Suse
Monthly
Authentication bypass in Cosmos Server 0.22.18 allows unauthenticated attackers to leak Constellation device metadata via the public-devices endpoint. The handler accepts any non-empty Authorization header but does not validate the bearer token, exposing device names, IPs, and role flags. Publicly available exploit code exists, but no active exploitation is reported; the vulnerability is patched in version 0.22.19.
HTTP request smuggling vulnerability in Rouille's proxy implementation allows remote attackers to desynchronize HTTP message boundaries using a CL.TE attack. Affected versions 0.3.3 through 3.6.2. Publicly available exploit code exists, but no active exploitation has been reported.
HTTP response splitting in Rouille 0.4.0 to 3.6.2 allows remote attackers to inject arbitrary response headers. By embedding carriage return or line feed bytes into percent-decoded query parameters or Cookie header values, attackers can perform cache poisoning, session fixation, and override security policies like CSP or CORS. No active exploitation is confirmed, but proof-of-concept code may exist.
HTTP request smuggling in Rouille 0.3.3 through 3.6.2 allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into header values. The framework forwards these headers verbatim to backends like Go net/http or Python http.server, which interpret the raw LF as a request delimiter, enabling a smuggled request with attacker-chosen method, path, and headers. Publicly available exploit code exists, increasing the risk for deployments using Rouille as a proxy.
Remote unauthenticated denial of service in gopacket <= 1.6.0 via a single crafted sFlow UDP datagram that triggers an unbounded memory allocation of up to 16 GiB, causing the parsing process to be OOM-killed. Affected services include any network telemetry collector or application that uses gopacket’s sFlow decoder without additional validation. A proof-of-concept exploit exists and can crash the process with just a 104-byte packet.
Remote denial-of-service in the gopacket library's Diameter AVP decoder allows unauthenticated attackers to trigger a ~4 GiB memory allocation per crafted packet, causing OOM kill after two messages under memory constraints. The flaw affects gopacket ≤1.6.0 (latest before fix), and publicly available exploit code demonstrates end-to-end exploitation against a collector with a 256 MB memory cap. No active exploitation is currently reported.
Race condition in Xen's grant table version switching (v2 to v1) allows remote unauthenticated attackers to cause low confidentiality impact and denial of service under specific conditions. The vulnerability arises when hypervisor code drops and re-acquires the grant table lock during a version switch, creating a window where status frame properties can change inconsistently. No public exploit has been identified at time of analysis, and the CVSS network attack vector may be misleading as exploitation likely requires a guest domain to initiate the switch.
Race condition in Xen Grant Table version switching from v1 to v2 allows a malicious guest VM to cause low confidentiality impact and limited denial of service. The vulnerability occurs when hypervisor code drops and reacquires the grant table lock during the version transition, creating a window where reference counts become inconsistent. No active exploitation or public exploit code has been identified at time of analysis.
Memory corruption in Xen allows guest VMs with Populated on Demand (PoD) enabled to cause denial of service by attempting to reclaim non-guest memory pages, corrupting hypervisor memory management state. No public exploit identified and SSVC indicates no current exploitation, but the flaw is automatable with partial technical impact.
Information disclosure in Xen's vNUMA configuration handling allows low-privileged authenticated attackers to read sensitive guest data during domain destruction. A race condition between the device model retrieving configuration and the simultaneous cleanup of that data permits unauthorized access to memory layout or other confidential information. No public exploit is identified, and the vulnerability is not known to be actively exploited at this time.
Denial of service in Xen libfsimage's iso9660 driver can be triggered by a local attacker mounting a crafted ISO image, crashing the Xen host. The vulnerability arises from insufficient validation of size and offset fields in Rock Ridge Continuation Entry (CE) records, leading to out-of-bounds memory access. Although the CVSS score is only 5.5 (Medium), the attack requires user interaction (mounting the ISO), and no patch version is specified in the provided data; active exploitation status is unknown.
Denial of service in libfsimage's iso9660 driver via crafted ISO image with a malformed Rock Ridge NM record entry length, causing crash of tools that use the library. Affects libfsimage from Xen Project; no public exploit or active exploitation identified.
Denial of service in the iso9660 driver of libfsimage when parsing Rock Ridge extensions. The vulnerability affects the Xen hypervisor's toolstack and potentially other software using this library. A crafted ISO image can trigger an infinite loop or memory corruption due to failure to validate record lengths, resulting in a crash. This issue is not known to be exploited publicly and requires local user interaction.
Integer underflow in the System Use area calculation of libfsimage's ISO 9660 driver allows denial of service via a crafted ISO image. An unauthenticated local attacker can cause the driver to crash when a user or process mounts or accesses a malicious ISO file, resulting in high availability impact. No active exploitation or public exploit has been identified at this time, and CVSS 5.5 with local attack vector and user interaction limits real-world risk.
Out-of-bounds read in libfsimage’s iso9660 directory walk allows local attackers with a crafted disk image to leak memory or crash the host when the image is mounted. The flaw arises from unvalidated record lengths read directly from attacker-controlled on-disk fields. No known active exploitation or public exploit code exists.
Safari and WebKit-based apps across Apple platforms crash when a user visits a specially crafted website, due to a state management flaw (CWE-400: Uncontrolled Resource Consumption) in versions prior to 26.6. Affected platforms include Safari on macOS Tahoe, iOS 26, iPadOS 26, and visionOS 26. No confidentiality or integrity impact is present - the consequence is an app-level denial-of-service. No public exploit code exists and CISA SSVC confirms no active exploitation, with EPSS at 0.16% (6th percentile), indicating very low exploitation likelihood at time of analysis.
UI spoofing in Apple Safari 26.5 and earlier allows attackers using cross-origin framing to misrepresent website identity. The vulnerability requires user interaction (visiting a malicious page) and could lead to phishing or deceptive actions. No active exploitation or public exploit code identified; patch is available.
Bypass of iframe sandboxing policy in Apple Safari and all Apple operating systems through version 26.5 allows malicious web content to violate sandbox restrictions. Affected users include anyone running Safari on iOS, iPadOS, macOS Tahoe, tvOS, visionOS, or watchOS prior to version 26.6. An attacker can cause integrity violations, such as injecting or modifying content within sandboxed iframes, but requires user interaction (clicking a link or visiting a malicious page) and no public exploit or active exploitation has been identified at this time.
Out-of-bounds heap read in GNU Binutils linker when processing 32-bit XCOFF files allows local attackers to disclose heap memory and cause denial of service. Affects Red Hat Enterprise Linux 6 through 10, Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation identified at time of analysis; EPSS data unavailable.
Server-side request forgery in Kimi Code's FetchURL tool allows attackers who can influence a FetchURL call (e.g., via prompt injection) to bypass hostname and IP denylists by using crafted public hostnames that resolve to internal addresses or via HTTP redirects, exposing internal network services. No public exploit or active exploitation identified at the time of analysis.
Remote denial of service in llama.cpp allows unauthenticated attackers to exhaust server resources via crafted JSON schema inputs that trigger unbounded recursion in the JSON-schema-to-GBNF conversion routine. Affected versions include commit e15efe0 and prior. A fix exists in a pending pull request; no active exploitation reported.
Denial of service in ggml-org llama.cpp allows remote attackers to crash the application by sending a crafted JSON schema that triggers a null pointer dereference in the _visit_pattern function. No authentication or user interaction is required, and all versions up to the affected commits d006858/e15efe0 are vulnerable. The fix is pending merge; no public exploit code has been identified.
Denial of service in SQLite 3.41 due to a use-after-free in the JSON extraction function. A local unauthenticated attacker can trigger a crash by supplying a malicious JSON input, causing the host application to terminate. No active exploitation has been confirmed in the wild, but public exploit proof-of-concept may exist.
Memory exhaustion in ImageMagick's magick CLI tool allows a local attacker to cause denial of service by repeatedly supplying malformed command-line arguments. Affects versions before 7.1.2-27. Vendor patch is available; no public exploit or active exploitation reported.
NULL pointer dereference in the Linux kernel tracing subsystem (`func_set_flag()`) allows a local attacker with tracefs write access to trigger a kernel panic and crash the system. The flaw arises when a process holds an open file descriptor to a function tracer option (e.g., `func_stack_trace`) while a concurrent tracer switch sets `tr->current_trace_flags` to NULL; a subsequent write to that option file then dereferences the NULL pointer before the function tracer guard executes. No active exploitation (KEV) or public exploit code has been identified; EPSS is 0.20% at the 10th percentile, consistent with a localized, technically specific DoS condition.
