Suse
Monthly
Use-after-free in the Linux kernel's staging Intel IPU7 media driver allows a local attacker to corrupt kernel memory and potentially escalate privileges. The `isys_probe()` error path registers the V4L2 async notifier but fails to unregister it on subsequent probe failures, leaving a dangling pointer in the global `notifier_list` after `devres` frees the enclosing `struct ipu7_isys`. Any subsequent walk of that list - an event driven by normal kernel media subsystem activity - reads freed memory, creating exploitable heap corruption. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS is 0.17% at the 7th percentile.
Race condition in Linux kernel's core scheduler pick_next_task() path allows a local low-privileged attacker to exploit a TOCTOU window when pick_task() releases the rq (run queue) lock mid-selection, potentially leaking information across SMT sibling threads, corrupting forceidle accounting, and destabilizing the scheduler. The vulnerability breaks the cookie-based SMT isolation guarantee of Core Scheduling: an uncookied task can be committed as the sibling of a cookied task during the lock-release window, violating the trust boundary the feature is designed to enforce. No public exploit exists (EPSS 0.19%), and fixes are available in Linux 7.2.4, 7.3-rc1, and 6.19.
Use-after-free race condition in the Linux kernel RDMA/ucma subsystem allows a local attacker with access to the userspace connection manager interface to corrupt kernel memory and achieve privilege escalation. The flaw exists in ucma_set_ib_path(), which invokes ucma_event_handler() without holding the handler lock that serializes access to ctx->file; a concurrent ucma_migrate_id() call can swap ctx->file between reads inside the handler, causing an event to be enqueued on file B's list while only file A's mutex is held - a condition confirmed by a KASAN slab-use-after-free trace in the upstream commit. Patches are available for all actively supported stable kernel branches (6.12.109, 6.18.50, 7.2.4, 7.3-rc1); no public exploit or active exploitation has been identified.
A race condition in the Linux kernel's RDMA/ucma subsystem allows an unprivileged local user to corrupt kernel data structures and deadlock a mutex by racing ucma_write_cm_event() against ucma_migrate_id(). The device /dev/infiniband/rdma_cm carries world-readable/writable permissions (0666), and the kernel description explicitly states no physical RDMA hardware is required to reach the vulnerable code path, making this accessible to any local user on an affected system. The race causes ctx->file to be swapped mid-sequence across four dereferences - resulting in a kernel BUG at lib/list_debug.c, a permanently held mutex wedging subsequent writers in uninterruptible D-state, and a stranded uevent that outlives its owning context. No public exploit has been identified at time of analysis.
Dangling pointer in the Linux kernel AS3722 PMIC regulator driver leaves `pdev->dev.of_node` referencing freed memory after `of_node_put()` prematurely drops the reference acquired by `of_get_child_by_name()` during Device Tree parsing in `as3722_get_regulator_dt_data()`. Systems running the ams AS3722 Power Management IC driver - predominantly NVIDIA Tegra-based embedded platforms - are affected across all kernel versions since Linux 3.13. If the stale pointer is subsequently dereferenced by regulator framework operations, kernel memory corruption, information disclosure, or local privilege escalation may result; no public exploit code has been identified at time of analysis.
Linux kernel ring-buffer subsystem exposes a race condition between subbuffer resize and page allocation/free operations, enabling local privilege escalation. When ring_buffer_subbuf_order_set() clears cpu_buffer->free_page without holding the cpu_buffer->lock, a concurrent ring_buffer_alloc_read_page() or ring_buffer_free_read_page() call can operate on a stale or freed page, producing kernel memory corruption. No public exploit code exists and EPSS is 0.20%, but the CVSS 7.8 C:H/I:H/A:H vector reflects full kernel-level impact potential once the race is won.
Page-list corruption in the Linux kernel ring-buffer subsystem allows a local low-privileged attacker to trigger undefined memory behavior by exploiting improper handling of a failed remote reader page swap. When the tracing ring-buffer's `swap_reader_page` callback returns `-EBUSY` - which occurs during an event storm on a small buffer - `__rb_get_reader_page_from_remote()` incorrectly proceeds as though the swap succeeded, splicing the same physical page as both the previous and new reader entry simultaneously. This corrupted page-list state can result in confidentiality loss from stale kernel memory reads, integrity violations from writes to a doubly-referenced page, or kernel panic. No public exploit or active KEV listing exists; EPSS is 0.15%, consistent with a low-likelihood local kernel race condition.
Heap buffer overflow in the Linux kernel orangefs client debug-mask parser allows a local low-privileged attacker to corrupt kernel heap memory and potentially escalate privileges. The flaw originates in `orangefs_prepare_cdm_array()`, where buffer sizing via `strcspn()` and subsequent parsing via `sscanf %s` diverge in how they handle leading whitespace - a crafted debug mask entry prefixed with a space causes an undersized allocation that `sscanf` then overwrites. Vendor-released patches are available across all active stable branches (6.12.109, 6.18.50, 7.2.4, 7.3-rc1); no public exploit or active exploitation is identified.
Heap out-of-bounds write in the Linux kernel's ocfs2 o2dlm (distributed lock manager) allows a malicious cluster member to corrupt or panic peer nodes. The dlm_migrate_request_handler() accepts a peer-supplied name-length field (migrate->namelen) from a DLM_MIGRATE_REQUEST message without bounds-checking and passes it to dlm_init_mle(), which memcpy()s up to ~215 attacker-controlled bytes past the 32-byte mname[] field of an o2dlm_mle slab object. Any node that has joined the DLM domain can trigger it; there is no public exploit and it is not in CISA KEV, with EPSS at just 0.20%.
Kernel memory corruption in the Linux kernel's OCFS2 cluster filesystem distributed lock manager (o2dlm) allows any node in a DLM domain to crash or corrupt the heap of a peer node. The dlm_mig_lockres_handler for DLM_MIG_LOCKRES recovery messages trusts the peer-supplied num_locks and lockname_len fields without validation, producing an out-of-bounds read that ends in a BUG_ON panic and a heap out-of-bounds write into a fixed 32-byte lockname slab object. No public exploit identified at time of analysis; EPSS is low at 0.20% (10th percentile), and the fix is available across multiple stable kernel branches.
Out-of-bounds read and write in the Linux kernel's ocfs2 refcount block validator allows a local privileged attacker to corrupt kernel memory via a crafted or corrupted filesystem image. The `ocfs2_validate_refcount_block()` function fails to validate `rl_used` and `rl_count` fields against the actual fixed per-block capacity before refcount/reflink/CoW operations walk the record array, allowing a crafted `rl_used == 0xffff` to drive the loop 65534 iterations past the end of the 4096-byte metadata block. A subsequent `memmove()` of up to ~1 MiB from an already out-of-bounds offset in `ocfs2_insert_refcount_rec()` can corrupt arbitrary kernel memory. No public exploit and no KEV listing; EPSS is 0.20% reflecting realistic low exploitation probability.
Arbitrary kernel memory read/write in the Linux kernel's OpenRISC architecture syscall handler allows an unprivileged local process to overwrite kernel structures such as the sys_call_table and achieve kernel-context code execution. The `sys_or1k_atomic()` function (syscall 244 in the or1k ABI) performs a hand-written assembly atomic word swap between two user-supplied pointers without calling `access_ok()`, and its four memory-access instructions lack exception table entries - meaning any kernel address passed by a caller is directly dereferenced without fault isolation. Patches are confirmed in stable series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation is identified.
Use-after-free in the Linux kernel IPMI message handler allows a local low-privileged user to corrupt kernel memory by racing `_ipmi_destroy_user()` against concurrent RCU readers in `find_cmd_rcvr()` and `handle_ipmb_get_msg_cmd()`. A regression introduced by commit 9e91f8a6c868 removed the `synchronize_rcu()` grace period that previously ensured no readers held live pointers to `cmd_rcvr` structures before `kfree()` was called, while the `cmd_rcvrs` list continues to be walked under plain RCU. No public exploit code has been identified at time of analysis; patched stable kernel versions are available.
Use-after-free in the Linux kernel's lockd (NFS Network Lock Manager) service allows freed-memory access during hash-bucket file traversal. The nlm_traverse_files() iterator pinned the current file but not the saved 'next' pointer across a mutex_unlock window, so a concurrent nlm_release_file() could kfree the next file and cause the iterator to dereference freed memory on its next step. Fixed across stable kernels; no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a hard-to-time race rather than a turnkey exploit.
Use-after-free in the Linux kernel charger-manager power supply driver exposes local low-privileged users to kernel memory corruption and potential privilege escalation. The driver's probe path registers power_supply sysfs attributes before acquiring regulator handles, and its remove path frees regulator consumer handles before tearing down sysfs - creating two overlapping windows where a write to the externally_control attribute, or the remove path's own try_charger_enable() call, dereferences already-freed memory. No public exploit exists and EPSS is 0.20%, but the bug was discovered by static analysis rather than observed in-the-wild attacks, and patches are available in stable kernel trees 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Slab out-of-bounds write in the Linux kernel's cros_usbpd-charger driver allows a malfunctioning, malicious, or compromised Chrome Embedded Controller (EC) to corrupt kernel heap memory during device probe. The driver accepts EC-reported USB PD port counts as loop bounds without validating them against EC_USB_PD_MAX_PORTS (8), so an EC returning any count N > 8 - up to the u8 maximum of 255 - writes N pointers into an 8-entry slab-allocated array, overflowing by up to 247 entries (~1976 bytes). No public exploit exists and EPSS is 0.17%, reflecting the high-complexity attack path that requires prior EC firmware compromise.
Out-of-bounds write in the Linux kernel's cros_usbpd-charger driver allows kernel memory corruption when a malicious or compromised ChromeOS Embedded Controller (EC) returns a falsified USB PD port count. Kernels from approximately v4.20 through unpatched 6.12.x, 6.18.x, and 7.2.x stable branches fail to clamp the EC-supplied charger port count to EC_USB_PD_MAX_PORTS before iterating, enabling heap corruption with potential for privilege escalation or system crash. No public exploit exists (EPSS 0.17%, 6th percentile), and patches have been released in 6.12.109, 6.18.50, and 7.2.4.
Use-after-free in the Linux kernel's LP8727 battery charger driver allows local exploitation via a race condition in lp8727_release_irq() that can corrupt kernel memory. The defect exists because lp8727_release_irq() cancelled the delayed work before freeing the IRQ, leaving a window where a concurrently delivered IRQ could cause the threaded handler lp8727_isr_func() to re-arm the work via schedule_delayed_work(); after the .remove path returned and the devm layer freed pchg, lp8727_delayed_func() could still execute and dereference the freed structure. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17%, consistent with a static-analysis-detected defect with no known weaponization.
Missing null termination in the Qualcomm battery manager driver (qcom_battmgr) causes the kernel to read beyond a string buffer boundary when firmware on SC8280XP-based devices returns a string that exactly fills the BATTMGR_STRING_LEN field. The three contiguous string fields - model_number, serial_number, and oem_info - are exposed to userspace via the power supply sysfs interface using a bare "%s" format, meaning an unterminated firmware string causes the kernel to traverse into adjacent struct members and leak their contents to unprivileged local readers. No public exploit has been identified at time of analysis; patches are confirmed for stable branches 6.12.109, 6.18.50, and 7.2.4.
Use-after-free vulnerability in the Linux kernel's rt9455 power supply driver allows local exploitation through a race condition between delayed workqueue callbacks and driver teardown. The rt9455_remove() function cancels work items in an order that permits batt_presence_work to re-queue max_charging_time_work after the latter has already been cancelled, resulting in a callback executing against already-freed rt9455_info memory. Identical UAF exposure exists in the probe error path if rt9455_hw_init() fails after the IRQ is registered. No public exploit exists and EPSS is 0.17% (6th percentile); the vulnerability was identified by static analysis rather than observed in exploitation.
Register corruption in Linux kernel s390/percpu silently drops the `mviy` instruction on kernels compiled with GNU binutils prior to 2.39, leaving the per-CPU address register unrepaired after CPU migration following an interrupt. Affected kernels are limited to IBM s390/zSeries architecture builds in the 7.2 lineage using the older toolchain. With C:H/I:H/A:H in the CVSS vector, successful exploitation by a local attacker could lead to privilege escalation via corrupted per-CPU data, though no public exploit or KEV listing exists and EPSS is 0.15%.
Silent data corruption in the Linux kernel's s390/dasd subsystem causes local processes to silently receive zeroed data for the unread portion of partially-completed ESE (Extent Space Efficient) disk reads that pass through the ERP (Error Recovery Procedure) chain. The root cause is dasd_default_erp_postaction() omitting the proc_bytes field when copying per-request state back from the ERP request to the originating request, which causes __dasd_cleanup_cqr() to treat the request as fully satisfied and return without requeuing the unread remainder. No public exploit code exists and no active exploitation is confirmed; vendor-released patches are available across multiple stable branches.
IOMMU Stream ID aliasing in the Linux kernel's Tegra241 CMDQV driver allows a guest-controlled VMM to break IOMMU isolation by supplying an oversized virtual Stream ID. The bounds check in tegra241_vintf_init_vsid() only rejects values exceeding UINT_MAX, but the SID_MATCH register's VIRT_SID field is only 20 bits wide; the 'virt_sid << 1 | 0x1' encoding silently truncates bits above position 20, causing a value like 0x80000000 to alias SID_MATCH to vSID 0 and route the IOMMU entry to the wrong DMA Stream ID. Because vdev->virt_id is guest-controlled under CMDQV virtualization, an attacker with guest VM access can break tenant isolation and gain C:H/I:H/A:H access across the IOMMU boundary to host memory and devices. No public exploit is identified at time of analysis; EPSS is 0.17%, consistent with the narrow Tegra241 hardware-specific attack surface.
