Suse
Monthly
A soundness bug in the Linux kernel BPF verifier lets a crafted eBPF program slip past verification: when handling a 32-bit 'if w1 != 0' comparison, is_branch_taken() fails to distinguish BPF_JMP32 from BPF_JMP, wrongly reports the jump as always taken, and then tracks the wrong execution path for the rest of the program - leaving register bounds inconsistent with runtime behaviour. A local attacker who can load eBPF programs (CAP_BPF/CAP_SYS_ADMIN, or a host where kernel.unprivileged_bpf_disabled has been turned off) can turn this into memory corruption and kernel privilege escalation, with the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.0) rating high confidentiality, integrity and availability impact. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; practical risk is strongly limited by the default posture of disabling unprivileged BPF on modern distributions.
The Linux kernel's bcm_sf2 (Broadcom Starfighter2) DSA switch driver walks the entire CFP 'unique' rule bitmap into a caller-supplied rule_locs[] array without limiting the walk to nfc->rule_cnt, so a local, low-privileged user can read/write past the end of that allocation - or, with rule_cnt of 0, trigger a NULL-pointer dereference - simply by issuing the ETHTOOL_GRXCLSRLALL ethtool ioctl with a slot count smaller than the number of installed CFP rules. The ioctl itself requires no CAP_NET_ADMIN, but the bug is only reachable after a privileged administrator has installed at least one CFP classification rule, so it is confined to embedded or networking hardware that uses the Broadcom SF2 integrated switch and is not a risk on generic or default kernels; no public exploit has been identified at time of analysis. Our independent assessment scores it AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H (NVD publishes 7.0), reflecting a local attack path, a privileged precondition, impact dominated by availability, and only limited integrity exposure rather than the confidentiality/integrity compromise implied by the higher vendor score.
An out-of-bounds write, plus a NULL pointer dereference path, exists in the Linux kernel's nfp driver for Netronome/Corigine SmartNICs: nfp_net_get_fs_loc() walks every entry in nn->fs.list and dumps it into rule_locs[] without checking cmd->rule_cnt, the number of slots the caller actually allocated. A local, low-privileged user session can reach this path because the ETHTOOL_GRXCLSRLALL ioctl requires no CAP_NET_ADMIN and sizes the buffer from the userspace-supplied rule_cnt, so passing fewer slots than installed rules (or 0, which leaves the destination pointer NULL) corrupts kernel memory; a system administrator must first have installed ethtool ntuple/flow-steering rules via CAP_NET_ADMIN, and the nfp driver must be loaded on real NFP hardware. The provided CVSS 3.1 record rates this 7.0 with C:H/I:H/A:H, while our independent assessment bounds it to CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, keeping local access and the high availability impact but scaling confidentiality and integrity down. No public exploit code or confirmed active exploitation was identified at time of analysis; vendor patches exist in Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3.
The mv88e6xxx DSA switch driver in the Linux kernel can be driven into an out-of-bounds kernel memory write - or a NULL-pointer dereference - by a local user issuing the ETHTOOL_GRXCLSRLALL ioctl on a host where an administrator has previously installed at least one RX-flow classification rule; the ioctl requires no CAP_NET_ADMIN, so any local account can reach the buggy path, although the most likely outcome is a kernel crash with limited integrity impact rather than code execution or data theft. The defect is a missing bound on the policy-rule dump: the caller's rule_cnt buffer limit is clobbered by the driver before it is ever read, and a value of 0 leaves the destination pointer NULL. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; vendor fixes are available in the stable trees (6.12.111, 6.18.53, 7.2.7 and 7.3-rc3), and per the independent assessment exploitation is gated on non-default prerequisites - Marvell switch hardware using this driver plus pre-existing policy rules installed by a privileged administrator.
A race condition in the Linux kernel's VXLAN driver (vxlan_fdb_destroy / vxlan_cleanup path) lets a local attacker holding CAP_NET_ADMIN corrupt the shared per-nexthop FDB list and trigger a slab-use-after-free, producing kernel memory corruption that can crash the host and may be leveraged for privilege escalation. Kernels that support FDB nexthops in VXLAN (introduced around 5.8) are affected up to the released fixes, but the bug is only reachable in a non-default EVPN-style topology in which at least two VXLAN devices reference the same FDB nexthop id, data-plane learning is disabled, and 'dynamic' FDB entries are created so they become eligible for the aging timer. Practical risk is far lower than the NVD base score of 7.8 implies: exploitation demands privileged local access, an uncommon shared-nexthop configuration, and winning a timing-dependent race, and there is no public exploit identified at time of analysis and no CISA KEV listing; the vendor has released patches.
Use-after-free in the Linux kernel net/sched traffic-control subsystem allows a local attacker holding CAP_NET_ADMIN to crash the kernel by sending a crafted RTM_NEWQDISC netlink request that installs a clsact qdisc binding a populated shared ingress block while also carrying an invalid TCA_RATE attribute, so estimator setup fails after ->init() has already published the embedded mini_Qdisc and the unwind path synchronously frees that qdisc while lockless readers on the tc_run() packet path may still hold a pointer to it. The assessed vector (AV:L/AC:H/PR:L/UI:N) reflects that exploitation needs local privileges plus a race window that only reliably opens with concurrent traffic on the affected interface, and the resulting impact is denial of service through a kernel crash rather than code execution or data compromise. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; kernel.org released fixes in the referenced stable branches.
A kernel error-handling bug in the AMD IOMMU nested-domain allocation path of the Linux kernel (7.x, AMD-Vi/vIOMMU systems) causes domain-ID allocation failures to be silently ignored, so a nested IOMMU domain can be set up using a host domain ID that was never actually allocated. The flaw is reachable only by a locally privileged caller able to create IOMMU domains (iommufd/vIOMMU nested translation) and only when amd_iommu_pdom_id_alloc() actually fails (domain-ID space exhaustion or short memory), so it is a real but difficult-to-trigger error-path defect with no public exploit identified at time of analysis. Notably, the 7.8 NVD-style score (S:C/C:H/I:H/A:H) is inconsistent with the practical impact, which the independent assessment rates as limited integrity and availability gain on the error path only; vendor patches are available.
Local users who already hold access to a vdpa_sim_blk virtio-block device can drive requests whose start sector is at or beyond the device capacity, causing an unsigned underflow in vdpasim_blk_check_range() that forwards a wildly out-of-range buffer offset into the data path and yields out-of-bounds writes (VIRTIO_BLK_T_OUT copy-in, VIRTIO_BLK_T_WRITE_ZEROES memset) and out-of-bounds reads (VIRTIO_BLK_T_IN). The flaw affects Linux kernels built with the CONFIG_VDPA_SIM_BLK simulator driver since the feature was introduced (around 5.13) and is fixed by stable patches 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3; there is no public exploit code and no confirmed active exploitation (no public exploit identified at time of analysis), and the practical risk is bounded because this is a development/simulation driver that is rarely enabled on production systems. The independently assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H) treats integrity and availability as the dominant impacts and downgrades confidentiality relative to the vendor score.
The vdpa_sim_net virtual network simulator driver in the Linux kernel fails to check the signed return value of vringh_iov_pull_iotlb() when processing a TX descriptor, so a negative error code is added to an unsigned byte counter and later used as a size_t length for receive_filter() and vringh_iov_push_iotlb() in the RX path - turning an error into an oversized copy length. Only systems built with CONFIG_VDPA_SIM_NET that have loaded the vdpa_sim_net simulator module and expose a vhost-vdpa device to a local user are affected; this is a test/simulator driver not normally loaded in production, and the independent assessment rates exploitation as high complexity (AC:H) requiring local access (PR:L). There is no public exploit code identified at time of analysis, and the flaw was self-reported by the developer rather than observed in the wild; vendor fixes are already released in Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3.
Local denial of service in the Linux kernel's newly introduced nstree/listns() namespace-listing infrastructure, where the kernel takes a reference on a candidate mount namespace before the caller's permission to see it has been checked, so on the denial path the final reference can be dropped inside an RCU read-side critical section and put_mnt_ns() may sleep there. Only kernels new enough to contain the nstree code (introduced by commit 76b6f5dfb3fd, present in Linux 6.19 and 7.x builds such as the 7.0.0-30-generic Ubuntu kernel in the reported splat) are affected, and triggering requires a local, already-authenticated user (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H per our assessment - no confidentiality impact and only low integrity impact, far below the formally published 7.8 vector) who can invoke listns(). The result is a 'Voluntary context switch within RCU read-side critical section' splat that can escalate to an RCU stall or hang on affected kernels; no public exploit has been identified at time of analysis and there is no KEV listing.
Heap out-of-bounds write in the Linux kernel's hinic network driver (Huawei HiNIC NICs), where check_mbox_seq_id_and_seg_len() permits the final mailbox segment (seq_id=42) to carry a full 48-byte payload, writing 16 bytes past the 2048-byte MBOX_MAX_BUF_SZ receive buffer. The bug is reachable only where the hinic driver is loaded and a mailbox segment can be injected with seq_id=42 and a maximal payload - realistically via the PF/VF hardware mailbox path (for example a malicious VF in an SR-IOV setup) or a compromised device - so per our independent assessment the input CVSS 3.1 score of 8.8 (S:C, C:H/I:H/A:H) materially overstates real-world risk relative to the more realistic AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H profile, which favors a device crash or DoS over reliable code execution. There is no public exploit identified at time of analysis and no CISA KEV listing; vendor patches are available in the stable trees. The sibling hinic3 driver already handled this case correctly via MBOX_LAST_SEG_MAX_LEN, and the same check has now been ported to hinic.
TX ring memory corruption in the Linux kernel's stmmac (STMicroelectronics DWMAC/DWXGMAC) Ethernet driver allows a local sender to overwrite TX descriptors that are still owned by the DMA engine. The flaw is in the stmmac TSO transmit path: stmmac_tso_xmit() underestimates how many free descriptors a highly-fragmented TSO skb will actually consume, so a nearly-full descriptor ring can pass the availability check and let stmmac_tso_allocator() write past the available slots. Exploitation requires the stmmac driver in use with TSO/GSO enabled and a local sender able to submit a large, heavily-fragmented TSO skb at the moment the ring is almost full; the assessed impact is limited integrity damage and availability loss on affected (largely ARM/embedded STMicro MAC) systems, and no public exploit has been identified at time of analysis.
Linux kernel builds in the 7.2 development series contain a regression in the mm/slab allocator that lets an unprivileged local user corrupt the kernel's partial-slab lists by winning a narrow multi-CPU race, resulting in a list_add corruption BUG and a fatal kernel panic (denial of service). The independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H: the attacker needs only an ordinary local account and no user interaction, but must win a tight timing window in which one CPU inserts a slab onto pc.slabs outside n->list_lock while another is removing that slab from n->partial, as demonstrated in the upstream report through the System V message-queue (msgsnd) path running as UID 65534. The issue is not listed in CISA KEV and no public exploit was identified at time of analysis, although the upstream report includes a reproducer trace; vendor fixes are released as stable commits 570a6aaf6b52c6ec098f4811cdb52b1496f13d15 (Linux 7.2.7) and 4a724bcf5d703e18957397914d79156fa2cf1174 (Linux 7.3-rc3).
A use-after-free race in the Linux kernel's IPv6 FIB6 route-table walker lets a local user who can delete IPv6 routes free a seq private object while it is still linked on net->ipv6.fib6_walkers, after which a subsequent route deletion traverses the dangling list and dereferences the freed walker. The race is triggered by concurrently iterating the route table through /proc/net/ipv6_route or the BPF ipv6_route iterator while removing the last route at a FIB6 table root, and the BPF show path only widens the already non-deterministic window. Exploitation requires local access on an IPv6-enabled host, is timing-dependent, and typically needs route-deletion privileges (CAP_NET_ADMIN, sometimes reachable via unprivileged user namespaces); assessed impact is kernel memory corruption resulting in low integrity impact and high availability impact (crash/DoS), with potential privilege-escalation consequences in that local context. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available in the referenced stable trees.
A memory-lifetime bug in the Linux kernel's ftrace function-graph tracer allows a child task to free its parent's active function-graph return stack (ret_stack), after which the parent writes to the freed slab object inside function_graph_enter_regs(). The flaw is reachable only on the fork error path: ftrace_graph_init_task() runs after copy_exec_state(), so when a non-CLONE_VM fork's task_exec_state allocation fails under memory pressure, copy_process() unwinds through bad_fork_free/free_task() and ftrace_graph_exit_task() frees the still-shared parent ret_stack; systems that never enable the function_graph tracer are unaffected, and the trigger path normally requires privileged (tracefs) access, so exploitation prerequisites are local and configuration-dependent. Published CVSS 3.1 is 7.8 (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H), but our independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H because the attacker must both have function_graph tracing active and force an allocation failure; no public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Linux kernel ALSA us122l driver code leaves VM_MAYWRITE set on read-buffer mappings that were created with PROT_READ, so a local user who can open the hwdep character node O_RDWR can simply call mprotect() to upgrade that mapping to writable after the initial rejection. Once writable, the attacker can alter the struct usb_stream read_size field, which the fault handler uses to decide which pages belong to the read buffer and which usb_stream_free() uses to size the free_pages_exact() release, resulting in out-of-bounds page mapping/access and out-of-bounds freeing of memory outside the allocation. Exploitation requires local authenticated access to /dev/snd's us122l hwdep node plus a physically attached Tascam US-122L-class USB audio device, so no public exploit code has been identified at time of analysis and the practical risk is modest despite the 7.0 base score; the independent assessment rates confidentiality and integrity impact as limited with availability impact high.
Out-of-bounds memory access in the Linux kernel's UFS (BSD FFS/UFS2) filesystem driver is reachable when the kernel mounts an attacker-crafted UFS image, because ufs_read_cylinder() caches unvalidated cylinder-group metadata and later uses it as an array index and bitmap-scan start during ordinary block and inode allocation or free. Affected are kernels from the initial git import (commit 1da177e4, i.e. Linux 2.6.12 era) through the 6.12.x, 6.18.x and 7.2.x lines prior to the stable fixes 6.12.111, 6.18.53 and 7.2.7 (mainline 7.3-rc3), with UFS support compiled in; per the CVSS vector the flaw is unauthenticated (PR:N) but requires high-complexity prerequisite conditions and user interaction (AV:L/AC:H/UI:R), since the victim must actually mount the malicious image, typically via removable-media automount or an explicit mount. The CNA scores this 7.0, but our independent assessment rates confidentiality and integrity impact as Low and only availability as High (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H), because mounting arbitrary images normally requires CAP_SYS_ADMIN and the trigger is contingent on subsequent allocation activity; no public exploit code and no CISA KEV entry were identified at time of analysis.
Memory corruption and denial of service in the Linux kernel's accel/ethosu driver can be triggered by an authenticated local user with access to the Arm Ethos-U NPU device by submitting a job that sets its SRAM size to 0 while the command stream still contains SRAM accesses; this causes the region base register write to be skipped and a stale base address from a prior job to be used. The independent assessment rates the impact as low confidentiality and integrity with high availability (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H), noting that the NVD score of 7.8 likely overstates the real impact because the flaw is limited to SRAM regions and requires niche Ethos-U hardware. No public exploit code has been identified, and the vulnerability is not known to be actively exploited; a vendor patch is available.
An out-of-bounds write in the Linux kernel's ASoC compress-audio platform driver for Spreadtrum/Unisoc (sprd) SoCs lets an authenticated local user who can open the SPRD compress PCM device corrupt kernel memory: the driver allocates fixed 32 KB IRAM and 2 MB DDR stage buffers but derives all copy lengths from the user-controlled fragment_size and buffer_size supplied via SNDRV_COMPRESS_SET_PARAMS, so an oversized request overflows past those fixed allocations during write(). The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H (7.8, HIGH), reflecting deterministic local exploitation with no user interaction and no need for SNDRV_PCM_TRIGGER_START, though impact is confined to Unisoc/Spreadtrum platforms that actually build and load this driver. Vendor-released patches are available (Linux 6.12.111, 6.18.53, 7.2.7, and 7.3-rc3); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Discovery is credited to Atuin, an automated vulnerability discovery engine, and the issue is tracked as EUVD-2026-86764.
A slab use-after-free in the Linux kernel process-exit path lets a local user with an ordinary account crash or destabilize the system by winning a narrow race between wait4(-1) reaping an exiting task and a concurrent setsid() that drops the last PIDTYPE link for that task's struct pid. The bug affects kernels carrying the 0a36bad01731 regression (Linux 6.16 through the 6.18.53/7.2.7 fixes) and requires local authenticated access (CVSS PR:L), with success being timing-dependent; the outcome observed under KASAN is a kernel crash from a bad read of pid->inodes in proc_invalidate_siblings_dcache, not a controlled read/write or privilege gain. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, although a tested reproducer exists privately; patch status is vendor-released, with fixes shipping in 6.18.53, 7.2.7, and 7.3-rc3.
Linux kernel MPLS handling retains a stale inner_protocol/inner_network_header record after the last MPLS label is popped, so a subsequent MPLS push combined with Open vSwitch recirculation and fragmentation causes ovs_fragment() to trust a stale header offset and compute a wildly oversized memcpy that crashes the kernel. Affected are Linux builds exposing the MPLS datapath plus either Open vSwitch push/pop/fragment actions or the tc act_mpls action; exploitation requires local access with CAP_NET_ADMIN to program the datapath and a host already configured with those actions, and the observed outcome is a deterministic kernel BUG/page fault rather than a controllable code-execution or data-disclosure primitive, consistent with our assessed vector (AV:L/AC:H/PR:L, C:N/I:L/A:H). Vendor patches are available for the stable branches (6.12.111, 6.18.53, 7.2.7, 7.3-rc3), and no public exploit code has been identified at time of analysis; CVE-2026-97612 is not in CISA KEV.
