Red Hat
Monthly
Kernel memory corruption in the Linux kernel's MTD slram driver stems from a link-before-initialize race in `register_device()`, where new `slram_mtdlist` entries are inserted into the global device list before all required state (memory allocation, `memremap()`, and `mtd_device_register()`) is fully committed. When any of these subsequent operations fail, the partially initialized entry persists on the list, and later cleanup code dereferences or frees invalid kernel memory - enabling potential local privilege escalation from low-privileged access to full kernel compromise. EPSS is 0.22% (13th percentile), no CISA KEV listing exists, and no public exploit has been identified at time of analysis, collectively indicating low near-term exploitation likelihood despite the high CVSS score of 7.8.
Out-of-bounds memory access in the Linux kernel MTD raw NAND subsystem allows a local low-privilege user to corrupt or read kernel memory via an improper bounds check in `nand_select_target()`, where the chip-select index `cs` is not validated against `nanddev_ntargets()`. Affected systems span Linux 5.2 through current stable branches across multiple LTS lines; patched releases are available. No public exploit code exists and the vulnerability is not listed in CISA KEV, with EPSS at 0.22% (13th percentile), indicating low real-world exploitation probability despite the high CVSS score of 7.8.
The OCFS2 extent-move ioctl (OCFS2_IOC_MOVE_EXT) in the Linux kernel permits a local user with write access to an OCFS2-mounted filesystem to trigger cross-inode data corruption and information disclosure by supplying a crafted physical goal cluster that an uninitialized probe output allows to survive a failed scan. Affected kernel versions span from approximately Linux 3.0 (commit e6b5859cccfa0fec) through all stable branches prior to the fix releases in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit has been identified at time of analysis, and EPSS probability is 0.22% (13th percentile), consistent with a subsystem-specific kernel bug requiring deliberate targeting.
Unbounded array indexing in the ocfs2 filesystem's ocfs2_sum_rightmost_rec() function causes UBSAN-detected kernel panic or memory corruption when a file write targets an inode whose embedded extent list has been corrupted on-disk. Linux kernels prior to 6.18.40 (stable 6.x branch) and 7.1.5 (7.x branch) are affected on any system mounting an ocfs2 volume. No public exploit has been identified at time of analysis and EPSS probability sits at 0.21% (11th percentile), reflecting realistically constrained exploitability due to the required on-disk corruption precondition.
OCFS2 cluster filesystem dinode validation in the Linux kernel fails to reject inodes with non-canonical i_mode type bits, allowing forged on-disk metadata to propagate into in-core kernel inode structures. Affected kernels accept any non-zero i_mode value and pass it verbatim into ocfs2_populate_inode(), where an unrecognized S_IFMT type falls through to ocfs2_special_file_iops and init_special_inode() - a code path not designed for arbitrary mode inputs. No public exploit has been identified at time of analysis and EPSS sits at only 0.22%, but the kernel-level impact (C:H/I:H/A:H) and the shared-storage attack surface of OCFS2 clusters warrant priority patching on affected systems.
Cache coherency corruption in the Linux kernel's OpenRISC architecture jump_label implementation leaves instruction cache lines on remote SMP cores stale after static key updates, meaning security-relevant kernel branches may execute the wrong code path indefinitely on affected multi-core OpenRISC systems. The flaw originates in commit 8c30b0018f9d, which ported jump_label support from arm64 without adapting icache invalidation to OpenRISC's SMP model - `kick_all_cpus_sync()` does not guarantee a full remote icache flush on this architecture. No public exploit has been identified at time of analysis, and the 0.21% EPSS score (11th percentile) reflects the severe rarity of OpenRISC SMP hardware in production.
Use-after-free in the Linux kernel TPM subsystem's tpm_buf_append_salt() function triggers automatic kernel memory corruption on systems equipped with asynchronous KPP cryptographic hardware backends. The defect fires continuously and without any userland action - the hwrng_fillfn kernel thread invokes the vulnerable code path on every entropy poll via tpm2_get_random → tpm2_start_auth_session → tpm_buf_append_salt, causing a deferred completion worker to dereference a freed kpp_request when the async backend returns -EINPROGRESS. No public exploit has been identified at time of analysis and EPSS is 0.20% (10th percentile), but the kernel-space use-after-free carries inherent privilege escalation and denial-of-service risk on affected hardware configurations.
Tegra GPC DMA driver in the Linux kernel hangs when a client submits a transfer whose length is not evenly divisible by the channel's configured maximum burst size, resulting in a partial-burst stall that freezes the DMA channel indefinitely. The defect is confirmed in production via the PL011 UART TX DMA path on NVIDIA Tegra SoC hardware and affects kernel branches from the introducing commit ee17028009d4 through fixed stable releases spanning 6.1, 6.6, 6.12, 6.18, and 7.1 series. No public exploit code exists and no active exploitation is confirmed; EPSS of 0.21% (12th percentile) reflects the extremely low real-world exploitation probability, consistent with a hardware-specific driver defect rather than a broadly exploitable software flaw.
Initialization ordering flaw in the Linux kernel's Renesas RZ DMAC driver (rz-dmac) creates a race window during driver probe where a DMA interrupt fires before channel->ch_base is assigned and before the ld_free, ld_queue, and ld_active linked-list structures are initialized, leading to invalid kernel memory access, potential kernel crashes, or memory corruption on Renesas RZ SoC-based platforms. Affected systems run Linux 5.15 through the pre-patch stable releases; fixes are available across multiple upstream stable branches (6.6.148, 6.12.101, 7.1.5, 7.2-rc1). No public exploit exists, EPSS is 0.21% (11th percentile), and this CVE is not listed in the CISA KEV catalog.
Incomplete error-path cleanup in the Linux kernel's dell-laptop platform driver exposes systems running Dell hardware to resource leak conditions that can be leveraged for privilege escalation by local low-privileged users. The dell_init() function fails to release the notifier, debugfs directory, keyboard backlight LED, and optional touchpad LED when a later initialization step fails, leaving dangling kernel object registrations. No active exploitation is confirmed (not in CISA KEV), and the EPSS score is very low at 0.20% (10th percentile), but the CVSS 3.1 score of 7.8 High with local-access C:H/I:H/A:H reflects the theoretical privilege escalation ceiling if the dangling resources are abused post-init.
Incorrect pointer usage in the Intel Speed Select Technology (ISST) platform driver causes SST-PP control registers to be restored only for power domain 0 during system resume from suspend, leaving all non-zero power domains with corrupted performance profile settings. Systems running affected Linux kernel versions (6.18.16-6.18.39, 6.19.x, 7.0) on Intel Xeon hardware with multi-domain ISST configurations will silently misconfigure CPU performance profiles after any suspend/resume cycle, leading to integrity and availability impact. EPSS is at 0.21% (11th percentile) and no active exploitation has been identified; a vendor patch is available across multiple stable branches.
Permanent I2C bus lockup in the Linux kernel i2c-imx driver (NXP i.MX SoCs) occurs when an SMBus block-read response returns a byte count of 0, a condition explicitly permitted by SMBus 3.1 specification section 6.5.7. The interrupt-driven state machine introduced in the v6.13 rework rejects count=0 with -EPROTO but critically fails to issue NACK+STOP before returning, leaving the target device holding SDA and the entire I2C bus permanently stuck until the controller is power-cycled. A secondary bug on the count > I2C_SMBUS_BLOCK_MAX error path exhibits the same failure mode. No public exploit or active exploitation is identified; vendor-released patches are available in kernel versions 6.18.40, 7.1.5, and 7.2-rc4.
Use-after-free in the Linux kernel's IPv4 TCP stack (net/ipv4/tcp_output.c) occurs when tcp_connect() reconciles conflicting TCP-MD5 and TCP-AO authentication keys on a socket that is already in TCP_SYN_SENT and hashed into the inet ehash. In the needs_ao branch, tcp_clear_md5_list() frees each tcp_md5sig_key and the md5sig_info container with bare kfree() before the RCU grace period, while softirq RX-path readers (__tcp_md5_do_lookup / __tcp_md5_do_lookup_exact) are still walking the same list under RCU, producing a per-key slab use-after-free. It affects kernels on the 6.18 line (and the described stable range) and is fixed by deferring frees with kfree_rcu; no public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile).
Kernel memory corruption (double free) in the Linux kernel's XFRM/IPsec NAT keepalive path allows a crash or potential heap exploitation when a keepalive transmission fails after the socket buffer has already been handed to the IPv4/IPv6 output stack. Introduced with the nat_keepalive feature in Linux 6.11 and affecting recent stable branches, nat_keepalive_send() incorrectly frees an skb that ip_build_and_send_pkt() or ip6_xmit() may already have consumed, producing a double free. EPSS is low (0.21%, 11th percentile), no public exploit has been identified, and it is not listed in CISA KEV; despite the auto-assigned 9.8 CVSS, realistic impact centers on denial of service and requires an IPsec NAT-traversal configuration.
Insufficient capability verification in the Linux kernel's xfrm interface changelink path allows a process holding CAP_NET_ADMIN in a device's network namespace to rewrite xfrm (IPsec transform) interface parameters belonging to a separate, distinct link namespace where it lacks authorization. Affected kernel versions span all stable branches from the introduction of xfrm_interface (commit f203b76d) through the fix commits, with patched releases confirmed at 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. No public exploit code or active exploitation has been identified; EPSS is 0.22% at the 13th percentile, reflecting low current attacker interest despite a High CVSS score driven by the cross-namespace scope change.
Out-of-bounds heap read and write in the Linux kernel TPM character device driver exposes kernel heap memory to local low-privileged users with access to /dev/tpm0 or /dev/tpmrm0. The TPM char device open handlers fail to call nonseekable_open(), leaving FMODE_PREAD and FMODE_PWRITE enabled on a device that only supports sequential command/response I/O; a pread() call with a large offset (e.g., 0x1400) passes that offset unchecked into tpm_common_read(), causing an out-of-bounds heap read via copy_to_user() and a subsequent out-of-bounds zero-write via memset(). No public exploit is identified at time of analysis, EPSS sits at 0.22% (13th percentile), and patches are available across all active Linux stable branches.
Data corruption in the Linux kernel's spi-imx driver causes SPI bus transfers to produce malformed data when DMA initialization fails and the driver incorrectly falls back to PIO mode without resetting the ECSPI hardware configuration. Systems running NXP i.MX SoCs with ECSPI DMA declared in the device tree but without the sdma-imx7d.bin SDMA firmware are deterministically and silently affected on every transfer. Downstream security-critical devices connected to the affected SPI bus - such as the Infineon SLB9670 TPM - receive corrupted responses that can prevent device initialization entirely, eliminating TPM-based security services; no public exploit has been identified at time of analysis.
Undefined behavior in the Linux kernel's spi-uniphier SPI controller driver arises from a driver probe initialization ordering defect: devm_request_irq() is called before init_completion(), leaving a race window in which an early interrupt can invoke complete() on an uninitialized kernel completion object. Systems running Socionext UniPhier SoC hardware on affected kernel versions are exposed during driver probe. No public exploit has been identified and EPSS sits at 0.22% (13th percentile), consistent with the hardware-specific nature of the flaw - practical exploitation is constrained to platforms physically equipped with UniPhier SoCs.
Heap out-of-bounds write in the Linux kernel NVMe-oF target (nvmet) DH-HMAC-CHAP authentication handler lets a remote NVMe-oF initiator corrupt kernel heap memory when in-band authentication is enabled. nvmet_execute_auth_receive() trusts the host-supplied AUTH_RECEIVE allocation length after only checking it is nonzero, so the SUCCESS1 and FAILURE1 response builders write a fixed-size DH-HMAC-CHAP message into an undersized kmalloc() buffer, producing a 16-byte OOB write from a one-byte allocation length. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.25%, 17th percentile).
Out-of-bounds read in the Linux kernel NVMe-over-Fabrics RDMA target (nvmet-rdma) allows a connected fabric host to make the target map inline data at an attacker-chosen offset, corrupting the per-command scatterlist. When a port is configured with inline_data_size greater than PAGE_SIZE, an offset in the (PAGE_SIZE, inline_data_size] range causes the 'PAGE_SIZE - off' calculation to underflow and sets sg->length to roughly 4 GiB, so the block backend reads far past the first inline page, leaking adjacent kernel memory and risking a crash. No public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile), but the flaw is patched across all maintained stable branches.
Use-after-free in the Linux kernel CAN isotp (ISO 15765-2 Transport Protocol) socket subsystem enables a local low-privileged attacker to corrupt freed kernel memory, potentially escalating privileges to root. The race arises because isotp_notify() clears so->bound via can_rx_unregister() without a subsequent RCU grace period, causing isotp_release() to skip synchronize_rcu() and cancel so->rxtimer while an in-flight isotp_rcv() callback is still executing and about to re-arm it via isotp_send_fc(). Multiple Linux stable branches from 5.10 through pre-7.2-rc4 are affected; vendor-released patches are confirmed across eight stable-tree commits. No public exploit identified at time of analysis; EPSS is 0.22% at the 13th percentile.
Use-after-free race condition in the Linux kernel CAN ISO-TP (isotp) subsystem enables a local user to corrupt kernel memory by racing isotp_release() against concurrent network device unregistration, with CVSS 7.8 reflecting full confidentiality, integrity, and availability impact on the vulnerable system. Affected kernels span the stable 5.10 tree through at least 6.18.x and 7.1.x; patched versions 6.6.148, 6.12.101, 6.18.40, 7.1.5, and 7.2-rc4 are available. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS exploitation probability is low at 0.21% (11th percentile), consistent with the narrow race window and specialized hardware prerequisites.
