Suse
Monthly
Timing side-channel in Net::OAuth before 0.33 for Perl allows remote unauthenticated attackers to recover valid signatures byte-by-byte by measuring server response latency during signature rejection. For HMAC-SHA1 and HMAC-SHA256 methods the oracle yields a forged HMAC token; under the PLAINTEXT signature method the comparison is performed directly against the signature key, meaning the timing oracle exposes the raw consumer_secret and token_secret. No public exploit has been identified at time of analysis and EPSS is 0.17% (6th percentile), but the PLAINTEXT credential-exposure path is theoretically severe for any deployment relying on that method.
Signature-verification bypass in the Net::OAuth Perl module before 0.33 lets a remote attacker forge valid OAuth requests for any consumer key and token by dictating which algorithm the Service Provider uses to check their signature. Because verify() resolves the signature-method class from the attacker-supplied signature_method parameter and offers no way to pin an expected method, a provider deployed on RSA-SHA1 (which holds only the consumer's public key) can be tricked into validating an HMAC-SHA1 signature against a placeholder/guessable consumer_secret. No public exploit has been identified at time of analysis and EPSS is low (0.11%), but the flaw is unauthenticated and network-reachable (CVSS 9.8).
Type confusion in V8, Chrome's JavaScript engine, enables remote code execution within the browser sandbox against users running Chrome prior to 151.0.7922.169. An unauthenticated remote attacker can trigger the vulnerability by luring a victim to a crafted HTML page, making this a drive-by exploitation scenario requiring only a single user interaction. Google has released a patch in stable channel version 151.0.7922.169; no public exploit or CISA KEV listing has been identified at time of analysis, though SSVC rates the technical impact as total.
Sandbox escape via heap-based buffer overflow in ANGLE's graphics engine on Chrome for Android allows a threat actor who has already achieved renderer process compromise to execute arbitrary code entirely outside the Chrome sandbox. All Chrome for Android versions prior to 151.0.7922.169 are affected; the vulnerability requires a two-stage exploit chain combining a separate renderer compromise with this ANGLE flaw. Google has released a patched build (151.0.7922.169); no public exploit code or CISA KEV listing has been identified at time of analysis, though the two-stage nature indicates likely use in sophisticated targeted attack chains.
Use-after-free in Google Chrome's WebGL subsystem allows remote code execution inside the browser sandbox for all Chrome versions prior to 151.0.7922.169. An attacker can achieve arbitrary code execution within the Chrome renderer by delivering a crafted HTML page to a victim, requiring only a single page visit. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CVSS 8.8 with low attack complexity reflects meaningful real-world risk for any unpatched Chrome deployment.
Sandbox escape via race condition in Google Chrome's USB subsystem (all versions prior to 151.0.7922.169) enables arbitrary code execution on the host system when chained with a renderer process compromise. This is a second-stage exploit: an attacker must already have code execution within Chrome's sandboxed renderer before the USB TOCTOU race can be leveraged to cross the sandbox boundary, triggered through a crafted HTML page. No public exploit code or CISA KEV listing has been identified at time of analysis, though the scope-changed CVSS rating of 8.3 (S:C, C:H/I:H/A:H) underscores that a successful chain achieves full host-level compromise.
Remote code execution within the Chrome renderer sandbox is achievable against all Chrome versions prior to 151.0.7922.169 by delivering a crafted HTML page to a victim user. The root cause is an incorrect arithmetic or numeric calculation in V8, Chrome's JavaScript engine, which can be triggered purely through JavaScript execution in a standard browsing session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS score of 8.8 and the universality of Chrome's user base make this a high-priority patching candidate.
Use-after-free in the Browser component of Google Chrome on macOS prior to 151.0.7922.169 enables remote attackers to execute arbitrary code outside the sandbox. Exploitation requires social engineering to induce a user to visit a crafted HTML page, placing this in the user-interaction-required category. No public exploit code or CISA KEV listing has been identified at time of analysis, but the sandbox escape impact elevates real-world severity significantly.
Type confusion in V8, Chrome's JavaScript engine, enables arbitrary code execution inside the Chrome renderer sandbox on any platform (Windows, macOS, Linux) when a user visits an attacker-controlled HTML page. All Chrome releases prior to 151.0.7922.169 are affected; Google has released the patched stable-channel build. No public exploit code or active exploitation has been identified at time of analysis, though the SSVC framework rates technical impact as total within the sandbox boundary.
Sandbox escape via link following in Google Chrome's CredentialProvider component on Windows allows a local attacker to execute arbitrary code outside the browser's security sandbox, affecting all Chrome versions prior to 151.0.7922.169. The vulnerability stems from improper symbolic link or junction resolution (CWE-59) in the CredentialProvider, a Windows-specific subsystem handling credential operations, enabling a local attacker to redirect file access operations to attacker-controlled paths. No public exploit code has been identified and CISA's SSVC assessment confirms no known exploitation; however, the full CIA triad impact and sandbox escape potential make this a meaningful local privilege boundary violation.
Remote code execution in Google Chrome for Android before 151.0.7922.169 stems from a heap buffer overflow in Dawn, Chromium's WebGPU implementation, and is notable because Google explicitly states it allows code execution OUTSIDE the renderer sandbox. A remote attacker who lures a victim to a crafted HTML page can achieve full compromise of the browser process context on the device. Rated Critical by Chromium with CVSS 9.6; a vendor patch is available, and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Google Chrome's WebGL implementation (all versions prior to 151.0.7922.169) enables a remote attacker to execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. The sandbox escape elevates the impact from renderer-level code execution to potential full OS-level compromise. No public exploit code or active exploitation has been identified at the time of analysis, but the SSVC technical impact rating is 'total,' reflecting the severity of successful exploitation.
Remote denial-of-service in Oracle Java SE's 2D component allows unauthenticated network attackers to hang or crash the JVM across versions 25.0.4 and 26.0.2 via multiple protocols. The attack surface spans both server-side Java deployments exposing 2D-related APIs through web services and client-side environments running sandboxed Java Web Start applications or applets processing untrusted code. Oracle characterizes this as easily exploitable with no public exploit identified at time of analysis; no KEV listing is present.
Tar extraction path traversal in moby/go-archive allows an attacker who controls archive contents to create or overwrite files outside the intended destination directory, undermining container-to-host filesystem boundaries. The affected functions - Unpack, UnpackLayer, Untar, UntarUncompressed, and ApplyLayer - perform lexical path validation but rely on OS-level resolution at operation time, meaning symlinks introduced inside the archive redirect writes to arbitrary paths writable by the extracting process. This flaw propagates through the full Docker ecosystem including Docker Engine, Docker Desktop, Docker CLI, Docker Compose, and Docker Sandboxes; vendor-released patches are available and no public exploit code has been identified at time of analysis.
Access-control mitigation bypass in the Firefox Add-ons Manager component allows attackers to circumvent a security protection that Mozilla had previously put in place around add-on handling, affecting Firefox before 154 and Firefox ESR before 153.1. Mozilla assigned this a 9.8 CVSS score with a fully remote, unauthenticated, no-user-interaction vector, though the terse advisory text does not detail the exact protection defeated. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Information disclosure via a side-channel in Mozilla Firefox's Web Audio component allows remote, unauthenticated attackers to infer sensitive data that should be isolated between origins by measuring observable timing or behavioral discrepancies. The flaw affects Firefox before 154 and Firefox ESR before 153.1 and is fixed in those releases; no public exploit has been identified and EPSS is low (0.14%, 4th percentile), indicating no evidence of active exploitation.
Information disclosure via the WebRTC component in Mozilla Firefox allows network-accessible attackers to exfiltrate sensitive browser data due to improper restriction of rendered UI layers (CWE-1021). All Firefox releases prior to version 154 and all Firefox ESR releases prior to version 153.1 are affected across all platforms listed under CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. The CVSS base score is 7.5 with high confidentiality impact; SSVC confirms automatable exploitation, though no active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Same-origin policy enforcement in Firefox's DOM Service Workers component can be bypassed, allowing a malicious web page to access resources, responses, or cached content belonging to another origin. The flaw affects Firefox before version 154 and Firefox ESR before 153.1, and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the network, no-authentication, no-interaction vector makes it attractive for drive-by attacks.
Privilege escalation in Firefox's Request Handling component exposes all versions prior to 154 (and ESR prior to 153.1) to high-impact compromise of confidentiality, integrity, and availability. The flaw carries a CVSS 8.8 score with a network attack vector and no privilege prerequisite, meaning a remote attacker can trigger it by inducing a user to interact with attacker-controlled content. SSVC assessment confirms no active exploitation at time of analysis and rates technical impact as total, while fix versions are confirmed via two Mozilla security advisories.
Side-channel information disclosure in Firefox's Storage: Cache API (CWE-203) allows remote unauthenticated attackers to infer sensitive cached data through observable timing discrepancies between cache hits and misses. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected per Mozilla advisories mfsa2026-74 through mfsa2026-80. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact rating and broad Firefox deployment footprint make patching a near-term priority.
Privilege escalation in Mozilla Firefox's Downloads API component exposes users on any version prior to Firefox 154 or Firefox ESR 153.1 to high-impact compromise across confidentiality, integrity, and availability. Classified under CWE-269 (Improper Privilege Management), the flaw enables an unauthenticated remote attacker to escalate privileges when a user interacts with a crafted download trigger, requiring no prior foothold on the target system. No public exploit has been identified at time of analysis, but Firefox's ubiquitous deployment and the low attack complexity make this a high-priority patch for any organization.
Privilege escalation via invalid pointer dereference in Mozilla Firefox's Graphics component allows a remote attacker to gain elevated privileges within the browser context. Affected versions are all Firefox releases prior to 154 and all Firefox ESR releases prior to 153.1, with patches confirmed in Mozilla advisories mfsa2026-74 and mfsa2026-77. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation status as none with the attack not automatable, though technical impact is assessed as total.
Protection-mechanism bypass in the Firefox JavaScript engine's garbage collector (JavaScript: GC) undermines a built-in exploit mitigation, weakening a defense that normally hinders memory-corruption exploitation. The flaw affects Mozilla Firefox and Firefox ESR and was addressed by the vendor in Firefox 154 and Firefox ESR 153.1. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported internally by Mozilla.
Use-after-free in Mozilla Firefox's JavaScript garbage collector (GC) component enables remote code execution when a victim visits a malicious webpage. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected across multiple product lines, as indicated by four separate Mozilla Security Advisories (MFSA2026-74, -77, -78, -80). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the high CVSS score of 8.8 with full C/I/A impact and low attack complexity demands prompt patching.
Protection mechanism failure in Firefox's Data Loss Prevention (DLP) component allows remote attackers, with user interaction, to bypass DLP controls, resulting in high confidentiality and integrity impact. Affected versions span the standard Firefox release channel (prior to 154) and both active ESR branches (ESR 140.x prior to 140.14, ESR 153.x prior to 153.1). No public exploit exists and EPSS sits at 0.17% (7th percentile), indicating low observed exploitation probability despite the high CVSS score - no active exploitation is confirmed via CISA KEV.
Use-after-free memory corruption in Firefox's Layout: Text and Fonts component allows a remote unauthenticated attacker to achieve high-confidence confidentiality, integrity, and availability impact by luring a user to visit a malicious web page. The vulnerability spans the main Firefox release channel and all three active ESR branches (115.x, 140.x, 153.x), indicating broad exposure across enterprise and consumer deployments. No public exploit or active exploitation has been identified at time of analysis, but the network-accessible, low-complexity nature of this flaw and the breadth of MFSA advisories (mfsa2026-74 through mfsa2026-80) signal a high-priority patching target.
Privilege escalation via the Shell Integration component in Mozilla Firefox allows a remote unauthenticated attacker - with user interaction - to achieve full compromise of confidentiality, integrity, and availability on affected systems. Affected are all Firefox releases prior to 154 and ESR branches prior to 140.14 and 153.1, as confirmed by Mozilla advisories mfsa2026-74, mfsa2026-76, and mfsa2026-77. No public exploit or CISA KEV listing has been identified at time of analysis, and SSVC rates exploitation status as none.
