block reads. When an attacker-controlled NTFS image is mounted and traversed (lookup/readdir), missing per-read validation can lead to out-of-bounds memory access, enabling information disclosure or a kernel crash. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is not on the CISA KEV list.
Signed-integer overflow in the Linux kernel NTFS driver's mapping-pairs runlist parser lets a crafted or corrupted NTFS volume redirect logical-to-physical cluster mappings to unintended disk locations. The flaw affects the kernel's NTFS attribute parsing when it accumulates relative LCN deltas; a malicious runlist can set the accumulator to S64_MAX and add 1, triggering undefined behavior that resolves runs to a different set of physical clusters. Fixed upstream in Linux 7.1.5 and 7.2-rc1; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.20%).
Out-of-bounds memory access in the Linux kernel NTFS driver arises because resident $INDEX_ROOT attribute headers are consumed after lookup without fully validating their layout invariants. Affected are Linux kernels prior to the 7.1.5 and 7.2-rc1 stable fixes when mounting or accessing an attacker-crafted NTFS volume; unchecked entries_offset, index_length, and allocated_size fields let a malformed filesystem drive reads beyond the resident value, tagged upstream as Information Disclosure. This is not actively exploited (no CISA KEV entry) and EPSS is low at 0.20%, with no public exploit identified at time of analysis, though upstream stable commits are available.
The legacy NTFS driver in the Linux kernel fails to reject non-resident attribute records for attribute types contractually required to be resident, creating resident/non-resident union confusion paths in multiple critical code locations. Affected callers - including inode loading ($STANDARD_INFORMATION), volume flag updates ($VOLUME_INFORMATION), and directory traversal ($INDEX_ROOT) - read data.resident.value_offset directly without first verifying the a->non_resident flag, potentially acting on the wrong union member when a crafted or corrupted NTFS image is mounted. A local attacker with standard user privileges can exploit this to trigger kernel memory corruption or information disclosure; no active exploitation is confirmed (EPSS 0.20%, not in CISA KEV), and patches are available in Linux 7.1.5 and 7.2-rc1.
Linux kernel's ntfs3 filesystem driver crashes and may corrupt memory when processing a crafted NTFS image due to an unbounded memmove in the DeleteIndexEntryAllocation code path. Any local user able to mount a malformed NTFS volume can trigger a kernel oops through a negative ptrdiff_t silently cast to a near-maximal size_t, causing memmove to walk far past the destination buffer. No public exploit and no CISA KEV listing exist at time of analysis; EPSS is low at 0.21%, but the memory corruption primitive and local-to-kernel boundary crossing make this a meaningful privilege escalation and availability risk on systems where unprivileged NTFS mounts are possible.
Slab-out-of-bounds write in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3) is triggered during the log_replay() analysis pass when mounting a malformed NTFS3 volume. The copy_lcns loop lacks bounds enforcement against dp->lcns_follow, so a crafted LRH entry with target_vcn set to dp->vcn + dp->lcns_follow - 1 and lcns_follow greater than 1 overflows the heap-allocated page_lcns[] array, corrupting kernel memory. Confirmed by KASAN on mainline kernel 8d90b09e6741 with a slab-out-of-bounds write of size 8 at log_replay+0x68d4; no public exploit exists and EPSS stands at 0.21%, though the CVSS score of 8.4 reflects the full confidentiality, integrity, and availability impact of kernel heap corruption.
Integer underflow in the ntfs3 filesystem driver's journal replay logic (`fs/ntfs3/fslog.c`) allows a local attacker with low privileges to corrupt the resident attribute data size to approximately 4 GiB, enabling out-of-bounds kernel memory reads up to 4 GiB beyond a 1024-byte MFT record allocation. Exploitation requires mounting or processing a crafted NTFS image with specially crafted Log Record Header values - on distributions with unprivileged user namespaces enabled (Ubuntu, Fedora, and others), this is achievable without elevated privileges. No public exploit code has been identified and the vulnerability is not in CISA KEV; EPSS stands at 0.21% (12th percentile), and patches are confirmed available across multiple stable kernel branches.
Denial-of-service in the Linux kernel ntfs3 driver lets an attacker with the ability to mount a crafted NTFS image panic the system via unbounded recursion. indx_find_buffer() descends the NTFS B+ tree index with no depth limit, so a circular index-node reference overflows the kernel stack when a file deletion hits the index rebalancing fallback path. No public exploit is identified and it is not in CISA KEV; EPSS is low at 0.23%. Note that the supplied CVSS 9.8/AV:N vector is inconsistent with the description, which requires local access to attach a malicious filesystem.
Heap out-of-bounds write in the Linux kernel's ntfs3 filesystem driver lets a local user corrupt kernel slab memory by mounting and accessing a crafted NTFS image. When indx_insert_into_root() promotes a full resident $INDEX_ROOT into $INDEX_ALLOCATION, hdr_insert_head() copies resident entry bytes ('to_move') sized from on-disk data into a destination buffer sized from an attacker-shrunk root->index_block_size, writing 120-136 bytes of attacker-controlled data past a kmalloc allocation. The flaw is fixed across multiple stable trees; there is no public exploit identified at time of analysis and EPSS is low (0.21%), and despite the NVD CVSS of 9.8 the described trigger is local rather than network-reachable.
Improper validation of on-disk metadata in the Linux kernel's legacy NTFS driver allows a crafted NTFS filesystem image to smuggle an error-marked MFT (Master File Table) reference back through ntfs_lookup_inode_by_name(), causing directory-lookup callers to misinterpret corrupted disk data as a legitimate pseudo-errno. This affects systems that mount attacker-supplied NTFS volumes; there is no public exploit identified at time of analysis and the EPSS probability is low (0.20%). The upstream fix normalizes any error-marked reference to ERR_MREF(-EIO) so callers can no longer be tricked into consuming a bogus value.
Local volume corruption and a writeback deadlock affect the Linux kernel NTFS driver (fixed in 7.1.5 and 7.2-rc3) when a filesystem is mounted with the non-default show_sys_files option and userspace writes to an exposed base metadata file such as $Bitmap; because the cluster allocator scans $Bitmap through the same inode page cache, the write both corrupts the volume and deadlocks writeback against an already-locked folio. Only affected when the opt-in show_sys_files mount option is set, so this is a local integrity/availability issue rather than a remote one. There is no public exploit identified at time of analysis, EPSS is 0.20% (10th percentile), and it is not in CISA KEV.
Memory-safety flaw in the Linux kernel's legacy NTFS (read) driver lets a crafted NTFS filesystem image bypass a resident/non-resident attribute check in ntfs_map_runlist_nolock(). When the driver expects a non-resident attribute during mount, an attacker-supplied image can substitute a resident attribute; the code previously only flagged this with a non-fatal WARN_ON() and then read a->data.non_resident.highest_vcn from the wrong union member, corrupting the VCN range check. The fix replaces WARN_ON() with an -EIO return so the malicious image is rejected at mount. There is no public exploit identified at time of analysis, and EPSS is low (0.22%).
Landlock SCOPE_SIGNAL enforcement in the Linux kernel can be bypassed by a sandboxed process via the asynchronous SIGIO delivery path, allowing it to send arbitrary signals - including SIGKILL - to processes outside its Landlock domain such as supervisors or security monitors. The flaw exists because hook_file_send_sigiotask() evaluates the Landlock domain recorded at F_SETOWN time rather than the live sender domain, and control_current_fowner() incorrectly skips domain recording when a single member of the target process group (PIDTYPE_PGID) shares the caller's thread group, leaving the remaining group members unchecked at delivery. No public exploit code exists and EPSS is 0.22% (13th percentile), but the impact is significant for environments relying on Landlock as a containment boundary.