Race condition in the Linux kernel's CAN ISO-TP (isotp) socket subsystem allows adjacent-network attackers to corrupt TX state machine transitions, enabling kernel memory corruption with high confidentiality, integrity, and availability impact. Multiple stable branches from 5.10 onward are affected, with fixes released in kernel versions 6.6.148, 6.12.101, 6.18.40, 7.1.5, and 7.2-rc4. No public exploit code or CISA KEV entry has been identified at time of analysis, and the EPSS probability of exploitation within 30 days is 0.21% (11th percentile), consistent with the narrow, specialized conditions required.
Use-after-free in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges. The flaw arises from a race between concurrent RCU readers re-arming a throttle timer and RCU-deferred deallocation of the BCM operation structure, introduced by commit f1b4e32aca08's replacement of synchronize_rcu() with call_rcu(). No active exploitation has been confirmed (not in CISA KEV) and EPSS is 0.21% (12th percentile), reflecting limited real-world risk outside CAN-enabled environments.
Lockless race condition in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows local low-privileged users to trigger torn reads of socket binding state, silently redirecting CAN traffic to unintended interfaces or leaving broken RX filter operations registered as successful. The vulnerability affects all kernel branches from Linux 2.6.25 through unpatched stable releases across the 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, and 7.1.x series. No public exploit code or CISA KEV listing exists at time of analysis; EPSS probability is 0.22% (13th percentile), consistent with the local-only attack surface and specialized CAN subsystem prerequisite.
Race conditions in the Linux kernel CAN Broadcast Manager (BCM) subsystem allow adjacent attackers on the CAN bus to corrupt kernel timer and filter state in bcm_rx_setup() by racing concurrent frame-reception handlers, with theoretical impact spanning kernel memory disclosure, corruption, and denial of service. KCSAN-detected simultaneous accesses affect all Linux kernel stable branches from 5.4 through 6.15, spanning automotive, industrial, and embedded deployments that rely on CAN BCM sockets. No public exploit has been identified and EPSS sits at 0.21% (11th percentile), indicating very low near-term exploitation probability despite the 8.8 CVSS score; vendor-released patches are available across multiple stable branches.
Missing RCU (Read-Copy-Update) list synchronization primitives in the Linux kernel's CAN BCM (Broadcast Manager) subsystem expose local low-privilege users to a race-condition memory hazard affecting all kernel stable branches from 5.4 through 6.15. Two distinct defects compound the risk: bcm_[rx|tx]_setup() uses plain list_add() instead of list_add_rcu(), allowing bcm_proc_show() to observe partially initialized bcm_op structures under rcu_read_lock(); and bcm_release() invokes bcm_remove_op() - which schedules memory reclamation via call_rcu() - without first calling list_del_rcu(), creating a use-after-free window while the op remains traversable. No public exploit code has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) indicates low current exploitation probability despite the CVSS 7.8 High rating.
Race condition and missing lock coverage in the Linux kernel CAN Broadcast Manager (BCM) subsystem expose kernel frame data and 64-bit timer values to concurrent unsynchronized access. Low-privileged local users with access to AF_CAN BCM sockets can trigger reads of partially written frame content or torn 64-bit ktime_t values - the latter specifically affecting 32-bit kernel builds - with C:H/I:H/A:H impact per the CVSS vector. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) confirms low current exploitation activity, and the vulnerability is not listed in CISA KEV.
Stale state bugs in the Linux kernel CAN Broadcast Manager (BCM) subsystem allow a local low-privileged user to trigger a runaway hrtimer loop and silently suppress CAN frame delivery following network device removal events. Affected systems span Linux 2.6.25 through unpatched stable branches, with fixes released in 6.6.148, 6.12.101, 6.18.42, 7.1.5, and 7.2-rc4. An attacker with local CAN socket access can cause indefinite bcm_tx_timeout_handler() execution and potentially inject CAN frames into a subsequently reused interface index, yielding high integrity and availability impact with no public exploit identified at time of analysis.
Race condition in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows adjacent network attackers to corrupt CAN frame state and trigger spurious RX_TIMEOUT notifications. The flaw exists in ANYDEV rx operations (ifindex == 0) where concurrent frame delivery from multiple CAN interfaces races hrtimer_cancel(), bcm_rx_starttimer(), and bcm_rx_timeout_handler() on different CPUs, leading to last_frames corruption and clobbering of shared rx_ifindex/rx_stamp fields. No public exploit has been identified at time of analysis; EPSS is 0.21% (11th percentile), indicating very low current exploitation probability.
Missing frame length validation in the Linux kernel CAN Broadcast Manager (BCM) subsystem allows a local low-privileged user to trigger kernel memory corruption by supplying a malformed RTR-reply frame via RX_SETUP with the RX_RTR_FRAME flag. While bcm_tx_setup() correctly enforces DLC bounds on TX_SETUP frames, the equivalent check was absent in bcm_rx_setup(), creating an asymmetric validation gap reachable through the CAN socket interface. The CVSS 3.1 score is 7.8 HIGH with full C/I/A impact; no public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog, but patched stable releases are available across multiple kernel branches.
Use-after-free race condition in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows a local low-privileged attacker to trigger a stale filter pointer against freed memory, with potential full CIA impact on affected systems. The flaw exists from kernel 2.6.25 onward in net/can/bcm.c, where concurrent NETDEV_UNREGISTER events could silently bypass can_rx_unregister(), leaving dangling references to freed bcm_op and socket structures. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.21% (11th percentile), indicating very low real-world exploitation probability at this time.
Use-after-free of freed executable memory in the Linux kernel's io_uring/bpf-ops subsystem allows a local attacker with CAP_BPF and CAP_PERFMON capabilities to achieve arbitrary kernel code execution by registering the same io_uring_bpf_ops struct_ops map against multiple io_ring_ctx instances in sequence. The missing re-registration guard on ops->priv causes the first io_ring_ctx to be orphaned with a dangling ctx->loop_step function pointer into a freed BPF trampoline, which is invoked when io_uring_enter() is later called on that ring. No public exploit has been identified at time of analysis, and EPSS at 0.20% reflects low near-term mass-exploitation probability, though the primitive - controlled call into freed executable memory - is a classic kernel privilege escalation building block.
BPF verifier register bounds mismatch in the Linux kernel allows local users with BPF loading capability to bypass BPF memory safety checks via crafted programs targeting LSM hook context loads. The flaw in check_mem_access() causes stale register bounds from prior instructions to corrupt the verifier's abstract interpretation, producing a divergence between the verifier's belief and runtime state that can be exploited to escape the BPF sandbox. Patches are confirmed available in stable branches (6.12.103, 6.18.40, 7.1.5, 7.2-rc1); no public exploit or CISA KEV listing exists, and EPSS is low at 0.22% (13th percentile), indicating limited observed real-world exploitation.
Incomplete cleanup in the Linux kernel's sparx5 Ethernet switch driver leaves a switchdev blocking notifier registered when workqueue allocation fails during initialization, creating a dangling callback that subsequent kernel network events can invoke against uninitialized driver state - enabling potential kernel memory corruption or privilege escalation on affected hardware. Systems running kernels from 5.14 through the unpatched stable branches on Microchip Sparx5 switch ASICs are affected; patches have been backported to five stable kernel series. No public exploit code exists and EPSS probability is 0.21% (12th percentile), though kernel-level C:H/I:H/A:H impact warrants prompt patching on any affected networking appliance.
Metadata snapshot operations in the Linux kernel's device-mapper thin provisioning (dm-thin) subsystem write a partially-updated superblock field to disk when a metadata commit subsequently fails, corrupting the on-disk space map reference counts. Systems using dm-thin storage pools are affected across a wide range of stable kernel branches from 3.2 onward through patched versions. A local attacker with access to dm-thin pool management can deliberately trigger the failure path - for example by constraining the metadata device - causing persistent metadata inconsistency that survives reboots and results in data loss or pool unavailability. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis.
Out-of-bounds memory access in the Linux kernel dm-era (device mapper era) subsystem allows a local privileged attacker to trigger a vmalloc out-of-bounds read by configuring a dm-era table with a non-zero start sector. The era_map() function fails to apply the target offset before calculating the writeset block, passing an absolute block number to writeset_marked() that may exceed the allocated bitset size. No public exploit exists and EPSS probability is 0.22%, but patches are backported across all major stable kernel branches. The provided CVSS score of 8.8 (AV:N/PR:L) materially overstates real-world risk for a flaw requiring CAP_SYS_ADMIN and a specifically misconfigured dm-era table.
Integer wraparound in the Linux kernel's dm-log subsystem on 32-bit architectures allows a local attacker to trigger a bitset_size overflow, potentially causing kernel memory corruption. Specifically, when region_size is close to UINT_MAX and bitset_size is rounded up to a multiple of BITS_PER_LONG, a 32-bit size_t wraps around to zero, leading to an incorrect zero-byte bitmap allocation and subsequent out-of-bounds write conditions. No public exploit is identified at time of analysis, and EPSS probability is low (0.22%, percentile 13%), but the CVSS 7.8 local score reflects the potential for full system compromise once the specific conditions are met.
The Linux kernel dm (device-mapper) subsystem, from version 6.9 onward, leaks the calling process's thread keyring by retaining a reference to the table device file beyond the caller's lifetime, causing LUKS volume keys to silently persist in RAM after `cryptsetup luksSuspend`. This regression, introduced by commit a28d893eb327, breaks a documented security guarantee: `luksSuspend` is expected to wipe the volume key from memory, but an unpatched kernel leaves a second copy in the retained thread keyring recoverable until `luksClose`. Any adversary capable of reading kernel memory - via physical access, cold boot attack, or a separate memory disclosure exploit - can extract the LUKS volume key and decrypt the protected volume. No public exploit is identified, and EPSS of 0.21% (11th percentile) reflects limited automated exploitation probability.
Double-free memory corruption in the Linux kernel's device mapper subsystem allows a local attacker to trigger kernel memory corruption by causing dm_resume failure during early device creation, potentially leading to privilege escalation or system crash. Affected systems run kernel versions from approximately Linux 5.1 through multiple stable branches prior to the respective patch commits; fixes are available across all major stable series from 5.10 through 7.2-rc3. No public exploit code exists and EPSS exploitation probability is extremely low at 0.22% (13th percentile), though the high CVSS impact metrics (C:H/I:H/A:H) reflect the potential severity if the error path is successfully triggered and weaponized.
Deadlock in the Linux kernel's dm-integrity device mapper module allows a local attacker or process with block-device access to permanently freeze I/O on an integrity-protected block device. When dm_integrity_check_limits detects an out-of-bounds bio and returns failure, it exits with DM_MAPIO_KILL while leaving an internal range lock held, so all subsequent I/O operations block indefinitely waiting for a lock that will never be released. No public exploit identified at time of analysis; EPSS is 0.21% at the 11th percentile, consistent with a locally-triggered kernel availability flaw requiring a non-default configuration.
Integrity bypass in the Linux kernel dm-integrity device mapper subsystem allows low-privileged users to undermine block-level data integrity guarantees through a double-increment logic error in hash_offset tracking. The introduced commit 84597a44a9d86ac949900441cea7da0af0f2f473 (present since Linux 5.7) causes the hash_offset variable to advance by two positions per iteration instead of one, meaning integrity hashes are verified against incorrect offsets - allowing corrupted data to pass or valid data to fail integrity checks. No public exploit identified at time of analysis, and EPSS at 0.21% (11th percentile) reflects low near-term exploitation probability.
An out-of-bounds kernel write in the Linux kernel's dm-verity Forward Error Correction (FEC) code allows corruption of adjacent kernel memory when Reed-Solomon erasure recovery is triggered. An off-by-one in the erasure-counting logic lets the erasure count reach roots+1, which is then passed to decode_rs8() and overruns the lambda[] locator polynomial by one element, clobbering the syndrome buffer (syn[0]). It affects Linux systems using dm-verity with FEC enabled; there is no CISA KEV listing, no public exploit identified, and EPSS is low (0.22%, 13th percentile), indicating this is a memory-safety defect rather than an actively exploited threat.
Uninitialized memory dereference in the Linux kernel's dma-fence subsystem allows a local low-privileged user on AMD GPU-equipped systems to trigger memory corruption via the amdgpu userqueue wait path. The root cause is an off-by-one logic error in `dma_fence_dedup_array()` that returns 1 instead of 0 for empty input, which the primary caller guards against but `amdgpu_userq_wait_*()` does not, exposing an uninitialized fence slot to dereference. Patch commits are available for stable branches 6.18.40 and 7.1.5; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), indicating low real-world exploitation activity.
Use-after-free in the Linux kernel's amdxdna DMA buffer memory mapping function exposes systems with AMD XDna AI accelerator hardware to local privilege escalation. When vm_insert_pages() fails inside amdxdna_gem_dmabuf_mmap(), the error path triggers drm_gem_object_put() twice on the same GEM object - once through the VMA close handler and again through the fall-through put_obj label - freeing the object and then accessing freed memory. EPSS sits at 0.21% (11th percentile) and the vulnerability is not listed in CISA KEV, indicating no known active exploitation; however, the CVSS 7.8 high score reflects the full C/H/I:H/A:H kernel memory corruption potential if successfully triggered locally.