Use-after-free in the Linux kernel's in-kernel Open vSwitch datapath lets a local user holding CAP_NET_ADMIN crash the kernel by racing flow-table mask reallocation against packet lookups. Because tbl_mask_array_realloc() retires the old mask array with call_rcu() before repointing tbl->mask_array at the new one, a lookup that enters ovs_flow_tbl_lookup_stats() during that preemptible window can dereference memory that mask_array_rcu_cb() has already kfree()'d, producing the KASAN slab-use-after-free observed on the fast path. Exploitation requires the openvswitch datapath to be loaded and actively processing flows and depends on winning a narrow timing window, so the realistic outcome is kernel panic/denial of service rather than reliable data disclosure or code execution; no public exploit identified at time of analysis, and vendor patches are available (Linux 6.12.111, 6.18.53, 7.2.7, 7.3-rc3).
A use-after-free race in the Linux kernel's nfnetlink_cttimeout netfilter module lets a local attacker who holds CAP_NET_ADMIN and can trigger module unload or network-namespace teardown crash or corrupt kernel memory via the connection-tracking timeout policy path. The flaw exists because cttimeout_exit() unregisters the per-net operations (freeing the per-net timeout storage) before clearing the nf_ct_timeout_hook, so a concurrent nf_ct_set_timeout() call reached through an iptables/xtables CT target can dereference the stale hook and read already-freed memory. KASAN-reported use-after-free; no public exploit identified at time of analysis, and exploitation requires a narrow timing race plus elevated privileges (CAP_NET_ADMIN, and CAP_SYS_MODULE/root or repeated netns churn), so the practical outcome is a kernel crash rather than controlled corruption.
Linux kernel netfilter logging (the nf_log_syslog and nfnetlink_log backends) contains a teardown-ordering race that leaves a stale per-network-namespace logger pointer which later sysctl reads or packet-logging operations dereference. A local actor able to rebind the kernel's log backend - realistically requiring CAP_NET_ADMIN in the target network namespace - must win a narrow timing window against module unload or network-namespace exit, so the assessed impact is no confidentiality loss, limited integrity impact, and high availability impact (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). Vendor patches are available in stable releases 6.12.111, 6.18.53 and 7.2.7 (mainline 7.3-rc3), and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis.
Heap corruption in the Linux kernel's IPv6 fragment reassembly logic can be turned into local privilege escalation by a low-privileged local user (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H in our assessment) on systems where unprivileged user/network namespaces are enabled and IPv6 fragment processing is reachable. The flaw stems from a race during network-namespace teardown: fqdir_pre_exit() flushes the skbs held in incomplete fragment queues without marking those queues complete, so a fragment that acquired a reference just before high_thresh was cleared can reuse stale reassembly metadata, and ip6_frag_reasm() then applies an old nhoffset to a new skb, producing an out-of-bounds write (KASAN: slab-out-of-bounds in ipv6_frag_rcv / ip6_protocol_deliver_rcu against skbuff_small_head). Successful exploitation yields kernel heap corruption exploitable for elevation to root; the primary limiting factor is winning the race between fqdir teardown and concurrent reassembly, and no public exploit code or confirmed active exploitation has been identified at time of analysis. A separate side effect is that unflushed fragments can keep conntrack references alive past the per-net conntrack cleanup point.
Use-after-free in the Linux kernel's mac802154 (IEEE 802.15.4 soft-MAC) RX path lets queued beacon or MAC-command frames keep a pointer to an 802.15.4 interface's private data (sdata) after that interface has been removed, so a later worker run dereferences freed memory and crashes the kernel. Triggering it requires two simultaneous conditions: an attacker within 802.15.4 radio range flooding a victim interface to fill the rx_beacon_list/rx_mac_cmd_list, and that interface being unregistered or its whole phy torn down while frames are still queued - the teardown step generally requires administrative/local privilege (PR:L in our assessment, not the PR:N shown in the 7.5 NVD vector), and the race window is narrow (AC:H). The realistic outcome is a kernel crash / denial of service rather than data theft, and no public exploit code was identified at time of analysis.
A use-after-free in the Linux kernel's Landlock security module (current_check_refer_path()/hook_path_link()) lets a local process that has already entered a Landlock domain handling at least one filesystem access right race a linkat(2) loop against rename(2) plus rmdir(2) so that a freed parent dentry is walked during security_path_link(), triggering a KASAN slab-use-after-free. Impact per our independent assessment is primarily availability (kernel memory corruption/crash) with limited integrity effects, not confidentiality; the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, which is lower on complexity and confidentiality than the vendor-published CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - signals conflict sharply on severity. Exploitation requires local code execution, membership in an active Landlock domain, and winning a timing-sensitive race; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no public exploit has been identified at time of analysis.
Double completion of asynchronous crypto requests in Linux kernel s390 protected-key drivers (paes_s390 and phmac_s390) can crash or destabilize IBM Z systems when an error path returns a negative code after the request was already finalized. The issue is local-only, requires some privileges (PR:L) and high complexity (AC:H), and is limited to s390 hardware using these drivers; the independent assessment rates real-world risk as low despite NVD's 7.0 base score, with integrity and availability impact but no confidentiality impact. Vendor patches are available and no public exploit has been identified at time of analysis.
An incorrect free in the Linux kernel's AFS (kAFS/AndrewFS) client, in afs_lookup_server(), allows a local, low-privileged user who has an AFS filesystem mounted to crash the kernel; the faulty code path is only reached during racy candidate-server cleanup, so it is confined to hosts actually running the kAFS client. Kernels from roughly 6.15 up to the fixed 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3 releases are affected, and while NVD scores this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), our independent assessment lowers it to AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H because the realistic outcome is a kernel crash in a rare configuration rather than controllable memory corruption. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Use-after-free in the Linux kernel AFS filesystem client's peer address-refresh logic allows a crash or, potentially, limited memory corruption when an AFS fileserver endpoint list is refreshed while an inbound RxRPC callback still holds the old peer. The bug arises because afs_fs_probe_fileserver() fetches endpoint state with old_alist left NULL, so afs_set_peer_appdata() treats every list replacement as initial setup, binds the new peers but never unbinds the removed ones; a peer (Pold) is then freed by the server's RCU callback while still pinned through an RxRPC connection, and a later callback dereferences the freed server (KASAN slab-use-after-free in afs_find_server). Exploitation requires a host with an AFS volume mounted over the kernel afs/rxrpc stack plus the correct multi-event race between an address-list refresh and an incoming callback, so it is assessed as AV:L/AC:H/PR:L/UI:N with bounded impact (C:N/I:L/A:H) rather than the network-reachable NVD vector; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the affected footprint is limited to AFS deployments, which are uncommon. Vendor-released patches addressing the flaw are available in the stable trees.
Out-of-bounds writes in the Linux kernel's rkvdec driver for Rockchip stateless HEVC video decoding let a local user who can open the V4L2 decoder device submit a crafted HEVC Picture Parameter Set and drive tile-loop counters and the pic_parameter_set_id beyond the driver's hardware table capacity, corrupting adjacent kernel/driver memory. Exploitation is gated on Rockchip decode hardware being present and on local low-privileged access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, per the independent assessment), and the realistic outcome is a kernel crash or integrity impact rather than code execution or data disclosure; no public exploit has been identified at time of analysis. The issue is fixed in the vendor's stable trees via upstream commits 03beb248d8a7bab30559a60d4df81f167e63b9e3 and 81ad46bb33d8fd279aaa33af5296c648814c964b, corresponding to the Linux 7.2.7 and 7.3-rc3 releases.
A local out-of-bounds write in the Linux kernel's MediaTek vcodec AV1 decoder (vdec_av1_slice_setup_tile) lets an attacker who can open the mtk-vcodec V4L2 stateless AV1 decode device node and submit a crafted bitstream copy tile_info entries beyond the capacity of the mi_col_starts[]/mi_row_starts[] arrays, corrupting adjacent kernel memory. Exploitation is confined to MediaTek SoC platforms that actually ship the AV1 decoder driver and expose the decode device locally; our independent assessment rates it AV:L/AC:H/PR:L with high availability impact but only limited integrity impact and no confidentiality impact, which is substantially lower than the 7.8 base score published by NVD. No public exploit code has been identified at time of analysis, and vendor-released patches are available (Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3).
A local user on Rockchip RK3588-class systems can crash the kernel, and potentially corrupt a small DMA descriptor buffer, by submitting a crafted AV1 stateless-decode request to the verisilicon VPU981 hardware decoder driver. The flaw lies in rockchip_vpu981_av1_dec_set_tile_info(), which divides context_update_tile_id by a bitstream-controlled tile_cols value without checking for zero and writes one descriptor per tile into a fixed-size tile_info buffer holding only AV1_MAX_TILES entries. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, but vendor-released fixes are available in Linux 6.12.111, 6.18.53, 7.2.7, and 7.3-rc3. Note the discrepancy between the published 7.8 score (C:H/I:H/A:H) and the independent assessment, which rates confidentiality impact None, integrity Low, and availability High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) because reachability is confined to this specific SoC decoder and the attacker must already hold local access to the V4L2 decode node.
Out-of-bounds access in the Linux kernel's Rockchip VPU981 stateless AV1 video decoder (drivers/media/platform/verisilicon) allows a local, low-privileged user who can open the decoder's V4L2 device node to read past the tile group entry control array and to program the hardware with more tiles than the descriptor buffer holds, by submitting a crafted AV1 frame that declares tile_cols * tile_rows larger than either the number of tile group entries supplied or AV1_MAX_TILES. The assessed impact is primarily denial of service (kernel memory corruption/hardware misprogramming can crash the decoder path) with limited integrity impact and a potential information-disclosure angle, reflected in our scored vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. Exploitation requires the specific Rockchip VPU981-class hardware plus an exposed stateless AV1 decoder node, which sharply narrows the exposed population versus a generic kernel flaw; no public exploit has been identified at time of analysis, and vendor patches are available in Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3.
Insufficient bounds validation of HEVC tile counts in the Linux kernel's V4L2 control framework lets a local user with access to a stateless HEVC decoder device node cause out-of-bounds reads by submitting a crafted V4L2_CTRL_TYPE_HEVC_PPS compound control. The kernel reads num_tile_columns_minus1 + 1 entries from column_width_minus1[] and num_tile_rows_minus1 + 1 entries from row_height_minus1[], and because std_validate_compound() does not bound these u8 counts, tile-loop bounds can run past the fixed-size uAPI arrays whenever tiling is enabled. Exploitation requires local access to a system exposing a V4L2 stateless HEVC decoder (typically ARM/SoC hardware codecs, often gated behind the 'video' group) plus the ability to issue a VIDIOC_S_EXT_CTRLS ioctl; it is not remotely reachable, and no public exploit has been identified at time of analysis. The impact is assessed as availability-focused with limited integrity effects (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) rather than the higher-confidentiality score sometimes attached to this CVE.
Out-of-range AV1 tile geometry submitted through the Video4Linux2 stateless-decoder control interface is not bounded by the kernel's compound-control validator in Linux 6.5 and later, so a local user who can open a mem2mem AV1 decode device can drive loop bounds, array indices, a divisor, and per-tile descriptor buffer sizing with attacker-controlled tile_cols/tile_rows values. The flaw is reachable only locally, requires an account with access to the relevant /dev/video* node (typically 'video' group membership) and a driver implementing a stateless AV1 decoder, and no public exploit code has been identified at time of analysis; the risk is therefore a config- and access-gated kernel memory-safety issue rather than a network-exploitable one. Exploitation prerequisites plus high attack complexity and the absence of any confidentiality impact keep the practical risk below the 7.8 score shown in some feeds - no vendor advisory has flagged active exploitation (not listed in CISA KEV).
Uninitialized-memory handling in the Linux kernel's Broadcom bnxt_en network driver can leave an rx_tpa[] entry zeroed after a failed TPA buffer reallocation during an RX ring reset, causing a zero DMA address to be handed to the NIC. The bug is not a remotely reachable path: the authoritative assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, and triggering it requires a host-side memory-allocation failure (-ENOMEM in bnxt_alloc_one_tpa_info_data) to coincide exactly with an RX ring reset on a NetXtreme-C/E adapter with TPA active, so NVD's 8.1 AV:N/PR:N score materially overstates the real risk. Vendor-released fixes exist in 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3, and no public exploit identified at time of analysis.
An out-of-bounds array access in the Linux kernel's Broadcom bnxt_en Ethernet driver can crash the kernel at boot or during receive processing on affected 57500/57600-family NICs, most notably the BCM57608 running firmware that advertises fewer concurrent TPA aggregations than the firmware's TPA ID range. Because the driver allocates rx_tpa with only bp->max_tpa entries (32 on the documented firmware version 233) while the software TPA ID derived from the firmware ID can reach 1023, bnxt_rx_pkt dereferences an invalid pointer and triggers a general protection fault. There is no public exploit identified at time of analysis, and the independent assessment is materially less severe than the published CVSS 8.1 - the flaw is a deterministic local/host-side denial-of-service condition on specific Broadcom hardware and firmware combinations, affects only kernels built from commit ec4d8e7cf024 onward, and no code execution or data disclosure primitive has been demonstrated. Remote attackers cannot trigger it without first gaining a position on the affected host's receive path; the operative impact is loss of availability (kernel panic).
A use-after-free race in the Linux kernel's CIFS/SMB client DFS automount handling lets a local user trigger a kernel memory-access fault by racing DFS automount expiry against a superblock lookup in __cifs_get_super(), producing a KASAN 'slab-use-after-free in cifs_sb_active' crash. Only hosts with an active DFS-enabled SMB/CIFS mount (DFS referrals and automount expiry in play) are exposed, the race window is narrow with high attack complexity, and the assessed impact is a denial of service/crash rather than reliable code execution. No public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
A reference-count leak in the Linux kernel CIFS/SMB client's oplock-break handling (cifs_queue_oplock_break) allows a failure path to hold an extra cifsFileInfo reference, which later causes unmount of the CIFS filesystem to fail with 'VFS: Busy inodes after unmount' and a kernel BUG at fs/super.c:777, resulting in a denial-of-service condition on affected hosts. The flaw is reachable when a second oplock break arrives while the first cifs_oplock_break work item is still queued, causing queue_work() to return false and the corresponding reference drop to be skipped; triggering it requires an SMB/CIFS share mounted from a server the attacker controls or that responds slowly, and mounting a share is normally a privileged operation on the client. No public exploit code was identified at time of analysis, and this issue is not in CISA KEV; while NVD assigns 7.5 (HIGH), the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, making this a moderate-to-low real-world risk because the race window is timing-dependent and the outcome is availability loss only.
Heap out-of-bounds write in the Linux kernel CIFS/SMB client (fs/smb/client) can corrupt slab memory when an ACL rewrite expands owner/group SIDs beyond the buffer that was sized from the on-disk DACL length. It is only reachable on systems that mount an SMB/CIFS share with the non-default cifsacl or modefromsid options and then trigger a local ACL-modifying operation such as chown or chmod, so the realistic outcome is kernel memory corruption or a crash rather than a remote attack; the source CVSS vector (8.8, AV:N/AC:L/PR:N/UI:R) is inconsistent with this local, mount-option-gated path. No confirmed active exploitation (no CISA KEV) and no public exploit code have been identified, and vendor patches are available with fixed builds including 6.18.53, 6.12.111, 7.2.7 and 7.3-rc3.
Out-of-bounds memory access in the Linux kernel XFS realtime reverse-mapping (rtrmapbt) and realtime refcount (rtrefcountbt) btree code stems from _maxlevels_ondisk functions that omit the inode root level when sizing in-memory btree cursors, so a tall btree can drive accesses past the end of the allocated cursor. Local attackers on an XFS filesystem that uses a realtime device together with rtrmapbt or rtrefcountbt can trigger the condition; the non-default feature combination and the requirement for a sufficiently large btree keep exposure limited, and our assessment rates it local-only with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) rather than the more severe 7.8 vector supplied with the CVE. Vendor patches are available in stable kernels 6.18.53, 7.2.7 and 7.3-rc3, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Use-after-free in the Linux kernel qla2xxx QLogic Fibre Channel HBA driver allows a locally privileged actor to crash the kernel when a pending response-queue work item (qla_do_work) executes against qpair and response-queue memory that has already been freed during queue teardown. The flaw affects kernels carrying the qla2xxx driver built from the parent commit 68ca949cdb04b4dc71451a999148fbc5f187a220, and is fixed by upstream commits 1710a69fd74d0b4bdfcc57c3309b1c4057f70d85, f1f4d1cb93eeeb250eac9405121933e268eefbd3 and 19788a55cab61d78e33e0914a5a31d27843e8a4a released in Linux 6.18.53, 7.2.7 and 7.3-rc1. Exploitation is gated on winning a narrow teardown race and requires the ability to trigger privileged teardown operations (module unload, device removal, HBA reconfiguration); no active exploitation is confirmed (not in CISA KEV) and no public exploit code was identified at time of analysis. The practical outcome is primarily a kernel crash/denial of service rather than a reliable escalation primitive.