Memory corruption in the Linux kernel's MIPS scheduler corrupts kernel pointer state when CONFIG_CPUMASK_OFFSTACK is enabled, enabling local privilege escalation to root. Two compounding flaws exist: sizeof(new_mask) resolves to the pointer width (4-8 bytes on MIPS) rather than the actual cpumask buffer size, causing copy_from_user() to overwrite the mask pointer with user-controlled bytes; and the original code invoked copy_from_user() prior to allocating the mask buffer, creating a write-before-allocation primitive. CVSS 7.8 with AV:L/AC:L/PR:L/UI:N reflects straightforward local exploitation on affected MIPS systems, though EPSS at 0.21% (12th percentile), no CISA KEV listing, and no public exploit code indicate limited real-world exploitation activity at time of analysis.
Use-after-free in the Linux kernel's IOMMUFD subsystem (iommu/iommufd) exposes systems running VFIO device passthrough to kernel memory corruption by a local low-privileged attacker, with a scope change that may cross security boundaries into the hypervisor layer. The flaw, present since Linux 6.11, stems from a race between IOPF group acceptance by the fault handler and concurrent device detach operations, leaving IOMMUFD's deliver list holding references to memory already freed by the generic pending list cleanup path. No public exploit or active exploitation has been identified at time of analysis - EPSS stands at 0.17% (6th percentile) and the vulnerability is absent from CISA KEV - though the CVSS 3.1 score of 8.8 reflects the severity of potential impact in affected virtualization environments.
Double-free memory corruption in the Linux kernel's pinctrl/devicetree subsystem enables a local low-privileged attacker on systems running affected pinctrl drivers - such as pinctrl-imx on NXP iMX6 platforms - to corrupt kernel heap memory, with theoretical potential for local privilege escalation. The flaw resides in the error-cleanup path of `dt_remember_or_free_map()`: when `kstrdup_const()` fails mid-loop, `dt_free_map()` iterates over all map entries including those never initialized by the core, passing uninitialized `kmalloc()` data to `kfree_const()` - a KASAN-confirmed double-free. No public exploit identified at time of analysis; the EPSS score of 0.18% (8th percentile) reflects very low real-world exploitation probability despite the formal CVSS 7.8 rating.
List corruption in the Linux kernel's hugetlb memory management subsystem (`mm/hugetlb`) allows a local low-privileged attacker to trigger kernel memory corruption, potentially achieving privilege escalation or host crash. The flaw was confirmed as causing real-world KVM host panics in dense virtualization environments where QEMU and SPDK/DPDK vhost-user processes share a hugetlbfs MAP_SHARED mapping; with CONFIG_DEBUG_LIST disabled, the corruption silently embeds a kernel stack address into an active cache list, setting up a use-after-free. No public exploit has been identified at time of analysis; EPSS is 0.17% and the vulnerability is not in CISA KEV, but fixed stable kernel releases are available across all active branches.
KVM on AMD SVM-enabled hosts fails to update x2APIC MSR intercepts when AVIC is inhibited while a nested guest (L2) is running, allowing an L1 guest with root-level privileges to directly access the host's APIC state, send arbitrary interrupts, and crash the host kernel. Affected Linux kernels from 6.0 through multiple stable branches expose the host to interrupt manipulation, task priority changes, and denial-of-service. A functional proof-of-concept demonstrating both spurious interrupt injection and wakeup handler corruption is embedded in the CVE description itself; this vulnerability is not currently listed in the CISA KEV catalog and carries a 0.17% EPSS score consistent with its narrow but severe exploitation conditions.
KVM s390 PCI subsystem in the Linux kernel allows a local low-privileged user to corrupt hypervisor resources by repeatedly calling the adapter interrupt forwarding ioctl for the same zPCI device without prior unregistration. The vulnerability affects IBM Z (s390) systems running Linux KVM with PCI passthrough from commit 3c5a1b6f onwards (Linux 6.0+), with patched stable releases available. No public exploit exists and EPSS sits at 0.17% (6th percentile), reflecting the niche architecture and local-access prerequisite, but the CVSS Scope:Changed designation signals the flaw can cross the guest-to-hypervisor boundary, elevating its priority on affected IBM Z KVM deployments.
Use-after-free in the Linux kernel's dibs loopback subsystem allows a local low-privileged attacker to corrupt kernel memory during concurrent DMB node attach, detach, and unregister operations. The vulnerability arises from a race window between hash table lookup under dmb_ht_lock and the subsequent refcount operation performed after the lock is dropped, enabling a concurrent unregister path to free the node before the refcount transition completes. With a CVSS score of 7.8 and C:H/I:H/A:H impact metrics, successful exploitation can lead to privilege escalation or kernel crash; however, no public exploit is identified at time of analysis and EPSS at 0.17% reflects low current exploitation probability.
Use-after-free in the Linux kernel audit subsystem's `audit_del_rule()` function exposes systems from kernel 4.3 onward to local privilege escalation. The flaw stems from incorrect RCU ordering: fsnotify mark resources tied to `e->rule.exe` are freed before the rule is unlinked from RCU-visible filter lists, creating a window where concurrent `audit_filter()` and `audit_filter_rules()` readers dereference already-freed memory. Patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Linux kernel Bluetooth management subsystem allows a local low-privileged user to corrupt kernel heap memory by racing MGMT_OP_SET_LOCAL_NAME against MGMT_OP_REMOVE_UUID on systems with a powered BR/EDR-capable Bluetooth controller. The race exploits a missing lock acquisition in pending_eir_or_class() and the omission of MGMT_OP_SET_LOCAL_NAME from EIR-serialization logic, enabling a freed pending command entry to be read during EIR reconstruction. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), but the kernel UAF primitive and confirmed 7.8 CVSS score make patching a clear priority for Bluetooth-enabled systems.
Bluetooth HIDP in the Linux kernel exposes an uninitialized-memory read and a peer-controlled out-of-bounds byte access in hidp_session_run() when processing numbered HID report responses. Systems running Linux with active Bluetooth HID sessions are vulnerable to a malicious adjacent Bluetooth peer leveraging this to disclose kernel memory contents (rated C:H, enabling potential KASLR bypass) or manipulate HIDIOCGFEATURE report completion with attacker-controlled data. No public exploit has been identified, EPSS is 0.17% (6th percentile), and this vulnerability is not listed in CISA KEV.
Use-after-free in the Linux kernel's AFS (Andrew File System) subsystem exposes systems running the kafs module to kernel memory corruption exploitable by local low-privileged users, potentially enabling privilege escalation to root. The race condition in afs_make_call() allows the afs_call structure to be freed by an arriving async server response while the sending function - having transferred its reference rather than retaining one - continues to access the freed memory. EPSS is 0.17% (6th percentile), no CISA KEV listing exists, and upstream fix commits are publicly available on stable kernel trees.
Use-after-free in the Linux kernel ALSA timer subsystem allows an unprivileged local user to corrupt kernel heap memory and escalate privileges to root. The flaw stems from snd_timer_close_locked() setting SNDRV_TIMER_IFLG_DEAD but never clearing it after close completes; when snd_seq_timer_open() retries on the same instance after a forced failure, snd_timer_instance_free() frees an object still referenced across multiple kernel data structures. With CVSS 7.8 and a detailed exploitation path described directly in the upstream kernel commit, this is a credible local privilege escalation on desktop and workstation Linux systems, despite a low EPSS score of 0.17% (6th percentile) and no current CISA KEV listing. No public exploit code has been identified at time of analysis.
Missing bounds enforcement in the Linux kernel ALSA USB audio driver's implicit-feedback path allows a physically-connected malicious USB device to inject oversized sync packets that propagate un-clamped into the playback endpoint queue. The un-clamped frame count - potentially exceeding ep->maxframesize - can drive packet transfers beyond hardware frame limits, risking kernel memory corruption with high confidentiality, integrity, and availability impact. No public exploit has been identified and EPSS is 0.17% (6th percentile), but patches are confirmed across multiple stable kernel branches including 6.6.151, 6.12.103, 7.1.8, and 6.18.44.