Client pointer confusion in the Linux kernel's amdxdna DRM accelerator driver allows a local low-privileged user to trigger cross-process access to another process's hardware context and debug buffer objects via a misrouted SYNC_DIRECT_FROM_DEVICE ioctl. Systems running AMD XDNA NPU hardware (such as AMD Ryzen AI series processors) with the amdxdna kernel module loaded are affected across kernel versions from the driver's introduction up to the patched releases in 7.1.5 and 7.2-rc1. No public exploit exists and the EPSS score of 0.20% (10th percentile) reflects low near-term exploitation probability, though the CVSS 7.8 score correctly captures the high CIA impact should exploitation succeed.
Integer underflow in the Linux kernel's Intel VPU accelerator driver (accel/ivpu) allows a local low-privileged attacker to trigger out-of-bounds kernel memory reads and infinite loops via a malformed firmware log buffer. The vulnerability exists because fw_log_from_bo() never validates that log->size is at least log->header_size before fw_log_print_buffer() computes data_size = log->size - log->header_size - a u32 subtraction that wraps to near-U32_MAX, defeating the bounds checks from commit dd1311bcf0e6 and enabling fw_log_print_lines() to read far past the allocated BO region. No active exploitation is confirmed (not in CISA KEV), and EPSS is 0.21% (11th percentile), indicating low near-term exploitation likelihood despite the 7.1 CVSS score.
Denial of service in the Linux kernel's Xen paravirtualized SCSI backend (xen-scsiback) lets a malicious pvSCSI guest exhaust every command tag of a target LUN's session by driving the pre-submission error paths, which call transport_generic_free_cmd() on an se_cmd whose cmd_kref is still 0. The resulting refcount underflow is a use-after-free that leaks the tag and stops the LUN; on hosts booted with panic_on_warn it crashes the host outright. There is no public exploit identified at time of analysis and EPSS is low (0.21%), but the fix is shipped across multiple stable kernel trees.
Use-after-free in the Linux kernel's LIO SCSI target core (iSCSI transport) lets an initiator that can issue a PERSISTENT RESERVE OUT / REGISTER AND MOVE command trigger reads of an unmapped kernel virtual address, risking information disclosure or a kernel crash. The flaw exists only in the target-mode stack (drivers/target) and only manifests when the PR OUT parameter list exceeds one page (>4096 bytes), forcing transport_kmap_data_sg() down its vmap()/vunmap() path. EPSS is low (0.22%, 13th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
Use-after-free in the Linux kernel's resctrl filesystem subsystem allows a local low-privileged user to dereference freed kernel memory during a race between a concurrent monitoring file reader and resctrl unmount or fatal teardown. The vulnerable code path affects multiple stable kernel series, with fixes confirmed in 6.18.42, 7.1.5, and 7.2-rc3. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% reflects low current exploitation probability, though kernel use-after-free primitives are commonly developed into local privilege escalation exploits.
Use-after-free and initialization-order race conditions in the Linux kernel's mlx5e MACsec hardware offload driver allow a local low-privileged user to corrupt kernel memory during RX Security Channel deletion. The delete path in macsec_del_rxsc_ctx() called metadata_dst_free() unconditionally, bypassing reference counting, while concurrent RX datapath readers operating under rcu_read_lock() could still hold and dereference the freed dst object. A secondary race in the add path published the SC's xarray entry before md_dst was fully initialized, allowing readers to observe NULL or partially-constructed pointers. Patches are available across multiple stable branches (6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2-rc2); no public exploit has been identified at time of analysis.
Use-after-free race condition in the Linux kernel's tracing/user_events subsystem allows a low-privileged local user to corrupt kernel heap memory during fork(), potentially enabling privilege escalation to root. The race is triggered when a multithreaded process concurrently unregisters a user event enabler while calling fork(), causing user_event_mm_dup() to dereference enabler and user_event structures freed without observing the required RCU grace period. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, the low privilege bar and full C/I/A impact make it a meaningful escalation primitive on any multi-user or shared Linux system running an unpatched kernel with CONFIG_USER_EVENTS enabled.
Error-masking in the Linux kernel CPU hotplug subsystem allows a failed CPU state transition to silently appear successful to callers, spanning stable branches from 4.14 through 7.1.x. The root cause is that cpuhp_invoke_callback() reuses the ret variable in its rollback path: when one instance callback fails and the subsequent rollback succeeds, the rollback's zero return overwrites the original non-zero error, hiding the failure from higher-level consumers. No active exploitation is confirmed - EPSS sits at 0.22% (13th percentile) and there is no CISA KEV listing - but patches are available across all affected stable branches.
Unbounded sprintf() calls in the Linux kernel's CPU hotplug sysfs interface (states_show()) can overflow the PAGE_SIZE kernel buffer when a sufficient number of hotplug states are registered, enabling a local low-privileged user to corrupt adjacent kernel memory with potential high impact on confidentiality, integrity, and availability. Affected kernel versions span from the 4.6 era through multiple current stable branches (5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x), each with vendor-released patch versions confirmed by ENISA EUVD-2026-59024. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), indicating limited real-world exploitation probability despite the 7.8 CVSS score.
Missing DMA sync-for-CPU in the Linux kernel's MANA (Microsoft Azure Network Adapter) RX path can hand stale or uninitialized buffer memory to the networking stack on systems that require explicit DMA syncing, such as those booted with swiotlb=force. The flaw affects the mana Ethernet driver when RX buffers come from page-pool fragments (frag_count > 1), where the DMA unmap that normally performs the implicit CPU sync is skipped. There is no public exploit identified at time of analysis, EPSS is low (0.20%), and it is not listed in CISA KEV.
Cross-namespace privilege escalation in the Linux kernel SIT (IPv6-in-IPv4) tunnel driver allows a local attacker with CAP_NET_ADMIN in one network namespace to rewrite SIT tunnel configuration belonging to a distinct, more privileged network namespace, bypassing the intended authorization boundary. This is particularly impactful in containerized environments where network namespace isolation is a primary security boundary, as tenant containers are commonly granted CAP_NET_ADMIN within their own namespace. Patches are confirmed available across all active stable kernel branches (5.10 through 7.x); no public exploit or CISA KEV entry exists at time of analysis, and EPSS is 0.22%, reflecting very low observed exploitation activity.
Privilege boundary bypass in the Linux kernel's ip6_vti (IPv6 Virtual Tunnel Interface) subsystem allows a local user with CAP_NET_ADMIN in one network namespace to reconfigure VTI6 tunnels residing in a separate, unprivileged network namespace. The rtnl changelink path validates CAP_NET_ADMIN only against dev_net(dev), leaving t->net unchecked when the device spans namespaces - enabling unauthorized rewrites of cross-namespace tunnel configurations with full confidentiality, integrity, and availability impact on the affected namespace. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (12th percentile) reflects low current exploitation probability, though the capability misuse pattern is well-understood in container-escape research.
Privilege escalation in the Linux kernel's IP VTI (Virtual Tunnel Interface) subsystem allows a local attacker holding CAP_NET_ADMIN in one network namespace to reconfigure VTI tunnel endpoints anchored in a separate, more privileged network namespace they do not control. Affected kernel versions span from approximately 3.15 through all stable branches prior to 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code has been identified and no CISA KEV listing exists, but the scope-changed CVSS rating (8.8) reflects real cross-namespace boundary violation risk relevant to container and VNF deployments.
IPv6 GRE tunnel management in the Linux kernel allows a local attacker holding CAP_NET_ADMIN in one network namespace to modify tunnel configurations residing in a separate, unauthorized namespace - effectively escalating privilege across namespace security boundaries. Affected kernels span multiple long-term support trees from at least 4.19.100 onward, with patches released across stable series including 6.12.97, 6.6.145, 6.1.178, 6.18.40, 5.10.261, 5.15.212, and 7.1.5. No public exploit code has been identified at time of analysis; EPSS exploitation probability stands at 0.21% (12th percentile), indicating limited current attacker interest despite the high CVSS score.
Raw AES-128 LLSEC key exposure in the Linux kernel's legacy ieee802154 netlink family allows any local user to extract 16-byte cryptographic key material directly from the kernel keytable on systems running IEEE 802.15.4 (wpan) interfaces with link-layer security configured. Because IEEE 802.15.4 LLSEC uses CCM* mode where the same key both encrypts frames and provides message authentication, key disclosure simultaneously breaks confidentiality and authenticity of the entire 802.15.4 wireless network. No confirmed active exploitation and no public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), consistent with the niche hardware requirement.
Header buffer corruption in the Linux kernel gve (Google Virtual Ethernet) driver's DQO RX datapath lets header bytes from one packet be copied onto another, and lets header buffers be re-posted while the device still owns them, when both header-split and HW-GRO are enabled with many concurrent flows. The gve driver is used by Google Cloud Platform Linux VMs, so exposure is limited to GCP guests running affected kernels with that specific offload configuration. There is no public exploit identified at time of analysis, EPSS is very low (0.20%), and the observed effect is roughly a 30% throughput drop with heavy TCP retransmissions rather than code execution.
Data corruption in the Linux kernel's LoongArch memory management subsystem allows a local low-privileged user to cause silent loss of written data or potential exposure of stale page contents via a race condition between hardware page table walker behavior and software dirty-bit tracking. Affected systems are those running LoongArch CPUs with hardware PTW enabled - a condition that applies to the architecture by design - across kernel versions from 5.19 through stable branches prior to 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code exists and EPSS stands at 0.21% (11th percentile), though the bug was reliably reproduced via the LTP madvise09 test, confirming it is not theoretical.
Reference count underflow in the Linux kernel IPMI subsystem's handle_read_event_rsp() function enables local privilege escalation on server hardware with active IPMI interfaces. The flaw resides in the error-rollback path: when event delivery fails after successfully allocating receive messages for some users, the rollback incorrectly drops the user reference count twice - once through ipmi_free_recv_msg() and again through a now-stale explicit put - freeing an ipmi_user object that remains linked on intf->users. Subsequent event delivery then dereferences the freed object or trips refcount_t's addition-on-zero guard, enabling kernel memory corruption leading to full system compromise. No public exploit or CISA KEV listing exists; EPSS is 0.20% at the 10th percentile, consistent with no active exploitation at time of analysis.
Kernel panic via NULL pointer dereference in the Linux kernel's multiq traffic scheduler (net/sched/sch_multiq) affects all kernels from 2.6.29 through unpatched stable trees. When multiq pairs with a non-work-conserving child qdisc (such as qfq) routed through a peeking intermediary (such as tbf), multiq_dequeue() invokes the child's raw ->dequeue() method directly instead of qdisc_dequeue_peeked(), orphaning the stash, corrupting qlen/backlog accounting, and triggering a NULL dereference in softirq context during ordinary egress. Exploitation requires local access with CAP_NET_ADMIN and a deliberately constructed qdisc hierarchy; no public exploit code exists and EPSS probability is 0.21% (12th percentile), consistent with the niche configuration requirement.
Null pointer dereference in the Linux kernel's fhandle subsystem allows a local low-privileged user to trigger a kernel panic via a race condition in capable_wrt_mount(). The vulnerable path is reached when open_by_handle_at() processes a file handle whose detached mount - created via open_tree(OPEN_TREE_CLONE) - is concurrently dissolved by fput(), causing umount_tree() to clear mount->mnt_ns to NULL before capable_wrt_mount() can safely dereference mnt_ns->user_ns. No public exploit identified at time of analysis (EPSS 0.20%, no CISA KEV listing), and patched kernel versions 6.12.97, 6.18.40, 7.1.5, and 7.2-rc2 are available from upstream stable trees.
Kernel memory disclosure and denial-of-service in the Linux kernel OrangeFS client affects systems mounting OrangeFS parallel filesystems, where fill_from_part() truncates a 64-bit directory-entry length into a __u32. An entry length near U32_MAX wraps to a small value that slips past the bounds check and is then used to index the directory part, causing an out-of-bounds read that oopses the kernel. The malformed trailer is supplied by the userspace OrangeFS client, and there is no public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and this is not in CISA KEV. Note: the input CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) conflicts with the description, which describes a local, client-supplied-data OOB read rather than remote unauthenticated code execution.
Out-of-bounds memory read and infinite-loop denial of service in the Linux kernel's iosm WWAN driver (net/wwan/iosm) allow a rogue or compromised modem to corrupt kernel memory and exhaust system resources by supplying crafted MUX downlink packets with malicious offsets and circular table references. Affected systems are those running Linux 5.18 and later with Intel WWAN hardware using the iosm driver, where the mux_dl_adb_decode() function failed to validate any of the device-supplied offsets and lengths (first_table_index, next_table_index, table_length, datagram_index, datagram_length) against the received socket buffer boundary. No public exploit exists and EPSS probability is very low at 0.21% (12th percentile); however, the CVSS 8.8 rating with Full C/I/A impact and reproduction confirmed under KASAN make this a credible risk for cellular-enabled Linux deployments awaiting patch application.
Memory corruption in the Linux kernel's compaction subsystem allows a local low-privileged attacker to trigger data corruption or potential privilege escalation by exploiting improper error handling in compaction_free(). The function ignores failure returns from free_pages_prepare(), causing hardware-poisoned pages (PageHWPoison) or bad pages (free_page_is_bad()) to be re-added to the compaction freepages list and subsequently reallocated to kernel or user structures. Exploitation requires low-privilege local access and is not confirmed actively exploited (absent from CISA KEV), with EPSS at a low 0.21% (11th percentile); vendor-released patches are available across multiple stable branches.