Memory corruption in Mozilla Firefox's Graphics component stems from an integer overflow (CWE-190) that can be triggered when the browser processes malicious web content, potentially leading to remote code execution within the content process. The flaw affects Firefox before 154 and the ESR 140.x and 153.x branches, and Mozilla has shipped fixes across advisories MFSA2026-74 through MFSA2026-80. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Site isolation bypass in Mozilla Firefox's Networking: Cookies component allows remote, unauthenticated attackers to read and manipulate cookies across origins when a victim visits a malicious page, scoring CVSS 8.1 (High) due to high confidentiality and integrity impact. The flaw, rooted in CWE-346 (Origin Validation Error), undermines a core browser security boundary that separates per-site cookie access. Vendor-released patches are available in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1; no public exploit or CISA KEV listing is identified at time of analysis.
Privilege escalation in Firefox's Networking: Cookies component allows a remote, unauthenticated attacker to gain elevated privileges within the browser when a user visits a malicious page, yielding full confidentiality, integrity, and availability impact. All Firefox releases prior to 154 and both ESR branches prior to 140.14 and 153.1 are affected across all platforms. SSVC rates technical impact as total, but exploitation status is confirmed as none and the attack is not automatable due to the required user interaction; no public exploit or CISA KEV listing exists at time of analysis.
Privilege escalation via incorrect boundary conditions in Firefox's Graphics: CanvasWebGL component allows remote attackers to achieve high-impact code execution by luring users to a crafted web page. The flaw affects all Firefox releases prior to version 154 and multiple ESR branches (115.x, 140.x, 153.x), making the exposure broad across both consumer and enterprise deployments. No active exploitation has been confirmed (SSVC: Exploitation: none), but the CVSS 8.8 score and total technical impact classification warrant prompt patching.
Memory corruption via a use-after-free in Firefox's DOM: Core & HTML component allows a remote attacker to trigger dangling-pointer reuse in the browser engine, potentially leading to arbitrary code execution within the content process. All Firefox and Firefox ESR users on versions prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. No public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), consistent with a freshly patched browser bug with no observed weaponization.
Memory corruption via a use-after-free in Firefox's Graphics: ImageLib component allows a remote attacker to potentially execute code or disclose memory contents when a victim renders attacker-controlled image data. All Firefox channels are affected up to the fixed builds (Firefox 154 and ESR 115.39, 140.14, 153.1). No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), indicating no observed weaponization despite the high CVSS score.
Privilege escalation via the Remote Settings Client component affects Mozilla Firefox across all supported mainline and ESR release tracks, with Mozilla assigning the issue CVSS 8.8 High severity. The flaw (CWE-269, Improper Privilege Management) permits a network-based attacker to escalate privileges within the browser context when a user interacts with attacker-controlled content, achieving total confidentiality, integrity, and availability impact. No public exploit code exists and CISA has not listed this in KEV, but the simultaneous patching of three ESR branches alongside mainline signals that Mozilla assessed significant breadth of exposure across its install base.
Privilege escalation in Firefox's CanvasWebGL graphics component affects all Firefox releases prior to version 154 and both active ESR branches, enabling a remote attacker to gain full control over confidentiality, integrity, and availability within the browser process. The flaw stems from improper privilege management (CWE-269) in the WebGL canvas rendering pipeline, exploitable by luring a victim to a crafted web page - no authentication or special software is required beyond a standard Firefox installation. No public exploit code or active exploitation has been identified at time of analysis; however, Mozilla issued three simultaneous security advisories (MFSA2026-74/76/77) addressing all supported release tracks, signaling broad internal severity.
Memory corruption in Mozilla Firefox's Graphics: Text component (CWE-416 use-after-free) can be triggered by malicious web content, potentially leading to remote code execution or information disclosure in the browser process. All Firefox users on pre-fix builds are affected until updated to Firefox 154 or the corresponding ESR releases (115.39, 140.14, 153.1). There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 6th percentile).
Privilege escalation in Firefox's DOM Navigation component allows a remote unauthenticated attacker to achieve full confidentiality, integrity, and availability compromise within the browser process by inducing a user to visit a malicious webpage. All Firefox releases prior to version 154 and all active ESR branches (115.x, 140.x, 153.x) are affected, with Mozilla issuing four simultaneous MFSA advisories (mfsa2026-74 through mfsa2026-77) indicating broad impact across every supported release channel. No public exploit or KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a high-priority patch for all Firefox deployments.
Memory-corruption via a use-after-free in Firefox's JavaScript WebAssembly engine allows a remote attacker to corrupt heap memory and potentially achieve arbitrary code execution or information disclosure when a victim loads attacker-controlled content. All Firefox versions prior to Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1 are affected. There is no public exploit identified at time of analysis, KEV does not list it as actively exploited, and EPSS is low (0.16%), so this is a high-severity but not yet demonstrably-exploited flaw.
Privilege escalation in Firefox's DOM Networking component allows remote attackers who can lure a user to a malicious webpage to achieve high-impact compromise of confidentiality, integrity, and availability. The flaw, rooted in improper privilege management (CWE-269), affects all Firefox releases prior to version 154 and multiple ESR branches, and has been patched across four simultaneous Mozilla advisories (mfsa2026-74 through mfsa2026-77). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Memory corruption in the Linux kernel's NTFS filesystem driver stems from unchecked integer arithmetic when converting runlist element counts into byte sizes inside ntfs_rl_realloc() and ntfs_rl_realloc_nofail(). An attacker who can get a crafted NTFS volume mounted and parsed can overflow the size calculation and corrupt kernel heap memory, potentially escalating to code execution. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile).
Memory corruption in the Linux kernel's nzxt-smart2 hwmon driver exposes systems on non-coherent DMA architectures (ARM, MIPS) to deterministic kernel memory corruption whenever the NZXT Smart Device 2 USB hardware triggers a DMA-mapped output report. The driver's send_output_report() passes a misaligned buffer to hid_hw_output_report(), which hands it to usb_interrupt_msg() for DMA mapping; on non-coherent caches, cache line flush or invalidate operations corrupt adjacent kernel variables (mutex, update_interval) sharing the same cache line. No public exploit has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects low exploitation probability, and the bug is not listed in CISA KEV.
Out-of-bounds array access in the Linux kernel nct6775-core hardware monitoring driver allows a local low-privileged user on systems equipped with the nct6116 Super I/O chip to trigger reads beyond 3-element weight register arrays (up to index 4), with the resulting garbage values subsequently used as hardware I/O register addresses. This can cause invalid hardware register writes, hardware misconfiguration, or system crashes. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), making this a patch-priority rather than emergency-response item; exploitation is bounded by the hardware specificity of the nct6116 chip.
A double-free memory-corruption defect in the Linux kernel's rtase Realtek automotive Ethernet driver allows the same multi-fragment socket buffer to be freed twice when the transmit path hits a DMA mapping failure. It affects hosts running the rtase driver (Realtek multi-gigabit/automotive NICs) on kernel 6.12 and related stable trees, and can lead to kernel memory corruption and denial of service. No public exploit has been identified at time of analysis; EPSS is low (0.17%, 7th percentile) and the CVE is not on CISA KEV.
Use-after-free in the Linux kernel's Bluetooth HCI synchronization subsystem allows an adjacent-network attacker with low privileges to pass freed hci_conn pointers to hci_conn_valid(), where kmalloc may have reallocated that memory to unrelated objects. Affected Linux kernel versions across multiple stable branches expose systems with active Bluetooth to potential kernel memory corruption, yielding full confidentiality, integrity, and availability impact at the kernel level. No public exploit code has been identified and CISA KEV does not list this CVE; however, the HIGH CVSS score and kernel-level CIA:H/H/H impact justify prompt patching on any Bluetooth-enabled Linux host.
Use-after-free memory corruption in the Linux kernel's ksmbd SMB server subsystem exposes systems running the in-kernel file-sharing daemon to potential kernel-level compromise by an authenticated remote attacker. Affected are Linux kernel versions beginning at commit 8510a043d334ecdf83d4604782f288db6bf21d60 (ksmbd introduction) through multiple stable branches, with vendor-released patches confirmed in 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. No public exploit code has been identified and EPSS stands at 0.17% (6th percentile), indicating no observed mass exploitation at time of analysis despite the CVSS 8.8 severity rating.
Use-after-free in the Linux kernel's dibs loopback subsystem allows a local low-privileged attacker to corrupt kernel memory during concurrent DMB node attach, detach, and unregister operations. The vulnerability arises from a race window between hash table lookup under dmb_ht_lock and the subsequent refcount operation performed after the lock is dropped, enabling a concurrent unregister path to free the node before the refcount transition completes. With a CVSS score of 7.8 and C:H/I:H/A:H impact metrics, successful exploitation can lead to privilege escalation or kernel crash; however, no public exploit is identified at time of analysis and EPSS at 0.17% reflects low current exploitation probability.
Memory corruption in the Linux kernel's User Mode Linux (UML) vector network driver lets a remote peer trigger a use-after-free in vector_mmsg_rx(). When a received packet fails verify_header(), the code frees the skb but skips the slot-cleanup that normal paths perform, so the next RX iteration re-reads and double-frees the same freed buffer, causing a refcount underflow / use-after-free. It affects UML instances using the GRE or L2TPv3 vector transports; any peer on such a transport can trigger it without authentication. No public exploit identified at time of analysis, and EPSS is low (0.20%).
Arbitrary CMA memory corruption via GPU DMA in the Linux kernel's drm/vc4 VideoCore 4 driver affects Raspberry Pi and similar vc4-based platforms running kernels from version 4.13 through multiple stable series. The vc4_overflow_mem_work() function incorrectly programs BPOS with the full 16MB binner BO size instead of the correct 512KB slot size, authorizing the GPU's PTB hardware to scribble tile lists across adjacent in-flight job memory and into unrelated CMA pages beyond the BO boundary. No public exploit has been identified at time of analysis and EPSS is 0.17% (6th percentile), but the memory corruption manifests reliably as GPU hangs, userspace heap corruption, and system crashes under normal GPU workloads that overflow the initial binner slot.
Heap buffer overflow and potential kernel memory mass-zeroing in the Linux kernel drm/panthor GPU driver allow a local attacker to corrupt kernel heap structures or trigger catastrophic out-of-bounds writes by supplying a crafted firmware image to the Arm Mali Valhall (Panthor) DRM subsystem. The root cause is that panthor_fw_load_section_entry() computes section->data.size from raw firmware header fields without bounding it against the allocated section_size, allowing both a memcpy overflow and an unsigned integer underflow in a subsequent memset that could zero arbitrarily large kernel memory regions. No public exploit has been identified and EPSS is low at 0.18% (8th percentile), but the CVSS impact ratings of C:H/I:H/A:H reflect the realistic worst case of full kernel compromise on affected hardware.
Out-of-bounds memory access in the Linux kernel's drm/panthor driver (ARM Mali Valhall GPU) allows a local authenticated attacker to read or corrupt kernel memory by supplying a crafted MCU virtual address near the end of the firmware shared memory section. The underlying flaw is in iface_fw_to_cpu_addr(), which validated only that a firmware-provided address falls within the shared section - not that the full firmware interface structure fits within it - enabling subsequent structure-level accesses to reach past the section boundary. No public exploit code exists and EPSS is 0.17% (6th percentile), indicating no evidence of active exploitation; patches are available in Linux stable releases 6.12.103, 7.1.8, and 6.18.44.
Incorrect route selection in the Linux kernel's netfilter flowtable IPIP-encapsulation offload path causes the headroom and IP fragment-offset (iph->frag_off) to be computed from the reverse-direction dst instead of the current direction when pushing the IPIP header. Affecting kernel 6.19 and development branches through the 7.x line, the flaw can lead to malformed encapsulated packets and potential memory/headroom mishandling in the fast-path offload; it is tagged as information disclosure. The input CVSS of 9.8 (RCE-grade) is a CNA auto-score that overstates a config-dependent packet-handling bug, and EPSS is low at 0.20% (10th percentile) with no public exploit or KEV listing.
