Suse
Monthly
Data corruption in the Linux kernel's LoongArch memory management subsystem allows a local low-privileged user to cause silent loss of written data or potential exposure of stale page contents via a race condition between hardware page table walker behavior and software dirty-bit tracking. Affected systems are those running LoongArch CPUs with hardware PTW enabled - a condition that applies to the architecture by design - across kernel versions from 5.19 through stable branches prior to 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code exists and EPSS stands at 0.21% (11th percentile), though the bug was reliably reproduced via the LTP madvise09 test, confirming it is not theoretical.
Reference count underflow in the Linux kernel IPMI subsystem's handle_read_event_rsp() function enables local privilege escalation on server hardware with active IPMI interfaces. The flaw resides in the error-rollback path: when event delivery fails after successfully allocating receive messages for some users, the rollback incorrectly drops the user reference count twice - once through ipmi_free_recv_msg() and again through a now-stale explicit put - freeing an ipmi_user object that remains linked on intf->users. Subsequent event delivery then dereferences the freed object or trips refcount_t's addition-on-zero guard, enabling kernel memory corruption leading to full system compromise. No public exploit or CISA KEV listing exists; EPSS is 0.20% at the 10th percentile, consistent with no active exploitation at time of analysis.
Kernel memory disclosure and denial-of-service in the Linux kernel OrangeFS client affects systems mounting OrangeFS parallel filesystems, where fill_from_part() truncates a 64-bit directory-entry length into a __u32. An entry length near U32_MAX wraps to a small value that slips past the bounds check and is then used to index the directory part, causing an out-of-bounds read that oopses the kernel. The malformed trailer is supplied by the userspace OrangeFS client, and there is no public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and this is not in CISA KEV. Note: the input CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) conflicts with the description, which describes a local, client-supplied-data OOB read rather than remote unauthenticated code execution.
Memory corruption in the Linux kernel's compaction subsystem allows a local low-privileged attacker to trigger data corruption or potential privilege escalation by exploiting improper error handling in compaction_free(). The function ignores failure returns from free_pages_prepare(), causing hardware-poisoned pages (PageHWPoison) or bad pages (free_page_is_bad()) to be re-added to the compaction freepages list and subsequently reallocated to kernel or user structures. Exploitation requires low-privilege local access and is not confirmed actively exploited (absent from CISA KEV), with EPSS at a low 0.21% (11th percentile); vendor-released patches are available across multiple stable branches.
Memory-safety defect in the Linux kernel IPVS (IP Virtual Server) subsystem where __ip_vs_get_out_rt() calls skb_ensure_writable(), which can reallocate skb->head, leaving a stale IP-header pointer that is then dereferenced. Affected hosts are Linux systems acting as IPVS load balancers/directors; the flaw can lead to reads of freed/relocated packet memory (information disclosure) or kernel instability. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile); the upstream fix reloads the IP header after reallocation.
Out-of-bounds memory access in the Linux kernel's spufs (SPU filesystem) subsystem on PowerPC Cell Broadband Engine architectures allows a local low-privileged user to read or write beyond the SPU local store buffer via a flawed bounds check in `spufs_mem_mmap_access()`. The function computes the mmap offset correctly but validates it against `vma->vm_end` rather than `LS_SIZE`, causing the guard to never fire on 64-bit systems and leaving the length parameter unconstrained relative to the actual local store buffer. Vendor-released patches are confirmed across multiple stable kernel branches; no public exploit has been identified and EPSS is 0.21% at the 12th percentile.
PowerPC E500 systems running Linux kernel 7.0 through 7.1.4 and 7.2-rc4 silently lose kernel address-masking protection due to a compile-time preprocessor symbol typo - `CONFIG_E500` instead of `CONFIG_PPC_E500` - causing `mask_user_address_isel()` to be omitted from E500 builds entirely. A local low-privileged user on affected E500 hardware can exploit the absent address-masking primitive to achieve high-impact memory disclosure, integrity corruption, or denial of service against the kernel. No public exploit exists, EPSS is 0.19% (9th percentile), and this vulnerability is not in CISA KEV, indicating very limited current exploitation activity despite a CVSS score of 7.8.
Insufficient Multi-Link Element (MLE) common info length validation in the Linux kernel's IEEE 802.11 WiFi stack exposes adjacent-network attackers to high-impact memory corruption. Kernels from commit 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 onward failed to validate the advertised common-info length field for Reconfiguration and Priority Access MLE types - and also omitted the length octet when computing the minimum common size for Reconfiguration MLEs - meaning a malformed MLE frame crafted by a nearby attacker can trigger out-of-bounds access. The CVSS score of 8.8 (AV:A) and EPSS of 0.20% (10th percentile) together indicate high potential impact but no public exploit activity at time of analysis; no public exploit and no CISA KEV listing have been identified.
Wrong MTD geometry is applied in the Linux kernel's mchp23k256 SPI SRAM driver when the chip is matched via the SPI id-table rather than via Device Tree, potentially exposing or corrupting unintended SRAM address regions. The driver's probe function calls of_device_get_match_data() exclusively, causing any non-OF SPI modalias match to silently fall back to the default mchp23k256_caps structure regardless of which part was actually selected by the SPI id-table, leading to incorrect chip capacity and address geometry. No public exploit exists and EPSS places this at the 7th percentile (0.17%), but the C:H/I:H/A:H CVSS impact flags reflect that incorrect geometry can expose the entire SRAM contents or allow out-of-bounds writes on affected embedded systems.
Kernel memory corruption in the Linux MTD raw NAND driver for NXP LPC32xx SLC hardware arises because lpc32xx_xmit_dma() silently discards the return value of wait_for_completion_timeout(), treating an expired DMA transfer as successful. The timed-out DMA engine can continue accessing a scatterlist buffer after it has been unmapped and potentially reused by the NAND read/write path, creating a use-after-free condition in kernel space. Exploitation requires local access to an embedded Linux system built on LPC32xx silicon with NAND flash; no public exploit has been identified and EPSS probability sits at 0.18% (7th percentile), indicating limited real-world exploitation interest.
The BPF verifier in the Linux kernel incorrectly accepts constant negative offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF pointer accesses, enabling a local attacker with BPF program loading privileges to perform out-of-bounds kernel memory reads and writes by bypassing the boundary enforcement in __check_buffer_access(). The regression was introduced when commit 022ac0750883 moved constant pointer offsets from reg->off to reg->var_off without updating the corresponding validation logic, leaving a signedness blind spot that allows programs with negative var_off values to load and attach to raw tracepoints undetected. No public exploit code has been identified at time of analysis and the vulnerability is absent from the CISA KEV catalog, but the well-documented commit trail makes independent derivation feasible for a skilled kernel researcher.
The Linux kernel's binder IPC driver contains a use-after-clear bug in binder_transaction() where lsmctx.len is re-read after security_release_secctx() has already zeroed the field via memset, causing sg_buf_end_offset to be inflated by the full aligned LSM security context size on every transaction to a txn_security_ctx binder node. This allows BINDER_TYPE_PTR scatter-gather copies to overrun into bytes already populated with the secctx data, enabling LSM security context disclosure and potential kernel buffer corruption. No public exploit or CISA KEV listing exists at time of analysis; the EPSS score of 0.17% reflects low current exploitation probability, though the low-privilege local attack vector is meaningful on Android where binder IPC is the foundational IPC mechanism.
Improper credential context in the Linux kernel's in-kernel SMB3 server (ksmbd) allows an attacker with an open SMB handle to have SET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION FSCTL operations executed under the ksmbd worker's credentials instead of the credentials captured when the file was opened. Because the underlying VFS xattr, fallocate and fileattr helpers revalidate inode permissions, ownership and LSM policy against those worker credentials rather than the SMB handle's access mask, an attacker can corrupt or zero file data and alter file attributes beyond what their handle should permit (CVSS 9.1, I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not in CISA KEV; the upstream fix is merged into stable kernels.
Buffer overflow and missing locking in the Linux kernel's sun4i-ss PRNG driver expose local low-privilege users on AllWinner sun4i SoC hardware to potential kernel memory corruption and privilege escalation. Two distinct flaws exist: sun4i_ss_prng_seed() lacks mutual exclusion and accepts input without bounds checking, while sun4i_ss_prng_generate() truncates output length and fails to synchronize with hardware before reading bytes, producing cryptographically unreliable output. No public exploit has been identified, EPSS sits at 0.18% (8th percentile), and the kernel maintainers resolved the issue by removing the entire dead code block rather than patching individual bugs.
NULL pointer dereference in the Linux kernel's rxrpc subsystem allows a remote unauthenticated attacker to crash the kernel, causing a denial of service. The flaw exists in rxrpc_verify_data(), which skips allocating the rx_dec_buffer when the associated skb private length is zero, while its caller rxrpc_recvmsg_data() unconditionally assumes the buffer is populated after a successful return. A crafted RxRPC network packet with zero-length payload data can trigger this path, passing a NULL pointer to skb_copy_bits() and causing a kernel panic. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is very low at 0.16% (5th percentile), consistent with a niche kernel subsystem.
Memory corruption and use-after-free in the Linux kernel's AF_RXRPC subsystem (rxrpc) let a local process trigger a double-free and connection refcount underflow by reading an out-of-band challenge message with MSG_PEEK. Because rxrpc_recvmsg_oob() guards only the unlink from recvmsg_oobq under MSG_PEEK but always moves the skb onto pending_oobq, the same singly-referenced skb becomes linked into both a list and an rbtree that share storage, corrupting linkage and freeing the skb and its connection reference twice on socket close. The NVD-assigned CVSS is 9.8, but EPSS is only 0.15% (5th percentile) and there is no public exploit identified at time of analysis; the fix is upstream in the stable trees.
Memory corruption in the Linux kernel's rxrpc networking subsystem (rxgk/GSS Kerberos security class) affects kernels from 6.16 onward, where rxgk_issue_challenge() frees the page holding challenge content before a tracepoint reads the wire header (whdr) that still points into that freed page, creating a use-after-free. The flaw is patched in stable releases 6.18.40, 7.1.5 and 7.2-rc1, and is triggerable only where the rxrpc RxGK security class is active (primarily kAFS deployments). There is no public exploit identified at time of analysis, and the EPSS score is very low at 0.15% (5th percentile), indicating negligible observed exploitation interest.
Denial of service in the Linux kernel's rxrpc subsystem allows remote, unauthenticated attackers to trigger an infinite loop in rxrpc_recvmsg() by sending packets that populate the out-of-band (OOB) queue, which the wait condition fails to check. Systems exposing RxRPC endpoints - primarily AFS (Andrew File System) clients and servers - are affected from the introducing commit through Linux 7.1.4 and 6.18.39. No public exploit exists and EPSS sits at 0.15% (5th percentile), signaling negligible real-world exploitation probability; this is not listed in CISA KEV.
Null-pointer dereference in the Linux kernel's rxrpc subsystem allows a remote unauthenticated attacker to crash the kernel by sending a forged ACKALL control packet to an exposed rxrpc service. Affected systems run Linux from commit b341a0263b1b804d329f864c2dc24815364510ec through the fixes landed in stable releases 6.18.40 and 7.1.5; Linux 6.14 is explicitly confirmed affected. No public exploit has been identified and EPSS probability is very low at 0.15%, but the network-accessible, no-authentication attack path warrants immediate patching on any system actively serving rxrpc traffic.
Kernel panic via rxrpc protocol mishandling in the Linux kernel allows a network-positioned attacker to crash an AFS client system by sending a premature reply DATA packet before any request packets have been transmitted on a client call. The flaw resides in rxrpc_receiving_reply(), which fails to verify call exposure state before invoking rxrpc_rotate_tx_window() - a function whose do...while loop oopses on an empty transmit queue. Fixes have been backported to stable branches 7.1.5 and 6.18.40; no public exploit has been identified and EPSS exploitation probability is extremely low at 0.15% (5th percentile), indicating no known active exploitation.
Denial of service (and potential memory corruption) in the Linux kernel's AF_RXRPC networking stack stems from a double unlock in rxrpc_recvmsg() triggered while handling out-of-band (OOB) messages, affecting kernels from roughly 6.16 up to the fixed 6.18.40, 7.1.5 and 7.2-rc1 releases. Releasing an already-released lock corrupts kernel lock state and can crash the host or open a race window. No public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile).
Denial-of-service in the Linux kernel's AFS (Andrew File System) cache manager allows remote attackers to crash or destabilize systems running AFS by sending a crafted CB.InitCallBackState3 callback request that arrives without an associated server record. The CB.InitCallBackState3 handler failed to perform the null-check present in all other callback handlers, meaning an unexpected or spoofed callback packet lacking a peer-to-server mapping causes a kernel-level fault. No public exploits have been identified, and EPSS places exploitation probability at just 0.16% (5th percentile), reflecting the niche deployment footprint of AFS.