Race condition in the Linux kernel mac802154 subsystem allows a local low-privileged attacker to trigger kernel memory corruption by racing hardware teardown against an in-flight asynchronous transmit completion. Affected systems are those running IEEE 802.15.4 wireless networking hardware with the mac802154 module loaded; versions from Linux 3.19 through the respective stable-branch fix commits are vulnerable. No public exploit identified at time of analysis, and EPSS of 0.21% (12th percentile) reflects negligible observed exploitation activity; vendor patches have been released across all active stable kernel branches.
IPVS (IP Virtual Server) SCTP state tracking in the Linux kernel misreads chunk headers for IPv6 packets carrying extension headers, causing incorrect connection state transitions that affect load balancer behavior and resource accounting. The IPVS subsystem, widely deployed in Kubernetes and LVS environments via kube-proxy, can misclassify an SCTP INIT packet as an already-ESTABLISHED connection when the IPv6 packet includes extension headers (e.g., an 8-byte Destination Options header), because set_sctp_state() hardcodes sizeof(struct ipv6hdr) as the transport offset rather than using the offset already resolved by ipv6_find_hdr(). No public exploit identified at time of analysis, and EPSS at 0.21% (12th percentile) confirms very low current exploitation interest despite the CVSS 8.2 score.
Information disclosure and TCP flow corruption in the Linux kernel's IPVS (IP Virtual Server) load balancer arises because ip_vs_conn_new() only zeroes the delta fields of its two ip_vs_seq structures, leaving init_seq and previous_delta filled with stale slab data. A director acting as a connection-sync backup can hash a connection with IP_VS_CONN_F_IN_SEQ/OUT_SEQ flags set (inherited from IP_VS_CONN_F_BACKUP_MASK) while an attacker-supplied sync message omits IPVS_OPT_SEQ_DATA, so an IPVS application helper later rewrites forwarded TCP sequence/ack numbers using uninitialized kernel memory. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and the issue is not in CISA KEV.
Heap out-of-bounds read in the Linux kernel MACsec subsystem (`macsec_encrypt()`) allows a local attacker with CAP_NET_RAW capability to leak 12 bytes of kernel heap memory and emit that raw heap content onto the wire as a malformed Ethernet frame, with additional potential for kernel destabilization. The flaw is triggered exclusively via the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path, where the socket buffer arrives at `macsec_start_xmit()` with `skb->mac_header` unset, resolving `eth_hdr(skb)` to `skb->head + 65535` - far outside valid headroom. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (12th percentile) reflects low exploitation probability; patches have been backported across all active stable kernel series.
Out-of-bounds write in the Linux kernel's dibs loopback subsystem enables a local low-privileged attacker to corrupt kernel memory by supplying a crafted offset or oversized write through the move_data() interface, which calls memcpy() without verifying that offset + size stays within the registered DMB's allocated length. The software loopback omits the memory-region bounds enforcement that real ISM hardware provides natively, leaving peer-supplied parameters unchecked. Patch commits are confirmed across four stable kernel branches (6.12.97, 6.18.40, 7.1.5, 7.2-rc3); the vulnerability is not in CISA KEV and no public exploit code has been identified at time of analysis.
Kernel memory corruption in the Linux kernel's DRBD (Distributed Replicated Block Device) driver lets a malicious or man-in-the-middle replication peer write attacker-chosen bytes past a bio page in a receiving node. The flaw lives in recv_dless_read(), where a peer-supplied payload length is handled as a signed int (data_size) that can be driven negative, and it affects any node that reads from its peer - a diskless node or one using read-balancing - in the default configuration. Rated CVSS 9.8 by NVD; there is no public exploit identified at time of analysis and EPSS probability is low (0.20%).
Shared MIPI PHY resource mismanagement in the Linux kernel's NXP i.MX93 block-control power domain driver (imx93-blk-ctrl) allows a local attacker with low privileges to trigger kernel-level incorrect behavior - including potential memory corruption, information disclosure, and system instability - by exploiting the fact that the DSI and CSI subdomains share clock and reset control bits without coordination. Patches are available across stable branches (6.18.42, 7.1.5, 7.2-rc4), and exploitation probability is low per EPSS (0.20%, 10th percentile). No public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Linux kernel's rt2x00 WiFi driver stems from improper error handling during device probe, where early allocation failures invoke a full teardown path that assumes work items (intf_work, autowakeup_work, sleep_work) are already initialized. On systems with Ralink/MediaTek rt2x00-compatible WiFi hardware, a local low-privileged attacker who can trigger workqueue allocation failure during driver probe can corrupt uninitialized kernel work_struct objects, as confirmed by DEBUG_OBJECTS reporting invalid work drains. EPSS is low (0.21%, 12th percentile) and this is not listed in CISA KEV, though a QEMU-based proof-of-concept demonstrating the failure path was confirmed by the reporters.
Heap overflow in the Linux kernel brcmfmac/cyw WiFi driver allows a network-adjacent attacker controlling a rogue or compromised access point to corrupt kernel heap memory during WPA3 SAE authentication. The flaw in `brcmf_notify_auth_frame_rx()` causes an unsigned integer underflow when a short auth frame (under 24 bytes) is received, producing a wrap-around copy length that drives `memcpy` far beyond the allocated buffer. With CVSS 8.8 and full C/H/I/H/A/H impact on the vulnerable system, exploitation yields arbitrary kernel memory write capability; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (12th percentile), indicating low observed exploitation pressure despite the critical technical severity.
Integer underflow and overflow flaws in the Linux kernel's Realtek Bluetooth driver (btrtl) corrupt kernel memory during firmware loading, enabling a local attacker with low privileges to achieve full kernel-level compromise. The vulnerability exists in rtlbt_parse_firmware(), where a malformed firmware patch with a length field smaller than 4 causes a subtraction underflow that transforms a subsequent memcpy into an oversized kernel memory write; a separate addition overflow on 32-bit architectures compounds the exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), consistent with the local-only attack vector.
Incorrect IPv6 transport-header offset handling in the Linux kernel's IPVS (IP Virtual Server) load-balancing subsystem causes application-layer helper code and ICMPv6 checksum validation to misread packet headers when IPv6 traffic - particularly packets carrying extension headers - is processed. The IPVS TCP application path wrongly assumed an IPv4 network header even after the ipvsh offset argument was supplied, and ip_vs_out_icmp_v6() used an incorrect ICMPv6 offset. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and this is not on CISA KEV, and for the only in-tree app (FTP) the maintainers note the effect is harmless because port mangling is handled by Netfilter without TCP sequence adjustment.
Out-of-bounds memory access in the Linux kernel's spufs (SPU filesystem) subsystem on PowerPC Cell Broadband Engine architectures allows a local low-privileged user to read or write beyond the SPU local store buffer via a flawed bounds check in `spufs_mem_mmap_access()`. The function computes the mmap offset correctly but validates it against `vma->vm_end` rather than `LS_SIZE`, causing the guard to never fire on 64-bit systems and leaving the length parameter unconstrained relative to the actual local store buffer. Vendor-released patches are confirmed across multiple stable kernel branches; no public exploit has been identified and EPSS is 0.21% at the 12th percentile.
PowerPC E500 systems running Linux kernel 7.0 through 7.1.4 and 7.2-rc4 silently lose kernel address-masking protection due to a compile-time preprocessor symbol typo - `CONFIG_E500` instead of `CONFIG_PPC_E500` - causing `mask_user_address_isel()` to be omitted from E500 builds entirely. A local low-privileged user on affected E500 hardware can exploit the absent address-masking primitive to achieve high-impact memory disclosure, integrity corruption, or denial of service against the kernel. No public exploit exists, EPSS is 0.19% (9th percentile), and this vulnerability is not in CISA KEV, indicating very limited current exploitation activity despite a CVSS score of 7.8.
Out-of-bounds read in the Linux kernel cfg80211 WiFi subsystem allows an adjacent-network unauthenticated attacker to disclose kernel memory or crash the system by sending a crafted EHT Multi-Link Element inside an MBSSID beacon frame. Affected kernels fail to call ieee80211_mle_type_ok() before passing the element to ieee80211_mle_get_mld_id(), violating the helper's documented contract and allowing reads past the IE boundary. No public exploit exists and EPSS is 0.20% (10th percentile), but the attack requires only radio proximity to a device with Wi-Fi scanning active - no authentication and no user interaction needed.
Insufficient Multi-Link Element (MLE) common info length validation in the Linux kernel's IEEE 802.11 WiFi stack exposes adjacent-network attackers to high-impact memory corruption. Kernels from commit 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 onward failed to validate the advertised common-info length field for Reconfiguration and Priority Access MLE types - and also omitted the length octet when computing the minimum common size for Reconfiguration MLEs - meaning a malformed MLE frame crafted by a nearby attacker can trigger out-of-bounds access. The CVSS score of 8.8 (AV:A) and EPSS of 0.20% (10th percentile) together indicate high potential impact but no public exploit activity at time of analysis; no public exploit and no CISA KEV listing have been identified.
Remote kernel memory corruption in the Linux mac80211 WiFi subsystem allows an unauthenticated attacker within WiFi range to trigger out-of-bounds memory accesses by sending crafted 802.11 extension frames that bypass subtype validation and reach generic RX path code expecting regular 802.11 header layouts. Affected systems include any Linux host with an active mac80211-based WiFi driver across a broad range of kernel versions spanning 5.10 through pre-patch 7.x releases. The CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact at the kernel level; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Wrong MTD geometry is applied in the Linux kernel's mchp23k256 SPI SRAM driver when the chip is matched via the SPI id-table rather than via Device Tree, potentially exposing or corrupting unintended SRAM address regions. The driver's probe function calls of_device_get_match_data() exclusively, causing any non-OF SPI modalias match to silently fall back to the default mchp23k256_caps structure regardless of which part was actually selected by the SPI id-table, leading to incorrect chip capacity and address geometry. No public exploit exists and EPSS places this at the 7th percentile (0.17%), but the C:H/I:H/A:H CVSS impact flags reflect that incorrect geometry can expose the entire SRAM contents or allow out-of-bounds writes on affected embedded systems.
Kernel memory corruption in the Linux MTD raw NAND driver for NXP LPC32xx SLC hardware arises because lpc32xx_xmit_dma() silently discards the return value of wait_for_completion_timeout(), treating an expired DMA transfer as successful. The timed-out DMA engine can continue accessing a scatterlist buffer after it has been unmapped and potentially reused by the NAND read/write path, creating a use-after-free condition in kernel space. Exploitation requires local access to an embedded Linux system built on LPC32xx silicon with NAND flash; no public exploit has been identified and EPSS probability sits at 0.18% (7th percentile), indicating limited real-world exploitation interest.
The BPF verifier in the Linux kernel incorrectly accepts constant negative offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF pointer accesses, enabling a local attacker with BPF program loading privileges to perform out-of-bounds kernel memory reads and writes by bypassing the boundary enforcement in __check_buffer_access(). The regression was introduced when commit 022ac0750883 moved constant pointer offsets from reg->off to reg->var_off without updating the corresponding validation logic, leaving a signedness blind spot that allows programs with negative var_off values to load and attach to raw tracepoints undetected. No public exploit code has been identified at time of analysis and the vulnerability is absent from the CISA KEV catalog, but the well-documented commit trail makes independent derivation feasible for a skilled kernel researcher.
Uninitialized pointer dereference in the Linux kernel's `fwnode_init()` function exposes systems to local privilege escalation or kernel crash via a garbage `secondary` pointer in `struct fwnode_handle`. When firmware nodes are allocated on the stack or via non-zeroing heap allocators, `fwnode_init()` leaves `fwnode->secondary` containing arbitrary memory content; subsequent kernel functions such as `dev_to_swnode()` that check `IS_ERR_OR_NULL()` before dereferencing will silently proceed with the garbage pointer. Patches are confirmed available across all active stable kernel branches (5.15.x through 7.x); no public exploit code exists and this CVE is not listed in the CISA KEV catalog.
The Linux kernel's binder IPC driver contains a use-after-clear bug in binder_transaction() where lsmctx.len is re-read after security_release_secctx() has already zeroed the field via memset, causing sg_buf_end_offset to be inflated by the full aligned LSM security context size on every transaction to a txn_security_ctx binder node. This allows BINDER_TYPE_PTR scatter-gather copies to overrun into bytes already populated with the secctx data, enabling LSM security context disclosure and potential kernel buffer corruption. No public exploit or CISA KEV listing exists at time of analysis; the EPSS score of 0.17% reflects low current exploitation probability, though the low-privilege local attack vector is meaningful on Android where binder IPC is the foundational IPC mechanism.
Improper credential context in the Linux kernel's in-kernel SMB3 server (ksmbd) allows an attacker with an open SMB handle to have SET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION FSCTL operations executed under the ksmbd worker's credentials instead of the credentials captured when the file was opened. Because the underlying VFS xattr, fallocate and fileattr helpers revalidate inode permissions, ownership and LSM policy against those worker credentials rather than the SMB handle's access mask, an attacker can corrupt or zero file data and alter file attributes beyond what their handle should permit (CVSS 9.1, I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not in CISA KEV; the upstream fix is merged into stable kernels.