Denial of service in the Linux kernel netfilter flowtable subsystem allows a crash in the tunnel transmit path when IPIP tunnel offload is combined with a direct-xmit device such as a bridge. Because no dst_entry is supplied, the code performs invalid dst usage while checking skb headroom and setting iph->frag_off, leading to a kernel crash. Rated CVSS 9.8 by automated scoring, but vendor tags classify it as Denial Of Service; EPSS is 0.20% (10th percentile), it is not in CISA KEV, and no public exploit was identified at time of analysis.
Weakened AMD SEV-SNP memory-integrity enforcement in the Linux kernel results from a race between WBINVD IPIs and dirty-cacheline migration that can leave Reverse Map Table (RMP) memory with un-flushed dirty cache lines when SNP_INIT_EX is invoked with INIT_RMP=1, violating SNP firmware requirement (spec section 8.8). Affected are Linux 7.1 hosts that had adopted commit 99cf1fb58e68 (which dropped the pre-SNPEn WBINVD); the fix reverts that change so wbinvd_on_all_cpus() again runs before setting MSR_AMD64_SYSCFG_SNP_EN, while the RMP is not yet in use. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not CISA KEV-listed.
Out-of-bounds read in the Linux kernel's batman-adv multicast tracker exposes adjacent-network unauthenticated attackers to kernel memory disclosure or denial-of-service via a crafted TVLV mcast tracker packet. The root cause is a C macro misuse - offsetof() on the first struct member always evaluates to 0, making the bounds check a no-op that permits access to num_dests even when only 0 or 1 byte is in the received packet instead of the required 2. EPSS is 0.21% (11th percentile), no CISA KEV entry exists, and no public exploit is identified; vendor-released patches are available in Linux 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3.
Memory-corruption (double-free / use-after-free) in the Linux kernel's SunRPC server layer allows the rq_procinfo->pc_release hook to fire against stale, reused request state when a worker thread hits an early error path (unsupported protocol, short frame, or bad auth) before a valid procinfo is installed. It affects Linux 6.18 (and the shared SunRPC code reachable via kernel RPC servers such as nfsd), and successful triggering corrupts kernel heap state, risking denial of service or privilege escalation. The issue is patched upstream; there is no public exploit identified at time of analysis and EPSS is low (0.21%), so it is not currently known to be exploited.
Out-of-bounds slab write in the Linux kernel SUNRPC layer (xdr_buf_to_bvec()) lets a remote NFS client corrupt kernel memory via the in-kernel NFS server (nfsd) write path. The function stores a bio_vec into the caller's rq_bvec array before verifying the slot is in range - and the head branch stores with no check at all - so when the exactly-sized rq_maxpages budget is used up, one bio_vec lands past the array into adjacent slab memory, with attacker-influenced bv_len and bv_offset values taken from client-supplied RPC payload sizes. Rated CVSS 9.8 by the source, but with low EPSS (0.21%), no CISA KEV listing, and no public exploit identified at time of analysis.
Filesystem consistency flaw in the Linux kernel NTFS driver's ntfs_ir_reparent() index-root reparenting path allows a transient on-disk/in-memory layout that $INDEX_ROOT validation rejects as corrupt, surfacing as generic/013 xfstests failures and ntfsck 'Corrupt index root' errors. The bug is a metadata-ordering error triggered during NTFS write operations that grow an index root and hit -ENOSPC, not a remotely exploitable memory-safety issue; no public exploit identified at time of analysis and it is not in CISA KEV. Fixed in stable 7.1.5 and mainline 7.2-rc1.
Out-of-bounds read in the Linux kernel's NTFS driver (ntfs_mapping_pairs_decompress) lets a crafted NTFS attribute record trigger a one-byte read past the attribute boundary. It stems from off-by-one bounds checks that use strict greater-than instead of >=, so mapping-pair data extending exactly to attr_end passes validation and buf[b] reads one byte too far. No public exploit is identified at time of analysis, EPSS is low (0.20%), and it is not on CISA KEV; exploitation requires the kernel to parse an attacker-controlled NTFS volume.
Out-of-bounds kernel memory read in the legacy NTFS filesystem driver of the Linux kernel (affecting builds derived from commit 6ceb4cc8 up to the 7.1.x and 7.2-rc series) occurs when the driver parses a crafted NTFS image whose $FILE_NAME attribute declares a small resident value_length but an oversized file_name_length. Callers trust file_name_length and read past the resident attribute value during name conversion/comparison, producing a slab-out-of-bounds read confirmed under KASAN from the kmalloc-1k MFT record copy. There is no public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and despite the source-assigned 9.8 CVSS this is a local filesystem-parsing bug rather than a remote-unauthenticated flaw.
Out-of-bounds read in the Linux kernel's NTFS driver allows a local attacker to leak adjacent kernel memory or crash the system by parsing extended attribute (EA) entries on a crafted NTFS volume. The ntfs_ea_lookup and ntfs_listxattr routines dereferenced the next_entry_offset field of an EA entry without first verifying that enough space remained in the buffer. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is tagged as Information Disclosure rather than code execution.
On-disk NTFS metadata corruption in the Linux kernel's NTFS3 driver arises because ntfs_resident_attr_resize() may select zero-length resident $DATA attributes when converting attributes to non-resident to free MFT record space, producing 0-byte non-resident $DATA that fsck flags as filesystem corruption. The flaw affects Linux systems writing to NTFS volumes and is a data-integrity/consistency defect rather than a memory-safety or remote-code issue; it is fixed in stable 7.1.5 and 7.2-rc1. There is no public exploit identified at time of analysis, EPSS probability is low (0.20%, 10th percentile), and it is not listed in CISA KEV. The published CVSS of 9.8 (network vector) is not consistent with a local filesystem write path and appears to be an automated over-assessment.
Out-of-bounds access in the Linux kernel's legacy NTFS filesystem driver arises from insufficient validation of INDEX_HEADER geometry within INDX directory-index blocks; a crafted NTFS volume can drive ntfs_lookup_inode_by_name() to read past block boundaries. The fix hardens ntfs_index_block_inconsisent() to strictly validate index-block header fields before use, affecting systems that mount attacker-controlled NTFS media. There is no public exploit identified at time of analysis, KEV does not list it, and EPSS is low (0.20%, 10th percentile), consistent with a filesystem-parsing bug that requires a malicious volume rather than remote reach.
Deadlock in the Linux kernel NTFS driver allows local users with write access to an NTFS-mounted volume to render the system completely unresponsive by triggering an ABBA lock ordering race between concurrent VFS writeback paths. The vulnerability affects kernels since commit 6994acf33bae and manifests when inode writeback (acquiring extent_lock then mrec_lock) races with MFT folio writeback (holding mrec_lock while attempting extent_lock). No active exploitation has been confirmed - EPSS places this at the 10th percentile (0.20%) - reflecting the narrow real-world surface: production Linux systems rarely mount NTFS volumes. Patches are available in Linux 7.1.5 and 7.2-rc1.
Indefinite thread blocking in the Linux kernel's NTFS driver can cause a local denial of service on systems mounting NTFS volumes under memory pressure. Specifically, `get_nr_free_clusters()` and `__get_nr_free_mft_records()` allocate heap memory for a readahead state structure; if that allocation fails, neither `NVolFreeClusterKnown()` is set nor `vol->free_waitq` is woken, leaving any waiting kernel thread blocked indefinitely. Kernels prior to 7.1.5 and 7.2-rc1 are affected; no public exploit has been identified and EPSS is 0.20% (10th percentile).
Improper validation of NTFS index entries in the Linux kernel's NTFS filesystem driver allows a crafted or corrupted NTFS volume to be processed without adequate bounds checking during index root and index block reads. When an attacker-controlled NTFS image is mounted and traversed (lookup/readdir), missing per-read validation can lead to out-of-bounds memory access, enabling information disclosure or a kernel crash. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is not on the CISA KEV list.
Signed-integer overflow in the Linux kernel NTFS driver's mapping-pairs runlist parser lets a crafted or corrupted NTFS volume redirect logical-to-physical cluster mappings to unintended disk locations. The flaw affects the kernel's NTFS attribute parsing when it accumulates relative LCN deltas; a malicious runlist can set the accumulator to S64_MAX and add 1, triggering undefined behavior that resolves runs to a different set of physical clusters. Fixed upstream in Linux 7.1.5 and 7.2-rc1; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.20%).
Out-of-bounds memory access in the Linux kernel NTFS driver arises because resident $INDEX_ROOT attribute headers are consumed after lookup without fully validating their layout invariants. Affected are Linux kernels prior to the 7.1.5 and 7.2-rc1 stable fixes when mounting or accessing an attacker-crafted NTFS volume; unchecked entries_offset, index_length, and allocated_size fields let a malformed filesystem drive reads beyond the resident value, tagged upstream as Information Disclosure. This is not actively exploited (no CISA KEV entry) and EPSS is low at 0.20%, with no public exploit identified at time of analysis, though upstream stable commits are available.
The legacy NTFS driver in the Linux kernel fails to reject non-resident attribute records for attribute types contractually required to be resident, creating resident/non-resident union confusion paths in multiple critical code locations. Affected callers - including inode loading ($STANDARD_INFORMATION), volume flag updates ($VOLUME_INFORMATION), and directory traversal ($INDEX_ROOT) - read data.resident.value_offset directly without first verifying the a->non_resident flag, potentially acting on the wrong union member when a crafted or corrupted NTFS image is mounted. A local attacker with standard user privileges can exploit this to trigger kernel memory corruption or information disclosure; no active exploitation is confirmed (EPSS 0.20%, not in CISA KEV), and patches are available in Linux 7.1.5 and 7.2-rc1.
Improper validation of on-disk metadata in the Linux kernel's legacy NTFS driver allows a crafted NTFS filesystem image to smuggle an error-marked MFT (Master File Table) reference back through ntfs_lookup_inode_by_name(), causing directory-lookup callers to misinterpret corrupted disk data as a legitimate pseudo-errno. This affects systems that mount attacker-supplied NTFS volumes; there is no public exploit identified at time of analysis and the EPSS probability is low (0.20%). The upstream fix normalizes any error-marked reference to ERR_MREF(-EIO) so callers can no longer be tricked into consuming a bogus value.
Local volume corruption and a writeback deadlock affect the Linux kernel NTFS driver (fixed in 7.1.5 and 7.2-rc3) when a filesystem is mounted with the non-default show_sys_files option and userspace writes to an exposed base metadata file such as $Bitmap; because the cluster allocator scans $Bitmap through the same inode page cache, the write both corrupts the volume and deadlocks writeback against an already-locked folio. Only affected when the opt-in show_sys_files mount option is set, so this is a local integrity/availability issue rather than a remote one. There is no public exploit identified at time of analysis, EPSS is 0.20% (10th percentile), and it is not in CISA KEV.
Memory-safety flaw in the Linux kernel's legacy NTFS (read) driver lets a crafted NTFS filesystem image bypass a resident/non-resident attribute check in ntfs_map_runlist_nolock(). When the driver expects a non-resident attribute during mount, an attacker-supplied image can substitute a resident attribute; the code previously only flagged this with a non-fatal WARN_ON() and then read a->data.non_resident.highest_vcn from the wrong union member, corrupting the VCN range check. The fix replaces WARN_ON() with an -EIO return so the malicious image is rejected at mount. There is no public exploit identified at time of analysis, and EPSS is low (0.22%).
