Suse
Monthly
Memory corruption in the Linux kernel's mm/mempolicy subsystem allows a local unprivileged user to trigger a bogus folio pointer dereference, a VM_BUG_ON() panic, or silent LRU isolation of an unrelated live folio when an HMM-based GPU driver has migrated a transparent huge page (THP) to device memory. The flaw exists because queue_folios_pmd() does not guard against device-private PMDs before calling pmd_folio(), which misinterprets the device-private swap entry encoding as a hardware PFN. No public exploit has been identified at time of analysis, and EPSS is 0.18%, but the C:H/I:H/A:H CVSS impact rating reflects the potential severity if the precise conditions are met.
Stale walk->action state in the Linux kernel mm/pagewalk subsystem causes walk_pud_range() to spuriously retry PUD traversal and invoke page-walk callbacks twice, resulting in a slab-out-of-bounds write reachable by unprivileged local users via the mincore(2) syscall. Affected kernels in the 6.18.21-6.18.49 and 7.0-7.2.3 ranges contain the latent logic error activated by commit 3b89863c3fa4; the bug was confirmed by KASAN output and a local fuzzer producing an OOB write into a sigqueue slab object. No public exploit is available and no active exploitation has been identified; vendor-released patches are available in 6.18.50, 7.2.4, and 7.3-rc1.
UAF in the Linux kernel's user_events tracing subsystem (present since kernel 6.4) allows a local unprivileged user to trigger a reference-count underflow during fork failure, freeing the parent process's user_event_mm slab object while the parent retains a stale pointer. Any subsequent user_events ioctl() call by the parent dereferences the freed memory, enabling a write primitive that can lead to local privilege escalation. No public exploit exists and EPSS is low at 0.20%; no KEV listing is present at time of analysis.
Ring buffer corruption in the Linux kernel tracing subsystem arises from an inverted retry-exhaustion test in `simple_ring_buffer_swap_reader_page()`. When a compare-and-swap link replacement succeeds on the eighth and final attempt, the existing `!retry` guard (which triggers at zero) incorrectly returns -EBUSY while leaving the link update complete but reader bookkeeping unfinished; when all eight attempts fail, retry reaches -1, `!retry` is false, and the function falls through to update head and reader pointers as though the swap succeeded, silently corrupting the ring buffer structure. The fix, landed in Linux 7.2.4 and 7.3-rc1, corrects the guard to treat only a negative counter as exhaustion and return the documented -EBUSY. No public exploit code exists and EPSS is 0.19%.
Use-after-free in the Linux kernel tracing subsystem allows a local unprivileged attacker with tracefs access to corrupt kernel memory, potentially achieving privilege escalation. The race exists between trace_pipe readers holding stale event pointers and concurrent writes to buffer_subbuf_size_kb, which triggers ring_buffer_subbuf_order_set() to free and replace all ring buffer sub-buffer pages - including reader pages - without coordinating with active readers. KASAN-confirmed reproduction via syzbot (syz-executor989/6002) demonstrates practical triggering. No public exploit or CISA KEV listing at time of analysis; EPSS of 0.20% at the 10th percentile reflects low current exploitation probability.
Use-after-free in the Linux kernel tracing subsystem allows a local attacker with tracefs write access to panic the kernel or corrupt memory by registering two hist triggers sharing the same name= parameter on different events, followed by a third trigger referencing a variable. The second trigger's hist_data is freed by hist_register_trigger() during named-data reuse detection, but its tr->hist_vars list entry is never removed; a subsequent find_var_file() call then dereferences the freed 2048-byte slab region. The bug is confirmed by an included KASAN trace showing the precise allocation and free sites, with a deterministic three-command reproduction sequence documented in the CVE description itself; no public exploit has been identified at time of analysis.
An infinite loop in the Linux kernel's device property subsystem causes system hangs when iterating firmware nodes (fwnodes) with a secondary fwnode containing more than one child. Affected are Linux kernel versions across multiple stable branches (5.10.x through 6.19.x pre-patch). An attacker or malformed firmware blob that produces such a node topology can cause a kernel thread to spin indefinitely, consuming a CPU core and ultimately triggering a watchdog reset or complete system hang. No active exploitation has been confirmed, and EPSS stands at 0.17%.
Out-of-bounds kernel heap read in the Linux kernel's Nitro Secure Module (NSM) virtio driver allows a malicious or buggy NSM backend to disclose adjacent kernel heap memory to user space. The driver stores the used-ring response length reported by the backend device without clamping it to the actual response buffer size; parse_resp_raw() then copies that unclamped length of bytes to user space, leaking heap contents to the calling process. No public exploit has been identified at time of analysis; patches are available in stable kernel releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Use-after-free in the Linux kernel's RapidIO mport character device driver allows a local low-privileged user to trigger kernel memory corruption via the DMA request teardown path. The flaw exists in dma_req_free(), where the mutex protecting a mapping object is unlocked through a pointer that may have already been freed by kref_put() invoking the last-reference destructor. An attacker with access to the /dev/mport* character device interface can trigger this condition to achieve kernel privilege escalation. No public exploit code has been identified at time of analysis, and EPSS probability sits at 0.20%.
Double-free memory corruption in the Linux kernel V4L2 (Video for Linux 2) subsystem exists in the error-handling path of __video_register_device() after a prior patch introduced a put_device() call on device_register() failure. Because the V4L2 API contract requires callers to invoke video_device_release() - which kfree()s the video_device struct - on registration failure, the intermediate put_device() frees the struct first, causing a subsequent double-free. The fix reverts the erroneous commit (2a934fdb01db6458288fc9386d3d8ceba6dd551a), accepting a small memory leak in exchange for eliminating the double-free, given that device_register() failures are described as extremely rare in practice. No public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Linux kernel's at91_udc USB gadget driver allows a local low-privileged attacker to dereference freed kernel memory during driver teardown, potentially achieving kernel code execution. The vulnerability affects systems running AT91/SAM series Atmel ARM microcontrollers in polled-VBUS mode, where a self-restarting timer/work cycle is never cancelled before the devm-allocated udc structure is freed. No public exploit exists and no KEV listing has been issued, but the bug is reachable via a routine driver unbind without triggering any fault condition.
Use-after-free in the Linux kernel USB audio gadget driver (drivers/usb/gadget/function/u_audio.c) allows a local attacker or race condition to corrupt kernel memory when a USB audio gadget device is disconnected while userspace ALSA control file descriptors remain open. The root cause is that g_audio_cleanup() calls snd_card_free_when_closed() - which defers ALSA card teardown asynchronously - but immediately frees the underlying struct snd_uac_chip; kctl callbacks invoked when userspace closes those lingering FDs then dereference freed memory. No public exploit code exists and EPSS is 0.17%, but the kernel UAF class carries inherent privilege escalation potential on affected systems.
Dangling pointer use-after-free vulnerabilities in the Linux kernel USB gadget UVC (USB Video Class) driver allow a local attacker with low privileges to exploit freed memory in the uvc_function_bind() error path and uvc_function_unbind() teardown routine. The driver fails to NULL uvc->control_req after usb_ep_free_request() and uvc->control_buf after kfree(), leaving stale pointers that can be dereferenced in subsequent operations. No public exploit or active exploitation has been identified; EPSS sits at 0.20% (10th percentile), consistent with an unexploited kernel subsystem bug on niche hardware.
Out-of-bounds stack write in `sensor_hub_get_feature()` within the Linux kernel HID sensor-hub subsystem allows an attacker controlling a malicious HID device to corrupt kernel memory. A crafted HID descriptor that advertises an oversized feature field size exploits a mismatch between the function's return-value clamping logic and its unclamped per-value copy loop: when IIO subsystem callers (e.g., pressure or ambient-light sensor drivers) pass a small stack buffer such as a single s32, the copy loop writes beyond the buffer boundary by the full `field->report_size / 8` bytes per value. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), indicating low observed exploitation probability.
Out-of-bounds write in the STM32 CEC driver (media/cec/platform/stm32) allows an adjacent attacker on the same HDMI CEC bus to corrupt kernel memory by sending an overlong CEC frame. The stm32_rx_done() IRQ handler appends each received byte to a fixed 16-byte rx_msg.msg[] buffer using rx_msg.len as an unsanitized write index; a peer device that withholds the EOM signal drives RXBR interrupts indefinitely, writing attacker-controlled bytes past the end of the array into adjacent kernel structures. This vulnerability is reachable as soon as the STM32 CEC driver has probed and reception is enabled, with no local privilege or prior authentication on the CEC bus. No public exploit is identified at time of analysis; the fix is available in stable releases.
Heap out-of-bounds write in the Linux kernel vicodec virtual video codec driver's FWHT encoder allows a local low-privileged user to corrupt adjacent kernel heap memory, potentially enabling privilege escalation to root. The root cause is an undersized CAPTURE buffer: the encoder allocates output using a size multiplier of 3, but 4-component pixel formats whose planes all hit the FWHT_FRAME_UNENCODED verbatim-copy fallback require a multiplier of 4, producing a per-frame overflow of coded_w × coded_h bytes into adjacent slab memory. No public exploit has been identified at time of analysis; the EPSS score of 0.20% reflects the niche status of the vicodec driver in production deployments.
Slab-out-of-bounds memory corruption in the Linux kernel's nilfs2 log-structured filesystem allows a local low-privileged user to corrupt kernel slab memory by truncating a file whose block mapping collapses from B-tree to direct form. When this collapse occurs, an orphaned intermediate B-tree node block remains dirty in the kernel cache; the nilfs2 log writer subsequently misclassifies it as a direct-mapping data block and calls nilfs_direct_propagate() on it, causing a KASAN-detected out-of-bounds access that can lead to privilege escalation or kernel panic. No public exploit exists and EPSS is 0.20%, but the low-complexity local trigger limits the risk primarily to systems actively using nilfs2 mounts.
Out-of-bounds kernel read in Linux UBIFS's superblock signature verifier allows mounting a crafted NAND filesystem image to disclose kernel memory or crash the system. Linux kernels from v5.3 with UBIFS authentication support compiled in are affected - the flaw is exercised before any cryptographic check occurs, so no valid signing key is required. No public exploit has been identified at time of analysis and EPSS stands at 0.20%, but the C:H/A:H impact is real on embedded or desktop Linux deployments using UBIFS.
Use-after-free in the Linux kernel NFSD server's NFSv4.2 inter-server copy (SSC) teardown path allows a memory-corruption/crash condition when nfsd4_ssc_expire_umount() resumes its list walk after dropping nfsd_ssc_lock for an mntput(). The saved 'next' (tmp) entry is not pinned by the nsui_busy flag, so a concurrent nfsd RPC thread hitting nfsd4_ssc_cancel_dul() can list_del+kfree that entry in the lock-drop window, leaving the walk to dereference freed memory. It affects NFS servers configured for server-to-server (inter-server) copy; no public exploit is identified at time of analysis and EPSS is low (0.20%).
Silent data loss in Linux kernel NFSD's NFSv4.2 async COPY implementation causes the server to omit a write-verifier rotation when asynchronous copy writeback fails: the server correctly encodes NFS_UNSTABLE in the CB_OFFLOAD callback, but leaves nn->writeverf unchanged, so the client's subsequent COMMIT handshake returns the same verifier the client already holds and the client concludes copied data is durable - silently discarding data whose writeback actually failed. This violates the UNSTABLE+COMMIT durability contract specified in RFC 7862 §15.1 and RFC 8881 §18.32, matching a protocol-state class of bug already remediated in nfsd_vfs_write() and nfsd_commit(). No public exploit or active exploitation is identified; EPSS is 0.20%, consistent with the narrow preconditions required.
Silent data loss in the Linux kernel NFSD NFSv4.2 async COPY offload path allows writeback errors to go undetected, causing clients to treat unwritten data as durably committed. The vulnerability stems from a TOCTOU race in `_nfsd_copy_file_range()`: the writeback-error cursor 'since' is sampled after the copy loop rather than before it, so a concurrent COMMIT or stable WRITE on the same destination inode can advance the error cursor before the COPY worker reads it, masking any writeback failure. CB_OFFLOAD then signals `wr_stable_how = FILE_SYNC4` to the NFS client, which confidently discards its copy of the data under the false belief it is durably stored on the server. No public exploit has been identified at time of analysis, and EPSS stands at 0.20%.
Use-after-free in the Linux kernel NFSD server (nfsv4 state machine) arises because nfsd4_drop_revoked_stid() processes FREE_STATEID for admin-revoked delegations without setting the SC_STATUS_FREED flag before dropping cl_lock. Because revoke_delegation() relies on that flag to tell whether FREE_STATEID has already handled the delegation, the freed delegation is re-added to the client's cl_revoked list via list_add(), and the dangling entry is later dereferenced when cl_revoked is walked during __destroy_client(). Affects NFSv4-serving kernels from ~6.11.6 up to the fix; no public exploit identified at time of analysis and EPSS is low (0.20%).
Out-of-bounds ring-buffer write and stale-memory disclosure in the Linux kernel NFSD server affects the nfsd_fh_verify and nfsd_fh_verify_err tracepoints, which reserve a server-address trace slot sized by the transport's remote-address length (xpt_remotelen) but populate it from the local address using xpt_locallen. On NFSv2/v3-over-UDP, xpt_remotelen stays zero for the transport's lifetime, so every file-handle verification copies 16 or 28 bytes past a zero-byte slot; in the reverse case an oversized slot leaks prior ring-buffer contents to trace consumers. Exploitation requires the tracepoint to be enabled by a local administrator, and there is no public exploit identified at time of analysis (EPSS 0.17%).