Improper bounds enforcement in the Linux kernel's accel/amdxdna driver allows a local low-privileged user to trigger a kernel-to-userspace copy that exceeds the application-provided buffer size via a crafted ioctl call. The root cause is that copy_to_user() was using the kernel's internal data size rather than the caller-supplied buffer size to bound the copy, enabling overflow into adjacent userspace memory and exposure of unintended kernel data. No public exploit exists and no active exploitation has been confirmed, but the CVSS vector (C:H/I:H) reflects a real dual-impact risk: confidentiality loss from kernel memory spillover and integrity loss from overwriting adjacent user-space structures.
Incorrect NULL-check ordering in the Linux kernel's crypto/ccp driver exposes AMD SEV-SNP systems to kernel memory corruption during Trusted I/O firmware initialization. On architectures without HASHED_PAGE_VIRTUAL, passing the return value of __snp_alloc_firmware_pages() directly to page_address() before checking for NULL causes page_address(NULL) to return a deterministic but invalid non-zero address, silently bypassing the allocation-failure guard and allowing sev_tsm_init_locked() to dereference garbage memory. Affected kernel versions span from commit 4be423572da1f4c1 through the patched releases (7.1.5, 7.2-rc1, 6.19); no public exploit identified at time of analysis, and EPSS is 0.16% (5th percentile), consistent with zero confirmed in-the-wild exploitation.
Out-of-bounds array access in the Linux kernel's nvme-pci driver crashes the kernel and prevents NVMe namespaces from appearing as /dev nodes on systems built without NUMA support (CONFIG_NUMA=n). The root cause is a signed-to-unsigned type mismatch: NUMA_NO_NODE (-1) is cast to UINT_MAX when passed through a parameter declared 'unsigned', causing nvme_setup_descriptor_pools() to index far beyond the bounds of the descriptor pool array (sized to nr_node_ids). No active exploitation has been identified (not in CISA KEV), and EPSS of 0.17% reflects negligible real-world exploitation probability, though the CONFIG_NUMA=n precondition significantly limits the exposed population to non-enterprise kernel builds.
Exclusive BPF maps in the Linux kernel can be inserted as inner maps within non-exclusive outer map-in-map structures, allowing any unrelated local BPF program to look up and mutate a map that is supposed to be bound exclusively to a single program by cryptographic hash. This bypasses the signed BPF loader's integrity guarantee - an adversary on a hostile host can rewrite the frozen metadata map contents that the loader has already validated against a signed hash. No public exploit is identified at time of analysis and EPSS is very low (0.18%), but the impact is high for environments relying on exclusive maps as a trust boundary.
Heap out-of-bounds write in the Linux kernel amdgpu DRM driver's `amdgpu_coredump()` function allows a local attacker with GPU access to corrupt kernel heap memory during a GPU reset event. The vulnerability affects Linux kernel versions containing commit eea85914d15b up to the fix commits, specifically Linux 7.1 stable and prior, on systems with AMD GPU hardware. A local user who can trigger or time a GPU ring timeout during an active GPU reset could exploit this heap corruption for potential privilege escalation; however, no public exploit exists and EPSS probability is 0.15% (5th percentile), indicating limited real-world exploitation activity at time of analysis.
Race condition in the kernfs xattr subsystem of Linux kernel 7.1 and earlier allows local low-privileged users to corrupt shared xattr structures across multiple superblocks, resulting in high-impact confidentiality, integrity, and availability compromise. The flaw arises specifically in namespace-multiplexed environments where kernfs_test_super() allows distinct superblocks to share a single kernfs_node while VFS locking remains per-inode and therefore insufficient. No public exploit has been identified at time of analysis; EPSS probability is 0.15% (5th percentile), indicating that despite the high CVSS score, widespread exploitation is currently assessed as unlikely.
Heap buffer overflow in the Linux kernel wcn36xx WiFi driver allows an adjacent-network attacker without authentication to corrupt kernel heap memory with firmware-controlled content. The vulnerability exists in the synchronous HAL response dispatcher for Qualcomm WCN36xx chipsets, which copies all firmware responses into a fixed 4096-byte buffer without first validating response length. Successful exploitation from an adjacent network position yields high confidentiality, integrity, and availability impact - consistent with potential kernel code execution. EPSS is low at 0.19% and no active exploitation is confirmed, but the lack of authentication requirement and network-adjacent reachability elevate real-world concern for affected embedded and mobile platforms. Patches are available across multiple stable kernel branches.
Use-after-free in the Linux kernel iommufd subsystem allows a local low-privileged attacker on IOMMU-enabled systems to corrupt kernel memory by triggering dmabuf invalidation callbacks against already-destroyed page structures during detach. Affected configurations include virtualization hosts using VFIO or vDPA device passthrough where the iommufd framework is active. The CVSS S:C (Changed Scope) rating reflects the potential for cross-workload impact in multi-tenant environments; no public exploit identified at time of analysis, and EPSS at 0.15% (5th percentile) indicates negligible observed exploitation activity.
Incorrect file-handle hashing in the Linux kernel's lockd (NLM) server causes NLMv4 lock-state lookups to fail intermittently. When a client presents an NFS file handle shorter than LOCKD_FH_HASH_SIZE (32 bytes), file_hash() digests stale bytes left in the argument buffer from a prior request, so the same wire handle hashes into different nlm_files[] buckets across calls and nlm_lookup_file() misses existing lock records. This is a functional-correctness and reliability defect introduced by commit 3de744ee4e45 during the xdrgen NLMv4 TEST conversion; a vendor patch is available, EPSS is low (0.15%), and there is no public exploit identified at time of analysis and no CISA KEV listing.
Guest kernel crash in the Linux virtio RTC driver occurs during device restore when stale virtqueues are not cleaned up before reinitialization. Systems running virtual machines with a virtio-rtc device exposed are affected across Linux kernel versions up to 6.18.40 and 7.1.5 stable series. A local low-privileged user on the guest who triggers a suspend/resume cycle under conditions where virtqueue reinitialization fails can dereference a NULL info pointer in vp_del_vq(), panicking the guest kernel. No public exploit is identified at time of analysis, and EPSS of 0.17% (6th percentile) confirms exploitation is not currently widespread.
Incorrect IRQ-to-ring mapping in the Linux kernel's vdpa/octeon_ep driver mishandles interrupt routing on Marvell OCTEON EP devices that expose non-contiguous or non-zero-based IRQ numbers, causing the interrupt handler to index the wrong virtqueue ring. Only systems with OCTEON EP hardware using the vDPA data path are affected, and the fix ships in stable kernels 6.18.40, 7.1.5, and 7.2-rc1. There is no public exploit identified at time of analysis, EPSS is very low (0.17%, 6th percentile), and the published 10.0 CVSS vector is inconsistent with the local, hardware-specific nature of the flaw.
Out-of-bounds write in the Linux kernel's vfio/qat driver allows a local low-privileged user with access to the Intel QuickAssist Technology virtual function migration interface to corrupt kernel memory through a race condition. The root cause is a Time-of-Check Time-of-Use flaw in qat_vf_resume_write(), where two concurrent writers can both pass the filp->f_pos boundary check before the lock is held, causing the second writer to copy data past the end of the migration-state buffer once the first writer has already advanced the file position. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% at the 6th percentile reflects low current exploitation probability; vendor-released patches are available in stable kernel series 6.12.97, 6.18.40, and 7.1.5.
Incorrect teardown ordering in the Linux kernel's netkit queue lease subsystem allows a local attacker with low privileges to trigger a race window where live NAPI polling consumes net_iov entries whose DMA addresses have already been cleared, causing the physical NIC to DMA to a stale or zero address. Affected kernel versions span from the introducing commit 5602ad61ebee through the 7.1 stable series, with fixes landing in 7.1.5 and 7.2-rc1. No public exploit code exists and EPSS probability stands at 0.15%, but the S:C scope change in the CVSS vector signals that successful exploitation can corrupt memory beyond the vulnerable process boundary, potentially enabling privilege escalation.
Improper error-path cleanup in the Linux kernel's Marvell OcteonTX crypto hardware-accelerator driver (crypto/marvell/octeontx) mishandles DMA unmapping: on a mapping failure the sg_cleanup loop indexes list[i] instead of list[j], leaking successfully mapped scatter-gather entries while repeatedly unmapping the already-failed one. Only systems with Marvell OcteonTX crypto hardware and this driver loaded are affected. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile) and the issue is not in CISA KEV.
Out-of-bounds kernel memory access in the Linux kernel CXL (Compute Express Link) region driver allows a local attacker on systems equipped with CXL memory hardware to corrupt kernel memory by causing cxl_cancel_auto_attach() to use a negative errno value as an array index into p->targets[]. The flaw originates when cxl_region_sort_targets() fails - setting cxled->pos to a negative errno - and that invalid index is later used directly without validation. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.15% at the 5th percentile, reflecting very low real-world exploitation probability consistent with the niche CXL hardware requirement.
Use-after-free in the Linux kernel's ksmbd in-kernel SMB server allows a low-privileged authenticated SMB client to dereference freed kernel memory, potentially achieving arbitrary kernel-level code execution or sensitive information disclosure. The race condition exists between `same_client_has_lease()` releasing `ci->m_lock` without holding a reference on the returned `opinfo` pointer and a concurrent SMB CLOSE operation freeing that same object. Affected kernels span the 5.15 through 7.1 stable series; patches are confirmed available across all branches. No public exploit code or CISA KEV listing has been identified at time of analysis, and an EPSS of 0.18% (8th percentile) indicates no currently observed widespread exploitation.
Use-after-free in the Linux kernel staging nvec driver's nvec_rx_completed() function exposes Tegra-based systems to potential kernel memory corruption. The flaw arises from a TOCTOU race: nvec_msg_free() releases a message pool slot atomically, but the immediately following read of nvec->rx->data[0] occurs after that release - allowing a concurrent nvec_msg_alloc() to reclaim and overwrite the same slot. No public exploit has been identified at time of analysis, and the very low EPSS score (0.18%, 8th percentile) reflects the niche Tegra hardware prerequisite and staging driver context. Fixed commits are available across multiple stable kernel branches.
Shift-out-of-bounds undefined behavior in the Linux kernel's MAX3421E USB host controller driver (`max3421-hcd`) allows a local low-privileged user with access to the raw USB device node to corrupt kernel hub state. The `max3421_hub_control()` function blindly shifts the integer constant 1 left by an attacker-controlled `wValue` field without bounds-checking, so any value ≥ 32 invokes undefined behavior that arbitrarily corrupts `max3421_hcd->port_status`, including immutable change bits that gate internal state transitions. No public exploit exists and this CVE is not in the CISA KEV catalog; EPSS at 0.25% (16th percentile) reflects low exploitation likelihood, but the CVSS 7.8 is grounded in a genuine local privilege-escalation primitive within the kernel USB subsystem.
Double-decrement of the descriptor_busy reference counter in the Linux kernel's GPIB driver re-introduces a use-after-free condition that a prior security patch (commit d1857f8296dc) was specifically designed to prevent. Affected kernels include the 6.18.22-6.18.39 range and Linux 7.0, with patched releases available at 6.18.40, 7.1.5, and 7.2-rc1. Exploitation requires a local low-privilege account and access to GPIB device nodes; no public exploit code has been identified at time of analysis, and the EPSS score of 0.19% reflects negligible observed exploitation activity.
Out-of-bounds memory access in the Linux kernel's xilinx-ams IIO ADC driver allows a local low-privileged user to corrupt kernel memory through malformed event handling in ams_handle_event(). Affected versions span multiple stable kernel branches beginning with the commit that introduced the xilinx-ams driver, with the flaw present from Linux 5.17 onward across the 6.1, 6.6, 6.12, 6.18, and 7.1 stable series. No public exploit exists and EPSS sits at 0.18% (8th percentile), though vendor-released patches are confirmed across six stable branches and the CVSS 7.8 score reflects genuine kernel memory corruption potential on affected Xilinx hardware platforms.
Uninitialized kernel memory read in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3) allows a low-privileged local user to potentially leak sensitive kernel memory contents via a crafted or specially structured NTFS file. The flaw manifests in ni_seek_data_or_hole() when run_lookup() fails to locate the target VCN in runs[0], causing attr_data_get_block_locked() to exit prematurely without initializing the lcn variable - a KMSAN-confirmed uninit-value read triggered through the ntfs_llseek/vfs_llseek call chain. No public exploit exists at time of analysis (EPSS 0.20%, 10th percentile) and this is not listed in CISA KEV, indicating low active exploitation risk despite the CVSS 7.1 base score.