Kernel memory corruption in the Linux kernel's MTD slram driver stems from a link-before-initialize race in `register_device()`, where new `slram_mtdlist` entries are inserted into the global device list before all required state (memory allocation, `memremap()`, and `mtd_device_register()`) is fully committed. When any of these subsequent operations fail, the partially initialized entry persists on the list, and later cleanup code dereferences or frees invalid kernel memory - enabling potential local privilege escalation from low-privileged access to full kernel compromise. EPSS is 0.22% (13th percentile), no CISA KEV listing exists, and no public exploit has been identified at time of analysis, collectively indicating low near-term exploitation likelihood despite the high CVSS score of 7.8.
Out-of-bounds memory access in the Linux kernel MTD raw NAND subsystem allows a local low-privilege user to corrupt or read kernel memory via an improper bounds check in `nand_select_target()`, where the chip-select index `cs` is not validated against `nanddev_ntargets()`. Affected systems span Linux 5.2 through current stable branches across multiple LTS lines; patched releases are available. No public exploit code exists and the vulnerability is not listed in CISA KEV, with EPSS at 0.22% (13th percentile), indicating low real-world exploitation probability despite the high CVSS score of 7.8.
The OCFS2 extent-move ioctl (OCFS2_IOC_MOVE_EXT) in the Linux kernel permits a local user with write access to an OCFS2-mounted filesystem to trigger cross-inode data corruption and information disclosure by supplying a crafted physical goal cluster that an uninitialized probe output allows to survive a failed scan. Affected kernel versions span from approximately Linux 3.0 (commit e6b5859cccfa0fec) through all stable branches prior to the fix releases in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit has been identified at time of analysis, and EPSS probability is 0.22% (13th percentile), consistent with a subsystem-specific kernel bug requiring deliberate targeting.
Unbounded array indexing in the ocfs2 filesystem's ocfs2_sum_rightmost_rec() function causes UBSAN-detected kernel panic or memory corruption when a file write targets an inode whose embedded extent list has been corrupted on-disk. Linux kernels prior to 6.18.40 (stable 6.x branch) and 7.1.5 (7.x branch) are affected on any system mounting an ocfs2 volume. No public exploit has been identified at time of analysis and EPSS probability sits at 0.21% (11th percentile), reflecting realistically constrained exploitability due to the required on-disk corruption precondition.
OCFS2 cluster filesystem dinode validation in the Linux kernel fails to reject inodes with non-canonical i_mode type bits, allowing forged on-disk metadata to propagate into in-core kernel inode structures. Affected kernels accept any non-zero i_mode value and pass it verbatim into ocfs2_populate_inode(), where an unrecognized S_IFMT type falls through to ocfs2_special_file_iops and init_special_inode() - a code path not designed for arbitrary mode inputs. No public exploit has been identified at time of analysis and EPSS sits at only 0.22%, but the kernel-level impact (C:H/I:H/A:H) and the shared-storage attack surface of OCFS2 clusters warrant priority patching on affected systems.
Cache coherency corruption in the Linux kernel's OpenRISC architecture jump_label implementation leaves instruction cache lines on remote SMP cores stale after static key updates, meaning security-relevant kernel branches may execute the wrong code path indefinitely on affected multi-core OpenRISC systems. The flaw originates in commit 8c30b0018f9d, which ported jump_label support from arm64 without adapting icache invalidation to OpenRISC's SMP model - `kick_all_cpus_sync()` does not guarantee a full remote icache flush on this architecture. No public exploit has been identified at time of analysis, and the 0.21% EPSS score (11th percentile) reflects the severe rarity of OpenRISC SMP hardware in production.
Use-after-free in the Linux kernel TPM subsystem's tpm_buf_append_salt() function triggers automatic kernel memory corruption on systems equipped with asynchronous KPP cryptographic hardware backends. The defect fires continuously and without any userland action - the hwrng_fillfn kernel thread invokes the vulnerable code path on every entropy poll via tpm2_get_random → tpm2_start_auth_session → tpm_buf_append_salt, causing a deferred completion worker to dereference a freed kpp_request when the async backend returns -EINPROGRESS. No public exploit has been identified at time of analysis and EPSS is 0.20% (10th percentile), but the kernel-space use-after-free carries inherent privilege escalation and denial-of-service risk on affected hardware configurations.
Tegra GPC DMA driver in the Linux kernel hangs when a client submits a transfer whose length is not evenly divisible by the channel's configured maximum burst size, resulting in a partial-burst stall that freezes the DMA channel indefinitely. The defect is confirmed in production via the PL011 UART TX DMA path on NVIDIA Tegra SoC hardware and affects kernel branches from the introducing commit ee17028009d4 through fixed stable releases spanning 6.1, 6.6, 6.12, 6.18, and 7.1 series. No public exploit code exists and no active exploitation is confirmed; EPSS of 0.21% (12th percentile) reflects the extremely low real-world exploitation probability, consistent with a hardware-specific driver defect rather than a broadly exploitable software flaw.
Initialization ordering flaw in the Linux kernel's Renesas RZ DMAC driver (rz-dmac) creates a race window during driver probe where a DMA interrupt fires before channel->ch_base is assigned and before the ld_free, ld_queue, and ld_active linked-list structures are initialized, leading to invalid kernel memory access, potential kernel crashes, or memory corruption on Renesas RZ SoC-based platforms. Affected systems run Linux 5.15 through the pre-patch stable releases; fixes are available across multiple upstream stable branches (6.6.148, 6.12.101, 7.1.5, 7.2-rc1). No public exploit exists, EPSS is 0.21% (11th percentile), and this CVE is not listed in the CISA KEV catalog.
Incomplete error-path cleanup in the Linux kernel's dell-laptop platform driver exposes systems running Dell hardware to resource leak conditions that can be leveraged for privilege escalation by local low-privileged users. The dell_init() function fails to release the notifier, debugfs directory, keyboard backlight LED, and optional touchpad LED when a later initialization step fails, leaving dangling kernel object registrations. No active exploitation is confirmed (not in CISA KEV), and the EPSS score is very low at 0.20% (10th percentile), but the CVSS 3.1 score of 7.8 High with local-access C:H/I:H/A:H reflects the theoretical privilege escalation ceiling if the dangling resources are abused post-init.
Incorrect pointer usage in the Intel Speed Select Technology (ISST) platform driver causes SST-PP control registers to be restored only for power domain 0 during system resume from suspend, leaving all non-zero power domains with corrupted performance profile settings. Systems running affected Linux kernel versions (6.18.16-6.18.39, 6.19.x, 7.0) on Intel Xeon hardware with multi-domain ISST configurations will silently misconfigure CPU performance profiles after any suspend/resume cycle, leading to integrity and availability impact. EPSS is at 0.21% (11th percentile) and no active exploitation has been identified; a vendor patch is available across multiple stable branches.
Permanent I2C bus lockup in the Linux kernel i2c-imx driver (NXP i.MX SoCs) occurs when an SMBus block-read response returns a byte count of 0, a condition explicitly permitted by SMBus 3.1 specification section 6.5.7. The interrupt-driven state machine introduced in the v6.13 rework rejects count=0 with -EPROTO but critically fails to issue NACK+STOP before returning, leaving the target device holding SDA and the entire I2C bus permanently stuck until the controller is power-cycled. A secondary bug on the count > I2C_SMBUS_BLOCK_MAX error path exhibits the same failure mode. No public exploit or active exploitation is identified; vendor-released patches are available in kernel versions 6.18.40, 7.1.5, and 7.2-rc4.
Use-after-free in the Linux kernel's IPv4 TCP stack (net/ipv4/tcp_output.c) occurs when tcp_connect() reconciles conflicting TCP-MD5 and TCP-AO authentication keys on a socket that is already in TCP_SYN_SENT and hashed into the inet ehash. In the needs_ao branch, tcp_clear_md5_list() frees each tcp_md5sig_key and the md5sig_info container with bare kfree() before the RCU grace period, while softirq RX-path readers (__tcp_md5_do_lookup / __tcp_md5_do_lookup_exact) are still walking the same list under RCU, producing a per-key slab use-after-free. It affects kernels on the 6.18 line (and the described stable range) and is fixed by deferring frees with kfree_rcu; no public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile).
Kernel memory corruption (double free) in the Linux kernel's XFRM/IPsec NAT keepalive path allows a crash or potential heap exploitation when a keepalive transmission fails after the socket buffer has already been handed to the IPv4/IPv6 output stack. Introduced with the nat_keepalive feature in Linux 6.11 and affecting recent stable branches, nat_keepalive_send() incorrectly frees an skb that ip_build_and_send_pkt() or ip6_xmit() may already have consumed, producing a double free. EPSS is low (0.21%, 11th percentile), no public exploit has been identified, and it is not listed in CISA KEV; despite the auto-assigned 9.8 CVSS, realistic impact centers on denial of service and requires an IPsec NAT-traversal configuration.
Insufficient capability verification in the Linux kernel's xfrm interface changelink path allows a process holding CAP_NET_ADMIN in a device's network namespace to rewrite xfrm (IPsec transform) interface parameters belonging to a separate, distinct link namespace where it lacks authorization. Affected kernel versions span all stable branches from the introduction of xfrm_interface (commit f203b76d) through the fix commits, with patched releases confirmed at 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. No public exploit code or active exploitation has been identified; EPSS is 0.22% at the 13th percentile, reflecting low current attacker interest despite a High CVSS score driven by the cross-namespace scope change.
Out-of-bounds heap read and write in the Linux kernel TPM character device driver exposes kernel heap memory to local low-privileged users with access to /dev/tpm0 or /dev/tpmrm0. The TPM char device open handlers fail to call nonseekable_open(), leaving FMODE_PREAD and FMODE_PWRITE enabled on a device that only supports sequential command/response I/O; a pread() call with a large offset (e.g., 0x1400) passes that offset unchecked into tpm_common_read(), causing an out-of-bounds heap read via copy_to_user() and a subsequent out-of-bounds zero-write via memset(). No public exploit is identified at time of analysis, EPSS sits at 0.22% (13th percentile), and patches are available across all active Linux stable branches.
Data corruption in the Linux kernel's spi-imx driver causes SPI bus transfers to produce malformed data when DMA initialization fails and the driver incorrectly falls back to PIO mode without resetting the ECSPI hardware configuration. Systems running NXP i.MX SoCs with ECSPI DMA declared in the device tree but without the sdma-imx7d.bin SDMA firmware are deterministically and silently affected on every transfer. Downstream security-critical devices connected to the affected SPI bus - such as the Infineon SLB9670 TPM - receive corrupted responses that can prevent device initialization entirely, eliminating TPM-based security services; no public exploit has been identified at time of analysis.
Undefined behavior in the Linux kernel's spi-uniphier SPI controller driver arises from a driver probe initialization ordering defect: devm_request_irq() is called before init_completion(), leaving a race window in which an early interrupt can invoke complete() on an uninitialized kernel completion object. Systems running Socionext UniPhier SoC hardware on affected kernel versions are exposed during driver probe. No public exploit has been identified and EPSS sits at 0.22% (13th percentile), consistent with the hardware-specific nature of the flaw - practical exploitation is constrained to platforms physically equipped with UniPhier SoCs.
Heap out-of-bounds write in the Linux kernel NVMe-oF target (nvmet) DH-HMAC-CHAP authentication handler lets a remote NVMe-oF initiator corrupt kernel heap memory when in-band authentication is enabled. nvmet_execute_auth_receive() trusts the host-supplied AUTH_RECEIVE allocation length after only checking it is nonzero, so the SUCCESS1 and FAILURE1 response builders write a fixed-size DH-HMAC-CHAP message into an undersized kmalloc() buffer, producing a 16-byte OOB write from a one-byte allocation length. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.25%, 17th percentile).
Out-of-bounds read in the Linux kernel NVMe-over-Fabrics RDMA target (nvmet-rdma) allows a connected fabric host to make the target map inline data at an attacker-chosen offset, corrupting the per-command scatterlist. When a port is configured with inline_data_size greater than PAGE_SIZE, an offset in the (PAGE_SIZE, inline_data_size] range causes the 'PAGE_SIZE - off' calculation to underflow and sets sg->length to roughly 4 GiB, so the block backend reads far past the first inline page, leaking adjacent kernel memory and risking a crash. No public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile), but the flaw is patched across all maintained stable branches.
Use-after-free in the Linux kernel CAN isotp (ISO 15765-2 Transport Protocol) socket subsystem enables a local low-privileged attacker to corrupt freed kernel memory, potentially escalating privileges to root. The race arises because isotp_notify() clears so->bound via can_rx_unregister() without a subsequent RCU grace period, causing isotp_release() to skip synchronize_rcu() and cancel so->rxtimer while an in-flight isotp_rcv() callback is still executing and about to re-arm it via isotp_send_fc(). Multiple Linux stable branches from 5.10 through pre-7.2-rc4 are affected; vendor-released patches are confirmed across eight stable-tree commits. No public exploit identified at time of analysis; EPSS is 0.22% at the 13th percentile.
Use-after-free race condition in the Linux kernel CAN ISO-TP (isotp) subsystem enables a local user to corrupt kernel memory by racing isotp_release() against concurrent network device unregistration, with CVSS 7.8 reflecting full confidentiality, integrity, and availability impact on the vulnerable system. Affected kernels span the stable 5.10 tree through at least 6.18.x and 7.1.x; patched versions 6.6.148, 6.12.101, 6.18.40, 7.1.5, and 7.2-rc4 are available. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS exploitation probability is low at 0.21% (11th percentile), consistent with the narrow race window and specialized hardware prerequisites.