Memory corruption in the Linux kernel's MIPS scheduler corrupts kernel pointer state when CONFIG_CPUMASK_OFFSTACK is enabled, enabling local privilege escalation to root. Two compounding flaws exist: sizeof(new_mask) resolves to the pointer width (4-8 bytes on MIPS) rather than the actual cpumask buffer size, causing copy_from_user() to overwrite the mask pointer with user-controlled bytes; and the original code invoked copy_from_user() prior to allocating the mask buffer, creating a write-before-allocation primitive. CVSS 7.8 with AV:L/AC:L/PR:L/UI:N reflects straightforward local exploitation on affected MIPS systems, though EPSS at 0.21% (12th percentile), no CISA KEV listing, and no public exploit code indicate limited real-world exploitation activity at time of analysis.
Kernel memory corruption in the Linux kernel's MTD slram driver stems from a link-before-initialize race in `register_device()`, where new `slram_mtdlist` entries are inserted into the global device list before all required state (memory allocation, `memremap()`, and `mtd_device_register()`) is fully committed. When any of these subsequent operations fail, the partially initialized entry persists on the list, and later cleanup code dereferences or frees invalid kernel memory - enabling potential local privilege escalation from low-privileged access to full kernel compromise. EPSS is 0.22% (13th percentile), no CISA KEV listing exists, and no public exploit has been identified at time of analysis, collectively indicating low near-term exploitation likelihood despite the high CVSS score of 7.8.
Unbounded array indexing in the ocfs2 filesystem's ocfs2_sum_rightmost_rec() function causes UBSAN-detected kernel panic or memory corruption when a file write targets an inode whose embedded extent list has been corrupted on-disk. Linux kernels prior to 6.18.40 (stable 6.x branch) and 7.1.5 (7.x branch) are affected on any system mounting an ocfs2 volume. No public exploit has been identified at time of analysis and EPSS probability sits at 0.21% (11th percentile), reflecting realistically constrained exploitability due to the required on-disk corruption precondition.
Cache coherency corruption in the Linux kernel's OpenRISC architecture jump_label implementation leaves instruction cache lines on remote SMP cores stale after static key updates, meaning security-relevant kernel branches may execute the wrong code path indefinitely on affected multi-core OpenRISC systems. The flaw originates in commit 8c30b0018f9d, which ported jump_label support from arm64 without adapting icache invalidation to OpenRISC's SMP model - `kick_all_cpus_sync()` does not guarantee a full remote icache flush on this architecture. No public exploit has been identified at time of analysis, and the 0.21% EPSS score (11th percentile) reflects the severe rarity of OpenRISC SMP hardware in production.
Use-after-free in the Linux kernel TPM subsystem's tpm_buf_append_salt() function triggers automatic kernel memory corruption on systems equipped with asynchronous KPP cryptographic hardware backends. The defect fires continuously and without any userland action - the hwrng_fillfn kernel thread invokes the vulnerable code path on every entropy poll via tpm2_get_random → tpm2_start_auth_session → tpm_buf_append_salt, causing a deferred completion worker to dereference a freed kpp_request when the async backend returns -EINPROGRESS. No public exploit has been identified at time of analysis and EPSS is 0.20% (10th percentile), but the kernel-space use-after-free carries inherent privilege escalation and denial-of-service risk on affected hardware configurations.
Race condition in the Linux kernel's DesignWare eDMA (dw-edma) driver exposes DONE_INT_MASK and ABORT_INT_MASK interrupt registers to concurrent corruption when multiple DMA channels are started simultaneously. Systems running Linux kernel versions since commit 7e4b8a4fbe2c and equipped with DesignWare eDMA hardware - common in PCIe-attached peripherals and certain SoC platforms - are affected across stable branches from 6.1 through 7.1. No public exploit has been identified and EPSS sits at 0.21% (12th percentile), consistent with a hardware-specific driver flaw; however, the kernel maintainers have shipped patches across all active stable series, and remediation should be prioritized where this DMA controller is in use.
Initialization ordering flaw in the Linux kernel's Renesas RZ DMAC driver (rz-dmac) creates a race window during driver probe where a DMA interrupt fires before channel->ch_base is assigned and before the ld_free, ld_queue, and ld_active linked-list structures are initialized, leading to invalid kernel memory access, potential kernel crashes, or memory corruption on Renesas RZ SoC-based platforms. Affected systems run Linux 5.15 through the pre-patch stable releases; fixes are available across multiple upstream stable branches (6.6.148, 6.12.101, 7.1.5, 7.2-rc1). No public exploit exists, EPSS is 0.21% (11th percentile), and this CVE is not listed in the CISA KEV catalog.
Permanent I2C bus lockup in the Linux kernel i2c-imx driver (NXP i.MX SoCs) occurs when an SMBus block-read response returns a byte count of 0, a condition explicitly permitted by SMBus 3.1 specification section 6.5.7. The interrupt-driven state machine introduced in the v6.13 rework rejects count=0 with -EPROTO but critically fails to issue NACK+STOP before returning, leaving the target device holding SDA and the entire I2C bus permanently stuck until the controller is power-cycled. A secondary bug on the count > I2C_SMBUS_BLOCK_MAX error path exhibits the same failure mode. No public exploit or active exploitation is identified; vendor-released patches are available in kernel versions 6.18.40, 7.1.5, and 7.2-rc4.
Use-after-free in the Linux kernel's IPv4 TCP stack (net/ipv4/tcp_output.c) occurs when tcp_connect() reconciles conflicting TCP-MD5 and TCP-AO authentication keys on a socket that is already in TCP_SYN_SENT and hashed into the inet ehash. In the needs_ao branch, tcp_clear_md5_list() frees each tcp_md5sig_key and the md5sig_info container with bare kfree() before the RCU grace period, while softirq RX-path readers (__tcp_md5_do_lookup / __tcp_md5_do_lookup_exact) are still walking the same list under RCU, producing a per-key slab use-after-free. It affects kernels on the 6.18 line (and the described stable range) and is fixed by deferring frees with kfree_rcu; no public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile).
Kernel memory corruption (double free) in the Linux kernel's XFRM/IPsec NAT keepalive path allows a crash or potential heap exploitation when a keepalive transmission fails after the socket buffer has already been handed to the IPv4/IPv6 output stack. Introduced with the nat_keepalive feature in Linux 6.11 and affecting recent stable branches, nat_keepalive_send() incorrectly frees an skb that ip_build_and_send_pkt() or ip6_xmit() may already have consumed, producing a double free. EPSS is low (0.21%, 11th percentile), no public exploit has been identified, and it is not listed in CISA KEV; despite the auto-assigned 9.8 CVSS, realistic impact centers on denial of service and requires an IPsec NAT-traversal configuration.
Data corruption in the Linux kernel's spi-imx driver causes SPI bus transfers to produce malformed data when DMA initialization fails and the driver incorrectly falls back to PIO mode without resetting the ECSPI hardware configuration. Systems running NXP i.MX SoCs with ECSPI DMA declared in the device tree but without the sdma-imx7d.bin SDMA firmware are deterministically and silently affected on every transfer. Downstream security-critical devices connected to the affected SPI bus - such as the Infineon SLB9670 TPM - receive corrupted responses that can prevent device initialization entirely, eliminating TPM-based security services; no public exploit has been identified at time of analysis.
Undefined behavior in the Linux kernel's spi-uniphier SPI controller driver arises from a driver probe initialization ordering defect: devm_request_irq() is called before init_completion(), leaving a race window in which an early interrupt can invoke complete() on an uninitialized kernel completion object. Systems running Socionext UniPhier SoC hardware on affected kernel versions are exposed during driver probe. No public exploit has been identified and EPSS sits at 0.22% (13th percentile), consistent with the hardware-specific nature of the flaw - practical exploitation is constrained to platforms physically equipped with UniPhier SoCs.
Use-after-free of freed executable memory in the Linux kernel's io_uring/bpf-ops subsystem allows a local attacker with CAP_BPF and CAP_PERFMON capabilities to achieve arbitrary kernel code execution by registering the same io_uring_bpf_ops struct_ops map against multiple io_ring_ctx instances in sequence. The missing re-registration guard on ops->priv causes the first io_ring_ctx to be orphaned with a dangling ctx->loop_step function pointer into a freed BPF trampoline, which is invoked when io_uring_enter() is later called on that ring. No public exploit has been identified at time of analysis, and EPSS at 0.20% reflects low near-term mass-exploitation probability, though the primitive - controlled call into freed executable memory - is a classic kernel privilege escalation building block.
Incomplete cleanup in the Linux kernel's sparx5 Ethernet switch driver leaves a switchdev blocking notifier registered when workqueue allocation fails during initialization, creating a dangling callback that subsequent kernel network events can invoke against uninitialized driver state - enabling potential kernel memory corruption or privilege escalation on affected hardware. Systems running kernels from 5.14 through the unpatched stable branches on Microchip Sparx5 switch ASICs are affected; patches have been backported to five stable kernel series. No public exploit code exists and EPSS probability is 0.21% (12th percentile), though kernel-level C:H/I:H/A:H impact warrants prompt patching on any affected networking appliance.
Use-after-free in the Linux kernel's amdxdna DMA buffer memory mapping function exposes systems with AMD XDna AI accelerator hardware to local privilege escalation. When vm_insert_pages() fails inside amdxdna_gem_dmabuf_mmap(), the error path triggers drm_gem_object_put() twice on the same GEM object - once through the VMA close handler and again through the fall-through put_obj label - freeing the object and then accessing freed memory. EPSS sits at 0.21% (11th percentile) and the vulnerability is not listed in CISA KEV, indicating no known active exploitation; however, the CVSS 7.8 high score reflects the full C/H/I:H/A:H kernel memory corruption potential if successfully triggered locally.
Client pointer confusion in the Linux kernel's amdxdna DRM accelerator driver allows a local low-privileged user to trigger cross-process access to another process's hardware context and debug buffer objects via a misrouted SYNC_DIRECT_FROM_DEVICE ioctl. Systems running AMD XDNA NPU hardware (such as AMD Ryzen AI series processors) with the amdxdna kernel module loaded are affected across kernel versions from the driver's introduction up to the patched releases in 7.1.5 and 7.2-rc1. No public exploit exists and the EPSS score of 0.20% (10th percentile) reflects low near-term exploitation probability, though the CVSS 7.8 score correctly captures the high CIA impact should exploitation succeed.
Integer underflow in the Linux kernel's Intel VPU accelerator driver (accel/ivpu) allows a local low-privileged attacker to trigger out-of-bounds kernel memory reads and infinite loops via a malformed firmware log buffer. The vulnerability exists because fw_log_from_bo() never validates that log->size is at least log->header_size before fw_log_print_buffer() computes data_size = log->size - log->header_size - a u32 subtraction that wraps to near-U32_MAX, defeating the bounds checks from commit dd1311bcf0e6 and enabling fw_log_print_lines() to read far past the allocated BO region. No active exploitation is confirmed (not in CISA KEV), and EPSS is 0.21% (11th percentile), indicating low near-term exploitation likelihood despite the 7.1 CVSS score.
Use-after-free race condition in the Linux kernel's tracing/user_events subsystem allows a low-privileged local user to corrupt kernel heap memory during fork(), potentially enabling privilege escalation to root. The race is triggered when a multithreaded process concurrently unregisters a user event enabler while calling fork(), causing user_event_mm_dup() to dereference enabler and user_event structures freed without observing the required RCU grace period. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, the low privilege bar and full C/I/A impact make it a meaningful escalation primitive on any multi-user or shared Linux system running an unpatched kernel with CONFIG_USER_EVENTS enabled.
Header buffer corruption in the Linux kernel gve (Google Virtual Ethernet) driver's DQO RX datapath lets header bytes from one packet be copied onto another, and lets header buffers be re-posted while the device still owns them, when both header-split and HW-GRO are enabled with many concurrent flows. The gve driver is used by Google Cloud Platform Linux VMs, so exposure is limited to GCP guests running affected kernels with that specific offload configuration. There is no public exploit identified at time of analysis, EPSS is very low (0.20%), and the observed effect is roughly a 30% throughput drop with heavy TCP retransmissions rather than code execution.