Use-after-free in the Linux kernel's FOU (Foo-over-UDP) tunnel subsystem allows a local attacker with low privileges to corrupt kernel memory by exploiting a race condition in fou_create(). The struct fou object is published via sk_user_data before being committed to the per-network-namespace port list; when fou_add_to_port_list() subsequently fails on port-0 requests, the error path frees the object while concurrent RCU readers can still dereference it through fou_from_sock(). Two stable-branch upstream commits (a28d8903, b14361ac) provide the fix; no public exploit has been identified at time of analysis, and EPSS sits at the 5th percentile.
A DMA mapping resource leak in the Linux kernel's igbvf driver (Intel 82576 SR-IOV virtual function NIC) occurs on the TX buffer-mapping error path: an off-by-one in the dma_error cleanup loop leaks exactly one DMA mapping (the packet head) whenever a fragment mapping fails after the head was successfully mapped. The bug traces to a 2010 fix for an endless loop and affects a wide range of stable kernels until patched (fixes landed in 6.6.151, 6.12.103, 6.18.44, 7.1.8 and 7.2-rc6). There is no public exploit identified at time of analysis, EPSS is very low (0.17%), and the practical impact is memory/DMA resource exhaustion rather than the remote code execution suggested by the assigned 9.8 score.
Kernel-level use-after-free in the Linux SMC (Shared Memory Communications) subsystem allows a race between socket close and link group termination to write to freed memory. The flaw lives in the net/smc driver where __smc_lgr_terminate() releases conns_lock after locating a connection in lgr->conns_all but before calling sock_hold(), so a concurrent close can free the embedded socket first. Fixed across multiple stable trees; EPSS is low (0.17%), there is no public exploit identified at time of analysis, and it is not on CISA KEV.
Use-after-free in the Linux kernel netfilter ipset subsystem enables local kernel memory corruption with potential for privilege escalation. During an ipset hash resize (`mtype_resize()`), comment pointers are shallow-copied via `memcpy()` rather than deep-copied, causing both old and new table entries to share the same `ip_set_comment_rcu` pointer; an `xt_SET --add-set --exist` packet hitting the old entry during this window calls `ip_set_init_comment()`, freeing the shared pointer and leaving the new table entry with a dangling reference that is later dereferenced in `strlen()` during backlog replay. Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6), no public exploit has been identified, and EPSS sits at 0.17% (6th percentile), indicating very low observed exploitation pressure at time of analysis.
Use-after-free race condition in the Linux Kernel TIPC subsystem allows a low-privileged attacker to trigger stale-pointer dereference during socket poll trace operations, potentially leading to kernel memory corruption and privilege escalation. The flaw arises because tipc_poll() invokes trace_tipc_sk_poll() without holding the socket lock, enabling tipc_list_dump() to walk live queue members while a concurrent thread dequeues and frees socket buffers (skbs). Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8); no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Linux kernel wifi/mac80211 subsystem allows an adjacent network attacker to trigger kernel memory corruption during Block Acknowledgment session teardown. ieee80211_stop_tx_ba_cb() hands tid_tx to kfree_rcu() and then reads tid_tx->ndp after dropping sta->lock without RCU read-side protection, creating a window where the RCU softirq callback can free the object before the read completes. The vulnerability carries a CVSS 8.8 score (AV:A) but EPSS sits at the 5th percentile with no KEV listing, reflecting the race-condition exploitation complexity; no public exploit has been identified at time of analysis.
Use-after-free and out-of-bounds read in the Linux kernel mwifiex WiFi driver (CVSS 8.8, AV:A) allow an unauthenticated attacker on an adjacent WiFi segment to trigger kernel memory corruption by sending crafted A-MSDU frames containing TDLS payloads. Affected kernel versions span from the commit introducing A-MSDU TDLS handling (circa Linux 4.5, commit 776f742040ca) through all stable branches prior to the fixes in 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the flaw is remotely selectable by the sender through control over A-MSDU subframe layout, making TDLS-capable mwifiex deployments meaningfully exposed from the local wireless segment.
Out-of-bounds slab read in the Linux kernel's binfmt_misc subsystem allows local low-privileged users - including those operating within unprivileged user namespaces - to trigger heap memory exposure or a kernel crash by registering a binary format with a flag character ('P', 'O', 'C', or 'F') as the field delimiter. The flaw exists because check_special_flags() consumes flag characters without using the delimiter as a terminator, swallowing the 8-byte padding appended by create_entry() and reading past the end of the allocated buffer. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates low near-term exploitation probability; however, reachability from unprivileged user namespaces on most modern Linux distributions meaningfully broadens the real-world attack surface.
Use-after-free in the Linux kernel's Transparent Huge Page split path exposes systems to kernel memory corruption, potential privilege escalation, or denial of service via a race condition in __folio_split(). Any local low-privilege user on affected kernels prior to the stable fixes in versions 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6 may trigger this by racing a concurrent final iput() against the shmem THP split unlock sequence. No public exploit or PoC has been identified, and the EPSS score of 0.17% (6th percentile) reflects minimal real-world exploitation activity at time of analysis.
Use-After-Free in the Linux kernel's mm/page_reporting subsystem triggers a General Protection Fault during PM suspend and hibernation on systems running virtio_balloon with page reporting enabled. When the PM freezer initiates a suspend or S4 hibernation cycle, the virtio_balloon driver tears down its virtqueues via del_vqs(), but page_reporting_process - scheduled on the non-freezable system_wq workqueue - remains active. If the buddy allocator frees pages during this window (e.g., the balloon shrinker runs during S4 image saving), the reporting worker calls virtballoon_free_page_report() on already-deleted virtqueues, causing kernel memory corruption. No public exploit has been identified at time of analysis; EPSS is 0.18% (8th percentile), reflecting minimal exploitation probability, though this is a confirmed kernel UAF with crash-level impact validated by Google in production virtualization infrastructure.
Use-after-free in the Linux kernel bridge (net/bridge) multicast fast-leave path lets the group-leave handler dereference a freed port-group entry after br_multicast_del_pg() removes it, because the loop keeps walking through the stale next pointer. It affects bridges that had multicast-to-unicast enabled and later disabled while multiple per-source-MAC port groups existed, and can corrupt kernel memory. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not in CISA KEV, so the headline CVSS 9.8 overstates practical risk for most deployments.
Memory corruption in the Linux kernel's User Mode Linux (UML) vector network driver lets a remote peer trigger a use-after-free in vector_mmsg_rx(). When a received packet fails verify_header(), the code frees the skb but skips the slot-cleanup that normal paths perform, so the next RX iteration re-reads and double-frees the same freed buffer, causing a refcount underflow / use-after-free. It affects UML instances using the GRE or L2TPv3 vector transports; any peer on such a transport can trigger it without authentication. No public exploit identified at time of analysis, and EPSS is low (0.20%).
Race-condition torn read in the Linux kernel's VXLAN driver (route_shortcircuit()) allows the neighbour hardware address (n->ha) to be read without holding the n->ha_lock seqlock, producing a partially-updated or corrupted MAC address while the neighbour subsystem concurrently updates it. Fixed by switching to neigh_ha_snapshot() for a seqlock-protected read. No public exploit identified at time of analysis; EPSS is 0.17% (6th percentile), and despite the assigned CVSS of 10.0 the practical impact is a minor data-integrity/read-consistency issue in VXLAN forwarding, not a genuine critical remote compromise.