Heap buffer overflow in the Linux kernel ntfs3 filesystem driver's log_replay() function allows a local authenticated user to corrupt kernel heap memory by mounting a dirty NTFS volume whose on-disk log page size exceeds the host PAGE_SIZE. The one_page_buf scratch buffer is allocated using the host page size but never resized when a larger on-disk page size is adopted from the restart area, causing read_log_page() to write beyond the allocation boundary. No public exploit code exists, EPSS is 0.18% (7th percentile), and this is not listed in the CISA KEV catalog, placing current exploitation probability very low despite a CVSS 7.8 base score.
Resource exhaustion in the Linux kernel's xprtrdma (RDMA transport for NFS/RPC) subsystem allows a malicious or compromised RDMA peer to trigger unbounded Receive Work Request allocation, causing denial of service on affected systems. The flaw exists in rpcrdma_reply_handler(), where the credit clamp is bypassed for replies matching no pending request (unknown XID), and rpcrdma_post_recvs() then allocates WRs past re_max_requests without bound. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), reflecting the niche RDMA deployment context. Patches are available across multiple stable kernel branches.
Race condition in the Linux kernel AppArmor unix socket mediation subsystem exposes systems with peer path-based AppArmor rules to a use-after-free scenario, enabling a local low-privileged user to potentially escalate privileges and achieve full compromise of confidentiality, integrity, and availability. The flaw involves accessing a peer unix socket's path (`peer_path`) outside the kernel socket state lock, creating a window for concurrent execution of `unix_release_sock()` to free the referenced path while AppArmor reads it. No public exploit code exists and the EPSS score sits at a low 0.17% (7th percentile), but the NVD-assigned CVSS scope change (S:C) reflects that successful exploitation could reach kernel-level components beyond the attacking process.
Reference count leak in the Linux kernel AppArmor security module allows a local low-privileged user to trigger use-after-free conditions via a bug in update_sk_ctx() socket context management, potentially achieving privilege escalation with high confidentiality, integrity, and availability impact. The fix, backported across stable branches (6.18.40, 7.1.5, 7.2-rc1), corrects the unconditional plabel reference put in the caller by adding a compensating reference acquisition. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation probability.
AppArmor's aa_change_profile() in the Linux kernel dereferences a potentially NULL or ERR_PTR label value before the existing IS_ERR_OR_NULL() guard is reached, allowing a local low-privilege attacker to trigger a kernel crash or kernel memory disclosure. Affected are kernel versions from the introducing commit e00b02bb6ac2a1893227ce8014b649028d6425d2 through multiple stable branches, with vendor-released patches confirmed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 7.1.5, and 7.2-rc1. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) reflects minimal current exploitation interest.
Resource leak in Linux kernel AppArmor's aa_label_alloc() function exposes local attackers with low privileges to potential privilege escalation. When proxy allocation fails during label creation, the error path bypasses aa_label_free(), leaving the security identifier (secid) and other label resources unreleased. No public exploit has been identified at time of analysis, and EPSS at 0.18% (8th percentile) reflects low near-term exploitation probability, though the C:H/I:H/A:H CVSS impact ratings signal meaningful consequence if exploited.
Kernel page fault in Linux kernel AppArmor's file auditing path allows a local low-privileged user to crash the system or leak kernel memory via the audit log. The regression was introduced by commit 4a134723f9f1, which left the *name pointer uninitialized when path->dentry is the aa_null sentinel, then passed it to audit_log_untrustedstring() where strlen() dereferences an invalid address. No public exploit code exists and EPSS probability is 0.17% (7th percentile), but patched stable releases 6.18.40, 7.1.5, and 7.2-rc1 are confirmed available.
Denial-of-service (and potential use-after-free) in the Linux kernel's xfrm/IPsec state-cache logic lets a stale state be inserted into the input-path cache because the state's validity is checked before the global xfrm_state_lock is taken. In the window between the check and the lock, a concurrent operation can kill the state, so a dead (freed-path) state gets cached and later dereferenced on the IPsec input path. Despite an auto-generated 9.8 CVSS, real-world signals are modest: EPSS is 0.21% (11th percentile), the issue is tagged Denial of Service, it is not in CISA KEV, and no public exploit was identified at time of analysis.
Out-of-bounds kernel memory corruption in the QCOM USB audio ALSA driver (`sound/usb/qcom/`) allows a local unprivileged user to corrupt kernel slab memory or trigger a kernel oops by sending a crafted stream-disable request over AF_QIPCRTR. The disable path in `handle_uaudio_stream_req()` fails to guard against a negative index returned by `info_idx_from_ifnum()`, an invariant violation that the enable path already handles - resulting in a wild-pointer dereference when the card has never been enabled, or an out-of-bounds 4-byte slab write when it has. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low-complexity local exploit path on QCOM-equipped systems warrants prompt patching.
Improper packet-header validation in the Linux kernel's netfilter flowtable IP6IP6 tunnel fast path was corrected by switching nf_flow_ip6_tunnel_proto() from skb_header_pointer() to pskb_may_pull(), guaranteeing the outer IPv6 header is actually present in the skb before the offload path dereferences it. The flaw affects hosts using netfilter flowtable hardware/software offload with IP6IP6 tunnel encapsulation, where a malformed encapsulated packet could be processed against a header not fully pulled into the linear buffer. No public exploit identified at time of analysis; not listed in CISA KEV, and EPSS is low (0.20%, 10th percentile).
Type confusion in the Linux kernel's IPv6 In-situ OAM (IOAM) lightweight-tunnel code lets a crafted IOAM route trigger an invalid cast in rt6_get_cookie(), which reads struct rt6_info fields out of a dummy dst_entry that was only ever a bare struct dst_entry embedded in ioam6_lwt. This CWE-843-class flaw affects kernels from 6.16 up to the fixed releases and can produce an invalid pointer access when the aliased sernum/reset_ts field reaches zero. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and the issue is not in CISA KEV, so it reads as a memory-safety/DoS-grade bug rather than a broadly weaponized RCE despite the 9.8 NVD score.
Stack type confusion in the Linux kernel BPF verifier allows a local attacker to bypass non-scalar pointer spill validation and treat a live kernel pointer slot as an ordinary scalar stack read. Affected are Linux 7.1 stable series prior to commit 0f9278b22cda and mainline prior to 3a354149bcea, with fixes confirmed in Linux 7.1.5 and 7.2-rc1. Successful exploitation permits full kernel memory read and write access, enabling local privilege escalation; no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Linux kernel's in-kernel SMB server (ksmbd) lets a remote client that opens an SMB connection race two concurrent SMB2 NEGOTIATE requests to trigger a slab UAF read of the shared conn->preauth_info structure (kmalloc-96). The response send path smb3_preauth_hash_rsp() reads and dereferences conn->preauth_info->Preauth_HashValue without holding conn_lock, so one worker can free the object on the failing-negotiate path while another reads it - a window a bare NULL check cannot close. Exploitation is pre-authentication over the network but requires ksmbd to be actively serving shares plus precise timing; EPSS is low (0.21%, 12th percentile), it is not on CISA KEV, and no public exploit identified at time of analysis.
Out-of-bounds memory access in the Linux kernel netfilter flowtable subsystem allows malformed IPv4 packets to overrun header-size calculations in nf_flow_ip4_tunnel_proto(), affecting systems that use nftables flowtable offload with IP tunnel processing. The bug stems from consuming the untrusted iph->ihl field without validation before computing header size. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not on CISA KEV; despite the CNA's 9.8 rating, real-world impact is most consistent with a denial-of-service kernel crash on a non-default configuration.
Guest memory corruption in the Linux kernel's s390 (IBM Z) memory-management code, where mishandling of the _PAGE_UNUSED software PTE bit causes in-use KVM guest pages to be discarded as if unused. On s390 KVM hosts running kernels before 7.1.5 (and 7.2-rc series before the fix), the bit set by KVM on unmapped guest pages was not cleared by all PTE-setting paths, so a page returned to use could later be silently dropped - corrupting guest state. There is no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and it is not in CISA KEV.
Use-after-free in the Linux kernel mxl862xx DSA driver exposes systems running MaxLinear MXL862xx Ethernet switches to local privilege escalation via kernel heap corruption. The race condition between the MDIO CRC error work handler and driver teardown allows freed dsa_port objects to be dereferenced if a CRC error is scheduled during the narrow window between MXL862XX_FLAG_WORK_STOPPED being set and dsa_unregister_switch() completing. EPSS is 0.20% (10th percentile) with no CISA KEV listing, reflecting niche hardware dependency and low broad exploitation interest.
Incorrect bounds validation in the Linux kernel's octeontx2-af driver allows a local attacker with low privileges to trigger a kernel-level flaw by issuing a crafted devlink command that sets NIX maximum LFs before any PF/VF assignment, bypassing the faulty assignment-check condition. Systems running Marvell OcteonTX2 SoC hardware with the octeontx2-af driver loaded are affected across multiple stable kernel branches originating from commit dd7842878633453e38d6a4927593dd28b9d8ab91. EPSS exploitation probability is very low at 0.21% (11th percentile), no public exploit code has been identified, and this vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds kernel memory read in the Linux kernel's GENEVE tunnel GRO path (drivers/net/geneve.c) affects tunnels that have not enabled the IFLA_GENEVE_GRO_HINT feature - which is the default. geneve_gro_complete() honours an attacker-supplied GRO hint option unconditionally while geneve_gro_receive() ignores it, so the two paths disagree and dispatch the inner gro_complete handler at an unvalidated offset (nhoff + gh_len), reading past the skb head. Confirmed via a KASAN slab-out-of-bounds report in ipv6_gro_complete; there is no public exploit identified at time of analysis and EPSS is low (0.16%).
Out-of-bounds access in the Linux kernel's GENEVE tunnel GRO (Generic Receive Offload) path affects systems using GENEVE overlay networking, where geneve_gro_complete() can re-derive an inner dispatch offset that disagrees with what geneve_gro_receive() recorded - either through a race with geneve_quiesce()/geneve_unquiesce() flipping gs->gro_hint, or through re-read option bytes differing from the parsed ones - and complete GRO past the validated inner network header. Successful triggering leads to memory-safety corruption in softirq packet processing, most plausibly a kernel crash (denial of service). This is fixed upstream; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds array access in the Linux kernel's NXP ENETC Ethernet driver (net/ethernet/freescale/enetc) occurs on the XDP_REDIRECT transmit path when an xdp_frame carries a number of fragments greater than or equal to ENETC_MAX_SKB_FRAGS, overrunning the fixed-size xdp_redirect_arr buffer-descriptor array. Affected are systems using NXP/Freescale ENETC MACs (e.g., LS1028A-class SoCs) with an XDP program that performs redirect on multi-buffer frames, introduced in 5.13 and fixed across current stable branches. No public exploit identified at time of analysis, and EPSS is low (0.21%, 12th percentile), consistent with a driver-specific memory-safety bug rather than a broadly exploited flaw.
Hardware protection bypass in the Linux kernel's PMBus hwmon driver silently discards concurrent regulator fault events, preventing hw_protection_trigger() from firing when multiple power faults coincide. Systems running affected kernel versions (6.6.143-6.6.145, 6.12.92-6.12.97, 6.18.21-6.18.40, 6.19.11-6.20, 7.0-7.1.4) with PMBus-managed power rails may fail to respond to simultaneous under-voltage and over-current events, leaving hardware operating without critical protection. No public exploit has been identified; EPSS of 0.22% (13th percentile) and absence from CISA KEV confirm this is not actively exploited.
Memory corruption (use-after-free) in the Linux kernel's fbnic Ethernet driver occurs on the transmit path when fbnic_tx_lso() caches a pointer into the skb shared-info region and then calls skb_cow_head(), which may reallocate the skb and free the original buffer. Any host equipped with Meta's fbnic NIC that transmits large-segmentation-offload (LSO/TSO) traffic can trigger a slab-use-after-free, reading freed skbuff memory and potentially crashing the kernel. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%), and the issue is not in CISA KEV.
Integer underflow in the ksmbd in-kernel SMB3 server's DACL parsing logic allows authenticated remote SMB clients to bypass ACE count validation, driving large kernel heap allocations. The flaw exists in parse_dacl(), where subtracting sizeof(struct smb_acl) from an attacker-controlled 16-bit DACL size using unsigned arithmetic wraps to a large size_t when the DACL size is smaller than the header, permitting an ACE count of up to 0xffff to pass the guard unchecked. No public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) indicates minimal current exploitation activity, though upstream kernel patches confirm vendor acknowledgment and the attack path is fully documented in the fix commit.
A use-after-free in the Linux kernel's in-kernel SMB3 server (ksmbd) durable-handle path lets a concurrent SMB2 durable reconnect (DH2C/DHnC) read the freed fp->owner.name buffer via strcmp() in ksmbd_vfs_compare_durable_owner(), as caught by KASAN. Only systems that enable and export shares over ksmbd are affected, and exploitation requires winning a tight race between two reconnects on the same persistent_id. No public exploit identified at time of analysis, and EPSS is low (0.21%), consistent with a hard-to-time kernel race rather than a turnkey remote exploit despite the 9.8 input score.
