Red Hat
Monthly
Null-pointer dereference in the Linux kernel's rxrpc subsystem allows a remote unauthenticated attacker to crash the kernel by sending a forged ACKALL control packet to an exposed rxrpc service. Affected systems run Linux from commit b341a0263b1b804d329f864c2dc24815364510ec through the fixes landed in stable releases 6.18.40 and 7.1.5; Linux 6.14 is explicitly confirmed affected. No public exploit has been identified and EPSS probability is very low at 0.15%, but the network-accessible, no-authentication attack path warrants immediate patching on any system actively serving rxrpc traffic.
Kernel panic via rxrpc protocol mishandling in the Linux kernel allows a network-positioned attacker to crash an AFS client system by sending a premature reply DATA packet before any request packets have been transmitted on a client call. The flaw resides in rxrpc_receiving_reply(), which fails to verify call exposure state before invoking rxrpc_rotate_tx_window() - a function whose do...while loop oopses on an empty transmit queue. Fixes have been backported to stable branches 7.1.5 and 6.18.40; no public exploit has been identified and EPSS exploitation probability is extremely low at 0.15% (5th percentile), indicating no known active exploitation.
Denial of service (and potential memory corruption) in the Linux kernel's AF_RXRPC networking stack stems from a double unlock in rxrpc_recvmsg() triggered while handling out-of-band (OOB) messages, affecting kernels from roughly 6.16 up to the fixed 6.18.40, 7.1.5 and 7.2-rc1 releases. Releasing an already-released lock corrupts kernel lock state and can crash the host or open a race window. No public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile).
Use-after-free / stale work-item race in the Linux kernel's kAFS (Andrew File System client) network-namespace teardown path allows a use-after-free when an afs netns is destroyed. Fixed upstream (this issue was found by AI review), the flaw stems from afs_charge_preallocation() and afs_rx_new_call() failing to stop the rxrpc preallocation 'charger' work item before incoming calls are disabled during net-namespace deletion, so the charger can run against freed/torn-down state. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and it is not in CISA KEV, so this is a correctness/stability defect far below the raw CVSS 9.8 rating.
Denial-of-service in the Linux kernel's AFS (Andrew File System) cache manager allows remote attackers to crash or destabilize systems running AFS by sending a crafted CB.InitCallBackState3 callback request that arrives without an associated server record. The CB.InitCallBackState3 handler failed to perform the null-check present in all other callback handlers, meaning an unexpected or spoofed callback packet lacking a peer-to-server mapping causes a kernel-level fault. No public exploits have been identified, and EPSS places exploitation probability at just 0.16% (5th percentile), reflecting the niche deployment footprint of AFS.
Improper bounds enforcement in the Linux kernel's accel/amdxdna driver allows a local low-privileged user to trigger a kernel-to-userspace copy that exceeds the application-provided buffer size via a crafted ioctl call. The root cause is that copy_to_user() was using the kernel's internal data size rather than the caller-supplied buffer size to bound the copy, enabling overflow into adjacent userspace memory and exposure of unintended kernel data. No public exploit exists and no active exploitation has been confirmed, but the CVSS vector (C:H/I:H) reflects a real dual-impact risk: confidentiality loss from kernel memory spillover and integrity loss from overwriting adjacent user-space structures.
Integer overflow in the Linux kernel's legacy DRM radeon driver exposes systems with older ATI/AMD Radeon GPUs to kernel memory corruption via crafted dumb-buffer allocation requests from a low-privileged local user. The flaw resides in radeon_align_pitch(), where both the alignment round-up addition and the final width-times-bytes-per-pixel multiplication can overflow signed 32-bit integers, causing radeon_mode_dumb_create() to return an invalid pitch or allocate a zero-sized kernel buffer - a condition that can be leveraged for heap corruption. EPSS sits at 0.16% (5th percentile) with no CISA KEV listing and no public proof-of-concept, indicating active exploitation has not been confirmed; however, the low-privilege local vector and straightforward arithmetic overflow make this notable for shared Linux systems with this legacy hardware.
Type confusion in the rtw89 PCI Advanced Error Reporting (AER) handlers corrupts kernel memory on Linux systems equipped with Realtek RTL8852CE and related WiFi adapters. The driver stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() incorrectly retrieve it as a net_device pointer, causing netif_device_detach/attach to read and write at wrong memory offsets within a misidentified kernel struct. An adjacent-network attacker within WiFi range could potentially trigger the faulty AER handler path by inducing hardware-level PCI errors via crafted 802.11 frames, resulting in kernel memory corruption. No public exploit exists and EPSS is 0.17% (6th percentile), indicating low observed exploitation activity despite a high CVSS score of 8.8.
Type confusion in the rtw88 Realtek PCIe Wi-Fi driver's PCI Advanced Error Reporting (AER) handlers allows an adjacent-network attacker to corrupt kernel memory, potentially enabling privilege escalation or arbitrary kernel code execution on Linux systems using Realtek PCIe Wi-Fi hardware. The driver stores an ieee80211_hw pointer via pci_set_drvdata() at probe time but retrieves it as a net_device pointer in io_error_detected() and io_resume(), causing netif operations to read and write kernel memory at incorrect struct offsets. No public exploit code has been identified, EPSS places exploitation probability at 0.17% (6th percentile), and the vulnerability is not listed in CISA KEV.
Kernel soft lockup and system panic in the Linux rtw89 Wi-Fi driver affects systems with Realtek RTW89 802.11ax chipsets during 6GHz band scanning. The root cause is an integer truncation bug where the loop counter variable `i` is silently narrowed to 8 bits via a `movzbl %bl, %eax` instruction; when `req->n_6ghz_params` exceeds 255, the counter wraps to zero and the loop never terminates, trapping the CPU for 26+ seconds until the watchdog fires and triggers a kernel panic. No public exploit identified at time of analysis, and EPSS of 0.17% at the 6th percentile reflects low exploitation probability despite the provided CVSS score of 8.8.
Out-of-bounds read in the Linux kernel's rtw88 PCIe WiFi driver allows an adjacent-network attacker to trigger kernel memory disclosure or a system crash via crafted WiFi RX descriptor values. Systems running unpatched kernels with Realtek RTW88-series WiFi chipsets attached over PCIe are affected; the USB transport path was already protected by an equivalent check. The vulnerability arises because the PCIe receive path in rtw_pci_rx_napi() does not validate that the firmware-derived new_len value stays within the pre-allocated DMA buffer before calling skb_put_data. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog.
Out-of-bounds array indexing in the Linux kernel's rtw89 WiFi driver exposes systems using Realtek 802.11ax hardware to kernel memory corruption or disclosure from adjacent network attackers. The driver accepts an 8-bit mac_id (range 0-255) from firmware-processed RX descriptors and uses it without validation to index into assoc_link_on_macid[], which contains only 128 entries - creating a 128-entry gap where attacker-controlled values trigger reads or writes beyond the array boundary. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at 0.17% (6th percentile), but the CVSS 8.8 score reflects the full kernel memory impact achievable by an unauthenticated adjacent attacker.
Out-of-bounds array access in the Linux kernel's ath9k WiFi driver allows an adjacent network attacker to trigger kernel memory corruption via a maliciously crafted firmware transmit status queue ID. The ath_tx_edma_tasklet() function blindly indexes sc->tx.txq[] using a 4-bit hardware field (range 0-15) against an array of only 10 entries (ATH9K_NUM_TX_QUEUES), meaning any qid value of 10 or greater causes an OOB memory access with potential for high confidentiality, integrity, and availability impact. No active exploitation is confirmed (not in CISA KEV), and EPSS stands at 0.18% (7th percentile), but the adjacent-network, no-authentication attack vector keeps this relevant for environments running Atheros 802.11n hardware.
Kernel panic via NULL pointer dereference in the Linux kernel's ath11k PCI WiFi driver affects systems running kernel versions from 5.19 through pre-7.1.5/7.2-rc1 with Qualcomm PCI-attached WiFi chipsets such as WCN6855. The race condition occurs when a system reboot overlaps with WLAN firmware crash recovery (Subsystem Reset, SSR), causing the MHI teardown path and SSR recovery path to simultaneously attempt to deinitialize MHI and free DMA-backed contexts, resulting in a double-free scenario and kernel crash. No public exploit code exists and EPSS exploitation probability is very low at 0.15%, consistent with an accidental-trigger vulnerability rather than a targeted attack vector.
Denial of service in the Linux kernel's VXLAN driver stems from a race condition in vxlan_gro_prepare_receive(): udp_tunnel_sock_release() can set sk->sk_user_data to NULL while GRO processing is mid-flight, producing a NULL-pointer dereference and kernel panic. It affects hosts using VXLAN overlay tunnels across numerous stable branches, is fixed upstream, and has no public exploit identified at time of analysis (EPSS 0.17%). The published NVD CVSS of 9.8 (C:H/I:H/A:H) overstates impact - the actual effect is a crash, not code execution or data disclosure.
Reference count corruption in the Linux kernel's Operating Performance Points (OPP) subsystem exposes systems to memory corruption and potential privilege escalation via a race condition between OPP object addition and frequency lookup. Affected kernels from 4.11 through stable branches predating commits to 7.1.5 and 6.18.40 are vulnerable when concurrent DVFS (Dynamic Voltage and Frequency Scaling) operations race during OPP table construction. No public exploit exists and EPSS sits at 0.17% (6th percentile), suggesting no known widespread exploitation; however, the H/H/H CVSS impact reflects the severity of kernel memory corruption if triggered.
Heap buffer overflow in the Linux kernel CCP driver's snp_filter_reserved_mem_regions() function enables a low-privileged local attacker to corrupt kernel memory on AMD SEV-SNP-enabled systems. The off-by-one error in the boundary check permits a 4-byte write past a PAGE_SIZE kzalloc buffer when 255 or more IOMEM reserved memory regions are present, yielding full High impact on confidentiality, integrity, and availability per CVSS 7.8. No public exploit has been identified and EPSS stands at 0.19% (8th percentile), indicating no current widespread exploitation activity despite the severity score.
Incorrect NULL-check ordering in the Linux kernel's crypto/ccp driver exposes AMD SEV-SNP systems to kernel memory corruption during Trusted I/O firmware initialization. On architectures without HASHED_PAGE_VIRTUAL, passing the return value of __snp_alloc_firmware_pages() directly to page_address() before checking for NULL causes page_address(NULL) to return a deterministic but invalid non-zero address, silently bypassing the allocation-failure guard and allowing sev_tsm_init_locked() to dereference garbage memory. Affected kernel versions span from commit 4be423572da1f4c1 through the patched releases (7.1.5, 7.2-rc1, 6.19); no public exploit identified at time of analysis, and EPSS is 0.16% (5th percentile), consistent with zero confirmed in-the-wild exploitation.
Use-after-free in the Linux kernel's DLM (Distributed Lock Manager) subsystem stems from incorrect sequence-number ordering of message handles in a node's send_queue, which breaks the before(mh->seq, seq) tail-walk in dlm_receive_ack and leads to refcounting corruption and freeing of an in-use send buffer. It affects Linux kernels using DLM (clustered filesystems such as GFS2/OCFS2) from 5.14 onward, and is fixed in stable releases 6.6.145, 6.12.97, 6.18.40 and 7.1.5. Despite a headline CVSS of 9.8, EPSS is only 0.17% (6th percentile), there is no public exploit, and it is not on CISA KEV - the reporter only reproduced it on an experimental branch with an io_uring userspace benchmark.
Denial of service (and potential memory corruption) in the Linux kernel IPv6 stack arises from a race condition in addrconf_dad_failure() where ifp->lock is transiently dropped, letting a concurrent ipv6_del_addr() poison a list entry that Duplicate Address Detection (DAD) work then dereferences, producing a general protection fault in ipv6_del_addr(). The flaw affects the addrconf DAD-failure path across a broad range of kernel versions and is fixed by folding the state transition into a single locked critical section. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%), and it is not listed in CISA KEV.
Resource leak and premature mutex use in the Linux kernel's mlx5 InfiniBand driver (IB/mlx5) expose systems with Mellanox/NVIDIA ConnectX hardware to local privilege escalation, denial of service, and potential information disclosure. When mlx5_ib_alloc_transport_domain() successfully allocates a transport domain (TD) but mlx5_ib_enable_lb() subsequently fails, the TD object is never freed, leaking kernel memory. Compounding this, the loopback mutex (dev->lb.mutex) was initialized too late - after code paths that could use it - creating a window for undefined kernel behavior. No public exploit exists and EPSS sits at 0.17% (7th percentile), placing real-world risk well below the CVSS 7.8 headline score.
Resource leak and potential mutex deadlock in the Linux kernel's RDMA/mlx5 driver (UMR XLT cleanup path) enables denial-of-service conditions on systems using Mellanox/NVIDIA ConnectX RDMA adapters. The vulnerability exists from commit 1efe8c0670d6a6883faa09c9abc746c741f5664a onward, including Linux 6.16, where a fallible error path in mlx5_odp_populate_xlt() skips the mandatory DMA buffer and XLT mapping cleanup performed by mlx5r_umr_unmap_free_xlt(), and if the emergency XLT page code path was taken, permanently locks xlt_emergency_page_mutex. EPSS is very low at 0.18% (8th percentile), no public exploit code exists, and the vulnerability is not listed in CISA KEV, but RDMA-enabled HPC, storage, and financial infrastructure running affected kernel versions should prioritize patching.