Use-after-free in the Linux kernel's qla2xxx QLogic Fibre Channel HBA driver lets a local attacker with high privileges (root/CAP_SYS_ADMIN) race a virtual port (vport) teardown against an asynchronous fabric report-ID acquisition, causing qla24xx_report_id_acquisition() to re-insert a vport already marked VPORT_DELETE into host_map, so a later lookup dereferences memory freed by scsi_host_put(). The assessed impact is availability-high with integrity-low and no confidentiality impact (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H), and exploitation requires the qla2xxx driver with NPIV vports in use; no public exploit has been identified at time of analysis.
Use-after-free and linked-list corruption in the Linux kernel's qla2xxx QLogic Fibre Channel driver can occur when the NVMe-over-Fibre-Channel transport takes the LS-response reject error path in qla_nvme_xmt_ls_rsp(): the uctx structure is freed with kfree() while still linked in fcport->unsol_ctx_head, so a later list_add_tail() writes through the freed node and a subsequent list_del() can corrupt the list or panic the kernel. Affected configurations are hosts running the qla2xxx driver against a QLogic FC HBA with the NVMe-oF FC transport active, primarily enterprise SAN deployments; per the independent assessment this is a local/adjacent, high-complexity issue (AV:L/AC:H/PR:L) whose triggering depends on an error/reject condition on the LS response path rather than directly attacker-chosen input, a notable reduction from the 8.8 input score. There is no public exploit code identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing); vendor patches are available in the stable trees.
Concurrent list manipulation in the Linux kernel qla2xxx Fibre Channel driver can corrupt the per-fcport NVMe unsolicited-context list, leading to kernel instability or crashes on hosts using QLogic FC HBAs in NVMe-FC mode. The fcport->unsol_ctx_head list is mutated from four different contexts (the response-queue ISR, the DPC/purex worker, the NVMe-FC transport callback and SRB completion) without a shared lock; because multiqueue adapters add entries through different qpairs, the qpair qp_lock cannot serialize the per-fcport list, so a concurrent add/delete or two concurrent deletes can corrupt list pointers. Our independent assessment treats this as a local, high-complexity timing/reliability defect (AV:L/AC:H/PR:L/UI:N, C:N/I:L/A:H) driven by normal NVMe-FC traffic rather than attacker-supplied input - materially lower than the published 8.8 AV:A vector - and no public exploit was identified at time of analysis.
A memory-management correctness defect in the Linux kernel's x86 page-attribute code (arch/x86/mm/pat) causes split page tables to be allocated outside the normal kernel page-table path, so they are never marked as kernel page tables and their associated IOTLB entries are not invalidated when the tables are freed. Exploitation requires local, high-privileged access on an affected kernel (the 6.18.7 through 6.18.53 band or 6.19) that also runs an IOMMU with shared virtual addressing (SVA), plus a timing/reuse window in which a stale IOTLB entry is actually consumed; the independent assessment rates the realistic impact as negligible confidentiality impact, limited integrity impact and possible availability impact (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H), materially below the 8.2 vendor-published vector. There is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), while vendor-released fixes are available in Linux 6.18.53, 7.2.7 and 7.3-rc4.
Denial of service in the Linux kernel's Multipath TCP (MPTCP) receive path can occur when a subflow is reset during exceptional error handling, letting the receive path recursively re-enter mptcp_data_ready() and attempt to take the data lock a second time. The defect affects MPTCP-enabled kernels across several stable branches prior to fixes released in 6.12.111, 6.18.53, 7.2.7 and 7.3-rc4, and only hosts that actually run MPTCP connections carrying subflows are exposed; the traffic is reachable unauthenticated from the network (CVSS PR:N), but the triggering window is exceptionally rare and not deterministically reachable, which is why attack complexity is assessed as High. No public exploit identified at time of analysis and there is no confirmed active exploitation; the authoritative assessment classifies this as a robustness/reliability bug rather than a security-priority issue.
Divide-by-zero in the Linux kernel's Multipath TCP (MPTCP) scheduler allows an unauthenticated remote peer to crash an affected host, because a race between subflow selection for transmission and a subflow socket state change can leave the connection's MSS value (mss_now) reset to zero, which is then used as a divisor on a later release path. Only systems built with CONFIG_MPTCP and carrying multipath connections with multiple subflows are exposed - single-path TCP is unaffected - and successful triggering depends on hitting a narrow timing window rather than deterministic attacker control, consistent with an assessed vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (availability-only impact, no confidentiality or integrity loss). No public exploit code and no evidence of active exploitation were identified at time of analysis, and although the CVE is tagged 'Information Disclosure', the described behavior and the CVSS vector indicate a pure denial-of-service defect.
An integer overflow in the BSON encoder of the MongoDB Python Driver's bundled native C extension (PyMongo before 4.18.2) can cause an out-of-bounds write inside the process hosting the driver when an application encodes a single document built from an unusually large (~2 GB) caller-supplied value. Only builds that link the C extension are affected - the pure-Python BSON fallback is not - and successfully triggering it requires that a large attacker-influenced value actually reach the encoding path, so most applications are exposed only through data they already accept from untrusted sources. The flaw is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis; the vendor has released 4.18.2 as the fixed version, and because impact is confined to the hosting application's own process, risk is best treated as a genuine but precondition-heavy memory-corruption issue.
Attackers can inject arbitrary additional servers into a PyMongo (MongoDB Python Driver) client's connection topology by smuggling the percent-encoded form of a host-list delimiter (for example %2C) inside a hostname value that an application places into a connection string, because PyMongo decodes percent-escapes before it splits the host list. The request is unauthenticated (CVSS 4.0 PR:N) but carries an attack-requirement prerequisite (AT:P): the target application must build a URI at runtime from a host the attacker can influence, meaning static or hardcoded connection strings are not exploitable. MongoDB's own CVSS 4.0 rating of 8.3 (High) is driven by a high integrity impact - the client may route its authentication exchange and subsequent database operations to the rogue host, which can observe limited information and return altered query results. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in PyMongo 4.18.2.
Authentication bypass in Python Social Auth (social-core) versions prior to 5.0.0 allows unauthenticated remote attackers to impersonate any VK user when an application uses the vk-app backend, as the backend skips signature verification if the auth_key parameter is omitted. An attacker can forge callback fields such as viewer_id, access_token, api_id, and api_result to authenticate as an arbitrary VK identity, potentially taking over accounts in the target application. The vulnerability is fixed in version 5.0.0, and no public exploit code or active exploitation has been identified at this time.
Malicious or compromised X servers can crash X clients linked against libXi before 1.8.4 by returning malformed XI2 device-class data that the library's XI2 class parser reads out of bounds, producing an availability-only denial of service against the connected client. The attack needs no authentication on the server side (CVSS AV:N/PR:N) but is gated by user interaction (UI:R), because the victim must establish an X protocol connection to the attacker-controlled server; there is no memory disclosure back to the attacker, no integrity impact, and no code execution. A vendor fix is available (upstream merge request 23, commit e2089ab, with the affected range documented as libXi before 1.8.4), and no public exploit code was identified at time of analysis. Practically, the risk is lower than the 7.4 base score suggests, since the only outcome is a client-side crash.
An iterator-handling defect in the Linux kernel's GFS2 clustered filesystem quota initialization routine (gfs2_quota_init) can be reached when a GFS2 filesystem is mounted, leading to a potential crash or memory-safety consequence rather than remote compromise. Only systems that build and actually mount GFS2 volumes are exposed, which is uncommon outside high-availability cluster deployments. NVD assigns a 7.1 base score under the AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H vector, but our independent assessment scores this lower (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H) because the upstream commit is a readability refactor and no concrete triggerable impact beyond a possible crash is established by the available data; there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV).
A use-after-free race in the Linux kernel's chips-media wave5 VPU (video codec) driver allows a local user who can open the codec's V4L2 mem2mem device node to crash the kernel: if the driver's IRQ thread acquires the instance spinlock in the narrow window between m2m_ctx release and wave5_release() removing the stream instance from the active-instances list, the IRQ handler walks a freed/stale context and dereferences a NULL pointer. The vendor-listed CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H) reflects a worst-case write-after-free scenario, but our assessment scores it lower (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) because the concrete observed outcome is a kernel crash rather than confirmed code execution, exploitation is local-only, and the race window is non-deterministic; the affected hardware/driver is present only on specific SoCs. No public exploit code or in-the-wild exploitation has been identified at time of analysis (not in CISA KEV), and vendor-released stable fixes exist.
The Linux kernel's Thunderbolt XDomain (host-to-host / peer) service handling carries a lifetime defect: the service ID is released in tb_service_release() while the ID array that backs it is owned by the parent XDomain, so a service can outlive the XDomain reference it depends on and teardown of a Thunderbolt connection can access a freed/absent parent structure. The assessed practical outcome is a kernel crash (denial of service) with only limited integrity impact, and reaching the bug requires a system with the Thunderbolt driver active plus a physically attached Thunderbolt device or peer host to establish the XDomain connection - the supplied CVSS 8.8 vector (AV:A/AC:L, C:H/I:H/A:H) is significantly overstated versus the assessed physical-access, high-complexity vector (AV:P/AC:H, C:N/I:L/A:H). Vendor patches are available for the stable trees and mainline (5.10.266, 5.15.217, 6.12.111, 6.18.53, and 7.2), and no public exploit code was identified at time of analysis.
Improper Thunderbolt domain-teardown handling in the Linux kernel leaves the root-switch pointer (tb->root_switch) referencing a stopped domain, so a Thunderbolt/USB4 peer on the same fabric can race the teardown with an in-flight XDP cross-domain request (tb_xdp_handle_request) and drive the driver into stale-pointer/use-after-free territory that destabilizes or crashes the host. The fix mirrors the firmware connection manager by clearing tb->root_switch when the domain is stopped while deliberately keeping the uuid alive long enough to reply before the domain is fully released. Affected are Thunderbolt-capable Linux systems running unpatched kernels; the scenario is constrained to a physically adjacent attacker with a live Thunderbolt/USB4 link and a timing-dependent window, no public exploit code is identified at time of analysis, and the independent assessment (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) rates impact as availability-skewed rather than the 7.5 CVSS vector's C:H/I:H/A:H.
An out-of-bounds SDMA queue index in the Linux kernel's AMD amdkfd (KFD) GPU-compute driver allows a local low-privileged user on AMD GPU systems to corrupt kernel memory and crash the machine via the CRIU checkpoint/restore path that supplies a caller-controlled restore_sdma_id. The missing bounds check against the maximum queue count affects kernels predating the 6.12.111, 6.18.53 and 7.2 releases, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Assessed impact is local integrity and availability loss, with memory corruption and panic as the dominant realistic outcome rather than disclosed data.
Local low-privileged users on systems with AMD GFXv9-class GPUs can leak adjacent kernel memory through the amdkfd get_wave_state() path in the Linux kernel, because attacker-supplied queue descriptor fields are used unchecked as the length and offset of a copy_to_user(). The bug is reachable only via the AMD KFD device node (/dev/kfd) together with the AMDKFD_IOC_RESTORE_PROCESS (CRIU restore, H3) ioctl, giving an attacker roughly 4 GiB of over-read when the offset exceeds the size (integer underflow) or a 1 MiB read against a 4 KiB allocation that exposes neighbouring MQDs, ring buffers and KASLR-relevant kernel pointers. Vendor-released fixes are available in Linux 6.12.111 and 6.18.53 (and in the 7.2 line), but at the time of analysis there is confirmed no CISA KEV listing and no public exploit code identified, so this should be treated as a real but local-only information-disclosure risk rather than an actively exploited flaw; systems without an AMD GPU or without the KFD driver loaded are not exposed.
A use-after-free race in the Linux kernel's ACRN hypervisor service module (HSM) lets an authenticated local attacker with control of the ACRN irqfd ioctl path free a struct hsm_irqfd that a queued shutdown work item still references, yielding kernel memory corruption via container_of() on a dangling pointer. Exploitation is not a default Linux configuration: it requires the ACRN hypervisor stack to be built and running on the host with the acrn HSM driver loaded and an ACRN VM present, plus the attacker must win a narrow timing window between acrn_irqfd_deassign()/deinit and an eventfd EPOLLHUP wakeup. Our assessment rates this CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H - a low-complexity vector is not realistic because the race is hard to trigger reliably, and the dominant impact is availability (kernel crash), with only limited integrity impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available (Linux 6.18.53 / 7.2).
Kernel panic and denial of service in the Intel iwlwifi 'mld' (multi-link device) driver stem from a use-after-free on the firmware-error recovery path. Hosts are affected only when the MLD driver is loaded and two connections are active at once - an infrastructure BSS link plus a NAN (neighbor awareness networking) link - and a firmware error forces a reconfig that restores the BSS link but fails to restore the NAN link; mac80211 then frees the BSS link's data while a queued async statistics notification still holds a dangling fw_id_to_bss_conf[] pointer, so the workqueue handler dereferences freed memory and panics the kernel. Local access to the machine is required, the race between async_handlers_wk and the reconfig work makes deliberate triggering complex, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status; vendor patches are available in Linux 6.18.53 and 7.2.
A use-after-free in the Linux kernel's ACPICA AML interpreter, reached through acpi_ds_terminate_control_method(), fails to clear references to a control method's locals and arguments on termination, leaving dangling pointers that can crash the kernel (denial of service). Affected are kernels built from the pre-fix code through the stable branches below 6.12.111 and 6.18.53 and the 7.2 line, with the CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* applying to unpatched builds; triggering requires control of ACPI/AML content - malicious platform firmware supplying crafted DSDT/SSDT tables, or a local user with CAP_SYS_ADMIN injecting AML via configfs/ACPI custom_method - so there is no remote or unprivileged path on default configurations, and the practical outcome is predominantly a kernel crash rather than reliable code execution. Vendor-released patches are 6.12.111, 6.18.53 and 7.2; no public exploit identified at time of analysis.
Out-of-bounds access in the Linux kernel's ACPICA AML parser function acpi_ps_get_next_field allows crafted ACPI/AML field definitions to be parsed beyond intended boundaries, producing a crash-dominant denial of service; exploitation requires malicious or tampered platform firmware that supplies crafted DSDT/SSDT tables, or a privileged local user with CAP_SYS_ADMIN injecting custom AML via configfs/custom_method. The NVD CVSS 3.1 base is 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), but the independent assessment treats the practical vector as AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H because this is not reachable by a remote or unprivileged local attacker on a default configuration. Vendor patches are available in Linux 6.12.111, 6.18.53, and 7.2; no public exploit code or CISA KEV active exploitation is identified in the provided data.
Kernel crashes in the Linux kernel's ACPI/AML interpreter can be triggered when acpi_ut_copy_simple_object() adds invalid references for local, argument, or debug objects while processing crafted ACPI tables. Affected versions include Linux kernels before 6.18.53 on the 6.18.y branch, before 6.12.111 on the 6.12.y branch, and upstream before the fix in 7.2; patching is available. No public exploit or KEV listing is identified at time of analysis, and although the published CVSS is 8.4, the independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H because exploitation requires privileged ACPI table injection or malicious firmware and realistically causes denial of service rather than code execution or disclosure.
Integer overflow in the Linux kernel's ACPICA AML interpreter allows memory corruption and a likely kernel crash when a crafted Mid() (three-operand) AML operation is evaluated with operand values chosen so that Index + Length wraps around. Affected are Linux kernels before 6.12.111, before 6.18.53, and before 7.2 in the mainline tree, as tracked under CPE cpe:2.3:a:linux:linux and EUVD-2026-86064. This is not remotely reachable: exploitation realistically requires either the ability to supply malicious ACPI firmware tables (DSDT/SSDT) or root/CAP_SYS_ADMIN-level access such as via debugfs custom_method, so an ordinary unprivileged local user cannot trigger it on a default configuration; no public exploit has been identified at time of analysis, and vendor patches are available. Note that the NVD CVSS of 8.4 (AV:L/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates real-world risk for this class of Linux-kernel ACPICA flaw; our assessment rates it AV:L/AC:H/PR:H/UI:N with impact dominated by kernel memory corruption and denial of service rather than a realistic full confidentiality/integrity compromise.
The Linux kernel's ACPICA interpreter fails to validate the object type of handler objects in acpi_ev_has_default_handler() and acpi_ev_find_region_handler(), so malformed or crafted ACPI/AML tables can drive those paths to operate on a handler of an unexpected type. Exploitation is local and practical only for an attacker who can supply the AML - most plausibly by overriding ACPI tables via CONFIG_ACPI_CONFIGFS table loading (which normally requires CAP_SYS_ADMIN) or by controlling platform firmware/DSDT, and no public exploit or confirmed active exploitation was identified at time of analysis. Our independent assessment rates real-world risk substantially below the published NVD CVSS 3.1 score of 8.4, since the attack is local, depends on a non-default custom-table-loading configuration, and yields integrity/availability impact rather than code execution.
Use-after-free in the Linux kernel's ACPICA acpi_ns_build_normalized_path() function allows local attackers to crash or destabilize ACPI-enabled systems by triggering a stale node dereference, producing a denial of service (availability impact). The flaw affects kernels before 6.12.111, before 6.18.53, and before 7.2; exploitation requires low-privileged local access and depends on winning a race or lifetime window, and no public exploit code is identified at time of analysis. The independent assessment rates this as availability-only (AV:L/AC:H/PR:L, C:N/I:N/A:H), conflicting with the higher confidentiality-loss 7.7 score in the supplied CVSS input.