NULL pointer dereference in Linux kernel NFSD's NFSv4.2 compound dispatch loop allows remote clients to crash NFS servers built with CONFIG_NFSD_V4_2_INTER_SSC. By inserting an operation such as SETATTR between a foreign PUTFH and SAVEFH within a crafted COMPOUND request, an attacker causes fh_want_write() to dereference a NULL fh_export pointer - killing the nfsd kthread and denying NFS service to all clients. No public exploit has been identified and EPSS stands at 0.22%, reflecting low current exploitation interest.
Unbounded O(n²) CPU consumption in the Linux kernel NFS server (nfsd) POSIX ACL decoder allows any NFS client reachable on port 2049 to cause server-side denial of service by supplying an oversized ACL entry count in a SETACL compound. The root cause is an asymmetry introduced in commit 5fc51dfc2eb1: the encoder already caps count at NFS_ACL_MAX_ENTRIES, but the decoder added in that commit omits the symmetric bound check, passing the raw wire u32 directly into an O(n²) bubble sort. Patches are available in Linux 7.2.4 and 7.3-rc1; no public exploit or active exploitation has been identified.
Delegation recall permanently stalls in Linux kernel NFSD when the callback queue fails during a lease break. In nfsd_break_one_deleg(), the NFSD4_CALLBACK_RUNNING bit is set atomically to serialize recall work, but if nfsd4_run_cb() cannot queue the workitem, the refcount is decremented while the bit is left set - creating a permanent latch that causes every subsequent break_lease() on the same delegation to silently return early. The result is that the delegation is never recalled and any conflicting NFS open or lock operation stalls indefinitely, constituting a server-side denial of service. No public exploit has been identified and EPSS is 0.17%, consistent with a logic-error DoS requiring a specific failure condition to manifest.
Stale opcnt in nfsd4_release_compoundargs() enables an out-of-bounds slab read that leaks kernel memory to userspace via the netlink RPC status interface on Linux NFS servers. When nfsd_dispatch() hits an error path that leaves rq_status_counter at an odd value, the RPC status dumpit handler reads up to 16 entries from args->ops[] - but the inline iops[] array has only 8 elements and is the last field in the struct, so indices 8-15 access adjacent slab memory belonging to whatever object follows in the allocator. The fix zeroes opcnt unconditionally at compound-args release time. No public exploit or active exploitation has been identified; EPSS is 0.17%.
Use-after-free in the Linux kernel NFSD subsystem allows a local attacker with low privileges to read freed vmalloc memory or trigger kernel memory corruption via a race between the rpc_status netlink diagnostic interface and NFSv4 compound request teardown. The ops buffer (args->ops[]) is freed synchronously by vfree() in nfsd4_release_compoundargs() without waiting for an RCU grace period, while the rpc_status dumpit holds only an rcu_read_lock that protects the parent svc_rqst struct but not the separately vmalloc'd ops buffer. Vendor-released patches are available in stable series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV entry exists at time of analysis.
Memory corruption in the Linux kernel NFSD server (NFSv4.1+ session handling) occurs because nfsd4_sequence() can free the very session slot it is currently processing. When the session slot shrinker lowers se_target_maxslots below the channel's maxreqs, free_session_slots() kfrees every slot at index >= se_target_maxslots without verifying the caller's own slotid or the NFSD4_SLOT_INUSE flag, so an authenticated NFSv4.1+ client using a high-numbered slot can have its live slot freed, after which the code writes to the freed object and nfsd4_store_cache_entry() copies the compound reply into the dangling sl_data[] buffer, corrupting the slab. This is a use-after-free / heap out-of-bounds write with no public exploit identified at time of analysis and a low EPSS (0.20%, 10th percentile).
Denial of service (and potential local privilege escalation) in the Linux kernel's NFS server (nfsd) arises from a stateowner reference-count underflow on the NFSv4 seqid-operation replay retry path. When nfsd4_cstate_assign_replay() returns -EAGAIN because the replay owner is being torn down (RP_UNHASHED), nfs4_preprocess_seqid_op() erroneously called nfs4_put_stateowner() on a reference it never acquired, corrupting so_count and risking a use-after-free, while simultaneously leaking the sc_count reference held on the stid. There is no public exploit identified at time of analysis and EPSS is low (0.20%), but the leaked stid reference can also stall a concurrent nfsd4_close_open_stateid(), amplifying availability impact on an NFSv4 export.
Defensive hardening in the Linux kernel NFSD subsystem closes an edge case where nfsd_file_do_acquire() could use a file returned by dentry_create() that was never actually opened. The POSIX VFS interface permits ->atomic_open handlers to return success while delegating the open to a retry path via finish_no_open(); if that path is reached during an NFSv4 file creation, the resulting struct file lacks FMODE_OPENED and is in an invalid state for server I/O. Using such a handle can lead to a kernel crash or panic on the NFS server, causing a denial-of-service. No public exploit exists and exploitation is described as extremely unlikely by the kernel developers themselves; no public exploit has been identified at time of analysis.
Race condition in the Linux kernel NFSD NFSv4.2 server-side copy state management allows any authenticated NFSv4.2 client to crash the NFS server kernel. The cpntf entry is inserted into the IDR (making it immediately addressable by stateid) before its cp_list is initialized in a separate lock section; a concurrent OFFLOAD_CANCEL - using the cnr_stateid echoed to the client - reaches _free_cpntf_state_locked() and calls list_del() on a zeroed list_head, triggering a kernel oops. No public exploit code is known and the issue is not in CISA KEV; patches are available in stable releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Use-after-free in the Linux kernel NFS server (nfsd) file-cache disposal path allows concurrent kernel subsystem callbacks - the global memory shrinker, nfsd laundromat garbage collector, and fsnotify - to dereference a freed nfsd_fcache_disposal struct during per-network-namespace teardown, producing kernel heap corruption or a system panic. The vulnerable window opens when a network namespace hosting nfsd is destroyed while disposal callbacks remain in-flight; containerized NFS server deployments (Docker, Kubernetes) are the most realistic trigger scenario. No public exploit identified at time of analysis, with EPSS at 0.17% consistent with a race-condition-gated kernel bug.
Denial of service in the Linux kernel NFS server (nfsd) pNFS layout subsystem allows an authenticated NFSv4.1+ client to leak layout stateids, gradually exhausting kernel memory. A race in the layout fence/recall path (lm_breaker_timedout) lets the block-lease breaker acquire a duplicate sc_count reference that is never released, pinning the layout stateid forever. Rated CVSS 9.8 but the real-world impact is availability-only and gated on a niche pNFS export configuration plus a race window; no public exploit identified at time of analysis and EPSS is very low (0.15%, 5th percentile).
Resource exhaustion in the Linux kernel NFSv4.2 inter-server copy (COPY offload) path allows an authenticated NFS client to leak nfsd_file objects on the server. Each inter-server COPY request that triggers a failed nfsd4_setup_inter_ssc() call bypasses the cleanup path where release_copy_files() drops the nf_dst reference, permanently pinning a file, inode, dentry, and vfsmount. Over time, repeated failed COPY requests exhaust kernel memory resources, producing a denial-of-service condition. No public exploit exists and EPSS is 0.21%, reflecting the niche NFSv4.2 inter-server copy configuration required.
Remote kernel crash in the Linux kernel NFSv4 server (nfsd) allows any unauthenticated network client to trigger a NULL pointer dereference and kernel oops by sending a crafted SETATTR compound request. The flaw resides in nfsd4_setattr() when delegation timestamp attributes (FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY) are included alongside the NFSv4 'one stateid' (all-0xFF bytes): the special-stateid handling path in nfs4_preprocess_stateid_op() exits without populating the nfs4_stid output pointer, leaving the local variable NULL, after which the unconditional dereference of st->sc_type at offset 4 from NULL panics the kernel. No public exploit has been identified at time of analysis, and EPSS sits at 0.24% (15th percentile), though the zero-prerequisite attack surface makes this straightforward to trigger against any exposed NFSv4 server running an affected kernel.
Silent data corruption in the Linux kernel NFS server daemon (nfsd) allows authorized NFS write clients to induce incorrect file-offset placement whenever a partial write completes between 50% and 99% of a segment boundary. Affecting kernel revisions from commit 06c5c97293e3fca99ce15da157068edf45a7c6e4 up to the fix commits included in 7.2.4 and 7.3-rc1, the logic error in nfsd_direct_write() causes subsequent write segments to land at wrong file offsets while the byte-count returned to the NFS client is over-reported, masking the corruption. No public exploit has been identified at time of analysis and EPSS stands at 0.19%, but the impact is undetected, silent filesystem data corruption on any NFS-exported volume.
Use-after-free in the Linux kernel's NFS server (nfsd4_create_file, the NFSv4 OPEN-with-create path) allows a stale dentry to be dereferenced after being freed. When the exported filesystem is itself NFS (an NFS re-export), dentry_create() can return a different dentry than the one passed in, so the original 'child' dentry already recorded in resfhp may be freed and later dereferenced via fh_compose(), leading to memory corruption and likely a server crash. No public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile), and the fix is available upstream in stable kernels.
Out-of-bounds write and kernel memory disclosure in the Linux kernel NFS server (nfsd) affect deployments exporting pNFS flexfiles layouts. The XDR length calculation in nfsd4_ff_encode_layoutget() miscomputes the reservation for the encoded layout, so with certain string/file-handle sizes the server writes up to 5 bytes past the reserved XDR buffer, and with 4-byte-aligned lengths it over-reserves and transmits uninitialized (stale) kernel buffer contents to the client. It is fixed in stable releases 6.12.109, 6.18.50, and 7.2.4 (and 7.3-rc1); no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Use-after-free in the Linux kernel NFSD localio code path allows a local user to dereference recycled slab memory by exploiting a missing RCU read-lock window in `nfsd_open_local_fh()`. The `again:` retry block performs a `cmpxchg` on an `nfsd_file` pointer and then calls `nfsd_file_get()` (refcount_inc_not_zero) without holding `rcu_read_lock`, while the sole caller drops the lock before the helper runs - leaving a race window where CPU1 can put the last reference, trigger `call_rcu`, and have the slab page recycled before CPU0 increments the refcount. Vendor-released patches are available for the 6.15, 6.18, 7.2, and 7.3-rc1 stable trees; no public exploit exists and EPSS is 0.20%.
Use-after-free in the Linux kernel NFSD server (nfsd4_copy_notify) lets a racing OFFLOAD_CANCEL operation free a copy-notify stateid before the COPY_NOTIFY caller finishes initializing and reading it, corrupting kernel memory on NFSv4.2 servers with inter-server copy offload. Affected are kernels from 5.6 up to the fixed 6.12.109/6.18.50/7.2.4/7.3-rc1 releases. The flaw requires an authenticated NFS client and a tight race window, and there is no public exploit identified at time of analysis (EPSS 0.20%, 10th percentile).
Stale debugfs function pointers in Linux kernel NFSD create a use-after-free condition when module initialization fails partway through. Specifically, nfsd_debugfs_init() registers debugfs files containing fops pointers into module text before nfsd4_init_slabs() succeeds; if slab allocation then fails, the module's text is freed but the debugfs entries remain live with now-dangling pointers. Any subsequent access to those orphaned debugfs files - for example by a local user browsing /sys/kernel/debug - can trigger a kernel-mode UAF, potentially crashing the system or enabling privilege escalation. No public exploit code exists and EPSS is 0.21%; patch commits are available for 6.18.50, 7.2.4, and 7.3-rc1.
POSIX ACL reference-count leaks in Linux kernel NFSD allow a remote attacker to exhaust kernel memory via malformed NFSv4 OPEN compound requests. When the NFS server decodes an OPEN compound carrying valid POSIX ACL createhow4 attributes but encounters a non-seqid-mutating error from claim4 decoding, the compound dispatcher short-circuits before nfsd4_open() executes, permanently leaking both op_pacl and op_dpacl references because OP_OPEN lacked an op_release handler; a secondary leak exists on the NFSv4.0 replay path where op_release was never called from nfsd4_encode_replay(). No public exploit code has been identified and EPSS is 0.20%, but repeated malformed requests against a network-reachable NFSv4 server could drive the kernel toward OOM-induced service failure.
Use-after-free in Linux kernel NFSD's copy-notify stateid management (NFSv4.2 server-to-server copy) allows an authenticated NFS client to trigger a KASAN-detectable UAF at nfs4_put_cpntf_state() by racing OFFLOAD_CANCEL or laundromat expiry against concurrent stateid readers. Three separate revoke paths were affected: the parent-stid drain (nfs4_free_cpntf_statelist()), OFFLOAD_CANCEL via manage_cpntf_state(), and laundromat tick expiry. No public exploit or CISA KEV listing exists; EPSS is 0.17% (6th percentile), and real-world impact is DoS-leaning with theoretical memory disclosure.
Use-after-free in the Linux kernel's NFS server (NFSD) NFSv4.0 revoked-state cleanup path lets a race between the periodic laundromat sweep and administrative client expiry free an NFS client structure while it is still being dereferenced. In nfs40_clean_admin_revoked(), a stateid reference is held but does not pin the owning client, so nfsd4_drop_revoked_stid() can dereference s->sc_client after another thread frees the client. It is a server-side memory-corruption bug affecting hosts running NFSD with NFSv4.0 state, fixed in stable releases; there is no public exploit identified at time of analysis and EPSS is low at 0.20%.