Out-of-bounds read in the Linux kernel's VXLAN driver stems from route_shortcircuit() validating only 20 bytes from skb->data instead of accounting for the 14-byte MAC header offset, so ip_hdr()->daddr dereferences can read past the pulled linear buffer when packets have non-linear fragments. The flaw affects hosts running VXLAN tunneling with proxy mode, is tagged as an information-disclosure issue, and has no public exploit identified at time of analysis (EPSS 0.17%, 6th percentile). A vendor fix replaces pskb_may_pull() with pskb_network_may_pull() to check the full network header including skb_network_offset().
Use-after-free in the Linux kernel tracing subsystem exposes low-privileged local attackers to kernel memory corruption and potential privilege escalation. The defect, introduced at commit ae63b31e4d0e2ec09c569306ea46f664508ef717, causes trace_module_add_events() to call __add_event_to_tracers() unconditionally even when __register_event() has failed, leaving a trace_event_file holding a dangling pointer to a freed trace_event_call after a module load failure. EPSS is 0.17% (6th percentile) and no public exploit or CISA KEV listing has been identified, but the kernel UAF class carries inherent escalation potential and patches are available across multiple stable branches.
Integer overflow in the Linux kernel SCTP subsystem allows a remote low-privileged attacker to trigger an approximately 8 MiB out-of-bounds write past a socket buffer (skb) tail in kernel heap memory by adding 65,536 unique peer transport addresses to an SCTP association, wrapping the 16-bit transport_count to zero. Affected systems running Linux kernels from the 4.7 era through stable branches prior to 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6 are vulnerable. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates minimal current exploitation activity despite the CVSS 8.8 rating.
Privilege escalation in the Linux kernel's s390/qeth network driver allows any local unprivileged user to invoke three network management ioctls - SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE, and SIOC_QETH_QUERY_OAT - without the CAP_NET_ADMIN capability check that should gate them. Affected deployments are exclusively IBM z Systems (s390) mainframe environments running Linux kernels from commit 18787eeebd7 through the respective stable fix points, limiting real-world exposure to a narrow architectural niche. No public exploit or active exploitation has been identified; EPSS of 0.17% at the 6th percentile is consistent with the specialized environment required.
Use-after-free in the Linux kernel's Open vSwitch meter subsystem exposes systems running OVS to local privilege escalation, memory corruption, and potential information disclosure. The flaw affects all Linux 5.8+ kernels up to the patched stable releases and is triggered by a custom userspace application interacting with OVS via Netlink uAPI - standard ovs-vswitchd deployments are not vulnerable. No public exploit has been identified and EPSS sits at the 6th percentile, but the bug was discovered by Trend Micro's Zero Day Initiative (ZDI-CAN-31642), indicating professional security research attention; multiple stable kernel patches are now available.
NULL pointer dereference and use-after-free in the Linux kernel i2c-imx driver (NXP i.MX SoC family) allows a local attacker or concurrent kernel path to trigger kernel memory corruption during I2C slave unregistration. The race condition in i2c_imx_unreg_slave() permits a pending hrtimer callback to fire after the slave pointer has been cleared, causing i2c_imx_slave_finish_op() to dereference a NULL pointer with potential for privilege escalation or system crash. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.17% (6th percentile) confirms low exploitation likelihood, though the CVSS base score of 8.4 reflects high potential impact if triggered.
Double-free heap corruption in the Linux kernel's peak_usb CAN bus USB driver exposes systems with PEAK USB-to-CAN hardware to local privilege escalation, kernel panic, or sensitive memory disclosure. The flaw resides in the peak_usb_start() error-handling path, where a URB transfer buffer is freed explicitly via kfree(buf) before usb_free_urb() frees the same buffer a second time through the URB_FREE_BUFFER flag, corrupting kernel heap allocator metadata. Patched stable kernel releases are confirmed available (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6), no public exploit code has been identified, and EPSS at 0.17% (6th percentile) confirms no observed exploitation activity.
Arbitrary CMA memory corruption via GPU DMA in the Linux kernel's drm/vc4 VideoCore 4 driver affects Raspberry Pi and similar vc4-based platforms running kernels from version 4.13 through multiple stable series. The vc4_overflow_mem_work() function incorrectly programs BPOS with the full 16MB binner BO size instead of the correct 512KB slot size, authorizing the GPU's PTB hardware to scribble tile lists across adjacent in-flight job memory and into unrelated CMA pages beyond the BO boundary. No public exploit has been identified at time of analysis and EPSS is 0.17% (6th percentile), but the memory corruption manifests reliably as GPU hangs, userspace heap corruption, and system crashes under normal GPU workloads that overflow the initial binner slot.
Uninitialized GPU memory reuse in the Linux kernel's drm/vc4 driver (Broadcom VideoCore IV, used in Raspberry Pi) allows a local low-privileged user to trigger GPU hangs, corrupt GPU state, and read stale tile state data left by prior GPU jobs in recycled buffer slots. The vulnerability exists because the 16MB binner Buffer Object is partitioned into 512KB slots that are recycled across jobs without clearing, causing the Primitive Tile Binner (PTB) hardware to act on stale Tile State Data Array (TSDA) contents from previous jobs - producing invalid command and primitive streams. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) reflects low exploitation probability despite the high CVSS base score.
Heap buffer overflow and potential kernel memory mass-zeroing in the Linux kernel drm/panthor GPU driver allow a local attacker to corrupt kernel heap structures or trigger catastrophic out-of-bounds writes by supplying a crafted firmware image to the Arm Mali Valhall (Panthor) DRM subsystem. The root cause is that panthor_fw_load_section_entry() computes section->data.size from raw firmware header fields without bounding it against the allocated section_size, allowing both a memcpy overflow and an unsigned integer underflow in a subsequent memset that could zero arbitrarily large kernel memory regions. No public exploit has been identified and EPSS is low at 0.18% (8th percentile), but the CVSS impact ratings of C:H/I:H/A:H reflect the realistic worst case of full kernel compromise on affected hardware.
Out-of-bounds memory access in the Linux kernel's drm/panthor driver (ARM Mali Valhall GPU) allows a local authenticated attacker to read or corrupt kernel memory by supplying a crafted MCU virtual address near the end of the firmware shared memory section. The underlying flaw is in iface_fw_to_cpu_addr(), which validated only that a firmware-provided address falls within the shared section - not that the full firmware interface structure fits within it - enabling subsequent structure-level accesses to reach past the section boundary. No public exploit code exists and EPSS is 0.17% (6th percentile), indicating no evidence of active exploitation; patches are available in Linux stable releases 6.12.103, 7.1.8, and 6.18.44.
Divide-by-zero panic in the Linux kernel's AMD display driver (drm/amd/display) allows a low-privileged local user to crash the kernel by triggering a zero-area viewport condition in the calculate_mcache_setting function. The vulnerable code path exits early with num_mcaches == 0 and mvmpg_width/height == 0, then proceeds to divide by those zero values, causing both a divide-by-zero panic and potential integer underflow on num_mcaches. EPSS is very low at 0.15% (5th percentile) and no active exploitation or public exploit code has been identified at time of analysis; however, the local trigger mechanism via display mode setting is accessible to low-privileged users on systems with AMD GPU hardware.
Integer overflow in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user with AMD KFD device access to bypass EOP ring buffer size validation on GFX8/GFX9 hardware, enabling out-of-bounds GPU writes that can corrupt adjacent kernel memory or trigger GPU faults. A crafted eop_ring_buffer_size of 0xFFFFF001 exploits the ALIGN macro's typeof-preserved 32-bit arithmetic to wrap the computed size to zero, causing kfd_queue_buffer_get() to skip its exact-size check and accept an undersized buffer object. No public exploit has been identified and this is not in CISA KEV; EPSS stands at 0.17% (6th percentile), reflecting very low in-the-wild exploitation probability despite a CVSS 7.8 score.