Incorrect error code propagation in the Linux kernel's AFS (Andrew File System) subsystem allows a remote attacker capable of influencing AFS Volume Location server responses to trigger incorrect error handling in `afs_extract_vl_addrs()`, potentially causing availability impact on affected kernels. Systems running AFS-enabled Linux kernels from version 4.20 through the unpatched stable branches are affected, with all known impact limited to availability (C:N/I:N in CVSS). No public exploit code exists and this vulnerability is not listed in CISA KEV; EPSS probability is 0.22%, consistent with low current exploitation interest.
Race condition in the Linux kernel's AFS (Andrew File System) subsystem allows local low-privileged users to corrupt kernel memory by exploiting unsynchronized writes to net->cells_dyn_ino, with potential for privilege escalation to root. The flaw exists because cell lifecycle operations modified shared kernel state without holding net->cells_lock exclusively, and RCU cleanup context constraints in afs_cell_destroy() prevented a straightforward fix - requiring cell removal to be relocated to afs_destroy_cell_work() in a workqueue context. No public exploit exists and EPSS sits at 0.21% (11th percentile), though the 7.8 CVSS score is technically justified by the potential kernel-level impact on affected configurations.
Integer overflow in the Linux kernel minix filesystem driver allows a local low-privileged user to crash the kernel by mounting a crafted Minix v3 image. The minix_blocks_needed() helper uses DIV_ROUND_UP() in unsigned int arithmetic; an image with s_ninodes or s_zones set near UINT_MAX causes the addition to wrap to zero, tricking minix_check_superblock() into accepting an invalid zero bitmap-block count, after which minix_fill_super() dereferences the unallocated s_imap[0] or s_zmap[0] pointer and panics the kernel. No public exploit identified at time of analysis; EPSS is 0.21% (11th percentile), reflecting very low exploitation probability consistent with a legacy, rarely-used filesystem driver.
Double-unlock of an inode's rwsem in the Linux kernel cachefiles subsystem corrupts kernel locking state when start_creating() fails with ENOMEM during directory creation. Local attackers with low-privilege access on systems using network filesystem caching via cachefiles can exploit the corrupted rwsem to achieve privilege escalation or kernel crash, reflecting the high CIA impact in the CVSS 7.8 score. No public exploit has been identified and EPSS is very low (0.20%, 10th percentile), but upstream patches are confirmed available via the kernel stable tree.
Unsigned integer underflow in the Linux kernel iomap writeback subsystem allows a low-privileged user to corrupt filesystem EOF metadata and on-disk size tracking. The flaw occurs in the io_size EOF trim path when a concurrent truncate shrinks the file after end_pos is sampled, causing end_pos to fall below ioend->io_offset; the resulting negative subtraction wraps to a huge value in the size_t io_size field. This corrupted io_size is then consumed by end_io paths for decisions including on-disk EOF updates, unwritten extent completion, and COW range handling. No public exploit has been identified at time of analysis, and EPSS is very low at 0.21% (11th percentile), though the official CVSS scores this 8.8 High with full C/I/A impact.
Improper handling of asynchronous fscache cache-object creation in the Linux kernel's netfs subsystem affects kernels from 6.11 up to the fixed 6.18.40, 7.1.5 and 7.2-rc2 releases. In netfs_create_write_req(), caching is skipped when the fscache cookie appears disabled, but a still-in-progress async cache object may not yet have enabled it, causing fscache_begin_write_operation() to be bypassed and write operations to the local cache to be mishandled. The issue is a local netfs/fscache correctness bug (tagged Information Disclosure); it is not remotely reachable, and there is no public exploit identified at time of analysis.
Improper error handling in the Linux kernel's netfs (network filesystem) subsystem allows a local user with low privileges to corrupt kernel folio state or trigger a kernel hang. The writeback_iter() loop fails to re-invoke itself with the error code set when a write operation fails, leaving folios unlocked and non-redirtied, which produces incorrect iteration state with high integrity and availability consequences. No public exploit code has been identified, and EPSS places exploitation probability at 0.21% (11th percentile), consistent with a constrained local kernel defect rather than a broadly weaponized vulnerability.
Invalid cursor access in the Linux kernel's Intel Xe GPU (drm/xe) page table subsystem allows local low-privileged users to trigger kernel warnings and potentially exploit uninitialized memory during page table binding walks involving purged buffer objects. Affected kernel versions span Linux 7.1 up to the fix points in 7.1.5 and 7.2-rc2, and only systems equipped with Intel Xe GPU hardware are at risk. No public exploit identified at time of analysis; EPSS at 0.20% (10th percentile) reflects minimal current exploitation interest, though the kernel memory-management context elevates the theoretical impact ceiling.
Context confusion in the Linux kernel's uprobes/x86 subsystem allows a local attacker with low privileges to trigger incorrect VMA lookups by exploiting the use of `current->mm` (the tracer's memory map) instead of the traced process's `mm_struct` during uprobe unregistration. Affected are kernel versions in the 6.18.x, 7.1.x, and pre-rc2 7.2 branches originating from commit ba2bfc97b462. Patches are confirmed in 6.18.40, 7.1.5, and 7.2-rc2; no public exploit code has been identified and the vulnerability is not listed in CISA KEV, with EPSS at a low 0.21% (11th percentile).
Credit resource leak in the Linux kernel CIFS client function cifs_issue_read() enables a server-side actor to exhaust the SMB flow-control credit pool on a connected Linux host, producing a denial of service for all I/O on the affected CIFS mount. Linux kernel versions from commit 69c3c023af25edb5433a2db824d3e7cc328f0183 onward are affected until stable-tree patches landing in 6.12.97, 6.18.40, 7.1.5, and 7.2-rc2. No public exploit identified at time of analysis; EPSS of 0.21% (11th percentile) confirms very low real-world exploitation probability and no CISA KEV listing exists.
Use-after-free in the Linux kernel's legacy NTFS filesystem driver (ntfs_mft_writepages) allows a local low-privileged attacker to corrupt kernel slab memory by winning a timing race between MFT writeback and concurrent MFT allocation extension. Affected kernels span the Linux 7.1 stable series up through 7.1.4; fix commits are confirmed in the upstream stable tree targeting 7.1.5 and 7.2-rc3. No public exploit is identified at time of analysis and EPSS is low (0.20%), but the confirmed slab-use-after-free in ring-0 writeback code represents a high-severity memory safety defect warranting scheduled patching.
Use-after-free race condition in the Linux kernel's legacy NTFS driver (ntfs.ko) exposes systems with NTFS-mounted volumes to kernel heap memory corruption, enabling local privilege escalation, information disclosure, or kernel panic. The flaw in ntfs_attr_fallocate() releases a read lock before consuming a borrowed runlist pointer, while a concurrent mmap page_mkwrite path can simultaneously reallocate and free the underlying array - confirmed by a KASAN slab-use-after-free trace in the CVE description. No public exploit or CISA KEV entry exists; EPSS of 0.20% (10th percentile) reflects the difficulty of reliably winning this race, though successful exploitation carries severe kernel-level impact.
Kernel crash via bad memory access in the mlx5e traffic control peer flow cleanup path affects Linux systems running Mellanox/NVIDIA mlx5 NICs in LAG (Link Aggregation Group) mode. When mlx5_lag_get_dev_seq() returns an error during device teardown - because the peer is absent from the LAG or no master device is marked - the driver proceeds to dereference an invalid pointer in mlx5e_tc_del_fdb_peers_flow, causing a kernel panic. No public exploit exists and EPSS is 0.20% (10th percentile), but the crash is deterministically reproducible on affected hardware configurations during device removal or driver teardown sequences.
Race condition in the Linux kernel's Microchip VCAP network driver corrupts hardware forwarding table entries on systems using sparx5 or lan969x switching ASICs. A local authenticated user can simultaneously trigger a debugfs VCAP rule dump and a tc-flower rule write to different Super VCAP instances, causing shared cache registers to be overwritten mid-transaction and committing corrupt data directly into hardware forwarding entries. No public exploit code or CISA KEV listing exists; EPSS is 0.21%, reflecting low exploitation likelihood in practice.
Use-after-free race condition in the Linux kernel's AMD XDNA accelerator driver (accel/amdxdna) allows a local, low-privileged attacker on systems with AMD XDNA hardware to corrupt kernel memory, potentially achieving full privilege escalation. The race window opens because amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove() before removing the object from abo->mem.umap_list, permitting aie2_populate_range() to obtain a stale reference concurrently. No public exploit has been identified at time of analysis, and an EPSS of 0.21% (11th percentile) signals minimal current exploitation interest.
Out-of-bounds array indexing in the Linux kernel's KVM irqfd routing for LoongArch allows a local user with KVM access to index past the routing table's chip array boundary, potentially exposing host kernel memory or enabling a hypervisor boundary breach with full triad impact. Patches are available in stable releases 6.18.40, 7.1.5, and 7.2-rc1 across three upstream commits. No public exploit code exists and EPSS sits at 0.21% (11th percentile), indicating negligible active exploitation probability despite the elevated CVSS 8.8 score.
Missing interrupt request (IRQ) validity checking in the LoongArch KVM subsystem of the Linux kernel allows a local low-privileged user with access to KVM device nodes to pass malformed IRQ values via the kvm_vcpu_ioctl_interrupt() ioctl, potentially causing memory corruption or privilege escalation that crosses the guest-to-host boundary. The CVSS scope change (S:C) signals that successful exploitation could compromise the hypervisor host, making this significant for LoongArch-based virtualization environments. No public exploit code has been identified and EPSS probability sits at 0.21%, suggesting exploitation remains theoretical at this time.
Local privilege/information-disclosure risk in the Linux kernel's s390 KVM subsystem stems from an unlikely race in try_get_locked_pte(), where puds or pmds can be unmapped between the p?dp_get() and p?d_offset() calls, leaving code operating on a stale or freed page-table entry. The flaw affects s390 (IBM Z mainframe) systems running KVM virtualization and has now been patched upstream; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.20%, 10th percentile).
Improper state unwinding in the Linux kernel KVM nested VMX (nVMX) subsystem allows a low-privileged local attacker operating within an L1 guest to potentially escape the virtualization boundary and gain control over the host hypervisor's page table base register (CR3). When EPT is disabled and the deferred vTPR-vs-TPR Threshold consistency check fails, KVM does not restore vmcs01.GUEST_CR3 to its own value, leaving it set to an L1-controlled address - enabling a malicious guest to redirect hypervisor memory mappings to attacker-controlled structures. No public exploit has been identified and no CISA KEV listing exists; EPSS at 0.20% (10th percentile) confirms currently low observed exploitation probability.
Out-of-bounds kernel memory access in Linux KVM's Intel TDX subsystem allows a local, low-privileged user to exploit a TOCTOU race condition during TD virtual machine initialization, potentially achieving kernel memory disclosure, corruption, or denial of service. The vulnerable path exists in tdx_td_init(), where the cpuid.nent field is read once to size a flexible allocation and then again from the copied structure - allowing userspace to change the count between those two references. No active exploitation has been confirmed and EPSS probability is very low (0.20%, 10th percentile), limiting immediate real-world risk to TDX-enabled production environments.
Use-after-free in the Linux kernel's KVM x86 irqfd subsystem exposes hypervisor hosts to potential privilege escalation and VM escape when VFIO PCI device passthrough is in use. The flaw arises because a failed IRTE bypass update leaves irqfd->producer as a dangling pointer; if the VFIO PCI vector is subsequently disabled-an event independent of KVM routing-the now-freed vfio_pci_irq_ctx struct can be dereferenced through KVM's routing table, corrupting kernel memory. No public exploit has been identified at time of analysis and EPSS is low (0.22%, 13th percentile), but the S:C scope change in the CVSS vector reflects the potential for a low-privilege local attacker to escape VM boundaries into the host kernel.
Improper permission handling in the KVM ARM64 nested-virtualization (NV) subsystem of the Linux kernel (6.16 through fixes in 6.18.40/7.1.5) lets a malicious L1 guest hypervisor write to a read-only backing page and trigger a page reference leak on the host. When mapping the L1 VNCR page into the host stage-1, KVM trusted only the guest stage-1 permissions and ignored that the backing PFN may be read-only (e.g. a read-only memslot), permitting writes to memory that should be immutable and leaking pages on the read-only early-return path. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the issue is not in CISA KEV.
Guest-to-host memory corruption in the Linux kernel's arm64 KVM nested-virtualization (NV) path arises from mishandling of the VNCR page translation: when a nested guest reads the VNCR page before writing, the host maps the PFN read-only and fails to re-fetch a writable translation on the subsequent write abort. The fix invalidates the VNCR TLB and re-translates before injecting the abort, restoring correct write-fault handling and satisfying FEAT_ETS2/3 ordering. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and it is not on CISA KEV.