Kernel crash risk in the Linux Kernel arises from insufficient buffer validation in ACPICA's acpi_ut_walk_aml_resources(), allowing malformed ACPI resource descriptors to overflow internal buffers. Exploitation requires control over ACPI resource descriptor data - firmware, a rogue device advertising crafted resource data, or a privileged local path that feeds ACPI tables into the kernel - so the NVD CVSS 3.1 score of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) overstates real-world risk; the independently assessed vector is AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H with a predominant kernel-crash impact. Vendor-released patches are available, and no public exploit identified at time of analysis.
Out-of-bounds reads in the Linux kernel's ACPI interpreter (ACPICA) - specifically in acpi_ps_get_next_namestring() and acpi_ps_peek_opcode() - can cause a kernel crash or expose adjacent memory contents when parsing malformed AML bytecode from ACPI tables. All kernel versions tracing back to the initial git commit (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2) are affected; fixes are published in Linux 6.12.111 and 6.18.53 (mainline 7.2). Exploitation requires the ability to supply crafted ACPI tables - malicious or modified firmware/BIOS, physical boot-time table override, root-level override via initrd (CONFIG_ACPI_TABLE_UPGRADE), or a hostile hypervisor - which is why our independent assessment lowers the supplied CVSS 7.7 (PR:N, AC:L, C:H) to AV:L/AC:H/PR:L with confidentiality impact limited to adjacent-memory leakage; the realistic outcome is a kernel denial of service. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the patch is available from the vendor via the referenced upstream stable commits.
Out-of-bounds access to native Wi-Fi header fields in the Linux kernel's ath11k driver can corrupt kernel stack memory when a received frame's length exceeds the maximum native Wi-Fi header size in the DP_RX_DECAP_TYPE_NATIVE_WIFI decapsulation path (ath11k_dp_rx_h_undecap_nwifi). Unauthenticated adjacent attackers within radio range (AV:A, PR:N, UI:N) against systems running the ath11k driver on supported Qualcomm Wi-Fi hardware - tested on WCN6855 hw2.1 PCI with WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 firmware - can trigger a malformed over-the-air frame that leads to kernel stack corruption and a crash; no public exploit has been identified at time of analysis. Independent assessment rates this CVSS 3.1 AV:A/AC:H/PR:N/UI:N/C:L/I:L/A:H, meaning the vendor/NVD score of 8.8 overstates real-world risk: the trigger path must be active, the attacker must be radio-adjacent, and the confirmed outcome is memory corruption/crash rather than demonstrated code execution.
Mounting a crafted NTFS volume on a system running the Linux kernel's ntfs3 driver can drive a slab out-of-bounds read: a malformed directory index entry declares a key_size larger than the bytes actually present in its NTFS_DE payload, and the subsequent directory lookup passes that key to cmp_fnames(), which reads past the end of the kmalloc'ed index buffer. The flaw is local (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, 7.1) and requires the victim to mount and access the malicious image, typically via removable media, a supplied disk image, or a desktop automount path; the practical consequence is most often a kernel crash or denial of service rather than reliable disclosure of meaningful data, so real-world risk is lower than the headline score implies. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor-released fixes exist in Linux 6.18.53, 6.12.111, and 7.2.
An out-of-bounds read exists in the Linux kernel's ntfs3 driver: the readdir path in ntfs_dir_emit() compares a UTF-16LE character count (fname->name_len) against a byte count (e->size) without accounting for the 2-byte encoding or the ATTR_FILE_NAME header, so a crafted NTFS image with a small declared entry size but a large name length slips past the bounds check and lets ntfs_utf16_to_nls() read beyond the index entry. Exploitation is local and requires the victim to mount and list a directory on the attacker-supplied filesystem, typically via removable media or a disk image opened by an auto-mount daemon, and mounting normally requires CAP_SYS_ADMIN or equivalent auto-mount privileges, with user interaction needed to insert the media or open the image. The impact is information disclosure (kernel memory contents adjacent to the entry) plus a denial-of-service crash; no public exploit code or active exploitation was identified at time of analysis, and no EPSS score was supplied, though patch code is already public in the upstream stable trees.
Out-of-bounds read and unbounded iteration in the Linux kernel's NVMe driver allow a local attacker who controls or emulates an NVMe device advertising Flexible Data Placement (FDP) to crash the kernel and potentially disclose adjacent memory contents. Only kernels before 6.18.53 and the 7.x line before 7.2 are affected, and exploitation is not reachable purely over a network: per the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H the attacker needs an authenticated local foothold (PR:L) plus a malicious, tampered or emulated NVMe controller, so the published CVSS 8.2 (AV:N/AC:L/PR:N) overstates both reachability and required complexity. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
A use-after-free race in the Linux kernel's amdkfd (AMD KFD compute) queue destruction path lets a local user who can access the AMD GPU compute interface free a queue while it is still being dereferenced. The flaw sits in wait_on_destroy_queue(), which drops its locks while waiting for a queue to resume, creating a window in which a concurrent destroy_queue_cpsch() can free the same queue; the fix serializes destruction using the is_being_destroyed flag. Affected systems are those running an AMD GPU with the KFD/ROCm compute path active on kernel versions before 6.12.111 / 6.18.53 (fixed in 7.2); exploitation requires local low-privilege access, a favorable race outcome, and no public exploit code has been identified at time of analysis.
Out-of-bounds reads in the Linux kernel amdgpu FRU PIA parser can crash affected systems when malformed or truncated EEPROM data is processed during driver initialization. Exploitation requires local access with low privileges and high attack complexity on AMD GPUs that expose a FRU PIA, primarily datacenter or professional models, and an attacker must be able to supply corrupted on-board EEPROM contents rather than network or ordinary userspace input. The assessed impact is low confidentiality and high availability, not reliable code execution or data theft; vendor patches are available in Linux 6.12.111, 6.18.53, and 7.2, and no public exploit was identified at time of analysis.
Boundary-condition mishandling in the Linux kernel's RDMA user-memory path (ib_umem_find_best_pgsz()) lets a local user who can register a user memory region through RDMA verbs drive out-of-range iova/length arithmetic into a GENMASK, producing incorrect page-size masks and, in the worst case, kernel memory corruption or a crash. Exposure is narrow and architecture-dependent: the truncation and >4G GENMASK overflow cases are principally reachable on 32-bit kernels where iova is passed as a 32-bit value, while 64-bit builds are far less affected, and access is gated by PR:L (an RDMA/InfiniBand or RoCE-capable device plus permission to call ib_umem_get()). Our independent assessment is less severe than the published 7.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H), since the patch addresses arithmetic on page-size masks rather than a direct attacker-controlled heap write; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
A malformed TCP SACK option stream can crash the Linux kernel on CPU architectures that do not tolerate unaligned memory access, because netfilter's nf_conntrack TCP option parser reads a 32-bit value through an unaligned pointer dereference in its timestamp fast path. The defect affects the kernel's connection-tracking code that processes TCP traffic, which runs on virtually every firewall, gateway, or NAT host that uses nf_conntrack, and it is exploitable by a remote, unauthenticated attacker who can reach a conntrack-processing path and craft SACK options at a non-4-byte-aligned offset (PR:N/UI:N), though the independent assessment rates this AC:H rather than AC:L because exploitation is limited to non-x86 alignment-faulting architectures. Impact is availability-only - a kernel fault/crash rather than memory corruption or disclosure - and no public exploit code was identified at time of analysis; the vendor fix is already available in stable releases.
Btrfs subvolume metadata handling in the Linux kernel can read out of bounds when a mounted filesystem contains a crafted ROOT_REF or ROOT_BACKREF item whose on-disk name_len does not exactly match the remaining item payload, and BTRFS_IOC_GET_SUBVOL_INFO then copies more bytes than intended into its fixed-size UAPI name buffer. Only systems using btrfs are affected; the flaw is local rather than remote and per the assessed vector requires low privileges plus the ability to present a corrupted/malicious btrfs image to the kernel (typically mount privilege or an auto-mount/removable-media/container path). The kernel.org stable fixes are published (6.12.111, 6.18.53, 7.2), and no public exploit code or active exploitation has been identified at time of analysis. The upstream/NVD score of 7.8 overstates practical risk: the hardened assessment rates it as a local out-of-bounds read with limited confidentiality and availability impact (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L).
Out-of-bounds memory access in the Linux kernel's RDMA RTRS server (rtrs-srv) module, used by RNBD remote block devices, is reachable by an unauthenticated remote attacker (CVSS vector PR:N) who can open an rtrs client session over an RDMA/RoCE/InfiniBand fabric and send a process_read or process_write message whose network-supplied usr_len field exceeds off. The unchecked subtraction data_len = off - usr_len underflows to a huge size_t that is then handed to the rdma_ev callback as a memory length, producing the out-of-bounds access. The independent assessment rates this AV:N/AC:L/PR:N/UI:N/S:U with Low confidentiality and integrity impact and High availability impact (substantially below the vendor's 9.8), and practical exposure is narrowed because rtrs-srv is not present on general-purpose systems and requires RDMA-fabric reachability rather than ordinary IP routing; no public exploit code identified at time of analysis.
Error recovery in the Linux kernel's nvme-fc (NVMe-over-Fibre-Channel) transport can abort in-flight requests against an io tagset that has not yet been allocated, producing a lockdep 'trying to register non-static key' warning and faulting the error-recovery path when a newly created controller in CONNECTING state loses connectivity. Affected systems are those running kernels before 6.12.111 or 6.18.53 (the fix is also merged for the 7.2 line), specifically hosts with NVMe-over-FC hardware such as an lpfc HBA; the trigger is an admin request timeout during controller connect caused by FC link loss, so it is a local availability/robustness defect rather than an attacker-supplied input, with no public exploit identified at time of analysis. The independent assessment rates this AV:L/AC:H/PR:L with availability-only impact and high attack complexity and, notably, the published CVSS 8.8 network-adjacent score is not supported by that analysis - the practical exposure is confined to FC-attached hosts whose connect path already failed.
An interrupt storm in the Linux kernel's stmmac Ethernet driver causes CPU starvation on systems using the XGMAC2 (DWMAC-XGMAC2) 10G MAC core, such as Intel Agilex5 SoCs. Because RBUE (RX Buffer Unavailable) was enabled in the default RX interrupt mask, a DMA RX descriptor ring that drains under heavy receive pressure fires the RBUE interrupt continuously-observed at roughly 1,821,811,555 MAC interrupts against only 2,618,627 actual RX completions on Agilex5, a ~695x amplification-locking the CPU into interrupt handling; the CVSS 3.1 vector is AV:N/PR:N (unauthenticated), and no public exploit has been identified at time of analysis. The flaw is highly constrained: it requires XGMAC2 silicon plus sustained high-rate RX traffic (or page_pool exhaustion), and independent assessment rates it AC:H rather than the NVD AC:L, since exploitation demands prolonged heavy traffic against specific hardware and results only in availability loss (CPU stall), with no data exposure or code execution.
A double-free in the Linux kernel's virtio-fs driver can corrupt kernel memory when a virtiofs device advertises more request queues than its transport actually provides, causing virtio_find_vqs() to fail during probe and the cleanup path to free fs->vqs and fs->mq_map twice. The flaw is reachable only from the device/hypervisor side: a guest must be running with a malicious or malfunctioning virtio-fs device, and the bug triggers solely on the probe-failure cleanup path, so it is not reachable in default configurations that do not attach a hostile virtio-fs device. Independent assessment rates this CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H (local, high attack complexity, low integrity and high availability impact), which is materially lower and narrower than the published CVSS 8.4 that assumes PR:N and full integrity impact; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and EUVD's 'Information Disclosure' tag conflicts with the double-free / availability-focused nature of the defect.
Use-after-free in the Linux kernel's HID++ (hidpp) driver leaves a stale pointer in hidpp->input when input_register_device() fails during hidpp_connect_event(), allowing a dangling reference to be used after input_free_device() has released it. Systems running affected kernels (anything prior to the fixed backports 6.12.111, 6.18.53, and 7.2) with a supported Logitech HID++ peripheral attached - such as a Unifying receiver, mouse, keyboard, or touchpad - are exposed to the code path, but the trigger is a registration-error path that is not attacker-controlled and rarely executes, so realistic impact is a local kernel crash or denial-of-service rather than confidentiality or integrity compromise. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation; vendor-released patches are available from kernel.org stable branches.
A use-after-free in the Linux kernel perf events core lets a local user who can create perf events with address filter ranges trigger a race between event teardown and an RCU reader, resulting in memory corruption that is most reliably observed as a kernel crash or denial of service. The bug affects the kernel up through the stable branches fixed in 6.12.111 and 6.18.53 and the mainline fix released as 7.2; systems running those or later versions are not affected. Exploitation requires local access, the ability to open perf events subject to CAP_PERFMON and the kernel.perf_event_paranoid sysctl, and precise timing because the window is a narrow UAF race, so an unprivileged attacker on a default or hardened configuration is unlikely to reach it; no public exploit code has been identified at time of analysis and there is no indication of active exploitation. The NVD vector rates this 7.8, but the assessed vector (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H, roughly 5.3) is more conservative because of the high attack complexity, the privileged precondition, and the limited realistic confidentiality impact.
Malformed f2fs filesystem images can make the Linux kernel read past the end of its inline filename storage while converting an inline directory into a regular dentry block, disclosing kernel memory contents and potentially crashing the system. The attack path is local and requires user interaction: a victim must mount an attacker-supplied corrupted image (for example via USB auto-mount, a container, or a VM) and then access the affected directory so that the inline-to-regular dentry conversion runs; only f2fs filesystems using inline dentries are affected. No public exploit code and no confirmed active exploitation (not in CISA KEV) were identified at time of analysis, and the risk is concentrated in environments that routinely mount untrusted removable media or filesystem images.
Mounting a crafted btrfs filesystem image on an unpatched Linux kernel can overflow a fixed 255-byte name buffer while processing a malformed INODE_REF item, producing an out-of-bounds memcpy/page fault and a kernel panic (denial of service, with memory-safety implications). The assessed vector is local, high-complexity, PR:L (authenticated/low-privileged local access) - an attacker must be able to supply the malicious image and get it parsed, for example via mount, an unprivileged user-namespace/loopback mount, or the NFS/open_by_handle export path (exportfs_decode_fh_raw → reconnect_path → btrfs_get_name) shown in the crash trace. Only systems that use btrfs (and particularly those exporting btrfs filesystems over NFS) are affected; there is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis. Patches are available in the vendor stable releases Linux 6.12.111, 6.18.53, and 7.2 (EUVD-2026-86201).
A double fput() in the Linux kernel's cachefiles_create_tmpfile() error-handling path drops the struct file reference count twice, producing a double-free/reference-underflow that is crash-dominant and can corrupt kernel memory or panic the host. Only systems that actually enable the fscache/cachefiles caching backend with cachefilesd running are exposed; the assessed vector is local-only (AV:L) with some existing privilege (PR:L) and high complexity (AC:H), because the attacker cannot reliably force the internal tmpfile-creation failure that triggers the flaw. Vendor patches are available for the stable branches (6.12.111, 6.18.53) and the 7.2 mainline fix; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.
Out-of-bounds read in the Linux kernel's cfg80211 wireless stack allows an attacker within 802.11 radio range to deliver a crafted, too-short association-response management frame - including the S1G variant with its distinct information-element offsets - which the client parses during the association window before frame length is validated, resulting in reads beyond the received buffer that can crash the kernel (availability impact) and expose limited adjacent memory. No authentication is required (CVSS PR:N) and no user interaction is needed, but exploitation is constrained to over-the-air proximity to a client that is actively associating on a vulnerable pre-patch kernel; a target with WiFi disabled or not associating is unaffected, there is no Internet reachability, and no public exploit code has been identified at time of analysis. Vendor patches are available for the affected stable and mainline branches.
Uninitialized stack memory in the Linux kernel's cifs/SMB client can leave fields of the stack-allocated cifs_open_info_data structure holding stale values, so a client that mounts and operates on an SMB share whose server responses fail to populate those fields may act on incorrect metadata. Exploitation requires a local user with the ability to trigger the affected file operations on a mounted share (CVSS vector AV:L/AC:H/PR:L/UI:N, consistent with our independent assessment of C:L/I:L/A:N rather than the higher-scored 7.0 record) and is realistically driven by a malicious or misbehaving SMB server, not by remote unauthenticated attackers. Only kernels prior to 6.12.111, prior to 6.18.53, and prior to 7.2 are affected; vendor fixes are available and no public exploit has been identified at time of analysis.
Out-of-bounds array indexing in the Linux kernel's iwlwifi mvm wireless driver can crash the kernel and read a small amount of adjacent memory when a compromised or malicious Intel WiFi adapter firmware sends a BA_WINDOW_STATUS_NOTIFICATION containing an out-of-range station ID. Systems running affected kernels before 6.12.111 or before 6.18.53 with an active Intel WiFi device are in scope, but the attacker must already control the firmware-side notification, so the NVD CVSS 3.1 score of 8.8 (AV:A/AC:L/PR:N/UI:N) substantially overstates real-world risk. No public exploit code or confirmed active exploitation was identified at time of analysis.