Concurrent event manipulation during CRIU checkpointing in the Linux kernel's AMD GPU driver (drm/amdkfd) exposes a race condition leading to heap out-of-bounds writes or use-after-free memory corruption. A low-privileged local attacker on a system with an AMD GPU can exploit the unprotected gap between the event count and IDR walk in kfd_criu_checkpoint_events() by racing event creation or destruction from a second thread within the same process, producing kernel heap corruption primitives exploitable for local privilege escalation. No public exploit code and no CISA KEV entry have been identified at time of analysis; EPSS is 0.17% (6th percentile), reflecting low current adversary interest despite the high C:H/I:H/A:H CVSS impact triad.
Out-of-bounds kernel memory read in the Linux kernel's vmwgfx DRM driver exposes systems running VMware-virtualized graphics to local privilege escalation or sensitive information disclosure. The flaw in vmw_cmd_draw() allows a low-privilege local user to supply a crafted DRAW_PRIMITIVES command stream header with an undersized size field, triggering unsigned integer underflow that produces a near-4 GiB loop bound and causes the kernel to dereference memory far beyond the allocated command bounce buffer. Patches are available across multiple stable kernel branches (6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2-rc6); no active exploitation has been confirmed and the vulnerability is not listed in CISA KEV.
Pointer underflow in the VMware graphics driver (drm/vmwgfx) of the Linux kernel enables local low-privileged users to perform a TOCTOU attack on the DMA command stream inside a bounce buffer, allowing one crafted command to overwrite authenticated fields (GMR id, surface id) of a previously verified command. This bypasses kernel command authentication and can lead to unauthorized access to graphics memory regions or escalated privileges within a VMware guest. EPSS is 0.17% (6th percentile) and the vulnerability is not listed in CISA KEV, suggesting no confirmed widespread exploitation at the time of analysis.
Race condition in the Linux kernel's drm/xe Intel GPU driver allows a locally-authenticated user to schedule a GPU job that executes concurrently with an in-flight kernel memory management operation on an external buffer object, violating the DMA_RESV_USAGE_KERNEL cross-driver synchronization contract. Affected systems are those running Linux 6.8 or later with compatible Intel Xe-architecture GPU hardware and the xe driver loaded; the race can result in reading or writing memory that is simultaneously being evicted or relocated. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV), consistent with the low EPSS score of 0.17% at the 6th percentile.
Heap out-of-bounds write in the Perl DBI module before version 1.652 lets an attacker who reaches the preparse() routine with attacker-controlled SQL corrupt heap memory when the ':pN' / ':N' (named-to-numbered) placeholder return style is used. A numeric placeholder such as ':2147483648' is parsed with atoi() and stored in the binder counter with no range check; on glibc it wraps negative, and each following '?' then expands to a 14-byte ':p-2147483648' string into a buffer that budgeted only 7 bytes per input byte. Exploitation status: no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile), and it is not in CISA KEV.
Heap out-of-bounds write in Perl's DBI module before 1.652 lets an attacker who can feed an oversized untrusted statement to the preparse() function corrupt heap memory on 32-bit perl builds, writing hundreds of megabytes of attacker-controlled data past a tiny allocation. The flaw stems from an integer wraparound (CWE-190) in the output-buffer sizing arithmetic and could lead to code execution or crashes. No public exploit has been identified and EPSS is low (0.20%), but a vendor patch (DBI 1.652) is available.
Unbounded locale cache growth in Apache Struts allows unauthenticated remote attackers to exhaust JVM heap memory and deny service to all users of the application. The vulnerability spans an exceptionally wide version range - from 2.0.0 through 7.2.1 across four release branches - and is exploitable only when no fixed locale is configured, a condition common in multilingual deployments. No public exploit has been identified at time of analysis, and EPSS at 0.19% (9th percentile) reflects low observed exploitation activity; however, the network vector with zero prerequisites on vulnerable configurations makes this a meaningful DoS risk in exposed environments.
Heap buffer overflow in the Linux kernel ASoC SOF IPC3 audio subsystem allows a local low-privilege attacker to write past an allocated buffer via a missing bounds check in `snd_sof_update_control()`, potentially enabling kernel memory corruption, privilege escalation, or system crash. Affected systems span Linux 5.18 through multiple stable branches (6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x) on hosts with Intel SOF-capable audio DSP hardware. No public exploit is known and EPSS is low at 0.21%, but the CVSS 7.8 score reflects the severity of the potential kernel-level impact once local access is obtained.
NULL pointer dereference in the Linux kernel netfilter nft_fib subsystem crashes the kernel when a FIB expression is placed in a netdev egress base chain, enabling denial of service against any system carrying that configuration. The root cause is a hook namespace collision where NF_NETDEV_EGRESS aliases NF_INET_LOCAL_IN numerically, causing nft_fib_validate() to incorrectly approve egress chain placement and then dereference nft_in(pkt) - which is NULL on the transmit path. No public exploit exists and EPSS is 0.21% (11th percentile), but systems running custom nftables egress FIB rules are at immediate kernel crash risk until patched.
Memory-safety flaw in the Linux kernel's netfilter SIP NAT helper (net/netfilter/nf_nat_sip.c) allows a stale, freed data pointer to be used after skb_ensure_writable() reallocates a cloned socket buffer, potentially corrupting kernel memory or crashing the host when SIP connection tracking and NAT are active. The bug affects systems using the nf_nat_sip application-layer gateway; because SIP conntrack linearizes SKBs, only clones (not fragments) trigger it, and a secondary error path could invoke UDP mangling on a TCP stream. No public exploit is identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not in CISA KEV.
Netfilter IPv6 fragment reassembly in the Linux kernel incorrectly advances the sk_buff MAC header offset on the NF_INET_LOCAL_OUT path, where no link-layer header exists, causing a u16 integer wrap that leaves the MAC header pointer aimed at kernel headroom. All Linux kernels from version 2.6.15 through the stable-branch patch releases (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5) are affected when the nf_conntrack_ipv6 module is loaded. A local low-privilege attacker can send crafted IPv6 fragmented packets to trigger the vulnerable reassembly code path, potentially achieving information disclosure of kernel memory or a kernel panic; no public exploit or active exploitation has been identified at time of analysis.
Incorrect route selection in the Linux kernel's netfilter flowtable IPIP-encapsulation offload path causes the headroom and IP fragment-offset (iph->frag_off) to be computed from the reverse-direction dst instead of the current direction when pushing the IPIP header. Affecting kernel 6.19 and development branches through the 7.x line, the flaw can lead to malformed encapsulated packets and potential memory/headroom mishandling in the fast-path offload; it is tagged as information disclosure. The input CVSS of 9.8 (RCE-grade) is a CNA auto-score that overstates a config-dependent packet-handling bug, and EPSS is low at 0.20% (10th percentile) with no public exploit or KEV listing.
Denial of service in the Linux kernel netfilter flowtable subsystem allows a crash in the tunnel transmit path when IPIP tunnel offload is combined with a direct-xmit device such as a bridge. Because no dst_entry is supplied, the code performs invalid dst usage while checking skb headroom and setting iph->frag_off, leading to a kernel crash. Rated CVSS 9.8 by automated scoring, but vendor tags classify it as Denial Of Service; EPSS is 0.20% (10th percentile), it is not in CISA KEV, and no public exploit was identified at time of analysis.
Connection limit bypass in the Linux kernel's netfilter nf_conncount subsystem allows network-reachable attackers to exhaust host resources by exploiting incorrect zone direction bitmask handling in tuple deduplication. The bug in __nf_conncount_add() conflates the u8 zone direction bitmask (NF_CT_ZONE_DIR_ORIG=1, NF_CT_ZONE_DIR_REPL=2, NF_CT_DEFAULT_ZONE_DIR=3) with the ip_conntrack_dir enum (IP_CT_DIR_ORIGINAL=0, IP_CT_DIR_REPLY=1), causing non-default directional zones to be erroneously treated as equivalent and bypassing per-connection counting. No active exploitation is confirmed (EPSS 0.22%, 13th percentile); upstream fixes have been committed across multiple stable kernel branches.