Data corruption in the Linux kernel's LoongArch memory management subsystem allows a local low-privileged user to cause silent loss of written data or potential exposure of stale page contents via a race condition between hardware page table walker behavior and software dirty-bit tracking. Affected systems are those running LoongArch CPUs with hardware PTW enabled - a condition that applies to the architecture by design - across kernel versions from 5.19 through stable branches prior to 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code exists and EPSS stands at 0.21% (11th percentile), though the bug was reliably reproduced via the LTP madvise09 test, confirming it is not theoretical.
Reference count underflow in the Linux kernel IPMI subsystem's handle_read_event_rsp() function enables local privilege escalation on server hardware with active IPMI interfaces. The flaw resides in the error-rollback path: when event delivery fails after successfully allocating receive messages for some users, the rollback incorrectly drops the user reference count twice - once through ipmi_free_recv_msg() and again through a now-stale explicit put - freeing an ipmi_user object that remains linked on intf->users. Subsequent event delivery then dereferences the freed object or trips refcount_t's addition-on-zero guard, enabling kernel memory corruption leading to full system compromise. No public exploit or CISA KEV listing exists; EPSS is 0.20% at the 10th percentile, consistent with no active exploitation at time of analysis.
Kernel memory disclosure and denial-of-service in the Linux kernel OrangeFS client affects systems mounting OrangeFS parallel filesystems, where fill_from_part() truncates a 64-bit directory-entry length into a __u32. An entry length near U32_MAX wraps to a small value that slips past the bounds check and is then used to index the directory part, causing an out-of-bounds read that oopses the kernel. The malformed trailer is supplied by the userspace OrangeFS client, and there is no public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and this is not in CISA KEV. Note: the input CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) conflicts with the description, which describes a local, client-supplied-data OOB read rather than remote unauthenticated code execution.
Memory corruption in the Linux kernel's compaction subsystem allows a local low-privileged attacker to trigger data corruption or potential privilege escalation by exploiting improper error handling in compaction_free(). The function ignores failure returns from free_pages_prepare(), causing hardware-poisoned pages (PageHWPoison) or bad pages (free_page_is_bad()) to be re-added to the compaction freepages list and subsequently reallocated to kernel or user structures. Exploitation requires low-privilege local access and is not confirmed actively exploited (absent from CISA KEV), with EPSS at a low 0.21% (11th percentile); vendor-released patches are available across multiple stable branches.
Memory-safety defect in the Linux kernel IPVS (IP Virtual Server) subsystem where __ip_vs_get_out_rt() calls skb_ensure_writable(), which can reallocate skb->head, leaving a stale IP-header pointer that is then dereferenced. Affected hosts are Linux systems acting as IPVS load balancers/directors; the flaw can lead to reads of freed/relocated packet memory (information disclosure) or kernel instability. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile); the upstream fix reloads the IP header after reallocation.
Out-of-bounds memory access in the Linux kernel's spufs (SPU filesystem) subsystem on PowerPC Cell Broadband Engine architectures allows a local low-privileged user to read or write beyond the SPU local store buffer via a flawed bounds check in `spufs_mem_mmap_access()`. The function computes the mmap offset correctly but validates it against `vma->vm_end` rather than `LS_SIZE`, causing the guard to never fire on 64-bit systems and leaving the length parameter unconstrained relative to the actual local store buffer. Vendor-released patches are confirmed across multiple stable kernel branches; no public exploit has been identified and EPSS is 0.21% at the 12th percentile.
PowerPC E500 systems running Linux kernel 7.0 through 7.1.4 and 7.2-rc4 silently lose kernel address-masking protection due to a compile-time preprocessor symbol typo - `CONFIG_E500` instead of `CONFIG_PPC_E500` - causing `mask_user_address_isel()` to be omitted from E500 builds entirely. A local low-privileged user on affected E500 hardware can exploit the absent address-masking primitive to achieve high-impact memory disclosure, integrity corruption, or denial of service against the kernel. No public exploit exists, EPSS is 0.19% (9th percentile), and this vulnerability is not in CISA KEV, indicating very limited current exploitation activity despite a CVSS score of 7.8.
Insufficient Multi-Link Element (MLE) common info length validation in the Linux kernel's IEEE 802.11 WiFi stack exposes adjacent-network attackers to high-impact memory corruption. Kernels from commit 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 onward failed to validate the advertised common-info length field for Reconfiguration and Priority Access MLE types - and also omitted the length octet when computing the minimum common size for Reconfiguration MLEs - meaning a malformed MLE frame crafted by a nearby attacker can trigger out-of-bounds access. The CVSS score of 8.8 (AV:A) and EPSS of 0.20% (10th percentile) together indicate high potential impact but no public exploit activity at time of analysis; no public exploit and no CISA KEV listing have been identified.
Wrong MTD geometry is applied in the Linux kernel's mchp23k256 SPI SRAM driver when the chip is matched via the SPI id-table rather than via Device Tree, potentially exposing or corrupting unintended SRAM address regions. The driver's probe function calls of_device_get_match_data() exclusively, causing any non-OF SPI modalias match to silently fall back to the default mchp23k256_caps structure regardless of which part was actually selected by the SPI id-table, leading to incorrect chip capacity and address geometry. No public exploit exists and EPSS places this at the 7th percentile (0.17%), but the C:H/I:H/A:H CVSS impact flags reflect that incorrect geometry can expose the entire SRAM contents or allow out-of-bounds writes on affected embedded systems.
Kernel memory corruption in the Linux MTD raw NAND driver for NXP LPC32xx SLC hardware arises because lpc32xx_xmit_dma() silently discards the return value of wait_for_completion_timeout(), treating an expired DMA transfer as successful. The timed-out DMA engine can continue accessing a scatterlist buffer after it has been unmapped and potentially reused by the NAND read/write path, creating a use-after-free condition in kernel space. Exploitation requires local access to an embedded Linux system built on LPC32xx silicon with NAND flash; no public exploit has been identified and EPSS probability sits at 0.18% (7th percentile), indicating limited real-world exploitation interest.
The BPF verifier in the Linux kernel incorrectly accepts constant negative offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF pointer accesses, enabling a local attacker with BPF program loading privileges to perform out-of-bounds kernel memory reads and writes by bypassing the boundary enforcement in __check_buffer_access(). The regression was introduced when commit 022ac0750883 moved constant pointer offsets from reg->off to reg->var_off without updating the corresponding validation logic, leaving a signedness blind spot that allows programs with negative var_off values to load and attach to raw tracepoints undetected. No public exploit code has been identified at time of analysis and the vulnerability is absent from the CISA KEV catalog, but the well-documented commit trail makes independent derivation feasible for a skilled kernel researcher.
The Linux kernel's binder IPC driver contains a use-after-clear bug in binder_transaction() where lsmctx.len is re-read after security_release_secctx() has already zeroed the field via memset, causing sg_buf_end_offset to be inflated by the full aligned LSM security context size on every transaction to a txn_security_ctx binder node. This allows BINDER_TYPE_PTR scatter-gather copies to overrun into bytes already populated with the secctx data, enabling LSM security context disclosure and potential kernel buffer corruption. No public exploit or CISA KEV listing exists at time of analysis; the EPSS score of 0.17% reflects low current exploitation probability, though the low-privilege local attack vector is meaningful on Android where binder IPC is the foundational IPC mechanism.
Improper credential context in the Linux kernel's in-kernel SMB3 server (ksmbd) allows an attacker with an open SMB handle to have SET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION FSCTL operations executed under the ksmbd worker's credentials instead of the credentials captured when the file was opened. Because the underlying VFS xattr, fallocate and fileattr helpers revalidate inode permissions, ownership and LSM policy against those worker credentials rather than the SMB handle's access mask, an attacker can corrupt or zero file data and alter file attributes beyond what their handle should permit (CVSS 9.1, I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not in CISA KEV; the upstream fix is merged into stable kernels.
Buffer overflow and missing locking in the Linux kernel's sun4i-ss PRNG driver expose local low-privilege users on AllWinner sun4i SoC hardware to potential kernel memory corruption and privilege escalation. Two distinct flaws exist: sun4i_ss_prng_seed() lacks mutual exclusion and accepts input without bounds checking, while sun4i_ss_prng_generate() truncates output length and fails to synchronize with hardware before reading bytes, producing cryptographically unreliable output. No public exploit has been identified, EPSS sits at 0.18% (8th percentile), and the kernel maintainers resolved the issue by removing the entire dead code block rather than patching individual bugs.
NULL pointer dereference in the Linux kernel's rxrpc subsystem allows a remote unauthenticated attacker to crash the kernel, causing a denial of service. The flaw exists in rxrpc_verify_data(), which skips allocating the rx_dec_buffer when the associated skb private length is zero, while its caller rxrpc_recvmsg_data() unconditionally assumes the buffer is populated after a successful return. A crafted RxRPC network packet with zero-length payload data can trigger this path, passing a NULL pointer to skb_copy_bits() and causing a kernel panic. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is very low at 0.16% (5th percentile), consistent with a niche kernel subsystem.
Memory corruption and use-after-free in the Linux kernel's AF_RXRPC subsystem (rxrpc) let a local process trigger a double-free and connection refcount underflow by reading an out-of-band challenge message with MSG_PEEK. Because rxrpc_recvmsg_oob() guards only the unlink from recvmsg_oobq under MSG_PEEK but always moves the skb onto pending_oobq, the same singly-referenced skb becomes linked into both a list and an rbtree that share storage, corrupting linkage and freeing the skb and its connection reference twice on socket close. The NVD-assigned CVSS is 9.8, but EPSS is only 0.15% (5th percentile) and there is no public exploit identified at time of analysis; the fix is upstream in the stable trees.
Memory corruption in the Linux kernel's rxrpc networking subsystem (rxgk/GSS Kerberos security class) affects kernels from 6.16 onward, where rxgk_issue_challenge() frees the page holding challenge content before a tracepoint reads the wire header (whdr) that still points into that freed page, creating a use-after-free. The flaw is patched in stable releases 6.18.40, 7.1.5 and 7.2-rc1, and is triggerable only where the rxrpc RxGK security class is active (primarily kAFS deployments). There is no public exploit identified at time of analysis, and the EPSS score is very low at 0.15% (5th percentile), indicating negligible observed exploitation interest.
Denial of service in the Linux kernel's rxrpc subsystem allows remote, unauthenticated attackers to trigger an infinite loop in rxrpc_recvmsg() by sending packets that populate the out-of-band (OOB) queue, which the wait condition fails to check. Systems exposing RxRPC endpoints - primarily AFS (Andrew File System) clients and servers - are affected from the introducing commit through Linux 7.1.4 and 6.18.39. No public exploit exists and EPSS sits at 0.15% (5th percentile), signaling negligible real-world exploitation probability; this is not listed in CISA KEV.
Null-pointer dereference in the Linux kernel's rxrpc subsystem allows a remote unauthenticated attacker to crash the kernel by sending a forged ACKALL control packet to an exposed rxrpc service. Affected systems run Linux from commit b341a0263b1b804d329f864c2dc24815364510ec through the fixes landed in stable releases 6.18.40 and 7.1.5; Linux 6.14 is explicitly confirmed affected. No public exploit has been identified and EPSS probability is very low at 0.15%, but the network-accessible, no-authentication attack path warrants immediate patching on any system actively serving rxrpc traffic.
Kernel panic via rxrpc protocol mishandling in the Linux kernel allows a network-positioned attacker to crash an AFS client system by sending a premature reply DATA packet before any request packets have been transmitted on a client call. The flaw resides in rxrpc_receiving_reply(), which fails to verify call exposure state before invoking rxrpc_rotate_tx_window() - a function whose do...while loop oopses on an empty transmit queue. Fixes have been backported to stable branches 7.1.5 and 6.18.40; no public exploit has been identified and EPSS exploitation probability is extremely low at 0.15% (5th percentile), indicating no known active exploitation.
Denial of service (and potential memory corruption) in the Linux kernel's AF_RXRPC networking stack stems from a double unlock in rxrpc_recvmsg() triggered while handling out-of-band (OOB) messages, affecting kernels from roughly 6.16 up to the fixed 6.18.40, 7.1.5 and 7.2-rc1 releases. Releasing an already-released lock corrupts kernel lock state and can crash the host or open a race window. No public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile).
Denial-of-service in the Linux kernel's AFS (Andrew File System) cache manager allows remote attackers to crash or destabilize systems running AFS by sending a crafted CB.InitCallBackState3 callback request that arrives without an associated server record. The CB.InitCallBackState3 handler failed to perform the null-check present in all other callback handlers, meaning an unexpected or spoofed callback packet lacking a peer-to-server mapping causes a kernel-level fault. No public exploits have been identified, and EPSS places exploitation probability at just 0.16% (5th percentile), reflecting the niche deployment footprint of AFS.