A soundness bug in the Linux kernel BPF verifier lets a crafted eBPF program slip past verification: when handling a 32-bit 'if w1 != 0' comparison, is_branch_taken() fails to distinguish BPF_JMP32 from BPF_JMP, wrongly reports the jump as always taken, and then tracks the wrong execution path for the rest of the program - leaving register bounds inconsistent with runtime behaviour. A local attacker who can load eBPF programs (CAP_BPF/CAP_SYS_ADMIN, or a host where kernel.unprivileged_bpf_disabled has been turned off) can turn this into memory corruption and kernel privilege escalation, with the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.0) rating high confidentiality, integrity and availability impact. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; practical risk is strongly limited by the default posture of disabling unprivileged BPF on modern distributions.
The Linux kernel's bcm_sf2 (Broadcom Starfighter2) DSA switch driver walks the entire CFP 'unique' rule bitmap into a caller-supplied rule_locs[] array without limiting the walk to nfc->rule_cnt, so a local, low-privileged user can read/write past the end of that allocation - or, with rule_cnt of 0, trigger a NULL-pointer dereference - simply by issuing the ETHTOOL_GRXCLSRLALL ethtool ioctl with a slot count smaller than the number of installed CFP rules. The ioctl itself requires no CAP_NET_ADMIN, but the bug is only reachable after a privileged administrator has installed at least one CFP classification rule, so it is confined to embedded or networking hardware that uses the Broadcom SF2 integrated switch and is not a risk on generic or default kernels; no public exploit has been identified at time of analysis. Our independent assessment scores it AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H (NVD publishes 7.0), reflecting a local attack path, a privileged precondition, impact dominated by availability, and only limited integrity exposure rather than the confidentiality/integrity compromise implied by the higher vendor score.
An out-of-bounds write, plus a NULL pointer dereference path, exists in the Linux kernel's nfp driver for Netronome/Corigine SmartNICs: nfp_net_get_fs_loc() walks every entry in nn->fs.list and dumps it into rule_locs[] without checking cmd->rule_cnt, the number of slots the caller actually allocated. A local, low-privileged user session can reach this path because the ETHTOOL_GRXCLSRLALL ioctl requires no CAP_NET_ADMIN and sizes the buffer from the userspace-supplied rule_cnt, so passing fewer slots than installed rules (or 0, which leaves the destination pointer NULL) corrupts kernel memory; a system administrator must first have installed ethtool ntuple/flow-steering rules via CAP_NET_ADMIN, and the nfp driver must be loaded on real NFP hardware. The provided CVSS 3.1 record rates this 7.0 with C:H/I:H/A:H, while our independent assessment bounds it to CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, keeping local access and the high availability impact but scaling confidentiality and integrity down. No public exploit code or confirmed active exploitation was identified at time of analysis; vendor patches exist in Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3.
The mv88e6xxx DSA switch driver in the Linux kernel can be driven into an out-of-bounds kernel memory write - or a NULL-pointer dereference - by a local user issuing the ETHTOOL_GRXCLSRLALL ioctl on a host where an administrator has previously installed at least one RX-flow classification rule; the ioctl requires no CAP_NET_ADMIN, so any local account can reach the buggy path, although the most likely outcome is a kernel crash with limited integrity impact rather than code execution or data theft. The defect is a missing bound on the policy-rule dump: the caller's rule_cnt buffer limit is clobbered by the driver before it is ever read, and a value of 0 leaves the destination pointer NULL. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; vendor fixes are available in the stable trees (6.12.111, 6.18.53, 7.2.7 and 7.3-rc3), and per the independent assessment exploitation is gated on non-default prerequisites - Marvell switch hardware using this driver plus pre-existing policy rules installed by a privileged administrator.
A race condition in the Linux kernel's VXLAN driver (vxlan_fdb_destroy / vxlan_cleanup path) lets a local attacker holding CAP_NET_ADMIN corrupt the shared per-nexthop FDB list and trigger a slab-use-after-free, producing kernel memory corruption that can crash the host and may be leveraged for privilege escalation. Kernels that support FDB nexthops in VXLAN (introduced around 5.8) are affected up to the released fixes, but the bug is only reachable in a non-default EVPN-style topology in which at least two VXLAN devices reference the same FDB nexthop id, data-plane learning is disabled, and 'dynamic' FDB entries are created so they become eligible for the aging timer. Practical risk is far lower than the NVD base score of 7.8 implies: exploitation demands privileged local access, an uncommon shared-nexthop configuration, and winning a timing-dependent race, and there is no public exploit identified at time of analysis and no CISA KEV listing; the vendor has released patches.
Use-after-free in the Linux kernel net/sched traffic-control subsystem allows a local attacker holding CAP_NET_ADMIN to crash the kernel by sending a crafted RTM_NEWQDISC netlink request that installs a clsact qdisc binding a populated shared ingress block while also carrying an invalid TCA_RATE attribute, so estimator setup fails after ->init() has already published the embedded mini_Qdisc and the unwind path synchronously frees that qdisc while lockless readers on the tc_run() packet path may still hold a pointer to it. The assessed vector (AV:L/AC:H/PR:L/UI:N) reflects that exploitation needs local privileges plus a race window that only reliably opens with concurrent traffic on the affected interface, and the resulting impact is denial of service through a kernel crash rather than code execution or data compromise. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; kernel.org released fixes in the referenced stable branches.
A kernel error-handling bug in the AMD IOMMU nested-domain allocation path of the Linux kernel (7.x, AMD-Vi/vIOMMU systems) causes domain-ID allocation failures to be silently ignored, so a nested IOMMU domain can be set up using a host domain ID that was never actually allocated. The flaw is reachable only by a locally privileged caller able to create IOMMU domains (iommufd/vIOMMU nested translation) and only when amd_iommu_pdom_id_alloc() actually fails (domain-ID space exhaustion or short memory), so it is a real but difficult-to-trigger error-path defect with no public exploit identified at time of analysis. Notably, the 7.8 NVD-style score (S:C/C:H/I:H/A:H) is inconsistent with the practical impact, which the independent assessment rates as limited integrity and availability gain on the error path only; vendor patches are available.
Local users who already hold access to a vdpa_sim_blk virtio-block device can drive requests whose start sector is at or beyond the device capacity, causing an unsigned underflow in vdpasim_blk_check_range() that forwards a wildly out-of-range buffer offset into the data path and yields out-of-bounds writes (VIRTIO_BLK_T_OUT copy-in, VIRTIO_BLK_T_WRITE_ZEROES memset) and out-of-bounds reads (VIRTIO_BLK_T_IN). The flaw affects Linux kernels built with the CONFIG_VDPA_SIM_BLK simulator driver since the feature was introduced (around 5.13) and is fixed by stable patches 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3; there is no public exploit code and no confirmed active exploitation (no public exploit identified at time of analysis), and the practical risk is bounded because this is a development/simulation driver that is rarely enabled on production systems. The independently assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H) treats integrity and availability as the dominant impacts and downgrades confidentiality relative to the vendor score.
The vdpa_sim_net virtual network simulator driver in the Linux kernel fails to check the signed return value of vringh_iov_pull_iotlb() when processing a TX descriptor, so a negative error code is added to an unsigned byte counter and later used as a size_t length for receive_filter() and vringh_iov_push_iotlb() in the RX path - turning an error into an oversized copy length. Only systems built with CONFIG_VDPA_SIM_NET that have loaded the vdpa_sim_net simulator module and expose a vhost-vdpa device to a local user are affected; this is a test/simulator driver not normally loaded in production, and the independent assessment rates exploitation as high complexity (AC:H) requiring local access (PR:L). There is no public exploit code identified at time of analysis, and the flaw was self-reported by the developer rather than observed in the wild; vendor fixes are already released in Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3.
Local denial of service in the Linux kernel's newly introduced nstree/listns() namespace-listing infrastructure, where the kernel takes a reference on a candidate mount namespace before the caller's permission to see it has been checked, so on the denial path the final reference can be dropped inside an RCU read-side critical section and put_mnt_ns() may sleep there. Only kernels new enough to contain the nstree code (introduced by commit 76b6f5dfb3fd, present in Linux 6.19 and 7.x builds such as the 7.0.0-30-generic Ubuntu kernel in the reported splat) are affected, and triggering requires a local, already-authenticated user (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H per our assessment - no confidentiality impact and only low integrity impact, far below the formally published 7.8 vector) who can invoke listns(). The result is a 'Voluntary context switch within RCU read-side critical section' splat that can escalate to an RCU stall or hang on affected kernels; no public exploit has been identified at time of analysis and there is no KEV listing.
Heap out-of-bounds write in the Linux kernel's hinic network driver (Huawei HiNIC NICs), where check_mbox_seq_id_and_seg_len() permits the final mailbox segment (seq_id=42) to carry a full 48-byte payload, writing 16 bytes past the 2048-byte MBOX_MAX_BUF_SZ receive buffer. The bug is reachable only where the hinic driver is loaded and a mailbox segment can be injected with seq_id=42 and a maximal payload - realistically via the PF/VF hardware mailbox path (for example a malicious VF in an SR-IOV setup) or a compromised device - so per our independent assessment the input CVSS 3.1 score of 8.8 (S:C, C:H/I:H/A:H) materially overstates real-world risk relative to the more realistic AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H profile, which favors a device crash or DoS over reliable code execution. There is no public exploit identified at time of analysis and no CISA KEV listing; vendor patches are available in the stable trees. The sibling hinic3 driver already handled this case correctly via MBOX_LAST_SEG_MAX_LEN, and the same check has now been ported to hinic.
TX ring memory corruption in the Linux kernel's stmmac (STMicroelectronics DWMAC/DWXGMAC) Ethernet driver allows a local sender to overwrite TX descriptors that are still owned by the DMA engine. The flaw is in the stmmac TSO transmit path: stmmac_tso_xmit() underestimates how many free descriptors a highly-fragmented TSO skb will actually consume, so a nearly-full descriptor ring can pass the availability check and let stmmac_tso_allocator() write past the available slots. Exploitation requires the stmmac driver in use with TSO/GSO enabled and a local sender able to submit a large, heavily-fragmented TSO skb at the moment the ring is almost full; the assessed impact is limited integrity damage and availability loss on affected (largely ARM/embedded STMicro MAC) systems, and no public exploit has been identified at time of analysis.
Linux kernel builds in the 7.2 development series contain a regression in the mm/slab allocator that lets an unprivileged local user corrupt the kernel's partial-slab lists by winning a narrow multi-CPU race, resulting in a list_add corruption BUG and a fatal kernel panic (denial of service). The independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H: the attacker needs only an ordinary local account and no user interaction, but must win a tight timing window in which one CPU inserts a slab onto pc.slabs outside n->list_lock while another is removing that slab from n->partial, as demonstrated in the upstream report through the System V message-queue (msgsnd) path running as UID 65534. The issue is not listed in CISA KEV and no public exploit was identified at time of analysis, although the upstream report includes a reproducer trace; vendor fixes are released as stable commits 570a6aaf6b52c6ec098f4811cdb52b1496f13d15 (Linux 7.2.7) and 4a724bcf5d703e18957397914d79156fa2cf1174 (Linux 7.3-rc3).
A use-after-free race in the Linux kernel's IPv6 FIB6 route-table walker lets a local user who can delete IPv6 routes free a seq private object while it is still linked on net->ipv6.fib6_walkers, after which a subsequent route deletion traverses the dangling list and dereferences the freed walker. The race is triggered by concurrently iterating the route table through /proc/net/ipv6_route or the BPF ipv6_route iterator while removing the last route at a FIB6 table root, and the BPF show path only widens the already non-deterministic window. Exploitation requires local access on an IPv6-enabled host, is timing-dependent, and typically needs route-deletion privileges (CAP_NET_ADMIN, sometimes reachable via unprivileged user namespaces); assessed impact is kernel memory corruption resulting in low integrity impact and high availability impact (crash/DoS), with potential privilege-escalation consequences in that local context. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available in the referenced stable trees.
A memory-lifetime bug in the Linux kernel's ftrace function-graph tracer allows a child task to free its parent's active function-graph return stack (ret_stack), after which the parent writes to the freed slab object inside function_graph_enter_regs(). The flaw is reachable only on the fork error path: ftrace_graph_init_task() runs after copy_exec_state(), so when a non-CLONE_VM fork's task_exec_state allocation fails under memory pressure, copy_process() unwinds through bad_fork_free/free_task() and ftrace_graph_exit_task() frees the still-shared parent ret_stack; systems that never enable the function_graph tracer are unaffected, and the trigger path normally requires privileged (tracefs) access, so exploitation prerequisites are local and configuration-dependent. Published CVSS 3.1 is 7.8 (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H), but our independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H because the attacker must both have function_graph tracing active and force an allocation failure; no public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Linux kernel ALSA us122l driver code leaves VM_MAYWRITE set on read-buffer mappings that were created with PROT_READ, so a local user who can open the hwdep character node O_RDWR can simply call mprotect() to upgrade that mapping to writable after the initial rejection. Once writable, the attacker can alter the struct usb_stream read_size field, which the fault handler uses to decide which pages belong to the read buffer and which usb_stream_free() uses to size the free_pages_exact() release, resulting in out-of-bounds page mapping/access and out-of-bounds freeing of memory outside the allocation. Exploitation requires local authenticated access to /dev/snd's us122l hwdep node plus a physically attached Tascam US-122L-class USB audio device, so no public exploit code has been identified at time of analysis and the practical risk is modest despite the 7.0 base score; the independent assessment rates confidentiality and integrity impact as limited with availability impact high.
Out-of-bounds memory access in the Linux kernel's UFS (BSD FFS/UFS2) filesystem driver is reachable when the kernel mounts an attacker-crafted UFS image, because ufs_read_cylinder() caches unvalidated cylinder-group metadata and later uses it as an array index and bitmap-scan start during ordinary block and inode allocation or free. Affected are kernels from the initial git import (commit 1da177e4, i.e. Linux 2.6.12 era) through the 6.12.x, 6.18.x and 7.2.x lines prior to the stable fixes 6.12.111, 6.18.53 and 7.2.7 (mainline 7.3-rc3), with UFS support compiled in; per the CVSS vector the flaw is unauthenticated (PR:N) but requires high-complexity prerequisite conditions and user interaction (AV:L/AC:H/UI:R), since the victim must actually mount the malicious image, typically via removable-media automount or an explicit mount. The CNA scores this 7.0, but our independent assessment rates confidentiality and integrity impact as Low and only availability as High (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H), because mounting arbitrary images normally requires CAP_SYS_ADMIN and the trigger is contingent on subsequent allocation activity; no public exploit code and no CISA KEV entry were identified at time of analysis.
Memory corruption and denial of service in the Linux kernel's accel/ethosu driver can be triggered by an authenticated local user with access to the Arm Ethos-U NPU device by submitting a job that sets its SRAM size to 0 while the command stream still contains SRAM accesses; this causes the region base register write to be skipped and a stale base address from a prior job to be used. The independent assessment rates the impact as low confidentiality and integrity with high availability (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H), noting that the NVD score of 7.8 likely overstates the real impact because the flaw is limited to SRAM regions and requires niche Ethos-U hardware. No public exploit code has been identified, and the vulnerability is not known to be actively exploited; a vendor patch is available.
An out-of-bounds write in the Linux kernel's ASoC compress-audio platform driver for Spreadtrum/Unisoc (sprd) SoCs lets an authenticated local user who can open the SPRD compress PCM device corrupt kernel memory: the driver allocates fixed 32 KB IRAM and 2 MB DDR stage buffers but derives all copy lengths from the user-controlled fragment_size and buffer_size supplied via SNDRV_COMPRESS_SET_PARAMS, so an oversized request overflows past those fixed allocations during write(). The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H (7.8, HIGH), reflecting deterministic local exploitation with no user interaction and no need for SNDRV_PCM_TRIGGER_START, though impact is confined to Unisoc/Spreadtrum platforms that actually build and load this driver. Vendor-released patches are available (Linux 6.12.111, 6.18.53, 7.2.7, and 7.3-rc3); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Discovery is credited to Atuin, an automated vulnerability discovery engine, and the issue is tracked as EUVD-2026-86764.
A slab use-after-free in the Linux kernel process-exit path lets a local user with an ordinary account crash or destabilize the system by winning a narrow race between wait4(-1) reaping an exiting task and a concurrent setsid() that drops the last PIDTYPE link for that task's struct pid. The bug affects kernels carrying the 0a36bad01731 regression (Linux 6.16 through the 6.18.53/7.2.7 fixes) and requires local authenticated access (CVSS PR:L), with success being timing-dependent; the outcome observed under KASAN is a kernel crash from a bad read of pid->inodes in proc_invalidate_siblings_dcache, not a controlled read/write or privilege gain. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, although a tested reproducer exists privately; patch status is vendor-released, with fixes shipping in 6.18.53, 7.2.7, and 7.3-rc3.
Linux kernel MPLS handling retains a stale inner_protocol/inner_network_header record after the last MPLS label is popped, so a subsequent MPLS push combined with Open vSwitch recirculation and fragmentation causes ovs_fragment() to trust a stale header offset and compute a wildly oversized memcpy that crashes the kernel. Affected are Linux builds exposing the MPLS datapath plus either Open vSwitch push/pop/fragment actions or the tc act_mpls action; exploitation requires local access with CAP_NET_ADMIN to program the datapath and a host already configured with those actions, and the observed outcome is a deterministic kernel BUG/page fault rather than a controllable code-execution or data-disclosure primitive, consistent with our assessed vector (AV:L/AC:H/PR:L, C:N/I:L/A:H). Vendor patches are available for the stable branches (6.12.111, 6.18.53, 7.2.7, 7.3-rc3), and no public exploit code has been identified at time of analysis; CVE-2026-97612 is not in CISA KEV.
