Red Hat
Monthly
A vulnerability was found in Keycloak-services. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the `convert_tf_weight_name_to_pt_weight_name()` function. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
OpenJPEG is an open-source JPEG 2000 codec. Rated medium severity (CVSS 6.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Russh is a Rust SSH client & server library. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A flaw was found in the Ansible aap-gateway. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
Grafana is an open-source platform for monitoring and observability. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv). Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required.
In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required.
Traefik is an HTTP reverse proxy and load balancer. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Squid is a caching proxy for the Web. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
jose v6.0.10 was discovered to contain weak encryption. Rated high severity (CVSS 7.0), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Out-of-bounds read in Apple Safari and system WebKit implementations allows local attackers to disclose internal application state by processing maliciously crafted web content, affecting Safari 18.5 and earlier, iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. The vulnerability requires local access and user interaction but poses information disclosure risk with CVSS 4.0 and EPSS 0.02% (very low exploitation probability); no public exploit code or active exploitation has been identified.
Safari and macOS contain a logic flaw that allows incorrect association of a download's origin, potentially disclosing information about file provenance to local attackers. The vulnerability affects Safari 18.6 and earlier, plus macOS Sequoia 15.6 and earlier, and requires local access (no authentication needed) to exploit. This is a low-exploitation-probability issue (EPSS 0.03%) with no confirmed active exploitation or public POC at time of analysis.
Address bar spoofing in Apple Safari, iOS, and iPadOS allows remote attackers to deceive users about the website they are visiting through malicious web content, exploiting a user interface flaw that fails to adequately distinguish legitimate from spoofed address bar information. The vulnerability affects Safari before version 18.6, iOS before 18.6, and iPadOS before 18.6, and requires user interaction to visit a malicious site. No public exploit code or active exploitation has been confirmed; the EPSS score of 0.04% reflects low real-world exploitation probability despite the network attack vector.
Information disclosure vulnerability in WebKit across Apple's ecosystem allows unauthenticated remote attackers to extract sensitive user information through maliciously crafted web content. The flaw affects Safari 18.x, iOS/iPadOS 18.x, macOS Sequoia 15.x, tvOS 18.x, visionOS 2.x, and watchOS 11.x, stemming from improper state management (CWE-359). Despite a CVSS score of 7.5, real-world exploitation risk remains relatively low with 0.13% EPSS probability and no public exploit identified at time of analysis. Vendor-released patches are available across all affected platforms.
Safari and Apple operating systems contain a use-after-free vulnerability in web content processing that causes unexpected application crashes when users visit maliciously crafted websites. The flaw affects Safari 18.5 and earlier, iOS 18.5 and earlier, iPadOS 18.5 and earlier (also iPadOS 17.7.8 and earlier), macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. Remote attackers can trigger a denial-of-service condition requiring only user interaction to visit a malicious page, with no elevated privileges required. Apple has released patches for all affected platforms; the EPSS score of 0.10% (28th percentile) indicates low real-world exploitation probability despite the accessibility of the attack vector.
Safari and related Apple platforms crash when processing maliciously crafted web content due to a memory handling vulnerability (buffer overflow). Affects Safari 18.5 and earlier, iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. An unauthenticated remote attacker can trigger a denial of service by hosting or injecting malicious web content, with user interaction required to visit the affected content. No public exploit code or active exploitation has been confirmed (EPSS 0.08% indicates minimal real-world exploitation activity to date).
Denial-of-service vulnerability in Apple's WebKit engine affects Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS through improper memory handling during web content processing. Local attackers without authentication can trigger this vulnerability via crafted web content to cause application crashes. Vendor-released patches are available across all affected platforms; EPSS score of 0.02% indicates minimal real-world exploitation likelihood despite the moderate CVSS 6.2 rating.
Memory corruption in Apple's WebKit browser engine across Safari 18.x, iOS/iPadOS 18.x, macOS Sequoia 15.x, and other Apple operating systems allows remote attackers to achieve arbitrary code execution via maliciously crafted web content requiring only user interaction (visiting a malicious webpage). With CVSS 8.8 (High), the vulnerability enables complete system compromise (high confidentiality, integrity, and availability impact) but carries relatively low real-world exploitation probability (EPSS 0.10%, 27th percentile). No public exploit identified at time of analysis, and vendor-released patches are available across all affected platforms as of July-August 2025.
Memory corruption in WebKit browser engine allows remote code execution across Apple's ecosystem (Safari 18.6, iOS/iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6) when users interact with maliciously crafted web content. The vulnerability stems from improper memory handling (CWE-119 buffer overflow) and requires no authentication but user interaction to trigger. EPSS score of 0.10% (26th percentile) indicates low observed exploitation probability, and no public exploit identified at time of analysis, though the CVSS 8.8 rating reflects the potential for complete system compromise if successfully exploited.
DNS resolve confusion in netavark, the Rust-based network stack for Podman containers, causes container name lookups to be forwarded to unexpected external DNS servers due to a regression that removed the dns.podman search domain. Affected deployments on Red Hat Enterprise Linux 8/9/10 and OpenShift Container Platform 4.0 running netavark < 1.15.1 are subject to misdirected container DNS resolution when host resolv.conf search domains contain a record matching a running container's hostname. The impact is limited to information disclosure (CVSS 3.7, Low), with no confirmed active exploitation and no public exploit identified at time of analysis.
Denial of service in the CPython standard-library 'tarfile' module allows remote attackers to hang any Python application that parses attacker-supplied tar archives. A maliciously crafted archive containing a header with a negative block offset causes the TarFile extraction and member-enumeration APIs (getmembers, extractall, iteration) to enter an infinite loop and deadlock, consuming the thread indefinitely. Rated CVSS 7.5 (availability-only); no public exploit is identified at time of analysis, EPSS is low at 0.61%, and it is not on CISA KEV, but the fix is upstream in CPython.
Buffer under-allocation in the Linux kernel HID (Human Interface Device) core subsystem allows a local low-privileged user to cause a kernel denial of service. When HID report IDs are not used, the transport layer expects the first byte to be 0x00 as a placeholder, but the allocated report buffer fails to account for this reserved byte - yielding only 7 usable bytes instead of 8. No active exploitation has been identified (not in CISA KEV; EPSS at 0.20%, 10th percentile), and impact is limited to availability with no confidentiality or integrity exposure.
Denial-of-service (kernel panic) in the Linux kernel's libwx network driver - the shared base module for Wangxun txgbe/ngbe Ethernet controllers - arises from a duplicate page_pool_put_full_page() call in the Rx path that double-frees page-pool pages, corrupting the free list and crashing the host (CWE-415). It affects 6.16 release-candidate kernels (rc1-rc6) on systems using Wangxun NICs and is triggered by ordinary received network traffic rather than a crafted payload. There is no public exploit identified at time of analysis and EPSS is very low (0.15%); the issue is a pre-release regression fixed upstream before the 6.16 final release.
Local privilege-context memory corruption in the Linux kernel's SMB/CIFS client (cifs.ko) arises from a use-after-free in crypt_message() when SMB3 encryption is offloaded to asynchronous hardware crypto accelerators. The prior CVE-2024-50047 fix removed async AEAD handling on the assumption all crypto is synchronous; when crypto_aead_encrypt/decrypt() returns -EINPROGRESS, the request buffer (creq) is freed by kvfree_sensitive() while the accelerator is still using it, causing kernel crashes (NULL pointer dereferences) and potential memory corruption. Affects kernels carrying the CVE-2024-50047 backport through 6.16-rc4; no public exploit identified at time of analysis and EPSS is low (0.28%).
Kernel panic via memory corruption in the Qualcomm SoundWire driver affects Linux 6.16-rc1 through 6.16-rc6 on systems using Qualcomm SDM845 SoC (e.g., Dragonboard 845c). The faulty commit introduced three distinct bugs in qcom_swrm_set_channel_map: an off-by-one that clobbers pconfig[0], an out-of-bounds write due to mismatched array sizes (tx_ch[] has 16 entries but pconfig[] only 15), and RX data overwriting TX channel configuration - collectively triggering a BRK exception at EL1 and kernel panic during audio subsystem probe. No public exploit is identified and EPSS is 0.12%, consistent with a regression bug rather than an attacker-targeted vulnerability; the primary risk is system unavailability on affected hardware.
Use-after-free in the Linux kernel's IIO FXLS8962AF/FXLS8964AF accelerometer driver (fxls8962af_fifo_flush) lets a race between FIFO-flush interrupt handling and buffer-mode teardown dereference a freed/NULL active_scan_mask, crashing the kernel. Affects systems running a vulnerable kernel (notably 6.16-rc1 through rc6 and backport-affected stable branches) that use the NXP fxls8962af IIO accelerometer. A vendor fix is available; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%).
Out-of-bounds write in the Linux kernel's Industrial I/O (IIO) backend debugfs interface allows a local user with write access to corrupt kernel memory by one byte beyond an 80-character buffer. The flaw affects 6.16 release-candidate kernels (rc1-rc6): after simple_write_to_buffer truncates an oversized write to the buffer size, a NUL string terminator is written at the (already maxed-out) offset without a bounds check. It is fixed upstream and has no public exploit identified at time of analysis; EPSS is very low (0.15%, 5th percentile).