Improper bounds enforcement in the Linux kernel's accel/amdxdna driver allows a local low-privileged user to trigger a kernel-to-userspace copy that exceeds the application-provided buffer size via a crafted ioctl call. The root cause is that copy_to_user() was using the kernel's internal data size rather than the caller-supplied buffer size to bound the copy, enabling overflow into adjacent userspace memory and exposure of unintended kernel data. No public exploit exists and no active exploitation has been confirmed, but the CVSS vector (C:H/I:H) reflects a real dual-impact risk: confidentiality loss from kernel memory spillover and integrity loss from overwriting adjacent user-space structures.
Incorrect NULL-check ordering in the Linux kernel's crypto/ccp driver exposes AMD SEV-SNP systems to kernel memory corruption during Trusted I/O firmware initialization. On architectures without HASHED_PAGE_VIRTUAL, passing the return value of __snp_alloc_firmware_pages() directly to page_address() before checking for NULL causes page_address(NULL) to return a deterministic but invalid non-zero address, silently bypassing the allocation-failure guard and allowing sev_tsm_init_locked() to dereference garbage memory. Affected kernel versions span from commit 4be423572da1f4c1 through the patched releases (7.1.5, 7.2-rc1, 6.19); no public exploit identified at time of analysis, and EPSS is 0.16% (5th percentile), consistent with zero confirmed in-the-wild exploitation.
Out-of-bounds array access in the Linux kernel's nvme-pci driver crashes the kernel and prevents NVMe namespaces from appearing as /dev nodes on systems built without NUMA support (CONFIG_NUMA=n). The root cause is a signed-to-unsigned type mismatch: NUMA_NO_NODE (-1) is cast to UINT_MAX when passed through a parameter declared 'unsigned', causing nvme_setup_descriptor_pools() to index far beyond the bounds of the descriptor pool array (sized to nr_node_ids). No active exploitation has been identified (not in CISA KEV), and EPSS of 0.17% reflects negligible real-world exploitation probability, though the CONFIG_NUMA=n precondition significantly limits the exposed population to non-enterprise kernel builds.
Exclusive BPF maps in the Linux kernel can be inserted as inner maps within non-exclusive outer map-in-map structures, allowing any unrelated local BPF program to look up and mutate a map that is supposed to be bound exclusively to a single program by cryptographic hash. This bypasses the signed BPF loader's integrity guarantee - an adversary on a hostile host can rewrite the frozen metadata map contents that the loader has already validated against a signed hash. No public exploit is identified at time of analysis and EPSS is very low (0.18%), but the impact is high for environments relying on exclusive maps as a trust boundary.
Heap out-of-bounds write in the Linux kernel amdgpu DRM driver's `amdgpu_coredump()` function allows a local attacker with GPU access to corrupt kernel heap memory during a GPU reset event. The vulnerability affects Linux kernel versions containing commit eea85914d15b up to the fix commits, specifically Linux 7.1 stable and prior, on systems with AMD GPU hardware. A local user who can trigger or time a GPU ring timeout during an active GPU reset could exploit this heap corruption for potential privilege escalation; however, no public exploit exists and EPSS probability is 0.15% (5th percentile), indicating limited real-world exploitation activity at time of analysis.
Race condition in the kernfs xattr subsystem of Linux kernel 7.1 and earlier allows local low-privileged users to corrupt shared xattr structures across multiple superblocks, resulting in high-impact confidentiality, integrity, and availability compromise. The flaw arises specifically in namespace-multiplexed environments where kernfs_test_super() allows distinct superblocks to share a single kernfs_node while VFS locking remains per-inode and therefore insufficient. No public exploit has been identified at time of analysis; EPSS probability is 0.15% (5th percentile), indicating that despite the high CVSS score, widespread exploitation is currently assessed as unlikely.
Heap buffer overflow in the Linux kernel wcn36xx WiFi driver allows an adjacent-network attacker without authentication to corrupt kernel heap memory with firmware-controlled content. The vulnerability exists in the synchronous HAL response dispatcher for Qualcomm WCN36xx chipsets, which copies all firmware responses into a fixed 4096-byte buffer without first validating response length. Successful exploitation from an adjacent network position yields high confidentiality, integrity, and availability impact - consistent with potential kernel code execution. EPSS is low at 0.19% and no active exploitation is confirmed, but the lack of authentication requirement and network-adjacent reachability elevate real-world concern for affected embedded and mobile platforms. Patches are available across multiple stable kernel branches.
Use-after-free in the Linux kernel iommufd subsystem allows a local low-privileged attacker on IOMMU-enabled systems to corrupt kernel memory by triggering dmabuf invalidation callbacks against already-destroyed page structures during detach. Affected configurations include virtualization hosts using VFIO or vDPA device passthrough where the iommufd framework is active. The CVSS S:C (Changed Scope) rating reflects the potential for cross-workload impact in multi-tenant environments; no public exploit identified at time of analysis, and EPSS at 0.15% (5th percentile) indicates negligible observed exploitation activity.
Incorrect file-handle hashing in the Linux kernel's lockd (NLM) server causes NLMv4 lock-state lookups to fail intermittently. When a client presents an NFS file handle shorter than LOCKD_FH_HASH_SIZE (32 bytes), file_hash() digests stale bytes left in the argument buffer from a prior request, so the same wire handle hashes into different nlm_files[] buckets across calls and nlm_lookup_file() misses existing lock records. This is a functional-correctness and reliability defect introduced by commit 3de744ee4e45 during the xdrgen NLMv4 TEST conversion; a vendor patch is available, EPSS is low (0.15%), and there is no public exploit identified at time of analysis and no CISA KEV listing.
Guest kernel crash in the Linux virtio RTC driver occurs during device restore when stale virtqueues are not cleaned up before reinitialization. Systems running virtual machines with a virtio-rtc device exposed are affected across Linux kernel versions up to 6.18.40 and 7.1.5 stable series. A local low-privileged user on the guest who triggers a suspend/resume cycle under conditions where virtqueue reinitialization fails can dereference a NULL info pointer in vp_del_vq(), panicking the guest kernel. No public exploit is identified at time of analysis, and EPSS of 0.17% (6th percentile) confirms exploitation is not currently widespread.
Incorrect IRQ-to-ring mapping in the Linux kernel's vdpa/octeon_ep driver mishandles interrupt routing on Marvell OCTEON EP devices that expose non-contiguous or non-zero-based IRQ numbers, causing the interrupt handler to index the wrong virtqueue ring. Only systems with OCTEON EP hardware using the vDPA data path are affected, and the fix ships in stable kernels 6.18.40, 7.1.5, and 7.2-rc1. There is no public exploit identified at time of analysis, EPSS is very low (0.17%, 6th percentile), and the published 10.0 CVSS vector is inconsistent with the local, hardware-specific nature of the flaw.
Out-of-bounds write in the Linux kernel's vfio/qat driver allows a local low-privileged user with access to the Intel QuickAssist Technology virtual function migration interface to corrupt kernel memory through a race condition. The root cause is a Time-of-Check Time-of-Use flaw in qat_vf_resume_write(), where two concurrent writers can both pass the filp->f_pos boundary check before the lock is held, causing the second writer to copy data past the end of the migration-state buffer once the first writer has already advanced the file position. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% at the 6th percentile reflects low current exploitation probability; vendor-released patches are available in stable kernel series 6.12.97, 6.18.40, and 7.1.5.
Incorrect teardown ordering in the Linux kernel's netkit queue lease subsystem allows a local attacker with low privileges to trigger a race window where live NAPI polling consumes net_iov entries whose DMA addresses have already been cleared, causing the physical NIC to DMA to a stale or zero address. Affected kernel versions span from the introducing commit 5602ad61ebee through the 7.1 stable series, with fixes landing in 7.1.5 and 7.2-rc1. No public exploit code exists and EPSS probability stands at 0.15%, but the S:C scope change in the CVSS vector signals that successful exploitation can corrupt memory beyond the vulnerable process boundary, potentially enabling privilege escalation.
Improper error-path cleanup in the Linux kernel's Marvell OcteonTX crypto hardware-accelerator driver (crypto/marvell/octeontx) mishandles DMA unmapping: on a mapping failure the sg_cleanup loop indexes list[i] instead of list[j], leaking successfully mapped scatter-gather entries while repeatedly unmapping the already-failed one. Only systems with Marvell OcteonTX crypto hardware and this driver loaded are affected. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile) and the issue is not in CISA KEV.
Out-of-bounds kernel memory access in the Linux kernel CXL (Compute Express Link) region driver allows a local attacker on systems equipped with CXL memory hardware to corrupt kernel memory by causing cxl_cancel_auto_attach() to use a negative errno value as an array index into p->targets[]. The flaw originates when cxl_region_sort_targets() fails - setting cxled->pos to a negative errno - and that invalid index is later used directly without validation. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.15% at the 5th percentile, reflecting very low real-world exploitation probability consistent with the niche CXL hardware requirement.
Use-after-free in the Linux kernel's ksmbd in-kernel SMB server allows a low-privileged authenticated SMB client to dereference freed kernel memory, potentially achieving arbitrary kernel-level code execution or sensitive information disclosure. The race condition exists between `same_client_has_lease()` releasing `ci->m_lock` without holding a reference on the returned `opinfo` pointer and a concurrent SMB CLOSE operation freeing that same object. Affected kernels span the 5.15 through 7.1 stable series; patches are confirmed available across all branches. No public exploit code or CISA KEV listing has been identified at time of analysis, and an EPSS of 0.18% (8th percentile) indicates no currently observed widespread exploitation.
Use-after-free in the Linux kernel staging nvec driver's nvec_rx_completed() function exposes Tegra-based systems to potential kernel memory corruption. The flaw arises from a TOCTOU race: nvec_msg_free() releases a message pool slot atomically, but the immediately following read of nvec->rx->data[0] occurs after that release - allowing a concurrent nvec_msg_alloc() to reclaim and overwrite the same slot. No public exploit has been identified at time of analysis, and the very low EPSS score (0.18%, 8th percentile) reflects the niche Tegra hardware prerequisite and staging driver context. Fixed commits are available across multiple stable kernel branches.
Shift-out-of-bounds undefined behavior in the Linux kernel's MAX3421E USB host controller driver (`max3421-hcd`) allows a local low-privileged user with access to the raw USB device node to corrupt kernel hub state. The `max3421_hub_control()` function blindly shifts the integer constant 1 left by an attacker-controlled `wValue` field without bounds-checking, so any value ≥ 32 invokes undefined behavior that arbitrarily corrupts `max3421_hcd->port_status`, including immutable change bits that gate internal state transitions. No public exploit exists and this CVE is not in the CISA KEV catalog; EPSS at 0.25% (16th percentile) reflects low exploitation likelihood, but the CVSS 7.8 is grounded in a genuine local privilege-escalation primitive within the kernel USB subsystem.
Double-decrement of the descriptor_busy reference counter in the Linux kernel's GPIB driver re-introduces a use-after-free condition that a prior security patch (commit d1857f8296dc) was specifically designed to prevent. Affected kernels include the 6.18.22-6.18.39 range and Linux 7.0, with patched releases available at 6.18.40, 7.1.5, and 7.2-rc1. Exploitation requires a local low-privilege account and access to GPIB device nodes; no public exploit code has been identified at time of analysis, and the EPSS score of 0.19% reflects negligible observed exploitation activity.
Out-of-bounds memory access in the Linux kernel's xilinx-ams IIO ADC driver allows a local low-privileged user to corrupt kernel memory through malformed event handling in ams_handle_event(). Affected versions span multiple stable kernel branches beginning with the commit that introduced the xilinx-ams driver, with the flaw present from Linux 5.17 onward across the 6.1, 6.6, 6.12, 6.18, and 7.1 stable series. No public exploit exists and EPSS sits at 0.18% (8th percentile), though vendor-released patches are confirmed across six stable branches and the CVSS 7.8 score reflects genuine kernel memory corruption potential on affected Xilinx hardware platforms.
Uninitialized kernel memory read in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3) allows a low-privileged local user to potentially leak sensitive kernel memory contents via a crafted or specially structured NTFS file. The flaw manifests in ni_seek_data_or_hole() when run_lookup() fails to locate the target VCN in runs[0], causing attr_data_get_block_locked() to exit prematurely without initializing the lcn variable - a KMSAN-confirmed uninit-value read triggered through the ntfs_llseek/vfs_llseek call chain. No public exploit exists at time of analysis (EPSS 0.20%, 10th percentile) and this is not listed in CISA KEV, indicating low active exploitation risk despite the CVSS 7.1 base score.