Timing side-channel in Net::OAuth before 0.33 for Perl allows remote unauthenticated attackers to recover valid signatures byte-by-byte by measuring server response latency during signature rejection. For HMAC-SHA1 and HMAC-SHA256 methods the oracle yields a forged HMAC token; under the PLAINTEXT signature method the comparison is performed directly against the signature key, meaning the timing oracle exposes the raw consumer_secret and token_secret. No public exploit has been identified at time of analysis and EPSS is 0.17% (6th percentile), but the PLAINTEXT credential-exposure path is theoretically severe for any deployment relying on that method.
Signature-verification bypass in the Net::OAuth Perl module before 0.33 lets a remote attacker forge valid OAuth requests for any consumer key and token by dictating which algorithm the Service Provider uses to check their signature. Because verify() resolves the signature-method class from the attacker-supplied signature_method parameter and offers no way to pin an expected method, a provider deployed on RSA-SHA1 (which holds only the consumer's public key) can be tricked into validating an HMAC-SHA1 signature against a placeholder/guessable consumer_secret. No public exploit has been identified at time of analysis and EPSS is low (0.11%), but the flaw is unauthenticated and network-reachable (CVSS 9.8).
Type confusion in V8, Chrome's JavaScript engine, enables remote code execution within the browser sandbox against users running Chrome prior to 151.0.7922.169. An unauthenticated remote attacker can trigger the vulnerability by luring a victim to a crafted HTML page, making this a drive-by exploitation scenario requiring only a single user interaction. Google has released a patch in stable channel version 151.0.7922.169; no public exploit or CISA KEV listing has been identified at time of analysis, though SSVC rates the technical impact as total.
Sandbox escape via heap-based buffer overflow in ANGLE's graphics engine on Chrome for Android allows a threat actor who has already achieved renderer process compromise to execute arbitrary code entirely outside the Chrome sandbox. All Chrome for Android versions prior to 151.0.7922.169 are affected; the vulnerability requires a two-stage exploit chain combining a separate renderer compromise with this ANGLE flaw. Google has released a patched build (151.0.7922.169); no public exploit code or CISA KEV listing has been identified at time of analysis, though the two-stage nature indicates likely use in sophisticated targeted attack chains.
Use-after-free in Google Chrome's WebGL subsystem allows remote code execution inside the browser sandbox for all Chrome versions prior to 151.0.7922.169. An attacker can achieve arbitrary code execution within the Chrome renderer by delivering a crafted HTML page to a victim, requiring only a single page visit. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CVSS 8.8 with low attack complexity reflects meaningful real-world risk for any unpatched Chrome deployment.
Sandbox escape via race condition in Google Chrome's USB subsystem (all versions prior to 151.0.7922.169) enables arbitrary code execution on the host system when chained with a renderer process compromise. This is a second-stage exploit: an attacker must already have code execution within Chrome's sandboxed renderer before the USB TOCTOU race can be leveraged to cross the sandbox boundary, triggered through a crafted HTML page. No public exploit code or CISA KEV listing has been identified at time of analysis, though the scope-changed CVSS rating of 8.3 (S:C, C:H/I:H/A:H) underscores that a successful chain achieves full host-level compromise.
Remote code execution within the Chrome renderer sandbox is achievable against all Chrome versions prior to 151.0.7922.169 by delivering a crafted HTML page to a victim user. The root cause is an incorrect arithmetic or numeric calculation in V8, Chrome's JavaScript engine, which can be triggered purely through JavaScript execution in a standard browsing session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS score of 8.8 and the universality of Chrome's user base make this a high-priority patching candidate.
Use-after-free in the Browser component of Google Chrome on macOS prior to 151.0.7922.169 enables remote attackers to execute arbitrary code outside the sandbox. Exploitation requires social engineering to induce a user to visit a crafted HTML page, placing this in the user-interaction-required category. No public exploit code or CISA KEV listing has been identified at time of analysis, but the sandbox escape impact elevates real-world severity significantly.
Type confusion in V8, Chrome's JavaScript engine, enables arbitrary code execution inside the Chrome renderer sandbox on any platform (Windows, macOS, Linux) when a user visits an attacker-controlled HTML page. All Chrome releases prior to 151.0.7922.169 are affected; Google has released the patched stable-channel build. No public exploit code or active exploitation has been identified at time of analysis, though the SSVC framework rates technical impact as total within the sandbox boundary.
Sandbox escape via link following in Google Chrome's CredentialProvider component on Windows allows a local attacker to execute arbitrary code outside the browser's security sandbox, affecting all Chrome versions prior to 151.0.7922.169. The vulnerability stems from improper symbolic link or junction resolution (CWE-59) in the CredentialProvider, a Windows-specific subsystem handling credential operations, enabling a local attacker to redirect file access operations to attacker-controlled paths. No public exploit code has been identified and CISA's SSVC assessment confirms no known exploitation; however, the full CIA triad impact and sandbox escape potential make this a meaningful local privilege boundary violation.
Remote code execution in Google Chrome for Android before 151.0.7922.169 stems from a heap buffer overflow in Dawn, Chromium's WebGPU implementation, and is notable because Google explicitly states it allows code execution OUTSIDE the renderer sandbox. A remote attacker who lures a victim to a crafted HTML page can achieve full compromise of the browser process context on the device. Rated Critical by Chromium with CVSS 9.6; a vendor patch is available, and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Google Chrome's WebGL implementation (all versions prior to 151.0.7922.169) enables a remote attacker to execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. The sandbox escape elevates the impact from renderer-level code execution to potential full OS-level compromise. No public exploit code or active exploitation has been identified at the time of analysis, but the SSVC technical impact rating is 'total,' reflecting the severity of successful exploitation.
Remote denial-of-service in Oracle Java SE's 2D component allows unauthenticated network attackers to hang or crash the JVM across versions 25.0.4 and 26.0.2 via multiple protocols. The attack surface spans both server-side Java deployments exposing 2D-related APIs through web services and client-side environments running sandboxed Java Web Start applications or applets processing untrusted code. Oracle characterizes this as easily exploitable with no public exploit identified at time of analysis; no KEV listing is present.
Tar extraction path traversal in moby/go-archive allows an attacker who controls archive contents to create or overwrite files outside the intended destination directory, undermining container-to-host filesystem boundaries. The affected functions - Unpack, UnpackLayer, Untar, UntarUncompressed, and ApplyLayer - perform lexical path validation but rely on OS-level resolution at operation time, meaning symlinks introduced inside the archive redirect writes to arbitrary paths writable by the extracting process. This flaw propagates through the full Docker ecosystem including Docker Engine, Docker Desktop, Docker CLI, Docker Compose, and Docker Sandboxes; vendor-released patches are available and no public exploit code has been identified at time of analysis.
Access-control mitigation bypass in the Firefox Add-ons Manager component allows attackers to circumvent a security protection that Mozilla had previously put in place around add-on handling, affecting Firefox before 154 and Firefox ESR before 153.1. Mozilla assigned this a 9.8 CVSS score with a fully remote, unauthenticated, no-user-interaction vector, though the terse advisory text does not detail the exact protection defeated. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Information disclosure via a side-channel in Mozilla Firefox's Web Audio component allows remote, unauthenticated attackers to infer sensitive data that should be isolated between origins by measuring observable timing or behavioral discrepancies. The flaw affects Firefox before 154 and Firefox ESR before 153.1 and is fixed in those releases; no public exploit has been identified and EPSS is low (0.14%, 4th percentile), indicating no evidence of active exploitation.
Information disclosure via the WebRTC component in Mozilla Firefox allows network-accessible attackers to exfiltrate sensitive browser data due to improper restriction of rendered UI layers (CWE-1021). All Firefox releases prior to version 154 and all Firefox ESR releases prior to version 153.1 are affected across all platforms listed under CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. The CVSS base score is 7.5 with high confidentiality impact; SSVC confirms automatable exploitation, though no active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Same-origin policy enforcement in Firefox's DOM Service Workers component can be bypassed, allowing a malicious web page to access resources, responses, or cached content belonging to another origin. The flaw affects Firefox before version 154 and Firefox ESR before 153.1, and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the network, no-authentication, no-interaction vector makes it attractive for drive-by attacks.
Privilege escalation in Firefox's Request Handling component exposes all versions prior to 154 (and ESR prior to 153.1) to high-impact compromise of confidentiality, integrity, and availability. The flaw carries a CVSS 8.8 score with a network attack vector and no privilege prerequisite, meaning a remote attacker can trigger it by inducing a user to interact with attacker-controlled content. SSVC assessment confirms no active exploitation at time of analysis and rates technical impact as total, while fix versions are confirmed via two Mozilla security advisories.
Side-channel information disclosure in Firefox's Storage: Cache API (CWE-203) allows remote unauthenticated attackers to infer sensitive cached data through observable timing discrepancies between cache hits and misses. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected per Mozilla advisories mfsa2026-74 through mfsa2026-80. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact rating and broad Firefox deployment footprint make patching a near-term priority.
Privilege escalation in Mozilla Firefox's Downloads API component exposes users on any version prior to Firefox 154 or Firefox ESR 153.1 to high-impact compromise across confidentiality, integrity, and availability. Classified under CWE-269 (Improper Privilege Management), the flaw enables an unauthenticated remote attacker to escalate privileges when a user interacts with a crafted download trigger, requiring no prior foothold on the target system. No public exploit has been identified at time of analysis, but Firefox's ubiquitous deployment and the low attack complexity make this a high-priority patch for any organization.
Privilege escalation via invalid pointer dereference in Mozilla Firefox's Graphics component allows a remote attacker to gain elevated privileges within the browser context. Affected versions are all Firefox releases prior to 154 and all Firefox ESR releases prior to 153.1, with patches confirmed in Mozilla advisories mfsa2026-74 and mfsa2026-77. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation status as none with the attack not automatable, though technical impact is assessed as total.
Protection-mechanism bypass in the Firefox JavaScript engine's garbage collector (JavaScript: GC) undermines a built-in exploit mitigation, weakening a defense that normally hinders memory-corruption exploitation. The flaw affects Mozilla Firefox and Firefox ESR and was addressed by the vendor in Firefox 154 and Firefox ESR 153.1. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported internally by Mozilla.
Use-after-free in Mozilla Firefox's JavaScript garbage collector (GC) component enables remote code execution when a victim visits a malicious webpage. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected across multiple product lines, as indicated by four separate Mozilla Security Advisories (MFSA2026-74, -77, -78, -80). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the high CVSS score of 8.8 with full C/I/A impact and low attack complexity demands prompt patching.
Protection mechanism failure in Firefox's Data Loss Prevention (DLP) component allows remote attackers, with user interaction, to bypass DLP controls, resulting in high confidentiality and integrity impact. Affected versions span the standard Firefox release channel (prior to 154) and both active ESR branches (ESR 140.x prior to 140.14, ESR 153.x prior to 153.1). No public exploit exists and EPSS sits at 0.17% (7th percentile), indicating low observed exploitation probability despite the high CVSS score - no active exploitation is confirmed via CISA KEV.
Use-after-free memory corruption in Firefox's Layout: Text and Fonts component allows a remote unauthenticated attacker to achieve high-confidence confidentiality, integrity, and availability impact by luring a user to visit a malicious web page. The vulnerability spans the main Firefox release channel and all three active ESR branches (115.x, 140.x, 153.x), indicating broad exposure across enterprise and consumer deployments. No public exploit or active exploitation has been identified at time of analysis, but the network-accessible, low-complexity nature of this flaw and the breadth of MFSA advisories (mfsa2026-74 through mfsa2026-80) signal a high-priority patching target.
Privilege escalation via the Shell Integration component in Mozilla Firefox allows a remote unauthenticated attacker - with user interaction - to achieve full compromise of confidentiality, integrity, and availability on affected systems. Affected are all Firefox releases prior to 154 and ESR branches prior to 140.14 and 153.1, as confirmed by Mozilla advisories mfsa2026-74, mfsa2026-76, and mfsa2026-77. No public exploit or CISA KEV listing has been identified at time of analysis, and SSVC rates exploitation status as none.