Out-of-bounds read in the Linux kernel's Intel Speed Select Technology (ISST) platform driver allows a local low-privileged user to disclose sensitive kernel memory or crash the system via malformed ioctl input. The functions isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() accept a user-controlled level value and pass it as an array index into perf_levels[] without validating it against max_level bounds, unlike adjacent helper functions that perform this check. No public exploit is identified at time of analysis, and patches have been released for stable kernel branches 6.12.109, 6.18.50, and 7.2.4.
Two compounding flaws in the Linux kernel's Intel Speed Select Technology (ISST) ioctl handler allow a local low-privileged user to trigger out-of-bounds memory access or NULL pointer dereference in kernel space. The `isst_if_clos_assoc()` function applies an off-by-one validator (`>` instead of `>=`) against the `sst_inst[]` array boundary, permitting socket_id equal to `topology_max_packages()` to index one entry past the allocated array; a second path omits a NULL check for valid in-range socket IDs whose package has no bound TPMI SST instance, both dereferences reaching `map_partition_power_domain_id()`. Patched kernel versions 6.12.109, 6.18.50, and 7.2.4 are available; no public exploit has been identified at time of analysis and EPSS (0.20%, 10th percentile) reflects very low observed exploitation activity.
Use-after-free memory corruption in the Linux kernel's VIA SDMMC host controller driver (mmc/via-sdmmc) can cause kernel instability and potentially enable local privilege escalation on systems equipped with VIA SD card controllers. During driver probe failure, the card-detect interrupt and pending work item (carddet_work) are not cleaned up, leaving the interrupt handler and work queue running against already-freed memory; via_sdc_isr() dereferences the freed sdhost structure while via_sdc_card_detect() performs a container_of() dereference against freed memory. No public exploit or active exploitation has been identified; the issue was discovered through in-house static analysis and manual code review.
Heap buffer overflow in the Linux kernel's panasonic-laptop platform driver allows a local low-privileged user on affected Panasonic hardware to corrupt kernel heap memory, potentially escalating privileges. The flaw resides in acpi_pcc_retrieve_biosdata(), which writes a trailing sentinel one element past the end of the allocated pcc->sinf[] array when num_sifr equals hkey->package.count - a condition that arises specifically on Panasonic hardware where the BIOS SQTY field reports one fewer SINF entries than the actual package, triggering the driver's existing off-by-one workaround. Vendor-released patches are available in Linux 7.2.4 and 7.3-rc1; no public exploit code or active exploitation has been identified.
Out-of-bounds read and write in the Linux kernel's Chrome EC sensorhub driver exposes Chromebook-class systems to kernel heap corruption via an unvalidated 8-bit sensor number in EC FIFO events. The cros_ec_sensor_ring_process_event() function indexes batch_state[] using the sensor_num field from embedded-controller events without checking it against the allocated array size, allowing any event carrying sensor_num >= sensorhub->sensor_num to access arbitrary adjacent kernel heap memory. No public exploit or CISA KEV listing exists; EPSS is 0.20%, but the C:H/I:H/A:H CIA impact reflects the potential for kernel memory corruption on affected Chrome EC hardware.
Off-by-one out-of-bounds NUL write in the Linux kernel's HP BIOS configuration driver (hp-bioscfg) corrupts kernel memory when hp_get_string_from_buffer() receives a BIOS attribute string whose length exactly matches the destination buffer size, causing the terminator write to land one byte past the allocation. The flaw affects multiple fixed-size kernel buffers - path[512], current_value[512], current_password/current_value[64], and the per-entry encodings[][512] and prerequisites[][512] arrays - exclusively on HP hardware with the hp-bioscfg module loaded. No public exploit code has been identified and EPSS stands at 0.17%, but the kernel write primitive carries theoretical privilege escalation potential alongside a realistic denial-of-service outcome.
Out-of-bounds heap read latency exists in the Linux kernel's `platform/x86/hp-bioscfg` ACPI package parser, where five `hp_populate_*_elements_from_package()` parsers derive their iteration bounds from `elements[0]->string.length` (the name field's byte length) rather than `obj->package.count` (the real package element count). Currently unexploitable because `hp_init_bios_package_attribute()` enforces a strict element-count pre-check, the flaw becomes reachable the moment an anticipated upstream relaxation of that check lands - at which point a local authenticated user on HP hardware could induce the parsers to read past the end of the ACPI `elements[]` array, disclosing kernel heap memory or crashing the kernel. Patches have been backported to stable series 6.12.109, 6.18.50, and 7.2.4; no public exploit exists (EPSS 0.17%).
Task context confusion in the Linux kernel's io_uring waitid subsystem allows a local low-privileged attacker to trigger __do_wait() execution from a kworker thread rather than the originating task, causing child process lookups and signal structure access to operate against the wrong process namespace. Affected kernels span from the commit introducing the vulnerable io_waitid_cb() behavior through version 7.2.3; fixes are confirmed in 7.2.4 and 7.3-rc1. No public exploit code and no KEV listing exist at time of analysis; EPSS of 0.17% reflects minimal observed exploitation activity.
Use-after-free in the Linux kernel's interconnect subsystem allows local low-privileged attackers to corrupt kernel heap memory, potentially enabling privilege escalation to root. The flaw resides in `icc_get()` and `of_icc_get_by_index()`: when `kasprintf()` fails to allocate memory for `path->name`, the error handler calls `kfree(path)` directly while the path's request structures are already linked into interconnect-node hash lists via `hlist_add_head()`, leaving dangling pointers that subsequent interconnect operations dereference. Patched kernel versions 6.12.109, 6.18.50, and 7.2.4 are available; no public exploit or CISA KEV listing exists at time of analysis.
Stack memory disclosure and integer underflow in the Linux kernel's IPMI ipmb subsystem allow a local low-privileged attacker with write access to the IPMB device node to read uninitialized kernel stack bytes and trigger a buffer length underflow in `ipmb_write()`. The root cause is that `ipmb_write()` parses message fields prior to validating the length byte, so a zero-length or undersized write crosses into adjacent stack memory. CVSS rates confidentiality impact as High (stack leak) and availability impact as High (SMBus block-write length underflow), while EPSS at 0.17% reflects the niche attack surface. No public exploit or active exploitation has been identified.
Use-after-free in the Linux kernel IPMI subsystem exposes freed kernel memory through a stale sysfs attribute left behind after a failed SMI registration. When ipmi_add_smi() encounters an error creating the maintenance_mode sysfs file, the nr_msgs attribute is not removed before the smi_info interface structure is freed, leaving a dangling sysfs entry backed by released memory. A local attacker with low privileges who can reach this error condition and then access the stale attribute may achieve arbitrary kernel memory read/write, creating a potential privilege escalation path to root. No public exploit exists and no active exploitation has been confirmed.
Memory corruption in the Linux kernel's IPMI message handler (ipmi/msghandler) stems from an incomplete error-path cleanup: when an IPMI interface encounters an error during startup, kernel workqueue items already scheduled for that interface are not canceled before the interface structure is freed, creating a use-after-free condition. Systems running kernel versions in the 6.18.20-6.18.49 and 7.0-7.2.3 ranges with IPMI-capable hardware are affected. Patches were released in stable updates 6.18.50 and 7.2.4; no public exploit exists and EPSS is very low at 0.20%.
Missing ingress-device validation in the Linux kernel's AF_IUCV HiperSockets receive path allows adjacent-network attackers on the same HiperSockets segment (VCHID) to deliver crafted ETH_P_AF_IUCV frames to sockets bound on different IQD devices, enabling accept-queue exhaustion, data injection into established connections, and attacker-controlled peer identity on newly accepted connections. A secondary local vector also exists: a process holding CAP_NET_RAW only within an unprivileged network namespace can send raw ETH_P_AF_IUCV frames over its loopback interface and have them matched against init_net sockets, bypassing namespace isolation. The fix - introduced in stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1 - adds a per-socket hs_dev check against the ingress netdev. No public exploit or CISA KEV listing is present at time of analysis.
TX queue stall in the Linux kernel's Broadcom bnxt network driver causes network transmission to halt on systems running software UDP Segmentation Offload (SW USO). Under burst traffic conditions, the `bnxt_sw_udp_gso_xmit` function can return early with NETDEV_TX_BUSY while leaving `txr->kick_pending` set to 1, meaning the driver has written Buffer Descriptors (BDs) but never rings the device doorbell - so the NIC never processes the queued packets and the completion event that would wake the TX queue never arrives. The stall was confirmed on a production system where a netdev TX watchdog triggered; no public exploit exists and no active exploitation has been identified.
Race condition in the Linux kernel's IPA (IP Accelerator) network driver permanently stalls the cellular modem TX queue on Qualcomm Snapdragon-based devices after a runtime power management resume cycle. The flaw occurs because the queue-wake work is dispatched during RPM_RESUMING state before RPM_ACTIVE is reached; the wake is consumed prematurely by a racing transmit, pm_runtime_get() returns -EINPROGRESS with no future wake scheduled, and the TX queue never recovers - blocking both outbound packets queued in qdisc and, through suspended endpoints, inbound RX as well. No public exploit exists and EPSS is 0.20%, but the failure manifests under normal cellular data usage without any adversarial trigger.
Use-after-free in the Linux kernel MCTP subsystem allows an unprivileged local user to corrupt kernel memory by racing mctp_route_lookup() against concurrent device teardown. The function accesses rt->dev without holding a reference, so mctp_dev_put() can kfree() mdev->addrs while mctp_saddr() is still reading rt->dev->addrs[0] - confirmed by a KASAN slab-use-after-free trace. No CAP_NET_RAW is required; any user who can open an AF_MCTP socket can reach this path, making it a low-barrier local privilege escalation candidate. No public exploit is identified at time of analysis, though the vulnerability reintroduces the CVE-2023-3439 use-after-free class and carries CVSS C:H/I:H/A:H.
NULL and error pointer dereference in the Linux kernel's ravb (Renesas Ethernet AVB) driver allows a local attacker with low privileges to crash the kernel or potentially escalate privileges by querying PTP hardware clock state during an invalid lifecycle window. The flaw affects the ravb driver from Linux 4.2 onward, where priv->ptp.clock is either NULL before the first interface open or left holding an error pointer after a failed PTP clock registration. Fixes are confirmed across stable branches in kernels 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV listing exists.
Use-after-free in the Linux kernel's ravb (Renesas Ethernet AVB) PTP driver allows a local attacker with code execution to potentially escalate privileges or crash the system. The race condition between ravb_ptp_interrupt() and ravb_ptp_stop() permits the interrupt handler to invoke ptp_clock_event() on a clock pointer already freed by ptp_clock_unregister() during interface teardown. No public exploit has been identified at time of analysis, and EPSS is very low (0.20%, 10th percentile), consistent with a hardware-specific kernel bug affecting Renesas SoC deployments.
Out-of-bounds read in the Linux kernel's SMC-Rv2 (Shared Memory Communications over RDMA v2) LLC handling occurs in smc_llc_save_add_link_rkeys(), where the peer rkey count is read from offset 94 of a 72-byte 'ADD LINK' message allocation whenever the RDMA device reports max_recv_sge == 1 and no shared v2 receive buffer exists. Any peer that initiates an SMC-Rv2 link addition triggers the over-read on every link addition, regardless of message contents, as demonstrated by a reproducible KASAN slab-out-of-bounds report. The flaw is fixed in stable kernels; no public exploit code or active exploitation has been identified, and EPSS is low at 0.20%.
Out-of-bounds buffer read in the Linux kernel SMC-Rv2 LLC message handler allows a malicious remote SMC peer to corrupt rtoken state by triggering reads from stale shared receive-buffer data. Specifically, smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() process a crafted DELETE_RKEY_V2 or ADD_LINK v2 message declaring up to 255 rkeys, reading the overflow portion from whatever a prior message left in lgr->wr_rx_buf_v2, potentially deleting valid registered memory keys or installing spurious ones. No public exploit code exists and EPSS is 0.20% (10th percentile), but the impact within SMC-R-enabled datacenter environments is real - disrupted RDMA sessions and hard-to-diagnose memory-token corruption.
A use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem allows the server-side link-addition path (smc_llc_srv_add_link() in net/smc/smc_llc.c) to read a freed LLC queue entry. smc_llc_flow_qentry_del() kfree()s the qentry, but on links without a shared v2 receive buffer the already-freed add_llc pointer is subsequently passed to smc_llc_save_add_link_rkeys(), producing a slab-use-after-free. Affects kernels since 6.14 through the fix in 6.18.50 / 7.2.4 / 7.3-rc1; no public exploit identified at time of analysis and EPSS is low (0.20%), and the KASAN report shows it manifests as a kernel crash rather than a demonstrated code-execution primitive.
Use-after-free in the Linux kernel SMC (Shared Memory Communications) subsystem allows a low-privileged local attacker to trigger a race condition during connection teardown, resulting in memory corruption with potential for privilege escalation. The flaw exists in smc_conn_free() and smc_lgr_terminate_sched(): when a link group is unlinked before connection cleanup completes, the device can re-arm the receive tasklet after tasklet_kill() returns, causing the tasklet to dereference an already-freed send buffer on the DMB-nocopy path. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17%.