Kernel-level memory corruption in the Linux RDMA SCSI RDMA Protocol target driver (ib_srpt) lets a malicious SRP initiator on the RDMA fabric overflow an integer length calculation and drive a ~4GB out-of-bounds scatter-gather mapping. The flaw stems from adding an attacker-controlled 32-bit immediate-data length to an offset without overflow checking, wrapping req_size below its bounds check. It carries a CVSS 9.8 rating, but there is no public exploit identified at time of analysis and EPSS is low (0.19%, 8th percentile); a vendor patch is available across current stable kernel trees.
Out-of-bounds write in the Linux kernel's RDMA irdma driver allows a local low-privileged user to overflow a fixed-size kernel array and corrupt heap memory, potentially escalating privileges or crashing the system. The flaw exists in irdma_copy_user_pgaddrs, where the loop guard based on palloc->total_cnt is inert when set to zero (the lvl==0 path), allowing a user-supplied umem with more than 4 DMA blocks to write beyond the 4-entry iwmr->pgaddrmem array. Patch-confirmed fixes are available across multiple stable kernel branches; no public exploit code exists and EPSS sits at 0.17%, but the High C/I/A impact of a kernel heap write warrants prompt patching on affected configurations.
Use-after-free in the Linux kernel's ALSA OSS sequencer subsystem allows a local low-privileged attacker to corrupt kernel heap memory by racing SysEx MIDI event dispatch against concurrent sequencer port closure. The vulnerable code path in snd_seq_oss_process_event() stores a raw pointer to SysEx byte data in the event record without retaining a refcount across the full dispatch lifecycle, enabling freed memory to be accessed in snd_seq_event_dup() if the OSS MIDI port is closed before dispatch completes. Vendor-released patches are available at kernel versions 6.18.40 and 7.1.5; no public exploit code and no active exploitation have been identified at time of analysis.
Use-after-free and NULL-pointer dereference in the Linux kernel ALSA sequencer MIDI subsystem allows a local low-privileged user to crash the kernel or potentially escalate privileges by racing MIDI output event processing against port teardown. The flaw exists because `event_process_midi()` reads `msynth->output_rfile.output` without holding any lock, while `midisynth_unuse()` can concurrently free `substream->runtime` before `snd_rawmidi_kernel_write1()` pins its buffer reference - leaving the event path with a dangling pointer confirmed via KASAN null-ptr-deref reproduction. No public exploit identified at time of analysis, and EPSS of 0.17% (7th percentile) signals low current exploitation interest despite the 7.8 CVSS score.
Resource leakage in the Linux kernel's NVMe-over-TCP target subsystem (nvmet-tcp) allows unauthenticated network clients to exhaust kernel queue and socket resources by manipulating a TLS handshake. The flaw in `nvmet_tcp_tls_handshake_done()` ignores the return value of `nvmet_tcp_set_queue_sock()`, so if the socket leaves TCP_ESTABLISHED state during handshake completion - a condition an attacker can induce by timing a connection abort - resources are never cleaned up. No public exploit is identified and EPSS is 0.17%, but repeated triggering can deny service to storage infrastructure running nvmet-tcp with TLS configured.
Out-of-bounds slab write in the Linux kernel's NVMe-multipath driver (nvme_mpath_revalidate_paths) affects hosts whose NUMA node IDs are sparse rather than densely packed from zero, notably some powerpc/POWER9 systems. The nvme_ns_head.current_path[] flexible array is sized with num_possible_nodes() but indexed with the raw numa_node_id(), so on non-contiguous topologies the driver writes a pointer past the end of the allocation during namespace scanning, producing the KASAN slab-out-of-bounds splat shown in the report. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and it is not on CISA KEV, despite an inflated NVD score of 9.8.
Out-of-bounds array access in the Linux kernel's nvme-pci driver crashes the kernel and prevents NVMe namespaces from appearing as /dev nodes on systems built without NUMA support (CONFIG_NUMA=n). The root cause is a signed-to-unsigned type mismatch: NUMA_NO_NODE (-1) is cast to UINT_MAX when passed through a parameter declared 'unsigned', causing nvme_setup_descriptor_pools() to index far beyond the bounds of the descriptor pool array (sized to nr_node_ids). No active exploitation has been identified (not in CISA KEV), and EPSS of 0.17% reflects negligible real-world exploitation probability, though the CONFIG_NUMA=n precondition significantly limits the exposed population to non-enterprise kernel builds.
The host1x GPU driver in the Linux kernel mishandles the return value of iommu_map_sgtable() after an upstream API change switched its return type from size_t (unsigned, zero on error) to ssize_t (signed, negative on error), leaving pin_job() blind to failures. Compounded by pin_job() assigning the result to a plain int - risking overflow on large sizes - an IOMMU mapping failure can be silently treated as success, potentially allowing a low-privileged local user on Tegra hardware to trigger kernel memory corruption and escalate privileges. No public exploit identified at time of analysis; the CVSS 8.8 score with Scope:Changed reflects the theoretical kernel-level blast radius, while the 0.17% EPSS and absence of CISA KEV listing indicate low current exploitation activity.
Out-of-bounds memory access in the Linux kernel RDMA/rxe (Soft RoCE) subsystem enables a local low-privileged attacker to corrupt kernel heap data or leak sensitive memory, potentially achieving local privilege escalation. The non-SRQ receive path in rxe_resp_check_length() and copy_data() reads WQE fields directly from a userspace-mapped shared buffer without snapshotting them first, creating a TOCTOU race window exploitable by any local user controlling a non-SRQ queue pair. Patches are confirmed available across multiple stable kernel branches; no public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.17% indicates low current exploitation probability consistent with the niche RDMA prerequisite.
Kernel memory (bio structure) leak in the Linux md/raid10 driver occurs when a discard operation reuses an r10bio object previously used for a read. Because put_all_bios() only releases the replacement bio (repl_bio) when read_slot is negative, a reused r10bio with a stale non-negative read_slot skips the bio_put() on repl_bio, leaking kernel memory on RAID10 arrays that have replacement/spare devices and receive discard (TRIM) traffic. There is no public exploit identified at time of analysis, and EPSS risk is very low (0.17%, 7th percentile).
Deadlock vulnerability in the Linux kernel md/raid1 and md/raid10 drivers can freeze systems running software RAID1 or RAID10 under concurrent memory pressure. The flaw causes incorrect GFP flag selection during block I/O error recovery - the kernel uses GFP_NOIO instead of GFP_NOIO|__GFP_HIGH after a failed bio is split and resubmitted, starving memory reclaim of emergency reserves and causing a kernel deadlock. No active exploitation has been identified (not in CISA KEV), and EPSS at 0.15% reflects low opportunistic risk; however, storage servers, hypervisors, and database hosts using Linux software RAID should prioritize patching to kernel 7.1.5 or 7.2-rc1.
Inconsistent arvif state management in the Linux kernel's ath12k Qualcomm WiFi 7 driver exposes local low-privileged users to kernel memory corruption, information disclosure, and system crash via stale pointer dereference. Three distinct error paths in ath12k_mac_vdev_create() fail to clear or properly unwind arvif->ar and associated vdev/peer state, leaving the driver operating against ghost structures never confirmed in firmware. No public exploit identified at time of analysis, and EPSS probability sits at 0.15% (5th percentile), reflecting low near-term exploitation likelihood despite the 7.8 CVSS score.
Silent data corruption in the Linux kernel nvdimm/btt subsystem results from a broken lane-acquisition locking model that became invalid once BTT lanes were made preemptible. On systems with NVDIMM persistent memory configured in BTT (Block Translation Table) mode, a low-privileged local user can trigger a preemption-induced race where a second task observes a non-zero per-CPU recursion count, incorrectly infers it already holds the lane lock, bypasses mutual exclusion, and concurrently accesses shared per-lane metadata and workspace state, yielding high-integrity and high-confidentiality impact. No public exploit exists and EPSS is 0.18% (8th percentile), but the race is reproducible via the upstream ndctl btt-check.sh unit test and patches are available across all actively maintained stable kernel branches.
Exclusive BPF maps in the Linux kernel can be inserted as inner maps within non-exclusive outer map-in-map structures, allowing any unrelated local BPF program to look up and mutate a map that is supposed to be bound exclusively to a single program by cryptographic hash. This bypasses the signed BPF loader's integrity guarantee - an adversary on a hostile host can rewrite the frozen metadata map contents that the loader has already validated against a signed hash. No public exploit is identified at time of analysis and EPSS is very low (0.18%), but the impact is high for environments relying on exclusive maps as a trust boundary.
Use-after-free in the Linux kernel BPF filesystem (bpffs) inode lifecycle exposes freed kernel memory during concurrent path traversal, enabling local attackers with low privileges to crash the kernel or potentially escalate privileges. The flaw was introduced by commit 4f375ade6aa9, which incorrectly removed the RCU grace-period delay protecting inodes and cached symlink bodies accessible via concurrent RCU pathwalk operations (pick_link, may_lookup). KASAN confirmed the slab-use-after-free at inode offset +2 (i_opflags). No public exploit has been identified and EPSS is very low at 0.17% (7th percentile), with no CISA KEV listing.
Out-of-bounds access in the Linux kernel NVMe Flexible Data Placement (FDP) code allows an attacker who can submit NVMe commands to read beyond the fdpcidx configuration array. An off-by-one in the fdpcidx bounds check (using '>' instead of '>=' against n = NUMFDPC + 1) accepts an index one element past the valid range, tagged by intelligence sources as an information-disclosure issue. Affects Linux 6.16 through the fix; no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile), and the published CVSS 9.8 network vector appears inflated relative to the local/fabric-scoped nature of NVMe command handling.
Use-after-free in Linux kernel's configfs_lookup() allows a local low-privilege attacker to trigger kernel memory corruption via a dangling pointer in configfs_dirent->s_dentry. When inode allocation fails during a directory lookup, the code drops the configfs_dirent reference but neglects to clear ->s_dentry, leaving it pointing at a dentry object that is subsequently freed; a follow-on getdents(2) call in the same directory dereferences that stale pointer to read the inode number, producing the UAF condition. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at 0.17% (7th percentile), but the defect has been latent since Linux 2.6.16 in 2006, meaning a vast range of unpatched production kernels carries the flaw.
Heap out-of-bounds write in the Linux kernel amdgpu DRM driver's `amdgpu_coredump()` function allows a local attacker with GPU access to corrupt kernel heap memory during a GPU reset event. The vulnerability affects Linux kernel versions containing commit eea85914d15b up to the fix commits, specifically Linux 7.1 stable and prior, on systems with AMD GPU hardware. A local user who can trigger or time a GPU ring timeout during an active GPU reset could exploit this heap corruption for potential privilege escalation; however, no public exploit exists and EPSS probability is 0.15% (5th percentile), indicating limited real-world exploitation activity at time of analysis.
Livelock in the Linux kernel's vhost-net subsystem can cause a host denial-of-service against KVM virtualization environments when mergeable receive buffers (VIRTIO_NET_F_MRG_RXBUF) are negotiated between host and guest. The defect in `vhost_get_avail_idx` propagates an incorrect return value through `vhost_enable_notify`, causing the host vhost kernel thread to spin in an immediate disable-then-retry notification loop when the guest is not consuming virtio ring entries fast enough. No public exploit code exists and EPSS stands at 0.17% (6th percentile), but the CVSS Scope Changed (S:C) metric confirms cross-VM-boundary impact on the hypervisor host, making this a meaningful availability risk for KVM-based virtualization fleets.
RB-tree corruption in the Linux kernel iommu/vt-d driver allows a privileged local attacker to corrupt kernel memory structures during device probe error handling, leading to potential kernel panic, privilege escalation, or information disclosure. Affected systems must have Intel VT-d IOMMU enabled and encounter a device that does not support Address Translation Services (ATS) followed by a probe step failure. No public exploit code has been identified and no CISA KEV listing exists, but the Changed Scope (S:C) CVSS flag signals that kernel-level corruption can cascade across process and subsystem boundaries. Upstream fixes are available in stable branches targeting kernel 6.18.40, 7.1.5, and 7.2-rc1.
Local privilege escalation in the Linux kernel's BPF arena subsystem arises from zap_pages() invoking zap_vma_range() without first acquiring the owning mm's mmap_lock, creating a lock-ordering race condition against arena_vm_close() and arena_map_mmap(), both of which acquire mmap_write_lock before arena->lock in reverse order. A low-privileged local user capable of loading BPF programs on affected Linux 6.9+ systems can exploit this AB-BA deadlock opportunity or operate on stale VMA pointers after concurrent unmapping, potentially corrupting kernel memory and escalating privileges. No public exploit code has been identified at time of analysis, and EPSS scores place current exploitation probability at a low 0.15%.
Out-of-bounds kernel memory read in the Linux kernel's ocfs2 filesystem allows disclosure of adjacent kernel data when a maliciously crafted or corrupted ocfs2 volume is mounted and a fast symlink is read. ocfs2_validate_inode_block() failed to validate zero-cluster (fast) symlink dinodes, so ocfs2_fast_symlink_read_folio() would strnlen()/memcpy an inline payload whose i_size exceeds the inline area or lacks a terminating NUL, copying past the inode block buffer (KASAN flagged a 3905-byte over-read via readlink). No public exploit identified at time of analysis; EPSS is low at 0.15% (5th percentile) and the issue is not in CISA KEV.