Uninitialized kernel memory access in the Linux kernel's comedi data acquisition subsystem allows local low-privilege users to crash the system by submitting crafted ioctl instructions targeting subdevice handlers. The do_insn_ioctl() and do_insnlist_ioctl() functions allocate MIN_SAMPLES (16) data elements but only copy the first insn->n elements from user space for write-type instructions, leaving the remainder uninitialized; certain subdevice handlers read beyond insn->n, triggering undefined behavior that results in denial of service. No public exploit identified at time of analysis; EPSS of 0.16% (5th percentile) reflects very low exploitation probability, consistent with a niche kernel subsystem requiring specialized hardware.
Local privilege escalation and memory corruption in the Linux kernel's IPv6 RPL (Routing Protocol for Low-Power and Lossy Networks) source-routing subsystem, affecting the 6.16-rc development series. The rpl_do_srh_inline() function in net/ipv6/rpl_iptunnel.c dereferences a stale pointer to the IPv6 header after skb_cow_head() may have freed the underlying buffer, producing a use-after-free (CWE-416) that a local attacker can trigger by sending IPv6 packets through an RPL lightweight-tunnel route. No public exploit is identified at time of analysis and EPSS is very low (0.15%), consistent with a bug found via internal KASAN selftesting rather than in-the-wild abuse.
Kernel oops and double-free in Linux SMC networking code causes local denial of service through a struct type confusion between smc_sock and inet_sock. The smc_sock structure hijacks AF_INET/AF_INET6 sk_family without placing inet_sock as its first member, causing downstream INET infrastructure - specifically cipso_v4_sock_setattr() - to misinterpret the smc_sock.clcsk_data_ready function pointer (at offset 784) as an inet_sock.inet_opt IP options pointer and attempt to free read-only text-segment memory. No public exploit exists and EPSS is at the 3rd percentile, but syzbot confirmed reliable reproduction through Smack LSM + CIPSO interactions on affected kernels.
Kernel crash in Linux netfilter nf_conntrack allows local users to cause a denial of service via a race condition during connection tracking garbage collection and entry confirmation. Across multiple Linux kernel stable series through 6.16-rc6, a three-CPU race between conntrack garbage collection, slab memory recycling, and connection confirmation can corrupt an hlist pointer in an nf_conn structure, causing a kernel oops in __nf_ct_delete_from_lists(). No public exploit identified at time of analysis, and EPSS at 0.15% (5th percentile) confirms very low current exploitation probability, though the availability impact is severe - a kernel panic takes down the entire host.
Denial of service in Linux kernel net/sched subsystem allows local authenticated attackers to trigger a kernel panic (BUG_ON) by manipulating HTB qdisc (hierarchical token bucket queue discipline) configuration with nested qdisc classes, causing htb_lookup_leaf to encounter an empty rbtree. The vulnerability requires low privilege and local access; no special user interaction is needed once a malicious qdisc configuration is set up. Vendor-released patches are available across multiple stable kernel series.
Integer wraparound in Linux kernel netlink socket receive buffer accounting allows local authenticated attackers to exhaust kernel memory by bypassing receive buffer limits via integer overflow in sk_rmem_alloc comparison. An attacker with local access can set SO_RCVBUFFORCE to INT_MAX, causing the receive buffer check to always evaluate false and permitting unlimited socket buffer allocation until out-of-memory conditions occur. CVSS 5.5 indicates local denial of service with potential system-wide impact; no active exploitation confirmed but vulnerability affects all Linux distributions.
Use-after-free in the Linux kernel's TIPC (Transparent Inter-Process Communication) topology server allows a local attacker to corrupt kernel memory by racing network-namespace teardown against TIPC connection handling. The flaw, CWE-416, occurs because tipc_topsrv_stop() dereferences a tipc_conn after dropping the IDR lock while tipc_conn_recv_work() may have concurrently released the object's final reference. It carries a 7.8 (High) CVSS and is fixed upstream; there is no public exploit identified at time of analysis and its EPSS score is very low (0.17%).
Kernel denial-of-service in the Linux kernel TCP write path allows local, low-privileged users to corrupt the socket's forward memory allocation counter, potentially triggering a kernel panic or system instability. The flaw stems from a signedness mismatch in the skb remaining-space calculation where implicit C type promotion causes a large unsigned wraparound value to be zero-extended into a signed 64-bit variable, driving sk_forward_alloc toward INT_MAX. No public exploit identified at time of analysis beyond a Syzkaller fuzzer reproducer; EPSS of 0.15% (4th percentile) reflects low near-term exploitation probability and CISA KEV does not list this CVE.
Kernel denial-of-service in the Linux vsock subsystem allows a local low-privileged user to crash the system by winning a race between transport assignment and module unload, causing a stale pointer dereference in `vsock_assign_transport()`. The impact is limited strictly to availability - a kernel panic/oops - with no confidentiality or integrity loss. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.11% (2nd percentile) reflects the high attack complexity required to reliably win the race condition.
NULL pointer dereference in the Linux kernel ATM CLIP subsystem's to_atmarpd() function causes local denial of service via kernel panic. Systems running the ATM CLIP networking subsystem are affected across a broad range of kernel versions dating back to 2.6.12. A local, low-privileged attacker can trigger the flaw by causing neighbor solicitation (clip_neigh_solicit) to invoke to_atmarpd() without the required RTNL lock, allowing a race window where atmarpd can be dereferenced while NULL or concurrently freed. No public exploit exists and EPSS is 0.16% (6th percentile), reflecting the niche deployment footprint of ATM networking.
Denial of service in Linux kernel traffic control (qdisc) subsystem allows local authenticated attackers to crash the system by creating or modifying queue disciplines with invalid parent class references. When certain qdiscs (fq, hhf, choke, etc.) invoke qdisc_tree_reduce_backlog during initialization with a null parent class, they trigger an unhandled null pointer dereference. No active exploitation confirmed (KEV not listed), but CVSS 5.5 reflects local privilege requirement with high availability impact.
Local privilege-escalation-class memory corruption in the Linux kernel's IPMI message handler (ipmi_msghandler) affects the ipmi_create_user() code path, where a list iterator that fails to match the requested intf->intf_num is left pointing at an invalid list-head-derived address and then passed to atomic_dec(&intf->nr_users), corrupting kernel memory. Local low-privileged users interacting with the IPMI subsystem can trigger the flaw, and with a CVSS of 7.8 (high) it threatens full confidentiality, integrity, and availability of the host. This is no public exploit identified at time of analysis, and the low EPSS (0.15%) reflects a niche, hardware-dependent subsystem rather than a mass-exploitation target.
Kernel crash via NULL pointer dereference in the KVM SVM subsystem affects Linux systems running AMD SEV or SEV-ES confidential computing workloads when intra-host VM migration and vCPU creation race concurrently. A local attacker with KVM ioctl access can trigger the race to produce an SEV-ES VM containing a non-SEV-ES vCPU, causing a kernel page fault when that vCPU is freed - crashing the host and all running guests. No public exploit has been identified and EPSS sits at 0.15% (5th percentile), reflecting the narrow, specialized deployment conditions required.
Use-after-free in the Linux kernel io_uring msg_ring subsystem allows a local, low-privileged attacker to crash the kernel via denial of service. Specifically, io_kiocb request objects allocated by msg_ring are freed immediately rather than deferred through an RCU grace period, creating a race where task_work addition races against premature object reclamation. Confirmed by KASAN via syzbot on 6.16-rc4; no public exploit identified at time of analysis and EPSS is negligible at 0.14% (4th percentile).
A general protection fault (GPF) in the Linux kernel's md-bitmap module affects the bitmap_get_stats() function when reading bitmap statistics for RAID devices with external bitmaps. Local users with sufficient privileges can trigger a kernel panic by accessing bitmap statistics through the /proc interface, causing denial of service. The vulnerability stems from incomplete validation of bitmap storage configuration introduced by a prior fix that failed to properly check superblock validity for both internal and external bitmap modes.
Use-after-free in the Linux kernel's DRM/GEM graphics subsystem allows a local user to crash the kernel by prematurely releasing a GEM handle while its buffer object remains attached to a DRM framebuffer, freeing the underlying dma-buf. Drivers using shadow planes to vmap the dma-buf during page flips (notably drm_gem_shmem-based drivers) then dereference the freed pointer during mode-setting, producing a kernel OOPS or WARNING and a denial of service. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.15% (4th percentile) confirms exploitation is rare and targeted rather than opportunistic.
Out-of-bounds page table read in the Linux kernel's memory-management rmap subsystem (mm/rmap) allows a local low-privileged user to trigger disclosure of adjacent kernel memory or a crash via the batched unmap path in try_to_unmap_one(). The flaw affects 6.16 release-candidate kernels (6.16-rc1 through rc5) where a large folio's PTE mappings span beyond a single page table, causing folio_unmap_pte_batch scanning to read past the end of a PTE table. Rated CVSS 7.1 (high) with high confidentiality and availability impact; EPSS is very low at 0.16% and there is no public exploit identified at time of analysis.