Out-of-bounds kernel memory read in the Linux kernel's IPv6 Segment Routing (SRv6/seg6) local processing allows a local unprivileged user to leak adjacent slab memory and potentially crash the host. After decap_and_validate() strips outer SRv6 headers for End.DX6/End.DT6 behaviors, the IPv6 control block (IP6CB) retains a stale nhoff from the outer packet, causing ip6_protocol_deliver_rcu() to read beyond the skb head on the inner packet (KASAN slab-out-of-bounds). There is no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a locally-reachable kernel bug rather than a mass-exploitable remote flaw.
Stack memory corruption in the Linux kernel's qnap-mcu MFD driver allows a local low-privileged user on QNAP hardware to corrupt kernel stack memory, potentially enabling privilege escalation. The driver's qnap_mcu_exec() publishes an on-stack receive buffer to the serdev receive path, which runs asynchronously; when a command times out and the function returns, reply->data still points at the deallocated stack frame. A late MCU reply or unsolicited MCU message then overwrites whatever occupies that stack memory next, yielding C:H/I:H/A:H impact. No public exploit exists and EPSS is 0.20% (10th percentile), consistent with a kernel driver bug requiring physical or local QNAP hardware access.
Out-of-bounds read and write in the Linux kernel's dm-pcache (device mapper persistent cache) module allow a local attacker with CAP_SYS_ADMIN to corrupt kernel memory by loading a device mapper table backed by a crafted cache device containing malformed geometry metadata. The root cause is that cache_segs_init() and get_seg_id() consume on-disk cache_info fields - specifically n_segs and per-segment next_seg link IDs - without range validation before indexing into kernel-allocated arrays, and the only integrity protection on this metadata is a CRC computed with a fixed, public seed that offers no adversarial resistance. No public exploit or active exploitation has been identified; EPSS is 0.20% at the 10th percentile, consistent with the constrained attack prerequisites.
Out-of-bounds memory reads in the Linux kernel dm-pcache device-mapper subsystem allow a CAP_SYS_ADMIN-privileged local attacker to disclose adjacent persistent memory contents to userspace and corrupt the cache replay tree, with potential for kernel panic. Two input-validation gaps exist: kset key_num is not bounded against PCACHE_KSET_KEYS_MAX before buffer iteration, and per-key intra-segment offset+length pairs are accepted verbatim, allowing crafted on-media cache device images to trigger OOB reads that surface into caller bio buffers. No public exploit exists and EPSS sits at 0.20% (10th percentile), consistent with the elevated privilege requirement gating this attack surface.
Out-of-bounds memory access in the Linux kernel's dm-pcache (device-mapper persistent cache) subsystem allows a local privileged attacker to read past segment data boundaries. The `cache_pos_decode()` function loads `key_tail` and `dirty_tail` segment offsets (`seg_off`) directly from the cache device without validating them against the segment's `data_size`, so a crafted cache device with an oversized `seg_off` causes the kernel to address memory beyond the segment buffer. Exploitation requires CAP_SYS_ADMIN to supply the device. No public exploit or CISA KEV listing exists; EPSS is low at 0.17%.
Out-of-bounds read in the Linux kernel dm-pcache subsystem allows a local low-privileged user to read past segment data boundaries into adjacent control areas, exposing sensitive kernel memory and potentially crashing the kernel. Specifically, cache_replay(), the writeback worker, and the GC worker all miscalculate the tail-kset read length using PCACHE_SEG_SIZE minus the segment offset rather than the actual data-region remainder via cache_seg_remain(). This affects Linux 6.18.x (before 6.18.50), 7.2.x (before 7.2.4), and pre-release 7.3-rc1. No public exploit or active exploitation has been identified; EPSS is 0.17% (6th percentile).
Use-after-free and invalid segment operations in the Linux kernel's dm-pcache subsystem allow a local low-privileged attacker to corrupt kernel memory, potentially achieving privilege escalation. The flaw exists in kset_replay() where cache_key_put(key) frees key memory, yet the subsequent code dereferences key->cache_pos.cache_seg - a classic UAF pattern in kernel mempool-managed memory. No public exploit code has been identified and EPSS is 0.20%, though the local CVSS 7.8 (C:H/I:H/A:H) vector reflects the severity of kernel-level memory corruption.
Unlocked dereference of dev->desc in the Linux kernel's i3c subsystem exposes systems with i3c-capable hardware to potential use-after-free or null pointer dereference conditions when a local low-privileged user races device descriptor teardown against calls to i3c_device_get_supported_xfer_mode(). The function accesses dev->desc to resolve the master controller without holding the required bus->lock, meaning a concurrent device detachment can free or null that pointer mid-access, leading to kernel memory corruption with CVSS-assessed C:H/I:H/A:H impact. No public exploit code or active exploitation (KEV) has been identified at time of analysis; vendor-supplied patch commits are available for stable kernel branches.
Use-before-initialization race condition in the ADI I3C master driver of the Linux kernel allows a hardware interrupt to acquire an uninitialized spinlock during device probe. Specifically, adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR before the transfer queue lock and IBI state are initialized, so an early CMDR interrupt can invoke adi_i3c_master_irq() and attempt to take master->xferqueue.lock against an uninitialized dynamic key. No public exploit has been identified and EPSS is 0.20%, but the fix is confirmed in stable trees 6.18.50 and 7.2.4.
Stack information disclosure and use-after-free in the Linux kernel i3c master driver allow a local, low-privileged user to leak kernel stack contents through the sysfs modalias interface during device unregistration. The defect exists from kernel 5.0 onward through 6.12.108, 6.18.49, and 7.2.3: i3cdev->dev->desc is zeroed before device_unregister() completes, so racing calls to i3c_device_uevent() and modalias_show() read a NULL descriptor and fall back to an uninitialized stack struct i3c_device_info, exposing raw kernel stack bytes in the generated uevent string. No public exploit code has been identified at time of analysis; patches are available in stable releases 6.12.109, 6.18.50, 7.2.4, and the 7.3-rc1 mainline tree.
Use-after-free in the Renesas I3C driver allows a local attacker with low privileges to crash the kernel or potentially escalate privileges on systems equipped with Renesas I3C hardware. The flaw stems from a race between a timed-out transfer cleanup path, which frees the transfer struct, and a late-arriving interrupt whose handler dereferences that now-freed memory. No public exploit has been identified, and exploitation requires specific hardware, but the UAF primitive theoretically supports memory corruption beyond a simple crash.
Use-after-free in the rtl8xxxu WiFi driver allows a local authenticated attacker to corrupt kernel memory during device teardown. The flaw exists in two races within the rx_urb_wq work queue shutdown path: schedule_work() is called outside the shutdown lock, and the worker can submit URBs after usb_kill_anchored_urbs() has returned, both permitting the worker to dereference the freed priv structure after ieee80211_free_hw() releases it. Exploitation requires specific hardware (Realtek RTL8XXXU USB WiFi adapter), active RX traffic, and a concurrent disconnect event. No public exploit exists; this was discovered by static analysis with an EPSS of 0.20%.
Out-of-bounds array indexing in the Linux kernel's rtl8192du Wi-Fi driver allows network-adjacent unauthenticated attackers to trigger kernel memory corruption or a crash. The driver's `rtl92du_tx_fill_desc()` function passes a raw 802.11 QoS TID value (range 0-15) as an index into `sta_entry->tids[]`, which is only allocated with MAX_TID_COUNT=9 entries; TID values 9-15 index past the array boundary. UBSAN confirms index-10 access on `rtl_tid_data [9]`. No public exploit exists and EPSS is 0.17%, indicating low real-world exploitation pressure at time of analysis.
The mt7925 WiFi driver (mt76 subsystem) in the Linux kernel fails to cancel a deferred work item on the device stop path, creating a 5-second race window during multi-link operation (MLO) power-save setup. If the mt7925 PCIe or USB device is torn down within that window, the surviving timer fires against a workqueue that has already been destroyed, triggering a kernel WARNING and potential crash. No public exploit has been identified; EPSS is 0.17% (6th percentile), and the bug requires local access to hardware running an affected kernel with MLO power-save active.
Out-of-bounds memory read in the Linux kernel mt76/mt7996 Wi-Fi driver allows a local attacker with ability to supply a truncated EEPROM firmware file to trigger kernel memory disclosure or crash during driver initialization. The driver unconditionally copies and validates the default EEPROM firmware without first checking its length against the expected MT7996_EEPROM_SIZE constant, so a file shorter than that threshold causes reads past the end of the allocated firmware buffer. No public exploit has been identified at time of analysis; EPSS sits at 0.17% (6th percentile), reflecting the hardware-gated, local-access constraint.
Out-of-bounds kernel heap write in the Linux kernel's DS28E17 1-Wire-to-I2C bridge driver allows a local attacker controlling a malicious I2C slave device to write up to 222 bytes past a 34-byte kernel buffer. The driver's w1_f19_i2c_read() unconditionally trusts a device-supplied length byte (0-255) on I2C_M_RECV_LEN transactions, but the caller buffer is only I2C_SMBUS_BLOCK_MAX + 2 bytes; the SMBus core's own BLOCK_MAX check runs only after the overwrite has already occurred. No public exploit has been identified at time of analysis; EPSS sits at 0.17%, reflecting the niche hardware prerequisite.
Improper sysctl table placement in the Linux kernel allows a local low-privileged user to modify the global `cad_pid` setting - which controls which process receives the Ctrl-Alt-Delete console signal - by abusing unprivileged user and PID namespace creation. A non-root user can call `unshare(CLONE_NEWUSER|CLONE_NEWPID)` to gain apparent root privileges in a child namespace and then overwrite the globally-scoped `/proc/sys/kernel/cad_pid`, even though `kill_cad_pid()` operates exclusively in the root namespace. No public exploit is identified at time of analysis; EPSS stands at 0.20% (10th percentile), and no CISA KEV listing exists.
Use-after-free in the Linux kernel's Smack LSM `smack_file_send_sigiotask()` function allows a local attacker with low privileges to trigger kernel memory corruption by racing credential pointer changes on a non-current task. The function incorrectly accessed both `tsk->cred` (subjective credentials, unprotected) and `__task_cred(tsk)` (objective credentials) on the same task; because a task may change its own `->cred` pointer at any time without synchronization, the first access can race with a credential transition, yielding a freed `struct cred` deref. The author confirmed KASAN-reported UAF reproduction and verified the fix. No public exploit exists and EPSS is low at 0.17%, but the CVSS-assessed local impact (C:H/I:H/A:H) reflects the potential for privilege escalation on affected kernels.
Denial of service in Apache OpenNLP 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5 lets a remote unauthenticated attacker pin CPU or crash a worker thread by feeding crafted text to either of the two built-in RegexNameFinder patterns (EMAIL and URL) obtained via RegexNameFinderFactory.getDefaultRegexNameFinders(). The EMAIL pattern's ambiguous nested quantifiers cause quadratic catastrophic backtracking (~32 KB of local-part characters burns seconds of CPU per find() call), while the URL pattern's nested capturing repetition recurses once per query token, exhausting the thread stack and throwing StackOverflowError (~4 KB, or ~1 KB on -Xss512k worker threads). No public exploit was identified at time of analysis; this is availability-only with no code execution or data exposure.
SymSpellModelSerializer in Apache OpenNLP 3.0.0-M4 and 3.0.0-M5 crashes the host JVM with an OutOfMemoryError when deserializing a crafted SymSpell binary model file whose unigramCount or bigramCount field is set to Integer.MAX_VALUE, forcing a 4-8 GB heap allocation attempt. The root cause (CWE-789: Uncontrolled Memory Allocation) is that these two 32-bit count fields are validated only for non-negativity - no upper bound prevents attacker-controlled pre-sizing of a LinkedHashMap before any dictionary entries are consumed. The attack payload is described by the advisory as under 100 bytes, requires no prior authentication if the target application accepts externally supplied model bytes, and is effective against every deserialization code path in the opennlp-spellcheck extension. No public exploit has been identified at time of analysis, and exposure is substantially limited to the small population running pre-release milestone builds.
Process termination via unrecovered panic in AWS SDK for Go v2's EventStream header decoder allows a remote actor to crash any Go application consuming AWS streaming service responses. Sending a crafted EventStream response frame containing a header value type byte outside the valid range triggers an unhandled Go panic that propagates to terminate the host process. The affected surface includes Bedrock inference and agent runtime packages, making AI/ML workloads on AWS a particularly relevant target; no public exploit or active exploitation has been confirmed.
Uncontrolled resource consumption in jackson-databind's CoreXMLDeserializers allows unauthenticated remote attackers to trigger multi-minute CPU saturation via a single oversized HTTP request. When jackson-databind deserializes a JSON string into a javax.xml.datatype.Duration or XMLGregorianCalendar field, it passes the raw string directly to JDK's DatatypeFactory, which internally calls BigInteger(String) and BigDecimal(String) constructors that exhibit O(n²) time complexity relative to digit count. Because the malicious digits are embedded in a JSON string token rather than a JSON number token, jackson-core's existing StreamReadConstraints.maxNumberLength guard is bypassed entirely. A few megabytes of input containing millions of digits can consume tens of seconds to minutes of CPU, and a handful of concurrent such requests can exhaust a server's worker thread pool. No public exploit or CISA KEV listing has been identified at time of analysis.