Kernel crash in the Linux libceph client allows a malicious or compromised authenticated Ceph OSD to trigger a BUG_ON assertion in ceph_msg_data_next() by sending a crafted sparse-read reply. The flaw in net/ceph/osd_client.c:osd_sparse_read() validates total data length against summed extents but omits per-extent monotonicity, overlap, and bounds checks, enabling a far-forward extent offset to advance the message-data cursor past the request buffer. Impact is limited to availability - a targeted kernel panic on any Linux client mounting a RADOS-backed filesystem or block device (RBD/CephFS). No public exploit code has been identified at time of analysis, and EPSS is low at 0.20%.
Remote denial of service in the Linux kernel's CephFS client (ceph module) allows a malicious or compromised Ceph MDS (Metadata Server) to crash a mounting client during session setup. In handle_session(), the MDSCapAuth match.path and match.fs_name fields of a CEPH_SESSION_OPEN message (msg_version >= 6) are copied with a bare ceph_decode_copy() after decoding an attacker-controlled 32-bit length, with no preceding bounds check, letting the copy read up to 4 GiB past the message front allocation and trigger a slab-out-of-bounds read. No public exploit is identified at time of analysis and EPSS is low (0.20%); exploitation requires a hostile server on the first post-connect message with no client-side user interaction.
Ceph filesystem driver in the Linux kernel leaks an inode wrbuffer reference when writeback is aborted during umount, triggering a kernel BUG and system crash. The defect manifests specifically when ceph_submit_write() fails the osd_stopping_blocker check at unmount time: the wrbuffer claim taken by ceph_dirty_folio() is never released because writepages_finish() - the only release path - never runs for aborted, never-submitted writes. Because i_wrbuffer_ref never returns to zero, the corresponding ihold() is never dropped, the inode cannot be evicted, and the kernel panics with 'VFS: Busy inodes after unmount of ceph' at fs/super.c:650. No public exploit code exists and no active exploitation has been reported; EPSS probability is 0.21%.
Use-after-free in the Linux kernel CIFS client's cifs_file_set_size() allows a local low-privileged user to corrupt kernel heap memory when a handle-based set-size RPC fails during SMB session teardown or reconnection. The freed tcon pointer is reused in a path-based fallback because it is not NULLed after cifsFileInfo_put(), exposing slab memory that may have been reclaimed by the kernel allocator. Patches are confirmed in versions 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation has been identified at time of analysis.
Stale fscache data exposure in the Linux kernel CIFS client allows a local low-privileged user with access to a mounted SMB share to read file data that should have been discarded after an O_TRUNC open. When cifs_do_truncate() is called from cifs_open() without holding i_rwsem, the fscache cookie invalidation step is skipped - meaning previously cached file contents remain readable via fscache_use_cookie() even after the file has been truncated to zero. This produces both confidentiality and integrity violations: a process can obtain pre-truncation data and the kernel cache becomes inconsistent with actual file state. No public exploit is identified at time of analysis; EPSS is 0.17%.
A use-after-free and memory leak in the Linux kernel's CIFS/SMB client (cifs_check_trans2 in the SMB1 TRANSACT2 reassembly path) can be triggered when a malicious or man-in-the-middle SMB server sends a malformed secondary TRANSACT2 response after a valid primary one. Because handle_mid() overwrites mid->resp_buf and skips clearing the server's smallbuf/bigbuf pointers when multiRsp is set, the demux thread later reuses a freed buffer, corrupting kernel memory. Despite a 9.8 CVSS rating, EPSS is only 0.20% and no public exploit is identified; the flaw is DoS/memory-corruption-leaning and requires the client to mount a share from an attacker-controlled server plus a demux-thread timing race.
A use-after-free in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated SMB client to trigger a slab-use-after-free write and likely kernel crash by abusing durable file-handle reconnection. When two sessions hold durable-v2 handles on the same file under different AppInstanceIds, ksmbd_reopen_durable_fd() rebinds every detached oplock on that inode to the reconnecting session instead of only the file's own, so one session adopts another's oplock without a session reference; after the adopted session is destroyed, ksmbd_close_fd_app_instance_id() dereferences the freed session. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), and the fix is present in kernels 7.2.4 and 7.3-rc1.
Denial of service and stale-memory disclosure in the Linux kernel SMB/CIFS client (cifs.ko) arise from an integer-overflow in symlink_data()'s error-context parsing loop. A previous fix (commit 7d9a7f1f96cd) checked the post-ALIGN() length against the remaining buffer, but ALIGN() itself overflows: an ErrorDataLength near UINT32_MAX (e.g. 0xFFFFFFF9) makes ALIGN(x,8) wrap to 0, so the bounds check passes and the loop advances by zero bytes, spinning indefinitely while 'p' points into stale data. A malicious or MITM SMB server can trigger this against a connecting client; no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile).
Heap buffer overflow in the Linux kernel's Intel THC HID QuickSPI driver allows a local low-privileged user to corrupt kernel memory via the hidraw interface. The driver's write_cmd_to_txdma() function performs an unbounded memcpy from a caller-supplied HID report into a device-descriptor-derived heap buffer of only a few hundred bytes, while the HID core permits reports up to 16,384 bytes through SET_REPORT/SET_FEATURE ioctls - a size mismatch that lets an attacker overflow the buffer with attacker-controlled length and content, enabling potential local privilege escalation to root. Vendor-released patches are available in Linux 7.2.4, 7.3-rc1, and 6.18.50; no public exploit or active exploitation has been identified at time of analysis.
Buffer overflow in the Linux kernel's Intel Touch Host Controller QuickSPI HID driver allows a local user with hidraw device access to corrupt kernel memory using device-controlled content. The function `quickspi_get_report()` copies the full device-supplied response length into the caller's buffer without checking the caller-provided size bound, so a touch controller returning more bytes than allocated overflows the kernel buffer. No public exploit exists (EPSS 0.17%, no KEV), but the sibling intel-quicki2c driver already carried the correct fix, confirming the root cause is a missing bounds-check port.
Out-of-bounds memory access in the Linux kernel's ntfs3 filesystem driver during log replay allows a local attacker who can mount a crafted NTFS image to corrupt kernel memory, potentially achieving privilege escalation. The root cause is that check_rstbl() validates DIR_PAGE_ENTRY table bookkeeping but never verifies that the trailing page_lcns[] array actually fits within the entry's declared size, so a crafted lcns_follow field drives a memmove and subsequent replay passes past the entry boundary. No public exploit or CISA KEV listing exists; EPSS is 0.18%, consistent with the local mount-gated attack surface shared by sibling ntfs3 CVEs (CVE-2026-89610 through CVE-2026-89614).
Kernel memory disclosure in the Linux ntfs3 driver's ni_read_frame() function exposes uninitialized kernel heap content to userspace via a plain read(2) call on a crafted NTFS compressed file. The LZNT decompressor returns early when it encounters a zero chunk header, writing fewer bytes than frame_size, but the residual gap in the vmapped pages is never zeroed before being marked uptodate and copied to userspace - leaking whatever kernel memory previously occupied those pages. A crafted NTFS image containing a short-decompressing compressed stream is sufficient to recover kernel pointers and defeat KASLR, making this a viable first-stage primitive for a chained kernel privilege-escalation attack. No public exploit has been identified at time of analysis and EPSS stands at 0.17%.
Out-of-bounds array access in the Linux kernel ntfs3 filesystem driver allows an attacker who can cause a crafted NTFS image to be mounted to trigger kernel memory corruption via an overflow of the page_lcns[] array. The copy_lcns and redo-shorten loops index page_lcns[] at j+i where i is bounded by the log record's lcns_follow field rather than the target dirty-page entry's field, and because check_dp_table() validates the entry but not the copy_lcns record, and find_dp() bounds j but not i, a crafted record can overflow the array of an otherwise structurally valid entry. No public exploit has been identified at time of analysis, and EPSS is 0.18%, but siblings CVE-2026-89610 through CVE-2026-89613 affect the same ntfs3 code path in the same kernel fix wave.
Out-of-bounds slab read in the Linux kernel NTFS driver's cluster allocator lets a crafted NTFS image trigger a KASAN-detected memory read when a file on the volume is extended. The free-cluster bitmap array (vol->lcn_empty_bits_per_page) is sized from the volume's nr_clusters at mount, but ntfs_cluster_alloc() bounds its scan by the on-disk $Bitmap size instead; an image whose $Bitmap advertises more clusters than the volume actually has drives the allocator past the array. Reported through the Linux stable tree with an upstream fix; no public exploit identified at time of analysis and EPSS is low (0.16%).
Improper metadata validation in the Linux kernel's NTFS3 filesystem driver allows a crafted NTFS image to pass consistency checks when an attribute declares empty mapping pairs while carrying an inconsistent highest VCN and size. Parsing such an attribute can drive out-of-bounds memory access during runlist decoding, leading to memory corruption or a denial of service when the malicious image is mounted. The fix rejects attributes whose empty mapping pairs contradict their highest VCN/size fields; no public exploit identified at time of analysis and EPSS is low (0.20%).
Out-of-bounds memory access in the Linux kernel ntfs3 filesystem driver occurs because parse_ntfs_boot_sector() decodes the boot sector's unsigned 64-bit MFT and MFTMirr Logical Cluster Numbers (LCNs) into a signed s64. A crafted NTFS image with a high-bit-set LCN wraps to a negative value that slips past the existing upper-bound check and propagates into the MFT zone allocator, driving an out-of-bounds access to lcn_empty_bits_per_page. Exploitation requires mounting an attacker-supplied NTFS volume; there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Out-of-bounds kernel memory write in the Linux kernel ntfs3 driver allows a local attacker to corrupt memory by mounting a crafted NTFS image. ntfs_attr_update_meta() shifts an attribute name forward by eight bytes when converting a non-sparse attribute to sparse (to insert the compressed_size field), but the record validator never confirms name_offset is within bounds, that the name does not overlap the mapping pairs, or that eight free bytes exist after mapping_pairs_offset - so a malicious MFT record can force a write past the attribute boundary. No public exploit identified at time of analysis; EPSS is low at 0.15% (5th percentile) and the issue is fixed in kernel 7.2.4 and 7.3-rc1.
Out-of-bounds memory access in the Linux kernel's NTFS (ntfs3) driver arises because the mapping-pairs runlist decoder confirms that a run's starting LCN falls inside the volume but never checks that the run's end (lcn + length) also stays within nr_clusters. Mounting or parsing a crafted NTFS image can therefore drive the kernel to reference clusters beyond the volume boundary, corrupting memory and potentially escalating privilege. No public exploit has been identified and EPSS is low (0.20%), indicating this is a hardening/DoS-leaning fix rather than an imminent mass-exploitation threat.
Missing lock acquisition in the eCryptfs filesystem layer exposes the global message context list to concurrent modification during daemon teardown. In `ecryptfs_exorcise_daemon()`, queued message contexts are moved back to the free list without holding `ecryptfs_msg_ctx_lists_mux`, while `ecryptfs_msg_ctx_alloc_to_free()` and other list consumers require that lock - creating a race window for use-after-free or memory corruption reachable by a local user. No public exploit exists and EPSS is 0.21%, but C:H/I:H/A:H impact makes this a meaningful local privilege escalation candidate on systems using eCryptfs.
Out-of-bounds read in the Linux kernel's eCryptfs filesystem packet parser allows a local low-privileged attacker to leak kernel memory or trigger a denial of service by opening a crafted encrypted file with a version 1 header. The root cause is that ecryptfs_parse_packet_set() computes remaining buffer space using a fixed PAGE_SIZE - 8 formula instead of the actual packet-set buffer length, overstating available bytes for version 1 headers where the packet set begins later. Patches are available for stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation has been identified.
Two heap out-of-bounds writes in Linux kernel eCryptfs allow a local low-privileged user to corrupt kernel memory structures by supplying a crafted Tag 3 passphrase-encrypted session key packet with an oversized encrypted_key_size field. The vulnerability is exclusively triggered when AES-192 (cipher code 0x08) is used because that cipher sets crypt_stat->key_size=24 independently, permitting crypto_skcipher_setkey() to succeed while encrypted_key_size still exceeds the 64-byte ECRYPTFS_MAX_KEY_BYTES bound - overflowing into ecryptfs_auth_tok and corrupting root_iv, keysig_list, and mutexes in ecryptfs_crypt_stat. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.20% at the 10th percentile.
Integer underflow in the Linux kernel's eCryptfs filename-encryption parser allows a local attacker to trigger heap memory corruption by supplying a crafted tag 70 packet with a body shorter than the fixed metadata fields. The underflow causes ecryptfs_parse_tag_70_packet() to derive a wildly inflated encrypted-filename size, enabling out-of-bounds heap reads or writes with full confidentiality, integrity, and availability impact. No public exploit code exists and the CVSS score of 7.8 (AV:L) aligns with the local-only attack surface; vendor-confirmed patches are available across all supported stable branches.