Heap buffer overflow in the Linux kernel ntfs3 filesystem driver's log_replay() function allows a local authenticated user to corrupt kernel heap memory by mounting a dirty NTFS volume whose on-disk log page size exceeds the host PAGE_SIZE. The one_page_buf scratch buffer is allocated using the host page size but never resized when a larger on-disk page size is adopted from the restart area, causing read_log_page() to write beyond the allocation boundary. No public exploit code exists, EPSS is 0.18% (7th percentile), and this is not listed in the CISA KEV catalog, placing current exploitation probability very low despite a CVSS 7.8 base score.
Resource exhaustion in the Linux kernel's xprtrdma (RDMA transport for NFS/RPC) subsystem allows a malicious or compromised RDMA peer to trigger unbounded Receive Work Request allocation, causing denial of service on affected systems. The flaw exists in rpcrdma_reply_handler(), where the credit clamp is bypassed for replies matching no pending request (unknown XID), and rpcrdma_post_recvs() then allocates WRs past re_max_requests without bound. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), reflecting the niche RDMA deployment context. Patches are available across multiple stable kernel branches.
Race condition in the Linux kernel AppArmor unix socket mediation subsystem exposes systems with peer path-based AppArmor rules to a use-after-free scenario, enabling a local low-privileged user to potentially escalate privileges and achieve full compromise of confidentiality, integrity, and availability. The flaw involves accessing a peer unix socket's path (`peer_path`) outside the kernel socket state lock, creating a window for concurrent execution of `unix_release_sock()` to free the referenced path while AppArmor reads it. No public exploit code exists and the EPSS score sits at a low 0.17% (7th percentile), but the NVD-assigned CVSS scope change (S:C) reflects that successful exploitation could reach kernel-level components beyond the attacking process.
Reference count leak in the Linux kernel AppArmor security module allows a local low-privileged user to trigger use-after-free conditions via a bug in update_sk_ctx() socket context management, potentially achieving privilege escalation with high confidentiality, integrity, and availability impact. The fix, backported across stable branches (6.18.40, 7.1.5, 7.2-rc1), corrects the unconditional plabel reference put in the caller by adding a compensating reference acquisition. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation probability.
AppArmor's aa_change_profile() in the Linux kernel dereferences a potentially NULL or ERR_PTR label value before the existing IS_ERR_OR_NULL() guard is reached, allowing a local low-privilege attacker to trigger a kernel crash or kernel memory disclosure. Affected are kernel versions from the introducing commit e00b02bb6ac2a1893227ce8014b649028d6425d2 through multiple stable branches, with vendor-released patches confirmed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 7.1.5, and 7.2-rc1. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) reflects minimal current exploitation interest.
Resource leak in Linux kernel AppArmor's aa_label_alloc() function exposes local attackers with low privileges to potential privilege escalation. When proxy allocation fails during label creation, the error path bypasses aa_label_free(), leaving the security identifier (secid) and other label resources unreleased. No public exploit has been identified at time of analysis, and EPSS at 0.18% (8th percentile) reflects low near-term exploitation probability, though the C:H/I:H/A:H CVSS impact ratings signal meaningful consequence if exploited.
Kernel page fault in Linux kernel AppArmor's file auditing path allows a local low-privileged user to crash the system or leak kernel memory via the audit log. The regression was introduced by commit 4a134723f9f1, which left the *name pointer uninitialized when path->dentry is the aa_null sentinel, then passed it to audit_log_untrustedstring() where strlen() dereferences an invalid address. No public exploit code exists and EPSS probability is 0.17% (7th percentile), but patched stable releases 6.18.40, 7.1.5, and 7.2-rc1 are confirmed available.
Denial-of-service (and potential use-after-free) in the Linux kernel's xfrm/IPsec state-cache logic lets a stale state be inserted into the input-path cache because the state's validity is checked before the global xfrm_state_lock is taken. In the window between the check and the lock, a concurrent operation can kill the state, so a dead (freed-path) state gets cached and later dereferenced on the IPsec input path. Despite an auto-generated 9.8 CVSS, real-world signals are modest: EPSS is 0.21% (11th percentile), the issue is tagged Denial of Service, it is not in CISA KEV, and no public exploit was identified at time of analysis.
Out-of-bounds kernel memory corruption in the QCOM USB audio ALSA driver (`sound/usb/qcom/`) allows a local unprivileged user to corrupt kernel slab memory or trigger a kernel oops by sending a crafted stream-disable request over AF_QIPCRTR. The disable path in `handle_uaudio_stream_req()` fails to guard against a negative index returned by `info_idx_from_ifnum()`, an invariant violation that the enable path already handles - resulting in a wild-pointer dereference when the card has never been enabled, or an out-of-bounds 4-byte slab write when it has. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low-complexity local exploit path on QCOM-equipped systems warrants prompt patching.
Improper packet-header validation in the Linux kernel's netfilter flowtable IP6IP6 tunnel fast path was corrected by switching nf_flow_ip6_tunnel_proto() from skb_header_pointer() to pskb_may_pull(), guaranteeing the outer IPv6 header is actually present in the skb before the offload path dereferences it. The flaw affects hosts using netfilter flowtable hardware/software offload with IP6IP6 tunnel encapsulation, where a malformed encapsulated packet could be processed against a header not fully pulled into the linear buffer. No public exploit identified at time of analysis; not listed in CISA KEV, and EPSS is low (0.20%, 10th percentile).
Type confusion in the Linux kernel's IPv6 In-situ OAM (IOAM) lightweight-tunnel code lets a crafted IOAM route trigger an invalid cast in rt6_get_cookie(), which reads struct rt6_info fields out of a dummy dst_entry that was only ever a bare struct dst_entry embedded in ioam6_lwt. This CWE-843-class flaw affects kernels from 6.16 up to the fixed releases and can produce an invalid pointer access when the aliased sernum/reset_ts field reaches zero. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and the issue is not in CISA KEV, so it reads as a memory-safety/DoS-grade bug rather than a broadly weaponized RCE despite the 9.8 NVD score.
Stack type confusion in the Linux kernel BPF verifier allows a local attacker to bypass non-scalar pointer spill validation and treat a live kernel pointer slot as an ordinary scalar stack read. Affected are Linux 7.1 stable series prior to commit 0f9278b22cda and mainline prior to 3a354149bcea, with fixes confirmed in Linux 7.1.5 and 7.2-rc1. Successful exploitation permits full kernel memory read and write access, enabling local privilege escalation; no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Linux kernel's in-kernel SMB server (ksmbd) lets a remote client that opens an SMB connection race two concurrent SMB2 NEGOTIATE requests to trigger a slab UAF read of the shared conn->preauth_info structure (kmalloc-96). The response send path smb3_preauth_hash_rsp() reads and dereferences conn->preauth_info->Preauth_HashValue without holding conn_lock, so one worker can free the object on the failing-negotiate path while another reads it - a window a bare NULL check cannot close. Exploitation is pre-authentication over the network but requires ksmbd to be actively serving shares plus precise timing; EPSS is low (0.21%, 12th percentile), it is not on CISA KEV, and no public exploit identified at time of analysis.
Out-of-bounds memory access in the Linux kernel netfilter flowtable subsystem allows malformed IPv4 packets to overrun header-size calculations in nf_flow_ip4_tunnel_proto(), affecting systems that use nftables flowtable offload with IP tunnel processing. The bug stems from consuming the untrusted iph->ihl field without validation before computing header size. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not on CISA KEV; despite the CNA's 9.8 rating, real-world impact is most consistent with a denial-of-service kernel crash on a non-default configuration.
Guest memory corruption in the Linux kernel's s390 (IBM Z) memory-management code, where mishandling of the _PAGE_UNUSED software PTE bit causes in-use KVM guest pages to be discarded as if unused. On s390 KVM hosts running kernels before 7.1.5 (and 7.2-rc series before the fix), the bit set by KVM on unmapped guest pages was not cleared by all PTE-setting paths, so a page returned to use could later be silently dropped - corrupting guest state. There is no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and it is not in CISA KEV.
Use-after-free in the Linux kernel mxl862xx DSA driver exposes systems running MaxLinear MXL862xx Ethernet switches to local privilege escalation via kernel heap corruption. The race condition between the MDIO CRC error work handler and driver teardown allows freed dsa_port objects to be dereferenced if a CRC error is scheduled during the narrow window between MXL862XX_FLAG_WORK_STOPPED being set and dsa_unregister_switch() completing. EPSS is 0.20% (10th percentile) with no CISA KEV listing, reflecting niche hardware dependency and low broad exploitation interest.
Incorrect bounds validation in the Linux kernel's octeontx2-af driver allows a local attacker with low privileges to trigger a kernel-level flaw by issuing a crafted devlink command that sets NIX maximum LFs before any PF/VF assignment, bypassing the faulty assignment-check condition. Systems running Marvell OcteonTX2 SoC hardware with the octeontx2-af driver loaded are affected across multiple stable kernel branches originating from commit dd7842878633453e38d6a4927593dd28b9d8ab91. EPSS exploitation probability is very low at 0.21% (11th percentile), no public exploit code has been identified, and this vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds kernel memory read in the Linux kernel's GENEVE tunnel GRO path (drivers/net/geneve.c) affects tunnels that have not enabled the IFLA_GENEVE_GRO_HINT feature - which is the default. geneve_gro_complete() honours an attacker-supplied GRO hint option unconditionally while geneve_gro_receive() ignores it, so the two paths disagree and dispatch the inner gro_complete handler at an unvalidated offset (nhoff + gh_len), reading past the skb head. Confirmed via a KASAN slab-out-of-bounds report in ipv6_gro_complete; there is no public exploit identified at time of analysis and EPSS is low (0.16%).
Out-of-bounds access in the Linux kernel's GENEVE tunnel GRO (Generic Receive Offload) path affects systems using GENEVE overlay networking, where geneve_gro_complete() can re-derive an inner dispatch offset that disagrees with what geneve_gro_receive() recorded - either through a race with geneve_quiesce()/geneve_unquiesce() flipping gs->gro_hint, or through re-read option bytes differing from the parsed ones - and complete GRO past the validated inner network header. Successful triggering leads to memory-safety corruption in softirq packet processing, most plausibly a kernel crash (denial of service). This is fixed upstream; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds array access in the Linux kernel's NXP ENETC Ethernet driver (net/ethernet/freescale/enetc) occurs on the XDP_REDIRECT transmit path when an xdp_frame carries a number of fragments greater than or equal to ENETC_MAX_SKB_FRAGS, overrunning the fixed-size xdp_redirect_arr buffer-descriptor array. Affected are systems using NXP/Freescale ENETC MACs (e.g., LS1028A-class SoCs) with an XDP program that performs redirect on multi-buffer frames, introduced in 5.13 and fixed across current stable branches. No public exploit identified at time of analysis, and EPSS is low (0.21%, 12th percentile), consistent with a driver-specific memory-safety bug rather than a broadly exploited flaw.
Hardware protection bypass in the Linux kernel's PMBus hwmon driver silently discards concurrent regulator fault events, preventing hw_protection_trigger() from firing when multiple power faults coincide. Systems running affected kernel versions (6.6.143-6.6.145, 6.12.92-6.12.97, 6.18.21-6.18.40, 6.19.11-6.20, 7.0-7.1.4) with PMBus-managed power rails may fail to respond to simultaneous under-voltage and over-current events, leaving hardware operating without critical protection. No public exploit has been identified; EPSS of 0.22% (13th percentile) and absence from CISA KEV confirm this is not actively exploited.
Memory corruption (use-after-free) in the Linux kernel's fbnic Ethernet driver occurs on the transmit path when fbnic_tx_lso() caches a pointer into the skb shared-info region and then calls skb_cow_head(), which may reallocate the skb and free the original buffer. Any host equipped with Meta's fbnic NIC that transmits large-segmentation-offload (LSO/TSO) traffic can trigger a slab-use-after-free, reading freed skbuff memory and potentially crashing the kernel. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%), and the issue is not in CISA KEV.
Integer underflow in the ksmbd in-kernel SMB3 server's DACL parsing logic allows authenticated remote SMB clients to bypass ACE count validation, driving large kernel heap allocations. The flaw exists in parse_dacl(), where subtracting sizeof(struct smb_acl) from an attacker-controlled 16-bit DACL size using unsigned arithmetic wraps to a large size_t when the DACL size is smaller than the header, permitting an ACE count of up to 0xffff to pass the guard unchecked. No public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) indicates minimal current exploitation activity, though upstream kernel patches confirm vendor acknowledgment and the attack path is fully documented in the fix commit.
A use-after-free in the Linux kernel's in-kernel SMB3 server (ksmbd) durable-handle path lets a concurrent SMB2 durable reconnect (DH2C/DHnC) read the freed fp->owner.name buffer via strcmp() in ksmbd_vfs_compare_durable_owner(), as caught by KASAN. Only systems that enable and export shares over ksmbd are affected, and exploitation requires winning a tight race between two reconnects on the same persistent_id. No public exploit identified at time of analysis, and EPSS is low (0.21%), consistent with a hard-to-time kernel race rather than a turnkey remote exploit despite the 9.8 input score.