Use-after-free in the Linux kernel's in-kernel Open vSwitch datapath lets a local user holding CAP_NET_ADMIN crash the kernel by racing flow-table mask reallocation against packet lookups. Because tbl_mask_array_realloc() retires the old mask array with call_rcu() before repointing tbl->mask_array at the new one, a lookup that enters ovs_flow_tbl_lookup_stats() during that preemptible window can dereference memory that mask_array_rcu_cb() has already kfree()'d, producing the KASAN slab-use-after-free observed on the fast path. Exploitation requires the openvswitch datapath to be loaded and actively processing flows and depends on winning a narrow timing window, so the realistic outcome is kernel panic/denial of service rather than reliable data disclosure or code execution; no public exploit identified at time of analysis, and vendor patches are available (Linux 6.12.111, 6.18.53, 7.2.7, 7.3-rc3).
A use-after-free race in the Linux kernel's nfnetlink_cttimeout netfilter module lets a local attacker who holds CAP_NET_ADMIN and can trigger module unload or network-namespace teardown crash or corrupt kernel memory via the connection-tracking timeout policy path. The flaw exists because cttimeout_exit() unregisters the per-net operations (freeing the per-net timeout storage) before clearing the nf_ct_timeout_hook, so a concurrent nf_ct_set_timeout() call reached through an iptables/xtables CT target can dereference the stale hook and read already-freed memory. KASAN-reported use-after-free; no public exploit identified at time of analysis, and exploitation requires a narrow timing race plus elevated privileges (CAP_NET_ADMIN, and CAP_SYS_MODULE/root or repeated netns churn), so the practical outcome is a kernel crash rather than controlled corruption.
Linux kernel netfilter logging (the nf_log_syslog and nfnetlink_log backends) contains a teardown-ordering race that leaves a stale per-network-namespace logger pointer which later sysctl reads or packet-logging operations dereference. A local actor able to rebind the kernel's log backend - realistically requiring CAP_NET_ADMIN in the target network namespace - must win a narrow timing window against module unload or network-namespace exit, so the assessed impact is no confidentiality loss, limited integrity impact, and high availability impact (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). Vendor patches are available in stable releases 6.12.111, 6.18.53 and 7.2.7 (mainline 7.3-rc3), and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis.
Heap corruption in the Linux kernel's IPv6 fragment reassembly logic can be turned into local privilege escalation by a low-privileged local user (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H in our assessment) on systems where unprivileged user/network namespaces are enabled and IPv6 fragment processing is reachable. The flaw stems from a race during network-namespace teardown: fqdir_pre_exit() flushes the skbs held in incomplete fragment queues without marking those queues complete, so a fragment that acquired a reference just before high_thresh was cleared can reuse stale reassembly metadata, and ip6_frag_reasm() then applies an old nhoffset to a new skb, producing an out-of-bounds write (KASAN: slab-out-of-bounds in ipv6_frag_rcv / ip6_protocol_deliver_rcu against skbuff_small_head). Successful exploitation yields kernel heap corruption exploitable for elevation to root; the primary limiting factor is winning the race between fqdir teardown and concurrent reassembly, and no public exploit code or confirmed active exploitation has been identified at time of analysis. A separate side effect is that unflushed fragments can keep conntrack references alive past the per-net conntrack cleanup point.
Use-after-free in the Linux kernel's mac802154 (IEEE 802.15.4 soft-MAC) RX path lets queued beacon or MAC-command frames keep a pointer to an 802.15.4 interface's private data (sdata) after that interface has been removed, so a later worker run dereferences freed memory and crashes the kernel. Triggering it requires two simultaneous conditions: an attacker within 802.15.4 radio range flooding a victim interface to fill the rx_beacon_list/rx_mac_cmd_list, and that interface being unregistered or its whole phy torn down while frames are still queued - the teardown step generally requires administrative/local privilege (PR:L in our assessment, not the PR:N shown in the 7.5 NVD vector), and the race window is narrow (AC:H). The realistic outcome is a kernel crash / denial of service rather than data theft, and no public exploit code was identified at time of analysis.
A use-after-free in the Linux kernel's Landlock security module (current_check_refer_path()/hook_path_link()) lets a local process that has already entered a Landlock domain handling at least one filesystem access right race a linkat(2) loop against rename(2) plus rmdir(2) so that a freed parent dentry is walked during security_path_link(), triggering a KASAN slab-use-after-free. Impact per our independent assessment is primarily availability (kernel memory corruption/crash) with limited integrity effects, not confidentiality; the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, which is lower on complexity and confidentiality than the vendor-published CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - signals conflict sharply on severity. Exploitation requires local code execution, membership in an active Landlock domain, and winning a timing-sensitive race; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no public exploit has been identified at time of analysis.
Double completion of asynchronous crypto requests in Linux kernel s390 protected-key drivers (paes_s390 and phmac_s390) can crash or destabilize IBM Z systems when an error path returns a negative code after the request was already finalized. The issue is local-only, requires some privileges (PR:L) and high complexity (AC:H), and is limited to s390 hardware using these drivers; the independent assessment rates real-world risk as low despite NVD's 7.0 base score, with integrity and availability impact but no confidentiality impact. Vendor patches are available and no public exploit has been identified at time of analysis.
An incorrect free in the Linux kernel's AFS (kAFS/AndrewFS) client, in afs_lookup_server(), allows a local, low-privileged user who has an AFS filesystem mounted to crash the kernel; the faulty code path is only reached during racy candidate-server cleanup, so it is confined to hosts actually running the kAFS client. Kernels from roughly 6.15 up to the fixed 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3 releases are affected, and while NVD scores this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), our independent assessment lowers it to AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H because the realistic outcome is a kernel crash in a rare configuration rather than controllable memory corruption. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Use-after-free in the Linux kernel AFS filesystem client's peer address-refresh logic allows a crash or, potentially, limited memory corruption when an AFS fileserver endpoint list is refreshed while an inbound RxRPC callback still holds the old peer. The bug arises because afs_fs_probe_fileserver() fetches endpoint state with old_alist left NULL, so afs_set_peer_appdata() treats every list replacement as initial setup, binds the new peers but never unbinds the removed ones; a peer (Pold) is then freed by the server's RCU callback while still pinned through an RxRPC connection, and a later callback dereferences the freed server (KASAN slab-use-after-free in afs_find_server). Exploitation requires a host with an AFS volume mounted over the kernel afs/rxrpc stack plus the correct multi-event race between an address-list refresh and an incoming callback, so it is assessed as AV:L/AC:H/PR:L/UI:N with bounded impact (C:N/I:L/A:H) rather than the network-reachable NVD vector; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the affected footprint is limited to AFS deployments, which are uncommon. Vendor-released patches addressing the flaw are available in the stable trees.
Out-of-bounds writes in the Linux kernel's rkvdec driver for Rockchip stateless HEVC video decoding let a local user who can open the V4L2 decoder device submit a crafted HEVC Picture Parameter Set and drive tile-loop counters and the pic_parameter_set_id beyond the driver's hardware table capacity, corrupting adjacent kernel/driver memory. Exploitation is gated on Rockchip decode hardware being present and on local low-privileged access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, per the independent assessment), and the realistic outcome is a kernel crash or integrity impact rather than code execution or data disclosure; no public exploit has been identified at time of analysis. The issue is fixed in the vendor's stable trees via upstream commits 03beb248d8a7bab30559a60d4df81f167e63b9e3 and 81ad46bb33d8fd279aaa33af5296c648814c964b, corresponding to the Linux 7.2.7 and 7.3-rc3 releases.
A local out-of-bounds write in the Linux kernel's MediaTek vcodec AV1 decoder (vdec_av1_slice_setup_tile) lets an attacker who can open the mtk-vcodec V4L2 stateless AV1 decode device node and submit a crafted bitstream copy tile_info entries beyond the capacity of the mi_col_starts[]/mi_row_starts[] arrays, corrupting adjacent kernel memory. Exploitation is confined to MediaTek SoC platforms that actually ship the AV1 decoder driver and expose the decode device locally; our independent assessment rates it AV:L/AC:H/PR:L with high availability impact but only limited integrity impact and no confidentiality impact, which is substantially lower than the 7.8 base score published by NVD. No public exploit code has been identified at time of analysis, and vendor-released patches are available (Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3).
A local user on Rockchip RK3588-class systems can crash the kernel, and potentially corrupt a small DMA descriptor buffer, by submitting a crafted AV1 stateless-decode request to the verisilicon VPU981 hardware decoder driver. The flaw lies in rockchip_vpu981_av1_dec_set_tile_info(), which divides context_update_tile_id by a bitstream-controlled tile_cols value without checking for zero and writes one descriptor per tile into a fixed-size tile_info buffer holding only AV1_MAX_TILES entries. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, but vendor-released fixes are available in Linux 6.12.111, 6.18.53, 7.2.7, and 7.3-rc3. Note the discrepancy between the published 7.8 score (C:H/I:H/A:H) and the independent assessment, which rates confidentiality impact None, integrity Low, and availability High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) because reachability is confined to this specific SoC decoder and the attacker must already hold local access to the V4L2 decode node.
Out-of-bounds access in the Linux kernel's Rockchip VPU981 stateless AV1 video decoder (drivers/media/platform/verisilicon) allows a local, low-privileged user who can open the decoder's V4L2 device node to read past the tile group entry control array and to program the hardware with more tiles than the descriptor buffer holds, by submitting a crafted AV1 frame that declares tile_cols * tile_rows larger than either the number of tile group entries supplied or AV1_MAX_TILES. The assessed impact is primarily denial of service (kernel memory corruption/hardware misprogramming can crash the decoder path) with limited integrity impact and a potential information-disclosure angle, reflected in our scored vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. Exploitation requires the specific Rockchip VPU981-class hardware plus an exposed stateless AV1 decoder node, which sharply narrows the exposed population versus a generic kernel flaw; no public exploit has been identified at time of analysis, and vendor patches are available in Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3.
Insufficient bounds validation of HEVC tile counts in the Linux kernel's V4L2 control framework lets a local user with access to a stateless HEVC decoder device node cause out-of-bounds reads by submitting a crafted V4L2_CTRL_TYPE_HEVC_PPS compound control. The kernel reads num_tile_columns_minus1 + 1 entries from column_width_minus1[] and num_tile_rows_minus1 + 1 entries from row_height_minus1[], and because std_validate_compound() does not bound these u8 counts, tile-loop bounds can run past the fixed-size uAPI arrays whenever tiling is enabled. Exploitation requires local access to a system exposing a V4L2 stateless HEVC decoder (typically ARM/SoC hardware codecs, often gated behind the 'video' group) plus the ability to issue a VIDIOC_S_EXT_CTRLS ioctl; it is not remotely reachable, and no public exploit has been identified at time of analysis. The impact is assessed as availability-focused with limited integrity effects (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) rather than the higher-confidentiality score sometimes attached to this CVE.
Out-of-range AV1 tile geometry submitted through the Video4Linux2 stateless-decoder control interface is not bounded by the kernel's compound-control validator in Linux 6.5 and later, so a local user who can open a mem2mem AV1 decode device can drive loop bounds, array indices, a divisor, and per-tile descriptor buffer sizing with attacker-controlled tile_cols/tile_rows values. The flaw is reachable only locally, requires an account with access to the relevant /dev/video* node (typically 'video' group membership) and a driver implementing a stateless AV1 decoder, and no public exploit code has been identified at time of analysis; the risk is therefore a config- and access-gated kernel memory-safety issue rather than a network-exploitable one. Exploitation prerequisites plus high attack complexity and the absence of any confidentiality impact keep the practical risk below the 7.8 score shown in some feeds - no vendor advisory has flagged active exploitation (not listed in CISA KEV).
Uninitialized-memory handling in the Linux kernel's Broadcom bnxt_en network driver can leave an rx_tpa[] entry zeroed after a failed TPA buffer reallocation during an RX ring reset, causing a zero DMA address to be handed to the NIC. The bug is not a remotely reachable path: the authoritative assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, and triggering it requires a host-side memory-allocation failure (-ENOMEM in bnxt_alloc_one_tpa_info_data) to coincide exactly with an RX ring reset on a NetXtreme-C/E adapter with TPA active, so NVD's 8.1 AV:N/PR:N score materially overstates the real risk. Vendor-released fixes exist in 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3, and no public exploit identified at time of analysis.
An out-of-bounds array access in the Linux kernel's Broadcom bnxt_en Ethernet driver can crash the kernel at boot or during receive processing on affected 57500/57600-family NICs, most notably the BCM57608 running firmware that advertises fewer concurrent TPA aggregations than the firmware's TPA ID range. Because the driver allocates rx_tpa with only bp->max_tpa entries (32 on the documented firmware version 233) while the software TPA ID derived from the firmware ID can reach 1023, bnxt_rx_pkt dereferences an invalid pointer and triggers a general protection fault. There is no public exploit identified at time of analysis, and the independent assessment is materially less severe than the published CVSS 8.1 - the flaw is a deterministic local/host-side denial-of-service condition on specific Broadcom hardware and firmware combinations, affects only kernels built from commit ec4d8e7cf024 onward, and no code execution or data disclosure primitive has been demonstrated. Remote attackers cannot trigger it without first gaining a position on the affected host's receive path; the operative impact is loss of availability (kernel panic).
A use-after-free race in the Linux kernel's CIFS/SMB client DFS automount handling lets a local user trigger a kernel memory-access fault by racing DFS automount expiry against a superblock lookup in __cifs_get_super(), producing a KASAN 'slab-use-after-free in cifs_sb_active' crash. Only hosts with an active DFS-enabled SMB/CIFS mount (DFS referrals and automount expiry in play) are exposed, the race window is narrow with high attack complexity, and the assessed impact is a denial of service/crash rather than reliable code execution. No public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
A reference-count leak in the Linux kernel CIFS/SMB client's oplock-break handling (cifs_queue_oplock_break) allows a failure path to hold an extra cifsFileInfo reference, which later causes unmount of the CIFS filesystem to fail with 'VFS: Busy inodes after unmount' and a kernel BUG at fs/super.c:777, resulting in a denial-of-service condition on affected hosts. The flaw is reachable when a second oplock break arrives while the first cifs_oplock_break work item is still queued, causing queue_work() to return false and the corresponding reference drop to be skipped; triggering it requires an SMB/CIFS share mounted from a server the attacker controls or that responds slowly, and mounting a share is normally a privileged operation on the client. No public exploit code was identified at time of analysis, and this issue is not in CISA KEV; while NVD assigns 7.5 (HIGH), the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, making this a moderate-to-low real-world risk because the race window is timing-dependent and the outcome is availability loss only.
Heap out-of-bounds write in the Linux kernel CIFS/SMB client (fs/smb/client) can corrupt slab memory when an ACL rewrite expands owner/group SIDs beyond the buffer that was sized from the on-disk DACL length. It is only reachable on systems that mount an SMB/CIFS share with the non-default cifsacl or modefromsid options and then trigger a local ACL-modifying operation such as chown or chmod, so the realistic outcome is kernel memory corruption or a crash rather than a remote attack; the source CVSS vector (8.8, AV:N/AC:L/PR:N/UI:R) is inconsistent with this local, mount-option-gated path. No confirmed active exploitation (no CISA KEV) and no public exploit code have been identified, and vendor patches are available with fixed builds including 6.18.53, 6.12.111, 7.2.7 and 7.3-rc3.
Out-of-bounds memory access in the Linux kernel XFS realtime reverse-mapping (rtrmapbt) and realtime refcount (rtrefcountbt) btree code stems from _maxlevels_ondisk functions that omit the inode root level when sizing in-memory btree cursors, so a tall btree can drive accesses past the end of the allocated cursor. Local attackers on an XFS filesystem that uses a realtime device together with rtrmapbt or rtrefcountbt can trigger the condition; the non-default feature combination and the requirement for a sufficiently large btree keep exposure limited, and our assessment rates it local-only with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) rather than the more severe 7.8 vector supplied with the CVE. Vendor patches are available in stable kernels 6.18.53, 7.2.7 and 7.3-rc3, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Use-after-free in the Linux kernel qla2xxx QLogic Fibre Channel HBA driver allows a locally privileged actor to crash the kernel when a pending response-queue work item (qla_do_work) executes against qpair and response-queue memory that has already been freed during queue teardown. The flaw affects kernels carrying the qla2xxx driver built from the parent commit 68ca949cdb04b4dc71451a999148fbc5f187a220, and is fixed by upstream commits 1710a69fd74d0b4bdfcc57c3309b1c4057f70d85, f1f4d1cb93eeeb250eac9405121933e268eefbd3 and 19788a55cab61d78e33e0914a5a31d27843e8a4a released in Linux 6.18.53, 7.2.7 and 7.3-rc1. Exploitation is gated on winning a narrow teardown race and requires the ability to trigger privileged teardown operations (module unload, device removal, HBA reconfiguration); no active exploitation is confirmed (not in CISA KEV) and no public exploit code was identified at time of analysis. The practical outcome is primarily a kernel crash/denial of service rather than a reliable escalation primitive.