Memory corruption in Mozilla Firefox's Graphics component stems from an integer overflow (CWE-190) that can be triggered when the browser processes malicious web content, potentially leading to remote code execution within the content process. The flaw affects Firefox before 154 and the ESR 140.x and 153.x branches, and Mozilla has shipped fixes across advisories MFSA2026-74 through MFSA2026-80. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Site isolation bypass in Mozilla Firefox's Networking: Cookies component allows remote, unauthenticated attackers to read and manipulate cookies across origins when a victim visits a malicious page, scoring CVSS 8.1 (High) due to high confidentiality and integrity impact. The flaw, rooted in CWE-346 (Origin Validation Error), undermines a core browser security boundary that separates per-site cookie access. Vendor-released patches are available in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1; no public exploit or CISA KEV listing is identified at time of analysis.
Privilege escalation in Firefox's Networking: Cookies component allows a remote, unauthenticated attacker to gain elevated privileges within the browser when a user visits a malicious page, yielding full confidentiality, integrity, and availability impact. All Firefox releases prior to 154 and both ESR branches prior to 140.14 and 153.1 are affected across all platforms. SSVC rates technical impact as total, but exploitation status is confirmed as none and the attack is not automatable due to the required user interaction; no public exploit or CISA KEV listing exists at time of analysis.
Privilege escalation via incorrect boundary conditions in Firefox's Graphics: CanvasWebGL component allows remote attackers to achieve high-impact code execution by luring users to a crafted web page. The flaw affects all Firefox releases prior to version 154 and multiple ESR branches (115.x, 140.x, 153.x), making the exposure broad across both consumer and enterprise deployments. No active exploitation has been confirmed (SSVC: Exploitation: none), but the CVSS 8.8 score and total technical impact classification warrant prompt patching.
Memory corruption via a use-after-free in Firefox's DOM: Core & HTML component allows a remote attacker to trigger dangling-pointer reuse in the browser engine, potentially leading to arbitrary code execution within the content process. All Firefox and Firefox ESR users on versions prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. No public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), consistent with a freshly patched browser bug with no observed weaponization.
Memory corruption via a use-after-free in Firefox's Graphics: ImageLib component allows a remote attacker to potentially execute code or disclose memory contents when a victim renders attacker-controlled image data. All Firefox channels are affected up to the fixed builds (Firefox 154 and ESR 115.39, 140.14, 153.1). No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), indicating no observed weaponization despite the high CVSS score.
Privilege escalation via the Remote Settings Client component affects Mozilla Firefox across all supported mainline and ESR release tracks, with Mozilla assigning the issue CVSS 8.8 High severity. The flaw (CWE-269, Improper Privilege Management) permits a network-based attacker to escalate privileges within the browser context when a user interacts with attacker-controlled content, achieving total confidentiality, integrity, and availability impact. No public exploit code exists and CISA has not listed this in KEV, but the simultaneous patching of three ESR branches alongside mainline signals that Mozilla assessed significant breadth of exposure across its install base.
Privilege escalation in Firefox's CanvasWebGL graphics component affects all Firefox releases prior to version 154 and both active ESR branches, enabling a remote attacker to gain full control over confidentiality, integrity, and availability within the browser process. The flaw stems from improper privilege management (CWE-269) in the WebGL canvas rendering pipeline, exploitable by luring a victim to a crafted web page - no authentication or special software is required beyond a standard Firefox installation. No public exploit code or active exploitation has been identified at time of analysis; however, Mozilla issued three simultaneous security advisories (MFSA2026-74/76/77) addressing all supported release tracks, signaling broad internal severity.
Memory corruption in Mozilla Firefox's Graphics: Text component (CWE-416 use-after-free) can be triggered by malicious web content, potentially leading to remote code execution or information disclosure in the browser process. All Firefox users on pre-fix builds are affected until updated to Firefox 154 or the corresponding ESR releases (115.39, 140.14, 153.1). There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 6th percentile).
Privilege escalation in Firefox's DOM Navigation component allows a remote unauthenticated attacker to achieve full confidentiality, integrity, and availability compromise within the browser process by inducing a user to visit a malicious webpage. All Firefox releases prior to version 154 and all active ESR branches (115.x, 140.x, 153.x) are affected, with Mozilla issuing four simultaneous MFSA advisories (mfsa2026-74 through mfsa2026-77) indicating broad impact across every supported release channel. No public exploit or KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a high-priority patch for all Firefox deployments.
Memory-corruption via a use-after-free in Firefox's JavaScript WebAssembly engine allows a remote attacker to corrupt heap memory and potentially achieve arbitrary code execution or information disclosure when a victim loads attacker-controlled content. All Firefox versions prior to Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1 are affected. There is no public exploit identified at time of analysis, KEV does not list it as actively exploited, and EPSS is low (0.16%), so this is a high-severity but not yet demonstrably-exploited flaw.
Privilege escalation in Firefox's DOM Networking component allows remote attackers who can lure a user to a malicious webpage to achieve high-impact compromise of confidentiality, integrity, and availability. The flaw, rooted in improper privilege management (CWE-269), affects all Firefox releases prior to version 154 and multiple ESR branches, and has been patched across four simultaneous Mozilla advisories (mfsa2026-74 through mfsa2026-77). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Memory corruption in the Linux kernel's NTFS filesystem driver stems from unchecked integer arithmetic when converting runlist element counts into byte sizes inside ntfs_rl_realloc() and ntfs_rl_realloc_nofail(). An attacker who can get a crafted NTFS volume mounted and parsed can overflow the size calculation and corrupt kernel heap memory, potentially escalating to code execution. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile).
Memory corruption in the Linux kernel's nzxt-smart2 hwmon driver exposes systems on non-coherent DMA architectures (ARM, MIPS) to deterministic kernel memory corruption whenever the NZXT Smart Device 2 USB hardware triggers a DMA-mapped output report. The driver's send_output_report() passes a misaligned buffer to hid_hw_output_report(), which hands it to usb_interrupt_msg() for DMA mapping; on non-coherent caches, cache line flush or invalidate operations corrupt adjacent kernel variables (mutex, update_interval) sharing the same cache line. No public exploit has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects low exploitation probability, and the bug is not listed in CISA KEV.
Out-of-bounds array access in the Linux kernel nct6775-core hardware monitoring driver allows a local low-privileged user on systems equipped with the nct6116 Super I/O chip to trigger reads beyond 3-element weight register arrays (up to index 4), with the resulting garbage values subsequently used as hardware I/O register addresses. This can cause invalid hardware register writes, hardware misconfiguration, or system crashes. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), making this a patch-priority rather than emergency-response item; exploitation is bounded by the hardware specificity of the nct6116 chip.
A double-free memory-corruption defect in the Linux kernel's rtase Realtek automotive Ethernet driver allows the same multi-fragment socket buffer to be freed twice when the transmit path hits a DMA mapping failure. It affects hosts running the rtase driver (Realtek multi-gigabit/automotive NICs) on kernel 6.12 and related stable trees, and can lead to kernel memory corruption and denial of service. No public exploit has been identified at time of analysis; EPSS is low (0.17%, 7th percentile) and the CVE is not on CISA KEV.
Use-after-free in the Linux kernel's Bluetooth HCI synchronization subsystem allows an adjacent-network attacker with low privileges to pass freed hci_conn pointers to hci_conn_valid(), where kmalloc may have reallocated that memory to unrelated objects. Affected Linux kernel versions across multiple stable branches expose systems with active Bluetooth to potential kernel memory corruption, yielding full confidentiality, integrity, and availability impact at the kernel level. No public exploit code has been identified and CISA KEV does not list this CVE; however, the HIGH CVSS score and kernel-level CIA:H/H/H impact justify prompt patching on any Bluetooth-enabled Linux host.
Use-after-free memory corruption in the Linux kernel's ksmbd SMB server subsystem exposes systems running the in-kernel file-sharing daemon to potential kernel-level compromise by an authenticated remote attacker. Affected are Linux kernel versions beginning at commit 8510a043d334ecdf83d4604782f288db6bf21d60 (ksmbd introduction) through multiple stable branches, with vendor-released patches confirmed in 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. No public exploit code has been identified and EPSS stands at 0.17% (6th percentile), indicating no observed mass exploitation at time of analysis despite the CVSS 8.8 severity rating.
Use-after-free in the Linux kernel's dibs loopback subsystem allows a local low-privileged attacker to corrupt kernel memory during concurrent DMB node attach, detach, and unregister operations. The vulnerability arises from a race window between hash table lookup under dmb_ht_lock and the subsequent refcount operation performed after the lock is dropped, enabling a concurrent unregister path to free the node before the refcount transition completes. With a CVSS score of 7.8 and C:H/I:H/A:H impact metrics, successful exploitation can lead to privilege escalation or kernel crash; however, no public exploit is identified at time of analysis and EPSS at 0.17% reflects low current exploitation probability.
Memory corruption in the Linux kernel's User Mode Linux (UML) vector network driver lets a remote peer trigger a use-after-free in vector_mmsg_rx(). When a received packet fails verify_header(), the code frees the skb but skips the slot-cleanup that normal paths perform, so the next RX iteration re-reads and double-frees the same freed buffer, causing a refcount underflow / use-after-free. It affects UML instances using the GRE or L2TPv3 vector transports; any peer on such a transport can trigger it without authentication. No public exploit identified at time of analysis, and EPSS is low (0.20%).
Arbitrary CMA memory corruption via GPU DMA in the Linux kernel's drm/vc4 VideoCore 4 driver affects Raspberry Pi and similar vc4-based platforms running kernels from version 4.13 through multiple stable series. The vc4_overflow_mem_work() function incorrectly programs BPOS with the full 16MB binner BO size instead of the correct 512KB slot size, authorizing the GPU's PTB hardware to scribble tile lists across adjacent in-flight job memory and into unrelated CMA pages beyond the BO boundary. No public exploit has been identified at time of analysis and EPSS is 0.17% (6th percentile), but the memory corruption manifests reliably as GPU hangs, userspace heap corruption, and system crashes under normal GPU workloads that overflow the initial binner slot.
Heap buffer overflow and potential kernel memory mass-zeroing in the Linux kernel drm/panthor GPU driver allow a local attacker to corrupt kernel heap structures or trigger catastrophic out-of-bounds writes by supplying a crafted firmware image to the Arm Mali Valhall (Panthor) DRM subsystem. The root cause is that panthor_fw_load_section_entry() computes section->data.size from raw firmware header fields without bounding it against the allocated section_size, allowing both a memcpy overflow and an unsigned integer underflow in a subsequent memset that could zero arbitrarily large kernel memory regions. No public exploit has been identified and EPSS is low at 0.18% (8th percentile), but the CVSS impact ratings of C:H/I:H/A:H reflect the realistic worst case of full kernel compromise on affected hardware.
Out-of-bounds memory access in the Linux kernel's drm/panthor driver (ARM Mali Valhall GPU) allows a local authenticated attacker to read or corrupt kernel memory by supplying a crafted MCU virtual address near the end of the firmware shared memory section. The underlying flaw is in iface_fw_to_cpu_addr(), which validated only that a firmware-provided address falls within the shared section - not that the full firmware interface structure fits within it - enabling subsequent structure-level accesses to reach past the section boundary. No public exploit code exists and EPSS is 0.17% (6th percentile), indicating no evidence of active exploitation; patches are available in Linux stable releases 6.12.103, 7.1.8, and 6.18.44.
Incorrect route selection in the Linux kernel's netfilter flowtable IPIP-encapsulation offload path causes the headroom and IP fragment-offset (iph->frag_off) to be computed from the reverse-direction dst instead of the current direction when pushing the IPIP header. Affecting kernel 6.19 and development branches through the 7.x line, the flaw can lead to malformed encapsulated packets and potential memory/headroom mishandling in the fast-path offload; it is tagged as information disclosure. The input CVSS of 9.8 (RCE-grade) is a CNA auto-score that overstates a config-dependent packet-handling bug, and EPSS is low at 0.20% (10th percentile) with no public exploit or KEV listing.