Resource management failure in the Linux kernel eCryptfs subsystem allows a local authenticated user to trigger a message context leak - and potentially exploit a stale pointer condition - by inducing send failures to the eCryptfs userspace daemon. The ecryptfs_send_message_locked() function moves a context from the free list to the allocated list before calling ecryptfs_send_miscdev(); on failure, it omits the rollback, leaving the context permanently stranded and the caller holding a dangling reference. Vendor-released patches are available across stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Linux kernel fanotify subsystem (introduced in 6.14) copies stale kernel stack memory to userspace and may enable local privilege escalation on unpatched 6.18.x and 7.x kernels. When a signal interrupts the triggering task precisely after the event reader sets FAN_EVENT_REPORTED but before it finishes preparing the file descriptor, fanotify_get_response() unwinds the stack-allocated file_range frame while the reader retains a dangling pointer to range.pos; the subsequent copy_range_info_to_user() dereferences freed stack memory, confirmed by KASAN. No public exploit code exists and EPSS is very low (0.17%), but vendor patches are available in 6.18.50, 7.2.4, and 7.3-rc1.
Uninitialized mutex race condition in the Linux kernel's omapfb DSI command-mode panel driver (panel-dsi-cm) exposes OMAP SoC systems to kernel panic or memory corruption. dsicm_probe() calls omapdss_register_display() to publish the display device before executing mutex_init() on ddata->lock, creating a window where any concurrently-invoked dsicm callback can attempt to acquire an uninitialized mutex with undefined results. No public exploit exists and EPSS sits at 0.17% (6th percentile), accurately reflecting the extreme niche of OMAP hardware in current deployments. Vendor-released patches are available across affected stable branches.
Incomplete error-path cleanup in the Linux kernel uvesafb framebuffer driver leaves a stale v86d connector callback registered when platform driver initialization fails, creating a potential use-after-free condition in kernel memory. All Linux kernel versions from 2.6.24 onward that include the uvesafb driver are affected; the issue was found through static analysis and is patched in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit exists; EPSS is 0.20% (10th percentile), reflecting the narrow and difficult-to-trigger conditions required.
Out-of-bounds read and write in the Linux kernel's forcedeth NVIDIA ethernet driver triggers on every S3 suspend/resume cycle due to an off-by-one loop terminator in nv_suspend() and nv_resume(). The loop runs one iteration past the end of the saved_config_space[] array, overwriting adjacent kernel memory (np->name_rx[]) and issuing a stray MMIO write one dword beyond the ioremap'd hardware window; with CONFIG_UBSAN_TRAP=y the kernel aborts during the suspend path. The bug has existed since Linux 2.6.27 but was only surfaced by UBSAN on Apple Macmini3,1 (MCP79) hardware during S3 cycling. No public exploit has been identified at time of analysis.
Kernel crash exposure in the OMAP SSI/HSI driver stems from a missing DMA mask initialization on the synthetic HSI controller device allocated via hsi_alloc_controller(), which bypasses the normal OF/platform device setup path and leaves the embedded struct device without a valid dma_mask. Following DMA API hardening changes in the kernel, dma_map_sg() and related helpers enforce the presence of a valid mask before proceeding, causing warnings or kernel panics on any OMAP SoC system where the driver attempts DMA mapping. The vulnerability is tightly hardware-gated to Texas Instruments OMAP-based platforms; patches are confirmed available in kernel stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1, and no public exploit or KEV listing exists.
Hugetlb reservation accounting in the Linux kernel underflows when a huge-page folio shared between a parent and child process (after fork) is unmapped by the parent first. Since commit df7a6d1f6405 introduced reservation adjustment logic into `__unmap_hugepage_range()`, the function decrements the reservation counter without verifying that the folio's mapcount has reached zero, leaving the child's mapping unaccounted and the counter in an arbitrarily large (underflowed) state until the child unmaps. Affected kernels from 6.9 through the fix commits expose systems using hugetlb-backed workloads to integrity corruption (overcommit of huge pages) and availability risk (kernel memory management instability). No public exploit or active exploitation is identified at time of analysis.
Out-of-bounds read in Linux kernel ACPI APEI GHES ARM hardware error handler arises from using pointer size instead of structure size when accounting for remaining CPER buffer after skipping the cper_sec_proc_arm header. Affected are stable branches 6.12.x through 6.12.109, 6.18.x through 6.18.50, 7.x through 7.2.4, and pre-7.3-rc1, on ARM systems with ACPI APEI support. No public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), and there is no CISA KEV listing, consistent with a low automated exploitation probability.
Stack buffer overflow in the Linux kernel's ACPI Platform Firmware Runtime Update (pfr_update) driver allows a local low-privileged attacker to corrupt kernel stack memory via oversized ACPI DSM buffer responses. The flaw exists in query_capability() where memcpy uses firmware-supplied buffer.length without bounds checking against fixed-size u8[16] destination fields in the stack-allocated struct pfru_update_cap_info, enabling writes up to 44 bytes past the end of the structure. KASAN confirmed exploitation on 7.2-rc6 producing three distinct stack-out-of-bounds reports; vendor-released patches are available in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit code exists and EPSS probability is low at 0.18%, but successful exploitation could yield arbitrary kernel code execution on affected systems.
Use-after-free in the Linux kernel's auxdisplay charlcd driver allows a local, low-privileged attacker to potentially corrupt kernel memory when charlcd_register() fails after bl_work has already been scheduled. The root cause is that charlcd_init() schedules a delayed backlight work item referencing the charlcd object before misc_register() is called; if registration fails, the caller frees the object while the work item's reference remains valid, creating a classic UAF condition. No public exploit exists and EPSS is 0.20% (10th percentile), reflecting the niche hardware footprint and non-default kernel configuration required.
Missing DMA alignment validation in the Linux kernel block layer allows a local unprivileged user to submit misaligned I/O vectors that bypass per-device alignment checks during bio construction from iov_iter, potentially triggering memory corruption, data leakage, or kernel crashes. Bio-based drivers lack alignment-split checks and stacking block drivers may silently mis-handle misalignment detected only after bio submission, making the window for exploitation broader than a single driver path. No public exploit has been identified and EPSS places this at the 9th percentile, though the high-C/I/A CVSS score reflects genuine kernel memory-safety consequences.
Out-of-bounds read in the Linux kernel Bluetooth subsystem's eir_get_service_data() leaks kernel heap memory into userspace for ISO broadcast sink configurations. When an ISO broadcast sink processes periodic advertising (PA) reports from a remote Bluetooth broadcaster, a PA payload packed with multiple mismatching Service Data fields causes eir_len to undercount by 2 bytes per field iteration - the subtraction uses only the data length (dlen), omitting the 2-byte length+type header - so the pointer eventually reads past hcon->le_per_adv_data[] into the surrounding struct hci_conn; a drifted field matching the BAA UUID causes those bytes to be copied into iso_pi(sk)->base, recoverable by a local or remote-assisted userspace process via getsockopt(BT_ISO_BASE). No public exploit or CISA KEV listing exists; EPSS of 0.17% (6th percentile) reflects low opportunistic risk, though the Bluetooth adjacent-network constraint caps mass exploitation potential.
Incorrect REX prefix encoding in the Linux kernel's BPF x86-64 JIT compiler drops the high bit of extended destination registers (R8-R15) during per-CPU address resolution, causing GS-segment offsets to be applied to the wrong register. The affected registers alias as R5→RAX, R7→RBP, R8→RSI, R9→RDI, leaving actual per-CPU pointers unadjusted and clobbering scratch registers or the frame pointer, reliably producing kernel panics and theoretically enabling memory corruption. Vendor-released patches are available in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV listing exists and EPSS is 0.17%.
Local privilege escalation in the Linux kernel BPF bloom filter implementation (bloom_map_alloc) affects 32-bit x86 kernels via two compounding integer arithmetic bugs: a BITS_TO_BYTES(U32_MAX) wrap at allocation time causes under-allocation of the bitset, and a u32-to-signed-long sign-extension in set_bit/test_bit causes negative bit offsets, enabling out-of-bounds kernel heap reads and writes. Exploitation requires a process holding CAP_BPF on a 32-bit x86 kernel; 64-bit kernels are entirely unaffected. No public exploit identified at time of analysis; EPSS at 0.20% reflects the narrow attack surface imposed by the 32-bit-only constraint.
Out-of-bounds heap read in the Linux kernel CXL fwctl driver allows a local low-privileged user to leak kernel memory to a CXL device mailbox and crash the kernel. The root cause is cxlctl_fw_rpc() ignoring the in_len bound established by fwctl_cmd_rpc(), letting a user-controlled op_size value drive memcpy reads beyond the kvzalloc(in_len) allocation. With a sufficiently large op_size the read walks into unmapped memory, causing a kernel oops. No public exploit code has been identified and EPSS stands at 0.17%, indicating limited active exploitation interest.
NULL pointer dereference and use-after-free conditions in the Linux kernel's CXL (Compute Express Link) MCE notifier path allow a local attacker with low privileges to corrupt kernel memory or achieve privilege escalation on systems with CXL memory hardware and extended linear cache enabled. The notifier was incorrectly anchored to the memory device lifetime (`cxl_memdev_state`) rather than to the region lifetime (`cxl_region`), meaning the MCE interrupt handler could fire against freed or nulled objects during device or region teardown. No public exploit has been identified and EPSS sits at 0.17%, consistent with the niche hardware dependency. Vendor-released patches are available in Linux 6.18.51, 7.2.4, and 7.3-rc1.
Incorrect hardware header length computation in the Linux kernel's ip6_gre driver creates a memory layout miscalculation in NBMA IPv6 GRE tunnel configurations, exploitable locally by a low-privileged user to corrupt kernel memory and potentially achieve privilege escalation. The function ip6gre_tnl_link_config_route() incorrectly accumulates the lower device's hardware header length into dev->hard_header_len when header_ops is set, affecting both NBMA ip6gre tunnels and ip6gretap/ip6erspan devices across a wide range of kernel versions from 4.19 onward. No public exploit code or active CISA KEV exploitation has been identified; EPSS probability is 0.17% (6th percentile), reflecting low current exploitation interest.
Silent data corruption in the Linux kernel md/raid10 driver occurs when a device is recovered while another mirror in the same pair is still missing. A bool-conversion regression (commit fe6a19d40ceb) inverted the still_degraded flag in raid10_sync_request(), so md_bitmap_start_sync() is called with degraded=false and prematurely clears bitmap bits belonging to the still-absent device; that device is later marked In_sync while holding stale data. This is a data-integrity/reliability defect, not a remotely triggerable attack - no public exploit is identified at time of analysis and EPSS is low (0.20%).
Silent kernel memory corruption in the Linux kernel SUNRPC subsystem arises when percpu counter allocation fails undetected during RPC service creation. When `percpu_counter_init()` fails inside `__svc_create()`, the function returns a half-initialized `svc_serv` structure to nfsd, lockd, or the NFS callback service without error; subsequent hot-path increments in `svc_xprt_enqueue()`, `svc_handle_xprt()`, and `svc_pool_wake_idle_thread()` dereference the NULL per-cpu pointer, which resolves to offset zero of the running CPU's per-cpu area and silently overwrites arbitrary kernel memory. Triggering the flaw requires local administrator access plus memory pressure at RPC service startup; the description explicitly excludes remote induction. No public exploit or CISA KEV listing exists, and EPSS sits at 0.22% (13th percentile).
A use-after-free and reference/memory leak race in the Linux kernel SUNRPC backchannel allows a NFS callback backchannel request to be enqueued onto a svc_serv (sv_cb_list) that is being destroyed, or to leak an xprt reference, when a backchannel receive completes concurrently with callback-service teardown. The flaw affects Linux kernels using the SUNRPC/NFS callback backchannel and is resolved by closing the producer side (clearing xprt->bc_serv under bc_pa_lock via a new xprt_svc_shutdown_bc()) before callback threads are stopped and draining leftover sv_cb_list entries before svc_destroy(). No public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with a hard-to-win teardown race rather than a broadly weaponizable bug.
A use-after-free race condition in the Linux kernel's SUNRPC client-side TLS handshake path (introduced in 6.5) allows the lower RPC transport to be freed while the xs_tls_handshake_done() completion callback is still running. When a synchronous handshake waiter times out or is signaled and tls_handshake_cancel() loses the race to handshake completion, the waiter drops the callback-owned reference, freeing the transport before the callback stores xprt_err or releases its own reference. Exploitation requires RPC-over-TLS client configuration (e.g. NFS mounted with xprtsec=tls/mtls) and winning a narrow timing race; no public exploit identified at time of analysis and EPSS is low at 0.20%.
Integer underflow in the ath6kl WiFi driver's ath6kl_cfg80211_connect_event() allows an adjacent-network attacker controlling a rogue access point to trigger disclosure of kernel slab memory to userspace via nl80211. When a crafted association response shorter than 6 bytes (or request shorter than 4 bytes) is received from firmware, the u8 length fields wrap around to approximately 250, causing cfg80211_connect_result() or cfg80211_roamed() to copy ~250 bytes of adjacent slab data through netlink to any listening userspace process. Patches are available across all active stable branches; no public exploit exists at time of analysis.
Use-after-free race condition in the Linux kernel's mt76/mt7925 MediaTek Wi-Fi 7 driver allows a local attacker with low privileges to corrupt kernel memory or trigger execution of stale MCU commands. The driver's mlo_pm_work delayed work item lacks cancellation in teardown and suspend paths (reset recovery, PCIe unbind, PCIe/mac80211/USB suspend), creating a window where the work executes after vif/bss structures are freed or firmware becomes unavailable. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17% (7th percentile), consistent with a race-condition kernel driver flaw of limited public interest.