Incorrect error code propagation in the Linux kernel's AFS (Andrew File System) subsystem allows a remote attacker capable of influencing AFS Volume Location server responses to trigger incorrect error handling in `afs_extract_vl_addrs()`, potentially causing availability impact on affected kernels. Systems running AFS-enabled Linux kernels from version 4.20 through the unpatched stable branches are affected, with all known impact limited to availability (C:N/I:N in CVSS). No public exploit code exists and this vulnerability is not listed in CISA KEV; EPSS probability is 0.22%, consistent with low current exploitation interest.
Race condition in the Linux kernel's AFS (Andrew File System) subsystem allows local low-privileged users to corrupt kernel memory by exploiting unsynchronized writes to net->cells_dyn_ino, with potential for privilege escalation to root. The flaw exists because cell lifecycle operations modified shared kernel state without holding net->cells_lock exclusively, and RCU cleanup context constraints in afs_cell_destroy() prevented a straightforward fix - requiring cell removal to be relocated to afs_destroy_cell_work() in a workqueue context. No public exploit exists and EPSS sits at 0.21% (11th percentile), though the 7.8 CVSS score is technically justified by the potential kernel-level impact on affected configurations.
Integer overflow in the Linux kernel minix filesystem driver allows a local low-privileged user to crash the kernel by mounting a crafted Minix v3 image. The minix_blocks_needed() helper uses DIV_ROUND_UP() in unsigned int arithmetic; an image with s_ninodes or s_zones set near UINT_MAX causes the addition to wrap to zero, tricking minix_check_superblock() into accepting an invalid zero bitmap-block count, after which minix_fill_super() dereferences the unallocated s_imap[0] or s_zmap[0] pointer and panics the kernel. No public exploit identified at time of analysis; EPSS is 0.21% (11th percentile), reflecting very low exploitation probability consistent with a legacy, rarely-used filesystem driver.
Double-unlock of an inode's rwsem in the Linux kernel cachefiles subsystem corrupts kernel locking state when start_creating() fails with ENOMEM during directory creation. Local attackers with low-privilege access on systems using network filesystem caching via cachefiles can exploit the corrupted rwsem to achieve privilege escalation or kernel crash, reflecting the high CIA impact in the CVSS 7.8 score. No public exploit has been identified and EPSS is very low (0.20%, 10th percentile), but upstream patches are confirmed available via the kernel stable tree.
Unsigned integer underflow in the Linux kernel iomap writeback subsystem allows a low-privileged user to corrupt filesystem EOF metadata and on-disk size tracking. The flaw occurs in the io_size EOF trim path when a concurrent truncate shrinks the file after end_pos is sampled, causing end_pos to fall below ioend->io_offset; the resulting negative subtraction wraps to a huge value in the size_t io_size field. This corrupted io_size is then consumed by end_io paths for decisions including on-disk EOF updates, unwritten extent completion, and COW range handling. No public exploit has been identified at time of analysis, and EPSS is very low at 0.21% (11th percentile), though the official CVSS scores this 8.8 High with full C/I/A impact.
Improper handling of asynchronous fscache cache-object creation in the Linux kernel's netfs subsystem affects kernels from 6.11 up to the fixed 6.18.40, 7.1.5 and 7.2-rc2 releases. In netfs_create_write_req(), caching is skipped when the fscache cookie appears disabled, but a still-in-progress async cache object may not yet have enabled it, causing fscache_begin_write_operation() to be bypassed and write operations to the local cache to be mishandled. The issue is a local netfs/fscache correctness bug (tagged Information Disclosure); it is not remotely reachable, and there is no public exploit identified at time of analysis.
Improper error handling in the Linux kernel's netfs (network filesystem) subsystem allows a local user with low privileges to corrupt kernel folio state or trigger a kernel hang. The writeback_iter() loop fails to re-invoke itself with the error code set when a write operation fails, leaving folios unlocked and non-redirtied, which produces incorrect iteration state with high integrity and availability consequences. No public exploit code has been identified, and EPSS places exploitation probability at 0.21% (11th percentile), consistent with a constrained local kernel defect rather than a broadly weaponized vulnerability.
Invalid cursor access in the Linux kernel's Intel Xe GPU (drm/xe) page table subsystem allows local low-privileged users to trigger kernel warnings and potentially exploit uninitialized memory during page table binding walks involving purged buffer objects. Affected kernel versions span Linux 7.1 up to the fix points in 7.1.5 and 7.2-rc2, and only systems equipped with Intel Xe GPU hardware are at risk. No public exploit identified at time of analysis; EPSS at 0.20% (10th percentile) reflects minimal current exploitation interest, though the kernel memory-management context elevates the theoretical impact ceiling.
Context confusion in the Linux kernel's uprobes/x86 subsystem allows a local attacker with low privileges to trigger incorrect VMA lookups by exploiting the use of `current->mm` (the tracer's memory map) instead of the traced process's `mm_struct` during uprobe unregistration. Affected are kernel versions in the 6.18.x, 7.1.x, and pre-rc2 7.2 branches originating from commit ba2bfc97b462. Patches are confirmed in 6.18.40, 7.1.5, and 7.2-rc2; no public exploit code has been identified and the vulnerability is not listed in CISA KEV, with EPSS at a low 0.21% (11th percentile).
Credit resource leak in the Linux kernel CIFS client function cifs_issue_read() enables a server-side actor to exhaust the SMB flow-control credit pool on a connected Linux host, producing a denial of service for all I/O on the affected CIFS mount. Linux kernel versions from commit 69c3c023af25edb5433a2db824d3e7cc328f0183 onward are affected until stable-tree patches landing in 6.12.97, 6.18.40, 7.1.5, and 7.2-rc2. No public exploit identified at time of analysis; EPSS of 0.21% (11th percentile) confirms very low real-world exploitation probability and no CISA KEV listing exists.
Use-after-free in the Linux kernel's legacy NTFS filesystem driver (ntfs_mft_writepages) allows a local low-privileged attacker to corrupt kernel slab memory by winning a timing race between MFT writeback and concurrent MFT allocation extension. Affected kernels span the Linux 7.1 stable series up through 7.1.4; fix commits are confirmed in the upstream stable tree targeting 7.1.5 and 7.2-rc3. No public exploit is identified at time of analysis and EPSS is low (0.20%), but the confirmed slab-use-after-free in ring-0 writeback code represents a high-severity memory safety defect warranting scheduled patching.
Use-after-free race condition in the Linux kernel's legacy NTFS driver (ntfs.ko) exposes systems with NTFS-mounted volumes to kernel heap memory corruption, enabling local privilege escalation, information disclosure, or kernel panic. The flaw in ntfs_attr_fallocate() releases a read lock before consuming a borrowed runlist pointer, while a concurrent mmap page_mkwrite path can simultaneously reallocate and free the underlying array - confirmed by a KASAN slab-use-after-free trace in the CVE description. No public exploit or CISA KEV entry exists; EPSS of 0.20% (10th percentile) reflects the difficulty of reliably winning this race, though successful exploitation carries severe kernel-level impact.
Kernel crash via bad memory access in the mlx5e traffic control peer flow cleanup path affects Linux systems running Mellanox/NVIDIA mlx5 NICs in LAG (Link Aggregation Group) mode. When mlx5_lag_get_dev_seq() returns an error during device teardown - because the peer is absent from the LAG or no master device is marked - the driver proceeds to dereference an invalid pointer in mlx5e_tc_del_fdb_peers_flow, causing a kernel panic. No public exploit exists and EPSS is 0.20% (10th percentile), but the crash is deterministically reproducible on affected hardware configurations during device removal or driver teardown sequences.
Race condition in the Linux kernel's Microchip VCAP network driver corrupts hardware forwarding table entries on systems using sparx5 or lan969x switching ASICs. A local authenticated user can simultaneously trigger a debugfs VCAP rule dump and a tc-flower rule write to different Super VCAP instances, causing shared cache registers to be overwritten mid-transaction and committing corrupt data directly into hardware forwarding entries. No public exploit code or CISA KEV listing exists; EPSS is 0.21%, reflecting low exploitation likelihood in practice.
Use-after-free race condition in the Linux kernel's AMD XDNA accelerator driver (accel/amdxdna) allows a local, low-privileged attacker on systems with AMD XDNA hardware to corrupt kernel memory, potentially achieving full privilege escalation. The race window opens because amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove() before removing the object from abo->mem.umap_list, permitting aie2_populate_range() to obtain a stale reference concurrently. No public exploit has been identified at time of analysis, and an EPSS of 0.21% (11th percentile) signals minimal current exploitation interest.
Out-of-bounds array indexing in the Linux kernel's KVM irqfd routing for LoongArch allows a local user with KVM access to index past the routing table's chip array boundary, potentially exposing host kernel memory or enabling a hypervisor boundary breach with full triad impact. Patches are available in stable releases 6.18.40, 7.1.5, and 7.2-rc1 across three upstream commits. No public exploit code exists and EPSS sits at 0.21% (11th percentile), indicating negligible active exploitation probability despite the elevated CVSS 8.8 score.
Missing interrupt request (IRQ) validity checking in the LoongArch KVM subsystem of the Linux kernel allows a local low-privileged user with access to KVM device nodes to pass malformed IRQ values via the kvm_vcpu_ioctl_interrupt() ioctl, potentially causing memory corruption or privilege escalation that crosses the guest-to-host boundary. The CVSS scope change (S:C) signals that successful exploitation could compromise the hypervisor host, making this significant for LoongArch-based virtualization environments. No public exploit code has been identified and EPSS probability sits at 0.21%, suggesting exploitation remains theoretical at this time.
Local privilege/information-disclosure risk in the Linux kernel's s390 KVM subsystem stems from an unlikely race in try_get_locked_pte(), where puds or pmds can be unmapped between the p?dp_get() and p?d_offset() calls, leaving code operating on a stale or freed page-table entry. The flaw affects s390 (IBM Z mainframe) systems running KVM virtualization and has now been patched upstream; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.20%, 10th percentile).
Improper state unwinding in the Linux kernel KVM nested VMX (nVMX) subsystem allows a low-privileged local attacker operating within an L1 guest to potentially escape the virtualization boundary and gain control over the host hypervisor's page table base register (CR3). When EPT is disabled and the deferred vTPR-vs-TPR Threshold consistency check fails, KVM does not restore vmcs01.GUEST_CR3 to its own value, leaving it set to an L1-controlled address - enabling a malicious guest to redirect hypervisor memory mappings to attacker-controlled structures. No public exploit has been identified and no CISA KEV listing exists; EPSS at 0.20% (10th percentile) confirms currently low observed exploitation probability.
Out-of-bounds kernel memory access in Linux KVM's Intel TDX subsystem allows a local, low-privileged user to exploit a TOCTOU race condition during TD virtual machine initialization, potentially achieving kernel memory disclosure, corruption, or denial of service. The vulnerable path exists in tdx_td_init(), where the cpuid.nent field is read once to size a flexible allocation and then again from the copied structure - allowing userspace to change the count between those two references. No active exploitation has been confirmed and EPSS probability is very low (0.20%, 10th percentile), limiting immediate real-world risk to TDX-enabled production environments.
Use-after-free in the Linux kernel's KVM x86 irqfd subsystem exposes hypervisor hosts to potential privilege escalation and VM escape when VFIO PCI device passthrough is in use. The flaw arises because a failed IRTE bypass update leaves irqfd->producer as a dangling pointer; if the VFIO PCI vector is subsequently disabled-an event independent of KVM routing-the now-freed vfio_pci_irq_ctx struct can be dereferenced through KVM's routing table, corrupting kernel memory. No public exploit has been identified at time of analysis and EPSS is low (0.22%, 13th percentile), but the S:C scope change in the CVSS vector reflects the potential for a low-privilege local attacker to escape VM boundaries into the host kernel.
Improper permission handling in the KVM ARM64 nested-virtualization (NV) subsystem of the Linux kernel (6.16 through fixes in 6.18.40/7.1.5) lets a malicious L1 guest hypervisor write to a read-only backing page and trigger a page reference leak on the host. When mapping the L1 VNCR page into the host stage-1, KVM trusted only the guest stage-1 permissions and ignored that the backing PFN may be read-only (e.g. a read-only memslot), permitting writes to memory that should be immutable and leaking pages on the read-only early-return path. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the issue is not in CISA KEV.
Guest-to-host memory corruption in the Linux kernel's arm64 KVM nested-virtualization (NV) path arises from mishandling of the VNCR page translation: when a nested guest reads the VNCR page before writing, the host maps the PFN read-only and fails to re-fetch a writable translation on the subsequent write abort. The fix invalidates the VNCR TLB and re-translates before injecting the abort, restoring correct write-fault handling and satisfying FEAT_ETS2/3 ordering. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and it is not on CISA KEV.