Kernel crash (availability loss) in the Linux gpio/eic-sprd Spreadtrum EIC GPIO driver affects systems running PREEMPT_RT kernels with Unisoc/Spreadtrum SoCs. The IRQ startup path - request_threaded_irq() → irq_startup() → sprd_eic_irq_unmask() - calls sprd_eic_update(), which acquires a regular spinlock_t via spin_lock_irqsave(). On PREEMPT_RT kernels, spinlock_t is a sleeping lock; sleeping in a non-sleepable IRQ-disabled context triggers a kernel BUG: 'sleeping function called from invalid context', crashing the system. No public exploit has been identified at time of analysis; patches are available across all maintained stable branches.
Kernel panic risk in the Linux gpio-sch driver exposes PREEMPT_RT systems with legacy Intel SCH GPIO hardware to a local denial of service. The SCH IRQ unmask callback acquires a regular spinlock inside a non-sleepable IRQ-setup context; under PREEMPT_RT, that spinlock is reimplemented as a sleeping lock, triggering a lockdep BUG and potential kernel panic. Patches are available across all active stable branches (5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.39, 7.1.4); no public exploit exists and EPSS is 0.21% (percentile 12%).
NULL pointer dereference in the Linux kernel's hid_logitech_dj driver causes a kernel crash (DoS) when a crafted HID descriptor is processed during device probe. The flaw exists in logi_dj_probe(): when a Logitech Unifying receiver emulation presents report ID 0x20 with only padding output items, hid-core registers the report with rep->maxfield == 0. The error-path validation then dereferences rep->field[0]->report_count while printing a diagnostic message, triggering a KASAN-visible null-ptr-deref and kernel panic. No public exploit is identified at time of analysis, but the kernel commit descriptions include a full uhid-based reproduction method, lowering the barrier for local attackers.
Resource exhaustion via file reference leak in the Linux kernel's io_uring NOP opcode handler allows a local, low-privileged user to gradually exhaust kernel memory. The flaw occurs when a NOP submission carries the generic IOSQE_FIXED_FILE sqe flag (setting REQ_F_FIXED_FILE) but omits the NOP-specific IORING_NOP_FIXED_FILE flag in nop_flags: io_nop() acquires a real file reference via io_file_get_normal(), yet io_put_file() skips releasing it because REQ_F_FIXED_FILE is set, producing one leaked 176-byte kernel file object per operation. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Kernel availability loss in the Linux mm/shrinker subsystem allows a local user with debugfs access to trigger a kernel BUG by reading the debugfs 'count' file of a memcg-aware shrinker such as zswap. The shrinker_debugfs_count_show() function incorrectly holds rcu_read_lock() while invoking ->count_objects() callbacks; when zswap's callback attempts to flush memcg stats via css_rstat_flush(), it sleeps inside an RCU read-side critical section - a fatal kernel invariant violation. No public exploit has been identified at time of analysis, and EPSS is very low at 0.21% (12th percentile).
Kernel panic via NULL pointer dereference in the Linux kernel's memory shrinker debugfs interface allows a local attacker to crash the system. The shrinker_debugfs_add() function unconditionally creates 'count' and 'scan' debugfs files for all registered shrinkers, but some shrinkers - notably the xen-backend shrinker - only implement one of the two required callbacks (count_objects or scan_objects). Writing to the exposed 'scan' debugfs file on such a shrinker dispatches through a NULL function pointer, triggering a kernel panic. No public exploit has been identified at time of analysis, and EPSS score of 0.21% reflects low exploitation probability. Patches are available across multiple stable kernel branches.
NULL pointer dereference in the Linux kernel's swap cgroup subsystem (`mm/swap_cgroup.c`) causes a kernel panic and full system crash on swapless hosts running kernel versions after commit `bea67dcc5eea`. The batched PTE zap path introduced by that commit calls `lookup_swap_cgroup_id()` without validating the swap entry against `swap_info[]`, so any process exit involving a PTE corrupted into a type-0 swap entry dereferences the uninitialized `ctrl->map` pointer and takes the host down. The crash pattern was confirmed in production on kernel 6.12.58 and independently reproduced by syzbot; no public exploit exists, but the kernel teardown path is deterministically vulnerable once the prerequisite conditions are present.
Softlockup in the Linux kernel's swap memory reclaim path allows a local user to trigger a kernel panic by generating heavy swap pressure on systems with large swap devices. The swap_reclaim_full_clusters() function, called from a kworker context, iterates through potentially thousands of full swap clusters without yielding the CPU via cond_resched(), starving the scheduler and eventually causing the kernel watchdog timer to fire. The vulnerability was confirmed in a real-world stress test on a 320-CPU arm64 machine with ~1TB RAM and an 8.6GB swap device, resulting in a kernel panic. No public exploit code exists and EPSS is very low (0.21%, 11th percentile).
Denial of service in the Linux kernel btmtksdio (MediaTek Bluetooth SDIO) driver allows a local attacker with low privileges to permanently hang the Bluetooth stack by triggering an infinite loop in btmtksdio_txrx_work(). The root cause is an inverted timeout logic: a misused time_is_before_jiffies() call, combined via OR, causes the worker loop's exit condition to become unconditionally true after the 5-second timeout fires, so the loop never terminates and never releases the SDIO host. No public exploit has been identified at time of analysis; however, the bug can also trigger organically under hardware stress conditions.
NULL pointer dereference in the Linux kernel Bluetooth HCI connection handler crashes the kernel when aborting a pending connection while `hdev->sent_cmd` is NULL but `req_status` remains `HCI_REQ_PEND`. Local users with Bluetooth access can trigger a general protection fault from the `hci_rx_work()` receive path, producing a kernel panic and denying service to all users on the affected system. No public exploit has been identified and EPSS probability stands at 0.21% (12th percentile), indicating very limited real-world exploitation likelihood.
NULL pointer dereference in the Linux kernel's Bluetooth ISO subsystem can crash the kernel when a race condition is triggered during PA-sync broadcast sink socket operations. The flaw exists in iso_conn_big_sync(), which drops the socket lock to call hci_get_route() and then re-acquires it without re-validating that the connection structure is still intact - allowing concurrent teardown events (iso_disconn_cfm → iso_conn_del → iso_chan_del) to null out iso_pi(sk)->conn before it is dereferenced. A local low-privileged user with access to Bluetooth ISO sockets can reliably crash the kernel, resulting in a denial of service. No public exploit code has been identified and no active exploitation is confirmed.
Device reference count leak in the Linux kernel's firmware_loader subsystem exposes systems to local denial-of-service conditions. Specifically, firmware_upload_register() fails to call put_device() on the fw_dev pointer when alloc_lookup_fw_priv() fails after fw_create_instance() has already called device_initialize(), leaving the embedded struct device reference count unbalanced and potentially preventing proper memory cleanup. Discovered via static analysis and confirmed by manual code review, the issue is patched across multiple stable kernel branches including 6.1.178, 6.6.145, 6.12.96, 6.18.39, and 7.1.4. No public exploit exists and no active exploitation has been observed.
Null pointer dereference in the Linux kernel's cpufreq subsystem during system reboot allows a local attacker with low privileges to crash the kernel. The reboot path (kernel_restart() → device_shutdown() → cpufreq_suspend()) does not invoke freeze_processes() - unlike the normal suspend path - leaving CPU hotplug operations free to run concurrently and free governor_data while cpufreq_suspend() is still reading it, producing a use-after-free null pointer dereference. No public exploit exists and EPSS probability is 0.22% (13th percentile), placing this in low-urgency territory despite the ubiquitous kernel footprint.
Denial of service via infinite exception loop in the Linux kernel's s390 architecture affects systems running IBM Secure Execution (Ultravisor) workloads on kernel versions 6.7 through the patched releases. When load_unaligned_zeropad() reads across a page boundary where the adjacent page has been donated to the Ultravisor, the do_secure_storage_access() exception handler cannot resolve the fault and enters an unresolvable loop, permanently hanging the affected execution context. Patched in upstream versions 6.12.97, 7.1.4, and 7.2-rc1 via reversion of DCACHE_WORD_ACCESS support on s390; no public exploit or active exploitation is confirmed at time of analysis.
Uninitialized stack memory use in the Linux kernel HFS and HFS+ filesystem drivers allows a local user to crash the kernel by mounting a crafted filesystem image. Two early-exit paths in `hfs_bnode_read()` - an invalid offset check and a corrected-to-zero length - skip the buffer write, while downstream callers such as `hfs_bnode_read_u16()` and `hfs_bnode_read_u8()` consume the uninitialized stack buffer unconditionally, producing KMSAN uninit-value reports and risking kernel panics. Patches are available across multiple stable kernel branches; no public exploit exists and EPSS is very low at 0.22%.