Integer underflow in the ocfs2 filesystem's FITRIM implementation allows a local low-privileged user to corrupt filesystem data or trigger a crash by submitting a trim range shorter than one cluster. The validation in ocfs2_trim_mainbm() checks against sb->s_blocksize instead of s_clustersize; on filesystems where cluster size exceeds block size, a range that passes the block-size check gets shifted to len==0, after which pointer arithmetic involving start + len - 1 and len -= ... underflows, driving the trim operation past the requested bounds. No public exploit has been identified at time of analysis, and EPSS is 0.18% (7th percentile), consistent with its low real-world exploitation priority.
Use-after-free in the Linux kernel's netfilter conntrack timeout subsystem (nf_ct_timeout) allows a local low-privileged attacker to corrupt kernel memory by exploiting improper reference counting between the data plane and control plane lifecycle of timeout policy objects. Affected versions span from Linux 3.4 through pre-7.1.5/7.2-rc1, covering a very wide range of deployments wherever custom conntrack timeout policies are active. No public exploit code has been identified and EPSS sits at 0.15% (5th percentile), but the local high-impact profile (C:H/I:H/A:H) and the ubiquity of the Linux kernel make patching a clear priority for affected configurations.
Kernel memory corruption in the Linux RDMA/siw (soft-iWARP) driver lets a remote peer trigger a slab use-after-free during connection setup: siw_socket_disassoc() can drop the last reference on an endpoint and free it, after which siw_cm_work_handler() still dereferences the stale endpoint pointer. The demonstrated impact is a KASAN-confirmed use-after-free crash after a malformed MPA request, exploitable only where the siw module is loaded and an iWARP listener is active. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile) with no CISA KEV listing, so the 9.8 NVD score overstates practical risk for typical deployments.
Stale red-black tree node linkage in the Linux kernel BPF subsystem enables a use-after-free condition when a refcounted BPF object survives teardown of its owning rbtree root and that root's memory address is subsequently reused. Local attackers with BPF-capable low-privilege accounts can exploit the incorrect owner validation in bpf_rbtree_remove() to trigger rb_erase_cached() against stale, invalid tree pointers, potentially achieving kernel memory corruption with full confidentiality, integrity, and availability impact. No public exploit code has been identified and EPSS sits at the 6th percentile; patch commits are available across multiple stable branches.
Race condition in the kernfs xattr subsystem of Linux kernel 7.1 and earlier allows local low-privileged users to corrupt shared xattr structures across multiple superblocks, resulting in high-impact confidentiality, integrity, and availability compromise. The flaw arises specifically in namespace-multiplexed environments where kernfs_test_super() allows distinct superblocks to share a single kernfs_node while VFS locking remains per-inode and therefore insufficient. No public exploit has been identified at time of analysis; EPSS probability is 0.15% (5th percentile), indicating that despite the high CVSS score, widespread exploitation is currently assessed as unlikely.
Heap buffer overflow in the Linux kernel wcn36xx WiFi driver allows an adjacent-network attacker without authentication to corrupt kernel heap memory with firmware-controlled content. The vulnerability exists in the synchronous HAL response dispatcher for Qualcomm WCN36xx chipsets, which copies all firmware responses into a fixed 4096-byte buffer without first validating response length. Successful exploitation from an adjacent network position yields high confidentiality, integrity, and availability impact - consistent with potential kernel code execution. EPSS is low at 0.19% and no active exploitation is confirmed, but the lack of authentication requirement and network-adjacent reachability elevate real-world concern for affected embedded and mobile platforms. Patches are available across multiple stable kernel branches.
Out-of-bounds heap read in the Linux kernel's wcn36xx WiFi driver exposes kernel memory and risks system crashes on any adjacent-network attacker within radio range of a device using a Qualcomm WCN36xx series chipset. The flaw, introduced at commit 43efa3c0f241e04862be8e6a68ff765d36cde1ba (Linux 4.11 era), allows the PRINT_REG_INFO firmware indication handler to iterate over rsp->regs[] using a firmware-controlled rsp->count value that is never validated against the actual received message length, enabling reads beyond the heap-allocated buffer. No public exploit has been identified and EPSS is very low at 0.18% (7th percentile), but the CVSS 8.1 score and the availability of patches across seven stable branches make this a concrete patch priority for platforms running Qualcomm WCN36xx hardware.
Sleepable BPF_LSM_CGROUP programs can be loaded into the Linux kernel without verifier rejection, causing a kernel BUG when those programs invoke blocking helpers inside an RCU read-side critical section. The cgroup BPF shim runs under rcu_read_lock_dont_migrate(), which prohibits sleeping; if a program marked BPF_F_SLEEPABLE attaches to an LSM cgroup hook such as file_open and calls bpf_get_dentry_xattr(), the kernel triggers a 'sleeping function called from invalid context' BUG. No public exploit identified at time of analysis; EPSS at 0.17% reflects the niche exploitation path requiring BPF-loading capability.
Out-of-bounds slab read in the Linux kernel's ASoC AMD ACP SoundWire legacy machine driver allows a local attacker - or a hardware-triggered probe path - to read beyond an allocated array in create_sdw_dailinks(), potentially causing kernel memory disclosure or denial of service. The vulnerability is introduced when all DAI link entries are initialized, causing the boundary-unchecked loop to walk past the end of the soc_dais allocation. KASAN confirmed the read-of-size-1 in mc_probe(). EPSS is at 0.17% (6th percentile) and the vulnerability is not listed in CISA KEV; no public exploit has been identified at time of analysis. Fixes are available for Linux stable branches 6.18.40 and 7.1.5, as well as the 7.2-rc1 mainline.
Out-of-bounds array read in the Linux kernel's AMD ACP SoundWire SOF audio driver exposes kernel memory to local attackers on systems equipped with AMD SoundWire hardware. The flaw in create_sdw_dailinks() allows iteration past the end of the allocated sof_dais array when all entries are initialized, lacking any bounds guard on the loop termination condition. No active exploitation is recorded (EPSS 0.17%, 6th percentile; no CISA KEV entry), and patches are available across multiple Linux stable branches.
Lockless directory traversal in the Linux kernel configfs subsystem allows a low-privileged local user to race concurrent lseek() operations against directory iteration, corrupting or dereferencing freed cursor objects in kernel memory. Affecting all Linux kernels from version 2.6.27 through multiple long-term stable branches (fixed in 7.1.5, 6.18.40, 6.12.97, 6.6.145, 6.1.178, 5.15.212, and 5.10.261), successful exploitation could yield full kernel privilege escalation with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and EPSS sits at 0.18% (7th percentile), indicating low near-term exploitation probability.
Use-after-free in the Linux kernel iommufd subsystem allows a local low-privileged attacker on IOMMU-enabled systems to corrupt kernel memory by triggering dmabuf invalidation callbacks against already-destroyed page structures during detach. Affected configurations include virtualization hosts using VFIO or vDPA device passthrough where the iommufd framework is active. The CVSS S:C (Changed Scope) rating reflects the potential for cross-workload impact in multi-tenant environments; no public exploit identified at time of analysis, and EPSS at 0.15% (5th percentile) indicates negligible observed exploitation activity.
Use-after-free in the Linux kernel mt76 MediaTek WiFi driver allows a local low-privileged attacker to dereference freed memory during concurrent TX datapath operations, potentially achieving full kernel compromise (C:H/I:H/A:H). The flaw exists in mt76_put_vif_phy_link(), where kfree() is called on an offchannel link structure immediately after rcu_assign_pointer(NULL) - without synchronizing against in-flight RCU readers in the TX softirq path (mt7996_mac_write_txwi) that already hold the pointer. No public exploit is identified at time of analysis, and EPSS of 0.17% (6th percentile) confirms very low current exploitation activity despite a CVSS score of 7.8.
Token resource leak in the Linux kernel mt7996 WiFi driver (mt76 subsystem) allows an adjacent unauthenticated attacker to exhaust TX tokens by repeatedly triggering failed link_conf or link_sta lookups in mt7996_tx_prepare_skb(), potentially degrading or crashing WiFi functionality on affected devices. The provided CVSS 8.8 score with C:H/I:H/A:H is notably high for what the description characterizes as a resource management bug; the actual impact most closely aligns with denial-of-service through token exhaustion, not direct confidentiality or integrity compromise. No public exploit code exists and EPSS sits at 0.17% (6th percentile), indicating minimal current exploitation interest. Patches are available in Linux 6.18.40, 7.1.5, and 7.2-rc1.
Invalid pointer dereference in the Linux kernel btrfs delayed reference processing loop (`__btrfs_run_delayed_refs()`) allows a local attacker with access to a btrfs-mounted volume to crash the kernel, causing a denial of service. The defect was introduced by a refactoring commit (0110a4c43451) that inadvertently removed safety guards which reset an internal pointer to NULL when `btrfs_select_ref_head()` returns `ERR_PTR(-EAGAIN)`, causing a subsequent `spin_lock()` call on the error code value treated as a pointer address. No public exploit code has been identified and EPSS probability is 0.18% (7th percentile), though patches are available across all active stable kernel branches.
Linux kernel ixgbe driver on Intel E610 adapters triggers a KASAN slab-out-of-bounds write when an XDP program is loaded on hosts with 64 or more logical CPUs. The root cause is a queue-count mismatch: MSI-X constraints cap the netdev at 63 queue pairs on E610, but XDP allocates 64 queues on ≥64-CPU systems, causing netif_set_xps_queue() to write 4 bytes beyond the allocated slab at queue index 63. With EPSS at 0.15% (5th percentile), no KEV listing, and hardware-specific trigger conditions, real-world exploitation is low-probability but not negligible in high-CPU-count data center environments running this Intel hardware.
Resource leak in the Linux kernel NFS server (NFSD) allows connected NFS clients to cause a denial-of-service condition by sending FREE_STATEID for an admin-revoked parallel NFS (pNFS) layout stateid. The kernel function nfsd4_drop_revoked_stid() lacks handling for the SC_TYPE_LAYOUT case, causing the stateid to remain allocated in the IDR tree and on the per-client list indefinitely rather than being properly unhashed and freed. No public exploit exists and EPSS is 0.17% (6th percentile), but the unauthenticated network vector and availability impact score of 7.5 warrant attention on NFS servers with pNFS layouts enabled. Vendor-released patches are available in stable kernel branches.
Incorrect file-handle hashing in the Linux kernel's lockd (NLM) server causes NLMv4 lock-state lookups to fail intermittently. When a client presents an NFS file handle shorter than LOCKD_FH_HASH_SIZE (32 bytes), file_hash() digests stale bytes left in the argument buffer from a prior request, so the same wire handle hashes into different nlm_files[] buckets across calls and nlm_lookup_file() misses existing lock records. This is a functional-correctness and reliability defect introduced by commit 3de744ee4e45 during the xdrgen NLMv4 TEST conversion; a vendor patch is available, EPSS is low (0.15%), and there is no public exploit identified at time of analysis and no CISA KEV listing.
Unsafe destructor execution in the Linux kernel BPF subsystem allows a local attacker with BPF program loading privileges to trigger memory corruption by causing map value cleanup routines to run from NMI (Non-Maskable Interrupt) context. The flaw affects array and hashtab BPF maps containing special fields such as referenced kptrs, uptr, timer, workqueue, and graph roots - destructors for these types are not NMI-safe, yet tracing BPF programs can invoke map update or delete operations from that context. No active exploitation has been identified (not in CISA KEV); EPSS is 0.17% (7th percentile), consistent with a locally-exploitable kernel flaw requiring specialized capabilities.
Use-after-free in the Linux kernel VDUSE (vDPA Device in Userspace) subsystem allows a local low-privileged user to corrupt kernel memory and escalate privileges to full kernel control. The flaw exists in vduse_dev_open(), which releases vduse_lock after an IDR lookup but before acquiring dev->lock, creating a race window where a concurrent VDUSE_DESTROY_DEV ioctl can remove and free the same struct vduse_dev object - causing the open path to later dereference freed memory. No public exploit code and no CISA KEV listing are identified at time of analysis, and EPSS sits at 0.17% (7th percentile), indicating low current exploitation probability despite a high CVSS score of 8.8.
Out-of-bounds kernel memory access in the Linux kernel vhost/vdpa subsystem allows a local attacker with low privileges to crash the system or trigger invalid physical memory mappings via crafted mmap operations. The vhost_vdpa_mmap() and vhost_vdpa_fault() functions accept a user-controlled virtqueue index from vma->vm_pgoff without validating it against the driver's configured queue count (v->nvqs), while the ioctl path already enforces both a bounds check and array_index_nospec(). Patches are available across all active stable branches; EPSS is 0.18% (7th percentile) and the vulnerability is not listed in CISA KEV.
Guest kernel crash in the Linux virtio RTC driver occurs during device restore when stale virtqueues are not cleaned up before reinitialization. Systems running virtual machines with a virtio-rtc device exposed are affected across Linux kernel versions up to 6.18.40 and 7.1.5 stable series. A local low-privileged user on the guest who triggers a suspend/resume cycle under conditions where virtqueue reinitialization fails can dereference a NULL info pointer in vp_del_vq(), panicking the guest kernel. No public exploit is identified at time of analysis, and EPSS of 0.17% (6th percentile) confirms exploitation is not currently widespread.
Local memory corruption in the Linux kernel's vhost-net driver arises from mishandling of zerocopy TX completion: vhost_zerocopy_complete() treats every ubuf_info callback as a finished vhost descriptor, so when the networking stack clones a zerocopy skb (e.g. batman-adv fragmentation via skb_split/skb_zerocopy_clone, or veth forwarding via skb_copy_ubufs) and a backend reset frees the vhost_net_ubuf_ref, a later delayed completion dereferences the freed ubufs pointer - a slab use-after-free confirmed by KASAN. It affects virtualization hosts running vhost-net with zerocopy TX, and a successful trigger yields kernel memory corruption (crash and potential privilege escalation). There is no public exploit identified at time of analysis, EPSS is low (0.17%), and a vendor patch is available across multiple stable branches.