Out-of-bounds memory access in the Linux kernel's NXP i.MX clock driver (clk-imx) affects 6.16 release candidates rc1 through rc5 running on i.MX95 hardware, where the dispmix_csr_clk_dev_data table uses a hardcoded parent-name count that overruns the parent_names array when num_parents is 4. Triggered automatically during device probe (imx95_bc_probe → __clk_register), it reads eight bytes past a global array, causing memory disclosure into pointer handling and potential kernel instability, as caught by KASAN. There is no public exploit identified at time of analysis and EPSS is negligible (0.15%, 5th percentile), consistent with a hardware- and pre-release-specific defect rather than a broadly exploitable flaw.
NULL pointer dereference in the Linux kernel's mlx5e Ethernet driver (mlx5_core module) causes kernel panic on systems equipped with Mellanox/NVIDIA ConnectX NICs. The race condition between DIM (Dynamic Interrupt Moderation) teardown and concurrent NAPI polling allows a local attacker with low privileges to crash the system, resulting in a complete denial of service. No public exploit code exists and EPSS is 0.11% (1st percentile), indicating near-zero opportunistic exploitation risk; however, the crash can also be triggered spontaneously on production systems under heavy NIC load during DIM reconfiguration.
Incorrect DMA unmap length in the Linux kernel bnxt_en driver during XDP_REDIRECT packet transmission triggers kernel warnings and potential availability disruption on systems with IOMMU enabled. Systems running Broadcom NetXtreme Ethernet adapters with IOMMU active and XDP_REDIRECT workloads are affected across multiple stable kernel branches. No public exploit exists and EPSS sits at 0.17% (7th percentile), marking this as a stability and correctness bug rather than a targeted security threat; no active exploitation has been identified.
Local privilege escalation and memory corruption in the Linux kernel's ksmbd in-kernel SMB3 server arises from a use-after-free in the oplock/lease break acknowledgment path, where a failed ksmbd_iov_pin_rsp() response allocation leads to opinfo->state being accessed after free and opinfo_put()/ksmbd_fd_put() being invoked twice. Affected builds include the 6.16 release-candidate series and Debian-packaged stable kernels running ksmbd; an authenticated SMB client interacting with a shared file can trigger the flaw for potential code execution or information disclosure. There is no public exploit identified at time of analysis and EPSS is low (0.15%), but the fix is already merged upstream and shipped via Debian LTS.
Linux kernel DRM scheduler fails to signal scheduled fences when killing job entities, causing dependent applications to hang indefinitely waiting for unresolved dependencies. Authenticated local users can trigger this denial of service by terminating applications whose job dependencies are not properly cleared during entity kill operations. The vulnerability affects multiple Linux kernel versions and has been patched upstream.
Vector register context corruption in the Linux kernel's RISC-V xtheadvector extension causes registers v8-v31 to be damaged during context save/restore operations, breaking userspace processes that rely on those registers. Affected systems must be running RISC-V hardware with the T-Head (xtheadvector) vendor extension and a Linux kernel prior to the stable tree fix. No public exploit exists and EPSS is extremely low (0.14%, 4th percentile), reflecting both the narrow hardware scope and the local-only attack vector; no active exploitation confirmed.
Kernel denial-of-service on RISC-V Linux systems stems from a flawed optimization to the access_ok() boundary check that allowed invalid addresses between TASK_SIZE and LONG_MAX to pass validation. Commit ad5643cf2f69 set TASK_SIZE_MAX to LONG_MAX for performance, but get_user_pages_fast() - invoked by syscalls such as futex() - trusts access_ok() and does not rely on hardware-level rejection of those addresses, triggering kernel faults. A local low-privileged user on an affected RISC-V system can cause a kernel crash; no public exploit is identified and EPSS probability is 0.16% (5th percentile), consistent with RISC-V's limited deployment footprint.
Race condition in the Linux kernel's MHI (Mobile Host Interface) endpoint driver allows a local low-privileged user to trigger data corruption by exploiting a premature read pointer update in mhi_ep_ring_add_element. Specifically, rd_offset is advanced before the ring buffer element is fully written, allowing the remote host to read uninitialized or incomplete data from the MHI ring - resulting in data corruption and potential availability loss. No public exploit identified at time of analysis; four stable-branch patches are available at kernel.org.
Linux kernel RAS (Reliability, Availability, Serviceability) header validation in the AMD GPU driver (amdgpu) lacks input sanitization, allowing a local authenticated attacker to trigger denial of service through excessive memory allocation when reading corrupted EEPROM data. The vulnerability affects all Linux kernel versions with the vulnerable amdgpu driver code path and requires local access with standard user privileges. No public exploit code has been identified; the EPSS score of 0.02% (5th percentile) indicates low real-world exploitation probability despite the moderate CVSS 5.5 rating.
Out-of-bounds memory access in the Linux kernel's NVIDIA Tegra I2C driver (i2c-tegra) lets a malicious or malfunctioning SMBus peripheral trigger a buffer over-read during an SMBus block read, because the driver trusted the device-supplied message length without validating it. A local attacker able to control an attached I2C/SMBus device, or to drive such a transfer, can leak adjacent kernel memory or crash the system. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and it is not on CISA KEV.
Kernel crash via use-after-teardown in the Linux perf subsystem allows a local low-privileged user to trigger a denial of service by exploiting a lifecycle ordering bug in do_exit(). Perf event sampling (PERF_SAMPLE_CALLCHAIN, PERF_SAMPLE_STACK_USER) occurs after exit_mmap() has already begun dismantling the process address space, causing the kernel to access unmapped or MMIO memory - confirmed on ARM64 as a synchronous external abort. Multiple stable kernel branches are affected, patches are available across eight upstream stable commits and Debian LTS; no active exploitation is confirmed (not in CISA KEV) and EPSS is 0.17% (7th percentile).
Out-of-bounds read/write in the Linux kernel's lan743x network driver affects systems using Microchip PCI1xxxx (hearthstone) Ethernet controllers, where incorrect OTP (8 Kb) and EEPROM (64 Kb) maximum size definitions allowed access beyond the intended memory bounds during EEPROM/OTP operations. A local user with the ability to invoke the driver's EEPROM/OTP read/write paths could trigger memory corruption, potentially leading to code execution or privilege escalation (CVSS 7.8). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS risk is low (0.16%, 6th percentile).
Local privilege escalation and denial of service in the Linux kernel's AMD Platform Management Framework (amd-pmf) driver stems from a double-free (CWE-415) triggered when Smart PC setup fails: dev->buf is freed but not nulled, then freed again during amd_pmf_remove(). The fix converts the driver's allocations to device-managed (devm_*) allocations. No public exploit identified at time of analysis, and EPSS probability is low (0.15%), consistent with a hard-to-reach local-only kernel bug affecting AMD systems on kernels around 6.14-6.16-rc.
Local privilege-relevant memory-safety flaw in the Linux kernel's NFC NCI UART line-discipline driver (drivers/nfc/nci/uart.c) allows a local attacker to trigger use of a partially-initialized tty->disc_data pointer. The driver assigned tty->disc_data before the NCI device was successfully opened, so if the underlying hardware sent data (or the NCIUARTSETDRIVER ioctl failed) during that window, code paths could operate on a device object that was never fully set up or was torn down on error. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.18%, 8th percentile); the issue was fixed upstream by exposing disc_data only on the success path.
Out-of-bounds shift in the Linux kernel Squashfs filesystem allows a local attacker to trigger memory corruption by racing a LOOP_SET_BLOCK_SIZE ioctl against a concurrent Squashfs mount on the same loop device, causing sb_min_blocksize() to return 0 and the code in squashfs_fill_super() to compute a shift exponent of 64. The affected subsystem is the kernel Squashfs driver (fs/squashfs/block.c) on Linux and downstream distributions such as Debian 11. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Incorrect frame length validation in the Linux kernel's virtio-net XDP socket (AF_XDP/XSK) receive path allows a local low-privileged attacker to trigger a kernel availability failure. The `buf_to_xdp` function incorrectly permits the first receive buffer's frame data to reach `xsk_pool_get_rx_frame_size() + vi->hdr_len` bytes, when the virtio header already occupies space within that first buffer, capping valid data at `xsk_pool_get_rx_frame_size()`. No public exploit code has been identified and EPSS sits at the 5th percentile, reflecting low real-world exploitation probability at this time.
Denial of service in the Linux kernel's dell-wmi-sysman platform driver allows a local low-privileged user to crash the system by triggering an invalid pointer dereference in sysfs callbacks. The driver fails to validate WMI data block pointers after retrieval before dereferencing them, affecting Dell hardware running unpatched kernel versions including the 6.16-rc series and Debian Linux 11.0. No active exploitation has been confirmed - EPSS sits at the 5th percentile and the vulnerability is absent from CISA KEV, making this a low-urgency patch for most environments.
Local privilege escalation and memory corruption in the Linux kernel's netfs (network filesystem) subsystem affects development builds 6.16-rc1 through 6.16-rc4, where a reference-counting error causes a double put of a netfs request. When a netfs request completes during the pause loop, the reference tied to the IN_PROGRESS flag is dropped, but the subsequent final wait loop erroneously drops it again, leading to a use-after-free/double-free condition (CWE-415). CVSS is 7.8 (High) requiring low-privileged local access; EPSS is low at 0.15% and there is no public exploit identified at time of analysis.