Hung-task denial-of-service in the Linux kernel's nilfs2 filesystem allows a local low-privileged user to indefinitely stall concurrent filesystem operations by supplying out-of-range segment numbers to the NILFS_IOCTL_CLEAN_SEGMENTS ioctl. Because input validation was deferred deep inside the call chain to nilfs_sufile_updatev() - which emits one printk warning per invalid entry while holding ns_segctor_sem write-locked - repeated invocations saturate the global printk path and keep the semaphore held long enough to block all readers, including routine operations such as chmod(). No public exploit has been identified and EPSS is very low (0.22%, 13th percentile), consistent with a local kernel DoS requiring filesystem access.
Unconditional invocation of cancel_work_sync() in the mtk-jpeg media driver's release path triggers spurious WARN_ON kernel warnings on non-multicore MediaTek JPEG codec platforms where the workqueue callback pointer is NULL. Systems running affected Linux kernel versions (6.6.140-6.18.38, 7.0.4) on MediaTek SoC hardware may experience kernel log pollution or, on kernels compiled with CONFIG_PANIC_ON_WARN=y, a full system denial of service when the JPEG device is released. No public exploit has been identified and no active exploitation is recorded; this is a stability and correctness fix with strictly local trigger conditions.
Integer overflow in the Linux kernel's XFS filesystem exchmaps reservation logic allows a local low-privileged user to crash the system. The bug in xfs_exchmaps_estimate_overhead() adds bmbt and rmapbt overhead to a local resblks variable but then performs the UINT_MAX guard check against the original req->resblks value - the pre-overhead figure - before writing the inflated value back into req->resblks for use in xfs_trans_alloc(). This means the guard intended to prevent integer truncation when the reservation is cast to unsigned int is rendered ineffective, enabling a kernel panic on XFS systems where exchmaps overhead pushes the reservation past UINT_MAX. No public exploit exists and EPSS is 0.21%, placing this firmly in the kernel stability/bug-fix category rather than active threat landscape.
Memory exhaustion in the Linux kernel XFS quota subsystem can be triggered by a local low-privilege user on systems mounting metadir XFS images with user quota enabled. The vulnerability exists in xfs_dqinode_metadir_create(), where failure of xfs_metadir_create() returns without releasing the allocated update and transaction state, and commit failures leave behind caller-owned inode references. Confirmed present from Linux 6.13-rc1 through v7.1.1; patched in stable releases 6.18.39 and 7.1.4.
The Linux kernel BPF verifier incorrectly elides null-check requirements for inner array map lookups when the BPF_F_INNER_MAP flag is set, allowing a local attacker with BPF program loading privileges to trigger a null pointer dereference and crash the kernel. The flaw arises because the verifier uses the inner map template's max_entries for bounds reasoning at verification time, while the runtime helper operates against a concrete inner map that may have a larger max_entries value. A crafted BPF program exploiting the faulty nullness elision can cause a kernel denial of service. No public exploit code has been identified at time of analysis, and EPSS is low at 0.21%.
Out-of-bounds read in the Linux kernel's Samsung Kalmia USB network driver allows a malicious USB device to crash the kernel via a u16 integer underflow in `kalmia_rx_fixup()`. When a crafted bulk-IN frame is 6-11 bytes long, the subtraction `skb->len - 12` underflows to approximately 65,530, bypassing length validation and causing `memcmp()`, `skb_trim()`, and `skb_pull()` to operate past the end of the 14,000-byte RX buffer. No public exploit or active exploitation (CISA KEV) has been identified; EPSS at 0.23% (14th percentile) confirms minimal exploitation interest.
Memory exhaustion in the Linux kernel's USB CDNSP host controller driver allows local users to trigger a kernel-level memory leak by forcing partial allocation failures in `cdnsp_alloc_stream_info()`. Systems running Linux 5.12 through unpatched stable branches accumulate unreleased `stream_ctx_array` allocations that are never freed, eventually causing availability impact on hosts with CDNSP USB hardware. No public exploit exists, EPSS stands at 0.21%, and the vulnerability carries no confidentiality or integrity impact per the CVSS vector.
Incorrect argument passing in dwc3_ulpi_setup() causes the Linux kernel's DWC3 USB controller driver to pass a raw MMIO register pointer (dwc3->regs, typed as void __iomem *) to dwc3_readl() and dwc3_writel(), which instead expect the containing struct dwc3 * pointer. Because the register accessor functions internally dereference the struct to locate ->regs, supplying ->regs directly results in incorrect memory access during ULPI (USB Low Pin Interface) initialization - flagged by the kernel sparse checker as a type-safety violation across address spaces. The practical impact is a potential kernel panic or silent misread/miswrite of a USB control register, manifesting as an availability failure in systems using DWC3 ULPI USB controllers. No public exploit exists and the issue requires local access to trigger.
Kernel denial-of-service in the Linux USB gadget composite driver crashes the system by triggering a KASAN memory fault in the USB_DT_OTG request handler when the configuration list is empty. The flaw exists because list_first_entry() never returns NULL - making the subsequent config NULL-check dead code - so when cdev->configs is empty during a gadget unbind race or when a driver sets is_otg before registering any configuration, composite_setup() dereferences a garbage pointer and memcpy() copies arbitrary kernel memory into the USB response buffer. No public exploit code has been identified, and EPSS is 0.22% (13th percentile), consistent with the local, race-condition nature of the flaw.
Reference count leak in the Linux kernel USB gadget printer driver (f_printer) allows a local user to trigger a permanent kref increment on every rejected concurrent open attempt. Each call to printer_open() that returns -EBUSY still increments dev->kref, but because VFS never invokes ->release() for a failed open, the reference is never balanced. Repeated exploitation exhausts the reference counter, preventing proper driver teardown and causing availability degradation. No public exploit has been identified at time of analysis.
Incomplete error-path cleanup in the Linux kernel's uss720 USB-to-parallel-port driver leaves a parport device registered after probe failure, creating a dangling stale pointer backed by freed private data. Systems where a Belkin F5U002 or similar USS720-based adapter is attached and causes get_1284_register() to fail during uss720_probe() are left with an orphaned kernel parport entry and a reserved parport slot, which can lead to a kernel crash when the stale pp->private_data pointer is later dereferenced. No active exploitation has been identified; the bug was discovered via static-analysis research, and patches are available across all major Linux stable branches.
DMA mapping leak in the Linux kernel's MTU3 USB device controller driver causes local denial-of-service on MediaTek SoC platforms. When mtu3_gadget_queue() maps a USB transfer request via DMA before checking whether the QMU GPD ring has capacity, then mtu3_prepare_transfer() fails and returns -EAGAIN, the error path bypasses the mtu3_req_complete() cleanup helper, permanently stranding the DMA mapping. Repeated exhaustion of the IOMMU aperture can destabilize or crash the kernel. No public exploit code exists and EPSS at 0.22% (13th percentile) confirms negligible exploitation interest; the impact is a local availability-only issue confined to MediaTek USB gadget hardware.
Availability loss in the Linux kernel's USB serial digi_acceleport driver allows a local user to permanently halt data reception on a Digi AccelePort serial port until the USB device is physically reconnected or the driver is rebound. The bug arises from a missing URB resubmission path: when a port is closed while in a throttled state, the read URB is never re-queued, leaving the port silently deaf to incoming data upon next open. No public exploit has been identified and EPSS sits at 0.22% (13th percentile), reflecting the niche hardware dependency and local-only attack surface.
Hard lockup in the Linux kernel's digi_acceleport USB serial driver causes full system freeze when a Digi AccelePort device is physically disconnected during active I/O. The driver's OOB (out-of-band) command path loops indefinitely with interrupts disabled upon persistent URB submission failure, resulting in a kernel hard lockup that effectively crashes the host. Systems with this specific USB-to-serial adapter are affected across a wide range of stable kernel branches from 2.6.12 onward; patches have been released across all active stable series.
Memory leak in the Linux kernel USB ULPI (Universal Serial Bus Link Interface) subsystem allows a local low-privileged user to trigger repeated ULPI device registration failures that leak kernel memory, potentially leading to system instability or denial of service. Affected kernel versions span from 4.2 through multiple pre-patch stable branches, with fixes backported to 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc3. No public exploit or active exploitation has been identified at time of analysis; the EPSS score of 0.22% (13th percentile) reflects minimal probability of weaponization.