Arbitrary code execution in Mistral Vibe (mistralai:mistral-vibe) lets an attacker defeat the agent's command-approval allowlist by prefixing an allowlisted command with shell environment-variable assignments (e.g. FOO=bar allowedcmd). The permission checker inspects only the command token and skips the leading assignments, so attacker-controlled variables such as LD_PRELOAD or PATH execute arbitrary code without user approval. Reported by HiddenLayer; no public exploit identified at time of analysis and not listed in CISA KEV.
Arbitrary file write in Mistral Vibe (the AI coding agent), introduced in version 1.3.4, lets an attacker create or overwrite files anywhere the Vibe process can reach - without triggering the tool's user-approval gate. The root cause is that shell redirection targets (e.g. '>' and '>>') are stripped from permission evaluation, so an otherwise allowlisted command can silently redirect its output to paths outside the active workspace. Reported by HiddenLayer; publicly detailed in their security advisory, with no public exploit code identified at time of analysis and no CISA KEV listing.
Heap out-of-bounds write in Orthanc DICOM Server allows a low-privileged network attacker to corrupt memory by supplying a malformed PNG image, potentially enabling remote code execution or denial-of-service against medical imaging infrastructure. The root cause is a CWE-190 integer overflow in pitch and buffer-size computation during PNG decoding, reported by CISA ICS-CERT under medical advisory ICSMA-26-253-02. No public exploit code has been identified at this time, but the nature of the flaw (heap corruption via attacker-controlled image data) makes it a credible RCE candidate in clinical environments.
Remote code execution in SGLang AI inference servers allows unauthenticated attackers to run arbitrary code through the /update_weights_from_tensor endpoint when no authentication keys are configured. The SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr remain resolvable, enabling malicious pickle REDUCE instructions to execute attacker-supplied code. EPSS is 0.21% and no CISA KEV or public exploit is identified, but CVSS rates the flaw critical.
Memory exhaustion DoS in the expressjs/compression Node.js middleware (versions before 1.8.2) allows remote unauthenticated attackers to crash any Express server using the package. When a client aborts an HTTP connection while a compressed response is in flight, the zlib transform stream allocated for that response is never destroyed, permanently leaking its native heap memory. An attacker can automate rapid request-then-abort cycles to exhaust all available server memory, causing process termination. The issue is fixed in 1.8.2 per the OpenJS Foundation advisory; no public exploit code or KEV listing has been identified at time of analysis.
Arbitrary file disclosure in the Hugo static site generator (versions after v0.123.0 and before v0.165.0) lets an attacker read files outside the intended project boundary by planting a symlink in a mounted directory. Because parent-directory symlinks were not dropped during direct resource lookups, functions like resources.Get and os.ReadFile follow the symlink and embed the target file's contents into the built site. Reported by VulnCheck; no public exploit identified at time of analysis, and this is an incomplete-fix follow-up to two prior advisories (GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw).
Memory exhaustion in multiparty Node.js library (versions 2.1.0 through <4.3.1) allows any unauthenticated network attacker to crash the host process with a single crafted HTTP request. The parser accumulates multipart part headers into an unbounded in-memory buffer with no size cap, consuming available process memory until the Node.js server is killed. The vulnerability carries no confidentiality or integrity impact - this is a pure availability issue addressed in multiparty 4.3.1, which enforces a maximum on the bytes buffered per part header block.
An incorrect free in the PCRE2 JIT fast path (all versions before 10.48) can corrupt process memory when an application reuses a single match data block across a pcre2_match call made with the PCRE2_COPY_MATCHED_SUBJECT option and a subsequent pcre2_jit_match call against a JIT-compiled pattern, yielding high confidentiality, integrity, and availability impact on the host process. Exploitation requires local access with low privileges and depends on a specific, uncommon API sequence inside the PCRE2-consuming application rather than on attacker-controlled input, which sharply narrows realistic exposure; the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, CISA SSVC rates exploitation as none and automatable as no, no public exploit was identified at time of analysis, and EPSS is 0.11% (1st percentile). A vendor fix exists in PCRE2 10.48 (upstream PR #937), so the residual risk is low despite the total technical impact rating.
An out-of-bounds heap write in PCRE2's pcre2_convert() pattern-conversion API affects releases before 10.48, but only on 32-bit builds where size_t is 32 bits - 64-bit systems are unaffected. Exploitation is remote and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H, base 7.4), yet it is sharply constrained: the consuming application must actually invoke the comparatively rarely-used convert entry point and pass it a large, attacker-supplied pattern, which is why AC:H applies and the SSVC assessment rates automatic exploitation as not feasible. Publicly available exploit code exists per the SSVC exploitation signal (POC), although there is no confirmed actively exploited (CISA KEV) status; EPSS is low at 0.10% (1st percentile), reflecting the narrow 32-bit-plus-convert-API precondition. Impact is high integrity and availability with no confidentiality loss, consistent with memory corruption via integer overflow leading to under-allocation.
Out-of-bounds read in zstd-jni versions 1.5.5-6 through 1.5.7-13 exposes JVM-based applications to memory disclosure or process crashes when processing attacker-controlled Zstd-compressed data. The `Zstd.getFrameContentSize` method and `ZstdInputStreamNoFinalizer` both fail to reject negative `srcPosition` and `len` arguments before marshalling them into the native Zstd frame-header parser, allowing a negative value to bypass Java-side bounds checks and trigger out-of-bounds reads in the underlying C layer. No public exploit code or CISA KEV listing has been identified; the vendor-released fix is version 1.5.7-14.
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who supplies a crafted .traineddata language file to corrupt heap memory during legacy OCR classifier initialization, with potential for controlled code execution. The flaw is in ReadIntTemplates in src/classify/intproto.cpp, which reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP file component and uses them directly as loop bounds - storing heap pointers into fixed-capacity struct arrays without validating against compile-time maximums. No patched release exists as of this review, though a fix commit is present in the repository; no public exploit has been identified.
Heap corruption in Tesseract OCR 5.5.3 and earlier allows an attacker who can supply a malicious unicharset file to corrupt application heap memory during OCR engine initialization, potentially leading to a crash or controlled code execution. The root cause is that UNICHARSET::load_via_fgets treats the declared character count as a trusted loop bound and uses the incrementing id variable as a direct unichars vector index, while unichar_insert_backwards_compatible silently performs no-op insertions for duplicate or empty representations - causing id to exceed unichars.size() and subsequent set_* writes to access memory beyond the vector. No patched release is available as of this review; only an upstream source commit fix exists.
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who controls the loaded .traineddata model file to corrupt heap memory, crash the process, or potentially achieve code execution. The root cause is in GenericVector::read (src/ccutil/genericvector.h): the serialized `reserved` field allocates the backing buffer while the independent `size_used_` field drives the callback write loop, with no invariant check enforcing size_used_ ≤ reserved. A crafted TESSDATA_INTTEMP component with version_id ≥ 4 exploits this by setting reserved small and size_used_ large, triggering the write overrun through fontinfo_table_.read during legacy classifier initialization. No public exploit and no CISA KEV entry exist at time of analysis; an upstream commit fix exists but no patched release has been published.
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who controls a crafted `.traineddata` model file to corrupt heap memory during LSTM inference, leading to a crash or potentially controlled code execution. The root cause is an inconsistency between `source_` (sized from deserialized `na_`) and the write count used by `WriteTimeStepPart` and `AddTimeStepPart` (driven by `ns_` from the CI gate WeightMatrix dim1), leaving two functions unbounded after prior hardening patched sibling routines. No fixed release is available at time of analysis; an upstream fix exists only as a commit. No public exploit identified at time of analysis.
Heap out-of-bounds write and read in Tesseract OCR Engine 5.5.3 and earlier allows an attacker who can supply a crafted `.traineddata` model file to corrupt heap memory during LSTM inference, potentially achieving information disclosure, a crash, or controlled heap corruption leading to code execution. The flaw lies in `FullyConnected::DeSerialize`, which loads layer dimension scalars `ni_` and `no_` without cross-validating them against the actual weight matrix dimensions; when `Forward` is subsequently called, `MatrixDotVector` writes into a scratch buffer sized by `no_` but indexed by the actual matrix row count, and reads from a buffer sized by `ni_` but indexed by column count minus one. No fixed release has been issued as of this analysis; an upstream fix commit exists on GitHub.
Stack-based buffer overflow in Tesseract OCR 5.5.3 and earlier corrupts the stack during legacy engine initialization, enabling denial of service and potential control-flow hijacking when a crafted `.traineddata` file is processed. The flaw originates in `Classify::ReadNormProtos` (normmatch.cpp), where unbounded `std::istream::operator>>(char*)` extraction into a fixed 61-byte stack buffer allows a 99-character NORMPROTO token to overwrite up to 39 bytes beyond the buffer boundary during `TessBaseAPI::Init`. No fixed release is available at time of analysis; an upstream fix commit exists but has not been tagged as a release, and no public exploit has been identified at time of analysis.
Memory exhaustion in rclone 1.75.0's serve S3 multipart upload handler allows remote attackers to exhaust process or host memory and permanently block request handlers by sending UploadPart requests that declare a large Content-Length but deliver no body bytes. The handler in cmd/serve/s3/multipart.go pre-allocates lib/pool pages sized to the attacker-controlled Content-Length header before any body bytes arrive, and the waitForTurn scheduling mechanism admits one additional oversized part even when --multipart-streaming-buffer-limit is active, partially bypassing the intended cap. The issue is fixed in rclone v1.75.1; no public exploit or CISA KEV listing has been identified.
Authentication/authorization bypass in rclone's dynamic serve interface (versions 1.70.0 through 1.75.0) lets remote attackers reach a fixed filesystem instead of the per-request backend the operator intended. When an FTP or S3 server is spun up via the serve/start RC (remote control) API with a per-server proxyOpt.AuthProxy, the FTP and S3 constructors mistakenly consult the empty process-global proxy.Opt.AuthProxy, so the request-local auth proxy is silently ignored: FTP accepts anonymous logins with any password against the fixed VFS, and S3 with AuthKey serves the fixed RC fs rather than the proxy-selected backend. There is no public exploit identified at time of analysis, and this is not in CISA KEV. Fixed in 1.75.1.
Authentication bypass in rclone's S3 server mode (rclone serve s3) allows any unauthenticated network attacker to impersonate arbitrary S3 access keys. When rclone serve s3 is started with --auth-proxy but without --auth-key, authPairMiddleware registers whatever accessKeyID the client chooses against an empty s3Secret, and gofakes3 then validates the request's SigV4 signature against that same empty secret - so an attacker can pick any access key, sign with an empty secret, and reach whatever backend the auth-proxy script resolves for that identity. Fixed in rclone 1.75.1; no public exploit identified at time of analysis, though the vendor security advisory (GHSA-xwwr-4h3p-r22c) and fix commit are public.
Cross-session credential isolation failure in rclone's FTP auth-proxy driver (versions 1.64.0-1.75.0) allows an authenticated network attacker to hijack a victim user's cloud storage backend by exploiting a server-wide, username-keyed credential map. When an attacker holds an open FTP session using a shared username and a victim subsequently authenticates with the same username, the victim's credential silently overwrites the server-wide map entry - causing the attacker's subsequent VFS operations to execute against the victim's backend, enabling reads, writes, renames, and deletions of the victim's cloud objects. No public exploit identified at time of analysis; vendor-released patch v1.75.1 resolves the issue.
Symlink escape in rclone's local backend (prior to v1.75.1) allows an attacker who controls sync source contents to apply metadata - ownership, permissions, or timestamps - to files and directories outside the intended destination root. When `--links` is enabled, a crafted `.rclonelink` entry plants a symlink in the destination; subsequent metadata routines (`MkdirMetadata`, `writeMetadataToFile`, `setTimes`) incorrectly skip the symlink guard and call `os.Chown`, `os.Chmod`, `os.Chtimes`, and birth-time syscalls through the planted link, bypassing `os.Root` confinement. Vendor-released patch is confirmed in v1.75.1; no active exploitation has been identified at time of analysis.
HTTP/1 request-target parsing in Traefik prior to 2.11.57 and 3.7.13 allows unauthenticated remote attackers to send a rootless URL target (e.g., `http:example.com/admin`) that Go's HTTP library stores in URL.Opaque rather than URL.Path, leaving URL.Path empty. Traefik's routing engine, forwardAuth middleware, and access logger all evaluate against the normalized empty path (treated as `/`), while URL.RequestURI() gives URL.Opaque precedence when forwarding — meaning the backend receives the original opaque target verbatim. The practical consequence is cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion, all requiring no authentication or special client configuration. No public exploit has been identified at time of analysis, though the patch PR includes test cases demonstrating the attack technique in full detail.
Security middleware bypass in Traefik reverse proxy versions 2.11.26-2.11.56 and 3.4.2-3.7.12 allows unauthenticated network attackers to reach protected backend routes by exploiting h2c protocol upgrade tunneling. When a crafted HTTP/1.1 request carrying Connection, Upgrade: h2c, and HTTP2-Settings headers causes a h2c-capable backend to respond with 101 Switching Protocols, Traefik enters a raw TCP tunnel that silently disables every configured middleware layer-including BasicAuth, ForwardAuth, IPAllowList, RateLimit, and all access logging, metrics, and tracing hooks-for the lifetime of that connection. All subsequent HTTP/2 frames in the tunnel reach protected backend paths without any Traefik security enforcement. No public exploit code has been identified at time of analysis; vendor-released fixes are available in v2.11.57 and v3.7.13.