Use-after-free in the Linux kernel's qla2xxx QLogic Fibre Channel HBA driver lets a local attacker with high privileges (root/CAP_SYS_ADMIN) race a virtual port (vport) teardown against an asynchronous fabric report-ID acquisition, causing qla24xx_report_id_acquisition() to re-insert a vport already marked VPORT_DELETE into host_map, so a later lookup dereferences memory freed by scsi_host_put(). The assessed impact is availability-high with integrity-low and no confidentiality impact (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H), and exploitation requires the qla2xxx driver with NPIV vports in use; no public exploit has been identified at time of analysis.
Use-after-free and linked-list corruption in the Linux kernel's qla2xxx QLogic Fibre Channel driver can occur when the NVMe-over-Fibre-Channel transport takes the LS-response reject error path in qla_nvme_xmt_ls_rsp(): the uctx structure is freed with kfree() while still linked in fcport->unsol_ctx_head, so a later list_add_tail() writes through the freed node and a subsequent list_del() can corrupt the list or panic the kernel. Affected configurations are hosts running the qla2xxx driver against a QLogic FC HBA with the NVMe-oF FC transport active, primarily enterprise SAN deployments; per the independent assessment this is a local/adjacent, high-complexity issue (AV:L/AC:H/PR:L) whose triggering depends on an error/reject condition on the LS response path rather than directly attacker-chosen input, a notable reduction from the 8.8 input score. There is no public exploit code identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing); vendor patches are available in the stable trees.
Concurrent list manipulation in the Linux kernel qla2xxx Fibre Channel driver can corrupt the per-fcport NVMe unsolicited-context list, leading to kernel instability or crashes on hosts using QLogic FC HBAs in NVMe-FC mode. The fcport->unsol_ctx_head list is mutated from four different contexts (the response-queue ISR, the DPC/purex worker, the NVMe-FC transport callback and SRB completion) without a shared lock; because multiqueue adapters add entries through different qpairs, the qpair qp_lock cannot serialize the per-fcport list, so a concurrent add/delete or two concurrent deletes can corrupt list pointers. Our independent assessment treats this as a local, high-complexity timing/reliability defect (AV:L/AC:H/PR:L/UI:N, C:N/I:L/A:H) driven by normal NVMe-FC traffic rather than attacker-supplied input - materially lower than the published 8.8 AV:A vector - and no public exploit was identified at time of analysis.
A memory-management correctness defect in the Linux kernel's x86 page-attribute code (arch/x86/mm/pat) causes split page tables to be allocated outside the normal kernel page-table path, so they are never marked as kernel page tables and their associated IOTLB entries are not invalidated when the tables are freed. Exploitation requires local, high-privileged access on an affected kernel (the 6.18.7 through 6.18.53 band or 6.19) that also runs an IOMMU with shared virtual addressing (SVA), plus a timing/reuse window in which a stale IOTLB entry is actually consumed; the independent assessment rates the realistic impact as negligible confidentiality impact, limited integrity impact and possible availability impact (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H), materially below the 8.2 vendor-published vector. There is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), while vendor-released fixes are available in Linux 6.18.53, 7.2.7 and 7.3-rc4.
Denial of service in the Linux kernel's Multipath TCP (MPTCP) receive path can occur when a subflow is reset during exceptional error handling, letting the receive path recursively re-enter mptcp_data_ready() and attempt to take the data lock a second time. The defect affects MPTCP-enabled kernels across several stable branches prior to fixes released in 6.12.111, 6.18.53, 7.2.7 and 7.3-rc4, and only hosts that actually run MPTCP connections carrying subflows are exposed; the traffic is reachable unauthenticated from the network (CVSS PR:N), but the triggering window is exceptionally rare and not deterministically reachable, which is why attack complexity is assessed as High. No public exploit identified at time of analysis and there is no confirmed active exploitation; the authoritative assessment classifies this as a robustness/reliability bug rather than a security-priority issue.
Divide-by-zero in the Linux kernel's Multipath TCP (MPTCP) scheduler allows an unauthenticated remote peer to crash an affected host, because a race between subflow selection for transmission and a subflow socket state change can leave the connection's MSS value (mss_now) reset to zero, which is then used as a divisor on a later release path. Only systems built with CONFIG_MPTCP and carrying multipath connections with multiple subflows are exposed - single-path TCP is unaffected - and successful triggering depends on hitting a narrow timing window rather than deterministic attacker control, consistent with an assessed vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (availability-only impact, no confidentiality or integrity loss). No public exploit code and no evidence of active exploitation were identified at time of analysis, and although the CVE is tagged 'Information Disclosure', the described behavior and the CVSS vector indicate a pure denial-of-service defect.
An integer overflow in the BSON encoder of the MongoDB Python Driver's bundled native C extension (PyMongo before 4.18.2) can cause an out-of-bounds write inside the process hosting the driver when an application encodes a single document built from an unusually large (~2 GB) caller-supplied value. Only builds that link the C extension are affected - the pure-Python BSON fallback is not - and successfully triggering it requires that a large attacker-influenced value actually reach the encoding path, so most applications are exposed only through data they already accept from untrusted sources. The flaw is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis; the vendor has released 4.18.2 as the fixed version, and because impact is confined to the hosting application's own process, risk is best treated as a genuine but precondition-heavy memory-corruption issue.
Attackers can inject arbitrary additional servers into a PyMongo (MongoDB Python Driver) client's connection topology by smuggling the percent-encoded form of a host-list delimiter (for example %2C) inside a hostname value that an application places into a connection string, because PyMongo decodes percent-escapes before it splits the host list. The request is unauthenticated (CVSS 4.0 PR:N) but carries an attack-requirement prerequisite (AT:P): the target application must build a URI at runtime from a host the attacker can influence, meaning static or hardcoded connection strings are not exploitable. MongoDB's own CVSS 4.0 rating of 8.3 (High) is driven by a high integrity impact - the client may route its authentication exchange and subsequent database operations to the rogue host, which can observe limited information and return altered query results. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in PyMongo 4.18.2.
Authentication bypass in Python Social Auth (social-core) versions prior to 5.0.0 allows unauthenticated remote attackers to impersonate any VK user when an application uses the vk-app backend, as the backend skips signature verification if the auth_key parameter is omitted. An attacker can forge callback fields such as viewer_id, access_token, api_id, and api_result to authenticate as an arbitrary VK identity, potentially taking over accounts in the target application. The vulnerability is fixed in version 5.0.0, and no public exploit code or active exploitation has been identified at this time.
Malicious or compromised X servers can crash X clients linked against libXi before 1.8.4 by returning malformed XI2 device-class data that the library's XI2 class parser reads out of bounds, producing an availability-only denial of service against the connected client. The attack needs no authentication on the server side (CVSS AV:N/PR:N) but is gated by user interaction (UI:R), because the victim must establish an X protocol connection to the attacker-controlled server; there is no memory disclosure back to the attacker, no integrity impact, and no code execution. A vendor fix is available (upstream merge request 23, commit e2089ab, with the affected range documented as libXi before 1.8.4), and no public exploit code was identified at time of analysis. Practically, the risk is lower than the 7.4 base score suggests, since the only outcome is a client-side crash.
An iterator-handling defect in the Linux kernel's GFS2 clustered filesystem quota initialization routine (gfs2_quota_init) can be reached when a GFS2 filesystem is mounted, leading to a potential crash or memory-safety consequence rather than remote compromise. Only systems that build and actually mount GFS2 volumes are exposed, which is uncommon outside high-availability cluster deployments. NVD assigns a 7.1 base score under the AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H vector, but our independent assessment scores this lower (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H) because the upstream commit is a readability refactor and no concrete triggerable impact beyond a possible crash is established by the available data; there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV).
A use-after-free race in the Linux kernel's chips-media wave5 VPU (video codec) driver allows a local user who can open the codec's V4L2 mem2mem device node to crash the kernel: if the driver's IRQ thread acquires the instance spinlock in the narrow window between m2m_ctx release and wave5_release() removing the stream instance from the active-instances list, the IRQ handler walks a freed/stale context and dereferences a NULL pointer. The vendor-listed CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H) reflects a worst-case write-after-free scenario, but our assessment scores it lower (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) because the concrete observed outcome is a kernel crash rather than confirmed code execution, exploitation is local-only, and the race window is non-deterministic; the affected hardware/driver is present only on specific SoCs. No public exploit code or in-the-wild exploitation has been identified at time of analysis (not in CISA KEV), and vendor-released stable fixes exist.
The Linux kernel's Thunderbolt XDomain (host-to-host / peer) service handling carries a lifetime defect: the service ID is released in tb_service_release() while the ID array that backs it is owned by the parent XDomain, so a service can outlive the XDomain reference it depends on and teardown of a Thunderbolt connection can access a freed/absent parent structure. The assessed practical outcome is a kernel crash (denial of service) with only limited integrity impact, and reaching the bug requires a system with the Thunderbolt driver active plus a physically attached Thunderbolt device or peer host to establish the XDomain connection - the supplied CVSS 8.8 vector (AV:A/AC:L, C:H/I:H/A:H) is significantly overstated versus the assessed physical-access, high-complexity vector (AV:P/AC:H, C:N/I:L/A:H). Vendor patches are available for the stable trees and mainline (5.10.266, 5.15.217, 6.12.111, 6.18.53, and 7.2), and no public exploit code was identified at time of analysis.
Improper Thunderbolt domain-teardown handling in the Linux kernel leaves the root-switch pointer (tb->root_switch) referencing a stopped domain, so a Thunderbolt/USB4 peer on the same fabric can race the teardown with an in-flight XDP cross-domain request (tb_xdp_handle_request) and drive the driver into stale-pointer/use-after-free territory that destabilizes or crashes the host. The fix mirrors the firmware connection manager by clearing tb->root_switch when the domain is stopped while deliberately keeping the uuid alive long enough to reply before the domain is fully released. Affected are Thunderbolt-capable Linux systems running unpatched kernels; the scenario is constrained to a physically adjacent attacker with a live Thunderbolt/USB4 link and a timing-dependent window, no public exploit code is identified at time of analysis, and the independent assessment (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) rates impact as availability-skewed rather than the 7.5 CVSS vector's C:H/I:H/A:H.
An out-of-bounds SDMA queue index in the Linux kernel's AMD amdkfd (KFD) GPU-compute driver allows a local low-privileged user on AMD GPU systems to corrupt kernel memory and crash the machine via the CRIU checkpoint/restore path that supplies a caller-controlled restore_sdma_id. The missing bounds check against the maximum queue count affects kernels predating the 6.12.111, 6.18.53 and 7.2 releases, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Assessed impact is local integrity and availability loss, with memory corruption and panic as the dominant realistic outcome rather than disclosed data.
Local low-privileged users on systems with AMD GFXv9-class GPUs can leak adjacent kernel memory through the amdkfd get_wave_state() path in the Linux kernel, because attacker-supplied queue descriptor fields are used unchecked as the length and offset of a copy_to_user(). The bug is reachable only via the AMD KFD device node (/dev/kfd) together with the AMDKFD_IOC_RESTORE_PROCESS (CRIU restore, H3) ioctl, giving an attacker roughly 4 GiB of over-read when the offset exceeds the size (integer underflow) or a 1 MiB read against a 4 KiB allocation that exposes neighbouring MQDs, ring buffers and KASLR-relevant kernel pointers. Vendor-released fixes are available in Linux 6.12.111 and 6.18.53 (and in the 7.2 line), but at the time of analysis there is confirmed no CISA KEV listing and no public exploit code identified, so this should be treated as a real but local-only information-disclosure risk rather than an actively exploited flaw; systems without an AMD GPU or without the KFD driver loaded are not exposed.
A use-after-free race in the Linux kernel's ACRN hypervisor service module (HSM) lets an authenticated local attacker with control of the ACRN irqfd ioctl path free a struct hsm_irqfd that a queued shutdown work item still references, yielding kernel memory corruption via container_of() on a dangling pointer. Exploitation is not a default Linux configuration: it requires the ACRN hypervisor stack to be built and running on the host with the acrn HSM driver loaded and an ACRN VM present, plus the attacker must win a narrow timing window between acrn_irqfd_deassign()/deinit and an eventfd EPOLLHUP wakeup. Our assessment rates this CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H - a low-complexity vector is not realistic because the race is hard to trigger reliably, and the dominant impact is availability (kernel crash), with only limited integrity impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available (Linux 6.18.53 / 7.2).
Kernel panic and denial of service in the Intel iwlwifi 'mld' (multi-link device) driver stem from a use-after-free on the firmware-error recovery path. Hosts are affected only when the MLD driver is loaded and two connections are active at once - an infrastructure BSS link plus a NAN (neighbor awareness networking) link - and a firmware error forces a reconfig that restores the BSS link but fails to restore the NAN link; mac80211 then frees the BSS link's data while a queued async statistics notification still holds a dangling fw_id_to_bss_conf[] pointer, so the workqueue handler dereferences freed memory and panics the kernel. Local access to the machine is required, the race between async_handlers_wk and the reconfig work makes deliberate triggering complex, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status; vendor patches are available in Linux 6.18.53 and 7.2.
A use-after-free in the Linux kernel's ACPICA AML interpreter, reached through acpi_ds_terminate_control_method(), fails to clear references to a control method's locals and arguments on termination, leaving dangling pointers that can crash the kernel (denial of service). Affected are kernels built from the pre-fix code through the stable branches below 6.12.111 and 6.18.53 and the 7.2 line, with the CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* applying to unpatched builds; triggering requires control of ACPI/AML content - malicious platform firmware supplying crafted DSDT/SSDT tables, or a local user with CAP_SYS_ADMIN injecting AML via configfs/ACPI custom_method - so there is no remote or unprivileged path on default configurations, and the practical outcome is predominantly a kernel crash rather than reliable code execution. Vendor-released patches are 6.12.111, 6.18.53 and 7.2; no public exploit identified at time of analysis.
Out-of-bounds access in the Linux kernel's ACPICA AML parser function acpi_ps_get_next_field allows crafted ACPI/AML field definitions to be parsed beyond intended boundaries, producing a crash-dominant denial of service; exploitation requires malicious or tampered platform firmware that supplies crafted DSDT/SSDT tables, or a privileged local user with CAP_SYS_ADMIN injecting custom AML via configfs/custom_method. The NVD CVSS 3.1 base is 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), but the independent assessment treats the practical vector as AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H because this is not reachable by a remote or unprivileged local attacker on a default configuration. Vendor patches are available in Linux 6.12.111, 6.18.53, and 7.2; no public exploit code or CISA KEV active exploitation is identified in the provided data.
Kernel crashes in the Linux kernel's ACPI/AML interpreter can be triggered when acpi_ut_copy_simple_object() adds invalid references for local, argument, or debug objects while processing crafted ACPI tables. Affected versions include Linux kernels before 6.18.53 on the 6.18.y branch, before 6.12.111 on the 6.12.y branch, and upstream before the fix in 7.2; patching is available. No public exploit or KEV listing is identified at time of analysis, and although the published CVSS is 8.4, the independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H because exploitation requires privileged ACPI table injection or malicious firmware and realistically causes denial of service rather than code execution or disclosure.
Integer overflow in the Linux kernel's ACPICA AML interpreter allows memory corruption and a likely kernel crash when a crafted Mid() (three-operand) AML operation is evaluated with operand values chosen so that Index + Length wraps around. Affected are Linux kernels before 6.12.111, before 6.18.53, and before 7.2 in the mainline tree, as tracked under CPE cpe:2.3:a:linux:linux and EUVD-2026-86064. This is not remotely reachable: exploitation realistically requires either the ability to supply malicious ACPI firmware tables (DSDT/SSDT) or root/CAP_SYS_ADMIN-level access such as via debugfs custom_method, so an ordinary unprivileged local user cannot trigger it on a default configuration; no public exploit has been identified at time of analysis, and vendor patches are available. Note that the NVD CVSS of 8.4 (AV:L/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates real-world risk for this class of Linux-kernel ACPICA flaw; our assessment rates it AV:L/AC:H/PR:H/UI:N with impact dominated by kernel memory corruption and denial of service rather than a realistic full confidentiality/integrity compromise.
The Linux kernel's ACPICA interpreter fails to validate the object type of handler objects in acpi_ev_has_default_handler() and acpi_ev_find_region_handler(), so malformed or crafted ACPI/AML tables can drive those paths to operate on a handler of an unexpected type. Exploitation is local and practical only for an attacker who can supply the AML - most plausibly by overriding ACPI tables via CONFIG_ACPI_CONFIGFS table loading (which normally requires CAP_SYS_ADMIN) or by controlling platform firmware/DSDT, and no public exploit or confirmed active exploitation was identified at time of analysis. Our independent assessment rates real-world risk substantially below the published NVD CVSS 3.1 score of 8.4, since the attack is local, depends on a non-default custom-table-loading configuration, and yields integrity/availability impact rather than code execution.
Use-after-free in the Linux kernel's ACPICA acpi_ns_build_normalized_path() function allows local attackers to crash or destabilize ACPI-enabled systems by triggering a stale node dereference, producing a denial of service (availability impact). The flaw affects kernels before 6.12.111, before 6.18.53, and before 7.2; exploitation requires low-privileged local access and depends on winning a race or lifetime window, and no public exploit code is identified at time of analysis. The independent assessment rates this as availability-only (AV:L/AC:H/PR:L, C:N/I:N/A:H), conflicting with the higher confidentiality-loss 7.7 score in the supplied CVSS input.