NULL pointer dereference in the Linux kernel's usbip virtual UDC (vudc) subsystem crashes the kernel when FunctionFS AIO cancellations are processed. The `vep_alloc_request()` function never initialized `vrequest->udc`, so any AIO cancellation arriving at `vep_dequeue()` - such as one triggered by a host-side `usbip attach` - dereferences a null pointer and produces a kernel oops, denying service to the guest system. A local attacker with low privileges on a system configured for USB/IP with FunctionFS AIO endpoints can reliably reproduce this crash. No public exploit code exists, and EPSS at 0.22% (13th percentile) confirms the path has not seen meaningful exploitation despite the bug reportedly existing for approximately ten years since Linux 4.7.
Kernel memory leak in the Linux USB gadget FunctionFS (f_fs) subsystem allows a local low-privileged user to slowly exhaust kernel memory by repeatedly triggering DMA buffer transfers via the ffs_dmabuf_transfer() code path. Affected kernels span from the commit introducing DMA buffer sharing (7b07a2a7ca02) through versions prior to 6.12.96, 7.1.4, and 7.2-rc3. The root cause is a missing dma_fence_put() call after dma_resv_add_fence(), leaving the initial kref permanently outstanding and causing ffs_dma_fence objects to accumulate without ever being freed. No public exploit has been identified at time of analysis.
The USB gadget FunctionFS (f_fs) subsystem in the Linux kernel fails to initialize the endpoint direction field (epfile->in) until USB host connection, leaving it zero when userspace performs early DMA ioctl calls such as FUNCTIONFS_DMABUF_ATTACH before a host connects. This incorrect DMA direction causes kernel-mode availability loss - crashes or hangs - on systems actively using FunctionFS-based USB gadgets with DMABUF. No public exploit has been identified, and EPSS probability stands at 0.21% (11th percentile), reflecting very low opportunistic exploitation risk.
The block device layer in Linux Kernel hangs indefinitely during NVMe surprise removal when `bdev_mark_dead()` is called with `surprise=true`, because a missing guard causes `sync_blockdev()` to be invoked on an already-dead device, permanently blocking `folio_wait_writeback()`. Triggered via `nvme_reset_work()` I/O-queues-lost path, the bug wedges the NVMe reset worker and every task waiting on it, requiring a system reboot to recover. Discovered by FuzzNvme (syzkaller + FEMU fuzzing framework); no public exploit identified at time of analysis.
Sensitive cryptographic key material handled by the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver was unconditionally emitted to the kernel ring buffer via unguarded hex-dump calls in *_setkey() and gen_split_key(), exposing raw key bytes to any local user with dmesg access on kernels built with CONFIG_DYNAMIC_DEBUG. The exposure affects NXP CAAM-equipped platforms (i.MX, QorIQ SoC families) running kernel versions from approximately 5.3 through the fix commits across all active stable branches. No public exploit code exists and EPSS probability is 0.22%, but key material disclosure on a crypto-accelerator driver carries genuine confidentiality risk that the vendor-assigned CVSS (C:N/I:N/A:H) incorrectly characterizes - the real primary impact is confidentiality loss, not availability.
Null pointer dereference in the Linux kernel's chacha20poly1305 crypto template allows a local unprivileged user to crash the system. The flaw exists in chachapoly_create(), which passes the unvalidated return value of crypto_attr_alg_name() directly to strcmp() when the poly1305 sub-argument is absent in a malformed template string; since that function returns an ERR_PTR on failure, the subsequent strcmp() call dereferences an invalid pointer, triggering a kernel panic. Patches are available across multiple stable branches; no public exploit or active exploitation has been identified at time of analysis.
Denial of service in the Linux kernel's AMD CCP/SEV driver allows a local low-privileged process to crash a KVM hypervisor host by submitting SEV firmware ioctls to /dev/sev, which incorrectly triggers SNP initialization and zeroes the MSR_VM_HSAVE_PA register, causing a general protection fault on the next VMRUN and terminating all running virtual machines. Affected kernels span from the introducing commit (ceac7fb89e8da465aec3ac3c20477f912f5c3a6c) through the fixed stable releases 6.12.96, 6.18.39, and 7.1.4. No public exploit has been identified and EPSS is 0.22%, but the blast radius - crashing the host and all its tenant VMs - warrants prompt patching on AMD EPYC KVM deployments.
Crash of a Linux KVM host is achievable by a local low-privileged user via the /dev/sev ioctl interface on systems running AMD SEV-SNP firmware. When SNP_COMMIT is issued after a prior failed SEV initialization, the crypto/ccp driver incorrectly proceeds with SNP initialization, zeroing out MSR_VM_HSAVE_PA - the model-specific register holding the AMD SVM host save-area pointer. Any subsequent VMRUN instruction by KVM for an already-running VM will generate a General Protection Fault, crashing the host and terminating all guest workloads. No public exploit has been identified at time of analysis; patch commits are available across multiple stable branches.
Uncontrolled SNP initialization in the Linux kernel's CCP/SEV driver allows a local low-privileged user with /dev/sev access to crash the host kernel on AMD SEV/SNP-capable systems running KVM. Sending a SNP_VLEK_LOAD ioctl when SNP has not been initialized triggers an unnecessary initialization/shutdown wrapper that zeros MSR_VM_HSAVE_PA globally; the subsequent VMRUN instruction for any active KVM guest then triggers a General Protection Fault, bringing down the host and terminating all co-hosted VMs. No public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects the specialized attack environment required.
Host crash vulnerability in the Linux kernel's AMD SEV/SNP subsystem allows a local low-privileged user to take down a virtualization host by triggering SNP re-initialization via the `/dev/sev` `SNP_CONFIG` ioctl when SNP has previously failed to initialize. When re-initialization executes while KVM guests are running, it zeroes `MSR_VM_HSAVE_PA` globally across all CPUs; the next VMRUN instruction on any active guest then raises a General Protection Fault, crashing the host kernel and terminating all hosted VMs. No public exploit identified at time of analysis; EPSS is 0.22% at the 13th percentile, consistent with low opportunistic exploitation probability.
Silent error propagation in the Linux kernel's CTR_DRBG implementation (`drbg_ctr_generate()`) causes the function to return a success code while leaving its output buffer uninitialized when an internal operation fails. Code that relies on the generated random material receives garbage data, which can trigger kernel crashes or hangs depending on how the uninitialized buffer is consumed downstream. No public exploit has been identified; patched stable kernel releases are available across all active longterm-support branches.
PMD-sized vmemmap pages are silently leaked in the Linux kernel's x86 memory management subsystem following a regression introduced in commit bf9e4e30f353, which replaced __free_pages() with pagetable_free() for vmemmap page freeing. Because vmemmap pages are not compound pages (outside of HVO, which does not apply here), pagetable_free() resolves compound_order() to zero and frees only the first page of a PMD-sized block, leaking the remaining pages on every memory section removal. Systems running affected kernel versions (6.18.7-6.18.38, 6.19 series through 7.1.3) that perform x86 memory hotplug operations will experience progressive physical memory loss; no public exploit has been identified and this vulnerability is not in CISA KEV.
Reference count leak in the Linux kernel's SCMI regulator driver can exhaust kernel memory resources, leading to a denial-of-service condition on affected systems. The flaw resides in scmi_regulator_probe(), where of_find_node_by_name() acquires a reference on a device-tree node but the corresponding of_node_put() release call is omitted on the error path when process_scmi_regulator_of_node() fails, permanently leaking the reference. Exploitation requires local access; no public exploit code has been identified and EPSS probability stands at 0.21%, indicating very low likelihood of opportunistic exploitation.
Hostname verification missing in Apache Thrift Python TSSLSocket before 0.24.0 enables man-in-the-middle impersonation, allowing interception and manipulation of RPC traffic. This flaw violates TLS certificate hostname matching, effectively letting an attacker with a valid certificate for any domain present as a legitimate server. No active exploitation or public exploit code is known.
Out-of-bounds read vulnerability in the c_glib language bindings of Apache Thrift before 0.24.0 may allow remote attackers to read heap memory contents through crafted Thrift messages. Affected users should upgrade to version 0.24.0. No public exploit or active exploitation has been identified at this time.
Heap out-of-bounds read in Apache Thrift's C++ THeaderTransport::readHeaderFormat() allows remote attackers to read unintended memory contents, potentially leading to information disclosure or denial of service. All versions before 0.24.0 are affected. No public exploit code has been reported.
Resource exhaustion in Apache Thrift Java bindings 0.19.0 through 0.23.x allows remote denial of service via an unbounded read. No authentication or user interaction is required, and no public exploit code is known. Users should upgrade to version 0.24.0 to remediate the issue.