Continuous kernel memory exhaustion in the Linux nvmet (NVMe-over-Fabrics target) subsystem leaks kmalloc-128 slab entries via bio->bi_integrity on every NVMe command with metadata, eventually degrading or denying service on affected target systems. Systems running Linux kernel through 6.16-rc4 as NVMe-oF targets and processing metadata-bearing I/O commands are affected. No public exploit code exists and EPSS is 0.15% (5th percentile), indicating low near-term exploitation probability; this is a correctness regression from a kernel block-layer change rather than a security-targeted attack surface.
Local privilege escalation and memory corruption in the Linux kernel's MediaTek MMC/SD host controller driver (mtk-sd) occurs because msdc_start_data() proceeds with a DMA transfer using stale settings after msdc_prepare_data() fails to map the DMA region. An attacker with local access to a system using MediaTek SD/MMC hardware can trigger an out-of-bounds write (CWE-787) leading to kernel memory corruption with high confidentiality, integrity, and availability impact. This is a code-quality/robustness fix in mainline kernel development (regression affects 6.16 release candidates and backported stable branches); there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.17%, 7th percentile).
Linux kernel NFS subsystem fails to clean up /proc/net/rpc/nfs directory when nfs_fs_proc_net_init() encounters a memory allocation failure, causing a warning when rpc_proc_exit() later attempts to remove the non-empty parent directory. The vulnerability affects kernel versions 6.16-rc1 through 6.16-rc3 and likely earlier versions, and requires local privileges to trigger via fault injection or memory pressure. While marked as availability impact (DoS via kernel warning), the practical severity is limited as it primarily causes a procfs resource leak rather than direct system compromise.
NULL pointer dereference in the Linux kernel SCSI target subsystem crashes the kernel when processing a malformed SCSI-3 Persistent Reservation SPEC_I_PT command. A local, low-privileged user with access to SCSI target infrastructure can trigger the bug by issuing a PR SPEC_I_PT operation that fails to locate the destination target port group, causing `core_scsi3_decode_spec_i_port()` to call `core_scsi3_lunacl_undepend_item()` with a NULL `dest_se_deve` pointer. Impact is limited to a denial-of-service kernel panic; no exploitation is confirmed in CISA KEV, and EPSS sits at the 5th percentile, indicating very low real-world exploitation probability.
Out-of-bounds heap write in the Linux kernel's spi-qpic-snand driver corrupts kernel memory on Qualcomm NAND-equipped devices, resulting in kernel panics, swiotlb mapping failures, and spinlock corruption. The flaw triggers whenever NAND flash operations require more than one codeword - a quantity determined by the chip's page size that is unknown at probe time - causing the BAM transaction buffer, allocated for only a single codeword, to be overrun. Real-world impact is denial of service via kernel crash; EPSS is 0.13% (3rd percentile), no public exploit exists, and the vulnerability is not listed in CISA KEV.
Local privilege/security-policy bypass in the Linux kernel's secretmem subsystem allows LSM and SELinux access controls to be evaded on secretmem file descriptors because the S_PRIVATE flag was left set after alloc_anon_inode(), causing inode_init_security_anon() checks to be skipped. The affected code paths are the anonymous-inode helpers used by secretmem (memfd_secret) and KVM guest_memfd, present in Linux 6.16 release candidates and a Debian backport. There is no public exploit identified and EPSS is very low (0.16%), so the practical impact is a defense-in-depth regression that lets a local process create secretmem objects that mandatory-access-control policy should have denied.
Out-of-bounds access in the Linux kernel's GPIO-based regulator driver (regulator/gpio) allows a local, low-privileged actor to trigger memory corruption on systems where the regulator is configured with more than one GPIO (config::ngpios > 1). The driver under-allocated the drvdata::gpiods array to hold a single gpio_desc pointer instead of ngpios pointers, so subsequent indexing reads beyond the allocation. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not in CISA KEV.
Use-after-free in the Linux kernel ACPICA interpreter crashes the system when platform firmware AML calls a method with fewer arguments than its definition requires. Local attackers with low privileges on systems running such buggy firmware can trigger a kernel panic, resulting in a denial of service. No public exploit code exists and EPSS sits at 0.17% (6th percentile), reflecting the narrow firmware-dependent trigger condition and limited exploitation interest.
Btrfs log replay in the Linux kernel crashes due to use of an uninitialized variable in extended reference (extref) iteration, causing a kernel denial of service for local users. In `__inode_add_ref()`, a `goto` jump skips the initialization of `victim_name.len`, so the next loop iteration reads an undefined stack value and performs an invalid memory access. No public exploit code exists and EPSS places exploitation probability at 0.16% (5th percentile), confirming negligible active-exploitation risk; this is not listed in the CISA KEV catalog.
Kernel warning triggering denial of service in the Linux SMB client subsystem affects systems using SMB multichannel. During channel reconnection in smb2_reconnect_server(), a dummy tcon structure with an uninitialized ->query_interface pointer is incorrectly passed to smb2_reconnect(), which then calls queue_delayed_work() on the invalid struct, firing a WARN_ON in the kernel workqueue at __queue_delayed_work+0x1d2/0x200. The result is potential kernel instability or crash on any Linux host using CIFS multichannel mounts; no active exploitation is confirmed, EPSS is 0.15% (4th percentile), and upstream patch commits are available across multiple stable branches.
Local privilege escalation via use-after-free in the Linux kernel's ROSE (amateur-radio X.25 PLP) networking stack, where rose_rt_device_down() mishandles neighbour-array compaction and leaves dangling rose_neigh pointers. A local attacker able to manipulate ROSE routing/devices can trigger access to freed kernel memory (CWE-416), enabling memory corruption that can lead to full compromise (confidentiality, integrity, and availability all High). No public exploit identified at time of analysis; EPSS is very low at 0.16% (6th percentile) and it is not on CISA KEV.
Out-of-bounds read in the Linux kernel virtio-net driver (through 6.16-rc3 and affected stable branches) lets a malicious or buggy virtio backend trigger a read past the allocated buffer inside xdp_linearize_page when XDP is used on the interface. The flaw stems from the driver reading follow-on ring buffers without validating that the reported received length fits within the allocated page, enabling potential information disclosure or a guest crash. There is no public exploit identified at time of analysis, and EPSS is very low (0.17%, 7th percentile), consistent with a hard-to-weaponize local kernel memory-safety bug.
Unsafe XArray access in the Linux kernel's RDMA mlx5_ib driver causes a lockdep warning and potential kernel panic on systems using Mellanox/NVIDIA InfiniBand hardware with implicit On-Demand Paging (ODP). The non-locking xarray variants __xa_store() and __xa_erase() were called inside the mlx5 page fault handler pagefault_mr() without holding the required XArray spinlock, violating RCU protection invariants. A local low-privilege user on an affected system can trigger this condition via RDMA page fault events, causing kernel denial of service. No public exploit exists and EPSS is at the 4th percentile, indicating this is a kernel stability concern rather than an imminent exploitation target.
Local privilege escalation and denial of service in the Linux kernel's LoongArch KVM hypervisor arises from an array index overflow when handling writes to the EIOINTC_ENABLE register of the emulated extended I/O interrupt controller. Affecting mainline 6.16 release candidates (rc1-rc3) on LoongArch hosts, a low-privileged actor able to program the virtual interrupt controller can write out of the bounds of a kernel array, corrupting memory with high confidentiality, integrity, and availability impact (CVSS 7.8). There is no public exploit identified at time of analysis and EPSS probability is low (0.14%, 4th percentile).
Local privilege escalation and host memory corruption in the Linux kernel's LoongArch KVM hypervisor (6.16 release candidates rc1-rc3) arises because the EIOINTC virtual irqchip fails to validate a user-space-supplied 'num_cpu' value against EIOINTC_ROUTE_MAX_VCPUS, allowing an array pointer overflow. A local user with permission to create KVM virtual machines can trigger out-of-bounds access in host kernel memory. No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile) and the issue was fixed upstream before the 6.16 final release.
Btrfs in the Linux kernel contains a race condition between same-directory rename operations and directory inode logging that can cause permanent, unrecoverable file loss after a crash or power failure. When a rename removes the old directory entry but has not yet inserted the new one, a concurrent fsync of a related inode can log the parent directory in this transient, inconsistent state and persist it to the log tree. If a power failure occurs immediately after that log flush, log replay on the next mount deletes the renamed file entirely, with no remaining hard links to recover it. No public exploit has been identified at time of analysis; the EPSS score of 0.11% (2nd percentile) reflects low opportunistic exploitation probability, though the impact for affected btrfs deployments is severe and permanent.
Null pointer dereference in Linux kernel maple_tree memory allocator causes denial of service when the MA_STATE_PREALLOC flag is incorrectly managed during node allocation requests. Local authenticated attackers can trigger this via memory operations that request large numbers of nodes, such as VMA merges during mmap_region() calls, leading to WARN_ON() messages followed by kernel crash. Affects Linux kernel versions including 6.16 release candidates and is confirmed patched in stable branches.
A null pointer dereference vulnerability exists in the AMD display driver within the Linux kernel, where the dce_hwseq structure is accessed without proper null checking in the dce110_blank_stream function. The vulnerability affects Linux kernel versions up to 6.16-rc2 and could allow a local attacker with low privileges to cause a system crash or potentially execute arbitrary code with kernel privileges. With an EPSS score of only 0.02% and no known active exploitation, this represents a low real-world risk despite the high CVSS score.