Kernel crash risk in the Linux Kernel arises from insufficient buffer validation in ACPICA's acpi_ut_walk_aml_resources(), allowing malformed ACPI resource descriptors to overflow internal buffers. Exploitation requires control over ACPI resource descriptor data - firmware, a rogue device advertising crafted resource data, or a privileged local path that feeds ACPI tables into the kernel - so the NVD CVSS 3.1 score of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) overstates real-world risk; the independently assessed vector is AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H with a predominant kernel-crash impact. Vendor-released patches are available, and no public exploit identified at time of analysis.
Out-of-bounds reads in the Linux kernel's ACPI interpreter (ACPICA) - specifically in acpi_ps_get_next_namestring() and acpi_ps_peek_opcode() - can cause a kernel crash or expose adjacent memory contents when parsing malformed AML bytecode from ACPI tables. All kernel versions tracing back to the initial git commit (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2) are affected; fixes are published in Linux 6.12.111 and 6.18.53 (mainline 7.2). Exploitation requires the ability to supply crafted ACPI tables - malicious or modified firmware/BIOS, physical boot-time table override, root-level override via initrd (CONFIG_ACPI_TABLE_UPGRADE), or a hostile hypervisor - which is why our independent assessment lowers the supplied CVSS 7.7 (PR:N, AC:L, C:H) to AV:L/AC:H/PR:L with confidentiality impact limited to adjacent-memory leakage; the realistic outcome is a kernel denial of service. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the patch is available from the vendor via the referenced upstream stable commits.
Out-of-bounds access to native Wi-Fi header fields in the Linux kernel's ath11k driver can corrupt kernel stack memory when a received frame's length exceeds the maximum native Wi-Fi header size in the DP_RX_DECAP_TYPE_NATIVE_WIFI decapsulation path (ath11k_dp_rx_h_undecap_nwifi). Unauthenticated adjacent attackers within radio range (AV:A, PR:N, UI:N) against systems running the ath11k driver on supported Qualcomm Wi-Fi hardware - tested on WCN6855 hw2.1 PCI with WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 firmware - can trigger a malformed over-the-air frame that leads to kernel stack corruption and a crash; no public exploit has been identified at time of analysis. Independent assessment rates this CVSS 3.1 AV:A/AC:H/PR:N/UI:N/C:L/I:L/A:H, meaning the vendor/NVD score of 8.8 overstates real-world risk: the trigger path must be active, the attacker must be radio-adjacent, and the confirmed outcome is memory corruption/crash rather than demonstrated code execution.
Mounting a crafted NTFS volume on a system running the Linux kernel's ntfs3 driver can drive a slab out-of-bounds read: a malformed directory index entry declares a key_size larger than the bytes actually present in its NTFS_DE payload, and the subsequent directory lookup passes that key to cmp_fnames(), which reads past the end of the kmalloc'ed index buffer. The flaw is local (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, 7.1) and requires the victim to mount and access the malicious image, typically via removable media, a supplied disk image, or a desktop automount path; the practical consequence is most often a kernel crash or denial of service rather than reliable disclosure of meaningful data, so real-world risk is lower than the headline score implies. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor-released fixes exist in Linux 6.18.53, 6.12.111, and 7.2.
An out-of-bounds read exists in the Linux kernel's ntfs3 driver: the readdir path in ntfs_dir_emit() compares a UTF-16LE character count (fname->name_len) against a byte count (e->size) without accounting for the 2-byte encoding or the ATTR_FILE_NAME header, so a crafted NTFS image with a small declared entry size but a large name length slips past the bounds check and lets ntfs_utf16_to_nls() read beyond the index entry. Exploitation is local and requires the victim to mount and list a directory on the attacker-supplied filesystem, typically via removable media or a disk image opened by an auto-mount daemon, and mounting normally requires CAP_SYS_ADMIN or equivalent auto-mount privileges, with user interaction needed to insert the media or open the image. The impact is information disclosure (kernel memory contents adjacent to the entry) plus a denial-of-service crash; no public exploit code or active exploitation was identified at time of analysis, and no EPSS score was supplied, though patch code is already public in the upstream stable trees.
Out-of-bounds read and unbounded iteration in the Linux kernel's NVMe driver allow a local attacker who controls or emulates an NVMe device advertising Flexible Data Placement (FDP) to crash the kernel and potentially disclose adjacent memory contents. Only kernels before 6.18.53 and the 7.x line before 7.2 are affected, and exploitation is not reachable purely over a network: per the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H the attacker needs an authenticated local foothold (PR:L) plus a malicious, tampered or emulated NVMe controller, so the published CVSS 8.2 (AV:N/AC:L/PR:N) overstates both reachability and required complexity. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
A use-after-free race in the Linux kernel's amdkfd (AMD KFD compute) queue destruction path lets a local user who can access the AMD GPU compute interface free a queue while it is still being dereferenced. The flaw sits in wait_on_destroy_queue(), which drops its locks while waiting for a queue to resume, creating a window in which a concurrent destroy_queue_cpsch() can free the same queue; the fix serializes destruction using the is_being_destroyed flag. Affected systems are those running an AMD GPU with the KFD/ROCm compute path active on kernel versions before 6.12.111 / 6.18.53 (fixed in 7.2); exploitation requires local low-privilege access, a favorable race outcome, and no public exploit code has been identified at time of analysis.
Out-of-bounds reads in the Linux kernel amdgpu FRU PIA parser can crash affected systems when malformed or truncated EEPROM data is processed during driver initialization. Exploitation requires local access with low privileges and high attack complexity on AMD GPUs that expose a FRU PIA, primarily datacenter or professional models, and an attacker must be able to supply corrupted on-board EEPROM contents rather than network or ordinary userspace input. The assessed impact is low confidentiality and high availability, not reliable code execution or data theft; vendor patches are available in Linux 6.12.111, 6.18.53, and 7.2, and no public exploit was identified at time of analysis.
Boundary-condition mishandling in the Linux kernel's RDMA user-memory path (ib_umem_find_best_pgsz()) lets a local user who can register a user memory region through RDMA verbs drive out-of-range iova/length arithmetic into a GENMASK, producing incorrect page-size masks and, in the worst case, kernel memory corruption or a crash. Exposure is narrow and architecture-dependent: the truncation and >4G GENMASK overflow cases are principally reachable on 32-bit kernels where iova is passed as a 32-bit value, while 64-bit builds are far less affected, and access is gated by PR:L (an RDMA/InfiniBand or RoCE-capable device plus permission to call ib_umem_get()). Our independent assessment is less severe than the published 7.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H), since the patch addresses arithmetic on page-size masks rather than a direct attacker-controlled heap write; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
A malformed TCP SACK option stream can crash the Linux kernel on CPU architectures that do not tolerate unaligned memory access, because netfilter's nf_conntrack TCP option parser reads a 32-bit value through an unaligned pointer dereference in its timestamp fast path. The defect affects the kernel's connection-tracking code that processes TCP traffic, which runs on virtually every firewall, gateway, or NAT host that uses nf_conntrack, and it is exploitable by a remote, unauthenticated attacker who can reach a conntrack-processing path and craft SACK options at a non-4-byte-aligned offset (PR:N/UI:N), though the independent assessment rates this AC:H rather than AC:L because exploitation is limited to non-x86 alignment-faulting architectures. Impact is availability-only - a kernel fault/crash rather than memory corruption or disclosure - and no public exploit code was identified at time of analysis; the vendor fix is already available in stable releases.
Btrfs subvolume metadata handling in the Linux kernel can read out of bounds when a mounted filesystem contains a crafted ROOT_REF or ROOT_BACKREF item whose on-disk name_len does not exactly match the remaining item payload, and BTRFS_IOC_GET_SUBVOL_INFO then copies more bytes than intended into its fixed-size UAPI name buffer. Only systems using btrfs are affected; the flaw is local rather than remote and per the assessed vector requires low privileges plus the ability to present a corrupted/malicious btrfs image to the kernel (typically mount privilege or an auto-mount/removable-media/container path). The kernel.org stable fixes are published (6.12.111, 6.18.53, 7.2), and no public exploit code or active exploitation has been identified at time of analysis. The upstream/NVD score of 7.8 overstates practical risk: the hardened assessment rates it as a local out-of-bounds read with limited confidentiality and availability impact (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L).
Out-of-bounds memory access in the Linux kernel's RDMA RTRS server (rtrs-srv) module, used by RNBD remote block devices, is reachable by an unauthenticated remote attacker (CVSS vector PR:N) who can open an rtrs client session over an RDMA/RoCE/InfiniBand fabric and send a process_read or process_write message whose network-supplied usr_len field exceeds off. The unchecked subtraction data_len = off - usr_len underflows to a huge size_t that is then handed to the rdma_ev callback as a memory length, producing the out-of-bounds access. The independent assessment rates this AV:N/AC:L/PR:N/UI:N/S:U with Low confidentiality and integrity impact and High availability impact (substantially below the vendor's 9.8), and practical exposure is narrowed because rtrs-srv is not present on general-purpose systems and requires RDMA-fabric reachability rather than ordinary IP routing; no public exploit code identified at time of analysis.
Error recovery in the Linux kernel's nvme-fc (NVMe-over-Fibre-Channel) transport can abort in-flight requests against an io tagset that has not yet been allocated, producing a lockdep 'trying to register non-static key' warning and faulting the error-recovery path when a newly created controller in CONNECTING state loses connectivity. Affected systems are those running kernels before 6.12.111 or 6.18.53 (the fix is also merged for the 7.2 line), specifically hosts with NVMe-over-FC hardware such as an lpfc HBA; the trigger is an admin request timeout during controller connect caused by FC link loss, so it is a local availability/robustness defect rather than an attacker-supplied input, with no public exploit identified at time of analysis. The independent assessment rates this AV:L/AC:H/PR:L with availability-only impact and high attack complexity and, notably, the published CVSS 8.8 network-adjacent score is not supported by that analysis - the practical exposure is confined to FC-attached hosts whose connect path already failed.
An interrupt storm in the Linux kernel's stmmac Ethernet driver causes CPU starvation on systems using the XGMAC2 (DWMAC-XGMAC2) 10G MAC core, such as Intel Agilex5 SoCs. Because RBUE (RX Buffer Unavailable) was enabled in the default RX interrupt mask, a DMA RX descriptor ring that drains under heavy receive pressure fires the RBUE interrupt continuously-observed at roughly 1,821,811,555 MAC interrupts against only 2,618,627 actual RX completions on Agilex5, a ~695x amplification-locking the CPU into interrupt handling; the CVSS 3.1 vector is AV:N/PR:N (unauthenticated), and no public exploit has been identified at time of analysis. The flaw is highly constrained: it requires XGMAC2 silicon plus sustained high-rate RX traffic (or page_pool exhaustion), and independent assessment rates it AC:H rather than the NVD AC:L, since exploitation demands prolonged heavy traffic against specific hardware and results only in availability loss (CPU stall), with no data exposure or code execution.
A double-free in the Linux kernel's virtio-fs driver can corrupt kernel memory when a virtiofs device advertises more request queues than its transport actually provides, causing virtio_find_vqs() to fail during probe and the cleanup path to free fs->vqs and fs->mq_map twice. The flaw is reachable only from the device/hypervisor side: a guest must be running with a malicious or malfunctioning virtio-fs device, and the bug triggers solely on the probe-failure cleanup path, so it is not reachable in default configurations that do not attach a hostile virtio-fs device. Independent assessment rates this CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H (local, high attack complexity, low integrity and high availability impact), which is materially lower and narrower than the published CVSS 8.4 that assumes PR:N and full integrity impact; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and EUVD's 'Information Disclosure' tag conflicts with the double-free / availability-focused nature of the defect.
Use-after-free in the Linux kernel's HID++ (hidpp) driver leaves a stale pointer in hidpp->input when input_register_device() fails during hidpp_connect_event(), allowing a dangling reference to be used after input_free_device() has released it. Systems running affected kernels (anything prior to the fixed backports 6.12.111, 6.18.53, and 7.2) with a supported Logitech HID++ peripheral attached - such as a Unifying receiver, mouse, keyboard, or touchpad - are exposed to the code path, but the trigger is a registration-error path that is not attacker-controlled and rarely executes, so realistic impact is a local kernel crash or denial-of-service rather than confidentiality or integrity compromise. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation; vendor-released patches are available from kernel.org stable branches.
A use-after-free in the Linux kernel perf events core lets a local user who can create perf events with address filter ranges trigger a race between event teardown and an RCU reader, resulting in memory corruption that is most reliably observed as a kernel crash or denial of service. The bug affects the kernel up through the stable branches fixed in 6.12.111 and 6.18.53 and the mainline fix released as 7.2; systems running those or later versions are not affected. Exploitation requires local access, the ability to open perf events subject to CAP_PERFMON and the kernel.perf_event_paranoid sysctl, and precise timing because the window is a narrow UAF race, so an unprivileged attacker on a default or hardened configuration is unlikely to reach it; no public exploit code has been identified at time of analysis and there is no indication of active exploitation. The NVD vector rates this 7.8, but the assessed vector (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H, roughly 5.3) is more conservative because of the high attack complexity, the privileged precondition, and the limited realistic confidentiality impact.
Malformed f2fs filesystem images can make the Linux kernel read past the end of its inline filename storage while converting an inline directory into a regular dentry block, disclosing kernel memory contents and potentially crashing the system. The attack path is local and requires user interaction: a victim must mount an attacker-supplied corrupted image (for example via USB auto-mount, a container, or a VM) and then access the affected directory so that the inline-to-regular dentry conversion runs; only f2fs filesystems using inline dentries are affected. No public exploit code and no confirmed active exploitation (not in CISA KEV) were identified at time of analysis, and the risk is concentrated in environments that routinely mount untrusted removable media or filesystem images.
Mounting a crafted btrfs filesystem image on an unpatched Linux kernel can overflow a fixed 255-byte name buffer while processing a malformed INODE_REF item, producing an out-of-bounds memcpy/page fault and a kernel panic (denial of service, with memory-safety implications). The assessed vector is local, high-complexity, PR:L (authenticated/low-privileged local access) - an attacker must be able to supply the malicious image and get it parsed, for example via mount, an unprivileged user-namespace/loopback mount, or the NFS/open_by_handle export path (exportfs_decode_fh_raw → reconnect_path → btrfs_get_name) shown in the crash trace. Only systems that use btrfs (and particularly those exporting btrfs filesystems over NFS) are affected; there is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis. Patches are available in the vendor stable releases Linux 6.12.111, 6.18.53, and 7.2 (EUVD-2026-86201).
A double fput() in the Linux kernel's cachefiles_create_tmpfile() error-handling path drops the struct file reference count twice, producing a double-free/reference-underflow that is crash-dominant and can corrupt kernel memory or panic the host. Only systems that actually enable the fscache/cachefiles caching backend with cachefilesd running are exposed; the assessed vector is local-only (AV:L) with some existing privilege (PR:L) and high complexity (AC:H), because the attacker cannot reliably force the internal tmpfile-creation failure that triggers the flaw. Vendor patches are available for the stable branches (6.12.111, 6.18.53) and the 7.2 mainline fix; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.
Out-of-bounds read in the Linux kernel's cfg80211 wireless stack allows an attacker within 802.11 radio range to deliver a crafted, too-short association-response management frame - including the S1G variant with its distinct information-element offsets - which the client parses during the association window before frame length is validated, resulting in reads beyond the received buffer that can crash the kernel (availability impact) and expose limited adjacent memory. No authentication is required (CVSS PR:N) and no user interaction is needed, but exploitation is constrained to over-the-air proximity to a client that is actively associating on a vulnerable pre-patch kernel; a target with WiFi disabled or not associating is unaffected, there is no Internet reachability, and no public exploit code has been identified at time of analysis. Vendor patches are available for the affected stable and mainline branches.
Uninitialized stack memory in the Linux kernel's cifs/SMB client can leave fields of the stack-allocated cifs_open_info_data structure holding stale values, so a client that mounts and operates on an SMB share whose server responses fail to populate those fields may act on incorrect metadata. Exploitation requires a local user with the ability to trigger the affected file operations on a mounted share (CVSS vector AV:L/AC:H/PR:L/UI:N, consistent with our independent assessment of C:L/I:L/A:N rather than the higher-scored 7.0 record) and is realistically driven by a malicious or misbehaving SMB server, not by remote unauthenticated attackers. Only kernels prior to 6.12.111, prior to 6.18.53, and prior to 7.2 are affected; vendor fixes are available and no public exploit has been identified at time of analysis.
Out-of-bounds array indexing in the Linux kernel's iwlwifi mvm wireless driver can crash the kernel and read a small amount of adjacent memory when a compromised or malicious Intel WiFi adapter firmware sends a BA_WINDOW_STATUS_NOTIFICATION containing an out-of-range station ID. Systems running affected kernels before 6.12.111 or before 6.18.53 with an active Intel WiFi device are in scope, but the attacker must already control the firmware-side notification, so the NVD CVSS 3.1 score of 8.8 (AV:A/AC:L/PR:N/UI:N) substantially overstates real-world risk. No public exploit code or confirmed active exploitation was identified at time of analysis.