Incorrect IRQ-to-ring mapping in the Linux kernel's vdpa/octeon_ep driver mishandles interrupt routing on Marvell OCTEON EP devices that expose non-contiguous or non-zero-based IRQ numbers, causing the interrupt handler to index the wrong virtqueue ring. Only systems with OCTEON EP hardware using the vDPA data path are affected, and the fix ships in stable kernels 6.18.40, 7.1.5, and 7.2-rc1. There is no public exploit identified at time of analysis, EPSS is very low (0.17%, 6th percentile), and the published 10.0 CVSS vector is inconsistent with the local, hardware-specific nature of the flaw.
Out-of-bounds write in the Linux kernel's vfio/qat driver allows a local low-privileged user with access to the Intel QuickAssist Technology virtual function migration interface to corrupt kernel memory through a race condition. The root cause is a Time-of-Check Time-of-Use flaw in qat_vf_resume_write(), where two concurrent writers can both pass the filp->f_pos boundary check before the lock is held, causing the second writer to copy data past the end of the migration-state buffer once the first writer has already advanced the file position. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% at the 6th percentile reflects low current exploitation probability; vendor-released patches are available in stable kernel series 6.12.97, 6.18.40, and 7.1.5.
Out-of-bounds memory access in the Linux kernel BPF cgroup storage subsystem exposes multiple stable kernel branches to local privilege escalation, stemming from an incomplete fix for predecessor commit abad3d0bad72. A local attacker with CAP_BPF privilege can construct a tail call chain using a storage-less intermediate BPF program as a bridge between two cgroup-storage-using programs (A→B(no storage)→C(storage)), bypassing cookie validation and causing runtime cgroup local storage in the callee to operate on the original caller's context, triggering an out-of-bounds kernel memory access with C:H/I:H/A:H impact. EPSS is low at 0.17% (7th percentile) and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Use-after-free in the Linux kernel Bluetooth HCI core subsystem allows a local attacker with low privileges to corrupt kernel memory and potentially escalate privileges or crash the system. The hci_unregister_dev() function fails to quiesce cmd_timer and ncmd_timer delayed work items before freeing the hci_dev structure, creating a race window where timer callbacks dereference stale memory including the hdev->reset function pointer. EPSS is very low at 0.17% (6th percentile), no active exploitation has been confirmed, and patched versions are available across multiple Linux stable kernel branches.
Out-of-bounds memory read in the Linux kernel Bluetooth HCI subsystem enables a malformed or malicious Bluetooth controller response to the Read Local Codec Capabilities command to cause the kernel to copy one byte beyond the HCI response payload into the codec list. All kernel versions from 5.16 onward that include Bluetooth codec capability support are affected, and fixed stable releases are available across the 6.1, 6.6, 6.12, 6.18, and 7.1 branches. No public exploit has been identified, and the 7th-percentile EPSS score of 0.17% indicates negligible opportunistic exploitation risk at this time.
Undefined behavior from a signed integer overflow in the Linux kernel's RDMA/mlx5 driver exposes systems with Mellanox ConnectX RDMA hardware to local privilege escalation or kernel crash. The flaw in set_rq_size() accepts user-supplied rq_wqe_shift values up to and including 32, causing signed 32-bit integer overflow when computing '1 << rq_wqe_shift' - undefined behavior under the C standard that can corrupt kernel memory structures. The vulnerability carries a CVSS 7.8 High score but EPSS of just 0.18% (7th percentile) and is absent from CISA KEV, indicating no public exploit or active exploitation at time of analysis.
Incorrect UAR index release in the Linux kernel RDMA/mlx5 driver allows a local attacker with low privileges to corrupt kernel-level resource tracking structures, potentially enabling privilege escalation, information disclosure, or denial-of-service via kernel crash. All kernel versions from 4.16 through the fixed stable releases (6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5) are affected on systems equipped with Mellanox/NVIDIA ConnectX RDMA hardware. No public exploit code or active exploitation has been identified; EPSS stands at 0.17% (7th percentile), indicating very low current exploitation probability.
Out-of-bounds read in the Linux kernel's ASoC hdac_hdmi HDMI audio codec driver allows a local attacker with low privileges to expose sensitive kernel memory or crash the kernel by writing a crafted out-of-range enum value to the ALSA control interface. The flaw exists in hdac_hdmi_set_pin_port_mux(), which indexes the texts array using the attacker-supplied value before the bounds-checking helper snd_soc_dapm_put_enum_double() has a chance to reject it. Patches are confirmed available across seven stable kernel branches; with an EPSS of 0.17% and no CISA KEV listing, no active exploitation has been identified at time of analysis.
Missing input validation in the Linux kernel's ASoC Meson AIU audio driver allows a local low-privileged attacker to supply out-of-range enum values to HDMI and internal codec mux put callbacks, triggering snd_soc_enum_item_to_val() on unvalidated input and resulting in out-of-bounds kernel memory access. Systems running Linux 5.7 through pre-7.1.5 on Amlogic Meson SoC hardware are affected, with potential for high confidentiality impact (kernel memory disclosure), limited integrity impact, and kernel crash (availability). No public exploit code exists and exploitation probability is very low (EPSS 0.15%, 5th percentile), but the local attack vector and low privilege requirement mean any user with ALSA device access on affected hardware is a potential threat actor.
Input validation bypass in the Linux kernel's FSL audmix ASoC driver allows a local low-privileged user to write out-of-range enum values to ALSA mixer controls, triggering out-of-bounds memory access in kernel space with potential for privilege escalation or kernel memory disclosure. Specifically, fsl_audmix_put_mix_clk_src() uses an unvalidated value in a BIT() shift operation, and fsl_audmix_put_out_src() uses it to index the prms transition table, both before any bounds check is performed. No public exploit exists and EPSS is extremely low (0.18%, 7th percentile), but the CVSS score of 7.8 reflects the high kernel-level impact if exploited on hardware where the driver is active.
Out-of-bounds array read in the Linux kernel's ASoC Tegra audio driver (tegra210_ahub) allows a local attacker with low privileges to disclose kernel memory contents or trigger a kernel panic on NVIDIA Tegra 210-based systems. The flaw in tegra_ahub_put_value_enum() accesses e->values[item[0]] before validating that item[0] falls within the valid enum range, making the existing bounds check ineffective. Patches are confirmed across multiple stable kernel branches; no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Linux kernel's IPv4 Forwarding Information Base (FIB) subsystem enables a local low-privileged attacker to corrupt kernel memory, potentially escalating to root. The flaw manifests in fib_leaf_notify() when network device driver callbacks - mlxsw, rocker, and nsim - invoke refcount_inc() on a dying fib_info object under RCU, violating reference-counting safety and triggering the 'addition on 0; use-after-free' kernel warning confirmed by syzbot. Patches are available in Linux 7.1.5 stable and 7.2-rc1; no public exploit or CISA KEV listing has been identified at time of analysis.
Concurrent use-after-free-adjacent race condition in the Linux kernel's FIB rules subsystem allows a local low-privileged user to trigger a kernel refcount complaint - and potentially a system crash or memory corruption - by racing a FIB rules dump against the teardown of a dying fib_rule object. Affected versions span multiple long-term stable branches from 4.12 onward through 7.x series kernels prior to the backported fix commits. No public exploit has been identified at time of analysis, and the EPSS score of 0.18% (7th percentile) reflects low exploitation probability; exploitation is not confirmed in the CISA KEV catalog.
Out-of-bounds read in the Linux kernel's SCTP protocol implementation allows a malicious SCTP peer to trigger memory over-reads during INIT or ASCONF chunk processing. The flaw stems from insufficient validation of an embedded address parameter's declared length inside ADD_IP, DEL_IP, and SET_PRIMARY ASCONF parameters, letting a crafted peer advertise a length exceeding the enclosing parameter's bounds. No public exploit has been identified at time of analysis, EPSS is low (0.18%), and it is not on CISA KEV, but the CVSS 9.1 score reflects remote unauthenticated reachability against SCTP-enabled hosts.
Incorrect teardown ordering in the Linux kernel's netkit queue lease subsystem allows a local attacker with low privileges to trigger a race window where live NAPI polling consumes net_iov entries whose DMA addresses have already been cleared, causing the physical NIC to DMA to a stale or zero address. Affected kernel versions span from the introducing commit 5602ad61ebee through the 7.1 stable series, with fixes landing in 7.1.5 and 7.2-rc1. No public exploit code exists and EPSS probability stands at 0.15%, but the S:C scope change in the CVSS vector signals that successful exploitation can corrupt memory beyond the vulnerable process boundary, potentially enabling privilege escalation.
Privilege escalation in the Linux kernel's TIPCv2 generic netlink interface exposes mutating operations - including TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and bearer enable/disable - to any local unprivileged process. The legacy TIPCv1 netlink API already enforces CAP_NET_ADMIN via netlink_net_capable(), but TIPCv2's generic netlink handlers omit the GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM flags, creating an enforcement gap. A QEMU/KASAN reproducer running as uid/gid 65534 with zero effective capabilities confirmed the flaw: an attacker can alter network identity, inject or flush cryptographic key material, and disrupt bearer connectivity. No public exploit has been identified and EPSS is very low (0.21%), but the primitives are straightforward for any local user.
TIPC connection send-side denial of service in the Linux kernel allows a remote TIPC peer to permanently wedge a connection by sending a crafted CONN_ACK message with an inflated acknowledgment count. When the peer-supplied count exceeds the unsigned 16-bit snt_unacked counter in tipc_sk_conn_proto_rcv(), integer underflow wraps the counter to a near-maximum value, causing tsk_conn_cong() to report congestion indefinitely and blocking all further transmits on that connection. This affects Linux kernels from the commit that introduced TIPC connection ack handling (around 4.7) through multiple stable branches prior to the backported fixes. No public exploit has been identified and EPSS is 0.21% (12th percentile), indicating low opportunistic risk despite the AV:N CVSS rating.
Unbounded kernel memory exhaustion in the Linux kernel TIPC subsystem allows a malicious peer node to cause a denial-of-service condition by sending PUBLICATION messages with inverted service-range bounds (lower > upper). Kernels from version 4.17 onward accept these malformed bindings in the name-distribution network receive path - unlike the local bind path, which enforces ordering via tipc_uaddr_valid() - causing service_range rbtree entries and associated publication structures to be permanently leaked with no per-peer cap, for the lifetime of the namespace. No public exploit or CISA KEV listing exists, and EPSS is very low (0.21%, 11th percentile), but the attack is mechanically straightforward for any attacker already operating as a TIPC peer.
Improper error-path cleanup in the Linux kernel's Marvell OcteonTX crypto hardware-accelerator driver (crypto/marvell/octeontx) mishandles DMA unmapping: on a mapping failure the sg_cleanup loop indexes list[i] instead of list[j], leaking successfully mapped scatter-gather entries while repeatedly unmapping the already-failed one. Only systems with Marvell OcteonTX crypto hardware and this driver loaded are affected. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile) and the issue is not in CISA KEV.
Resource-leak and repeated-unmap defect in the Linux kernel's Cavium/Marvell CPT cryptographic accelerator driver (crypto/cavium/cpt) mishandles its DMA error-cleanup path, using the outer loop index (list[i]) instead of the inner index (list[j]) so that successfully mapped scatter-gather entries leak while the single failed entry is unmapped repeatedly. It affects only systems running the cavium CPT driver against OcteonTX CPT hardware, is reachable solely when a DMA mapping failure occurs during request setup, and is a local reliability/resource-management bug rather than a remotely exploitable code-execution flaw. No public exploit identified at time of analysis; EPSS is 0.18% (7th percentile) and it is not in CISA KEV.
Corrupted DMA length assignments in the Linux kernel's iommu/dma-iommu subsystem allow a local attacker with low privileges to trigger memory corruption through the PCI Peer-to-Peer DMA (P2PDMA) code path, potentially achieving confidentiality, integrity, and availability impact across scope boundaries. The flaw stems from a variable typo in iommu_dma_map_sg() where multi-segment P2PDMA scatterlists receive the head segment's length for all entries, corrupting DMA mappings and leading to out-of-bounds memory operations. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.19% (9th percentile) reflects low observed exploitation probability.
Out-of-bounds kernel memory access in the Linux kernel CXL (Compute Express Link) region driver allows a local attacker on systems equipped with CXL memory hardware to corrupt kernel memory by causing cxl_cancel_auto_attach() to use a negative errno value as an array index into p->targets[]. The flaw originates when cxl_region_sort_targets() fails - setting cxled->pos to a negative errno - and that invalid index is later used directly without validation. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.15% at the 5th percentile, reflecting very low real-world exploitation probability consistent with the niche CXL hardware requirement.
Missing authorization on the handshake genl family's DONE downcall in Linux kernel 6.4 and later allows a local low-privileged process to forge TLS handshake completion signals to the kernel's TLS infrastructure. Any unprivileged user that can observe or guess a valid sockfd associated with an in-flight handshake request can submit a crafted DONE message - either with STATUS=0 to make the kernel consumer accept a session as if TLS authentication succeeded, or with a non-zero status to abort a legitimate handshake before the trusted agent tlshd can report its real result. No public exploit has been identified at time of analysis, and EPSS is very low (0.17%), but patches are confirmed across multiple stable branches.