Use-after-free in the Linux kernel's staging Intel IPU7 media driver allows a local attacker to corrupt kernel memory and potentially escalate privileges. The `isys_probe()` error path registers the V4L2 async notifier but fails to unregister it on subsequent probe failures, leaving a dangling pointer in the global `notifier_list` after `devres` frees the enclosing `struct ipu7_isys`. Any subsequent walk of that list - an event driven by normal kernel media subsystem activity - reads freed memory, creating exploitable heap corruption. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS is 0.17% at the 7th percentile.
Race condition in Linux kernel's core scheduler pick_next_task() path allows a local low-privileged attacker to exploit a TOCTOU window when pick_task() releases the rq (run queue) lock mid-selection, potentially leaking information across SMT sibling threads, corrupting forceidle accounting, and destabilizing the scheduler. The vulnerability breaks the cookie-based SMT isolation guarantee of Core Scheduling: an uncookied task can be committed as the sibling of a cookied task during the lock-release window, violating the trust boundary the feature is designed to enforce. No public exploit exists (EPSS 0.19%), and fixes are available in Linux 7.2.4, 7.3-rc1, and 6.19.
Use-after-free race condition in the Linux kernel RDMA/ucma subsystem allows a local attacker with access to the userspace connection manager interface to corrupt kernel memory and achieve privilege escalation. The flaw exists in ucma_set_ib_path(), which invokes ucma_event_handler() without holding the handler lock that serializes access to ctx->file; a concurrent ucma_migrate_id() call can swap ctx->file between reads inside the handler, causing an event to be enqueued on file B's list while only file A's mutex is held - a condition confirmed by a KASAN slab-use-after-free trace in the upstream commit. Patches are available for all actively supported stable kernel branches (6.12.109, 6.18.50, 7.2.4, 7.3-rc1); no public exploit or active exploitation has been identified.
A race condition in the Linux kernel's RDMA/ucma subsystem allows an unprivileged local user to corrupt kernel data structures and deadlock a mutex by racing ucma_write_cm_event() against ucma_migrate_id(). The device /dev/infiniband/rdma_cm carries world-readable/writable permissions (0666), and the kernel description explicitly states no physical RDMA hardware is required to reach the vulnerable code path, making this accessible to any local user on an affected system. The race causes ctx->file to be swapped mid-sequence across four dereferences - resulting in a kernel BUG at lib/list_debug.c, a permanently held mutex wedging subsequent writers in uninterruptible D-state, and a stranded uevent that outlives its owning context. No public exploit has been identified at time of analysis.
Dangling pointer in the Linux kernel AS3722 PMIC regulator driver leaves `pdev->dev.of_node` referencing freed memory after `of_node_put()` prematurely drops the reference acquired by `of_get_child_by_name()` during Device Tree parsing in `as3722_get_regulator_dt_data()`. Systems running the ams AS3722 Power Management IC driver - predominantly NVIDIA Tegra-based embedded platforms - are affected across all kernel versions since Linux 3.13. If the stale pointer is subsequently dereferenced by regulator framework operations, kernel memory corruption, information disclosure, or local privilege escalation may result; no public exploit code has been identified at time of analysis.
Linux kernel ring-buffer subsystem exposes a race condition between subbuffer resize and page allocation/free operations, enabling local privilege escalation. When ring_buffer_subbuf_order_set() clears cpu_buffer->free_page without holding the cpu_buffer->lock, a concurrent ring_buffer_alloc_read_page() or ring_buffer_free_read_page() call can operate on a stale or freed page, producing kernel memory corruption. No public exploit code exists and EPSS is 0.20%, but the CVSS 7.8 C:H/I:H/A:H vector reflects full kernel-level impact potential once the race is won.
Page-list corruption in the Linux kernel ring-buffer subsystem allows a local low-privileged attacker to trigger undefined memory behavior by exploiting improper handling of a failed remote reader page swap. When the tracing ring-buffer's `swap_reader_page` callback returns `-EBUSY` - which occurs during an event storm on a small buffer - `__rb_get_reader_page_from_remote()` incorrectly proceeds as though the swap succeeded, splicing the same physical page as both the previous and new reader entry simultaneously. This corrupted page-list state can result in confidentiality loss from stale kernel memory reads, integrity violations from writes to a doubly-referenced page, or kernel panic. No public exploit or active KEV listing exists; EPSS is 0.15%, consistent with a low-likelihood local kernel race condition.
Heap buffer overflow in the Linux kernel orangefs client debug-mask parser allows a local low-privileged attacker to corrupt kernel heap memory and potentially escalate privileges. The flaw originates in `orangefs_prepare_cdm_array()`, where buffer sizing via `strcspn()` and subsequent parsing via `sscanf %s` diverge in how they handle leading whitespace - a crafted debug mask entry prefixed with a space causes an undersized allocation that `sscanf` then overwrites. Vendor-released patches are available across all active stable branches (6.12.109, 6.18.50, 7.2.4, 7.3-rc1); no public exploit or active exploitation is identified.
Heap out-of-bounds write in the Linux kernel's ocfs2 o2dlm (distributed lock manager) allows a malicious cluster member to corrupt or panic peer nodes. The dlm_migrate_request_handler() accepts a peer-supplied name-length field (migrate->namelen) from a DLM_MIGRATE_REQUEST message without bounds-checking and passes it to dlm_init_mle(), which memcpy()s up to ~215 attacker-controlled bytes past the 32-byte mname[] field of an o2dlm_mle slab object. Any node that has joined the DLM domain can trigger it; there is no public exploit and it is not in CISA KEV, with EPSS at just 0.20%.
Kernel memory corruption in the Linux kernel's OCFS2 cluster filesystem distributed lock manager (o2dlm) allows any node in a DLM domain to crash or corrupt the heap of a peer node. The dlm_mig_lockres_handler for DLM_MIG_LOCKRES recovery messages trusts the peer-supplied num_locks and lockname_len fields without validation, producing an out-of-bounds read that ends in a BUG_ON panic and a heap out-of-bounds write into a fixed 32-byte lockname slab object. No public exploit identified at time of analysis; EPSS is low at 0.20% (10th percentile), and the fix is available across multiple stable kernel branches.
Out-of-bounds read and write in the Linux kernel's ocfs2 refcount block validator allows a local privileged attacker to corrupt kernel memory via a crafted or corrupted filesystem image. The `ocfs2_validate_refcount_block()` function fails to validate `rl_used` and `rl_count` fields against the actual fixed per-block capacity before refcount/reflink/CoW operations walk the record array, allowing a crafted `rl_used == 0xffff` to drive the loop 65534 iterations past the end of the 4096-byte metadata block. A subsequent `memmove()` of up to ~1 MiB from an already out-of-bounds offset in `ocfs2_insert_refcount_rec()` can corrupt arbitrary kernel memory. No public exploit and no KEV listing; EPSS is 0.20% reflecting realistic low exploitation probability.
Arbitrary kernel memory read/write in the Linux kernel's OpenRISC architecture syscall handler allows an unprivileged local process to overwrite kernel structures such as the sys_call_table and achieve kernel-context code execution. The `sys_or1k_atomic()` function (syscall 244 in the or1k ABI) performs a hand-written assembly atomic word swap between two user-supplied pointers without calling `access_ok()`, and its four memory-access instructions lack exception table entries - meaning any kernel address passed by a caller is directly dereferenced without fault isolation. Patches are confirmed in stable series 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation is identified.
Use-after-free in the Linux kernel IPMI message handler allows a local low-privileged user to corrupt kernel memory by racing `_ipmi_destroy_user()` against concurrent RCU readers in `find_cmd_rcvr()` and `handle_ipmb_get_msg_cmd()`. A regression introduced by commit 9e91f8a6c868 removed the `synchronize_rcu()` grace period that previously ensured no readers held live pointers to `cmd_rcvr` structures before `kfree()` was called, while the `cmd_rcvrs` list continues to be walked under plain RCU. No public exploit code has been identified at time of analysis; patched stable kernel versions are available.
Use-after-free in the Linux kernel's lockd (NFS Network Lock Manager) service allows freed-memory access during hash-bucket file traversal. The nlm_traverse_files() iterator pinned the current file but not the saved 'next' pointer across a mutex_unlock window, so a concurrent nlm_release_file() could kfree the next file and cause the iterator to dereference freed memory on its next step. Fixed across stable kernels; no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a hard-to-time race rather than a turnkey exploit.
Use-after-free in the Linux kernel charger-manager power supply driver exposes local low-privileged users to kernel memory corruption and potential privilege escalation. The driver's probe path registers power_supply sysfs attributes before acquiring regulator handles, and its remove path frees regulator consumer handles before tearing down sysfs - creating two overlapping windows where a write to the externally_control attribute, or the remove path's own try_charger_enable() call, dereferences already-freed memory. No public exploit exists and EPSS is 0.20%, but the bug was discovered by static analysis rather than observed in-the-wild attacks, and patches are available in stable kernel trees 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Slab out-of-bounds write in the Linux kernel's cros_usbpd-charger driver allows a malfunctioning, malicious, or compromised Chrome Embedded Controller (EC) to corrupt kernel heap memory during device probe. The driver accepts EC-reported USB PD port counts as loop bounds without validating them against EC_USB_PD_MAX_PORTS (8), so an EC returning any count N > 8 - up to the u8 maximum of 255 - writes N pointers into an 8-entry slab-allocated array, overflowing by up to 247 entries (~1976 bytes). No public exploit exists and EPSS is 0.17%, reflecting the high-complexity attack path that requires prior EC firmware compromise.
Out-of-bounds write in the Linux kernel's cros_usbpd-charger driver allows kernel memory corruption when a malicious or compromised ChromeOS Embedded Controller (EC) returns a falsified USB PD port count. Kernels from approximately v4.20 through unpatched 6.12.x, 6.18.x, and 7.2.x stable branches fail to clamp the EC-supplied charger port count to EC_USB_PD_MAX_PORTS before iterating, enabling heap corruption with potential for privilege escalation or system crash. No public exploit exists (EPSS 0.17%, 6th percentile), and patches have been released in 6.12.109, 6.18.50, and 7.2.4.
Use-after-free in the Linux kernel's LP8727 battery charger driver allows local exploitation via a race condition in lp8727_release_irq() that can corrupt kernel memory. The defect exists because lp8727_release_irq() cancelled the delayed work before freeing the IRQ, leaving a window where a concurrently delivered IRQ could cause the threaded handler lp8727_isr_func() to re-arm the work via schedule_delayed_work(); after the .remove path returned and the devm layer freed pchg, lp8727_delayed_func() could still execute and dereference the freed structure. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17%, consistent with a static-analysis-detected defect with no known weaponization.
Missing null termination in the Qualcomm battery manager driver (qcom_battmgr) causes the kernel to read beyond a string buffer boundary when firmware on SC8280XP-based devices returns a string that exactly fills the BATTMGR_STRING_LEN field. The three contiguous string fields - model_number, serial_number, and oem_info - are exposed to userspace via the power supply sysfs interface using a bare "%s" format, meaning an unterminated firmware string causes the kernel to traverse into adjacent struct members and leak their contents to unprivileged local readers. No public exploit has been identified at time of analysis; patches are confirmed for stable branches 6.12.109, 6.18.50, and 7.2.4.
Use-after-free vulnerability in the Linux kernel's rt9455 power supply driver allows local exploitation through a race condition between delayed workqueue callbacks and driver teardown. The rt9455_remove() function cancels work items in an order that permits batt_presence_work to re-queue max_charging_time_work after the latter has already been cancelled, resulting in a callback executing against already-freed rt9455_info memory. Identical UAF exposure exists in the probe error path if rt9455_hw_init() fails after the IRQ is registered. No public exploit exists and EPSS is 0.17% (6th percentile); the vulnerability was identified by static analysis rather than observed in exploitation.
Register corruption in Linux kernel s390/percpu silently drops the `mviy` instruction on kernels compiled with GNU binutils prior to 2.39, leaving the per-CPU address register unrepaired after CPU migration following an interrupt. Affected kernels are limited to IBM s390/zSeries architecture builds in the 7.2 lineage using the older toolchain. With C:H/I:H/A:H in the CVSS vector, successful exploitation by a local attacker could lead to privilege escalation via corrupted per-CPU data, though no public exploit or KEV listing exists and EPSS is 0.15%.
Silent data corruption in the Linux kernel's s390/dasd subsystem causes local processes to silently receive zeroed data for the unread portion of partially-completed ESE (Extent Space Efficient) disk reads that pass through the ERP (Error Recovery Procedure) chain. The root cause is dasd_default_erp_postaction() omitting the proc_bytes field when copying per-request state back from the ERP request to the originating request, which causes __dasd_cleanup_cqr() to treat the request as fully satisfied and return without requeuing the unread remainder. No public exploit code exists and no active exploitation is confirmed; vendor-released patches are available across multiple stable branches.
IOMMU Stream ID aliasing in the Linux kernel's Tegra241 CMDQV driver allows a guest-controlled VMM to break IOMMU isolation by supplying an oversized virtual Stream ID. The bounds check in tegra241_vintf_init_vsid() only rejects values exceeding UINT_MAX, but the SID_MATCH register's VIRT_SID field is only 20 bits wide; the 'virt_sid << 1 | 0x1' encoding silently truncates bits above position 20, causing a value like 0x80000000 to alias SID_MATCH to vSID 0 and route the IOMMU entry to the wrong DMA Stream ID. Because vdev->virt_id is guest-controlled under CMDQV virtualization, an attacker with guest VM access can break tenant isolation and gain C:H/I:H/A:H access across the IOMMU boundary to host memory and devices. No public exploit is identified at time of analysis; EPSS is 0.17%, consistent with the narrow Tegra241 hardware-specific attack surface.