Race condition in the Linux kernel's CAN ISO-TP (isotp) socket subsystem allows adjacent-network attackers to corrupt TX state machine transitions, enabling kernel memory corruption with high confidentiality, integrity, and availability impact. Multiple stable branches from 5.10 onward are affected, with fixes released in kernel versions 6.6.148, 6.12.101, 6.18.40, 7.1.5, and 7.2-rc4. No public exploit code or CISA KEV entry has been identified at time of analysis, and the EPSS probability of exploitation within 30 days is 0.21% (11th percentile), consistent with the narrow, specialized conditions required.
Use-after-free in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges. The flaw arises from a race between concurrent RCU readers re-arming a throttle timer and RCU-deferred deallocation of the BCM operation structure, introduced by commit f1b4e32aca08's replacement of synchronize_rcu() with call_rcu(). No active exploitation has been confirmed (not in CISA KEV) and EPSS is 0.21% (12th percentile), reflecting limited real-world risk outside CAN-enabled environments.
Lockless race condition in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows local low-privileged users to trigger torn reads of socket binding state, silently redirecting CAN traffic to unintended interfaces or leaving broken RX filter operations registered as successful. The vulnerability affects all kernel branches from Linux 2.6.25 through unpatched stable releases across the 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, and 7.1.x series. No public exploit code or CISA KEV listing exists at time of analysis; EPSS probability is 0.22% (13th percentile), consistent with the local-only attack surface and specialized CAN subsystem prerequisite.
Race conditions in the Linux kernel CAN Broadcast Manager (BCM) subsystem allow adjacent attackers on the CAN bus to corrupt kernel timer and filter state in bcm_rx_setup() by racing concurrent frame-reception handlers, with theoretical impact spanning kernel memory disclosure, corruption, and denial of service. KCSAN-detected simultaneous accesses affect all Linux kernel stable branches from 5.4 through 6.15, spanning automotive, industrial, and embedded deployments that rely on CAN BCM sockets. No public exploit has been identified and EPSS sits at 0.21% (11th percentile), indicating very low near-term exploitation probability despite the 8.8 CVSS score; vendor-released patches are available across multiple stable branches.
Missing RCU (Read-Copy-Update) list synchronization primitives in the Linux kernel's CAN BCM (Broadcast Manager) subsystem expose local low-privilege users to a race-condition memory hazard affecting all kernel stable branches from 5.4 through 6.15. Two distinct defects compound the risk: bcm_[rx|tx]_setup() uses plain list_add() instead of list_add_rcu(), allowing bcm_proc_show() to observe partially initialized bcm_op structures under rcu_read_lock(); and bcm_release() invokes bcm_remove_op() - which schedules memory reclamation via call_rcu() - without first calling list_del_rcu(), creating a use-after-free window while the op remains traversable. No public exploit code has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) indicates low current exploitation probability despite the CVSS 7.8 High rating.
Race condition and missing lock coverage in the Linux kernel CAN Broadcast Manager (BCM) subsystem expose kernel frame data and 64-bit timer values to concurrent unsynchronized access. Low-privileged local users with access to AF_CAN BCM sockets can trigger reads of partially written frame content or torn 64-bit ktime_t values - the latter specifically affecting 32-bit kernel builds - with C:H/I:H/A:H impact per the CVSS vector. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) confirms low current exploitation activity, and the vulnerability is not listed in CISA KEV.
Stale state bugs in the Linux kernel CAN Broadcast Manager (BCM) subsystem allow a local low-privileged user to trigger a runaway hrtimer loop and silently suppress CAN frame delivery following network device removal events. Affected systems span Linux 2.6.25 through unpatched stable branches, with fixes released in 6.6.148, 6.12.101, 6.18.42, 7.1.5, and 7.2-rc4. An attacker with local CAN socket access can cause indefinite bcm_tx_timeout_handler() execution and potentially inject CAN frames into a subsequently reused interface index, yielding high integrity and availability impact with no public exploit identified at time of analysis.
Race condition in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows adjacent network attackers to corrupt CAN frame state and trigger spurious RX_TIMEOUT notifications. The flaw exists in ANYDEV rx operations (ifindex == 0) where concurrent frame delivery from multiple CAN interfaces races hrtimer_cancel(), bcm_rx_starttimer(), and bcm_rx_timeout_handler() on different CPUs, leading to last_frames corruption and clobbering of shared rx_ifindex/rx_stamp fields. No public exploit has been identified at time of analysis; EPSS is 0.21% (11th percentile), indicating very low current exploitation probability.
Missing frame length validation in the Linux kernel CAN Broadcast Manager (BCM) subsystem allows a local low-privileged user to trigger kernel memory corruption by supplying a malformed RTR-reply frame via RX_SETUP with the RX_RTR_FRAME flag. While bcm_tx_setup() correctly enforces DLC bounds on TX_SETUP frames, the equivalent check was absent in bcm_rx_setup(), creating an asymmetric validation gap reachable through the CAN socket interface. The CVSS 3.1 score is 7.8 HIGH with full C/I/A impact; no public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog, but patched stable releases are available across multiple kernel branches.
Use-after-free race condition in the Linux kernel CAN BCM (Broadcast Manager) subsystem allows a local low-privileged attacker to trigger a stale filter pointer against freed memory, with potential full CIA impact on affected systems. The flaw exists from kernel 2.6.25 onward in net/can/bcm.c, where concurrent NETDEV_UNREGISTER events could silently bypass can_rx_unregister(), leaving dangling references to freed bcm_op and socket structures. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.21% (11th percentile), indicating very low real-world exploitation probability at this time.
Use-after-free of freed executable memory in the Linux kernel's io_uring/bpf-ops subsystem allows a local attacker with CAP_BPF and CAP_PERFMON capabilities to achieve arbitrary kernel code execution by registering the same io_uring_bpf_ops struct_ops map against multiple io_ring_ctx instances in sequence. The missing re-registration guard on ops->priv causes the first io_ring_ctx to be orphaned with a dangling ctx->loop_step function pointer into a freed BPF trampoline, which is invoked when io_uring_enter() is later called on that ring. No public exploit has been identified at time of analysis, and EPSS at 0.20% reflects low near-term mass-exploitation probability, though the primitive - controlled call into freed executable memory - is a classic kernel privilege escalation building block.
BPF verifier register bounds mismatch in the Linux kernel allows local users with BPF loading capability to bypass BPF memory safety checks via crafted programs targeting LSM hook context loads. The flaw in check_mem_access() causes stale register bounds from prior instructions to corrupt the verifier's abstract interpretation, producing a divergence between the verifier's belief and runtime state that can be exploited to escape the BPF sandbox. Patches are confirmed available in stable branches (6.12.103, 6.18.40, 7.1.5, 7.2-rc1); no public exploit or CISA KEV listing exists, and EPSS is low at 0.22% (13th percentile), indicating limited observed real-world exploitation.
Incomplete cleanup in the Linux kernel's sparx5 Ethernet switch driver leaves a switchdev blocking notifier registered when workqueue allocation fails during initialization, creating a dangling callback that subsequent kernel network events can invoke against uninitialized driver state - enabling potential kernel memory corruption or privilege escalation on affected hardware. Systems running kernels from 5.14 through the unpatched stable branches on Microchip Sparx5 switch ASICs are affected; patches have been backported to five stable kernel series. No public exploit code exists and EPSS probability is 0.21% (12th percentile), though kernel-level C:H/I:H/A:H impact warrants prompt patching on any affected networking appliance.
Metadata snapshot operations in the Linux kernel's device-mapper thin provisioning (dm-thin) subsystem write a partially-updated superblock field to disk when a metadata commit subsequently fails, corrupting the on-disk space map reference counts. Systems using dm-thin storage pools are affected across a wide range of stable kernel branches from 3.2 onward through patched versions. A local attacker with access to dm-thin pool management can deliberately trigger the failure path - for example by constraining the metadata device - causing persistent metadata inconsistency that survives reboots and results in data loss or pool unavailability. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis.
Out-of-bounds memory access in the Linux kernel dm-era (device mapper era) subsystem allows a local privileged attacker to trigger a vmalloc out-of-bounds read by configuring a dm-era table with a non-zero start sector. The era_map() function fails to apply the target offset before calculating the writeset block, passing an absolute block number to writeset_marked() that may exceed the allocated bitset size. No public exploit exists and EPSS probability is 0.22%, but patches are backported across all major stable kernel branches. The provided CVSS score of 8.8 (AV:N/PR:L) materially overstates real-world risk for a flaw requiring CAP_SYS_ADMIN and a specifically misconfigured dm-era table.
Integer wraparound in the Linux kernel's dm-log subsystem on 32-bit architectures allows a local attacker to trigger a bitset_size overflow, potentially causing kernel memory corruption. Specifically, when region_size is close to UINT_MAX and bitset_size is rounded up to a multiple of BITS_PER_LONG, a 32-bit size_t wraps around to zero, leading to an incorrect zero-byte bitmap allocation and subsequent out-of-bounds write conditions. No public exploit is identified at time of analysis, and EPSS probability is low (0.22%, percentile 13%), but the CVSS 7.8 local score reflects the potential for full system compromise once the specific conditions are met.
The Linux kernel dm (device-mapper) subsystem, from version 6.9 onward, leaks the calling process's thread keyring by retaining a reference to the table device file beyond the caller's lifetime, causing LUKS volume keys to silently persist in RAM after `cryptsetup luksSuspend`. This regression, introduced by commit a28d893eb327, breaks a documented security guarantee: `luksSuspend` is expected to wipe the volume key from memory, but an unpatched kernel leaves a second copy in the retained thread keyring recoverable until `luksClose`. Any adversary capable of reading kernel memory - via physical access, cold boot attack, or a separate memory disclosure exploit - can extract the LUKS volume key and decrypt the protected volume. No public exploit is identified, and EPSS of 0.21% (11th percentile) reflects limited automated exploitation probability.
Double-free memory corruption in the Linux kernel's device mapper subsystem allows a local attacker to trigger kernel memory corruption by causing dm_resume failure during early device creation, potentially leading to privilege escalation or system crash. Affected systems run kernel versions from approximately Linux 5.1 through multiple stable branches prior to the respective patch commits; fixes are available across all major stable series from 5.10 through 7.2-rc3. No public exploit code exists and EPSS exploitation probability is extremely low at 0.22% (13th percentile), though the high CVSS impact metrics (C:H/I:H/A:H) reflect the potential severity if the error path is successfully triggered and weaponized.
Deadlock in the Linux kernel's dm-integrity device mapper module allows a local attacker or process with block-device access to permanently freeze I/O on an integrity-protected block device. When dm_integrity_check_limits detects an out-of-bounds bio and returns failure, it exits with DM_MAPIO_KILL while leaving an internal range lock held, so all subsequent I/O operations block indefinitely waiting for a lock that will never be released. No public exploit identified at time of analysis; EPSS is 0.21% at the 11th percentile, consistent with a locally-triggered kernel availability flaw requiring a non-default configuration.
Integrity bypass in the Linux kernel dm-integrity device mapper subsystem allows low-privileged users to undermine block-level data integrity guarantees through a double-increment logic error in hash_offset tracking. The introduced commit 84597a44a9d86ac949900441cea7da0af0f2f473 (present since Linux 5.7) causes the hash_offset variable to advance by two positions per iteration instead of one, meaning integrity hashes are verified against incorrect offsets - allowing corrupted data to pass or valid data to fail integrity checks. No public exploit identified at time of analysis, and EPSS at 0.21% (11th percentile) reflects low near-term exploitation probability.
An out-of-bounds kernel write in the Linux kernel's dm-verity Forward Error Correction (FEC) code allows corruption of adjacent kernel memory when Reed-Solomon erasure recovery is triggered. An off-by-one in the erasure-counting logic lets the erasure count reach roots+1, which is then passed to decode_rs8() and overruns the lambda[] locator polynomial by one element, clobbering the syndrome buffer (syn[0]). It affects Linux systems using dm-verity with FEC enabled; there is no CISA KEV listing, no public exploit identified, and EPSS is low (0.22%, 13th percentile), indicating this is a memory-safety defect rather than an actively exploited threat.
Uninitialized memory dereference in the Linux kernel's dma-fence subsystem allows a local low-privileged user on AMD GPU-equipped systems to trigger memory corruption via the amdgpu userqueue wait path. The root cause is an off-by-one logic error in `dma_fence_dedup_array()` that returns 1 instead of 0 for empty input, which the primary caller guards against but `amdgpu_userq_wait_*()` does not, exposing an uninitialized fence slot to dereference. Patch commits are available for stable branches 6.18.40 and 7.1.5; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), indicating low real-world exploitation activity.
Use-after-free in the Linux kernel's amdxdna DMA buffer memory mapping function exposes systems with AMD XDna AI accelerator hardware to local privilege escalation. When vm_insert_pages() fails inside amdxdna_gem_dmabuf_mmap(), the error path triggers drm_gem_object_put() twice on the same GEM object - once through the VMA close handler and again through the fall-through put_obj label - freeing the object and then accessing freed memory. EPSS sits at 0.21% (11th percentile) and the vulnerability is not listed in CISA KEV, indicating no known active exploitation; however, the CVSS 7.8 high score reflects the full C/H/I:H/A:H kernel memory corruption potential if successfully triggered locally.