Null-pointer dereference in the Linux kernel's rxrpc subsystem allows a remote unauthenticated attacker to crash the kernel by sending a forged ACKALL control packet to an exposed rxrpc service. Affected systems run Linux from commit b341a0263b1b804d329f864c2dc24815364510ec through the fixes landed in stable releases 6.18.40 and 7.1.5; Linux 6.14 is explicitly confirmed affected. No public exploit has been identified and EPSS probability is very low at 0.15%, but the network-accessible, no-authentication attack path warrants immediate patching on any system actively serving rxrpc traffic.
Kernel panic via rxrpc protocol mishandling in the Linux kernel allows a network-positioned attacker to crash an AFS client system by sending a premature reply DATA packet before any request packets have been transmitted on a client call. The flaw resides in rxrpc_receiving_reply(), which fails to verify call exposure state before invoking rxrpc_rotate_tx_window() - a function whose do...while loop oopses on an empty transmit queue. Fixes have been backported to stable branches 7.1.5 and 6.18.40; no public exploit has been identified and EPSS exploitation probability is extremely low at 0.15% (5th percentile), indicating no known active exploitation.
Denial of service (and potential memory corruption) in the Linux kernel's AF_RXRPC networking stack stems from a double unlock in rxrpc_recvmsg() triggered while handling out-of-band (OOB) messages, affecting kernels from roughly 6.16 up to the fixed 6.18.40, 7.1.5 and 7.2-rc1 releases. Releasing an already-released lock corrupts kernel lock state and can crash the host or open a race window. No public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile).
Use-after-free / stale work-item race in the Linux kernel's kAFS (Andrew File System client) network-namespace teardown path allows a use-after-free when an afs netns is destroyed. Fixed upstream (this issue was found by AI review), the flaw stems from afs_charge_preallocation() and afs_rx_new_call() failing to stop the rxrpc preallocation 'charger' work item before incoming calls are disabled during net-namespace deletion, so the charger can run against freed/torn-down state. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and it is not in CISA KEV, so this is a correctness/stability defect far below the raw CVSS 9.8 rating.
Denial-of-service in the Linux kernel's AFS (Andrew File System) cache manager allows remote attackers to crash or destabilize systems running AFS by sending a crafted CB.InitCallBackState3 callback request that arrives without an associated server record. The CB.InitCallBackState3 handler failed to perform the null-check present in all other callback handlers, meaning an unexpected or spoofed callback packet lacking a peer-to-server mapping causes a kernel-level fault. No public exploits have been identified, and EPSS places exploitation probability at just 0.16% (5th percentile), reflecting the niche deployment footprint of AFS.
Improper bounds enforcement in the Linux kernel's accel/amdxdna driver allows a local low-privileged user to trigger a kernel-to-userspace copy that exceeds the application-provided buffer size via a crafted ioctl call. The root cause is that copy_to_user() was using the kernel's internal data size rather than the caller-supplied buffer size to bound the copy, enabling overflow into adjacent userspace memory and exposure of unintended kernel data. No public exploit exists and no active exploitation has been confirmed, but the CVSS vector (C:H/I:H) reflects a real dual-impact risk: confidentiality loss from kernel memory spillover and integrity loss from overwriting adjacent user-space structures.
Integer overflow in the Linux kernel's legacy DRM radeon driver exposes systems with older ATI/AMD Radeon GPUs to kernel memory corruption via crafted dumb-buffer allocation requests from a low-privileged local user. The flaw resides in radeon_align_pitch(), where both the alignment round-up addition and the final width-times-bytes-per-pixel multiplication can overflow signed 32-bit integers, causing radeon_mode_dumb_create() to return an invalid pitch or allocate a zero-sized kernel buffer - a condition that can be leveraged for heap corruption. EPSS sits at 0.16% (5th percentile) with no CISA KEV listing and no public proof-of-concept, indicating active exploitation has not been confirmed; however, the low-privilege local vector and straightforward arithmetic overflow make this notable for shared Linux systems with this legacy hardware.
Type confusion in the rtw89 PCI Advanced Error Reporting (AER) handlers corrupts kernel memory on Linux systems equipped with Realtek RTL8852CE and related WiFi adapters. The driver stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() incorrectly retrieve it as a net_device pointer, causing netif_device_detach/attach to read and write at wrong memory offsets within a misidentified kernel struct. An adjacent-network attacker within WiFi range could potentially trigger the faulty AER handler path by inducing hardware-level PCI errors via crafted 802.11 frames, resulting in kernel memory corruption. No public exploit exists and EPSS is 0.17% (6th percentile), indicating low observed exploitation activity despite a high CVSS score of 8.8.
Type confusion in the rtw88 Realtek PCIe Wi-Fi driver's PCI Advanced Error Reporting (AER) handlers allows an adjacent-network attacker to corrupt kernel memory, potentially enabling privilege escalation or arbitrary kernel code execution on Linux systems using Realtek PCIe Wi-Fi hardware. The driver stores an ieee80211_hw pointer via pci_set_drvdata() at probe time but retrieves it as a net_device pointer in io_error_detected() and io_resume(), causing netif operations to read and write kernel memory at incorrect struct offsets. No public exploit code has been identified, EPSS places exploitation probability at 0.17% (6th percentile), and the vulnerability is not listed in CISA KEV.
Kernel soft lockup and system panic in the Linux rtw89 Wi-Fi driver affects systems with Realtek RTW89 802.11ax chipsets during 6GHz band scanning. The root cause is an integer truncation bug where the loop counter variable `i` is silently narrowed to 8 bits via a `movzbl %bl, %eax` instruction; when `req->n_6ghz_params` exceeds 255, the counter wraps to zero and the loop never terminates, trapping the CPU for 26+ seconds until the watchdog fires and triggers a kernel panic. No public exploit identified at time of analysis, and EPSS of 0.17% at the 6th percentile reflects low exploitation probability despite the provided CVSS score of 8.8.
Out-of-bounds read in the Linux kernel's rtw88 PCIe WiFi driver allows an adjacent-network attacker to trigger kernel memory disclosure or a system crash via crafted WiFi RX descriptor values. Systems running unpatched kernels with Realtek RTW88-series WiFi chipsets attached over PCIe are affected; the USB transport path was already protected by an equivalent check. The vulnerability arises because the PCIe receive path in rtw_pci_rx_napi() does not validate that the firmware-derived new_len value stays within the pre-allocated DMA buffer before calling skb_put_data. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog.
Out-of-bounds array indexing in the Linux kernel's rtw89 WiFi driver exposes systems using Realtek 802.11ax hardware to kernel memory corruption or disclosure from adjacent network attackers. The driver accepts an 8-bit mac_id (range 0-255) from firmware-processed RX descriptors and uses it without validation to index into assoc_link_on_macid[], which contains only 128 entries - creating a 128-entry gap where attacker-controlled values trigger reads or writes beyond the array boundary. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at 0.17% (6th percentile), but the CVSS 8.8 score reflects the full kernel memory impact achievable by an unauthenticated adjacent attacker.
Out-of-bounds array access in the Linux kernel's ath9k WiFi driver allows an adjacent network attacker to trigger kernel memory corruption via a maliciously crafted firmware transmit status queue ID. The ath_tx_edma_tasklet() function blindly indexes sc->tx.txq[] using a 4-bit hardware field (range 0-15) against an array of only 10 entries (ATH9K_NUM_TX_QUEUES), meaning any qid value of 10 or greater causes an OOB memory access with potential for high confidentiality, integrity, and availability impact. No active exploitation is confirmed (not in CISA KEV), and EPSS stands at 0.18% (7th percentile), but the adjacent-network, no-authentication attack vector keeps this relevant for environments running Atheros 802.11n hardware.
Kernel panic via NULL pointer dereference in the Linux kernel's ath11k PCI WiFi driver affects systems running kernel versions from 5.19 through pre-7.1.5/7.2-rc1 with Qualcomm PCI-attached WiFi chipsets such as WCN6855. The race condition occurs when a system reboot overlaps with WLAN firmware crash recovery (Subsystem Reset, SSR), causing the MHI teardown path and SSR recovery path to simultaneously attempt to deinitialize MHI and free DMA-backed contexts, resulting in a double-free scenario and kernel crash. No public exploit code exists and EPSS exploitation probability is very low at 0.15%, consistent with an accidental-trigger vulnerability rather than a targeted attack vector.
Denial of service in the Linux kernel's VXLAN driver stems from a race condition in vxlan_gro_prepare_receive(): udp_tunnel_sock_release() can set sk->sk_user_data to NULL while GRO processing is mid-flight, producing a NULL-pointer dereference and kernel panic. It affects hosts using VXLAN overlay tunnels across numerous stable branches, is fixed upstream, and has no public exploit identified at time of analysis (EPSS 0.17%). The published NVD CVSS of 9.8 (C:H/I:H/A:H) overstates impact - the actual effect is a crash, not code execution or data disclosure.
Reference count corruption in the Linux kernel's Operating Performance Points (OPP) subsystem exposes systems to memory corruption and potential privilege escalation via a race condition between OPP object addition and frequency lookup. Affected kernels from 4.11 through stable branches predating commits to 7.1.5 and 6.18.40 are vulnerable when concurrent DVFS (Dynamic Voltage and Frequency Scaling) operations race during OPP table construction. No public exploit exists and EPSS sits at 0.17% (6th percentile), suggesting no known widespread exploitation; however, the H/H/H CVSS impact reflects the severity of kernel memory corruption if triggered.
Heap buffer overflow in the Linux kernel CCP driver's snp_filter_reserved_mem_regions() function enables a low-privileged local attacker to corrupt kernel memory on AMD SEV-SNP-enabled systems. The off-by-one error in the boundary check permits a 4-byte write past a PAGE_SIZE kzalloc buffer when 255 or more IOMEM reserved memory regions are present, yielding full High impact on confidentiality, integrity, and availability per CVSS 7.8. No public exploit has been identified and EPSS stands at 0.19% (8th percentile), indicating no current widespread exploitation activity despite the severity score.
Incorrect NULL-check ordering in the Linux kernel's crypto/ccp driver exposes AMD SEV-SNP systems to kernel memory corruption during Trusted I/O firmware initialization. On architectures without HASHED_PAGE_VIRTUAL, passing the return value of __snp_alloc_firmware_pages() directly to page_address() before checking for NULL causes page_address(NULL) to return a deterministic but invalid non-zero address, silently bypassing the allocation-failure guard and allowing sev_tsm_init_locked() to dereference garbage memory. Affected kernel versions span from commit 4be423572da1f4c1 through the patched releases (7.1.5, 7.2-rc1, 6.19); no public exploit identified at time of analysis, and EPSS is 0.16% (5th percentile), consistent with zero confirmed in-the-wild exploitation.
Use-after-free in the Linux kernel's DLM (Distributed Lock Manager) subsystem stems from incorrect sequence-number ordering of message handles in a node's send_queue, which breaks the before(mh->seq, seq) tail-walk in dlm_receive_ack and leads to refcounting corruption and freeing of an in-use send buffer. It affects Linux kernels using DLM (clustered filesystems such as GFS2/OCFS2) from 5.14 onward, and is fixed in stable releases 6.6.145, 6.12.97, 6.18.40 and 7.1.5. Despite a headline CVSS of 9.8, EPSS is only 0.17% (6th percentile), there is no public exploit, and it is not on CISA KEV - the reporter only reproduced it on an experimental branch with an io_uring userspace benchmark.
Denial of service (and potential memory corruption) in the Linux kernel IPv6 stack arises from a race condition in addrconf_dad_failure() where ifp->lock is transiently dropped, letting a concurrent ipv6_del_addr() poison a list entry that Duplicate Address Detection (DAD) work then dereferences, producing a general protection fault in ipv6_del_addr(). The flaw affects the addrconf DAD-failure path across a broad range of kernel versions and is fixed by folding the state transition into a single locked critical section. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%), and it is not listed in CISA KEV.
Resource leak and premature mutex use in the Linux kernel's mlx5 InfiniBand driver (IB/mlx5) expose systems with Mellanox/NVIDIA ConnectX hardware to local privilege escalation, denial of service, and potential information disclosure. When mlx5_ib_alloc_transport_domain() successfully allocates a transport domain (TD) but mlx5_ib_enable_lb() subsequently fails, the TD object is never freed, leaking kernel memory. Compounding this, the loopback mutex (dev->lb.mutex) was initialized too late - after code paths that could use it - creating a window for undefined kernel behavior. No public exploit exists and EPSS sits at 0.17% (7th percentile), placing real-world risk well below the CVSS 7.8 headline score.
Resource leak and potential mutex deadlock in the Linux kernel's RDMA/mlx5 driver (UMR XLT cleanup path) enables denial-of-service conditions on systems using Mellanox/NVIDIA ConnectX RDMA adapters. The vulnerability exists from commit 1efe8c0670d6a6883faa09c9abc746c741f5664a onward, including Linux 6.16, where a fallible error path in mlx5_odp_populate_xlt() skips the mandatory DMA buffer and XLT mapping cleanup performed by mlx5r_umr_unmap_free_xlt(), and if the emergency XLT page code path was taken, permanently locks xlt_emergency_page_mutex. EPSS is very low at 0.18% (8th percentile), no public exploit code exists, and the vulnerability is not listed in CISA KEV, but RDMA-enabled HPC, storage, and financial infrastructure running affected kernel versions should prioritize patching.