A vulnerability was found in Keycloak-services. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the `convert_tf_weight_name_to_pt_weight_name()` function. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
OpenJPEG is an open-source JPEG 2000 codec. Rated medium severity (CVSS 6.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Russh is a Rust SSH client & server library. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A flaw was found in the Ansible aap-gateway. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
Grafana is an open-source platform for monitoring and observability. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv). Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required.
In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required.
Traefik is an HTTP reverse proxy and load balancer. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Squid is a caching proxy for the Web. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
jose v6.0.10 was discovered to contain weak encryption. Rated high severity (CVSS 7.0), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Out-of-bounds read in Apple Safari and system WebKit implementations allows local attackers to disclose internal application state by processing maliciously crafted web content, affecting Safari 18.5 and earlier, iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. The vulnerability requires local access and user interaction but poses information disclosure risk with CVSS 4.0 and EPSS 0.02% (very low exploitation probability); no public exploit code or active exploitation has been identified.
Safari and macOS contain a logic flaw that allows incorrect association of a download's origin, potentially disclosing information about file provenance to local attackers. The vulnerability affects Safari 18.6 and earlier, plus macOS Sequoia 15.6 and earlier, and requires local access (no authentication needed) to exploit. This is a low-exploitation-probability issue (EPSS 0.03%) with no confirmed active exploitation or public POC at time of analysis.
Address bar spoofing in Apple Safari, iOS, and iPadOS allows remote attackers to deceive users about the website they are visiting through malicious web content, exploiting a user interface flaw that fails to adequately distinguish legitimate from spoofed address bar information. The vulnerability affects Safari before version 18.6, iOS before 18.6, and iPadOS before 18.6, and requires user interaction to visit a malicious site. No public exploit code or active exploitation has been confirmed; the EPSS score of 0.04% reflects low real-world exploitation probability despite the network attack vector.
Information disclosure vulnerability in WebKit across Apple's ecosystem allows unauthenticated remote attackers to extract sensitive user information through maliciously crafted web content. The flaw affects Safari 18.x, iOS/iPadOS 18.x, macOS Sequoia 15.x, tvOS 18.x, visionOS 2.x, and watchOS 11.x, stemming from improper state management (CWE-359). Despite a CVSS score of 7.5, real-world exploitation risk remains relatively low with 0.13% EPSS probability and no public exploit identified at time of analysis. Vendor-released patches are available across all affected platforms.
Safari and Apple operating systems contain a use-after-free vulnerability in web content processing that causes unexpected application crashes when users visit maliciously crafted websites. The flaw affects Safari 18.5 and earlier, iOS 18.5 and earlier, iPadOS 18.5 and earlier (also iPadOS 17.7.8 and earlier), macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. Remote attackers can trigger a denial-of-service condition requiring only user interaction to visit a malicious page, with no elevated privileges required. Apple has released patches for all affected platforms; the EPSS score of 0.10% (28th percentile) indicates low real-world exploitation probability despite the accessibility of the attack vector.
Safari and related Apple platforms crash when processing maliciously crafted web content due to a memory handling vulnerability (buffer overflow). Affects Safari 18.5 and earlier, iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. An unauthenticated remote attacker can trigger a denial of service by hosting or injecting malicious web content, with user interaction required to visit the affected content. No public exploit code or active exploitation has been confirmed (EPSS 0.08% indicates minimal real-world exploitation activity to date).
Denial-of-service vulnerability in Apple's WebKit engine affects Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS through improper memory handling during web content processing. Local attackers without authentication can trigger this vulnerability via crafted web content to cause application crashes. Vendor-released patches are available across all affected platforms; EPSS score of 0.02% indicates minimal real-world exploitation likelihood despite the moderate CVSS 6.2 rating.
Memory corruption in Apple's WebKit browser engine across Safari 18.x, iOS/iPadOS 18.x, macOS Sequoia 15.x, and other Apple operating systems allows remote attackers to achieve arbitrary code execution via maliciously crafted web content requiring only user interaction (visiting a malicious webpage). With CVSS 8.8 (High), the vulnerability enables complete system compromise (high confidentiality, integrity, and availability impact) but carries relatively low real-world exploitation probability (EPSS 0.10%, 27th percentile). No public exploit identified at time of analysis, and vendor-released patches are available across all affected platforms as of July-August 2025.
Memory corruption in WebKit browser engine allows remote code execution across Apple's ecosystem (Safari 18.6, iOS/iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6) when users interact with maliciously crafted web content. The vulnerability stems from improper memory handling (CWE-119 buffer overflow) and requires no authentication but user interaction to trigger. EPSS score of 0.10% (26th percentile) indicates low observed exploitation probability, and no public exploit identified at time of analysis, though the CVSS 8.8 rating reflects the potential for complete system compromise if successfully exploited.
DNS resolve confusion in netavark, the Rust-based network stack for Podman containers, causes container name lookups to be forwarded to unexpected external DNS servers due to a regression that removed the dns.podman search domain. Affected deployments on Red Hat Enterprise Linux 8/9/10 and OpenShift Container Platform 4.0 running netavark < 1.15.1 are subject to misdirected container DNS resolution when host resolv.conf search domains contain a record matching a running container's hostname. The impact is limited to information disclosure (CVSS 3.7, Low), with no confirmed active exploitation and no public exploit identified at time of analysis.
Denial of service in the CPython standard-library 'tarfile' module allows remote attackers to hang any Python application that parses attacker-supplied tar archives. A maliciously crafted archive containing a header with a negative block offset causes the TarFile extraction and member-enumeration APIs (getmembers, extractall, iteration) to enter an infinite loop and deadlock, consuming the thread indefinitely. Rated CVSS 7.5 (availability-only); no public exploit is identified at time of analysis, EPSS is low at 0.61%, and it is not on CISA KEV, but the fix is upstream in CPython.
Buffer under-allocation in the Linux kernel HID (Human Interface Device) core subsystem allows a local low-privileged user to cause a kernel denial of service. When HID report IDs are not used, the transport layer expects the first byte to be 0x00 as a placeholder, but the allocated report buffer fails to account for this reserved byte - yielding only 7 usable bytes instead of 8. No active exploitation has been identified (not in CISA KEV; EPSS at 0.20%, 10th percentile), and impact is limited to availability with no confidentiality or integrity exposure.
Denial-of-service (kernel panic) in the Linux kernel's libwx network driver - the shared base module for Wangxun txgbe/ngbe Ethernet controllers - arises from a duplicate page_pool_put_full_page() call in the Rx path that double-frees page-pool pages, corrupting the free list and crashing the host (CWE-415). It affects 6.16 release-candidate kernels (rc1-rc6) on systems using Wangxun NICs and is triggered by ordinary received network traffic rather than a crafted payload. There is no public exploit identified at time of analysis and EPSS is very low (0.15%); the issue is a pre-release regression fixed upstream before the 6.16 final release.
Local privilege-context memory corruption in the Linux kernel's SMB/CIFS client (cifs.ko) arises from a use-after-free in crypt_message() when SMB3 encryption is offloaded to asynchronous hardware crypto accelerators. The prior CVE-2024-50047 fix removed async AEAD handling on the assumption all crypto is synchronous; when crypto_aead_encrypt/decrypt() returns -EINPROGRESS, the request buffer (creq) is freed by kvfree_sensitive() while the accelerator is still using it, causing kernel crashes (NULL pointer dereferences) and potential memory corruption. Affects kernels carrying the CVE-2024-50047 backport through 6.16-rc4; no public exploit identified at time of analysis and EPSS is low (0.28%).
Kernel panic via memory corruption in the Qualcomm SoundWire driver affects Linux 6.16-rc1 through 6.16-rc6 on systems using Qualcomm SDM845 SoC (e.g., Dragonboard 845c). The faulty commit introduced three distinct bugs in qcom_swrm_set_channel_map: an off-by-one that clobbers pconfig[0], an out-of-bounds write due to mismatched array sizes (tx_ch[] has 16 entries but pconfig[] only 15), and RX data overwriting TX channel configuration - collectively triggering a BRK exception at EL1 and kernel panic during audio subsystem probe. No public exploit is identified and EPSS is 0.12%, consistent with a regression bug rather than an attacker-targeted vulnerability; the primary risk is system unavailability on affected hardware.
Use-after-free in the Linux kernel's IIO FXLS8962AF/FXLS8964AF accelerometer driver (fxls8962af_fifo_flush) lets a race between FIFO-flush interrupt handling and buffer-mode teardown dereference a freed/NULL active_scan_mask, crashing the kernel. Affects systems running a vulnerable kernel (notably 6.16-rc1 through rc6 and backport-affected stable branches) that use the NXP fxls8962af IIO accelerometer. A vendor fix is available; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%).
Out-of-bounds write in the Linux kernel's Industrial I/O (IIO) backend debugfs interface allows a local user with write access to corrupt kernel memory by one byte beyond an 80-character buffer. The flaw affects 6.16 release-candidate kernels (rc1-rc6): after simple_write_to_buffer truncates an oversized write to the buffer size, a NUL string terminator is written at the (already maxed-out) offset without a bounds check. It is fixed upstream and has no public exploit identified at time of analysis; EPSS is very low (0.15%, 5th percentile).