Local privilege escalation in the Linux kernel's GPU buddy memory allocator (gpu/buddy) allows a low-privileged authenticated local user to exploit a misalignment logic error in the try_harder contiguous fallback path, achieving high confidentiality, integrity, and availability impact (CVSS 7.8). The defect, introduced at commit 0a1844bf0b532d84324453374ad6845f64066c28, caused the allocator to return candidate blocks whose start offsets were not aligned to the caller's min_block_size, violating allocation invariants on both the RHS and LHS paths. No public exploit identified at time of analysis; EPSS exploitation probability is 0.21% (11th percentile), consistent with low near-term exploitation likelihood.
SELinux mandatory access control bypass in the Linux kernel allows local low-privilege users to circumvent connect-related network policy enforcement by initiating TCP connections via TCP Fast Open (MSG_FASTOPEN). The kernel's SELinux LSM hook for socket_sendmsg() was never updated to invoke selinux_socket_connect() when the MSG_FASTOPEN flag is passed, meaning connections using this path skip SELinux policy checks entirely. With a CVSS 8.4, Scope Changed, and confirmed patches across six stable branches, this is a meaningful MAC bypass in SELinux-enforcing environments - no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile).
Weakened AMD SEV-SNP memory-integrity enforcement in the Linux kernel results from a race between WBINVD IPIs and dirty-cacheline migration that can leave Reverse Map Table (RMP) memory with un-flushed dirty cache lines when SNP_INIT_EX is invoked with INIT_RMP=1, violating SNP firmware requirement (spec section 8.8). Affected are Linux 7.1 hosts that had adopted commit 99cf1fb58e68 (which dropped the pre-SNPEn WBINVD); the fix reverts that change so wbinvd_on_all_cpus() again runs before setting MSR_AMD64_SYSCFG_SNP_EN, while the RMP is not yet in use. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not CISA KEV-listed.
Use-after-free in the Linux kernel's batman-adv mesh networking driver allows adjacent unauthenticated attackers to achieve kernel memory corruption with potential for code execution, information disclosure, or denial of service. The flaw exists in batadv_interface_rx(), where pskb_may_pull() may reallocate the socket buffer during RX processing - the VLAN header pointer was correctly refreshed post-reallocation, but the ethernet header pointer was not, leaving a dangling reference used subsequently in Translation Table and AP isolation logic. EPSS is low at 0.22% (13th percentile) and no CISA KEV listing exists, limiting real-world risk primarily to environments actively running batman-adv mesh deployments. Vendor-released patches are confirmed across multiple stable kernel branches.
Use-after-free in the Linux kernel's batman-adv mesh networking module (net/batman-adv unicast path) occurs because the unicast_packet pointer is not reassigned after pskb_may_pull() inside batadv_get_vid() may reallocate the socket buffer, leaving a stale pointer into freed memory. Systems running batman-adv B.A.T.M.A.N. advanced mesh routing are affected across a wide range of stable kernel series. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.22%, 13th percentile).
Use-after-free in the Linux kernel's batman-adv Bridge Loop Avoidance (BLA) subsystem allows an unauthenticated attacker on the same Layer 2 network segment to corrupt kernel memory, potentially achieving arbitrary code execution or system crash. The flaw originates from pskb_may_pull() silently reallocating the socket buffer during backbone gateway processing in batadv_bla_is_backbone_gw(), leaving cached gateway address pointers dangling against the freed old buffer. Affected kernels span from commit 9e794b6bf4a2c65d698d7433ddfabc54a5d53a88 (approximately Linux 4.12) through multiple stable branches; patches are available across all active stable series. No public exploit or CISA KEV listing exists at time of analysis, and the very low EPSS of 0.22% (13th percentile) reflects the niche deployment footprint of batman-adv BLA.
Out-of-bounds buffer read in the Linux kernel's batman-adv (batadv) mesh networking driver allows a local user with eBPF TC hook access to trigger reads beyond allocated packet buffer boundaries inside batadv_interface_tx(). The vulnerability spans many stable kernel series from 2.6.38 through pre-patch releases of 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, and 7.1 branches. No public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), though the high CVSS impact metrics (C:H/I:H/A:H) reflect potential for kernel heap memory disclosure or corruption if the out-of-bounds read extends into sensitive kernel state.
Request storm vulnerability in the Linux kernel's batman-adv mesh networking subsystem (B.A.T.M.A.N. Advanced) exposes nodes to availability degradation through an inverted boolean condition in batadv_send_tt_request(). When a send buffer allocation fails, an incorrect check (ret == true instead of ret == false) causes the tt_req_node tracking structure to be retained rather than cleaned up, breaking the de-duplication mechanism that prevents simultaneous TT requests to the same originator. The result is that repeated, redundant translation table requests can flood a mesh peer - a request storm - degrading availability of nodes on the batman-adv overlay. No public exploit code exists and EPSS exploitation probability is very low (0.22%, 13th percentile); no active exploitation is confirmed.
Out-of-bounds read in the Linux kernel's batman-adv multicast tracker exposes adjacent-network unauthenticated attackers to kernel memory disclosure or denial-of-service via a crafted TVLV mcast tracker packet. The root cause is a C macro misuse - offsetof() on the first struct member always evaluates to 0, making the bounds check a no-op that permits access to num_dests even when only 0 or 1 byte is in the received packet instead of the required 2. EPSS is 0.21% (11th percentile), no CISA KEV entry exists, and no public exploit is identified; vendor-released patches are available in Linux 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3.
Integer-overflow-driven out-of-bounds access in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh networking module allows a node on the same mesh to corrupt translation-table processing via a crafted TT unicast TVLV. The VLAN count (u16) multiplied by the 8-byte batadv_tvlv_tt_vlan_data size overflows the u16 length variable, defeating every downstream bounds check that guards the TVLV buffer. This is a fixed, patched kernel bug with a low EPSS (0.22%, 13th percentile) and no public exploit identified at time of analysis; it is not listed in CISA KEV.
Use-after-free in the Linux kernel's sunrpc server-side TLS handshake path (svc_tcp_handshake/svc_sock) allows the asynchronous tlshd handshake-completion callback to write through a freed struct svc_sock, corrupting slab memory on any NFS server configured for RPC-with-TLS. Two close-versus-cancel races let svc_sock_free() kfree() the socket while svc_tcp_handshake_done() is still updating xpt_flags and walking the embedded wait queue, yielding an attacker-influenceable slab-corruption primitive rather than a benign read. No public exploit identified at time of analysis and EPSS is low (0.20%), but the fix is upstream in stable kernels.
Kernel-side race condition in the Linux SUNRPC server's TLS handshake path (svc_tcp_handshake) allows a lost cancellation race to corrupt an embedded swait_queue or prematurely tear down a succeeding handshake, leading to kernel memory corruption or connection instability on NFS/RPC servers using RPC-with-TLS. Affects servers that terminate kernel RPC TLS sessions; it is a resolved upstream kernel bug with no public exploit and a very low EPSS (0.21%, 11th percentile), and it is not in CISA KEV. Despite the NVD-propagated 9.8 rating typical of auto-generated kernel CVEs, the practical impact is a narrow timing window affecting availability/state integrity rather than turnkey remote code execution.