Kernel-level memory corruption in the Linux RDMA SCSI RDMA Protocol target driver (ib_srpt) lets a malicious SRP initiator on the RDMA fabric overflow an integer length calculation and drive a ~4GB out-of-bounds scatter-gather mapping. The flaw stems from adding an attacker-controlled 32-bit immediate-data length to an offset without overflow checking, wrapping req_size below its bounds check. It carries a CVSS 9.8 rating, but there is no public exploit identified at time of analysis and EPSS is low (0.19%, 8th percentile); a vendor patch is available across current stable kernel trees.
Out-of-bounds write in the Linux kernel's RDMA irdma driver allows a local low-privileged user to overflow a fixed-size kernel array and corrupt heap memory, potentially escalating privileges or crashing the system. The flaw exists in irdma_copy_user_pgaddrs, where the loop guard based on palloc->total_cnt is inert when set to zero (the lvl==0 path), allowing a user-supplied umem with more than 4 DMA blocks to write beyond the 4-entry iwmr->pgaddrmem array. Patch-confirmed fixes are available across multiple stable kernel branches; no public exploit code exists and EPSS sits at 0.17%, but the High C/I/A impact of a kernel heap write warrants prompt patching on affected configurations.
Use-after-free in the Linux kernel's ALSA OSS sequencer subsystem allows a local low-privileged attacker to corrupt kernel heap memory by racing SysEx MIDI event dispatch against concurrent sequencer port closure. The vulnerable code path in snd_seq_oss_process_event() stores a raw pointer to SysEx byte data in the event record without retaining a refcount across the full dispatch lifecycle, enabling freed memory to be accessed in snd_seq_event_dup() if the OSS MIDI port is closed before dispatch completes. Vendor-released patches are available at kernel versions 6.18.40 and 7.1.5; no public exploit code and no active exploitation have been identified at time of analysis.
Use-after-free and NULL-pointer dereference in the Linux kernel ALSA sequencer MIDI subsystem allows a local low-privileged user to crash the kernel or potentially escalate privileges by racing MIDI output event processing against port teardown. The flaw exists because `event_process_midi()` reads `msynth->output_rfile.output` without holding any lock, while `midisynth_unuse()` can concurrently free `substream->runtime` before `snd_rawmidi_kernel_write1()` pins its buffer reference - leaving the event path with a dangling pointer confirmed via KASAN null-ptr-deref reproduction. No public exploit identified at time of analysis, and EPSS of 0.17% (7th percentile) signals low current exploitation interest despite the 7.8 CVSS score.
Resource leakage in the Linux kernel's NVMe-over-TCP target subsystem (nvmet-tcp) allows unauthenticated network clients to exhaust kernel queue and socket resources by manipulating a TLS handshake. The flaw in `nvmet_tcp_tls_handshake_done()` ignores the return value of `nvmet_tcp_set_queue_sock()`, so if the socket leaves TCP_ESTABLISHED state during handshake completion - a condition an attacker can induce by timing a connection abort - resources are never cleaned up. No public exploit is identified and EPSS is 0.17%, but repeated triggering can deny service to storage infrastructure running nvmet-tcp with TLS configured.
Out-of-bounds slab write in the Linux kernel's NVMe-multipath driver (nvme_mpath_revalidate_paths) affects hosts whose NUMA node IDs are sparse rather than densely packed from zero, notably some powerpc/POWER9 systems. The nvme_ns_head.current_path[] flexible array is sized with num_possible_nodes() but indexed with the raw numa_node_id(), so on non-contiguous topologies the driver writes a pointer past the end of the allocation during namespace scanning, producing the KASAN slab-out-of-bounds splat shown in the report. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and it is not on CISA KEV, despite an inflated NVD score of 9.8.
Out-of-bounds array access in the Linux kernel's nvme-pci driver crashes the kernel and prevents NVMe namespaces from appearing as /dev nodes on systems built without NUMA support (CONFIG_NUMA=n). The root cause is a signed-to-unsigned type mismatch: NUMA_NO_NODE (-1) is cast to UINT_MAX when passed through a parameter declared 'unsigned', causing nvme_setup_descriptor_pools() to index far beyond the bounds of the descriptor pool array (sized to nr_node_ids). No active exploitation has been identified (not in CISA KEV), and EPSS of 0.17% reflects negligible real-world exploitation probability, though the CONFIG_NUMA=n precondition significantly limits the exposed population to non-enterprise kernel builds.
The host1x GPU driver in the Linux kernel mishandles the return value of iommu_map_sgtable() after an upstream API change switched its return type from size_t (unsigned, zero on error) to ssize_t (signed, negative on error), leaving pin_job() blind to failures. Compounded by pin_job() assigning the result to a plain int - risking overflow on large sizes - an IOMMU mapping failure can be silently treated as success, potentially allowing a low-privileged local user on Tegra hardware to trigger kernel memory corruption and escalate privileges. No public exploit identified at time of analysis; the CVSS 8.8 score with Scope:Changed reflects the theoretical kernel-level blast radius, while the 0.17% EPSS and absence of CISA KEV listing indicate low current exploitation activity.
Out-of-bounds memory access in the Linux kernel RDMA/rxe (Soft RoCE) subsystem enables a local low-privileged attacker to corrupt kernel heap data or leak sensitive memory, potentially achieving local privilege escalation. The non-SRQ receive path in rxe_resp_check_length() and copy_data() reads WQE fields directly from a userspace-mapped shared buffer without snapshotting them first, creating a TOCTOU race window exploitable by any local user controlling a non-SRQ queue pair. Patches are confirmed available across multiple stable kernel branches; no public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.17% indicates low current exploitation probability consistent with the niche RDMA prerequisite.
Kernel memory (bio structure) leak in the Linux md/raid10 driver occurs when a discard operation reuses an r10bio object previously used for a read. Because put_all_bios() only releases the replacement bio (repl_bio) when read_slot is negative, a reused r10bio with a stale non-negative read_slot skips the bio_put() on repl_bio, leaking kernel memory on RAID10 arrays that have replacement/spare devices and receive discard (TRIM) traffic. There is no public exploit identified at time of analysis, and EPSS risk is very low (0.17%, 7th percentile).
Deadlock vulnerability in the Linux kernel md/raid1 and md/raid10 drivers can freeze systems running software RAID1 or RAID10 under concurrent memory pressure. The flaw causes incorrect GFP flag selection during block I/O error recovery - the kernel uses GFP_NOIO instead of GFP_NOIO|__GFP_HIGH after a failed bio is split and resubmitted, starving memory reclaim of emergency reserves and causing a kernel deadlock. No active exploitation has been identified (not in CISA KEV), and EPSS at 0.15% reflects low opportunistic risk; however, storage servers, hypervisors, and database hosts using Linux software RAID should prioritize patching to kernel 7.1.5 or 7.2-rc1.
Inconsistent arvif state management in the Linux kernel's ath12k Qualcomm WiFi 7 driver exposes local low-privileged users to kernel memory corruption, information disclosure, and system crash via stale pointer dereference. Three distinct error paths in ath12k_mac_vdev_create() fail to clear or properly unwind arvif->ar and associated vdev/peer state, leaving the driver operating against ghost structures never confirmed in firmware. No public exploit identified at time of analysis, and EPSS probability sits at 0.15% (5th percentile), reflecting low near-term exploitation likelihood despite the 7.8 CVSS score.
Silent data corruption in the Linux kernel nvdimm/btt subsystem results from a broken lane-acquisition locking model that became invalid once BTT lanes were made preemptible. On systems with NVDIMM persistent memory configured in BTT (Block Translation Table) mode, a low-privileged local user can trigger a preemption-induced race where a second task observes a non-zero per-CPU recursion count, incorrectly infers it already holds the lane lock, bypasses mutual exclusion, and concurrently accesses shared per-lane metadata and workspace state, yielding high-integrity and high-confidentiality impact. No public exploit exists and EPSS is 0.18% (8th percentile), but the race is reproducible via the upstream ndctl btt-check.sh unit test and patches are available across all actively maintained stable kernel branches.
Exclusive BPF maps in the Linux kernel can be inserted as inner maps within non-exclusive outer map-in-map structures, allowing any unrelated local BPF program to look up and mutate a map that is supposed to be bound exclusively to a single program by cryptographic hash. This bypasses the signed BPF loader's integrity guarantee - an adversary on a hostile host can rewrite the frozen metadata map contents that the loader has already validated against a signed hash. No public exploit is identified at time of analysis and EPSS is very low (0.18%), but the impact is high for environments relying on exclusive maps as a trust boundary.
Use-after-free in the Linux kernel BPF filesystem (bpffs) inode lifecycle exposes freed kernel memory during concurrent path traversal, enabling local attackers with low privileges to crash the kernel or potentially escalate privileges. The flaw was introduced by commit 4f375ade6aa9, which incorrectly removed the RCU grace-period delay protecting inodes and cached symlink bodies accessible via concurrent RCU pathwalk operations (pick_link, may_lookup). KASAN confirmed the slab-use-after-free at inode offset +2 (i_opflags). No public exploit has been identified and EPSS is very low at 0.17% (7th percentile), with no CISA KEV listing.
Out-of-bounds access in the Linux kernel NVMe Flexible Data Placement (FDP) code allows an attacker who can submit NVMe commands to read beyond the fdpcidx configuration array. An off-by-one in the fdpcidx bounds check (using '>' instead of '>=' against n = NUMFDPC + 1) accepts an index one element past the valid range, tagged by intelligence sources as an information-disclosure issue. Affects Linux 6.16 through the fix; no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile), and the published CVSS 9.8 network vector appears inflated relative to the local/fabric-scoped nature of NVMe command handling.
Use-after-free in Linux kernel's configfs_lookup() allows a local low-privilege attacker to trigger kernel memory corruption via a dangling pointer in configfs_dirent->s_dentry. When inode allocation fails during a directory lookup, the code drops the configfs_dirent reference but neglects to clear ->s_dentry, leaving it pointing at a dentry object that is subsequently freed; a follow-on getdents(2) call in the same directory dereferences that stale pointer to read the inode number, producing the UAF condition. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at 0.17% (7th percentile), but the defect has been latent since Linux 2.6.16 in 2006, meaning a vast range of unpatched production kernels carries the flaw.
Heap out-of-bounds write in the Linux kernel amdgpu DRM driver's `amdgpu_coredump()` function allows a local attacker with GPU access to corrupt kernel heap memory during a GPU reset event. The vulnerability affects Linux kernel versions containing commit eea85914d15b up to the fix commits, specifically Linux 7.1 stable and prior, on systems with AMD GPU hardware. A local user who can trigger or time a GPU ring timeout during an active GPU reset could exploit this heap corruption for potential privilege escalation; however, no public exploit exists and EPSS probability is 0.15% (5th percentile), indicating limited real-world exploitation activity at time of analysis.
Livelock in the Linux kernel's vhost-net subsystem can cause a host denial-of-service against KVM virtualization environments when mergeable receive buffers (VIRTIO_NET_F_MRG_RXBUF) are negotiated between host and guest. The defect in `vhost_get_avail_idx` propagates an incorrect return value through `vhost_enable_notify`, causing the host vhost kernel thread to spin in an immediate disable-then-retry notification loop when the guest is not consuming virtio ring entries fast enough. No public exploit code exists and EPSS stands at 0.17% (6th percentile), but the CVSS Scope Changed (S:C) metric confirms cross-VM-boundary impact on the hypervisor host, making this a meaningful availability risk for KVM-based virtualization fleets.
RB-tree corruption in the Linux kernel iommu/vt-d driver allows a privileged local attacker to corrupt kernel memory structures during device probe error handling, leading to potential kernel panic, privilege escalation, or information disclosure. Affected systems must have Intel VT-d IOMMU enabled and encounter a device that does not support Address Translation Services (ATS) followed by a probe step failure. No public exploit code has been identified and no CISA KEV listing exists, but the Changed Scope (S:C) CVSS flag signals that kernel-level corruption can cascade across process and subsystem boundaries. Upstream fixes are available in stable branches targeting kernel 6.18.40, 7.1.5, and 7.2-rc1.
Local privilege escalation in the Linux kernel's BPF arena subsystem arises from zap_pages() invoking zap_vma_range() without first acquiring the owning mm's mmap_lock, creating a lock-ordering race condition against arena_vm_close() and arena_map_mmap(), both of which acquire mmap_write_lock before arena->lock in reverse order. A low-privileged local user capable of loading BPF programs on affected Linux 6.9+ systems can exploit this AB-BA deadlock opportunity or operate on stale VMA pointers after concurrent unmapping, potentially corrupting kernel memory and escalating privileges. No public exploit code has been identified at time of analysis, and EPSS scores place current exploitation probability at a low 0.15%.
Out-of-bounds kernel memory read in the Linux kernel's ocfs2 filesystem allows disclosure of adjacent kernel data when a maliciously crafted or corrupted ocfs2 volume is mounted and a fast symlink is read. ocfs2_validate_inode_block() failed to validate zero-cluster (fast) symlink dinodes, so ocfs2_fast_symlink_read_folio() would strnlen()/memcpy an inline payload whose i_size exceeds the inline area or lacks a terminating NUL, copying past the inode block buffer (KASAN flagged a 3905-byte over-read via readlink). No public exploit identified at time of analysis; EPSS is low at 0.15% (5th percentile) and the issue is not in CISA KEV.