Denial of service in the Linux kernel netfilter flowtable subsystem allows a crash in the tunnel transmit path when IPIP tunnel offload is combined with a direct-xmit device such as a bridge. Because no dst_entry is supplied, the code performs invalid dst usage while checking skb headroom and setting iph->frag_off, leading to a kernel crash. Rated CVSS 9.8 by automated scoring, but vendor tags classify it as Denial Of Service; EPSS is 0.20% (10th percentile), it is not in CISA KEV, and no public exploit was identified at time of analysis.
Weakened AMD SEV-SNP memory-integrity enforcement in the Linux kernel results from a race between WBINVD IPIs and dirty-cacheline migration that can leave Reverse Map Table (RMP) memory with un-flushed dirty cache lines when SNP_INIT_EX is invoked with INIT_RMP=1, violating SNP firmware requirement (spec section 8.8). Affected are Linux 7.1 hosts that had adopted commit 99cf1fb58e68 (which dropped the pre-SNPEn WBINVD); the fix reverts that change so wbinvd_on_all_cpus() again runs before setting MSR_AMD64_SYSCFG_SNP_EN, while the RMP is not yet in use. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not CISA KEV-listed.
Out-of-bounds read in the Linux kernel's batman-adv multicast tracker exposes adjacent-network unauthenticated attackers to kernel memory disclosure or denial-of-service via a crafted TVLV mcast tracker packet. The root cause is a C macro misuse - offsetof() on the first struct member always evaluates to 0, making the bounds check a no-op that permits access to num_dests even when only 0 or 1 byte is in the received packet instead of the required 2. EPSS is 0.21% (11th percentile), no CISA KEV entry exists, and no public exploit is identified; vendor-released patches are available in Linux 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3.
Memory-corruption (double-free / use-after-free) in the Linux kernel's SunRPC server layer allows the rq_procinfo->pc_release hook to fire against stale, reused request state when a worker thread hits an early error path (unsupported protocol, short frame, or bad auth) before a valid procinfo is installed. It affects Linux 6.18 (and the shared SunRPC code reachable via kernel RPC servers such as nfsd), and successful triggering corrupts kernel heap state, risking denial of service or privilege escalation. The issue is patched upstream; there is no public exploit identified at time of analysis and EPSS is low (0.21%), so it is not currently known to be exploited.
Out-of-bounds slab write in the Linux kernel SUNRPC layer (xdr_buf_to_bvec()) lets a remote NFS client corrupt kernel memory via the in-kernel NFS server (nfsd) write path. The function stores a bio_vec into the caller's rq_bvec array before verifying the slot is in range - and the head branch stores with no check at all - so when the exactly-sized rq_maxpages budget is used up, one bio_vec lands past the array into adjacent slab memory, with attacker-influenced bv_len and bv_offset values taken from client-supplied RPC payload sizes. Rated CVSS 9.8 by the source, but with low EPSS (0.21%), no CISA KEV listing, and no public exploit identified at time of analysis.
Filesystem consistency flaw in the Linux kernel NTFS driver's ntfs_ir_reparent() index-root reparenting path allows a transient on-disk/in-memory layout that $INDEX_ROOT validation rejects as corrupt, surfacing as generic/013 xfstests failures and ntfsck 'Corrupt index root' errors. The bug is a metadata-ordering error triggered during NTFS write operations that grow an index root and hit -ENOSPC, not a remotely exploitable memory-safety issue; no public exploit identified at time of analysis and it is not in CISA KEV. Fixed in stable 7.1.5 and mainline 7.2-rc1.
Out-of-bounds read in the Linux kernel's NTFS driver (ntfs_mapping_pairs_decompress) lets a crafted NTFS attribute record trigger a one-byte read past the attribute boundary. It stems from off-by-one bounds checks that use strict greater-than instead of >=, so mapping-pair data extending exactly to attr_end passes validation and buf[b] reads one byte too far. No public exploit is identified at time of analysis, EPSS is low (0.20%), and it is not on CISA KEV; exploitation requires the kernel to parse an attacker-controlled NTFS volume.
Out-of-bounds kernel memory read in the legacy NTFS filesystem driver of the Linux kernel (affecting builds derived from commit 6ceb4cc8 up to the 7.1.x and 7.2-rc series) occurs when the driver parses a crafted NTFS image whose $FILE_NAME attribute declares a small resident value_length but an oversized file_name_length. Callers trust file_name_length and read past the resident attribute value during name conversion/comparison, producing a slab-out-of-bounds read confirmed under KASAN from the kmalloc-1k MFT record copy. There is no public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and despite the source-assigned 9.8 CVSS this is a local filesystem-parsing bug rather than a remote-unauthenticated flaw.
Out-of-bounds read in the Linux kernel's NTFS driver allows a local attacker to leak adjacent kernel memory or crash the system by parsing extended attribute (EA) entries on a crafted NTFS volume. The ntfs_ea_lookup and ntfs_listxattr routines dereferenced the next_entry_offset field of an EA entry without first verifying that enough space remained in the buffer. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is tagged as Information Disclosure rather than code execution.
On-disk NTFS metadata corruption in the Linux kernel's NTFS3 driver arises because ntfs_resident_attr_resize() may select zero-length resident $DATA attributes when converting attributes to non-resident to free MFT record space, producing 0-byte non-resident $DATA that fsck flags as filesystem corruption. The flaw affects Linux systems writing to NTFS volumes and is a data-integrity/consistency defect rather than a memory-safety or remote-code issue; it is fixed in stable 7.1.5 and 7.2-rc1. There is no public exploit identified at time of analysis, EPSS probability is low (0.20%, 10th percentile), and it is not listed in CISA KEV. The published CVSS of 9.8 (network vector) is not consistent with a local filesystem write path and appears to be an automated over-assessment.
Out-of-bounds access in the Linux kernel's legacy NTFS filesystem driver arises from insufficient validation of INDEX_HEADER geometry within INDX directory-index blocks; a crafted NTFS volume can drive ntfs_lookup_inode_by_name() to read past block boundaries. The fix hardens ntfs_index_block_inconsisent() to strictly validate index-block header fields before use, affecting systems that mount attacker-controlled NTFS media. There is no public exploit identified at time of analysis, KEV does not list it, and EPSS is low (0.20%, 10th percentile), consistent with a filesystem-parsing bug that requires a malicious volume rather than remote reach.
Deadlock in the Linux kernel NTFS driver allows local users with write access to an NTFS-mounted volume to render the system completely unresponsive by triggering an ABBA lock ordering race between concurrent VFS writeback paths. The vulnerability affects kernels since commit 6994acf33bae and manifests when inode writeback (acquiring extent_lock then mrec_lock) races with MFT folio writeback (holding mrec_lock while attempting extent_lock). No active exploitation has been confirmed - EPSS places this at the 10th percentile (0.20%) - reflecting the narrow real-world surface: production Linux systems rarely mount NTFS volumes. Patches are available in Linux 7.1.5 and 7.2-rc1.
Indefinite thread blocking in the Linux kernel's NTFS driver can cause a local denial of service on systems mounting NTFS volumes under memory pressure. Specifically, `get_nr_free_clusters()` and `__get_nr_free_mft_records()` allocate heap memory for a readahead state structure; if that allocation fails, neither `NVolFreeClusterKnown()` is set nor `vol->free_waitq` is woken, leaving any waiting kernel thread blocked indefinitely. Kernels prior to 7.1.5 and 7.2-rc1 are affected; no public exploit has been identified and EPSS is 0.20% (10th percentile).
Improper validation of NTFS index entries in the Linux kernel's NTFS filesystem driver allows a crafted or corrupted NTFS volume to be processed without adequate bounds checking during index root and index block reads. When an attacker-controlled NTFS image is mounted and traversed (lookup/readdir), missing per-read validation can lead to out-of-bounds memory access, enabling information disclosure or a kernel crash. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is not on the CISA KEV list.
Signed-integer overflow in the Linux kernel NTFS driver's mapping-pairs runlist parser lets a crafted or corrupted NTFS volume redirect logical-to-physical cluster mappings to unintended disk locations. The flaw affects the kernel's NTFS attribute parsing when it accumulates relative LCN deltas; a malicious runlist can set the accumulator to S64_MAX and add 1, triggering undefined behavior that resolves runs to a different set of physical clusters. Fixed upstream in Linux 7.1.5 and 7.2-rc1; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.20%).
Out-of-bounds memory access in the Linux kernel NTFS driver arises because resident $INDEX_ROOT attribute headers are consumed after lookup without fully validating their layout invariants. Affected are Linux kernels prior to the 7.1.5 and 7.2-rc1 stable fixes when mounting or accessing an attacker-crafted NTFS volume; unchecked entries_offset, index_length, and allocated_size fields let a malformed filesystem drive reads beyond the resident value, tagged upstream as Information Disclosure. This is not actively exploited (no CISA KEV entry) and EPSS is low at 0.20%, with no public exploit identified at time of analysis, though upstream stable commits are available.
The legacy NTFS driver in the Linux kernel fails to reject non-resident attribute records for attribute types contractually required to be resident, creating resident/non-resident union confusion paths in multiple critical code locations. Affected callers - including inode loading ($STANDARD_INFORMATION), volume flag updates ($VOLUME_INFORMATION), and directory traversal ($INDEX_ROOT) - read data.resident.value_offset directly without first verifying the a->non_resident flag, potentially acting on the wrong union member when a crafted or corrupted NTFS image is mounted. A local attacker with standard user privileges can exploit this to trigger kernel memory corruption or information disclosure; no active exploitation is confirmed (EPSS 0.20%, not in CISA KEV), and patches are available in Linux 7.1.5 and 7.2-rc1.
Improper validation of on-disk metadata in the Linux kernel's legacy NTFS driver allows a crafted NTFS filesystem image to smuggle an error-marked MFT (Master File Table) reference back through ntfs_lookup_inode_by_name(), causing directory-lookup callers to misinterpret corrupted disk data as a legitimate pseudo-errno. This affects systems that mount attacker-supplied NTFS volumes; there is no public exploit identified at time of analysis and the EPSS probability is low (0.20%). The upstream fix normalizes any error-marked reference to ERR_MREF(-EIO) so callers can no longer be tricked into consuming a bogus value.
Local volume corruption and a writeback deadlock affect the Linux kernel NTFS driver (fixed in 7.1.5 and 7.2-rc3) when a filesystem is mounted with the non-default show_sys_files option and userspace writes to an exposed base metadata file such as $Bitmap; because the cluster allocator scans $Bitmap through the same inode page cache, the write both corrupts the volume and deadlocks writeback against an already-locked folio. Only affected when the opt-in show_sys_files mount option is set, so this is a local integrity/availability issue rather than a remote one. There is no public exploit identified at time of analysis, EPSS is 0.20% (10th percentile), and it is not in CISA KEV.
Memory-safety flaw in the Linux kernel's legacy NTFS (read) driver lets a crafted NTFS filesystem image bypass a resident/non-resident attribute check in ntfs_map_runlist_nolock(). When the driver expects a non-resident attribute during mount, an attacker-supplied image can substitute a resident attribute; the code previously only flagged this with a non-fatal WARN_ON() and then read a->data.non_resident.highest_vcn from the wrong union member, corrupting the VCN range check. The fix replaces WARN_ON() with an -EIO return so the malicious image is rejected at mount. There is no public exploit identified at time of analysis, and EPSS is low (0.22%).