Uninitialized kernel memory access in the Linux kernel's comedi data acquisition subsystem allows local low-privilege users to crash the system by submitting crafted ioctl instructions targeting subdevice handlers. The do_insn_ioctl() and do_insnlist_ioctl() functions allocate MIN_SAMPLES (16) data elements but only copy the first insn->n elements from user space for write-type instructions, leaving the remainder uninitialized; certain subdevice handlers read beyond insn->n, triggering undefined behavior that results in denial of service. No public exploit identified at time of analysis; EPSS of 0.16% (5th percentile) reflects very low exploitation probability, consistent with a niche kernel subsystem requiring specialized hardware.
Local privilege escalation and memory corruption in the Linux kernel's IPv6 RPL (Routing Protocol for Low-Power and Lossy Networks) source-routing subsystem, affecting the 6.16-rc development series. The rpl_do_srh_inline() function in net/ipv6/rpl_iptunnel.c dereferences a stale pointer to the IPv6 header after skb_cow_head() may have freed the underlying buffer, producing a use-after-free (CWE-416) that a local attacker can trigger by sending IPv6 packets through an RPL lightweight-tunnel route. No public exploit is identified at time of analysis and EPSS is very low (0.15%), consistent with a bug found via internal KASAN selftesting rather than in-the-wild abuse.
Kernel oops and double-free in Linux SMC networking code causes local denial of service through a struct type confusion between smc_sock and inet_sock. The smc_sock structure hijacks AF_INET/AF_INET6 sk_family without placing inet_sock as its first member, causing downstream INET infrastructure - specifically cipso_v4_sock_setattr() - to misinterpret the smc_sock.clcsk_data_ready function pointer (at offset 784) as an inet_sock.inet_opt IP options pointer and attempt to free read-only text-segment memory. No public exploit exists and EPSS is at the 3rd percentile, but syzbot confirmed reliable reproduction through Smack LSM + CIPSO interactions on affected kernels.
Kernel crash in Linux netfilter nf_conntrack allows local users to cause a denial of service via a race condition during connection tracking garbage collection and entry confirmation. Across multiple Linux kernel stable series through 6.16-rc6, a three-CPU race between conntrack garbage collection, slab memory recycling, and connection confirmation can corrupt an hlist pointer in an nf_conn structure, causing a kernel oops in __nf_ct_delete_from_lists(). No public exploit identified at time of analysis, and EPSS at 0.15% (5th percentile) confirms very low current exploitation probability, though the availability impact is severe - a kernel panic takes down the entire host.
Denial of service in Linux kernel net/sched subsystem allows local authenticated attackers to trigger a kernel panic (BUG_ON) by manipulating HTB qdisc (hierarchical token bucket queue discipline) configuration with nested qdisc classes, causing htb_lookup_leaf to encounter an empty rbtree. The vulnerability requires low privilege and local access; no special user interaction is needed once a malicious qdisc configuration is set up. Vendor-released patches are available across multiple stable kernel series.
Integer wraparound in Linux kernel netlink socket receive buffer accounting allows local authenticated attackers to exhaust kernel memory by bypassing receive buffer limits via integer overflow in sk_rmem_alloc comparison. An attacker with local access can set SO_RCVBUFFORCE to INT_MAX, causing the receive buffer check to always evaluate false and permitting unlimited socket buffer allocation until out-of-memory conditions occur. CVSS 5.5 indicates local denial of service with potential system-wide impact; no active exploitation confirmed but vulnerability affects all Linux distributions.
Use-after-free in the Linux kernel's TIPC (Transparent Inter-Process Communication) topology server allows a local attacker to corrupt kernel memory by racing network-namespace teardown against TIPC connection handling. The flaw, CWE-416, occurs because tipc_topsrv_stop() dereferences a tipc_conn after dropping the IDR lock while tipc_conn_recv_work() may have concurrently released the object's final reference. It carries a 7.8 (High) CVSS and is fixed upstream; there is no public exploit identified at time of analysis and its EPSS score is very low (0.17%).
Kernel denial-of-service in the Linux kernel TCP write path allows local, low-privileged users to corrupt the socket's forward memory allocation counter, potentially triggering a kernel panic or system instability. The flaw stems from a signedness mismatch in the skb remaining-space calculation where implicit C type promotion causes a large unsigned wraparound value to be zero-extended into a signed 64-bit variable, driving sk_forward_alloc toward INT_MAX. No public exploit identified at time of analysis beyond a Syzkaller fuzzer reproducer; EPSS of 0.15% (4th percentile) reflects low near-term exploitation probability and CISA KEV does not list this CVE.
Kernel denial-of-service in the Linux vsock subsystem allows a local low-privileged user to crash the system by winning a race between transport assignment and module unload, causing a stale pointer dereference in `vsock_assign_transport()`. The impact is limited strictly to availability - a kernel panic/oops - with no confidentiality or integrity loss. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.11% (2nd percentile) reflects the high attack complexity required to reliably win the race condition.
NULL pointer dereference in the Linux kernel ATM CLIP subsystem's to_atmarpd() function causes local denial of service via kernel panic. Systems running the ATM CLIP networking subsystem are affected across a broad range of kernel versions dating back to 2.6.12. A local, low-privileged attacker can trigger the flaw by causing neighbor solicitation (clip_neigh_solicit) to invoke to_atmarpd() without the required RTNL lock, allowing a race window where atmarpd can be dereferenced while NULL or concurrently freed. No public exploit exists and EPSS is 0.16% (6th percentile), reflecting the niche deployment footprint of ATM networking.
Denial of service in Linux kernel traffic control (qdisc) subsystem allows local authenticated attackers to crash the system by creating or modifying queue disciplines with invalid parent class references. When certain qdiscs (fq, hhf, choke, etc.) invoke qdisc_tree_reduce_backlog during initialization with a null parent class, they trigger an unhandled null pointer dereference. No active exploitation confirmed (KEV not listed), but CVSS 5.5 reflects local privilege requirement with high availability impact.
Local privilege-escalation-class memory corruption in the Linux kernel's IPMI message handler (ipmi_msghandler) affects the ipmi_create_user() code path, where a list iterator that fails to match the requested intf->intf_num is left pointing at an invalid list-head-derived address and then passed to atomic_dec(&intf->nr_users), corrupting kernel memory. Local low-privileged users interacting with the IPMI subsystem can trigger the flaw, and with a CVSS of 7.8 (high) it threatens full confidentiality, integrity, and availability of the host. This is no public exploit identified at time of analysis, and the low EPSS (0.15%) reflects a niche, hardware-dependent subsystem rather than a mass-exploitation target.
Kernel crash via NULL pointer dereference in the KVM SVM subsystem affects Linux systems running AMD SEV or SEV-ES confidential computing workloads when intra-host VM migration and vCPU creation race concurrently. A local attacker with KVM ioctl access can trigger the race to produce an SEV-ES VM containing a non-SEV-ES vCPU, causing a kernel page fault when that vCPU is freed - crashing the host and all running guests. No public exploit has been identified and EPSS sits at 0.15% (5th percentile), reflecting the narrow, specialized deployment conditions required.
Use-after-free in the Linux kernel io_uring msg_ring subsystem allows a local, low-privileged attacker to crash the kernel via denial of service. Specifically, io_kiocb request objects allocated by msg_ring are freed immediately rather than deferred through an RCU grace period, creating a race where task_work addition races against premature object reclamation. Confirmed by KASAN via syzbot on 6.16-rc4; no public exploit identified at time of analysis and EPSS is negligible at 0.14% (4th percentile).
A general protection fault (GPF) in the Linux kernel's md-bitmap module affects the bitmap_get_stats() function when reading bitmap statistics for RAID devices with external bitmaps. Local users with sufficient privileges can trigger a kernel panic by accessing bitmap statistics through the /proc interface, causing denial of service. The vulnerability stems from incomplete validation of bitmap storage configuration introduced by a prior fix that failed to properly check superblock validity for both internal and external bitmap modes.
Use-after-free in the Linux kernel's DRM/GEM graphics subsystem allows a local user to crash the kernel by prematurely releasing a GEM handle while its buffer object remains attached to a DRM framebuffer, freeing the underlying dma-buf. Drivers using shadow planes to vmap the dma-buf during page flips (notably drm_gem_shmem-based drivers) then dereference the freed pointer during mode-setting, producing a kernel OOPS or WARNING and a denial of service. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.15% (4th percentile) confirms exploitation is rare and targeted rather than opportunistic.
Out-of-bounds page table read in the Linux kernel's memory-management rmap subsystem (mm/rmap) allows a local low-privileged user to trigger disclosure of adjacent kernel memory or a crash via the batched unmap path in try_to_unmap_one(). The flaw affects 6.16 release-candidate kernels (6.16-rc1 through rc5) where a large folio's PTE mappings span beyond a single page table, causing folio_unmap_pte_batch scanning to read past the end of a PTE table. Rated CVSS 7.1 (high) with high confidentiality and availability impact; EPSS is very low at 0.16% and there is no public exploit identified at time of analysis.