Integer underflow in the ocfs2 filesystem's FITRIM implementation allows a local low-privileged user to corrupt filesystem data or trigger a crash by submitting a trim range shorter than one cluster. The validation in ocfs2_trim_mainbm() checks against sb->s_blocksize instead of s_clustersize; on filesystems where cluster size exceeds block size, a range that passes the block-size check gets shifted to len==0, after which pointer arithmetic involving start + len - 1 and len -= ... underflows, driving the trim operation past the requested bounds. No public exploit has been identified at time of analysis, and EPSS is 0.18% (7th percentile), consistent with its low real-world exploitation priority.
Use-after-free in the Linux kernel's netfilter conntrack timeout subsystem (nf_ct_timeout) allows a local low-privileged attacker to corrupt kernel memory by exploiting improper reference counting between the data plane and control plane lifecycle of timeout policy objects. Affected versions span from Linux 3.4 through pre-7.1.5/7.2-rc1, covering a very wide range of deployments wherever custom conntrack timeout policies are active. No public exploit code has been identified and EPSS sits at 0.15% (5th percentile), but the local high-impact profile (C:H/I:H/A:H) and the ubiquity of the Linux kernel make patching a clear priority for affected configurations.
Kernel memory corruption in the Linux RDMA/siw (soft-iWARP) driver lets a remote peer trigger a slab use-after-free during connection setup: siw_socket_disassoc() can drop the last reference on an endpoint and free it, after which siw_cm_work_handler() still dereferences the stale endpoint pointer. The demonstrated impact is a KASAN-confirmed use-after-free crash after a malformed MPA request, exploitable only where the siw module is loaded and an iWARP listener is active. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile) with no CISA KEV listing, so the 9.8 NVD score overstates practical risk for typical deployments.
Stale red-black tree node linkage in the Linux kernel BPF subsystem enables a use-after-free condition when a refcounted BPF object survives teardown of its owning rbtree root and that root's memory address is subsequently reused. Local attackers with BPF-capable low-privilege accounts can exploit the incorrect owner validation in bpf_rbtree_remove() to trigger rb_erase_cached() against stale, invalid tree pointers, potentially achieving kernel memory corruption with full confidentiality, integrity, and availability impact. No public exploit code has been identified and EPSS sits at the 6th percentile; patch commits are available across multiple stable branches.
Race condition in the kernfs xattr subsystem of Linux kernel 7.1 and earlier allows local low-privileged users to corrupt shared xattr structures across multiple superblocks, resulting in high-impact confidentiality, integrity, and availability compromise. The flaw arises specifically in namespace-multiplexed environments where kernfs_test_super() allows distinct superblocks to share a single kernfs_node while VFS locking remains per-inode and therefore insufficient. No public exploit has been identified at time of analysis; EPSS probability is 0.15% (5th percentile), indicating that despite the high CVSS score, widespread exploitation is currently assessed as unlikely.
Heap buffer overflow in the Linux kernel wcn36xx WiFi driver allows an adjacent-network attacker without authentication to corrupt kernel heap memory with firmware-controlled content. The vulnerability exists in the synchronous HAL response dispatcher for Qualcomm WCN36xx chipsets, which copies all firmware responses into a fixed 4096-byte buffer without first validating response length. Successful exploitation from an adjacent network position yields high confidentiality, integrity, and availability impact - consistent with potential kernel code execution. EPSS is low at 0.19% and no active exploitation is confirmed, but the lack of authentication requirement and network-adjacent reachability elevate real-world concern for affected embedded and mobile platforms. Patches are available across multiple stable kernel branches.
Out-of-bounds heap read in the Linux kernel's wcn36xx WiFi driver exposes kernel memory and risks system crashes on any adjacent-network attacker within radio range of a device using a Qualcomm WCN36xx series chipset. The flaw, introduced at commit 43efa3c0f241e04862be8e6a68ff765d36cde1ba (Linux 4.11 era), allows the PRINT_REG_INFO firmware indication handler to iterate over rsp->regs[] using a firmware-controlled rsp->count value that is never validated against the actual received message length, enabling reads beyond the heap-allocated buffer. No public exploit has been identified and EPSS is very low at 0.18% (7th percentile), but the CVSS 8.1 score and the availability of patches across seven stable branches make this a concrete patch priority for platforms running Qualcomm WCN36xx hardware.
Sleepable BPF_LSM_CGROUP programs can be loaded into the Linux kernel without verifier rejection, causing a kernel BUG when those programs invoke blocking helpers inside an RCU read-side critical section. The cgroup BPF shim runs under rcu_read_lock_dont_migrate(), which prohibits sleeping; if a program marked BPF_F_SLEEPABLE attaches to an LSM cgroup hook such as file_open and calls bpf_get_dentry_xattr(), the kernel triggers a 'sleeping function called from invalid context' BUG. No public exploit identified at time of analysis; EPSS at 0.17% reflects the niche exploitation path requiring BPF-loading capability.
Out-of-bounds slab read in the Linux kernel's ASoC AMD ACP SoundWire legacy machine driver allows a local attacker - or a hardware-triggered probe path - to read beyond an allocated array in create_sdw_dailinks(), potentially causing kernel memory disclosure or denial of service. The vulnerability is introduced when all DAI link entries are initialized, causing the boundary-unchecked loop to walk past the end of the soc_dais allocation. KASAN confirmed the read-of-size-1 in mc_probe(). EPSS is at 0.17% (6th percentile) and the vulnerability is not listed in CISA KEV; no public exploit has been identified at time of analysis. Fixes are available for Linux stable branches 6.18.40 and 7.1.5, as well as the 7.2-rc1 mainline.
Out-of-bounds array read in the Linux kernel's AMD ACP SoundWire SOF audio driver exposes kernel memory to local attackers on systems equipped with AMD SoundWire hardware. The flaw in create_sdw_dailinks() allows iteration past the end of the allocated sof_dais array when all entries are initialized, lacking any bounds guard on the loop termination condition. No active exploitation is recorded (EPSS 0.17%, 6th percentile; no CISA KEV entry), and patches are available across multiple Linux stable branches.
Lockless directory traversal in the Linux kernel configfs subsystem allows a low-privileged local user to race concurrent lseek() operations against directory iteration, corrupting or dereferencing freed cursor objects in kernel memory. Affecting all Linux kernels from version 2.6.27 through multiple long-term stable branches (fixed in 7.1.5, 6.18.40, 6.12.97, 6.6.145, 6.1.178, 5.15.212, and 5.10.261), successful exploitation could yield full kernel privilege escalation with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and EPSS sits at 0.18% (7th percentile), indicating low near-term exploitation probability.
Use-after-free in the Linux kernel iommufd subsystem allows a local low-privileged attacker on IOMMU-enabled systems to corrupt kernel memory by triggering dmabuf invalidation callbacks against already-destroyed page structures during detach. Affected configurations include virtualization hosts using VFIO or vDPA device passthrough where the iommufd framework is active. The CVSS S:C (Changed Scope) rating reflects the potential for cross-workload impact in multi-tenant environments; no public exploit identified at time of analysis, and EPSS at 0.15% (5th percentile) indicates negligible observed exploitation activity.
Use-after-free in the Linux kernel mt76 MediaTek WiFi driver allows a local low-privileged attacker to dereference freed memory during concurrent TX datapath operations, potentially achieving full kernel compromise (C:H/I:H/A:H). The flaw exists in mt76_put_vif_phy_link(), where kfree() is called on an offchannel link structure immediately after rcu_assign_pointer(NULL) - without synchronizing against in-flight RCU readers in the TX softirq path (mt7996_mac_write_txwi) that already hold the pointer. No public exploit is identified at time of analysis, and EPSS of 0.17% (6th percentile) confirms very low current exploitation activity despite a CVSS score of 7.8.
Token resource leak in the Linux kernel mt7996 WiFi driver (mt76 subsystem) allows an adjacent unauthenticated attacker to exhaust TX tokens by repeatedly triggering failed link_conf or link_sta lookups in mt7996_tx_prepare_skb(), potentially degrading or crashing WiFi functionality on affected devices. The provided CVSS 8.8 score with C:H/I:H/A:H is notably high for what the description characterizes as a resource management bug; the actual impact most closely aligns with denial-of-service through token exhaustion, not direct confidentiality or integrity compromise. No public exploit code exists and EPSS sits at 0.17% (6th percentile), indicating minimal current exploitation interest. Patches are available in Linux 6.18.40, 7.1.5, and 7.2-rc1.
Invalid pointer dereference in the Linux kernel btrfs delayed reference processing loop (`__btrfs_run_delayed_refs()`) allows a local attacker with access to a btrfs-mounted volume to crash the kernel, causing a denial of service. The defect was introduced by a refactoring commit (0110a4c43451) that inadvertently removed safety guards which reset an internal pointer to NULL when `btrfs_select_ref_head()` returns `ERR_PTR(-EAGAIN)`, causing a subsequent `spin_lock()` call on the error code value treated as a pointer address. No public exploit code has been identified and EPSS probability is 0.18% (7th percentile), though patches are available across all active stable kernel branches.
Linux kernel ixgbe driver on Intel E610 adapters triggers a KASAN slab-out-of-bounds write when an XDP program is loaded on hosts with 64 or more logical CPUs. The root cause is a queue-count mismatch: MSI-X constraints cap the netdev at 63 queue pairs on E610, but XDP allocates 64 queues on ≥64-CPU systems, causing netif_set_xps_queue() to write 4 bytes beyond the allocated slab at queue index 63. With EPSS at 0.15% (5th percentile), no KEV listing, and hardware-specific trigger conditions, real-world exploitation is low-probability but not negligible in high-CPU-count data center environments running this Intel hardware.
Resource leak in the Linux kernel NFS server (NFSD) allows connected NFS clients to cause a denial-of-service condition by sending FREE_STATEID for an admin-revoked parallel NFS (pNFS) layout stateid. The kernel function nfsd4_drop_revoked_stid() lacks handling for the SC_TYPE_LAYOUT case, causing the stateid to remain allocated in the IDR tree and on the per-client list indefinitely rather than being properly unhashed and freed. No public exploit exists and EPSS is 0.17% (6th percentile), but the unauthenticated network vector and availability impact score of 7.5 warrant attention on NFS servers with pNFS layouts enabled. Vendor-released patches are available in stable kernel branches.
Incorrect file-handle hashing in the Linux kernel's lockd (NLM) server causes NLMv4 lock-state lookups to fail intermittently. When a client presents an NFS file handle shorter than LOCKD_FH_HASH_SIZE (32 bytes), file_hash() digests stale bytes left in the argument buffer from a prior request, so the same wire handle hashes into different nlm_files[] buckets across calls and nlm_lookup_file() misses existing lock records. This is a functional-correctness and reliability defect introduced by commit 3de744ee4e45 during the xdrgen NLMv4 TEST conversion; a vendor patch is available, EPSS is low (0.15%), and there is no public exploit identified at time of analysis and no CISA KEV listing.
Unsafe destructor execution in the Linux kernel BPF subsystem allows a local attacker with BPF program loading privileges to trigger memory corruption by causing map value cleanup routines to run from NMI (Non-Maskable Interrupt) context. The flaw affects array and hashtab BPF maps containing special fields such as referenced kptrs, uptr, timer, workqueue, and graph roots - destructors for these types are not NMI-safe, yet tracing BPF programs can invoke map update or delete operations from that context. No active exploitation has been identified (not in CISA KEV); EPSS is 0.17% (7th percentile), consistent with a locally-exploitable kernel flaw requiring specialized capabilities.
Use-after-free in the Linux kernel VDUSE (vDPA Device in Userspace) subsystem allows a local low-privileged user to corrupt kernel memory and escalate privileges to full kernel control. The flaw exists in vduse_dev_open(), which releases vduse_lock after an IDR lookup but before acquiring dev->lock, creating a race window where a concurrent VDUSE_DESTROY_DEV ioctl can remove and free the same struct vduse_dev object - causing the open path to later dereference freed memory. No public exploit code and no CISA KEV listing are identified at time of analysis, and EPSS sits at 0.17% (7th percentile), indicating low current exploitation probability despite a high CVSS score of 8.8.
Out-of-bounds kernel memory access in the Linux kernel vhost/vdpa subsystem allows a local attacker with low privileges to crash the system or trigger invalid physical memory mappings via crafted mmap operations. The vhost_vdpa_mmap() and vhost_vdpa_fault() functions accept a user-controlled virtqueue index from vma->vm_pgoff without validating it against the driver's configured queue count (v->nvqs), while the ioctl path already enforces both a bounds check and array_index_nospec(). Patches are available across all active stable branches; EPSS is 0.18% (7th percentile) and the vulnerability is not listed in CISA KEV.
Guest kernel crash in the Linux virtio RTC driver occurs during device restore when stale virtqueues are not cleaned up before reinitialization. Systems running virtual machines with a virtio-rtc device exposed are affected across Linux kernel versions up to 6.18.40 and 7.1.5 stable series. A local low-privileged user on the guest who triggers a suspend/resume cycle under conditions where virtqueue reinitialization fails can dereference a NULL info pointer in vp_del_vq(), panicking the guest kernel. No public exploit is identified at time of analysis, and EPSS of 0.17% (6th percentile) confirms exploitation is not currently widespread.
Local memory corruption in the Linux kernel's vhost-net driver arises from mishandling of zerocopy TX completion: vhost_zerocopy_complete() treats every ubuf_info callback as a finished vhost descriptor, so when the networking stack clones a zerocopy skb (e.g. batman-adv fragmentation via skb_split/skb_zerocopy_clone, or veth forwarding via skb_copy_ubufs) and a backend reset frees the vhost_net_ubuf_ref, a later delayed completion dereferences the freed ubufs pointer - a slab use-after-free confirmed by KASAN. It affects virtualization hosts running vhost-net with zerocopy TX, and a successful trigger yields kernel memory corruption (crash and potential privilege escalation). There is no public exploit identified at time of analysis, EPSS is low (0.17%), and a vendor patch is available across multiple stable branches.