Out-of-bounds read in the Linux kernel's Intel Speed Select Technology (ISST) platform driver allows a local low-privileged user to disclose sensitive kernel memory or crash the system via malformed ioctl input. The functions isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() accept a user-controlled level value and pass it as an array index into perf_levels[] without validating it against max_level bounds, unlike adjacent helper functions that perform this check. No public exploit is identified at time of analysis, and patches have been released for stable kernel branches 6.12.109, 6.18.50, and 7.2.4.
Two compounding flaws in the Linux kernel's Intel Speed Select Technology (ISST) ioctl handler allow a local low-privileged user to trigger out-of-bounds memory access or NULL pointer dereference in kernel space. The `isst_if_clos_assoc()` function applies an off-by-one validator (`>` instead of `>=`) against the `sst_inst[]` array boundary, permitting socket_id equal to `topology_max_packages()` to index one entry past the allocated array; a second path omits a NULL check for valid in-range socket IDs whose package has no bound TPMI SST instance, both dereferences reaching `map_partition_power_domain_id()`. Patched kernel versions 6.12.109, 6.18.50, and 7.2.4 are available; no public exploit has been identified at time of analysis and EPSS (0.20%, 10th percentile) reflects very low observed exploitation activity.
Use-after-free memory corruption in the Linux kernel's VIA SDMMC host controller driver (mmc/via-sdmmc) can cause kernel instability and potentially enable local privilege escalation on systems equipped with VIA SD card controllers. During driver probe failure, the card-detect interrupt and pending work item (carddet_work) are not cleaned up, leaving the interrupt handler and work queue running against already-freed memory; via_sdc_isr() dereferences the freed sdhost structure while via_sdc_card_detect() performs a container_of() dereference against freed memory. No public exploit or active exploitation has been identified; the issue was discovered through in-house static analysis and manual code review.
Heap buffer overflow in the Linux kernel's panasonic-laptop platform driver allows a local low-privileged user on affected Panasonic hardware to corrupt kernel heap memory, potentially escalating privileges. The flaw resides in acpi_pcc_retrieve_biosdata(), which writes a trailing sentinel one element past the end of the allocated pcc->sinf[] array when num_sifr equals hkey->package.count - a condition that arises specifically on Panasonic hardware where the BIOS SQTY field reports one fewer SINF entries than the actual package, triggering the driver's existing off-by-one workaround. Vendor-released patches are available in Linux 7.2.4 and 7.3-rc1; no public exploit code or active exploitation has been identified.
Out-of-bounds read and write in the Linux kernel's Chrome EC sensorhub driver exposes Chromebook-class systems to kernel heap corruption via an unvalidated 8-bit sensor number in EC FIFO events. The cros_ec_sensor_ring_process_event() function indexes batch_state[] using the sensor_num field from embedded-controller events without checking it against the allocated array size, allowing any event carrying sensor_num >= sensorhub->sensor_num to access arbitrary adjacent kernel heap memory. No public exploit or CISA KEV listing exists; EPSS is 0.20%, but the C:H/I:H/A:H CIA impact reflects the potential for kernel memory corruption on affected Chrome EC hardware.
Off-by-one out-of-bounds NUL write in the Linux kernel's HP BIOS configuration driver (hp-bioscfg) corrupts kernel memory when hp_get_string_from_buffer() receives a BIOS attribute string whose length exactly matches the destination buffer size, causing the terminator write to land one byte past the allocation. The flaw affects multiple fixed-size kernel buffers - path[512], current_value[512], current_password/current_value[64], and the per-entry encodings[][512] and prerequisites[][512] arrays - exclusively on HP hardware with the hp-bioscfg module loaded. No public exploit code has been identified and EPSS stands at 0.17%, but the kernel write primitive carries theoretical privilege escalation potential alongside a realistic denial-of-service outcome.
Out-of-bounds heap read latency exists in the Linux kernel's `platform/x86/hp-bioscfg` ACPI package parser, where five `hp_populate_*_elements_from_package()` parsers derive their iteration bounds from `elements[0]->string.length` (the name field's byte length) rather than `obj->package.count` (the real package element count). Currently unexploitable because `hp_init_bios_package_attribute()` enforces a strict element-count pre-check, the flaw becomes reachable the moment an anticipated upstream relaxation of that check lands - at which point a local authenticated user on HP hardware could induce the parsers to read past the end of the ACPI `elements[]` array, disclosing kernel heap memory or crashing the kernel. Patches have been backported to stable series 6.12.109, 6.18.50, and 7.2.4; no public exploit exists (EPSS 0.17%).
Task context confusion in the Linux kernel's io_uring waitid subsystem allows a local low-privileged attacker to trigger __do_wait() execution from a kworker thread rather than the originating task, causing child process lookups and signal structure access to operate against the wrong process namespace. Affected kernels span from the commit introducing the vulnerable io_waitid_cb() behavior through version 7.2.3; fixes are confirmed in 7.2.4 and 7.3-rc1. No public exploit code and no KEV listing exist at time of analysis; EPSS of 0.17% reflects minimal observed exploitation activity.
Use-after-free in the Linux kernel's interconnect subsystem allows local low-privileged attackers to corrupt kernel heap memory, potentially enabling privilege escalation to root. The flaw resides in `icc_get()` and `of_icc_get_by_index()`: when `kasprintf()` fails to allocate memory for `path->name`, the error handler calls `kfree(path)` directly while the path's request structures are already linked into interconnect-node hash lists via `hlist_add_head()`, leaving dangling pointers that subsequent interconnect operations dereference. Patched kernel versions 6.12.109, 6.18.50, and 7.2.4 are available; no public exploit or CISA KEV listing exists at time of analysis.
Stack memory disclosure and integer underflow in the Linux kernel's IPMI ipmb subsystem allow a local low-privileged attacker with write access to the IPMB device node to read uninitialized kernel stack bytes and trigger a buffer length underflow in `ipmb_write()`. The root cause is that `ipmb_write()` parses message fields prior to validating the length byte, so a zero-length or undersized write crosses into adjacent stack memory. CVSS rates confidentiality impact as High (stack leak) and availability impact as High (SMBus block-write length underflow), while EPSS at 0.17% reflects the niche attack surface. No public exploit or active exploitation has been identified.
Use-after-free in the Linux kernel IPMI subsystem exposes freed kernel memory through a stale sysfs attribute left behind after a failed SMI registration. When ipmi_add_smi() encounters an error creating the maintenance_mode sysfs file, the nr_msgs attribute is not removed before the smi_info interface structure is freed, leaving a dangling sysfs entry backed by released memory. A local attacker with low privileges who can reach this error condition and then access the stale attribute may achieve arbitrary kernel memory read/write, creating a potential privilege escalation path to root. No public exploit exists and no active exploitation has been confirmed.
Memory corruption in the Linux kernel's IPMI message handler (ipmi/msghandler) stems from an incomplete error-path cleanup: when an IPMI interface encounters an error during startup, kernel workqueue items already scheduled for that interface are not canceled before the interface structure is freed, creating a use-after-free condition. Systems running kernel versions in the 6.18.20-6.18.49 and 7.0-7.2.3 ranges with IPMI-capable hardware are affected. Patches were released in stable updates 6.18.50 and 7.2.4; no public exploit exists and EPSS is very low at 0.20%.
Missing ingress-device validation in the Linux kernel's AF_IUCV HiperSockets receive path allows adjacent-network attackers on the same HiperSockets segment (VCHID) to deliver crafted ETH_P_AF_IUCV frames to sockets bound on different IQD devices, enabling accept-queue exhaustion, data injection into established connections, and attacker-controlled peer identity on newly accepted connections. A secondary local vector also exists: a process holding CAP_NET_RAW only within an unprivileged network namespace can send raw ETH_P_AF_IUCV frames over its loopback interface and have them matched against init_net sockets, bypassing namespace isolation. The fix - introduced in stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1 - adds a per-socket hs_dev check against the ingress netdev. No public exploit or CISA KEV listing is present at time of analysis.
TX queue stall in the Linux kernel's Broadcom bnxt network driver causes network transmission to halt on systems running software UDP Segmentation Offload (SW USO). Under burst traffic conditions, the `bnxt_sw_udp_gso_xmit` function can return early with NETDEV_TX_BUSY while leaving `txr->kick_pending` set to 1, meaning the driver has written Buffer Descriptors (BDs) but never rings the device doorbell - so the NIC never processes the queued packets and the completion event that would wake the TX queue never arrives. The stall was confirmed on a production system where a netdev TX watchdog triggered; no public exploit exists and no active exploitation has been identified.
Race condition in the Linux kernel's IPA (IP Accelerator) network driver permanently stalls the cellular modem TX queue on Qualcomm Snapdragon-based devices after a runtime power management resume cycle. The flaw occurs because the queue-wake work is dispatched during RPM_RESUMING state before RPM_ACTIVE is reached; the wake is consumed prematurely by a racing transmit, pm_runtime_get() returns -EINPROGRESS with no future wake scheduled, and the TX queue never recovers - blocking both outbound packets queued in qdisc and, through suspended endpoints, inbound RX as well. No public exploit exists and EPSS is 0.20%, but the failure manifests under normal cellular data usage without any adversarial trigger.
Use-after-free in the Linux kernel MCTP subsystem allows an unprivileged local user to corrupt kernel memory by racing mctp_route_lookup() against concurrent device teardown. The function accesses rt->dev without holding a reference, so mctp_dev_put() can kfree() mdev->addrs while mctp_saddr() is still reading rt->dev->addrs[0] - confirmed by a KASAN slab-use-after-free trace. No CAP_NET_RAW is required; any user who can open an AF_MCTP socket can reach this path, making it a low-barrier local privilege escalation candidate. No public exploit is identified at time of analysis, though the vulnerability reintroduces the CVE-2023-3439 use-after-free class and carries CVSS C:H/I:H/A:H.
NULL and error pointer dereference in the Linux kernel's ravb (Renesas Ethernet AVB) driver allows a local attacker with low privileges to crash the kernel or potentially escalate privileges by querying PTP hardware clock state during an invalid lifecycle window. The flaw affects the ravb driver from Linux 4.2 onward, where priv->ptp.clock is either NULL before the first interface open or left holding an error pointer after a failed PTP clock registration. Fixes are confirmed across stable branches in kernels 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or CISA KEV listing exists.
Use-after-free in the Linux kernel's ravb (Renesas Ethernet AVB) PTP driver allows a local attacker with code execution to potentially escalate privileges or crash the system. The race condition between ravb_ptp_interrupt() and ravb_ptp_stop() permits the interrupt handler to invoke ptp_clock_event() on a clock pointer already freed by ptp_clock_unregister() during interface teardown. No public exploit has been identified at time of analysis, and EPSS is very low (0.20%, 10th percentile), consistent with a hardware-specific kernel bug affecting Renesas SoC deployments.
Out-of-bounds read in the Linux kernel's SMC-Rv2 (Shared Memory Communications over RDMA v2) LLC handling occurs in smc_llc_save_add_link_rkeys(), where the peer rkey count is read from offset 94 of a 72-byte 'ADD LINK' message allocation whenever the RDMA device reports max_recv_sge == 1 and no shared v2 receive buffer exists. Any peer that initiates an SMC-Rv2 link addition triggers the over-read on every link addition, regardless of message contents, as demonstrated by a reproducible KASAN slab-out-of-bounds report. The flaw is fixed in stable kernels; no public exploit code or active exploitation has been identified, and EPSS is low at 0.20%.
Out-of-bounds buffer read in the Linux kernel SMC-Rv2 LLC message handler allows a malicious remote SMC peer to corrupt rtoken state by triggering reads from stale shared receive-buffer data. Specifically, smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() process a crafted DELETE_RKEY_V2 or ADD_LINK v2 message declaring up to 255 rkeys, reading the overflow portion from whatever a prior message left in lgr->wr_rx_buf_v2, potentially deleting valid registered memory keys or installing spurious ones. No public exploit code exists and EPSS is 0.20% (10th percentile), but the impact within SMC-R-enabled datacenter environments is real - disrupted RDMA sessions and hard-to-diagnose memory-token corruption.
A use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem allows the server-side link-addition path (smc_llc_srv_add_link() in net/smc/smc_llc.c) to read a freed LLC queue entry. smc_llc_flow_qentry_del() kfree()s the qentry, but on links without a shared v2 receive buffer the already-freed add_llc pointer is subsequently passed to smc_llc_save_add_link_rkeys(), producing a slab-use-after-free. Affects kernels since 6.14 through the fix in 6.18.50 / 7.2.4 / 7.3-rc1; no public exploit identified at time of analysis and EPSS is low (0.20%), and the KASAN report shows it manifests as a kernel crash rather than a demonstrated code-execution primitive.
Use-after-free in the Linux kernel SMC (Shared Memory Communications) subsystem allows a low-privileged local attacker to trigger a race condition during connection teardown, resulting in memory corruption with potential for privilege escalation. The flaw exists in smc_conn_free() and smc_lgr_terminate_sched(): when a link group is unlinked before connection cleanup completes, the device can re-arm the receive tasklet after tasklet_kill() returns, causing the tasklet to dereference an already-freed send buffer on the DMB-nocopy path. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17%.