Authorization bypass in Cloudreve WOPI integration allows view-only sessions to modify files. The WOPI access token secret is ignored, and view-created sessions can call write endpoints, enabling unintended file modification even when the viewer should be read-only. An attacker with a valid user session or control of a WOPI viewer can exploit this to overwrite files. Publicly available exploit code exists, but no active exploitation confirmed.
Metadata leakage in Cloudreve single-file shares allows an authenticated recipient to observe file activity (rename, create, delete) of unshared siblings in the owner's parent folder via the event stream endpoint, exposing file names and operation types but not file contents.
Denial of service in Cloudreve v4 and v3 allows any authenticated user to crash the entire server instance by uploading a tiny, maliciously crafted PNG/JPG/GIF file. The built-in image processor, enabled by default, decodes images without a pixel dimension cap, causing the Go stdlib to allocate large memory buffers from header‑supplied dimensions, triggering a fatal out‑of‑memory kill. A public proof‑of‑concept exploit is available, and the vendor has released a patch in version 4.17.0.
Information disclosure in Cloudreve allows any logged-in user to enumerate and harvest email addresses of inactive and banned accounts via the user search API. The `SearchActive` method in v4 and v3 omits the required status filter, exposing basic profile metadata to authenticated attackers. No account credentials are compromised, but the leaked PII enables user enumeration across the platform.
Path traversal in Cloudreve's WOPI PUT_RELATIVE handler permits authenticated attackers with a WOPI access token to write files to arbitrary locations within the same user account, bypassing the token's single-file scope. A crafted X-WOPI-SuggestedTarget header with directory traversal sequences (e.g., a/../../evil.docx) resolves outside the source
Heap buffer over-write in Magick.NET versions before 14.15.0 on 32-bit platforms when processing extremely large JNX files can lead to a denial-of-service condition by crashing the application. The vulnerability resides in the bundled ImageMagick library's JNX decoder, where an integer overflow occurs during file handling. Exploitation requires the attacker to supply a malicious JNX file to a locally running .NET application using Magick.NET; no public exploit or active exploitation is known.
A heap buffer over-write in ImageMagick's fx operation can be triggered via a crafted argument when processing images with the Magick.NET library, leading to a denial of service. Affected versions of the Magick.NET NuGet package (before 14.15.0) are confirmed vulnerable; no active exploitation or public proof-of-concept has been identified. The vulnerability has a medium CVSS score (5.0) with local attack vector and user interaction required.
Heap buffer overwrite in ImageMagick's morphology operation when an invalid user-supplied kernel is provided, leading to a denial-of-service condition. This integer overflow flaw (CWE-190) affects ImageMagick versions prior to 7.1.2-27 and the Magick.NET wrapper below 14.15.0. No active exploitation or public proof-of-concept has been identified, and EPSS data is unavailable.
Improper ordering of resource assignment in the Linux kernel's memory hotplug subsystem causes a spurious WARN_ON during error recovery in __add_memory_block(). When xa_store() fails under memory pressure, device_unregister() is invoked while mem->altmap is already set, triggering memory_block_release() with a non-NULL altmap pointer and producing a kernel warning that can lead to system instability or crash. Affected systems are those running Linux kernel versions from the introduction commit 1a8c64e110435e44e71bcd50a75663174b575f22 through the respective fix commits across the 6.6, 6.12, 6.18, 7.0, and 7.1 stable series; patches are confirmed available. No public exploit has been identified and EPSS stands at 0.16% (6th percentile), consistent with a stability regression rather than an actively targeted security flaw.
Resource leaks and teardown race conditions in the Linux kernel's gpio-rockchip driver expose Rockchip-based systems to kernel panic and memory exhaustion. Three distinct defects exist in the driver's remove path: an unreleased debounce clock reference, a stale chained IRQ handler left registered after driver removal, and an unfreed IRQ domain with its generic chips. The IRQ handler defect is the most severe - if a stray GPIO interrupt arrives after the driver is unbound, the kernel dereferences a stale function pointer and panics. No public exploit identified at time of analysis; EPSS of 0.16% (5th percentile) reflects the niche, hardware-specific exploitation surface.
Incorrect pointer passing in the Linux kernel's igorplugusb infrared USB receiver driver causes the USB core to misinterpret raw pointer bytes as a USB control setup packet, triggering a BOGUS control direction warning and a kernel-level denial of service. The regression was introduced by commit eac69475b01f, which allocated ir->request as a pointer for DMA coherency but left the usb_fill_control_urb() call referencing &ir->request (the pointer variable's address) rather than ir->request (the allocated struct usb_ctrlrequest). No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.17% (6th percentile), reflecting minimal real-world exploitation probability.
Deadlock vulnerability in the Linux kernel's GPIO shared proxy subsystem allows a local, low-privileged user to cause a system hang by triggering removal of a shared GPIO proxy's parent device. The root cause is an overly-wide mutex critical section introduced in commit 710abda58055, where the gpio_shared_entry mutex was held for too long, creating a locking inversion scenario during parent device teardown. No public exploit code exists and no active exploitation has been identified; the fix narrows the critical section to protect only offset reads.
Division-by-zero kernel panic in the Linux kernel's i2c-davinci driver causes a deterministic system crash on TI DaVinci SoC-based hardware when the 'clock-frequency' device tree property is absent. The root cause is a unit mismatch: DAVINCI_I2C_DEFAULT_BUS_FREQ was defined in kHz (100) but the probe path divided it by 1000, producing dev->bus_freq = 0, which then triggers an unconditional divide-by-zero during clock divider calculation. Availability impact is complete (kernel panic), but exploitation requires specific embedded hardware context; no public exploit exists and EPSS is 0.15%, consistent with a reliability defect rather than an adversarially exploitable flaw.
NULL pointer dereference in the Linux kernel's pch_uart serial driver allows a local low-privileged user to crash the kernel by triggering a failed DMA memory allocation in dma_handle_rx(). Systems running Intel PCH (Platform Controller Hub) hardware with the pch_uart driver active and DMA enabled are vulnerable to denial of service via kernel panic. No public exploit or CISA KEV listing exists; with an EPSS of 0.17% (6th percentile), real-world exploitation risk is low, but patches are confirmed across multiple stable kernel branches.
Use-after-free in the Linux kernel USB UVC gadget driver allows a privileged local user to crash the kernel by racing configfs extension-unit teardown against the bind-time list walks in uvc_function_bind(). The bind path walks opts->extension_units without holding opts->lock, while the configfs write path (uvcg_extension_drop) correctly holds the lock, creating an asymmetric locking pattern that enables a freed struct uvcg_extension to be dereferenced. No public exploit exists and EPSS sits at 0.16% (5th percentile), but patches are confirmed across multiple stable kernel branches including 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1.
Out-of-bounds memory access in the Linux kernel's drm/msm DSI display subsystem causes a kernel panic on systems with Qualcomm MSM DSI 6G hardware. The io_offset adjustment applied to the mapped IO base address is not reflected in the ctrl_size value passed to the snapshot dump routine, so msm_disp_snapshot_add_block reads past the end of the mapped region and crashes the kernel. Only devices with Qualcomm MSM DSI 6G display hardware running an unpatched kernel from 5.14 onward are affected; no public exploit exists and EPSS of 0.17% confirms very low exploitation probability.
Kernel panic via NULL pointer dereference in the Linux tps65219 PMIC regulator driver crashes affected systems when a hardware IRQ fires on the device, producing a local denial-of-service condition. The regression was introduced by commit 64a6b577490c, which removed the helper function `tps65219_get_rdev_by_name()` and inadvertently eliminated the only code path that assigned `irq_data.rdev`, leaving the pointer uninitialized for every registered IRQ. Systems running Linux kernel versions from that commit through the stable-branch fix points (6.18.34 and 7.0.11) on hardware equipped with the TI tps65219 PMIC are affected; no public exploit has been identified and the EPSS score of 0.17% reflects low exploitation probability.
Broadcast TLB flush in the Linux kernel x86 memory management subsystem triggers a General Protection Fault (#GP) on AMD INVLPGB-capable systems booted with the 'nopcid' parameter, causing a kernel panic and local denial of service. When PCID is disabled via 'nopcid', CR4.PCIDE is not set, but the INVLPGB broadcast TLB invalidation path remains enabled; once a memory descriptor becomes active across more than three CPUs, the kernel assigns it a global ASID and issues INVLPGB with a non-zero PCID - an illegal state that crashes the kernel. No public exploit exists, EPSS is 0.17% (6th percentile), and this is not in CISA KEV; real-world impact is constrained to the uncommon 'nopcid' boot configuration on AMD hardware.