Memory-corruption (double-free / use-after-free) in the Linux kernel's SunRPC server layer allows the rq_procinfo->pc_release hook to fire against stale, reused request state when a worker thread hits an early error path (unsupported protocol, short frame, or bad auth) before a valid procinfo is installed. It affects Linux 6.18 (and the shared SunRPC code reachable via kernel RPC servers such as nfsd), and successful triggering corrupts kernel heap state, risking denial of service or privilege escalation. The issue is patched upstream; there is no public exploit identified at time of analysis and EPSS is low (0.21%), so it is not currently known to be exploited.
Out-of-bounds slab write in the Linux kernel SUNRPC layer (xdr_buf_to_bvec()) lets a remote NFS client corrupt kernel memory via the in-kernel NFS server (nfsd) write path. The function stores a bio_vec into the caller's rq_bvec array before verifying the slot is in range - and the head branch stores with no check at all - so when the exactly-sized rq_maxpages budget is used up, one bio_vec lands past the array into adjacent slab memory, with attacker-influenced bv_len and bv_offset values taken from client-supplied RPC payload sizes. Rated CVSS 9.8 by the source, but with low EPSS (0.21%), no CISA KEV listing, and no public exploit identified at time of analysis.
Page-counter underflow in Linux kernel's hugetlb cgroup accounting allows a local low-privileged user to corrupt memory accounting state, causing integrity and availability impacts on affected systems. The flaw exists in alloc_hugetlb_folio() where a shared h_cg pointer is overwritten during sequential rsvd and non-rsvd hugetlb cgroup charges, causing the wrong cgroup to be committed to the folio's reserved slot. When the folio is freed, the mismatched uncharge path decrements a counter on a cgroup that was never charged, triggering a page_counter underflow (WARNING: mm/page_counter.c:61). No public exploit exists and EPSS sits at 0.21% (11th percentile), but the flaw affects a broad swath of kernel versions from 5.7 onward.
Filesystem consistency flaw in the Linux kernel NTFS driver's ntfs_ir_reparent() index-root reparenting path allows a transient on-disk/in-memory layout that $INDEX_ROOT validation rejects as corrupt, surfacing as generic/013 xfstests failures and ntfsck 'Corrupt index root' errors. The bug is a metadata-ordering error triggered during NTFS write operations that grow an index root and hit -ENOSPC, not a remotely exploitable memory-safety issue; no public exploit identified at time of analysis and it is not in CISA KEV. Fixed in stable 7.1.5 and mainline 7.2-rc1.
Out-of-bounds read in the Linux kernel's NTFS driver (ntfs_mapping_pairs_decompress) lets a crafted NTFS attribute record trigger a one-byte read past the attribute boundary. It stems from off-by-one bounds checks that use strict greater-than instead of >=, so mapping-pair data extending exactly to attr_end passes validation and buf[b] reads one byte too far. No public exploit is identified at time of analysis, EPSS is low (0.20%), and it is not on CISA KEV; exploitation requires the kernel to parse an attacker-controlled NTFS volume.
Out-of-bounds kernel memory read in the legacy NTFS filesystem driver of the Linux kernel (affecting builds derived from commit 6ceb4cc8 up to the 7.1.x and 7.2-rc series) occurs when the driver parses a crafted NTFS image whose $FILE_NAME attribute declares a small resident value_length but an oversized file_name_length. Callers trust file_name_length and read past the resident attribute value during name conversion/comparison, producing a slab-out-of-bounds read confirmed under KASAN from the kmalloc-1k MFT record copy. There is no public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and despite the source-assigned 9.8 CVSS this is a local filesystem-parsing bug rather than a remote-unauthenticated flaw.
Out-of-bounds read in the Linux kernel's NTFS driver allows a local attacker to leak adjacent kernel memory or crash the system by parsing extended attribute (EA) entries on a crafted NTFS volume. The ntfs_ea_lookup and ntfs_listxattr routines dereferenced the next_entry_offset field of an EA entry without first verifying that enough space remained in the buffer. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is tagged as Information Disclosure rather than code execution.
On-disk NTFS metadata corruption in the Linux kernel's NTFS3 driver arises because ntfs_resident_attr_resize() may select zero-length resident $DATA attributes when converting attributes to non-resident to free MFT record space, producing 0-byte non-resident $DATA that fsck flags as filesystem corruption. The flaw affects Linux systems writing to NTFS volumes and is a data-integrity/consistency defect rather than a memory-safety or remote-code issue; it is fixed in stable 7.1.5 and 7.2-rc1. There is no public exploit identified at time of analysis, EPSS probability is low (0.20%, 10th percentile), and it is not listed in CISA KEV. The published CVSS of 9.8 (network vector) is not consistent with a local filesystem write path and appears to be an automated over-assessment.
Out-of-bounds access in the Linux kernel's legacy NTFS filesystem driver arises from insufficient validation of INDEX_HEADER geometry within INDX directory-index blocks; a crafted NTFS volume can drive ntfs_lookup_inode_by_name() to read past block boundaries. The fix hardens ntfs_index_block_inconsisent() to strictly validate index-block header fields before use, affecting systems that mount attacker-controlled NTFS media. There is no public exploit identified at time of analysis, KEV does not list it, and EPSS is low (0.20%, 10th percentile), consistent with a filesystem-parsing bug that requires a malicious volume rather than remote reach.
Inconsistent $INDEX_ROOT attribute header validation in the Linux kernel's legacy ntfs filesystem driver exposes systems to potential kernel-level memory corruption when processing maliciously crafted NTFS volumes. Kernel versions from the initial NTFS implementation through 7.1.4 stable are affected across both directory inode and named index inode read paths, with fix releases confirmed at 7.1.5 stable and 7.2-rc1 mainline. No public exploit has been identified at time of analysis, and EPSS exploitation probability is 0.20% (10th percentile), though the CVSS 8.4 High score reflects the theoretical severity of kernel-space memory corruption if the vulnerability is successfully reached.
Deadlock in the Linux kernel NTFS driver allows local users with write access to an NTFS-mounted volume to render the system completely unresponsive by triggering an ABBA lock ordering race between concurrent VFS writeback paths. The vulnerability affects kernels since commit 6994acf33bae and manifests when inode writeback (acquiring extent_lock then mrec_lock) races with MFT folio writeback (holding mrec_lock while attempting extent_lock). No active exploitation has been confirmed - EPSS places this at the 10th percentile (0.20%) - reflecting the narrow real-world surface: production Linux systems rarely mount NTFS volumes. Patches are available in Linux 7.1.5 and 7.2-rc1.
Indefinite thread blocking in the Linux kernel's NTFS driver can cause a local denial of service on systems mounting NTFS volumes under memory pressure. Specifically, `get_nr_free_clusters()` and `__get_nr_free_mft_records()` allocate heap memory for a readahead state structure; if that allocation fails, neither `NVolFreeClusterKnown()` is set nor `vol->free_waitq` is woken, leaving any waiting kernel thread blocked indefinitely. Kernels prior to 7.1.5 and 7.2-rc1 are affected; no public exploit has been identified and EPSS is 0.20% (10th percentile).
Improper validation of NTFS index entries in the Linux kernel's NTFS filesystem driver allows a crafted or corrupted NTFS volume to be processed without adequate bounds checking during index root and index block reads. When an attacker-controlled NTFS image is mounted and traversed (lookup/readdir), missing per-read validation can lead to out-of-bounds memory access, enabling information disclosure or a kernel crash. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is not on the CISA KEV list.
Signed-integer overflow in the Linux kernel NTFS driver's mapping-pairs runlist parser lets a crafted or corrupted NTFS volume redirect logical-to-physical cluster mappings to unintended disk locations. The flaw affects the kernel's NTFS attribute parsing when it accumulates relative LCN deltas; a malicious runlist can set the accumulator to S64_MAX and add 1, triggering undefined behavior that resolves runs to a different set of physical clusters. Fixed upstream in Linux 7.1.5 and 7.2-rc1; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.20%).