Out-of-bounds kernel memory read in the Linux kernel's IPv6 Segment Routing (SRv6/seg6) local processing allows a local unprivileged user to leak adjacent slab memory and potentially crash the host. After decap_and_validate() strips outer SRv6 headers for End.DX6/End.DT6 behaviors, the IPv6 control block (IP6CB) retains a stale nhoff from the outer packet, causing ip6_protocol_deliver_rcu() to read beyond the skb head on the inner packet (KASAN slab-out-of-bounds). There is no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a locally-reachable kernel bug rather than a mass-exploitable remote flaw.
Stack memory corruption in the Linux kernel's qnap-mcu MFD driver allows a local low-privileged user on QNAP hardware to corrupt kernel stack memory, potentially enabling privilege escalation. The driver's qnap_mcu_exec() publishes an on-stack receive buffer to the serdev receive path, which runs asynchronously; when a command times out and the function returns, reply->data still points at the deallocated stack frame. A late MCU reply or unsolicited MCU message then overwrites whatever occupies that stack memory next, yielding C:H/I:H/A:H impact. No public exploit exists and EPSS is 0.20% (10th percentile), consistent with a kernel driver bug requiring physical or local QNAP hardware access.
Out-of-bounds read and write in the Linux kernel's dm-pcache (device mapper persistent cache) module allow a local attacker with CAP_SYS_ADMIN to corrupt kernel memory by loading a device mapper table backed by a crafted cache device containing malformed geometry metadata. The root cause is that cache_segs_init() and get_seg_id() consume on-disk cache_info fields - specifically n_segs and per-segment next_seg link IDs - without range validation before indexing into kernel-allocated arrays, and the only integrity protection on this metadata is a CRC computed with a fixed, public seed that offers no adversarial resistance. No public exploit or active exploitation has been identified; EPSS is 0.20% at the 10th percentile, consistent with the constrained attack prerequisites.
Out-of-bounds memory reads in the Linux kernel dm-pcache device-mapper subsystem allow a CAP_SYS_ADMIN-privileged local attacker to disclose adjacent persistent memory contents to userspace and corrupt the cache replay tree, with potential for kernel panic. Two input-validation gaps exist: kset key_num is not bounded against PCACHE_KSET_KEYS_MAX before buffer iteration, and per-key intra-segment offset+length pairs are accepted verbatim, allowing crafted on-media cache device images to trigger OOB reads that surface into caller bio buffers. No public exploit exists and EPSS sits at 0.20% (10th percentile), consistent with the elevated privilege requirement gating this attack surface.
Out-of-bounds memory access in the Linux kernel's dm-pcache (device-mapper persistent cache) subsystem allows a local privileged attacker to read past segment data boundaries. The `cache_pos_decode()` function loads `key_tail` and `dirty_tail` segment offsets (`seg_off`) directly from the cache device without validating them against the segment's `data_size`, so a crafted cache device with an oversized `seg_off` causes the kernel to address memory beyond the segment buffer. Exploitation requires CAP_SYS_ADMIN to supply the device. No public exploit or CISA KEV listing exists; EPSS is low at 0.17%.
Out-of-bounds read in the Linux kernel dm-pcache subsystem allows a local low-privileged user to read past segment data boundaries into adjacent control areas, exposing sensitive kernel memory and potentially crashing the kernel. Specifically, cache_replay(), the writeback worker, and the GC worker all miscalculate the tail-kset read length using PCACHE_SEG_SIZE minus the segment offset rather than the actual data-region remainder via cache_seg_remain(). This affects Linux 6.18.x (before 6.18.50), 7.2.x (before 7.2.4), and pre-release 7.3-rc1. No public exploit or active exploitation has been identified; EPSS is 0.17% (6th percentile).
Use-after-free and invalid segment operations in the Linux kernel's dm-pcache subsystem allow a local low-privileged attacker to corrupt kernel memory, potentially achieving privilege escalation. The flaw exists in kset_replay() where cache_key_put(key) frees key memory, yet the subsequent code dereferences key->cache_pos.cache_seg - a classic UAF pattern in kernel mempool-managed memory. No public exploit code has been identified and EPSS is 0.20%, though the local CVSS 7.8 (C:H/I:H/A:H) vector reflects the severity of kernel-level memory corruption.
Unlocked dereference of dev->desc in the Linux kernel's i3c subsystem exposes systems with i3c-capable hardware to potential use-after-free or null pointer dereference conditions when a local low-privileged user races device descriptor teardown against calls to i3c_device_get_supported_xfer_mode(). The function accesses dev->desc to resolve the master controller without holding the required bus->lock, meaning a concurrent device detachment can free or null that pointer mid-access, leading to kernel memory corruption with CVSS-assessed C:H/I:H/A:H impact. No public exploit code or active exploitation (KEV) has been identified at time of analysis; vendor-supplied patch commits are available for stable kernel branches.
Use-before-initialization race condition in the ADI I3C master driver of the Linux kernel allows a hardware interrupt to acquire an uninitialized spinlock during device probe. Specifically, adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR before the transfer queue lock and IBI state are initialized, so an early CMDR interrupt can invoke adi_i3c_master_irq() and attempt to take master->xferqueue.lock against an uninitialized dynamic key. No public exploit has been identified and EPSS is 0.20%, but the fix is confirmed in stable trees 6.18.50 and 7.2.4.
Stack information disclosure and use-after-free in the Linux kernel i3c master driver allow a local, low-privileged user to leak kernel stack contents through the sysfs modalias interface during device unregistration. The defect exists from kernel 5.0 onward through 6.12.108, 6.18.49, and 7.2.3: i3cdev->dev->desc is zeroed before device_unregister() completes, so racing calls to i3c_device_uevent() and modalias_show() read a NULL descriptor and fall back to an uninitialized stack struct i3c_device_info, exposing raw kernel stack bytes in the generated uevent string. No public exploit code has been identified at time of analysis; patches are available in stable releases 6.12.109, 6.18.50, 7.2.4, and the 7.3-rc1 mainline tree.
Use-after-free in the Renesas I3C driver allows a local attacker with low privileges to crash the kernel or potentially escalate privileges on systems equipped with Renesas I3C hardware. The flaw stems from a race between a timed-out transfer cleanup path, which frees the transfer struct, and a late-arriving interrupt whose handler dereferences that now-freed memory. No public exploit has been identified, and exploitation requires specific hardware, but the UAF primitive theoretically supports memory corruption beyond a simple crash.
Use-after-free in the rtl8xxxu WiFi driver allows a local authenticated attacker to corrupt kernel memory during device teardown. The flaw exists in two races within the rx_urb_wq work queue shutdown path: schedule_work() is called outside the shutdown lock, and the worker can submit URBs after usb_kill_anchored_urbs() has returned, both permitting the worker to dereference the freed priv structure after ieee80211_free_hw() releases it. Exploitation requires specific hardware (Realtek RTL8XXXU USB WiFi adapter), active RX traffic, and a concurrent disconnect event. No public exploit exists; this was discovered by static analysis with an EPSS of 0.20%.
Out-of-bounds array indexing in the Linux kernel's rtl8192du Wi-Fi driver allows network-adjacent unauthenticated attackers to trigger kernel memory corruption or a crash. The driver's `rtl92du_tx_fill_desc()` function passes a raw 802.11 QoS TID value (range 0-15) as an index into `sta_entry->tids[]`, which is only allocated with MAX_TID_COUNT=9 entries; TID values 9-15 index past the array boundary. UBSAN confirms index-10 access on `rtl_tid_data [9]`. No public exploit exists and EPSS is 0.17%, indicating low real-world exploitation pressure at time of analysis.
The mt7925 WiFi driver (mt76 subsystem) in the Linux kernel fails to cancel a deferred work item on the device stop path, creating a 5-second race window during multi-link operation (MLO) power-save setup. If the mt7925 PCIe or USB device is torn down within that window, the surviving timer fires against a workqueue that has already been destroyed, triggering a kernel WARNING and potential crash. No public exploit has been identified; EPSS is 0.17% (6th percentile), and the bug requires local access to hardware running an affected kernel with MLO power-save active.
Out-of-bounds memory read in the Linux kernel mt76/mt7996 Wi-Fi driver allows a local attacker with ability to supply a truncated EEPROM firmware file to trigger kernel memory disclosure or crash during driver initialization. The driver unconditionally copies and validates the default EEPROM firmware without first checking its length against the expected MT7996_EEPROM_SIZE constant, so a file shorter than that threshold causes reads past the end of the allocated firmware buffer. No public exploit has been identified at time of analysis; EPSS sits at 0.17% (6th percentile), reflecting the hardware-gated, local-access constraint.
Out-of-bounds kernel heap write in the Linux kernel's DS28E17 1-Wire-to-I2C bridge driver allows a local attacker controlling a malicious I2C slave device to write up to 222 bytes past a 34-byte kernel buffer. The driver's w1_f19_i2c_read() unconditionally trusts a device-supplied length byte (0-255) on I2C_M_RECV_LEN transactions, but the caller buffer is only I2C_SMBUS_BLOCK_MAX + 2 bytes; the SMBus core's own BLOCK_MAX check runs only after the overwrite has already occurred. No public exploit has been identified at time of analysis; EPSS sits at 0.17%, reflecting the niche hardware prerequisite.
Improper sysctl table placement in the Linux kernel allows a local low-privileged user to modify the global `cad_pid` setting - which controls which process receives the Ctrl-Alt-Delete console signal - by abusing unprivileged user and PID namespace creation. A non-root user can call `unshare(CLONE_NEWUSER|CLONE_NEWPID)` to gain apparent root privileges in a child namespace and then overwrite the globally-scoped `/proc/sys/kernel/cad_pid`, even though `kill_cad_pid()` operates exclusively in the root namespace. No public exploit is identified at time of analysis; EPSS stands at 0.20% (10th percentile), and no CISA KEV listing exists.
Use-after-free in the Linux kernel's Smack LSM `smack_file_send_sigiotask()` function allows a local attacker with low privileges to trigger kernel memory corruption by racing credential pointer changes on a non-current task. The function incorrectly accessed both `tsk->cred` (subjective credentials, unprotected) and `__task_cred(tsk)` (objective credentials) on the same task; because a task may change its own `->cred` pointer at any time without synchronization, the first access can race with a credential transition, yielding a freed `struct cred` deref. The author confirmed KASAN-reported UAF reproduction and verified the fix. No public exploit exists and EPSS is low at 0.17%, but the CVSS-assessed local impact (C:H/I:H/A:H) reflects the potential for privilege escalation on affected kernels.
Denial of service in Apache OpenNLP 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5 lets a remote unauthenticated attacker pin CPU or crash a worker thread by feeding crafted text to either of the two built-in RegexNameFinder patterns (EMAIL and URL) obtained via RegexNameFinderFactory.getDefaultRegexNameFinders(). The EMAIL pattern's ambiguous nested quantifiers cause quadratic catastrophic backtracking (~32 KB of local-part characters burns seconds of CPU per find() call), while the URL pattern's nested capturing repetition recurses once per query token, exhausting the thread stack and throwing StackOverflowError (~4 KB, or ~1 KB on -Xss512k worker threads). No public exploit was identified at time of analysis; this is availability-only with no code execution or data exposure.
SymSpellModelSerializer in Apache OpenNLP 3.0.0-M4 and 3.0.0-M5 crashes the host JVM with an OutOfMemoryError when deserializing a crafted SymSpell binary model file whose unigramCount or bigramCount field is set to Integer.MAX_VALUE, forcing a 4-8 GB heap allocation attempt. The root cause (CWE-789: Uncontrolled Memory Allocation) is that these two 32-bit count fields are validated only for non-negativity - no upper bound prevents attacker-controlled pre-sizing of a LinkedHashMap before any dictionary entries are consumed. The attack payload is described by the advisory as under 100 bytes, requires no prior authentication if the target application accepts externally supplied model bytes, and is effective against every deserialization code path in the opennlp-spellcheck extension. No public exploit has been identified at time of analysis, and exposure is substantially limited to the small population running pre-release milestone builds.
Process termination via unrecovered panic in AWS SDK for Go v2's EventStream header decoder allows a remote actor to crash any Go application consuming AWS streaming service responses. Sending a crafted EventStream response frame containing a header value type byte outside the valid range triggers an unhandled Go panic that propagates to terminate the host process. The affected surface includes Bedrock inference and agent runtime packages, making AI/ML workloads on AWS a particularly relevant target; no public exploit or active exploitation has been confirmed.
Uncontrolled resource consumption in jackson-databind's CoreXMLDeserializers allows unauthenticated remote attackers to trigger multi-minute CPU saturation via a single oversized HTTP request. When jackson-databind deserializes a JSON string into a javax.xml.datatype.Duration or XMLGregorianCalendar field, it passes the raw string directly to JDK's DatatypeFactory, which internally calls BigInteger(String) and BigDecimal(String) constructors that exhibit O(n²) time complexity relative to digit count. Because the malicious digits are embedded in a JSON string token rather than a JSON number token, jackson-core's existing StreamReadConstraints.maxNumberLength guard is bypassed entirely. A few megabytes of input containing millions of digits can consume tens of seconds to minutes of CPU, and a handful of concurrent such requests can exhaust a server's worker thread pool. No public exploit or CISA KEV listing has been identified at time of analysis.