Incorrect IRQ-to-ring mapping in the Linux kernel's vdpa/octeon_ep driver mishandles interrupt routing on Marvell OCTEON EP devices that expose non-contiguous or non-zero-based IRQ numbers, causing the interrupt handler to index the wrong virtqueue ring. Only systems with OCTEON EP hardware using the vDPA data path are affected, and the fix ships in stable kernels 6.18.40, 7.1.5, and 7.2-rc1. There is no public exploit identified at time of analysis, EPSS is very low (0.17%, 6th percentile), and the published 10.0 CVSS vector is inconsistent with the local, hardware-specific nature of the flaw.
Out-of-bounds write in the Linux kernel's vfio/qat driver allows a local low-privileged user with access to the Intel QuickAssist Technology virtual function migration interface to corrupt kernel memory through a race condition. The root cause is a Time-of-Check Time-of-Use flaw in qat_vf_resume_write(), where two concurrent writers can both pass the filp->f_pos boundary check before the lock is held, causing the second writer to copy data past the end of the migration-state buffer once the first writer has already advanced the file position. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% at the 6th percentile reflects low current exploitation probability; vendor-released patches are available in stable kernel series 6.12.97, 6.18.40, and 7.1.5.
Out-of-bounds memory access in the Linux kernel BPF cgroup storage subsystem exposes multiple stable kernel branches to local privilege escalation, stemming from an incomplete fix for predecessor commit abad3d0bad72. A local attacker with CAP_BPF privilege can construct a tail call chain using a storage-less intermediate BPF program as a bridge between two cgroup-storage-using programs (A→B(no storage)→C(storage)), bypassing cookie validation and causing runtime cgroup local storage in the callee to operate on the original caller's context, triggering an out-of-bounds kernel memory access with C:H/I:H/A:H impact. EPSS is low at 0.17% (7th percentile) and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Use-after-free in the Linux kernel Bluetooth HCI core subsystem allows a local attacker with low privileges to corrupt kernel memory and potentially escalate privileges or crash the system. The hci_unregister_dev() function fails to quiesce cmd_timer and ncmd_timer delayed work items before freeing the hci_dev structure, creating a race window where timer callbacks dereference stale memory including the hdev->reset function pointer. EPSS is very low at 0.17% (6th percentile), no active exploitation has been confirmed, and patched versions are available across multiple Linux stable kernel branches.
Out-of-bounds memory read in the Linux kernel Bluetooth HCI subsystem enables a malformed or malicious Bluetooth controller response to the Read Local Codec Capabilities command to cause the kernel to copy one byte beyond the HCI response payload into the codec list. All kernel versions from 5.16 onward that include Bluetooth codec capability support are affected, and fixed stable releases are available across the 6.1, 6.6, 6.12, 6.18, and 7.1 branches. No public exploit has been identified, and the 7th-percentile EPSS score of 0.17% indicates negligible opportunistic exploitation risk at this time.
Undefined behavior from a signed integer overflow in the Linux kernel's RDMA/mlx5 driver exposes systems with Mellanox ConnectX RDMA hardware to local privilege escalation or kernel crash. The flaw in set_rq_size() accepts user-supplied rq_wqe_shift values up to and including 32, causing signed 32-bit integer overflow when computing '1 << rq_wqe_shift' - undefined behavior under the C standard that can corrupt kernel memory structures. The vulnerability carries a CVSS 7.8 High score but EPSS of just 0.18% (7th percentile) and is absent from CISA KEV, indicating no public exploit or active exploitation at time of analysis.
Incorrect UAR index release in the Linux kernel RDMA/mlx5 driver allows a local attacker with low privileges to corrupt kernel-level resource tracking structures, potentially enabling privilege escalation, information disclosure, or denial-of-service via kernel crash. All kernel versions from 4.16 through the fixed stable releases (6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5) are affected on systems equipped with Mellanox/NVIDIA ConnectX RDMA hardware. No public exploit code or active exploitation has been identified; EPSS stands at 0.17% (7th percentile), indicating very low current exploitation probability.
Out-of-bounds read in the Linux kernel's ASoC hdac_hdmi HDMI audio codec driver allows a local attacker with low privileges to expose sensitive kernel memory or crash the kernel by writing a crafted out-of-range enum value to the ALSA control interface. The flaw exists in hdac_hdmi_set_pin_port_mux(), which indexes the texts array using the attacker-supplied value before the bounds-checking helper snd_soc_dapm_put_enum_double() has a chance to reject it. Patches are confirmed available across seven stable kernel branches; with an EPSS of 0.17% and no CISA KEV listing, no active exploitation has been identified at time of analysis.
Missing input validation in the Linux kernel's ASoC Meson AIU audio driver allows a local low-privileged attacker to supply out-of-range enum values to HDMI and internal codec mux put callbacks, triggering snd_soc_enum_item_to_val() on unvalidated input and resulting in out-of-bounds kernel memory access. Systems running Linux 5.7 through pre-7.1.5 on Amlogic Meson SoC hardware are affected, with potential for high confidentiality impact (kernel memory disclosure), limited integrity impact, and kernel crash (availability). No public exploit code exists and exploitation probability is very low (EPSS 0.15%, 5th percentile), but the local attack vector and low privilege requirement mean any user with ALSA device access on affected hardware is a potential threat actor.
Input validation bypass in the Linux kernel's FSL audmix ASoC driver allows a local low-privileged user to write out-of-range enum values to ALSA mixer controls, triggering out-of-bounds memory access in kernel space with potential for privilege escalation or kernel memory disclosure. Specifically, fsl_audmix_put_mix_clk_src() uses an unvalidated value in a BIT() shift operation, and fsl_audmix_put_out_src() uses it to index the prms transition table, both before any bounds check is performed. No public exploit exists and EPSS is extremely low (0.18%, 7th percentile), but the CVSS score of 7.8 reflects the high kernel-level impact if exploited on hardware where the driver is active.
Out-of-bounds array read in the Linux kernel's ASoC Tegra audio driver (tegra210_ahub) allows a local attacker with low privileges to disclose kernel memory contents or trigger a kernel panic on NVIDIA Tegra 210-based systems. The flaw in tegra_ahub_put_value_enum() accesses e->values[item[0]] before validating that item[0] falls within the valid enum range, making the existing bounds check ineffective. Patches are confirmed across multiple stable kernel branches; no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Linux kernel's IPv4 Forwarding Information Base (FIB) subsystem enables a local low-privileged attacker to corrupt kernel memory, potentially escalating to root. The flaw manifests in fib_leaf_notify() when network device driver callbacks - mlxsw, rocker, and nsim - invoke refcount_inc() on a dying fib_info object under RCU, violating reference-counting safety and triggering the 'addition on 0; use-after-free' kernel warning confirmed by syzbot. Patches are available in Linux 7.1.5 stable and 7.2-rc1; no public exploit or CISA KEV listing has been identified at time of analysis.
Concurrent use-after-free-adjacent race condition in the Linux kernel's FIB rules subsystem allows a local low-privileged user to trigger a kernel refcount complaint - and potentially a system crash or memory corruption - by racing a FIB rules dump against the teardown of a dying fib_rule object. Affected versions span multiple long-term stable branches from 4.12 onward through 7.x series kernels prior to the backported fix commits. No public exploit has been identified at time of analysis, and the EPSS score of 0.18% (7th percentile) reflects low exploitation probability; exploitation is not confirmed in the CISA KEV catalog.
Out-of-bounds read in the Linux kernel's SCTP protocol implementation allows a malicious SCTP peer to trigger memory over-reads during INIT or ASCONF chunk processing. The flaw stems from insufficient validation of an embedded address parameter's declared length inside ADD_IP, DEL_IP, and SET_PRIMARY ASCONF parameters, letting a crafted peer advertise a length exceeding the enclosing parameter's bounds. No public exploit has been identified at time of analysis, EPSS is low (0.18%), and it is not on CISA KEV, but the CVSS 9.1 score reflects remote unauthenticated reachability against SCTP-enabled hosts.
Incorrect teardown ordering in the Linux kernel's netkit queue lease subsystem allows a local attacker with low privileges to trigger a race window where live NAPI polling consumes net_iov entries whose DMA addresses have already been cleared, causing the physical NIC to DMA to a stale or zero address. Affected kernel versions span from the introducing commit 5602ad61ebee through the 7.1 stable series, with fixes landing in 7.1.5 and 7.2-rc1. No public exploit code exists and EPSS probability stands at 0.15%, but the S:C scope change in the CVSS vector signals that successful exploitation can corrupt memory beyond the vulnerable process boundary, potentially enabling privilege escalation.
Privilege escalation in the Linux kernel's TIPCv2 generic netlink interface exposes mutating operations - including TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and bearer enable/disable - to any local unprivileged process. The legacy TIPCv1 netlink API already enforces CAP_NET_ADMIN via netlink_net_capable(), but TIPCv2's generic netlink handlers omit the GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM flags, creating an enforcement gap. A QEMU/KASAN reproducer running as uid/gid 65534 with zero effective capabilities confirmed the flaw: an attacker can alter network identity, inject or flush cryptographic key material, and disrupt bearer connectivity. No public exploit has been identified and EPSS is very low (0.21%), but the primitives are straightforward for any local user.
TIPC connection send-side denial of service in the Linux kernel allows a remote TIPC peer to permanently wedge a connection by sending a crafted CONN_ACK message with an inflated acknowledgment count. When the peer-supplied count exceeds the unsigned 16-bit snt_unacked counter in tipc_sk_conn_proto_rcv(), integer underflow wraps the counter to a near-maximum value, causing tsk_conn_cong() to report congestion indefinitely and blocking all further transmits on that connection. This affects Linux kernels from the commit that introduced TIPC connection ack handling (around 4.7) through multiple stable branches prior to the backported fixes. No public exploit has been identified and EPSS is 0.21% (12th percentile), indicating low opportunistic risk despite the AV:N CVSS rating.
Unbounded kernel memory exhaustion in the Linux kernel TIPC subsystem allows a malicious peer node to cause a denial-of-service condition by sending PUBLICATION messages with inverted service-range bounds (lower > upper). Kernels from version 4.17 onward accept these malformed bindings in the name-distribution network receive path - unlike the local bind path, which enforces ordering via tipc_uaddr_valid() - causing service_range rbtree entries and associated publication structures to be permanently leaked with no per-peer cap, for the lifetime of the namespace. No public exploit or CISA KEV listing exists, and EPSS is very low (0.21%, 11th percentile), but the attack is mechanically straightforward for any attacker already operating as a TIPC peer.
Improper error-path cleanup in the Linux kernel's Marvell OcteonTX crypto hardware-accelerator driver (crypto/marvell/octeontx) mishandles DMA unmapping: on a mapping failure the sg_cleanup loop indexes list[i] instead of list[j], leaking successfully mapped scatter-gather entries while repeatedly unmapping the already-failed one. Only systems with Marvell OcteonTX crypto hardware and this driver loaded are affected. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile) and the issue is not in CISA KEV.
Resource-leak and repeated-unmap defect in the Linux kernel's Cavium/Marvell CPT cryptographic accelerator driver (crypto/cavium/cpt) mishandles its DMA error-cleanup path, using the outer loop index (list[i]) instead of the inner index (list[j]) so that successfully mapped scatter-gather entries leak while the single failed entry is unmapped repeatedly. It affects only systems running the cavium CPT driver against OcteonTX CPT hardware, is reachable solely when a DMA mapping failure occurs during request setup, and is a local reliability/resource-management bug rather than a remotely exploitable code-execution flaw. No public exploit identified at time of analysis; EPSS is 0.18% (7th percentile) and it is not in CISA KEV.
Corrupted DMA length assignments in the Linux kernel's iommu/dma-iommu subsystem allow a local attacker with low privileges to trigger memory corruption through the PCI Peer-to-Peer DMA (P2PDMA) code path, potentially achieving confidentiality, integrity, and availability impact across scope boundaries. The flaw stems from a variable typo in iommu_dma_map_sg() where multi-segment P2PDMA scatterlists receive the head segment's length for all entries, corrupting DMA mappings and leading to out-of-bounds memory operations. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.19% (9th percentile) reflects low observed exploitation probability.
Out-of-bounds kernel memory access in the Linux kernel CXL (Compute Express Link) region driver allows a local attacker on systems equipped with CXL memory hardware to corrupt kernel memory by causing cxl_cancel_auto_attach() to use a negative errno value as an array index into p->targets[]. The flaw originates when cxl_region_sort_targets() fails - setting cxled->pos to a negative errno - and that invalid index is later used directly without validation. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.15% at the 5th percentile, reflecting very low real-world exploitation probability consistent with the niche CXL hardware requirement.
Missing authorization on the handshake genl family's DONE downcall in Linux kernel 6.4 and later allows a local low-privileged process to forge TLS handshake completion signals to the kernel's TLS infrastructure. Any unprivileged user that can observe or guess a valid sockfd associated with an in-flight handshake request can submit a crafted DONE message - either with STATUS=0 to make the kernel consumer accept a session as if TLS authentication succeeded, or with a non-zero status to abort a legitimate handshake before the trusted agent tlshd can report its real result. No public exploit has been identified at time of analysis, and EPSS is very low (0.17%), but patches are confirmed across multiple stable branches.