Memory corruption in the Linux kernel's mm/mempolicy subsystem allows a local unprivileged user to trigger a bogus folio pointer dereference, a VM_BUG_ON() panic, or silent LRU isolation of an unrelated live folio when an HMM-based GPU driver has migrated a transparent huge page (THP) to device memory. The flaw exists because queue_folios_pmd() does not guard against device-private PMDs before calling pmd_folio(), which misinterprets the device-private swap entry encoding as a hardware PFN. No public exploit has been identified at time of analysis, and EPSS is 0.18%, but the C:H/I:H/A:H CVSS impact rating reflects the potential severity if the precise conditions are met.
Stale walk->action state in the Linux kernel mm/pagewalk subsystem causes walk_pud_range() to spuriously retry PUD traversal and invoke page-walk callbacks twice, resulting in a slab-out-of-bounds write reachable by unprivileged local users via the mincore(2) syscall. Affected kernels in the 6.18.21-6.18.49 and 7.0-7.2.3 ranges contain the latent logic error activated by commit 3b89863c3fa4; the bug was confirmed by KASAN output and a local fuzzer producing an OOB write into a sigqueue slab object. No public exploit is available and no active exploitation has been identified; vendor-released patches are available in 6.18.50, 7.2.4, and 7.3-rc1.
UAF in the Linux kernel's user_events tracing subsystem (present since kernel 6.4) allows a local unprivileged user to trigger a reference-count underflow during fork failure, freeing the parent process's user_event_mm slab object while the parent retains a stale pointer. Any subsequent user_events ioctl() call by the parent dereferences the freed memory, enabling a write primitive that can lead to local privilege escalation. No public exploit exists and EPSS is low at 0.20%; no KEV listing is present at time of analysis.
Ring buffer corruption in the Linux kernel tracing subsystem arises from an inverted retry-exhaustion test in `simple_ring_buffer_swap_reader_page()`. When a compare-and-swap link replacement succeeds on the eighth and final attempt, the existing `!retry` guard (which triggers at zero) incorrectly returns -EBUSY while leaving the link update complete but reader bookkeeping unfinished; when all eight attempts fail, retry reaches -1, `!retry` is false, and the function falls through to update head and reader pointers as though the swap succeeded, silently corrupting the ring buffer structure. The fix, landed in Linux 7.2.4 and 7.3-rc1, corrects the guard to treat only a negative counter as exhaustion and return the documented -EBUSY. No public exploit code exists and EPSS is 0.19%.
Use-after-free in the Linux kernel tracing subsystem allows a local unprivileged attacker with tracefs access to corrupt kernel memory, potentially achieving privilege escalation. The race exists between trace_pipe readers holding stale event pointers and concurrent writes to buffer_subbuf_size_kb, which triggers ring_buffer_subbuf_order_set() to free and replace all ring buffer sub-buffer pages - including reader pages - without coordinating with active readers. KASAN-confirmed reproduction via syzbot (syz-executor989/6002) demonstrates practical triggering. No public exploit or CISA KEV listing at time of analysis; EPSS of 0.20% at the 10th percentile reflects low current exploitation probability.
Use-after-free in the Linux kernel tracing subsystem allows a local attacker with tracefs write access to panic the kernel or corrupt memory by registering two hist triggers sharing the same name= parameter on different events, followed by a third trigger referencing a variable. The second trigger's hist_data is freed by hist_register_trigger() during named-data reuse detection, but its tr->hist_vars list entry is never removed; a subsequent find_var_file() call then dereferences the freed 2048-byte slab region. The bug is confirmed by an included KASAN trace showing the precise allocation and free sites, with a deterministic three-command reproduction sequence documented in the CVE description itself; no public exploit has been identified at time of analysis.
An infinite loop in the Linux kernel's device property subsystem causes system hangs when iterating firmware nodes (fwnodes) with a secondary fwnode containing more than one child. Affected are Linux kernel versions across multiple stable branches (5.10.x through 6.19.x pre-patch). An attacker or malformed firmware blob that produces such a node topology can cause a kernel thread to spin indefinitely, consuming a CPU core and ultimately triggering a watchdog reset or complete system hang. No active exploitation has been confirmed, and EPSS stands at 0.17%.
Out-of-bounds kernel heap read in the Linux kernel's Nitro Secure Module (NSM) virtio driver allows a malicious or buggy NSM backend to disclose adjacent kernel heap memory to user space. The driver stores the used-ring response length reported by the backend device without clamping it to the actual response buffer size; parse_resp_raw() then copies that unclamped length of bytes to user space, leaking heap contents to the calling process. No public exploit has been identified at time of analysis; patches are available in stable kernel releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Use-after-free in the Linux kernel's RapidIO mport character device driver allows a local low-privileged user to trigger kernel memory corruption via the DMA request teardown path. The flaw exists in dma_req_free(), where the mutex protecting a mapping object is unlocked through a pointer that may have already been freed by kref_put() invoking the last-reference destructor. An attacker with access to the /dev/mport* character device interface can trigger this condition to achieve kernel privilege escalation. No public exploit code has been identified at time of analysis, and EPSS probability sits at 0.20%.
Double-free memory corruption in the Linux kernel V4L2 (Video for Linux 2) subsystem exists in the error-handling path of __video_register_device() after a prior patch introduced a put_device() call on device_register() failure. Because the V4L2 API contract requires callers to invoke video_device_release() - which kfree()s the video_device struct - on registration failure, the intermediate put_device() frees the struct first, causing a subsequent double-free. The fix reverts the erroneous commit (2a934fdb01db6458288fc9386d3d8ceba6dd551a), accepting a small memory leak in exchange for eliminating the double-free, given that device_register() failures are described as extremely rare in practice. No public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Linux kernel's at91_udc USB gadget driver allows a local low-privileged attacker to dereference freed kernel memory during driver teardown, potentially achieving kernel code execution. The vulnerability affects systems running AT91/SAM series Atmel ARM microcontrollers in polled-VBUS mode, where a self-restarting timer/work cycle is never cancelled before the devm-allocated udc structure is freed. No public exploit exists and no KEV listing has been issued, but the bug is reachable via a routine driver unbind without triggering any fault condition.
Use-after-free in the Linux kernel USB audio gadget driver (drivers/usb/gadget/function/u_audio.c) allows a local attacker or race condition to corrupt kernel memory when a USB audio gadget device is disconnected while userspace ALSA control file descriptors remain open. The root cause is that g_audio_cleanup() calls snd_card_free_when_closed() - which defers ALSA card teardown asynchronously - but immediately frees the underlying struct snd_uac_chip; kctl callbacks invoked when userspace closes those lingering FDs then dereference freed memory. No public exploit code exists and EPSS is 0.17%, but the kernel UAF class carries inherent privilege escalation potential on affected systems.
Dangling pointer use-after-free vulnerabilities in the Linux kernel USB gadget UVC (USB Video Class) driver allow a local attacker with low privileges to exploit freed memory in the uvc_function_bind() error path and uvc_function_unbind() teardown routine. The driver fails to NULL uvc->control_req after usb_ep_free_request() and uvc->control_buf after kfree(), leaving stale pointers that can be dereferenced in subsequent operations. No public exploit or active exploitation has been identified; EPSS sits at 0.20% (10th percentile), consistent with an unexploited kernel subsystem bug on niche hardware.
Out-of-bounds stack write in `sensor_hub_get_feature()` within the Linux kernel HID sensor-hub subsystem allows an attacker controlling a malicious HID device to corrupt kernel memory. A crafted HID descriptor that advertises an oversized feature field size exploits a mismatch between the function's return-value clamping logic and its unclamped per-value copy loop: when IIO subsystem callers (e.g., pressure or ambient-light sensor drivers) pass a small stack buffer such as a single s32, the copy loop writes beyond the buffer boundary by the full `field->report_size / 8` bytes per value. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), indicating low observed exploitation probability.
Out-of-bounds write in the STM32 CEC driver (media/cec/platform/stm32) allows an adjacent attacker on the same HDMI CEC bus to corrupt kernel memory by sending an overlong CEC frame. The stm32_rx_done() IRQ handler appends each received byte to a fixed 16-byte rx_msg.msg[] buffer using rx_msg.len as an unsanitized write index; a peer device that withholds the EOM signal drives RXBR interrupts indefinitely, writing attacker-controlled bytes past the end of the array into adjacent kernel structures. This vulnerability is reachable as soon as the STM32 CEC driver has probed and reception is enabled, with no local privilege or prior authentication on the CEC bus. No public exploit is identified at time of analysis; the fix is available in stable releases.
Heap out-of-bounds write in the Linux kernel vicodec virtual video codec driver's FWHT encoder allows a local low-privileged user to corrupt adjacent kernel heap memory, potentially enabling privilege escalation to root. The root cause is an undersized CAPTURE buffer: the encoder allocates output using a size multiplier of 3, but 4-component pixel formats whose planes all hit the FWHT_FRAME_UNENCODED verbatim-copy fallback require a multiplier of 4, producing a per-frame overflow of coded_w × coded_h bytes into adjacent slab memory. No public exploit has been identified at time of analysis; the EPSS score of 0.20% reflects the niche status of the vicodec driver in production deployments.
Slab-out-of-bounds memory corruption in the Linux kernel's nilfs2 log-structured filesystem allows a local low-privileged user to corrupt kernel slab memory by truncating a file whose block mapping collapses from B-tree to direct form. When this collapse occurs, an orphaned intermediate B-tree node block remains dirty in the kernel cache; the nilfs2 log writer subsequently misclassifies it as a direct-mapping data block and calls nilfs_direct_propagate() on it, causing a KASAN-detected out-of-bounds access that can lead to privilege escalation or kernel panic. No public exploit exists and EPSS is 0.20%, but the low-complexity local trigger limits the risk primarily to systems actively using nilfs2 mounts.
Out-of-bounds kernel read in Linux UBIFS's superblock signature verifier allows mounting a crafted NAND filesystem image to disclose kernel memory or crash the system. Linux kernels from v5.3 with UBIFS authentication support compiled in are affected - the flaw is exercised before any cryptographic check occurs, so no valid signing key is required. No public exploit has been identified at time of analysis and EPSS stands at 0.20%, but the C:H/A:H impact is real on embedded or desktop Linux deployments using UBIFS.
Use-after-free in the Linux kernel NFSD server's NFSv4.2 inter-server copy (SSC) teardown path allows a memory-corruption/crash condition when nfsd4_ssc_expire_umount() resumes its list walk after dropping nfsd_ssc_lock for an mntput(). The saved 'next' (tmp) entry is not pinned by the nsui_busy flag, so a concurrent nfsd RPC thread hitting nfsd4_ssc_cancel_dul() can list_del+kfree that entry in the lock-drop window, leaving the walk to dereference freed memory. It affects NFS servers configured for server-to-server (inter-server) copy; no public exploit is identified at time of analysis and EPSS is low (0.20%).
Silent data loss in Linux kernel NFSD's NFSv4.2 async COPY implementation causes the server to omit a write-verifier rotation when asynchronous copy writeback fails: the server correctly encodes NFS_UNSTABLE in the CB_OFFLOAD callback, but leaves nn->writeverf unchanged, so the client's subsequent COMMIT handshake returns the same verifier the client already holds and the client concludes copied data is durable - silently discarding data whose writeback actually failed. This violates the UNSTABLE+COMMIT durability contract specified in RFC 7862 §15.1 and RFC 8881 §18.32, matching a protocol-state class of bug already remediated in nfsd_vfs_write() and nfsd_commit(). No public exploit or active exploitation is identified; EPSS is 0.20%, consistent with the narrow preconditions required.
Silent data loss in the Linux kernel NFSD NFSv4.2 async COPY offload path allows writeback errors to go undetected, causing clients to treat unwritten data as durably committed. The vulnerability stems from a TOCTOU race in `_nfsd_copy_file_range()`: the writeback-error cursor 'since' is sampled after the copy loop rather than before it, so a concurrent COMMIT or stable WRITE on the same destination inode can advance the error cursor before the COPY worker reads it, masking any writeback failure. CB_OFFLOAD then signals `wr_stable_how = FILE_SYNC4` to the NFS client, which confidently discards its copy of the data under the false belief it is durably stored on the server. No public exploit has been identified at time of analysis, and EPSS stands at 0.20%.
Use-after-free in the Linux kernel NFSD server (nfsv4 state machine) arises because nfsd4_drop_revoked_stid() processes FREE_STATEID for admin-revoked delegations without setting the SC_STATUS_FREED flag before dropping cl_lock. Because revoke_delegation() relies on that flag to tell whether FREE_STATEID has already handled the delegation, the freed delegation is re-added to the client's cl_revoked list via list_add(), and the dangling entry is later dereferenced when cl_revoked is walked during __destroy_client(). Affects NFSv4-serving kernels from ~6.11.6 up to the fix; no public exploit identified at time of analysis and EPSS is low (0.20%).
Out-of-bounds ring-buffer write and stale-memory disclosure in the Linux kernel NFSD server affects the nfsd_fh_verify and nfsd_fh_verify_err tracepoints, which reserve a server-address trace slot sized by the transport's remote-address length (xpt_remotelen) but populate it from the local address using xpt_locallen. On NFSv2/v3-over-UDP, xpt_remotelen stays zero for the transport's lifetime, so every file-handle verification copies 16 or 28 bytes past a zero-byte slot; in the reverse case an oversized slot leaks prior ring-buffer contents to trace consumers. Exploitation requires the tracepoint to be enabled by a local administrator, and there is no public exploit identified at time of analysis (EPSS 0.17%).