Out-of-bounds memory access in the Linux kernel NTFS driver arises because resident $INDEX_ROOT attribute headers are consumed after lookup without fully validating their layout invariants. Affected are Linux kernels prior to the 7.1.5 and 7.2-rc1 stable fixes when mounting or accessing an attacker-crafted NTFS volume; unchecked entries_offset, index_length, and allocated_size fields let a malformed filesystem drive reads beyond the resident value, tagged upstream as Information Disclosure. This is not actively exploited (no CISA KEV entry) and EPSS is low at 0.20%, with no public exploit identified at time of analysis, though upstream stable commits are available.
The legacy NTFS driver in the Linux kernel fails to reject non-resident attribute records for attribute types contractually required to be resident, creating resident/non-resident union confusion paths in multiple critical code locations. Affected callers - including inode loading ($STANDARD_INFORMATION), volume flag updates ($VOLUME_INFORMATION), and directory traversal ($INDEX_ROOT) - read data.resident.value_offset directly without first verifying the a->non_resident flag, potentially acting on the wrong union member when a crafted or corrupted NTFS image is mounted. A local attacker with standard user privileges can exploit this to trigger kernel memory corruption or information disclosure; no active exploitation is confirmed (EPSS 0.20%, not in CISA KEV), and patches are available in Linux 7.1.5 and 7.2-rc1.
Linux kernel's ntfs3 filesystem driver crashes and may corrupt memory when processing a crafted NTFS image due to an unbounded memmove in the DeleteIndexEntryAllocation code path. Any local user able to mount a malformed NTFS volume can trigger a kernel oops through a negative ptrdiff_t silently cast to a near-maximal size_t, causing memmove to walk far past the destination buffer. No public exploit and no CISA KEV listing exist at time of analysis; EPSS is low at 0.21%, but the memory corruption primitive and local-to-kernel boundary crossing make this a meaningful privilege escalation and availability risk on systems where unprivileged NTFS mounts are possible.
Slab-out-of-bounds write in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3) is triggered during the log_replay() analysis pass when mounting a malformed NTFS3 volume. The copy_lcns loop lacks bounds enforcement against dp->lcns_follow, so a crafted LRH entry with target_vcn set to dp->vcn + dp->lcns_follow - 1 and lcns_follow greater than 1 overflows the heap-allocated page_lcns[] array, corrupting kernel memory. Confirmed by KASAN on mainline kernel 8d90b09e6741 with a slab-out-of-bounds write of size 8 at log_replay+0x68d4; no public exploit exists and EPSS stands at 0.21%, though the CVSS score of 8.4 reflects the full confidentiality, integrity, and availability impact of kernel heap corruption.
Integer underflow in the ntfs3 filesystem driver's journal replay logic (`fs/ntfs3/fslog.c`) allows a local attacker with low privileges to corrupt the resident attribute data size to approximately 4 GiB, enabling out-of-bounds kernel memory reads up to 4 GiB beyond a 1024-byte MFT record allocation. Exploitation requires mounting or processing a crafted NTFS image with specially crafted Log Record Header values - on distributions with unprivileged user namespaces enabled (Ubuntu, Fedora, and others), this is achievable without elevated privileges. No public exploit code has been identified and the vulnerability is not in CISA KEV; EPSS stands at 0.21% (12th percentile), and patches are confirmed available across multiple stable kernel branches.
Denial-of-service in the Linux kernel ntfs3 driver lets an attacker with the ability to mount a crafted NTFS image panic the system via unbounded recursion. indx_find_buffer() descends the NTFS B+ tree index with no depth limit, so a circular index-node reference overflows the kernel stack when a file deletion hits the index rebalancing fallback path. No public exploit is identified and it is not in CISA KEV; EPSS is low at 0.23%. Note that the supplied CVSS 9.8/AV:N vector is inconsistent with the description, which requires local access to attach a malicious filesystem.
Heap out-of-bounds write in the Linux kernel's ntfs3 filesystem driver lets a local user corrupt kernel slab memory by mounting and accessing a crafted NTFS image. When indx_insert_into_root() promotes a full resident $INDEX_ROOT into $INDEX_ALLOCATION, hdr_insert_head() copies resident entry bytes ('to_move') sized from on-disk data into a destination buffer sized from an attacker-shrunk root->index_block_size, writing 120-136 bytes of attacker-controlled data past a kmalloc allocation. The flaw is fixed across multiple stable trees; there is no public exploit identified at time of analysis and EPSS is low (0.21%), and despite the NVD CVSS of 9.8 the described trigger is local rather than network-reachable.
Improper validation of on-disk metadata in the Linux kernel's legacy NTFS driver allows a crafted NTFS filesystem image to smuggle an error-marked MFT (Master File Table) reference back through ntfs_lookup_inode_by_name(), causing directory-lookup callers to misinterpret corrupted disk data as a legitimate pseudo-errno. This affects systems that mount attacker-supplied NTFS volumes; there is no public exploit identified at time of analysis and the EPSS probability is low (0.20%). The upstream fix normalizes any error-marked reference to ERR_MREF(-EIO) so callers can no longer be tricked into consuming a bogus value.
Local volume corruption and a writeback deadlock affect the Linux kernel NTFS driver (fixed in 7.1.5 and 7.2-rc3) when a filesystem is mounted with the non-default show_sys_files option and userspace writes to an exposed base metadata file such as $Bitmap; because the cluster allocator scans $Bitmap through the same inode page cache, the write both corrupts the volume and deadlocks writeback against an already-locked folio. Only affected when the opt-in show_sys_files mount option is set, so this is a local integrity/availability issue rather than a remote one. There is no public exploit identified at time of analysis, EPSS is 0.20% (10th percentile), and it is not in CISA KEV.
Memory-safety flaw in the Linux kernel's legacy NTFS (read) driver lets a crafted NTFS filesystem image bypass a resident/non-resident attribute check in ntfs_map_runlist_nolock(). When the driver expects a non-resident attribute during mount, an attacker-supplied image can substitute a resident attribute; the code previously only flagged this with a non-fatal WARN_ON() and then read a->data.non_resident.highest_vcn from the wrong union member, corrupting the VCN range check. The fix replaces WARN_ON() with an -EIO return so the malicious image is rejected at mount. There is no public exploit identified at time of analysis, and EPSS is low (0.22%).
Landlock SCOPE_SIGNAL enforcement in the Linux kernel can be bypassed by a sandboxed process via the asynchronous SIGIO delivery path, allowing it to send arbitrary signals - including SIGKILL - to processes outside its Landlock domain such as supervisors or security monitors. The flaw exists because hook_file_send_sigiotask() evaluates the Landlock domain recorded at F_SETOWN time rather than the live sender domain, and control_current_fowner() incorrectly skips domain recording when a single member of the target process group (PIDTYPE_PGID) shares the caller's thread group, leaving the remaining group members unchecked at delivery. No public exploit code exists and EPSS is 0.22% (13th percentile), but the impact is significant for environments relying on Landlock as a containment boundary.
Memory corruption in the Linux kernel's MIPS scheduler corrupts kernel pointer state when CONFIG_CPUMASK_OFFSTACK is enabled, enabling local privilege escalation to root. Two compounding flaws exist: sizeof(new_mask) resolves to the pointer width (4-8 bytes on MIPS) rather than the actual cpumask buffer size, causing copy_from_user() to overwrite the mask pointer with user-controlled bytes; and the original code invoked copy_from_user() prior to allocating the mask buffer, creating a write-before-allocation primitive. CVSS 7.8 with AV:L/AC:L/PR:L/UI:N reflects straightforward local exploitation on affected MIPS systems, though EPSS at 0.21% (12th percentile), no CISA KEV listing, and no public exploit code indicate limited real-world exploitation activity at time of analysis.