Client pointer confusion in the Linux kernel's amdxdna DRM accelerator driver allows a local low-privileged user to trigger cross-process access to another process's hardware context and debug buffer objects via a misrouted SYNC_DIRECT_FROM_DEVICE ioctl. Systems running AMD XDNA NPU hardware (such as AMD Ryzen AI series processors) with the amdxdna kernel module loaded are affected across kernel versions from the driver's introduction up to the patched releases in 7.1.5 and 7.2-rc1. No public exploit exists and the EPSS score of 0.20% (10th percentile) reflects low near-term exploitation probability, though the CVSS 7.8 score correctly captures the high CIA impact should exploitation succeed.
Integer underflow in the Linux kernel's Intel VPU accelerator driver (accel/ivpu) allows a local low-privileged attacker to trigger out-of-bounds kernel memory reads and infinite loops via a malformed firmware log buffer. The vulnerability exists because fw_log_from_bo() never validates that log->size is at least log->header_size before fw_log_print_buffer() computes data_size = log->size - log->header_size - a u32 subtraction that wraps to near-U32_MAX, defeating the bounds checks from commit dd1311bcf0e6 and enabling fw_log_print_lines() to read far past the allocated BO region. No active exploitation is confirmed (not in CISA KEV), and EPSS is 0.21% (11th percentile), indicating low near-term exploitation likelihood despite the 7.1 CVSS score.
Denial of service in the Linux kernel's Xen paravirtualized SCSI backend (xen-scsiback) lets a malicious pvSCSI guest exhaust every command tag of a target LUN's session by driving the pre-submission error paths, which call transport_generic_free_cmd() on an se_cmd whose cmd_kref is still 0. The resulting refcount underflow is a use-after-free that leaks the tag and stops the LUN; on hosts booted with panic_on_warn it crashes the host outright. There is no public exploit identified at time of analysis and EPSS is low (0.21%), but the fix is shipped across multiple stable kernel trees.
Use-after-free in the Linux kernel's LIO SCSI target core (iSCSI transport) lets an initiator that can issue a PERSISTENT RESERVE OUT / REGISTER AND MOVE command trigger reads of an unmapped kernel virtual address, risking information disclosure or a kernel crash. The flaw exists only in the target-mode stack (drivers/target) and only manifests when the PR OUT parameter list exceeds one page (>4096 bytes), forcing transport_kmap_data_sg() down its vmap()/vunmap() path. EPSS is low (0.22%, 13th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
Use-after-free in the Linux kernel's resctrl filesystem subsystem allows a local low-privileged user to dereference freed kernel memory during a race between a concurrent monitoring file reader and resctrl unmount or fatal teardown. The vulnerable code path affects multiple stable kernel series, with fixes confirmed in 6.18.42, 7.1.5, and 7.2-rc3. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% reflects low current exploitation probability, though kernel use-after-free primitives are commonly developed into local privilege escalation exploits.
Use-after-free and initialization-order race conditions in the Linux kernel's mlx5e MACsec hardware offload driver allow a local low-privileged user to corrupt kernel memory during RX Security Channel deletion. The delete path in macsec_del_rxsc_ctx() called metadata_dst_free() unconditionally, bypassing reference counting, while concurrent RX datapath readers operating under rcu_read_lock() could still hold and dereference the freed dst object. A secondary race in the add path published the SC's xarray entry before md_dst was fully initialized, allowing readers to observe NULL or partially-constructed pointers. Patches are available across multiple stable branches (6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2-rc2); no public exploit has been identified at time of analysis.
Use-after-free race condition in the Linux kernel's tracing/user_events subsystem allows a low-privileged local user to corrupt kernel heap memory during fork(), potentially enabling privilege escalation to root. The race is triggered when a multithreaded process concurrently unregisters a user event enabler while calling fork(), causing user_event_mm_dup() to dereference enabler and user_event structures freed without observing the required RCU grace period. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, the low privilege bar and full C/I/A impact make it a meaningful escalation primitive on any multi-user or shared Linux system running an unpatched kernel with CONFIG_USER_EVENTS enabled.
Error-masking in the Linux kernel CPU hotplug subsystem allows a failed CPU state transition to silently appear successful to callers, spanning stable branches from 4.14 through 7.1.x. The root cause is that cpuhp_invoke_callback() reuses the ret variable in its rollback path: when one instance callback fails and the subsequent rollback succeeds, the rollback's zero return overwrites the original non-zero error, hiding the failure from higher-level consumers. No active exploitation is confirmed - EPSS sits at 0.22% (13th percentile) and there is no CISA KEV listing - but patches are available across all affected stable branches.
Unbounded sprintf() calls in the Linux kernel's CPU hotplug sysfs interface (states_show()) can overflow the PAGE_SIZE kernel buffer when a sufficient number of hotplug states are registered, enabling a local low-privileged user to corrupt adjacent kernel memory with potential high impact on confidentiality, integrity, and availability. Affected kernel versions span from the 4.6 era through multiple current stable branches (5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x), each with vendor-released patch versions confirmed by ENISA EUVD-2026-59024. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), indicating limited real-world exploitation probability despite the 7.8 CVSS score.
Missing DMA sync-for-CPU in the Linux kernel's MANA (Microsoft Azure Network Adapter) RX path can hand stale or uninitialized buffer memory to the networking stack on systems that require explicit DMA syncing, such as those booted with swiotlb=force. The flaw affects the mana Ethernet driver when RX buffers come from page-pool fragments (frag_count > 1), where the DMA unmap that normally performs the implicit CPU sync is skipped. There is no public exploit identified at time of analysis, EPSS is low (0.20%), and it is not listed in CISA KEV.
Cross-namespace privilege escalation in the Linux kernel SIT (IPv6-in-IPv4) tunnel driver allows a local attacker with CAP_NET_ADMIN in one network namespace to rewrite SIT tunnel configuration belonging to a distinct, more privileged network namespace, bypassing the intended authorization boundary. This is particularly impactful in containerized environments where network namespace isolation is a primary security boundary, as tenant containers are commonly granted CAP_NET_ADMIN within their own namespace. Patches are confirmed available across all active stable kernel branches (5.10 through 7.x); no public exploit or CISA KEV entry exists at time of analysis, and EPSS is 0.22%, reflecting very low observed exploitation activity.
Privilege boundary bypass in the Linux kernel's ip6_vti (IPv6 Virtual Tunnel Interface) subsystem allows a local user with CAP_NET_ADMIN in one network namespace to reconfigure VTI6 tunnels residing in a separate, unprivileged network namespace. The rtnl changelink path validates CAP_NET_ADMIN only against dev_net(dev), leaving t->net unchecked when the device spans namespaces - enabling unauthorized rewrites of cross-namespace tunnel configurations with full confidentiality, integrity, and availability impact on the affected namespace. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (12th percentile) reflects low current exploitation probability, though the capability misuse pattern is well-understood in container-escape research.
Privilege escalation in the Linux kernel's IP VTI (Virtual Tunnel Interface) subsystem allows a local attacker holding CAP_NET_ADMIN in one network namespace to reconfigure VTI tunnel endpoints anchored in a separate, more privileged network namespace they do not control. Affected kernel versions span from approximately 3.15 through all stable branches prior to 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code has been identified and no CISA KEV listing exists, but the scope-changed CVSS rating (8.8) reflects real cross-namespace boundary violation risk relevant to container and VNF deployments.
IPv6 GRE tunnel management in the Linux kernel allows a local attacker holding CAP_NET_ADMIN in one network namespace to modify tunnel configurations residing in a separate, unauthorized namespace - effectively escalating privilege across namespace security boundaries. Affected kernels span multiple long-term support trees from at least 4.19.100 onward, with patches released across stable series including 6.12.97, 6.6.145, 6.1.178, 6.18.40, 5.10.261, 5.15.212, and 7.1.5. No public exploit code has been identified at time of analysis; EPSS exploitation probability stands at 0.21% (12th percentile), indicating limited current attacker interest despite the high CVSS score.
Raw AES-128 LLSEC key exposure in the Linux kernel's legacy ieee802154 netlink family allows any local user to extract 16-byte cryptographic key material directly from the kernel keytable on systems running IEEE 802.15.4 (wpan) interfaces with link-layer security configured. Because IEEE 802.15.4 LLSEC uses CCM* mode where the same key both encrypts frames and provides message authentication, key disclosure simultaneously breaks confidentiality and authenticity of the entire 802.15.4 wireless network. No confirmed active exploitation and no public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), consistent with the niche hardware requirement.
Header buffer corruption in the Linux kernel gve (Google Virtual Ethernet) driver's DQO RX datapath lets header bytes from one packet be copied onto another, and lets header buffers be re-posted while the device still owns them, when both header-split and HW-GRO are enabled with many concurrent flows. The gve driver is used by Google Cloud Platform Linux VMs, so exposure is limited to GCP guests running affected kernels with that specific offload configuration. There is no public exploit identified at time of analysis, EPSS is very low (0.20%), and the observed effect is roughly a 30% throughput drop with heavy TCP retransmissions rather than code execution.
Data corruption in the Linux kernel's LoongArch memory management subsystem allows a local low-privileged user to cause silent loss of written data or potential exposure of stale page contents via a race condition between hardware page table walker behavior and software dirty-bit tracking. Affected systems are those running LoongArch CPUs with hardware PTW enabled - a condition that applies to the architecture by design - across kernel versions from 5.19 through stable branches prior to 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code exists and EPSS stands at 0.21% (11th percentile), though the bug was reliably reproduced via the LTP madvise09 test, confirming it is not theoretical.
Reference count underflow in the Linux kernel IPMI subsystem's handle_read_event_rsp() function enables local privilege escalation on server hardware with active IPMI interfaces. The flaw resides in the error-rollback path: when event delivery fails after successfully allocating receive messages for some users, the rollback incorrectly drops the user reference count twice - once through ipmi_free_recv_msg() and again through a now-stale explicit put - freeing an ipmi_user object that remains linked on intf->users. Subsequent event delivery then dereferences the freed object or trips refcount_t's addition-on-zero guard, enabling kernel memory corruption leading to full system compromise. No public exploit or CISA KEV listing exists; EPSS is 0.20% at the 10th percentile, consistent with no active exploitation at time of analysis.
Kernel panic via NULL pointer dereference in the Linux kernel's multiq traffic scheduler (net/sched/sch_multiq) affects all kernels from 2.6.29 through unpatched stable trees. When multiq pairs with a non-work-conserving child qdisc (such as qfq) routed through a peeking intermediary (such as tbf), multiq_dequeue() invokes the child's raw ->dequeue() method directly instead of qdisc_dequeue_peeked(), orphaning the stash, corrupting qlen/backlog accounting, and triggering a NULL dereference in softirq context during ordinary egress. Exploitation requires local access with CAP_NET_ADMIN and a deliberately constructed qdisc hierarchy; no public exploit code exists and EPSS probability is 0.21% (12th percentile), consistent with the niche configuration requirement.
Null pointer dereference in the Linux kernel's fhandle subsystem allows a local low-privileged user to trigger a kernel panic via a race condition in capable_wrt_mount(). The vulnerable path is reached when open_by_handle_at() processes a file handle whose detached mount - created via open_tree(OPEN_TREE_CLONE) - is concurrently dissolved by fput(), causing umount_tree() to clear mount->mnt_ns to NULL before capable_wrt_mount() can safely dereference mnt_ns->user_ns. No public exploit identified at time of analysis (EPSS 0.20%, no CISA KEV listing), and patched kernel versions 6.12.97, 6.18.40, 7.1.5, and 7.2-rc2 are available from upstream stable trees.
Kernel memory disclosure and denial-of-service in the Linux kernel OrangeFS client affects systems mounting OrangeFS parallel filesystems, where fill_from_part() truncates a 64-bit directory-entry length into a __u32. An entry length near U32_MAX wraps to a small value that slips past the bounds check and is then used to index the directory part, causing an out-of-bounds read that oopses the kernel. The malformed trailer is supplied by the userspace OrangeFS client, and there is no public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and this is not in CISA KEV. Note: the input CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) conflicts with the description, which describes a local, client-supplied-data OOB read rather than remote unauthenticated code execution.
Out-of-bounds memory read and infinite-loop denial of service in the Linux kernel's iosm WWAN driver (net/wwan/iosm) allow a rogue or compromised modem to corrupt kernel memory and exhaust system resources by supplying crafted MUX downlink packets with malicious offsets and circular table references. Affected systems are those running Linux 5.18 and later with Intel WWAN hardware using the iosm driver, where the mux_dl_adb_decode() function failed to validate any of the device-supplied offsets and lengths (first_table_index, next_table_index, table_length, datagram_index, datagram_length) against the received socket buffer boundary. No public exploit exists and EPSS probability is very low at 0.21% (12th percentile); however, the CVSS 8.8 rating with Full C/I/A impact and reproduction confirmed under KASAN make this a credible risk for cellular-enabled Linux deployments awaiting patch application.
Memory corruption in the Linux kernel's compaction subsystem allows a local low-privileged attacker to trigger data corruption or potential privilege escalation by exploiting improper error handling in compaction_free(). The function ignores failure returns from free_pages_prepare(), causing hardware-poisoned pages (PageHWPoison) or bad pages (free_page_is_bad()) to be re-added to the compaction freepages list and subsequently reallocated to kernel or user structures. Exploitation requires low-privilege local access and is not confirmed actively exploited (absent from CISA KEV), with EPSS at a low 0.21% (11th percentile); vendor-released patches are available across multiple stable branches.