NULL pointer dereference in Linux kernel NFSD's NFSv4.2 compound dispatch loop allows remote clients to crash NFS servers built with CONFIG_NFSD_V4_2_INTER_SSC. By inserting an operation such as SETATTR between a foreign PUTFH and SAVEFH within a crafted COMPOUND request, an attacker causes fh_want_write() to dereference a NULL fh_export pointer - killing the nfsd kthread and denying NFS service to all clients. No public exploit has been identified and EPSS stands at 0.22%, reflecting low current exploitation interest.
Unbounded O(n²) CPU consumption in the Linux kernel NFS server (nfsd) POSIX ACL decoder allows any NFS client reachable on port 2049 to cause server-side denial of service by supplying an oversized ACL entry count in a SETACL compound. The root cause is an asymmetry introduced in commit 5fc51dfc2eb1: the encoder already caps count at NFS_ACL_MAX_ENTRIES, but the decoder added in that commit omits the symmetric bound check, passing the raw wire u32 directly into an O(n²) bubble sort. Patches are available in Linux 7.2.4 and 7.3-rc1; no public exploit or active exploitation has been identified.
Delegation recall permanently stalls in Linux kernel NFSD when the callback queue fails during a lease break. In nfsd_break_one_deleg(), the NFSD4_CALLBACK_RUNNING bit is set atomically to serialize recall work, but if nfsd4_run_cb() cannot queue the workitem, the refcount is decremented while the bit is left set - creating a permanent latch that causes every subsequent break_lease() on the same delegation to silently return early. The result is that the delegation is never recalled and any conflicting NFS open or lock operation stalls indefinitely, constituting a server-side denial of service. No public exploit has been identified and EPSS is 0.17%, consistent with a logic-error DoS requiring a specific failure condition to manifest.
Stale opcnt in nfsd4_release_compoundargs() enables an out-of-bounds slab read that leaks kernel memory to userspace via the netlink RPC status interface on Linux NFS servers. When nfsd_dispatch() hits an error path that leaves rq_status_counter at an odd value, the RPC status dumpit handler reads up to 16 entries from args->ops[] - but the inline iops[] array has only 8 elements and is the last field in the struct, so indices 8-15 access adjacent slab memory belonging to whatever object follows in the allocator. The fix zeroes opcnt unconditionally at compound-args release time. No public exploit or active exploitation has been identified; EPSS is 0.17%.
Use-after-free in the Linux kernel NFSD subsystem allows a local attacker with low privileges to read freed vmalloc memory or trigger kernel memory corruption via a race between the rpc_status netlink diagnostic interface and NFSv4 compound request teardown. The ops buffer (args->ops[]) is freed synchronously by vfree() in nfsd4_release_compoundargs() without waiting for an RCU grace period, while the rpc_status dumpit holds only an rcu_read_lock that protects the parent svc_rqst struct but not the separately vmalloc'd ops buffer. Vendor-released patches are available in stable series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV entry exists at time of analysis.
Memory corruption in the Linux kernel NFSD server (NFSv4.1+ session handling) occurs because nfsd4_sequence() can free the very session slot it is currently processing. When the session slot shrinker lowers se_target_maxslots below the channel's maxreqs, free_session_slots() kfrees every slot at index >= se_target_maxslots without verifying the caller's own slotid or the NFSD4_SLOT_INUSE flag, so an authenticated NFSv4.1+ client using a high-numbered slot can have its live slot freed, after which the code writes to the freed object and nfsd4_store_cache_entry() copies the compound reply into the dangling sl_data[] buffer, corrupting the slab. This is a use-after-free / heap out-of-bounds write with no public exploit identified at time of analysis and a low EPSS (0.20%, 10th percentile).
Denial of service (and potential local privilege escalation) in the Linux kernel's NFS server (nfsd) arises from a stateowner reference-count underflow on the NFSv4 seqid-operation replay retry path. When nfsd4_cstate_assign_replay() returns -EAGAIN because the replay owner is being torn down (RP_UNHASHED), nfs4_preprocess_seqid_op() erroneously called nfs4_put_stateowner() on a reference it never acquired, corrupting so_count and risking a use-after-free, while simultaneously leaking the sc_count reference held on the stid. There is no public exploit identified at time of analysis and EPSS is low (0.20%), but the leaked stid reference can also stall a concurrent nfsd4_close_open_stateid(), amplifying availability impact on an NFSv4 export.
Defensive hardening in the Linux kernel NFSD subsystem closes an edge case where nfsd_file_do_acquire() could use a file returned by dentry_create() that was never actually opened. The POSIX VFS interface permits ->atomic_open handlers to return success while delegating the open to a retry path via finish_no_open(); if that path is reached during an NFSv4 file creation, the resulting struct file lacks FMODE_OPENED and is in an invalid state for server I/O. Using such a handle can lead to a kernel crash or panic on the NFS server, causing a denial-of-service. No public exploit exists and exploitation is described as extremely unlikely by the kernel developers themselves; no public exploit has been identified at time of analysis.
Race condition in the Linux kernel NFSD NFSv4.2 server-side copy state management allows any authenticated NFSv4.2 client to crash the NFS server kernel. The cpntf entry is inserted into the IDR (making it immediately addressable by stateid) before its cp_list is initialized in a separate lock section; a concurrent OFFLOAD_CANCEL - using the cnr_stateid echoed to the client - reaches _free_cpntf_state_locked() and calls list_del() on a zeroed list_head, triggering a kernel oops. No public exploit code is known and the issue is not in CISA KEV; patches are available in stable releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Use-after-free in the Linux kernel NFS server (nfsd) file-cache disposal path allows concurrent kernel subsystem callbacks - the global memory shrinker, nfsd laundromat garbage collector, and fsnotify - to dereference a freed nfsd_fcache_disposal struct during per-network-namespace teardown, producing kernel heap corruption or a system panic. The vulnerable window opens when a network namespace hosting nfsd is destroyed while disposal callbacks remain in-flight; containerized NFS server deployments (Docker, Kubernetes) are the most realistic trigger scenario. No public exploit identified at time of analysis, with EPSS at 0.17% consistent with a race-condition-gated kernel bug.
Denial of service in the Linux kernel NFS server (nfsd) pNFS layout subsystem allows an authenticated NFSv4.1+ client to leak layout stateids, gradually exhausting kernel memory. A race in the layout fence/recall path (lm_breaker_timedout) lets the block-lease breaker acquire a duplicate sc_count reference that is never released, pinning the layout stateid forever. Rated CVSS 9.8 but the real-world impact is availability-only and gated on a niche pNFS export configuration plus a race window; no public exploit identified at time of analysis and EPSS is very low (0.15%, 5th percentile).
Resource exhaustion in the Linux kernel NFSv4.2 inter-server copy (COPY offload) path allows an authenticated NFS client to leak nfsd_file objects on the server. Each inter-server COPY request that triggers a failed nfsd4_setup_inter_ssc() call bypasses the cleanup path where release_copy_files() drops the nf_dst reference, permanently pinning a file, inode, dentry, and vfsmount. Over time, repeated failed COPY requests exhaust kernel memory resources, producing a denial-of-service condition. No public exploit exists and EPSS is 0.21%, reflecting the niche NFSv4.2 inter-server copy configuration required.
Remote kernel crash in the Linux kernel NFSv4 server (nfsd) allows any unauthenticated network client to trigger a NULL pointer dereference and kernel oops by sending a crafted SETATTR compound request. The flaw resides in nfsd4_setattr() when delegation timestamp attributes (FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY) are included alongside the NFSv4 'one stateid' (all-0xFF bytes): the special-stateid handling path in nfs4_preprocess_stateid_op() exits without populating the nfs4_stid output pointer, leaving the local variable NULL, after which the unconditional dereference of st->sc_type at offset 4 from NULL panics the kernel. No public exploit has been identified at time of analysis, and EPSS sits at 0.24% (15th percentile), though the zero-prerequisite attack surface makes this straightforward to trigger against any exposed NFSv4 server running an affected kernel.
Silent data corruption in the Linux kernel NFS server daemon (nfsd) allows authorized NFS write clients to induce incorrect file-offset placement whenever a partial write completes between 50% and 99% of a segment boundary. Affecting kernel revisions from commit 06c5c97293e3fca99ce15da157068edf45a7c6e4 up to the fix commits included in 7.2.4 and 7.3-rc1, the logic error in nfsd_direct_write() causes subsequent write segments to land at wrong file offsets while the byte-count returned to the NFS client is over-reported, masking the corruption. No public exploit has been identified at time of analysis and EPSS stands at 0.19%, but the impact is undetected, silent filesystem data corruption on any NFS-exported volume.
Use-after-free in the Linux kernel's NFS server (nfsd4_create_file, the NFSv4 OPEN-with-create path) allows a stale dentry to be dereferenced after being freed. When the exported filesystem is itself NFS (an NFS re-export), dentry_create() can return a different dentry than the one passed in, so the original 'child' dentry already recorded in resfhp may be freed and later dereferenced via fh_compose(), leading to memory corruption and likely a server crash. No public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile), and the fix is available upstream in stable kernels.
Out-of-bounds write and kernel memory disclosure in the Linux kernel NFS server (nfsd) affect deployments exporting pNFS flexfiles layouts. The XDR length calculation in nfsd4_ff_encode_layoutget() miscomputes the reservation for the encoded layout, so with certain string/file-handle sizes the server writes up to 5 bytes past the reserved XDR buffer, and with 4-byte-aligned lengths it over-reserves and transmits uninitialized (stale) kernel buffer contents to the client. It is fixed in stable releases 6.12.109, 6.18.50, and 7.2.4 (and 7.3-rc1); no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Use-after-free in the Linux kernel NFSD localio code path allows a local user to dereference recycled slab memory by exploiting a missing RCU read-lock window in `nfsd_open_local_fh()`. The `again:` retry block performs a `cmpxchg` on an `nfsd_file` pointer and then calls `nfsd_file_get()` (refcount_inc_not_zero) without holding `rcu_read_lock`, while the sole caller drops the lock before the helper runs - leaving a race window where CPU1 can put the last reference, trigger `call_rcu`, and have the slab page recycled before CPU0 increments the refcount. Vendor-released patches are available for the 6.15, 6.18, 7.2, and 7.3-rc1 stable trees; no public exploit exists and EPSS is 0.20%.
Use-after-free in the Linux kernel NFSD server (nfsd4_copy_notify) lets a racing OFFLOAD_CANCEL operation free a copy-notify stateid before the COPY_NOTIFY caller finishes initializing and reading it, corrupting kernel memory on NFSv4.2 servers with inter-server copy offload. Affected are kernels from 5.6 up to the fixed 6.12.109/6.18.50/7.2.4/7.3-rc1 releases. The flaw requires an authenticated NFS client and a tight race window, and there is no public exploit identified at time of analysis (EPSS 0.20%, 10th percentile).
Stale debugfs function pointers in Linux kernel NFSD create a use-after-free condition when module initialization fails partway through. Specifically, nfsd_debugfs_init() registers debugfs files containing fops pointers into module text before nfsd4_init_slabs() succeeds; if slab allocation then fails, the module's text is freed but the debugfs entries remain live with now-dangling pointers. Any subsequent access to those orphaned debugfs files - for example by a local user browsing /sys/kernel/debug - can trigger a kernel-mode UAF, potentially crashing the system or enabling privilege escalation. No public exploit code exists and EPSS is 0.21%; patch commits are available for 6.18.50, 7.2.4, and 7.3-rc1.
POSIX ACL reference-count leaks in Linux kernel NFSD allow a remote attacker to exhaust kernel memory via malformed NFSv4 OPEN compound requests. When the NFS server decodes an OPEN compound carrying valid POSIX ACL createhow4 attributes but encounters a non-seqid-mutating error from claim4 decoding, the compound dispatcher short-circuits before nfsd4_open() executes, permanently leaking both op_pacl and op_dpacl references because OP_OPEN lacked an op_release handler; a secondary leak exists on the NFSv4.0 replay path where op_release was never called from nfsd4_encode_replay(). No public exploit code has been identified and EPSS is 0.20%, but repeated malformed requests against a network-reachable NFSv4 server could drive the kernel toward OOM-induced service failure.
Use-after-free in Linux kernel NFSD's copy-notify stateid management (NFSv4.2 server-to-server copy) allows an authenticated NFS client to trigger a KASAN-detectable UAF at nfs4_put_cpntf_state() by racing OFFLOAD_CANCEL or laundromat expiry against concurrent stateid readers. Three separate revoke paths were affected: the parent-stid drain (nfs4_free_cpntf_statelist()), OFFLOAD_CANCEL via manage_cpntf_state(), and laundromat tick expiry. No public exploit or CISA KEV listing exists; EPSS is 0.17% (6th percentile), and real-world impact is DoS-leaning with theoretical memory disclosure.
Use-after-free in the Linux kernel's NFS server (NFSD) NFSv4.0 revoked-state cleanup path lets a race between the periodic laundromat sweep and administrative client expiry free an NFS client structure while it is still being dereferenced. In nfs40_clean_admin_revoked(), a stateid reference is held but does not pin the owning client, so nfsd4_drop_revoked_stid() can dereference s->sc_client after another thread frees the client. It is a server-side memory-corruption bug affecting hosts running NFSD with NFSv4.0 state, fixed in stable releases; there is no public exploit identified at time of analysis and EPSS is low at 0.20%.