Arbitrary code execution in Mistral Vibe (mistralai:mistral-vibe) lets an attacker defeat the agent's command-approval allowlist by prefixing an allowlisted command with shell environment-variable assignments (e.g. FOO=bar allowedcmd). The permission checker inspects only the command token and skips the leading assignments, so attacker-controlled variables such as LD_PRELOAD or PATH execute arbitrary code without user approval. Reported by HiddenLayer; no public exploit identified at time of analysis and not listed in CISA KEV.
Arbitrary file write in Mistral Vibe (the AI coding agent), introduced in version 1.3.4, lets an attacker create or overwrite files anywhere the Vibe process can reach - without triggering the tool's user-approval gate. The root cause is that shell redirection targets (e.g. '>' and '>>') are stripped from permission evaluation, so an otherwise allowlisted command can silently redirect its output to paths outside the active workspace. Reported by HiddenLayer; publicly detailed in their security advisory, with no public exploit code identified at time of analysis and no CISA KEV listing.
Heap out-of-bounds write in Orthanc DICOM Server allows a low-privileged network attacker to corrupt memory by supplying a malformed PNG image, potentially enabling remote code execution or denial-of-service against medical imaging infrastructure. The root cause is a CWE-190 integer overflow in pitch and buffer-size computation during PNG decoding, reported by CISA ICS-CERT under medical advisory ICSMA-26-253-02. No public exploit code has been identified at this time, but the nature of the flaw (heap corruption via attacker-controlled image data) makes it a credible RCE candidate in clinical environments.
Remote code execution in SGLang AI inference servers allows unauthenticated attackers to run arbitrary code through the /update_weights_from_tensor endpoint when no authentication keys are configured. The SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr remain resolvable, enabling malicious pickle REDUCE instructions to execute attacker-supplied code. EPSS is 0.21% and no CISA KEV or public exploit is identified, but CVSS rates the flaw critical.
Memory exhaustion DoS in the expressjs/compression Node.js middleware (versions before 1.8.2) allows remote unauthenticated attackers to crash any Express server using the package. When a client aborts an HTTP connection while a compressed response is in flight, the zlib transform stream allocated for that response is never destroyed, permanently leaking its native heap memory. An attacker can automate rapid request-then-abort cycles to exhaust all available server memory, causing process termination. The issue is fixed in 1.8.2 per the OpenJS Foundation advisory; no public exploit code or KEV listing has been identified at time of analysis.
Arbitrary file disclosure in the Hugo static site generator (versions after v0.123.0 and before v0.165.0) lets an attacker read files outside the intended project boundary by planting a symlink in a mounted directory. Because parent-directory symlinks were not dropped during direct resource lookups, functions like resources.Get and os.ReadFile follow the symlink and embed the target file's contents into the built site. Reported by VulnCheck; no public exploit identified at time of analysis, and this is an incomplete-fix follow-up to two prior advisories (GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw).
Memory exhaustion in multiparty Node.js library (versions 2.1.0 through <4.3.1) allows any unauthenticated network attacker to crash the host process with a single crafted HTTP request. The parser accumulates multipart part headers into an unbounded in-memory buffer with no size cap, consuming available process memory until the Node.js server is killed. The vulnerability carries no confidentiality or integrity impact - this is a pure availability issue addressed in multiparty 4.3.1, which enforces a maximum on the bytes buffered per part header block.
An incorrect free in the PCRE2 JIT fast path (all versions before 10.48) can corrupt process memory when an application reuses a single match data block across a pcre2_match call made with the PCRE2_COPY_MATCHED_SUBJECT option and a subsequent pcre2_jit_match call against a JIT-compiled pattern, yielding high confidentiality, integrity, and availability impact on the host process. Exploitation requires local access with low privileges and depends on a specific, uncommon API sequence inside the PCRE2-consuming application rather than on attacker-controlled input, which sharply narrows realistic exposure; the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, CISA SSVC rates exploitation as none and automatable as no, no public exploit was identified at time of analysis, and EPSS is 0.11% (1st percentile). A vendor fix exists in PCRE2 10.48 (upstream PR #937), so the residual risk is low despite the total technical impact rating.
An out-of-bounds heap write in PCRE2's pcre2_convert() pattern-conversion API affects releases before 10.48, but only on 32-bit builds where size_t is 32 bits - 64-bit systems are unaffected. Exploitation is remote and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H, base 7.4), yet it is sharply constrained: the consuming application must actually invoke the comparatively rarely-used convert entry point and pass it a large, attacker-supplied pattern, which is why AC:H applies and the SSVC assessment rates automatic exploitation as not feasible. Publicly available exploit code exists per the SSVC exploitation signal (POC), although there is no confirmed actively exploited (CISA KEV) status; EPSS is low at 0.10% (1st percentile), reflecting the narrow 32-bit-plus-convert-API precondition. Impact is high integrity and availability with no confidentiality loss, consistent with memory corruption via integer overflow leading to under-allocation.
Out-of-bounds read in zstd-jni versions 1.5.5-6 through 1.5.7-13 exposes JVM-based applications to memory disclosure or process crashes when processing attacker-controlled Zstd-compressed data. The `Zstd.getFrameContentSize` method and `ZstdInputStreamNoFinalizer` both fail to reject negative `srcPosition` and `len` arguments before marshalling them into the native Zstd frame-header parser, allowing a negative value to bypass Java-side bounds checks and trigger out-of-bounds reads in the underlying C layer. No public exploit code or CISA KEV listing has been identified; the vendor-released fix is version 1.5.7-14.
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who supplies a crafted .traineddata language file to corrupt heap memory during legacy OCR classifier initialization, with potential for controlled code execution. The flaw is in ReadIntTemplates in src/classify/intproto.cpp, which reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP file component and uses them directly as loop bounds - storing heap pointers into fixed-capacity struct arrays without validating against compile-time maximums. No patched release exists as of this review, though a fix commit is present in the repository; no public exploit has been identified.
Heap corruption in Tesseract OCR 5.5.3 and earlier allows an attacker who can supply a malicious unicharset file to corrupt application heap memory during OCR engine initialization, potentially leading to a crash or controlled code execution. The root cause is that UNICHARSET::load_via_fgets treats the declared character count as a trusted loop bound and uses the incrementing id variable as a direct unichars vector index, while unichar_insert_backwards_compatible silently performs no-op insertions for duplicate or empty representations - causing id to exceed unichars.size() and subsequent set_* writes to access memory beyond the vector. No patched release is available as of this review; only an upstream source commit fix exists.
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who controls the loaded .traineddata model file to corrupt heap memory, crash the process, or potentially achieve code execution. The root cause is in GenericVector::read (src/ccutil/genericvector.h): the serialized `reserved` field allocates the backing buffer while the independent `size_used_` field drives the callback write loop, with no invariant check enforcing size_used_ ≤ reserved. A crafted TESSDATA_INTTEMP component with version_id ≥ 4 exploits this by setting reserved small and size_used_ large, triggering the write overrun through fontinfo_table_.read during legacy classifier initialization. No public exploit and no CISA KEV entry exist at time of analysis; an upstream commit fix exists but no patched release has been published.
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who controls a crafted `.traineddata` model file to corrupt heap memory during LSTM inference, leading to a crash or potentially controlled code execution. The root cause is an inconsistency between `source_` (sized from deserialized `na_`) and the write count used by `WriteTimeStepPart` and `AddTimeStepPart` (driven by `ns_` from the CI gate WeightMatrix dim1), leaving two functions unbounded after prior hardening patched sibling routines. No fixed release is available at time of analysis; an upstream fix exists only as a commit. No public exploit identified at time of analysis.
Heap out-of-bounds write and read in Tesseract OCR Engine 5.5.3 and earlier allows an attacker who can supply a crafted `.traineddata` model file to corrupt heap memory during LSTM inference, potentially achieving information disclosure, a crash, or controlled heap corruption leading to code execution. The flaw lies in `FullyConnected::DeSerialize`, which loads layer dimension scalars `ni_` and `no_` without cross-validating them against the actual weight matrix dimensions; when `Forward` is subsequently called, `MatrixDotVector` writes into a scratch buffer sized by `no_` but indexed by the actual matrix row count, and reads from a buffer sized by `ni_` but indexed by column count minus one. No fixed release has been issued as of this analysis; an upstream fix commit exists on GitHub.
Stack-based buffer overflow in Tesseract OCR 5.5.3 and earlier corrupts the stack during legacy engine initialization, enabling denial of service and potential control-flow hijacking when a crafted `.traineddata` file is processed. The flaw originates in `Classify::ReadNormProtos` (normmatch.cpp), where unbounded `std::istream::operator>>(char*)` extraction into a fixed 61-byte stack buffer allows a 99-character NORMPROTO token to overwrite up to 39 bytes beyond the buffer boundary during `TessBaseAPI::Init`. No fixed release is available at time of analysis; an upstream fix commit exists but has not been tagged as a release, and no public exploit has been identified at time of analysis.
Memory exhaustion in rclone 1.75.0's serve S3 multipart upload handler allows remote attackers to exhaust process or host memory and permanently block request handlers by sending UploadPart requests that declare a large Content-Length but deliver no body bytes. The handler in cmd/serve/s3/multipart.go pre-allocates lib/pool pages sized to the attacker-controlled Content-Length header before any body bytes arrive, and the waitForTurn scheduling mechanism admits one additional oversized part even when --multipart-streaming-buffer-limit is active, partially bypassing the intended cap. The issue is fixed in rclone v1.75.1; no public exploit or CISA KEV listing has been identified.
Authentication/authorization bypass in rclone's dynamic serve interface (versions 1.70.0 through 1.75.0) lets remote attackers reach a fixed filesystem instead of the per-request backend the operator intended. When an FTP or S3 server is spun up via the serve/start RC (remote control) API with a per-server proxyOpt.AuthProxy, the FTP and S3 constructors mistakenly consult the empty process-global proxy.Opt.AuthProxy, so the request-local auth proxy is silently ignored: FTP accepts anonymous logins with any password against the fixed VFS, and S3 with AuthKey serves the fixed RC fs rather than the proxy-selected backend. There is no public exploit identified at time of analysis, and this is not in CISA KEV. Fixed in 1.75.1.
Authentication bypass in rclone's S3 server mode (rclone serve s3) allows any unauthenticated network attacker to impersonate arbitrary S3 access keys. When rclone serve s3 is started with --auth-proxy but without --auth-key, authPairMiddleware registers whatever accessKeyID the client chooses against an empty s3Secret, and gofakes3 then validates the request's SigV4 signature against that same empty secret - so an attacker can pick any access key, sign with an empty secret, and reach whatever backend the auth-proxy script resolves for that identity. Fixed in rclone 1.75.1; no public exploit identified at time of analysis, though the vendor security advisory (GHSA-xwwr-4h3p-r22c) and fix commit are public.
Cross-session credential isolation failure in rclone's FTP auth-proxy driver (versions 1.64.0-1.75.0) allows an authenticated network attacker to hijack a victim user's cloud storage backend by exploiting a server-wide, username-keyed credential map. When an attacker holds an open FTP session using a shared username and a victim subsequently authenticates with the same username, the victim's credential silently overwrites the server-wide map entry - causing the attacker's subsequent VFS operations to execute against the victim's backend, enabling reads, writes, renames, and deletions of the victim's cloud objects. No public exploit identified at time of analysis; vendor-released patch v1.75.1 resolves the issue.
Symlink escape in rclone's local backend (prior to v1.75.1) allows an attacker who controls sync source contents to apply metadata - ownership, permissions, or timestamps - to files and directories outside the intended destination root. When `--links` is enabled, a crafted `.rclonelink` entry plants a symlink in the destination; subsequent metadata routines (`MkdirMetadata`, `writeMetadataToFile`, `setTimes`) incorrectly skip the symlink guard and call `os.Chown`, `os.Chmod`, `os.Chtimes`, and birth-time syscalls through the planted link, bypassing `os.Root` confinement. Vendor-released patch is confirmed in v1.75.1; no active exploitation has been identified at time of analysis.
HTTP/1 request-target parsing in Traefik prior to 2.11.57 and 3.7.13 allows unauthenticated remote attackers to send a rootless URL target (e.g., `http:example.com/admin`) that Go's HTTP library stores in URL.Opaque rather than URL.Path, leaving URL.Path empty. Traefik's routing engine, forwardAuth middleware, and access logger all evaluate against the normalized empty path (treated as `/`), while URL.RequestURI() gives URL.Opaque precedence when forwarding — meaning the backend receives the original opaque target verbatim. The practical consequence is cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion, all requiring no authentication or special client configuration. No public exploit has been identified at time of analysis, though the patch PR includes test cases demonstrating the attack technique in full detail.
Security middleware bypass in Traefik reverse proxy versions 2.11.26-2.11.56 and 3.4.2-3.7.12 allows unauthenticated network attackers to reach protected backend routes by exploiting h2c protocol upgrade tunneling. When a crafted HTTP/1.1 request carrying Connection, Upgrade: h2c, and HTTP2-Settings headers causes a h2c-capable backend to respond with 101 Switching Protocols, Traefik enters a raw TCP tunnel that silently disables every configured middleware layer-including BasicAuth, ForwardAuth, IPAllowList, RateLimit, and all access logging, metrics, and tracing hooks-for the lifetime of that connection. All subsequent HTTP/2 frames in the tunnel reach protected backend paths without any Traefik security enforcement. No public exploit code has been identified at time of analysis; vendor-released fixes are available in v2.11.57 and v3.7.13.