Memory corruption in the Linux kernel's MIPS scheduler corrupts kernel pointer state when CONFIG_CPUMASK_OFFSTACK is enabled, enabling local privilege escalation to root. Two compounding flaws exist: sizeof(new_mask) resolves to the pointer width (4-8 bytes on MIPS) rather than the actual cpumask buffer size, causing copy_from_user() to overwrite the mask pointer with user-controlled bytes; and the original code invoked copy_from_user() prior to allocating the mask buffer, creating a write-before-allocation primitive. CVSS 7.8 with AV:L/AC:L/PR:L/UI:N reflects straightforward local exploitation on affected MIPS systems, though EPSS at 0.21% (12th percentile), no CISA KEV listing, and no public exploit code indicate limited real-world exploitation activity at time of analysis.
Kernel memory corruption in the Linux kernel's MTD slram driver stems from a link-before-initialize race in `register_device()`, where new `slram_mtdlist` entries are inserted into the global device list before all required state (memory allocation, `memremap()`, and `mtd_device_register()`) is fully committed. When any of these subsequent operations fail, the partially initialized entry persists on the list, and later cleanup code dereferences or frees invalid kernel memory - enabling potential local privilege escalation from low-privileged access to full kernel compromise. EPSS is 0.22% (13th percentile), no CISA KEV listing exists, and no public exploit has been identified at time of analysis, collectively indicating low near-term exploitation likelihood despite the high CVSS score of 7.8.
Unbounded array indexing in the ocfs2 filesystem's ocfs2_sum_rightmost_rec() function causes UBSAN-detected kernel panic or memory corruption when a file write targets an inode whose embedded extent list has been corrupted on-disk. Linux kernels prior to 6.18.40 (stable 6.x branch) and 7.1.5 (7.x branch) are affected on any system mounting an ocfs2 volume. No public exploit has been identified at time of analysis and EPSS probability sits at 0.21% (11th percentile), reflecting realistically constrained exploitability due to the required on-disk corruption precondition.
Cache coherency corruption in the Linux kernel's OpenRISC architecture jump_label implementation leaves instruction cache lines on remote SMP cores stale after static key updates, meaning security-relevant kernel branches may execute the wrong code path indefinitely on affected multi-core OpenRISC systems. The flaw originates in commit 8c30b0018f9d, which ported jump_label support from arm64 without adapting icache invalidation to OpenRISC's SMP model - `kick_all_cpus_sync()` does not guarantee a full remote icache flush on this architecture. No public exploit has been identified at time of analysis, and the 0.21% EPSS score (11th percentile) reflects the severe rarity of OpenRISC SMP hardware in production.
Use-after-free in the Linux kernel TPM subsystem's tpm_buf_append_salt() function triggers automatic kernel memory corruption on systems equipped with asynchronous KPP cryptographic hardware backends. The defect fires continuously and without any userland action - the hwrng_fillfn kernel thread invokes the vulnerable code path on every entropy poll via tpm2_get_random → tpm2_start_auth_session → tpm_buf_append_salt, causing a deferred completion worker to dereference a freed kpp_request when the async backend returns -EINPROGRESS. No public exploit has been identified at time of analysis and EPSS is 0.20% (10th percentile), but the kernel-space use-after-free carries inherent privilege escalation and denial-of-service risk on affected hardware configurations.
Race condition in the Linux kernel's DesignWare eDMA (dw-edma) driver exposes DONE_INT_MASK and ABORT_INT_MASK interrupt registers to concurrent corruption when multiple DMA channels are started simultaneously. Systems running Linux kernel versions since commit 7e4b8a4fbe2c and equipped with DesignWare eDMA hardware - common in PCIe-attached peripherals and certain SoC platforms - are affected across stable branches from 6.1 through 7.1. No public exploit has been identified and EPSS sits at 0.21% (12th percentile), consistent with a hardware-specific driver flaw; however, the kernel maintainers have shipped patches across all active stable series, and remediation should be prioritized where this DMA controller is in use.
Initialization ordering flaw in the Linux kernel's Renesas RZ DMAC driver (rz-dmac) creates a race window during driver probe where a DMA interrupt fires before channel->ch_base is assigned and before the ld_free, ld_queue, and ld_active linked-list structures are initialized, leading to invalid kernel memory access, potential kernel crashes, or memory corruption on Renesas RZ SoC-based platforms. Affected systems run Linux 5.15 through the pre-patch stable releases; fixes are available across multiple upstream stable branches (6.6.148, 6.12.101, 7.1.5, 7.2-rc1). No public exploit exists, EPSS is 0.21% (11th percentile), and this CVE is not listed in the CISA KEV catalog.
Permanent I2C bus lockup in the Linux kernel i2c-imx driver (NXP i.MX SoCs) occurs when an SMBus block-read response returns a byte count of 0, a condition explicitly permitted by SMBus 3.1 specification section 6.5.7. The interrupt-driven state machine introduced in the v6.13 rework rejects count=0 with -EPROTO but critically fails to issue NACK+STOP before returning, leaving the target device holding SDA and the entire I2C bus permanently stuck until the controller is power-cycled. A secondary bug on the count > I2C_SMBUS_BLOCK_MAX error path exhibits the same failure mode. No public exploit or active exploitation is identified; vendor-released patches are available in kernel versions 6.18.40, 7.1.5, and 7.2-rc4.
Use-after-free in the Linux kernel's IPv4 TCP stack (net/ipv4/tcp_output.c) occurs when tcp_connect() reconciles conflicting TCP-MD5 and TCP-AO authentication keys on a socket that is already in TCP_SYN_SENT and hashed into the inet ehash. In the needs_ao branch, tcp_clear_md5_list() frees each tcp_md5sig_key and the md5sig_info container with bare kfree() before the RCU grace period, while softirq RX-path readers (__tcp_md5_do_lookup / __tcp_md5_do_lookup_exact) are still walking the same list under RCU, producing a per-key slab use-after-free. It affects kernels on the 6.18 line (and the described stable range) and is fixed by deferring frees with kfree_rcu; no public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile).
Kernel memory corruption (double free) in the Linux kernel's XFRM/IPsec NAT keepalive path allows a crash or potential heap exploitation when a keepalive transmission fails after the socket buffer has already been handed to the IPv4/IPv6 output stack. Introduced with the nat_keepalive feature in Linux 6.11 and affecting recent stable branches, nat_keepalive_send() incorrectly frees an skb that ip_build_and_send_pkt() or ip6_xmit() may already have consumed, producing a double free. EPSS is low (0.21%, 11th percentile), no public exploit has been identified, and it is not listed in CISA KEV; despite the auto-assigned 9.8 CVSS, realistic impact centers on denial of service and requires an IPsec NAT-traversal configuration.
Data corruption in the Linux kernel's spi-imx driver causes SPI bus transfers to produce malformed data when DMA initialization fails and the driver incorrectly falls back to PIO mode without resetting the ECSPI hardware configuration. Systems running NXP i.MX SoCs with ECSPI DMA declared in the device tree but without the sdma-imx7d.bin SDMA firmware are deterministically and silently affected on every transfer. Downstream security-critical devices connected to the affected SPI bus - such as the Infineon SLB9670 TPM - receive corrupted responses that can prevent device initialization entirely, eliminating TPM-based security services; no public exploit has been identified at time of analysis.
Undefined behavior in the Linux kernel's spi-uniphier SPI controller driver arises from a driver probe initialization ordering defect: devm_request_irq() is called before init_completion(), leaving a race window in which an early interrupt can invoke complete() on an uninitialized kernel completion object. Systems running Socionext UniPhier SoC hardware on affected kernel versions are exposed during driver probe. No public exploit has been identified and EPSS sits at 0.22% (13th percentile), consistent with the hardware-specific nature of the flaw - practical exploitation is constrained to platforms physically equipped with UniPhier SoCs.
Use-after-free of freed executable memory in the Linux kernel's io_uring/bpf-ops subsystem allows a local attacker with CAP_BPF and CAP_PERFMON capabilities to achieve arbitrary kernel code execution by registering the same io_uring_bpf_ops struct_ops map against multiple io_ring_ctx instances in sequence. The missing re-registration guard on ops->priv causes the first io_ring_ctx to be orphaned with a dangling ctx->loop_step function pointer into a freed BPF trampoline, which is invoked when io_uring_enter() is later called on that ring. No public exploit has been identified at time of analysis, and EPSS at 0.20% reflects low near-term mass-exploitation probability, though the primitive - controlled call into freed executable memory - is a classic kernel privilege escalation building block.
Incomplete cleanup in the Linux kernel's sparx5 Ethernet switch driver leaves a switchdev blocking notifier registered when workqueue allocation fails during initialization, creating a dangling callback that subsequent kernel network events can invoke against uninitialized driver state - enabling potential kernel memory corruption or privilege escalation on affected hardware. Systems running kernels from 5.14 through the unpatched stable branches on Microchip Sparx5 switch ASICs are affected; patches have been backported to five stable kernel series. No public exploit code exists and EPSS probability is 0.21% (12th percentile), though kernel-level C:H/I:H/A:H impact warrants prompt patching on any affected networking appliance.
Use-after-free in the Linux kernel's amdxdna DMA buffer memory mapping function exposes systems with AMD XDna AI accelerator hardware to local privilege escalation. When vm_insert_pages() fails inside amdxdna_gem_dmabuf_mmap(), the error path triggers drm_gem_object_put() twice on the same GEM object - once through the VMA close handler and again through the fall-through put_obj label - freeing the object and then accessing freed memory. EPSS sits at 0.21% (11th percentile) and the vulnerability is not listed in CISA KEV, indicating no known active exploitation; however, the CVSS 7.8 high score reflects the full C/H/I:H/A:H kernel memory corruption potential if successfully triggered locally.
Client pointer confusion in the Linux kernel's amdxdna DRM accelerator driver allows a local low-privileged user to trigger cross-process access to another process's hardware context and debug buffer objects via a misrouted SYNC_DIRECT_FROM_DEVICE ioctl. Systems running AMD XDNA NPU hardware (such as AMD Ryzen AI series processors) with the amdxdna kernel module loaded are affected across kernel versions from the driver's introduction up to the patched releases in 7.1.5 and 7.2-rc1. No public exploit exists and the EPSS score of 0.20% (10th percentile) reflects low near-term exploitation probability, though the CVSS 7.8 score correctly captures the high CIA impact should exploitation succeed.
Integer underflow in the Linux kernel's Intel VPU accelerator driver (accel/ivpu) allows a local low-privileged attacker to trigger out-of-bounds kernel memory reads and infinite loops via a malformed firmware log buffer. The vulnerability exists because fw_log_from_bo() never validates that log->size is at least log->header_size before fw_log_print_buffer() computes data_size = log->size - log->header_size - a u32 subtraction that wraps to near-U32_MAX, defeating the bounds checks from commit dd1311bcf0e6 and enabling fw_log_print_lines() to read far past the allocated BO region. No active exploitation is confirmed (not in CISA KEV), and EPSS is 0.21% (11th percentile), indicating low near-term exploitation likelihood despite the 7.1 CVSS score.
Use-after-free race condition in the Linux kernel's tracing/user_events subsystem allows a low-privileged local user to corrupt kernel heap memory during fork(), potentially enabling privilege escalation to root. The race is triggered when a multithreaded process concurrently unregisters a user event enabler while calling fork(), causing user_event_mm_dup() to dereference enabler and user_event structures freed without observing the required RCU grace period. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, the low privilege bar and full C/I/A impact make it a meaningful escalation primitive on any multi-user or shared Linux system running an unpatched kernel with CONFIG_USER_EVENTS enabled.
Header buffer corruption in the Linux kernel gve (Google Virtual Ethernet) driver's DQO RX datapath lets header bytes from one packet be copied onto another, and lets header buffers be re-posted while the device still owns them, when both header-split and HW-GRO are enabled with many concurrent flows. The gve driver is used by Google Cloud Platform Linux VMs, so exposure is limited to GCP guests running affected kernels with that specific offload configuration. There is no public exploit identified at time of analysis, EPSS is very low (0.20%), and the observed effect is roughly a 30% throughput drop with heavy TCP retransmissions rather than code execution.