Kernel crash in the Linux libceph client allows a malicious or compromised authenticated Ceph OSD to trigger a BUG_ON assertion in ceph_msg_data_next() by sending a crafted sparse-read reply. The flaw in net/ceph/osd_client.c:osd_sparse_read() validates total data length against summed extents but omits per-extent monotonicity, overlap, and bounds checks, enabling a far-forward extent offset to advance the message-data cursor past the request buffer. Impact is limited to availability - a targeted kernel panic on any Linux client mounting a RADOS-backed filesystem or block device (RBD/CephFS). No public exploit code has been identified at time of analysis, and EPSS is low at 0.20%.
Remote denial of service in the Linux kernel's CephFS client (ceph module) allows a malicious or compromised Ceph MDS (Metadata Server) to crash a mounting client during session setup. In handle_session(), the MDSCapAuth match.path and match.fs_name fields of a CEPH_SESSION_OPEN message (msg_version >= 6) are copied with a bare ceph_decode_copy() after decoding an attacker-controlled 32-bit length, with no preceding bounds check, letting the copy read up to 4 GiB past the message front allocation and trigger a slab-out-of-bounds read. No public exploit is identified at time of analysis and EPSS is low (0.20%); exploitation requires a hostile server on the first post-connect message with no client-side user interaction.
Ceph filesystem driver in the Linux kernel leaks an inode wrbuffer reference when writeback is aborted during umount, triggering a kernel BUG and system crash. The defect manifests specifically when ceph_submit_write() fails the osd_stopping_blocker check at unmount time: the wrbuffer claim taken by ceph_dirty_folio() is never released because writepages_finish() - the only release path - never runs for aborted, never-submitted writes. Because i_wrbuffer_ref never returns to zero, the corresponding ihold() is never dropped, the inode cannot be evicted, and the kernel panics with 'VFS: Busy inodes after unmount of ceph' at fs/super.c:650. No public exploit code exists and no active exploitation has been reported; EPSS probability is 0.21%.
Use-after-free in the Linux kernel CIFS client's cifs_file_set_size() allows a local low-privileged user to corrupt kernel heap memory when a handle-based set-size RPC fails during SMB session teardown or reconnection. The freed tcon pointer is reused in a path-based fallback because it is not NULLed after cifsFileInfo_put(), exposing slab memory that may have been reclaimed by the kernel allocator. Patches are confirmed in versions 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation has been identified at time of analysis.
Stale fscache data exposure in the Linux kernel CIFS client allows a local low-privileged user with access to a mounted SMB share to read file data that should have been discarded after an O_TRUNC open. When cifs_do_truncate() is called from cifs_open() without holding i_rwsem, the fscache cookie invalidation step is skipped - meaning previously cached file contents remain readable via fscache_use_cookie() even after the file has been truncated to zero. This produces both confidentiality and integrity violations: a process can obtain pre-truncation data and the kernel cache becomes inconsistent with actual file state. No public exploit is identified at time of analysis; EPSS is 0.17%.
A use-after-free and memory leak in the Linux kernel's CIFS/SMB client (cifs_check_trans2 in the SMB1 TRANSACT2 reassembly path) can be triggered when a malicious or man-in-the-middle SMB server sends a malformed secondary TRANSACT2 response after a valid primary one. Because handle_mid() overwrites mid->resp_buf and skips clearing the server's smallbuf/bigbuf pointers when multiRsp is set, the demux thread later reuses a freed buffer, corrupting kernel memory. Despite a 9.8 CVSS rating, EPSS is only 0.20% and no public exploit is identified; the flaw is DoS/memory-corruption-leaning and requires the client to mount a share from an attacker-controlled server plus a demux-thread timing race.
A use-after-free in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated SMB client to trigger a slab-use-after-free write and likely kernel crash by abusing durable file-handle reconnection. When two sessions hold durable-v2 handles on the same file under different AppInstanceIds, ksmbd_reopen_durable_fd() rebinds every detached oplock on that inode to the reconnecting session instead of only the file's own, so one session adopts another's oplock without a session reference; after the adopted session is destroyed, ksmbd_close_fd_app_instance_id() dereferences the freed session. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), and the fix is present in kernels 7.2.4 and 7.3-rc1.
Denial of service and stale-memory disclosure in the Linux kernel SMB/CIFS client (cifs.ko) arise from an integer-overflow in symlink_data()'s error-context parsing loop. A previous fix (commit 7d9a7f1f96cd) checked the post-ALIGN() length against the remaining buffer, but ALIGN() itself overflows: an ErrorDataLength near UINT32_MAX (e.g. 0xFFFFFFF9) makes ALIGN(x,8) wrap to 0, so the bounds check passes and the loop advances by zero bytes, spinning indefinitely while 'p' points into stale data. A malicious or MITM SMB server can trigger this against a connecting client; no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile).
Heap buffer overflow in the Linux kernel's Intel THC HID QuickSPI driver allows a local low-privileged user to corrupt kernel memory via the hidraw interface. The driver's write_cmd_to_txdma() function performs an unbounded memcpy from a caller-supplied HID report into a device-descriptor-derived heap buffer of only a few hundred bytes, while the HID core permits reports up to 16,384 bytes through SET_REPORT/SET_FEATURE ioctls - a size mismatch that lets an attacker overflow the buffer with attacker-controlled length and content, enabling potential local privilege escalation to root. Vendor-released patches are available in Linux 7.2.4, 7.3-rc1, and 6.18.50; no public exploit or active exploitation has been identified at time of analysis.
Buffer overflow in the Linux kernel's Intel Touch Host Controller QuickSPI HID driver allows a local user with hidraw device access to corrupt kernel memory using device-controlled content. The function `quickspi_get_report()` copies the full device-supplied response length into the caller's buffer without checking the caller-provided size bound, so a touch controller returning more bytes than allocated overflows the kernel buffer. No public exploit exists (EPSS 0.17%, no KEV), but the sibling intel-quicki2c driver already carried the correct fix, confirming the root cause is a missing bounds-check port.
Out-of-bounds memory access in the Linux kernel's ntfs3 filesystem driver during log replay allows a local attacker who can mount a crafted NTFS image to corrupt kernel memory, potentially achieving privilege escalation. The root cause is that check_rstbl() validates DIR_PAGE_ENTRY table bookkeeping but never verifies that the trailing page_lcns[] array actually fits within the entry's declared size, so a crafted lcns_follow field drives a memmove and subsequent replay passes past the entry boundary. No public exploit or CISA KEV listing exists; EPSS is 0.18%, consistent with the local mount-gated attack surface shared by sibling ntfs3 CVEs (CVE-2026-89610 through CVE-2026-89614).
Kernel memory disclosure in the Linux ntfs3 driver's ni_read_frame() function exposes uninitialized kernel heap content to userspace via a plain read(2) call on a crafted NTFS compressed file. The LZNT decompressor returns early when it encounters a zero chunk header, writing fewer bytes than frame_size, but the residual gap in the vmapped pages is never zeroed before being marked uptodate and copied to userspace - leaking whatever kernel memory previously occupied those pages. A crafted NTFS image containing a short-decompressing compressed stream is sufficient to recover kernel pointers and defeat KASLR, making this a viable first-stage primitive for a chained kernel privilege-escalation attack. No public exploit has been identified at time of analysis and EPSS stands at 0.17%.
Out-of-bounds array access in the Linux kernel ntfs3 filesystem driver allows an attacker who can cause a crafted NTFS image to be mounted to trigger kernel memory corruption via an overflow of the page_lcns[] array. The copy_lcns and redo-shorten loops index page_lcns[] at j+i where i is bounded by the log record's lcns_follow field rather than the target dirty-page entry's field, and because check_dp_table() validates the entry but not the copy_lcns record, and find_dp() bounds j but not i, a crafted record can overflow the array of an otherwise structurally valid entry. No public exploit has been identified at time of analysis, and EPSS is 0.18%, but siblings CVE-2026-89610 through CVE-2026-89613 affect the same ntfs3 code path in the same kernel fix wave.
Out-of-bounds slab read in the Linux kernel NTFS driver's cluster allocator lets a crafted NTFS image trigger a KASAN-detected memory read when a file on the volume is extended. The free-cluster bitmap array (vol->lcn_empty_bits_per_page) is sized from the volume's nr_clusters at mount, but ntfs_cluster_alloc() bounds its scan by the on-disk $Bitmap size instead; an image whose $Bitmap advertises more clusters than the volume actually has drives the allocator past the array. Reported through the Linux stable tree with an upstream fix; no public exploit identified at time of analysis and EPSS is low (0.16%).
Improper metadata validation in the Linux kernel's NTFS3 filesystem driver allows a crafted NTFS image to pass consistency checks when an attribute declares empty mapping pairs while carrying an inconsistent highest VCN and size. Parsing such an attribute can drive out-of-bounds memory access during runlist decoding, leading to memory corruption or a denial of service when the malicious image is mounted. The fix rejects attributes whose empty mapping pairs contradict their highest VCN/size fields; no public exploit identified at time of analysis and EPSS is low (0.20%).
Out-of-bounds memory access in the Linux kernel ntfs3 filesystem driver occurs because parse_ntfs_boot_sector() decodes the boot sector's unsigned 64-bit MFT and MFTMirr Logical Cluster Numbers (LCNs) into a signed s64. A crafted NTFS image with a high-bit-set LCN wraps to a negative value that slips past the existing upper-bound check and propagates into the MFT zone allocator, driving an out-of-bounds access to lcn_empty_bits_per_page. Exploitation requires mounting an attacker-supplied NTFS volume; there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Out-of-bounds kernel memory write in the Linux kernel ntfs3 driver allows a local attacker to corrupt memory by mounting a crafted NTFS image. ntfs_attr_update_meta() shifts an attribute name forward by eight bytes when converting a non-sparse attribute to sparse (to insert the compressed_size field), but the record validator never confirms name_offset is within bounds, that the name does not overlap the mapping pairs, or that eight free bytes exist after mapping_pairs_offset - so a malicious MFT record can force a write past the attribute boundary. No public exploit identified at time of analysis; EPSS is low at 0.15% (5th percentile) and the issue is fixed in kernel 7.2.4 and 7.3-rc1.
Out-of-bounds memory access in the Linux kernel's NTFS (ntfs3) driver arises because the mapping-pairs runlist decoder confirms that a run's starting LCN falls inside the volume but never checks that the run's end (lcn + length) also stays within nr_clusters. Mounting or parsing a crafted NTFS image can therefore drive the kernel to reference clusters beyond the volume boundary, corrupting memory and potentially escalating privilege. No public exploit has been identified and EPSS is low (0.20%), indicating this is a hardening/DoS-leaning fix rather than an imminent mass-exploitation threat.
Missing lock acquisition in the eCryptfs filesystem layer exposes the global message context list to concurrent modification during daemon teardown. In `ecryptfs_exorcise_daemon()`, queued message contexts are moved back to the free list without holding `ecryptfs_msg_ctx_lists_mux`, while `ecryptfs_msg_ctx_alloc_to_free()` and other list consumers require that lock - creating a race window for use-after-free or memory corruption reachable by a local user. No public exploit exists and EPSS is 0.21%, but C:H/I:H/A:H impact makes this a meaningful local privilege escalation candidate on systems using eCryptfs.
Out-of-bounds read in the Linux kernel's eCryptfs filesystem packet parser allows a local low-privileged attacker to leak kernel memory or trigger a denial of service by opening a crafted encrypted file with a version 1 header. The root cause is that ecryptfs_parse_packet_set() computes remaining buffer space using a fixed PAGE_SIZE - 8 formula instead of the actual packet-set buffer length, overstating available bytes for version 1 headers where the packet set begins later. Patches are available for stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation has been identified.
Two heap out-of-bounds writes in Linux kernel eCryptfs allow a local low-privileged user to corrupt kernel memory structures by supplying a crafted Tag 3 passphrase-encrypted session key packet with an oversized encrypted_key_size field. The vulnerability is exclusively triggered when AES-192 (cipher code 0x08) is used because that cipher sets crypt_stat->key_size=24 independently, permitting crypto_skcipher_setkey() to succeed while encrypted_key_size still exceeds the 64-byte ECRYPTFS_MAX_KEY_BYTES bound - overflowing into ecryptfs_auth_tok and corrupting root_iv, keysig_list, and mutexes in ecryptfs_crypt_stat. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.20% at the 10th percentile.
Integer underflow in the Linux kernel's eCryptfs filename-encryption parser allows a local attacker to trigger heap memory corruption by supplying a crafted tag 70 packet with a body shorter than the fixed metadata fields. The underflow causes ecryptfs_parse_tag_70_packet() to derive a wildly inflated encrypted-filename size, enabling out-of-bounds heap reads or writes with full confidentiality, integrity, and availability impact. No public exploit code exists and the CVSS score of 7.8 (AV:L) aligns with the local-only attack surface; vendor-confirmed patches are available across all supported stable branches.