Authentication bypass in Cosmos Server 0.22.18 allows unauthenticated attackers to leak Constellation device metadata via the public-devices endpoint. The handler accepts any non-empty Authorization header but does not validate the bearer token, exposing device names, IPs, and role flags. Publicly available exploit code exists, but no active exploitation is reported; the vulnerability is patched in version 0.22.19.
HTTP request smuggling vulnerability in Rouille's proxy implementation allows remote attackers to desynchronize HTTP message boundaries using a CL.TE attack. Affected versions 0.3.3 through 3.6.2. Publicly available exploit code exists, but no active exploitation has been reported.
HTTP response splitting in Rouille 0.4.0 to 3.6.2 allows remote attackers to inject arbitrary response headers. By embedding carriage return or line feed bytes into percent-decoded query parameters or Cookie header values, attackers can perform cache poisoning, session fixation, and override security policies like CSP or CORS. No active exploitation is confirmed, but proof-of-concept code may exist.
HTTP request smuggling in Rouille 0.3.3 through 3.6.2 allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into header values. The framework forwards these headers verbatim to backends like Go net/http or Python http.server, which interpret the raw LF as a request delimiter, enabling a smuggled request with attacker-chosen method, path, and headers. Publicly available exploit code exists, increasing the risk for deployments using Rouille as a proxy.
Remote unauthenticated denial of service in gopacket <= 1.6.0 via a single crafted sFlow UDP datagram that triggers an unbounded memory allocation of up to 16 GiB, causing the parsing process to be OOM-killed. Affected services include any network telemetry collector or application that uses gopacket’s sFlow decoder without additional validation. A proof-of-concept exploit exists and can crash the process with just a 104-byte packet.
Remote denial-of-service in the gopacket library's Diameter AVP decoder allows unauthenticated attackers to trigger a ~4 GiB memory allocation per crafted packet, causing OOM kill after two messages under memory constraints. The flaw affects gopacket ≤1.6.0 (latest before fix), and publicly available exploit code demonstrates end-to-end exploitation against a collector with a 256 MB memory cap. No active exploitation is currently reported.
Race condition in Xen's grant table version switching (v2 to v1) allows remote unauthenticated attackers to cause low confidentiality impact and denial of service under specific conditions. The vulnerability arises when hypervisor code drops and re-acquires the grant table lock during a version switch, creating a window where status frame properties can change inconsistently. No public exploit has been identified at time of analysis, and the CVSS network attack vector may be misleading as exploitation likely requires a guest domain to initiate the switch.
Race condition in Xen Grant Table version switching from v1 to v2 allows a malicious guest VM to cause low confidentiality impact and limited denial of service. The vulnerability occurs when hypervisor code drops and reacquires the grant table lock during the version transition, creating a window where reference counts become inconsistent. No active exploitation or public exploit code has been identified at time of analysis.
Memory corruption in Xen allows guest VMs with Populated on Demand (PoD) enabled to cause denial of service by attempting to reclaim non-guest memory pages, corrupting hypervisor memory management state. No public exploit identified and SSVC indicates no current exploitation, but the flaw is automatable with partial technical impact.
Information disclosure in Xen's vNUMA configuration handling allows low-privileged authenticated attackers to read sensitive guest data during domain destruction. A race condition between the device model retrieving configuration and the simultaneous cleanup of that data permits unauthorized access to memory layout or other confidential information. No public exploit is identified, and the vulnerability is not known to be actively exploited at this time.
Denial of service in Xen libfsimage's iso9660 driver can be triggered by a local attacker mounting a crafted ISO image, crashing the Xen host. The vulnerability arises from insufficient validation of size and offset fields in Rock Ridge Continuation Entry (CE) records, leading to out-of-bounds memory access. Although the CVSS score is only 5.5 (Medium), the attack requires user interaction (mounting the ISO), and no patch version is specified in the provided data; active exploitation status is unknown.
Denial of service in libfsimage's iso9660 driver via crafted ISO image with a malformed Rock Ridge NM record entry length, causing crash of tools that use the library. Affects libfsimage from Xen Project; no public exploit or active exploitation identified.
Denial of service in the iso9660 driver of libfsimage when parsing Rock Ridge extensions. The vulnerability affects the Xen hypervisor's toolstack and potentially other software using this library. A crafted ISO image can trigger an infinite loop or memory corruption due to failure to validate record lengths, resulting in a crash. This issue is not known to be exploited publicly and requires local user interaction.
Integer underflow in the System Use area calculation of libfsimage's ISO 9660 driver allows denial of service via a crafted ISO image. An unauthenticated local attacker can cause the driver to crash when a user or process mounts or accesses a malicious ISO file, resulting in high availability impact. No active exploitation or public exploit has been identified at this time, and CVSS 5.5 with local attack vector and user interaction limits real-world risk.
Out-of-bounds read in libfsimage’s iso9660 directory walk allows local attackers with a crafted disk image to leak memory or crash the host when the image is mounted. The flaw arises from unvalidated record lengths read directly from attacker-controlled on-disk fields. No known active exploitation or public exploit code exists.
Safari and WebKit-based apps across Apple platforms crash when a user visits a specially crafted website, due to a state management flaw (CWE-400: Uncontrolled Resource Consumption) in versions prior to 26.6. Affected platforms include Safari on macOS Tahoe, iOS 26, iPadOS 26, and visionOS 26. No confidentiality or integrity impact is present - the consequence is an app-level denial-of-service. No public exploit code exists and CISA SSVC confirms no active exploitation, with EPSS at 0.16% (6th percentile), indicating very low exploitation likelihood at time of analysis.
UI spoofing in Apple Safari 26.5 and earlier allows attackers using cross-origin framing to misrepresent website identity. The vulnerability requires user interaction (visiting a malicious page) and could lead to phishing or deceptive actions. No active exploitation or public exploit code identified; patch is available.
Bypass of iframe sandboxing policy in Apple Safari and all Apple operating systems through version 26.5 allows malicious web content to violate sandbox restrictions. Affected users include anyone running Safari on iOS, iPadOS, macOS Tahoe, tvOS, visionOS, or watchOS prior to version 26.6. An attacker can cause integrity violations, such as injecting or modifying content within sandboxed iframes, but requires user interaction (clicking a link or visiting a malicious page) and no public exploit or active exploitation has been identified at this time.
Out-of-bounds heap read in GNU Binutils linker when processing 32-bit XCOFF files allows local attackers to disclose heap memory and cause denial of service. Affects Red Hat Enterprise Linux 6 through 10, Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation identified at time of analysis; EPSS data unavailable.
Server-side request forgery in Kimi Code's FetchURL tool allows attackers who can influence a FetchURL call (e.g., via prompt injection) to bypass hostname and IP denylists by using crafted public hostnames that resolve to internal addresses or via HTTP redirects, exposing internal network services. No public exploit or active exploitation identified at the time of analysis.
Remote denial of service in llama.cpp allows unauthenticated attackers to exhaust server resources via crafted JSON schema inputs that trigger unbounded recursion in the JSON-schema-to-GBNF conversion routine. Affected versions include commit e15efe0 and prior. A fix exists in a pending pull request; no active exploitation reported.
Denial of service in ggml-org llama.cpp allows remote attackers to crash the application by sending a crafted JSON schema that triggers a null pointer dereference in the _visit_pattern function. No authentication or user interaction is required, and all versions up to the affected commits d006858/e15efe0 are vulnerable. The fix is pending merge; no public exploit code has been identified.
Denial of service in SQLite 3.41 due to a use-after-free in the JSON extraction function. A local unauthenticated attacker can trigger a crash by supplying a malicious JSON input, causing the host application to terminate. No active exploitation has been confirmed in the wild, but public exploit proof-of-concept may exist.
Memory exhaustion in ImageMagick's magick CLI tool allows a local attacker to cause denial of service by repeatedly supplying malformed command-line arguments. Affects versions before 7.1.2-27. Vendor patch is available; no public exploit or active exploitation reported.
NULL pointer dereference in the Linux kernel tracing subsystem (`func_set_flag()`) allows a local attacker with tracefs write access to trigger a kernel panic and crash the system. The flaw arises when a process holds an open file descriptor to a function tracer option (e.g., `func_stack_trace`) while a concurrent tracer switch sets `tr->current_trace_flags` to NULL; a subsequent write to that option file then dereferences the NULL pointer before the function tracer guard executes. No active exploitation (KEV) or public exploit code has been identified; EPSS is 0.20% at the 10th percentile, consistent with a localized, technically specific DoS condition.