Out-of-bounds memory access in the Linux kernel's NXP i.MX clock driver (clk-imx) affects 6.16 release candidates rc1 through rc5 running on i.MX95 hardware, where the dispmix_csr_clk_dev_data table uses a hardcoded parent-name count that overruns the parent_names array when num_parents is 4. Triggered automatically during device probe (imx95_bc_probe → __clk_register), it reads eight bytes past a global array, causing memory disclosure into pointer handling and potential kernel instability, as caught by KASAN. There is no public exploit identified at time of analysis and EPSS is negligible (0.15%, 5th percentile), consistent with a hardware- and pre-release-specific defect rather than a broadly exploitable flaw.
NULL pointer dereference in the Linux kernel's mlx5e Ethernet driver (mlx5_core module) causes kernel panic on systems equipped with Mellanox/NVIDIA ConnectX NICs. The race condition between DIM (Dynamic Interrupt Moderation) teardown and concurrent NAPI polling allows a local attacker with low privileges to crash the system, resulting in a complete denial of service. No public exploit code exists and EPSS is 0.11% (1st percentile), indicating near-zero opportunistic exploitation risk; however, the crash can also be triggered spontaneously on production systems under heavy NIC load during DIM reconfiguration.
Incorrect DMA unmap length in the Linux kernel bnxt_en driver during XDP_REDIRECT packet transmission triggers kernel warnings and potential availability disruption on systems with IOMMU enabled. Systems running Broadcom NetXtreme Ethernet adapters with IOMMU active and XDP_REDIRECT workloads are affected across multiple stable kernel branches. No public exploit exists and EPSS sits at 0.17% (7th percentile), marking this as a stability and correctness bug rather than a targeted security threat; no active exploitation has been identified.
Local privilege escalation and memory corruption in the Linux kernel's ksmbd in-kernel SMB3 server arises from a use-after-free in the oplock/lease break acknowledgment path, where a failed ksmbd_iov_pin_rsp() response allocation leads to opinfo->state being accessed after free and opinfo_put()/ksmbd_fd_put() being invoked twice. Affected builds include the 6.16 release-candidate series and Debian-packaged stable kernels running ksmbd; an authenticated SMB client interacting with a shared file can trigger the flaw for potential code execution or information disclosure. There is no public exploit identified at time of analysis and EPSS is low (0.15%), but the fix is already merged upstream and shipped via Debian LTS.
Linux kernel DRM scheduler fails to signal scheduled fences when killing job entities, causing dependent applications to hang indefinitely waiting for unresolved dependencies. Authenticated local users can trigger this denial of service by terminating applications whose job dependencies are not properly cleared during entity kill operations. The vulnerability affects multiple Linux kernel versions and has been patched upstream.
Vector register context corruption in the Linux kernel's RISC-V xtheadvector extension causes registers v8-v31 to be damaged during context save/restore operations, breaking userspace processes that rely on those registers. Affected systems must be running RISC-V hardware with the T-Head (xtheadvector) vendor extension and a Linux kernel prior to the stable tree fix. No public exploit exists and EPSS is extremely low (0.14%, 4th percentile), reflecting both the narrow hardware scope and the local-only attack vector; no active exploitation confirmed.
Kernel denial-of-service on RISC-V Linux systems stems from a flawed optimization to the access_ok() boundary check that allowed invalid addresses between TASK_SIZE and LONG_MAX to pass validation. Commit ad5643cf2f69 set TASK_SIZE_MAX to LONG_MAX for performance, but get_user_pages_fast() - invoked by syscalls such as futex() - trusts access_ok() and does not rely on hardware-level rejection of those addresses, triggering kernel faults. A local low-privileged user on an affected RISC-V system can cause a kernel crash; no public exploit is identified and EPSS probability is 0.16% (5th percentile), consistent with RISC-V's limited deployment footprint.
Race condition in the Linux kernel's MHI (Mobile Host Interface) endpoint driver allows a local low-privileged user to trigger data corruption by exploiting a premature read pointer update in mhi_ep_ring_add_element. Specifically, rd_offset is advanced before the ring buffer element is fully written, allowing the remote host to read uninitialized or incomplete data from the MHI ring - resulting in data corruption and potential availability loss. No public exploit identified at time of analysis; four stable-branch patches are available at kernel.org.
Linux kernel RAS (Reliability, Availability, Serviceability) header validation in the AMD GPU driver (amdgpu) lacks input sanitization, allowing a local authenticated attacker to trigger denial of service through excessive memory allocation when reading corrupted EEPROM data. The vulnerability affects all Linux kernel versions with the vulnerable amdgpu driver code path and requires local access with standard user privileges. No public exploit code has been identified; the EPSS score of 0.02% (5th percentile) indicates low real-world exploitation probability despite the moderate CVSS 5.5 rating.
Out-of-bounds memory access in the Linux kernel's NVIDIA Tegra I2C driver (i2c-tegra) lets a malicious or malfunctioning SMBus peripheral trigger a buffer over-read during an SMBus block read, because the driver trusted the device-supplied message length without validating it. A local attacker able to control an attached I2C/SMBus device, or to drive such a transfer, can leak adjacent kernel memory or crash the system. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and it is not on CISA KEV.
Kernel crash via use-after-teardown in the Linux perf subsystem allows a local low-privileged user to trigger a denial of service by exploiting a lifecycle ordering bug in do_exit(). Perf event sampling (PERF_SAMPLE_CALLCHAIN, PERF_SAMPLE_STACK_USER) occurs after exit_mmap() has already begun dismantling the process address space, causing the kernel to access unmapped or MMIO memory - confirmed on ARM64 as a synchronous external abort. Multiple stable kernel branches are affected, patches are available across eight upstream stable commits and Debian LTS; no active exploitation is confirmed (not in CISA KEV) and EPSS is 0.17% (7th percentile).
Out-of-bounds read/write in the Linux kernel's lan743x network driver affects systems using Microchip PCI1xxxx (hearthstone) Ethernet controllers, where incorrect OTP (8 Kb) and EEPROM (64 Kb) maximum size definitions allowed access beyond the intended memory bounds during EEPROM/OTP operations. A local user with the ability to invoke the driver's EEPROM/OTP read/write paths could trigger memory corruption, potentially leading to code execution or privilege escalation (CVSS 7.8). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS risk is low (0.16%, 6th percentile).
Local privilege escalation and denial of service in the Linux kernel's AMD Platform Management Framework (amd-pmf) driver stems from a double-free (CWE-415) triggered when Smart PC setup fails: dev->buf is freed but not nulled, then freed again during amd_pmf_remove(). The fix converts the driver's allocations to device-managed (devm_*) allocations. No public exploit identified at time of analysis, and EPSS probability is low (0.15%), consistent with a hard-to-reach local-only kernel bug affecting AMD systems on kernels around 6.14-6.16-rc.
Local privilege-relevant memory-safety flaw in the Linux kernel's NFC NCI UART line-discipline driver (drivers/nfc/nci/uart.c) allows a local attacker to trigger use of a partially-initialized tty->disc_data pointer. The driver assigned tty->disc_data before the NCI device was successfully opened, so if the underlying hardware sent data (or the NCIUARTSETDRIVER ioctl failed) during that window, code paths could operate on a device object that was never fully set up or was torn down on error. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.18%, 8th percentile); the issue was fixed upstream by exposing disc_data only on the success path.
Out-of-bounds shift in the Linux kernel Squashfs filesystem allows a local attacker to trigger memory corruption by racing a LOOP_SET_BLOCK_SIZE ioctl against a concurrent Squashfs mount on the same loop device, causing sb_min_blocksize() to return 0 and the code in squashfs_fill_super() to compute a shift exponent of 64. The affected subsystem is the kernel Squashfs driver (fs/squashfs/block.c) on Linux and downstream distributions such as Debian 11. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Incorrect frame length validation in the Linux kernel's virtio-net XDP socket (AF_XDP/XSK) receive path allows a local low-privileged attacker to trigger a kernel availability failure. The `buf_to_xdp` function incorrectly permits the first receive buffer's frame data to reach `xsk_pool_get_rx_frame_size() + vi->hdr_len` bytes, when the virtio header already occupies space within that first buffer, capping valid data at `xsk_pool_get_rx_frame_size()`. No public exploit code has been identified and EPSS sits at the 5th percentile, reflecting low real-world exploitation probability at this time.
Denial of service in the Linux kernel's dell-wmi-sysman platform driver allows a local low-privileged user to crash the system by triggering an invalid pointer dereference in sysfs callbacks. The driver fails to validate WMI data block pointers after retrieval before dereferencing them, affecting Dell hardware running unpatched kernel versions including the 6.16-rc series and Debian Linux 11.0. No active exploitation has been confirmed - EPSS sits at the 5th percentile and the vulnerability is absent from CISA KEV, making this a low-urgency patch for most environments.
Local privilege escalation and memory corruption in the Linux kernel's netfs (network filesystem) subsystem affects development builds 6.16-rc1 through 6.16-rc4, where a reference-counting error causes a double put of a netfs request. When a netfs request completes during the pause loop, the reference tied to the IN_PROGRESS flag is dropped, but the subsequent final wait loop erroneously drops it again, leading to a use-after-free/double-free condition (CWE-415). CVSS is 7.8 (High) requiring low-privileged local access; EPSS is low at 0.15% and there is no public exploit identified at time of analysis.