Resource management failure in the Linux kernel eCryptfs subsystem allows a local authenticated user to trigger a message context leak - and potentially exploit a stale pointer condition - by inducing send failures to the eCryptfs userspace daemon. The ecryptfs_send_message_locked() function moves a context from the free list to the allocated list before calling ecryptfs_send_miscdev(); on failure, it omits the rollback, leaving the context permanently stranded and the caller holding a dangling reference. Vendor-released patches are available across stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Linux kernel fanotify subsystem (introduced in 6.14) copies stale kernel stack memory to userspace and may enable local privilege escalation on unpatched 6.18.x and 7.x kernels. When a signal interrupts the triggering task precisely after the event reader sets FAN_EVENT_REPORTED but before it finishes preparing the file descriptor, fanotify_get_response() unwinds the stack-allocated file_range frame while the reader retains a dangling pointer to range.pos; the subsequent copy_range_info_to_user() dereferences freed stack memory, confirmed by KASAN. No public exploit code exists and EPSS is very low (0.17%), but vendor patches are available in 6.18.50, 7.2.4, and 7.3-rc1.
Uninitialized mutex race condition in the Linux kernel's omapfb DSI command-mode panel driver (panel-dsi-cm) exposes OMAP SoC systems to kernel panic or memory corruption. dsicm_probe() calls omapdss_register_display() to publish the display device before executing mutex_init() on ddata->lock, creating a window where any concurrently-invoked dsicm callback can attempt to acquire an uninitialized mutex with undefined results. No public exploit exists and EPSS sits at 0.17% (6th percentile), accurately reflecting the extreme niche of OMAP hardware in current deployments. Vendor-released patches are available across affected stable branches.
Incomplete error-path cleanup in the Linux kernel uvesafb framebuffer driver leaves a stale v86d connector callback registered when platform driver initialization fails, creating a potential use-after-free condition in kernel memory. All Linux kernel versions from 2.6.24 onward that include the uvesafb driver are affected; the issue was found through static analysis and is patched in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit exists; EPSS is 0.20% (10th percentile), reflecting the narrow and difficult-to-trigger conditions required.
Out-of-bounds read and write in the Linux kernel's forcedeth NVIDIA ethernet driver triggers on every S3 suspend/resume cycle due to an off-by-one loop terminator in nv_suspend() and nv_resume(). The loop runs one iteration past the end of the saved_config_space[] array, overwriting adjacent kernel memory (np->name_rx[]) and issuing a stray MMIO write one dword beyond the ioremap'd hardware window; with CONFIG_UBSAN_TRAP=y the kernel aborts during the suspend path. The bug has existed since Linux 2.6.27 but was only surfaced by UBSAN on Apple Macmini3,1 (MCP79) hardware during S3 cycling. No public exploit has been identified at time of analysis.
Kernel crash exposure in the OMAP SSI/HSI driver stems from a missing DMA mask initialization on the synthetic HSI controller device allocated via hsi_alloc_controller(), which bypasses the normal OF/platform device setup path and leaves the embedded struct device without a valid dma_mask. Following DMA API hardening changes in the kernel, dma_map_sg() and related helpers enforce the presence of a valid mask before proceeding, causing warnings or kernel panics on any OMAP SoC system where the driver attempts DMA mapping. The vulnerability is tightly hardware-gated to Texas Instruments OMAP-based platforms; patches are confirmed available in kernel stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1, and no public exploit or KEV listing exists.
Hugetlb reservation accounting in the Linux kernel underflows when a huge-page folio shared between a parent and child process (after fork) is unmapped by the parent first. Since commit df7a6d1f6405 introduced reservation adjustment logic into `__unmap_hugepage_range()`, the function decrements the reservation counter without verifying that the folio's mapcount has reached zero, leaving the child's mapping unaccounted and the counter in an arbitrarily large (underflowed) state until the child unmaps. Affected kernels from 6.9 through the fix commits expose systems using hugetlb-backed workloads to integrity corruption (overcommit of huge pages) and availability risk (kernel memory management instability). No public exploit or active exploitation is identified at time of analysis.
Out-of-bounds read in Linux kernel ACPI APEI GHES ARM hardware error handler arises from using pointer size instead of structure size when accounting for remaining CPER buffer after skipping the cper_sec_proc_arm header. Affected are stable branches 6.12.x through 6.12.109, 6.18.x through 6.18.50, 7.x through 7.2.4, and pre-7.3-rc1, on ARM systems with ACPI APEI support. No public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), and there is no CISA KEV listing, consistent with a low automated exploitation probability.
Stack buffer overflow in the Linux kernel's ACPI Platform Firmware Runtime Update (pfr_update) driver allows a local low-privileged attacker to corrupt kernel stack memory via oversized ACPI DSM buffer responses. The flaw exists in query_capability() where memcpy uses firmware-supplied buffer.length without bounds checking against fixed-size u8[16] destination fields in the stack-allocated struct pfru_update_cap_info, enabling writes up to 44 bytes past the end of the structure. KASAN confirmed exploitation on 7.2-rc6 producing three distinct stack-out-of-bounds reports; vendor-released patches are available in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit code exists and EPSS probability is low at 0.18%, but successful exploitation could yield arbitrary kernel code execution on affected systems.
Use-after-free in the Linux kernel's auxdisplay charlcd driver allows a local, low-privileged attacker to potentially corrupt kernel memory when charlcd_register() fails after bl_work has already been scheduled. The root cause is that charlcd_init() schedules a delayed backlight work item referencing the charlcd object before misc_register() is called; if registration fails, the caller frees the object while the work item's reference remains valid, creating a classic UAF condition. No public exploit exists and EPSS is 0.20% (10th percentile), reflecting the niche hardware footprint and non-default kernel configuration required.
Missing DMA alignment validation in the Linux kernel block layer allows a local unprivileged user to submit misaligned I/O vectors that bypass per-device alignment checks during bio construction from iov_iter, potentially triggering memory corruption, data leakage, or kernel crashes. Bio-based drivers lack alignment-split checks and stacking block drivers may silently mis-handle misalignment detected only after bio submission, making the window for exploitation broader than a single driver path. No public exploit has been identified and EPSS places this at the 9th percentile, though the high-C/I/A CVSS score reflects genuine kernel memory-safety consequences.
Out-of-bounds read in the Linux kernel Bluetooth subsystem's eir_get_service_data() leaks kernel heap memory into userspace for ISO broadcast sink configurations. When an ISO broadcast sink processes periodic advertising (PA) reports from a remote Bluetooth broadcaster, a PA payload packed with multiple mismatching Service Data fields causes eir_len to undercount by 2 bytes per field iteration - the subtraction uses only the data length (dlen), omitting the 2-byte length+type header - so the pointer eventually reads past hcon->le_per_adv_data[] into the surrounding struct hci_conn; a drifted field matching the BAA UUID causes those bytes to be copied into iso_pi(sk)->base, recoverable by a local or remote-assisted userspace process via getsockopt(BT_ISO_BASE). No public exploit or CISA KEV listing exists; EPSS of 0.17% (6th percentile) reflects low opportunistic risk, though the Bluetooth adjacent-network constraint caps mass exploitation potential.
Incorrect REX prefix encoding in the Linux kernel's BPF x86-64 JIT compiler drops the high bit of extended destination registers (R8-R15) during per-CPU address resolution, causing GS-segment offsets to be applied to the wrong register. The affected registers alias as R5→RAX, R7→RBP, R8→RSI, R9→RDI, leaving actual per-CPU pointers unadjusted and clobbering scratch registers or the frame pointer, reliably producing kernel panics and theoretically enabling memory corruption. Vendor-released patches are available in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV listing exists and EPSS is 0.17%.
Local privilege escalation in the Linux kernel BPF bloom filter implementation (bloom_map_alloc) affects 32-bit x86 kernels via two compounding integer arithmetic bugs: a BITS_TO_BYTES(U32_MAX) wrap at allocation time causes under-allocation of the bitset, and a u32-to-signed-long sign-extension in set_bit/test_bit causes negative bit offsets, enabling out-of-bounds kernel heap reads and writes. Exploitation requires a process holding CAP_BPF on a 32-bit x86 kernel; 64-bit kernels are entirely unaffected. No public exploit identified at time of analysis; EPSS at 0.20% reflects the narrow attack surface imposed by the 32-bit-only constraint.
Out-of-bounds heap read in the Linux kernel CXL fwctl driver allows a local low-privileged user to leak kernel memory to a CXL device mailbox and crash the kernel. The root cause is cxlctl_fw_rpc() ignoring the in_len bound established by fwctl_cmd_rpc(), letting a user-controlled op_size value drive memcpy reads beyond the kvzalloc(in_len) allocation. With a sufficiently large op_size the read walks into unmapped memory, causing a kernel oops. No public exploit code has been identified and EPSS stands at 0.17%, indicating limited active exploitation interest.
NULL pointer dereference and use-after-free conditions in the Linux kernel's CXL (Compute Express Link) MCE notifier path allow a local attacker with low privileges to corrupt kernel memory or achieve privilege escalation on systems with CXL memory hardware and extended linear cache enabled. The notifier was incorrectly anchored to the memory device lifetime (`cxl_memdev_state`) rather than to the region lifetime (`cxl_region`), meaning the MCE interrupt handler could fire against freed or nulled objects during device or region teardown. No public exploit has been identified and EPSS sits at 0.17%, consistent with the niche hardware dependency. Vendor-released patches are available in Linux 6.18.51, 7.2.4, and 7.3-rc1.
Incorrect hardware header length computation in the Linux kernel's ip6_gre driver creates a memory layout miscalculation in NBMA IPv6 GRE tunnel configurations, exploitable locally by a low-privileged user to corrupt kernel memory and potentially achieve privilege escalation. The function ip6gre_tnl_link_config_route() incorrectly accumulates the lower device's hardware header length into dev->hard_header_len when header_ops is set, affecting both NBMA ip6gre tunnels and ip6gretap/ip6erspan devices across a wide range of kernel versions from 4.19 onward. No public exploit code or active CISA KEV exploitation has been identified; EPSS probability is 0.17% (6th percentile), reflecting low current exploitation interest.
Silent data corruption in the Linux kernel md/raid10 driver occurs when a device is recovered while another mirror in the same pair is still missing. A bool-conversion regression (commit fe6a19d40ceb) inverted the still_degraded flag in raid10_sync_request(), so md_bitmap_start_sync() is called with degraded=false and prematurely clears bitmap bits belonging to the still-absent device; that device is later marked In_sync while holding stale data. This is a data-integrity/reliability defect, not a remotely triggerable attack - no public exploit is identified at time of analysis and EPSS is low (0.20%).
Silent kernel memory corruption in the Linux kernel SUNRPC subsystem arises when percpu counter allocation fails undetected during RPC service creation. When `percpu_counter_init()` fails inside `__svc_create()`, the function returns a half-initialized `svc_serv` structure to nfsd, lockd, or the NFS callback service without error; subsequent hot-path increments in `svc_xprt_enqueue()`, `svc_handle_xprt()`, and `svc_pool_wake_idle_thread()` dereference the NULL per-cpu pointer, which resolves to offset zero of the running CPU's per-cpu area and silently overwrites arbitrary kernel memory. Triggering the flaw requires local administrator access plus memory pressure at RPC service startup; the description explicitly excludes remote induction. No public exploit or CISA KEV listing exists, and EPSS sits at 0.22% (13th percentile).
A use-after-free and reference/memory leak race in the Linux kernel SUNRPC backchannel allows a NFS callback backchannel request to be enqueued onto a svc_serv (sv_cb_list) that is being destroyed, or to leak an xprt reference, when a backchannel receive completes concurrently with callback-service teardown. The flaw affects Linux kernels using the SUNRPC/NFS callback backchannel and is resolved by closing the producer side (clearing xprt->bc_serv under bc_pa_lock via a new xprt_svc_shutdown_bc()) before callback threads are stopped and draining leftover sv_cb_list entries before svc_destroy(). No public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with a hard-to-win teardown race rather than a broadly weaponizable bug.
A use-after-free race condition in the Linux kernel's SUNRPC client-side TLS handshake path (introduced in 6.5) allows the lower RPC transport to be freed while the xs_tls_handshake_done() completion callback is still running. When a synchronous handshake waiter times out or is signaled and tls_handshake_cancel() loses the race to handshake completion, the waiter drops the callback-owned reference, freeing the transport before the callback stores xprt_err or releases its own reference. Exploitation requires RPC-over-TLS client configuration (e.g. NFS mounted with xprtsec=tls/mtls) and winning a narrow timing race; no public exploit identified at time of analysis and EPSS is low at 0.20%.
Integer underflow in the ath6kl WiFi driver's ath6kl_cfg80211_connect_event() allows an adjacent-network attacker controlling a rogue access point to trigger disclosure of kernel slab memory to userspace via nl80211. When a crafted association response shorter than 6 bytes (or request shorter than 4 bytes) is received from firmware, the u8 length fields wrap around to approximately 250, causing cfg80211_connect_result() or cfg80211_roamed() to copy ~250 bytes of adjacent slab data through netlink to any listening userspace process. Patches are available across all active stable branches; no public exploit exists at time of analysis.
Use-after-free race condition in the Linux kernel's mt76/mt7925 MediaTek Wi-Fi 7 driver allows a local attacker with low privileges to corrupt kernel memory or trigger execution of stale MCU commands. The driver's mlo_pm_work delayed work item lacks cancellation in teardown and suspend paths (reset recovery, PCIe unbind, PCIe/mac80211/USB suspend), creating a window where the work executes after vif/bss structures are freed or firmware becomes unavailable. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17% (7th percentile), consistent with a race-condition kernel driver flaw of limited public interest.