Kernel crash (availability loss) in the Linux gpio/eic-sprd Spreadtrum EIC GPIO driver affects systems running PREEMPT_RT kernels with Unisoc/Spreadtrum SoCs. The IRQ startup path - request_threaded_irq() → irq_startup() → sprd_eic_irq_unmask() - calls sprd_eic_update(), which acquires a regular spinlock_t via spin_lock_irqsave(). On PREEMPT_RT kernels, spinlock_t is a sleeping lock; sleeping in a non-sleepable IRQ-disabled context triggers a kernel BUG: 'sleeping function called from invalid context', crashing the system. No public exploit has been identified at time of analysis; patches are available across all maintained stable branches.
Kernel panic risk in the Linux gpio-sch driver exposes PREEMPT_RT systems with legacy Intel SCH GPIO hardware to a local denial of service. The SCH IRQ unmask callback acquires a regular spinlock inside a non-sleepable IRQ-setup context; under PREEMPT_RT, that spinlock is reimplemented as a sleeping lock, triggering a lockdep BUG and potential kernel panic. Patches are available across all active stable branches (5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.39, 7.1.4); no public exploit exists and EPSS is 0.21% (percentile 12%).
NULL pointer dereference in the Linux kernel's hid_logitech_dj driver causes a kernel crash (DoS) when a crafted HID descriptor is processed during device probe. The flaw exists in logi_dj_probe(): when a Logitech Unifying receiver emulation presents report ID 0x20 with only padding output items, hid-core registers the report with rep->maxfield == 0. The error-path validation then dereferences rep->field[0]->report_count while printing a diagnostic message, triggering a KASAN-visible null-ptr-deref and kernel panic. No public exploit is identified at time of analysis, but the kernel commit descriptions include a full uhid-based reproduction method, lowering the barrier for local attackers.
Resource exhaustion via file reference leak in the Linux kernel's io_uring NOP opcode handler allows a local, low-privileged user to gradually exhaust kernel memory. The flaw occurs when a NOP submission carries the generic IOSQE_FIXED_FILE sqe flag (setting REQ_F_FIXED_FILE) but omits the NOP-specific IORING_NOP_FIXED_FILE flag in nop_flags: io_nop() acquires a real file reference via io_file_get_normal(), yet io_put_file() skips releasing it because REQ_F_FIXED_FILE is set, producing one leaked 176-byte kernel file object per operation. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Kernel availability loss in the Linux mm/shrinker subsystem allows a local user with debugfs access to trigger a kernel BUG by reading the debugfs 'count' file of a memcg-aware shrinker such as zswap. The shrinker_debugfs_count_show() function incorrectly holds rcu_read_lock() while invoking ->count_objects() callbacks; when zswap's callback attempts to flush memcg stats via css_rstat_flush(), it sleeps inside an RCU read-side critical section - a fatal kernel invariant violation. No public exploit has been identified at time of analysis, and EPSS is very low at 0.21% (12th percentile).
Kernel panic via NULL pointer dereference in the Linux kernel's memory shrinker debugfs interface allows a local attacker to crash the system. The shrinker_debugfs_add() function unconditionally creates 'count' and 'scan' debugfs files for all registered shrinkers, but some shrinkers - notably the xen-backend shrinker - only implement one of the two required callbacks (count_objects or scan_objects). Writing to the exposed 'scan' debugfs file on such a shrinker dispatches through a NULL function pointer, triggering a kernel panic. No public exploit has been identified at time of analysis, and EPSS score of 0.21% reflects low exploitation probability. Patches are available across multiple stable kernel branches.
NULL pointer dereference in the Linux kernel's swap cgroup subsystem (`mm/swap_cgroup.c`) causes a kernel panic and full system crash on swapless hosts running kernel versions after commit `bea67dcc5eea`. The batched PTE zap path introduced by that commit calls `lookup_swap_cgroup_id()` without validating the swap entry against `swap_info[]`, so any process exit involving a PTE corrupted into a type-0 swap entry dereferences the uninitialized `ctrl->map` pointer and takes the host down. The crash pattern was confirmed in production on kernel 6.12.58 and independently reproduced by syzbot; no public exploit exists, but the kernel teardown path is deterministically vulnerable once the prerequisite conditions are present.
Softlockup in the Linux kernel's swap memory reclaim path allows a local user to trigger a kernel panic by generating heavy swap pressure on systems with large swap devices. The swap_reclaim_full_clusters() function, called from a kworker context, iterates through potentially thousands of full swap clusters without yielding the CPU via cond_resched(), starving the scheduler and eventually causing the kernel watchdog timer to fire. The vulnerability was confirmed in a real-world stress test on a 320-CPU arm64 machine with ~1TB RAM and an 8.6GB swap device, resulting in a kernel panic. No public exploit code exists and EPSS is very low (0.21%, 11th percentile).
Denial of service in the Linux kernel btmtksdio (MediaTek Bluetooth SDIO) driver allows a local attacker with low privileges to permanently hang the Bluetooth stack by triggering an infinite loop in btmtksdio_txrx_work(). The root cause is an inverted timeout logic: a misused time_is_before_jiffies() call, combined via OR, causes the worker loop's exit condition to become unconditionally true after the 5-second timeout fires, so the loop never terminates and never releases the SDIO host. No public exploit has been identified at time of analysis; however, the bug can also trigger organically under hardware stress conditions.
NULL pointer dereference in the Linux kernel Bluetooth HCI connection handler crashes the kernel when aborting a pending connection while `hdev->sent_cmd` is NULL but `req_status` remains `HCI_REQ_PEND`. Local users with Bluetooth access can trigger a general protection fault from the `hci_rx_work()` receive path, producing a kernel panic and denying service to all users on the affected system. No public exploit has been identified and EPSS probability stands at 0.21% (12th percentile), indicating very limited real-world exploitation likelihood.
NULL pointer dereference in the Linux kernel's Bluetooth ISO subsystem can crash the kernel when a race condition is triggered during PA-sync broadcast sink socket operations. The flaw exists in iso_conn_big_sync(), which drops the socket lock to call hci_get_route() and then re-acquires it without re-validating that the connection structure is still intact - allowing concurrent teardown events (iso_disconn_cfm → iso_conn_del → iso_chan_del) to null out iso_pi(sk)->conn before it is dereferenced. A local low-privileged user with access to Bluetooth ISO sockets can reliably crash the kernel, resulting in a denial of service. No public exploit code has been identified and no active exploitation is confirmed.
Device reference count leak in the Linux kernel's firmware_loader subsystem exposes systems to local denial-of-service conditions. Specifically, firmware_upload_register() fails to call put_device() on the fw_dev pointer when alloc_lookup_fw_priv() fails after fw_create_instance() has already called device_initialize(), leaving the embedded struct device reference count unbalanced and potentially preventing proper memory cleanup. Discovered via static analysis and confirmed by manual code review, the issue is patched across multiple stable kernel branches including 6.1.178, 6.6.145, 6.12.96, 6.18.39, and 7.1.4. No public exploit exists and no active exploitation has been observed.
Null pointer dereference in the Linux kernel's cpufreq subsystem during system reboot allows a local attacker with low privileges to crash the kernel. The reboot path (kernel_restart() → device_shutdown() → cpufreq_suspend()) does not invoke freeze_processes() - unlike the normal suspend path - leaving CPU hotplug operations free to run concurrently and free governor_data while cpufreq_suspend() is still reading it, producing a use-after-free null pointer dereference. No public exploit exists and EPSS probability is 0.22% (13th percentile), placing this in low-urgency territory despite the ubiquitous kernel footprint.
Denial of service via infinite exception loop in the Linux kernel's s390 architecture affects systems running IBM Secure Execution (Ultravisor) workloads on kernel versions 6.7 through the patched releases. When load_unaligned_zeropad() reads across a page boundary where the adjacent page has been donated to the Ultravisor, the do_secure_storage_access() exception handler cannot resolve the fault and enters an unresolvable loop, permanently hanging the affected execution context. Patched in upstream versions 6.12.97, 7.1.4, and 7.2-rc1 via reversion of DCACHE_WORD_ACCESS support on s390; no public exploit or active exploitation is confirmed at time of analysis.
Uninitialized stack memory use in the Linux kernel HFS and HFS+ filesystem drivers allows a local user to crash the kernel by mounting a crafted filesystem image. Two early-exit paths in `hfs_bnode_read()` - an invalid offset check and a corrected-to-zero length - skip the buffer write, while downstream callers such as `hfs_bnode_read_u16()` and `hfs_bnode_read_u8()` consume the uninitialized stack buffer unconditionally, producing KMSAN uninit-value reports and risking kernel panics. Patches are available across multiple stable kernel branches; no public exploit exists and EPSS is very low at 0.22%.