Continuous kernel memory exhaustion in the Linux nvmet (NVMe-over-Fabrics target) subsystem leaks kmalloc-128 slab entries via bio->bi_integrity on every NVMe command with metadata, eventually degrading or denying service on affected target systems. Systems running Linux kernel through 6.16-rc4 as NVMe-oF targets and processing metadata-bearing I/O commands are affected. No public exploit code exists and EPSS is 0.15% (5th percentile), indicating low near-term exploitation probability; this is a correctness regression from a kernel block-layer change rather than a security-targeted attack surface.
Local privilege escalation and memory corruption in the Linux kernel's MediaTek MMC/SD host controller driver (mtk-sd) occurs because msdc_start_data() proceeds with a DMA transfer using stale settings after msdc_prepare_data() fails to map the DMA region. An attacker with local access to a system using MediaTek SD/MMC hardware can trigger an out-of-bounds write (CWE-787) leading to kernel memory corruption with high confidentiality, integrity, and availability impact. This is a code-quality/robustness fix in mainline kernel development (regression affects 6.16 release candidates and backported stable branches); there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.17%, 7th percentile).
Linux kernel NFS subsystem fails to clean up /proc/net/rpc/nfs directory when nfs_fs_proc_net_init() encounters a memory allocation failure, causing a warning when rpc_proc_exit() later attempts to remove the non-empty parent directory. The vulnerability affects kernel versions 6.16-rc1 through 6.16-rc3 and likely earlier versions, and requires local privileges to trigger via fault injection or memory pressure. While marked as availability impact (DoS via kernel warning), the practical severity is limited as it primarily causes a procfs resource leak rather than direct system compromise.
NULL pointer dereference in the Linux kernel SCSI target subsystem crashes the kernel when processing a malformed SCSI-3 Persistent Reservation SPEC_I_PT command. A local, low-privileged user with access to SCSI target infrastructure can trigger the bug by issuing a PR SPEC_I_PT operation that fails to locate the destination target port group, causing `core_scsi3_decode_spec_i_port()` to call `core_scsi3_lunacl_undepend_item()` with a NULL `dest_se_deve` pointer. Impact is limited to a denial-of-service kernel panic; no exploitation is confirmed in CISA KEV, and EPSS sits at the 5th percentile, indicating very low real-world exploitation probability.
Out-of-bounds heap write in the Linux kernel's spi-qpic-snand driver corrupts kernel memory on Qualcomm NAND-equipped devices, resulting in kernel panics, swiotlb mapping failures, and spinlock corruption. The flaw triggers whenever NAND flash operations require more than one codeword - a quantity determined by the chip's page size that is unknown at probe time - causing the BAM transaction buffer, allocated for only a single codeword, to be overrun. Real-world impact is denial of service via kernel crash; EPSS is 0.13% (3rd percentile), no public exploit exists, and the vulnerability is not listed in CISA KEV.
Local privilege/security-policy bypass in the Linux kernel's secretmem subsystem allows LSM and SELinux access controls to be evaded on secretmem file descriptors because the S_PRIVATE flag was left set after alloc_anon_inode(), causing inode_init_security_anon() checks to be skipped. The affected code paths are the anonymous-inode helpers used by secretmem (memfd_secret) and KVM guest_memfd, present in Linux 6.16 release candidates and a Debian backport. There is no public exploit identified and EPSS is very low (0.16%), so the practical impact is a defense-in-depth regression that lets a local process create secretmem objects that mandatory-access-control policy should have denied.
Out-of-bounds access in the Linux kernel's GPIO-based regulator driver (regulator/gpio) allows a local, low-privileged actor to trigger memory corruption on systems where the regulator is configured with more than one GPIO (config::ngpios > 1). The driver under-allocated the drvdata::gpiods array to hold a single gpio_desc pointer instead of ngpios pointers, so subsequent indexing reads beyond the allocation. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not in CISA KEV.
Use-after-free in the Linux kernel ACPICA interpreter crashes the system when platform firmware AML calls a method with fewer arguments than its definition requires. Local attackers with low privileges on systems running such buggy firmware can trigger a kernel panic, resulting in a denial of service. No public exploit code exists and EPSS sits at 0.17% (6th percentile), reflecting the narrow firmware-dependent trigger condition and limited exploitation interest.
Btrfs log replay in the Linux kernel crashes due to use of an uninitialized variable in extended reference (extref) iteration, causing a kernel denial of service for local users. In `__inode_add_ref()`, a `goto` jump skips the initialization of `victim_name.len`, so the next loop iteration reads an undefined stack value and performs an invalid memory access. No public exploit code exists and EPSS places exploitation probability at 0.16% (5th percentile), confirming negligible active-exploitation risk; this is not listed in the CISA KEV catalog.
Kernel warning triggering denial of service in the Linux SMB client subsystem affects systems using SMB multichannel. During channel reconnection in smb2_reconnect_server(), a dummy tcon structure with an uninitialized ->query_interface pointer is incorrectly passed to smb2_reconnect(), which then calls queue_delayed_work() on the invalid struct, firing a WARN_ON in the kernel workqueue at __queue_delayed_work+0x1d2/0x200. The result is potential kernel instability or crash on any Linux host using CIFS multichannel mounts; no active exploitation is confirmed, EPSS is 0.15% (4th percentile), and upstream patch commits are available across multiple stable branches.
Local privilege escalation via use-after-free in the Linux kernel's ROSE (amateur-radio X.25 PLP) networking stack, where rose_rt_device_down() mishandles neighbour-array compaction and leaves dangling rose_neigh pointers. A local attacker able to manipulate ROSE routing/devices can trigger access to freed kernel memory (CWE-416), enabling memory corruption that can lead to full compromise (confidentiality, integrity, and availability all High). No public exploit identified at time of analysis; EPSS is very low at 0.16% (6th percentile) and it is not on CISA KEV.
Out-of-bounds read in the Linux kernel virtio-net driver (through 6.16-rc3 and affected stable branches) lets a malicious or buggy virtio backend trigger a read past the allocated buffer inside xdp_linearize_page when XDP is used on the interface. The flaw stems from the driver reading follow-on ring buffers without validating that the reported received length fits within the allocated page, enabling potential information disclosure or a guest crash. There is no public exploit identified at time of analysis, and EPSS is very low (0.17%, 7th percentile), consistent with a hard-to-weaponize local kernel memory-safety bug.
Unsafe XArray access in the Linux kernel's RDMA mlx5_ib driver causes a lockdep warning and potential kernel panic on systems using Mellanox/NVIDIA InfiniBand hardware with implicit On-Demand Paging (ODP). The non-locking xarray variants __xa_store() and __xa_erase() were called inside the mlx5 page fault handler pagefault_mr() without holding the required XArray spinlock, violating RCU protection invariants. A local low-privilege user on an affected system can trigger this condition via RDMA page fault events, causing kernel denial of service. No public exploit exists and EPSS is at the 4th percentile, indicating this is a kernel stability concern rather than an imminent exploitation target.
Local privilege escalation and denial of service in the Linux kernel's LoongArch KVM hypervisor arises from an array index overflow when handling writes to the EIOINTC_ENABLE register of the emulated extended I/O interrupt controller. Affecting mainline 6.16 release candidates (rc1-rc3) on LoongArch hosts, a low-privileged actor able to program the virtual interrupt controller can write out of the bounds of a kernel array, corrupting memory with high confidentiality, integrity, and availability impact (CVSS 7.8). There is no public exploit identified at time of analysis and EPSS probability is low (0.14%, 4th percentile).
Local privilege escalation and host memory corruption in the Linux kernel's LoongArch KVM hypervisor (6.16 release candidates rc1-rc3) arises because the EIOINTC virtual irqchip fails to validate a user-space-supplied 'num_cpu' value against EIOINTC_ROUTE_MAX_VCPUS, allowing an array pointer overflow. A local user with permission to create KVM virtual machines can trigger out-of-bounds access in host kernel memory. No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile) and the issue was fixed upstream before the 6.16 final release.
Btrfs in the Linux kernel contains a race condition between same-directory rename operations and directory inode logging that can cause permanent, unrecoverable file loss after a crash or power failure. When a rename removes the old directory entry but has not yet inserted the new one, a concurrent fsync of a related inode can log the parent directory in this transient, inconsistent state and persist it to the log tree. If a power failure occurs immediately after that log flush, log replay on the next mount deletes the renamed file entirely, with no remaining hard links to recover it. No public exploit has been identified at time of analysis; the EPSS score of 0.11% (2nd percentile) reflects low opportunistic exploitation probability, though the impact for affected btrfs deployments is severe and permanent.
Null pointer dereference in Linux kernel maple_tree memory allocator causes denial of service when the MA_STATE_PREALLOC flag is incorrectly managed during node allocation requests. Local authenticated attackers can trigger this via memory operations that request large numbers of nodes, such as VMA merges during mmap_region() calls, leading to WARN_ON() messages followed by kernel crash. Affects Linux kernel versions including 6.16 release candidates and is confirmed patched in stable branches.
A null pointer dereference vulnerability exists in the AMD display driver within the Linux kernel, where the dce_hwseq structure is accessed without proper null checking in the dce110_blank_stream function. The vulnerability affects Linux kernel versions up to 6.16-rc2 and could allow a local attacker with low privileges to cause a system crash or potentially execute arbitrary code with kernel privileges. With an EPSS score of only 0.02% and no known active exploitation, this represents a low real-world risk despite the high CVSS score.