Race condition in the Linux kernel mac802154 subsystem allows a local low-privileged attacker to trigger kernel memory corruption by racing hardware teardown against an in-flight asynchronous transmit completion. Affected systems are those running IEEE 802.15.4 wireless networking hardware with the mac802154 module loaded; versions from Linux 3.19 through the respective stable-branch fix commits are vulnerable. No public exploit identified at time of analysis, and EPSS of 0.21% (12th percentile) reflects negligible observed exploitation activity; vendor patches have been released across all active stable kernel branches.
IPVS (IP Virtual Server) SCTP state tracking in the Linux kernel misreads chunk headers for IPv6 packets carrying extension headers, causing incorrect connection state transitions that affect load balancer behavior and resource accounting. The IPVS subsystem, widely deployed in Kubernetes and LVS environments via kube-proxy, can misclassify an SCTP INIT packet as an already-ESTABLISHED connection when the IPv6 packet includes extension headers (e.g., an 8-byte Destination Options header), because set_sctp_state() hardcodes sizeof(struct ipv6hdr) as the transport offset rather than using the offset already resolved by ipv6_find_hdr(). No public exploit identified at time of analysis, and EPSS at 0.21% (12th percentile) confirms very low current exploitation interest despite the CVSS 8.2 score.
Information disclosure and TCP flow corruption in the Linux kernel's IPVS (IP Virtual Server) load balancer arises because ip_vs_conn_new() only zeroes the delta fields of its two ip_vs_seq structures, leaving init_seq and previous_delta filled with stale slab data. A director acting as a connection-sync backup can hash a connection with IP_VS_CONN_F_IN_SEQ/OUT_SEQ flags set (inherited from IP_VS_CONN_F_BACKUP_MASK) while an attacker-supplied sync message omits IPVS_OPT_SEQ_DATA, so an IPVS application helper later rewrites forwarded TCP sequence/ack numbers using uninitialized kernel memory. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and the issue is not in CISA KEV.
Heap out-of-bounds read in the Linux kernel MACsec subsystem (`macsec_encrypt()`) allows a local attacker with CAP_NET_RAW capability to leak 12 bytes of kernel heap memory and emit that raw heap content onto the wire as a malformed Ethernet frame, with additional potential for kernel destabilization. The flaw is triggered exclusively via the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path, where the socket buffer arrives at `macsec_start_xmit()` with `skb->mac_header` unset, resolving `eth_hdr(skb)` to `skb->head + 65535` - far outside valid headroom. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (12th percentile) reflects low exploitation probability; patches have been backported across all active stable kernel series.
Out-of-bounds write in the Linux kernel's dibs loopback subsystem enables a local low-privileged attacker to corrupt kernel memory by supplying a crafted offset or oversized write through the move_data() interface, which calls memcpy() without verifying that offset + size stays within the registered DMB's allocated length. The software loopback omits the memory-region bounds enforcement that real ISM hardware provides natively, leaving peer-supplied parameters unchecked. Patch commits are confirmed across four stable kernel branches (6.12.97, 6.18.40, 7.1.5, 7.2-rc3); the vulnerability is not in CISA KEV and no public exploit code has been identified at time of analysis.
Kernel memory corruption in the Linux kernel's DRBD (Distributed Replicated Block Device) driver lets a malicious or man-in-the-middle replication peer write attacker-chosen bytes past a bio page in a receiving node. The flaw lives in recv_dless_read(), where a peer-supplied payload length is handled as a signed int (data_size) that can be driven negative, and it affects any node that reads from its peer - a diskless node or one using read-balancing - in the default configuration. Rated CVSS 9.8 by NVD; there is no public exploit identified at time of analysis and EPSS probability is low (0.20%).
Shared MIPI PHY resource mismanagement in the Linux kernel's NXP i.MX93 block-control power domain driver (imx93-blk-ctrl) allows a local attacker with low privileges to trigger kernel-level incorrect behavior - including potential memory corruption, information disclosure, and system instability - by exploiting the fact that the DSI and CSI subdomains share clock and reset control bits without coordination. Patches are available across stable branches (6.18.42, 7.1.5, 7.2-rc4), and exploitation probability is low per EPSS (0.20%, 10th percentile). No public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Linux kernel's rt2x00 WiFi driver stems from improper error handling during device probe, where early allocation failures invoke a full teardown path that assumes work items (intf_work, autowakeup_work, sleep_work) are already initialized. On systems with Ralink/MediaTek rt2x00-compatible WiFi hardware, a local low-privileged attacker who can trigger workqueue allocation failure during driver probe can corrupt uninitialized kernel work_struct objects, as confirmed by DEBUG_OBJECTS reporting invalid work drains. EPSS is low (0.21%, 12th percentile) and this is not listed in CISA KEV, though a QEMU-based proof-of-concept demonstrating the failure path was confirmed by the reporters.
Heap overflow in the Linux kernel brcmfmac/cyw WiFi driver allows a network-adjacent attacker controlling a rogue or compromised access point to corrupt kernel heap memory during WPA3 SAE authentication. The flaw in `brcmf_notify_auth_frame_rx()` causes an unsigned integer underflow when a short auth frame (under 24 bytes) is received, producing a wrap-around copy length that drives `memcpy` far beyond the allocated buffer. With CVSS 8.8 and full C/H/I/H/A/H impact on the vulnerable system, exploitation yields arbitrary kernel memory write capability; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (12th percentile), indicating low observed exploitation pressure despite the critical technical severity.
Integer underflow and overflow flaws in the Linux kernel's Realtek Bluetooth driver (btrtl) corrupt kernel memory during firmware loading, enabling a local attacker with low privileges to achieve full kernel-level compromise. The vulnerability exists in rtlbt_parse_firmware(), where a malformed firmware patch with a length field smaller than 4 causes a subtraction underflow that transforms a subsequent memcpy into an oversized kernel memory write; a separate addition overflow on 32-bit architectures compounds the exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), consistent with the local-only attack vector.
Incorrect IPv6 transport-header offset handling in the Linux kernel's IPVS (IP Virtual Server) load-balancing subsystem causes application-layer helper code and ICMPv6 checksum validation to misread packet headers when IPv6 traffic - particularly packets carrying extension headers - is processed. The IPVS TCP application path wrongly assumed an IPv4 network header even after the ipvsh offset argument was supplied, and ip_vs_out_icmp_v6() used an incorrect ICMPv6 offset. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and this is not on CISA KEV, and for the only in-tree app (FTP) the maintainers note the effect is harmless because port mangling is handled by Netfilter without TCP sequence adjustment.
Out-of-bounds memory access in the Linux kernel's spufs (SPU filesystem) subsystem on PowerPC Cell Broadband Engine architectures allows a local low-privileged user to read or write beyond the SPU local store buffer via a flawed bounds check in `spufs_mem_mmap_access()`. The function computes the mmap offset correctly but validates it against `vma->vm_end` rather than `LS_SIZE`, causing the guard to never fire on 64-bit systems and leaving the length parameter unconstrained relative to the actual local store buffer. Vendor-released patches are confirmed across multiple stable kernel branches; no public exploit has been identified and EPSS is 0.21% at the 12th percentile.
PowerPC E500 systems running Linux kernel 7.0 through 7.1.4 and 7.2-rc4 silently lose kernel address-masking protection due to a compile-time preprocessor symbol typo - `CONFIG_E500` instead of `CONFIG_PPC_E500` - causing `mask_user_address_isel()` to be omitted from E500 builds entirely. A local low-privileged user on affected E500 hardware can exploit the absent address-masking primitive to achieve high-impact memory disclosure, integrity corruption, or denial of service against the kernel. No public exploit exists, EPSS is 0.19% (9th percentile), and this vulnerability is not in CISA KEV, indicating very limited current exploitation activity despite a CVSS score of 7.8.
Out-of-bounds read in the Linux kernel cfg80211 WiFi subsystem allows an adjacent-network unauthenticated attacker to disclose kernel memory or crash the system by sending a crafted EHT Multi-Link Element inside an MBSSID beacon frame. Affected kernels fail to call ieee80211_mle_type_ok() before passing the element to ieee80211_mle_get_mld_id(), violating the helper's documented contract and allowing reads past the IE boundary. No public exploit exists and EPSS is 0.20% (10th percentile), but the attack requires only radio proximity to a device with Wi-Fi scanning active - no authentication and no user interaction needed.
Insufficient Multi-Link Element (MLE) common info length validation in the Linux kernel's IEEE 802.11 WiFi stack exposes adjacent-network attackers to high-impact memory corruption. Kernels from commit 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 onward failed to validate the advertised common-info length field for Reconfiguration and Priority Access MLE types - and also omitted the length octet when computing the minimum common size for Reconfiguration MLEs - meaning a malformed MLE frame crafted by a nearby attacker can trigger out-of-bounds access. The CVSS score of 8.8 (AV:A) and EPSS of 0.20% (10th percentile) together indicate high potential impact but no public exploit activity at time of analysis; no public exploit and no CISA KEV listing have been identified.
Remote kernel memory corruption in the Linux mac80211 WiFi subsystem allows an unauthenticated attacker within WiFi range to trigger out-of-bounds memory accesses by sending crafted 802.11 extension frames that bypass subtype validation and reach generic RX path code expecting regular 802.11 header layouts. Affected systems include any Linux host with an active mac80211-based WiFi driver across a broad range of kernel versions spanning 5.10 through pre-patch 7.x releases. The CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact at the kernel level; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Wrong MTD geometry is applied in the Linux kernel's mchp23k256 SPI SRAM driver when the chip is matched via the SPI id-table rather than via Device Tree, potentially exposing or corrupting unintended SRAM address regions. The driver's probe function calls of_device_get_match_data() exclusively, causing any non-OF SPI modalias match to silently fall back to the default mchp23k256_caps structure regardless of which part was actually selected by the SPI id-table, leading to incorrect chip capacity and address geometry. No public exploit exists and EPSS places this at the 7th percentile (0.17%), but the C:H/I:H/A:H CVSS impact flags reflect that incorrect geometry can expose the entire SRAM contents or allow out-of-bounds writes on affected embedded systems.
Kernel memory corruption in the Linux MTD raw NAND driver for NXP LPC32xx SLC hardware arises because lpc32xx_xmit_dma() silently discards the return value of wait_for_completion_timeout(), treating an expired DMA transfer as successful. The timed-out DMA engine can continue accessing a scatterlist buffer after it has been unmapped and potentially reused by the NAND read/write path, creating a use-after-free condition in kernel space. Exploitation requires local access to an embedded Linux system built on LPC32xx silicon with NAND flash; no public exploit has been identified and EPSS probability sits at 0.18% (7th percentile), indicating limited real-world exploitation interest.
The BPF verifier in the Linux kernel incorrectly accepts constant negative offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF pointer accesses, enabling a local attacker with BPF program loading privileges to perform out-of-bounds kernel memory reads and writes by bypassing the boundary enforcement in __check_buffer_access(). The regression was introduced when commit 022ac0750883 moved constant pointer offsets from reg->off to reg->var_off without updating the corresponding validation logic, leaving a signedness blind spot that allows programs with negative var_off values to load and attach to raw tracepoints undetected. No public exploit code has been identified at time of analysis and the vulnerability is absent from the CISA KEV catalog, but the well-documented commit trail makes independent derivation feasible for a skilled kernel researcher.
Uninitialized pointer dereference in the Linux kernel's `fwnode_init()` function exposes systems to local privilege escalation or kernel crash via a garbage `secondary` pointer in `struct fwnode_handle`. When firmware nodes are allocated on the stack or via non-zeroing heap allocators, `fwnode_init()` leaves `fwnode->secondary` containing arbitrary memory content; subsequent kernel functions such as `dev_to_swnode()` that check `IS_ERR_OR_NULL()` before dereferencing will silently proceed with the garbage pointer. Patches are confirmed available across all active stable kernel branches (5.15.x through 7.x); no public exploit code exists and this CVE is not listed in the CISA KEV catalog.
The Linux kernel's binder IPC driver contains a use-after-clear bug in binder_transaction() where lsmctx.len is re-read after security_release_secctx() has already zeroed the field via memset, causing sg_buf_end_offset to be inflated by the full aligned LSM security context size on every transaction to a txn_security_ctx binder node. This allows BINDER_TYPE_PTR scatter-gather copies to overrun into bytes already populated with the secctx data, enabling LSM security context disclosure and potential kernel buffer corruption. No public exploit or CISA KEV listing exists at time of analysis; the EPSS score of 0.17% reflects low current exploitation probability, though the low-privilege local attack vector is meaningful on Android where binder IPC is the foundational IPC mechanism.
Improper credential context in the Linux kernel's in-kernel SMB3 server (ksmbd) allows an attacker with an open SMB handle to have SET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION FSCTL operations executed under the ksmbd worker's credentials instead of the credentials captured when the file was opened. Because the underlying VFS xattr, fallocate and fileattr helpers revalidate inode permissions, ownership and LSM policy against those worker credentials rather than the SMB handle's access mask, an attacker can corrupt or zero file data and alter file attributes beyond what their handle should permit (CVSS 9.1, I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not in CISA KEV; the upstream fix is merged into stable kernels.