Hung-task denial-of-service in the Linux kernel's nilfs2 filesystem allows a local low-privileged user to indefinitely stall concurrent filesystem operations by supplying out-of-range segment numbers to the NILFS_IOCTL_CLEAN_SEGMENTS ioctl. Because input validation was deferred deep inside the call chain to nilfs_sufile_updatev() - which emits one printk warning per invalid entry while holding ns_segctor_sem write-locked - repeated invocations saturate the global printk path and keep the semaphore held long enough to block all readers, including routine operations such as chmod(). No public exploit has been identified and EPSS is very low (0.22%, 13th percentile), consistent with a local kernel DoS requiring filesystem access.
Unconditional invocation of cancel_work_sync() in the mtk-jpeg media driver's release path triggers spurious WARN_ON kernel warnings on non-multicore MediaTek JPEG codec platforms where the workqueue callback pointer is NULL. Systems running affected Linux kernel versions (6.6.140-6.18.38, 7.0.4) on MediaTek SoC hardware may experience kernel log pollution or, on kernels compiled with CONFIG_PANIC_ON_WARN=y, a full system denial of service when the JPEG device is released. No public exploit has been identified and no active exploitation is recorded; this is a stability and correctness fix with strictly local trigger conditions.
Integer overflow in the Linux kernel's XFS filesystem exchmaps reservation logic allows a local low-privileged user to crash the system. The bug in xfs_exchmaps_estimate_overhead() adds bmbt and rmapbt overhead to a local resblks variable but then performs the UINT_MAX guard check against the original req->resblks value - the pre-overhead figure - before writing the inflated value back into req->resblks for use in xfs_trans_alloc(). This means the guard intended to prevent integer truncation when the reservation is cast to unsigned int is rendered ineffective, enabling a kernel panic on XFS systems where exchmaps overhead pushes the reservation past UINT_MAX. No public exploit exists and EPSS is 0.21%, placing this firmly in the kernel stability/bug-fix category rather than active threat landscape.
Memory exhaustion in the Linux kernel XFS quota subsystem can be triggered by a local low-privilege user on systems mounting metadir XFS images with user quota enabled. The vulnerability exists in xfs_dqinode_metadir_create(), where failure of xfs_metadir_create() returns without releasing the allocated update and transaction state, and commit failures leave behind caller-owned inode references. Confirmed present from Linux 6.13-rc1 through v7.1.1; patched in stable releases 6.18.39 and 7.1.4.
The Linux kernel BPF verifier incorrectly elides null-check requirements for inner array map lookups when the BPF_F_INNER_MAP flag is set, allowing a local attacker with BPF program loading privileges to trigger a null pointer dereference and crash the kernel. The flaw arises because the verifier uses the inner map template's max_entries for bounds reasoning at verification time, while the runtime helper operates against a concrete inner map that may have a larger max_entries value. A crafted BPF program exploiting the faulty nullness elision can cause a kernel denial of service. No public exploit code has been identified at time of analysis, and EPSS is low at 0.21%.
Out-of-bounds read in the Linux kernel's Samsung Kalmia USB network driver allows a malicious USB device to crash the kernel via a u16 integer underflow in `kalmia_rx_fixup()`. When a crafted bulk-IN frame is 6-11 bytes long, the subtraction `skb->len - 12` underflows to approximately 65,530, bypassing length validation and causing `memcmp()`, `skb_trim()`, and `skb_pull()` to operate past the end of the 14,000-byte RX buffer. No public exploit or active exploitation (CISA KEV) has been identified; EPSS at 0.23% (14th percentile) confirms minimal exploitation interest.
Memory exhaustion in the Linux kernel's USB CDNSP host controller driver allows local users to trigger a kernel-level memory leak by forcing partial allocation failures in `cdnsp_alloc_stream_info()`. Systems running Linux 5.12 through unpatched stable branches accumulate unreleased `stream_ctx_array` allocations that are never freed, eventually causing availability impact on hosts with CDNSP USB hardware. No public exploit exists, EPSS stands at 0.21%, and the vulnerability carries no confidentiality or integrity impact per the CVSS vector.
Incorrect argument passing in dwc3_ulpi_setup() causes the Linux kernel's DWC3 USB controller driver to pass a raw MMIO register pointer (dwc3->regs, typed as void __iomem *) to dwc3_readl() and dwc3_writel(), which instead expect the containing struct dwc3 * pointer. Because the register accessor functions internally dereference the struct to locate ->regs, supplying ->regs directly results in incorrect memory access during ULPI (USB Low Pin Interface) initialization - flagged by the kernel sparse checker as a type-safety violation across address spaces. The practical impact is a potential kernel panic or silent misread/miswrite of a USB control register, manifesting as an availability failure in systems using DWC3 ULPI USB controllers. No public exploit exists and the issue requires local access to trigger.
Kernel denial-of-service in the Linux USB gadget composite driver crashes the system by triggering a KASAN memory fault in the USB_DT_OTG request handler when the configuration list is empty. The flaw exists because list_first_entry() never returns NULL - making the subsequent config NULL-check dead code - so when cdev->configs is empty during a gadget unbind race or when a driver sets is_otg before registering any configuration, composite_setup() dereferences a garbage pointer and memcpy() copies arbitrary kernel memory into the USB response buffer. No public exploit code has been identified, and EPSS is 0.22% (13th percentile), consistent with the local, race-condition nature of the flaw.
Reference count leak in the Linux kernel USB gadget printer driver (f_printer) allows a local user to trigger a permanent kref increment on every rejected concurrent open attempt. Each call to printer_open() that returns -EBUSY still increments dev->kref, but because VFS never invokes ->release() for a failed open, the reference is never balanced. Repeated exploitation exhausts the reference counter, preventing proper driver teardown and causing availability degradation. No public exploit has been identified at time of analysis.
Incomplete error-path cleanup in the Linux kernel's uss720 USB-to-parallel-port driver leaves a parport device registered after probe failure, creating a dangling stale pointer backed by freed private data. Systems where a Belkin F5U002 or similar USS720-based adapter is attached and causes get_1284_register() to fail during uss720_probe() are left with an orphaned kernel parport entry and a reserved parport slot, which can lead to a kernel crash when the stale pp->private_data pointer is later dereferenced. No active exploitation has been identified; the bug was discovered via static-analysis research, and patches are available across all major Linux stable branches.
DMA mapping leak in the Linux kernel's MTU3 USB device controller driver causes local denial-of-service on MediaTek SoC platforms. When mtu3_gadget_queue() maps a USB transfer request via DMA before checking whether the QMU GPD ring has capacity, then mtu3_prepare_transfer() fails and returns -EAGAIN, the error path bypasses the mtu3_req_complete() cleanup helper, permanently stranding the DMA mapping. Repeated exhaustion of the IOMMU aperture can destabilize or crash the kernel. No public exploit code exists and EPSS at 0.22% (13th percentile) confirms negligible exploitation interest; the impact is a local availability-only issue confined to MediaTek USB gadget hardware.
Availability loss in the Linux kernel's USB serial digi_acceleport driver allows a local user to permanently halt data reception on a Digi AccelePort serial port until the USB device is physically reconnected or the driver is rebound. The bug arises from a missing URB resubmission path: when a port is closed while in a throttled state, the read URB is never re-queued, leaving the port silently deaf to incoming data upon next open. No public exploit has been identified and EPSS sits at 0.22% (13th percentile), reflecting the niche hardware dependency and local-only attack surface.
Hard lockup in the Linux kernel's digi_acceleport USB serial driver causes full system freeze when a Digi AccelePort device is physically disconnected during active I/O. The driver's OOB (out-of-band) command path loops indefinitely with interrupts disabled upon persistent URB submission failure, resulting in a kernel hard lockup that effectively crashes the host. Systems with this specific USB-to-serial adapter are affected across a wide range of stable kernel branches from 2.6.12 onward; patches have been released across all active stable series.
Memory leak in the Linux kernel USB ULPI (Universal Serial Bus Link Interface) subsystem allows a local low-privileged user to trigger repeated ULPI device registration failures that leak kernel memory, potentially leading to system instability or denial of service. Affected kernel versions span from 4.2 through multiple pre-patch stable branches, with fixes backported to 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc3. No public exploit or active exploitation has been identified at time of analysis; the EPSS score of 0.22% (13th percentile) reflects minimal probability of weaponization.
NULL pointer dereference in the Linux kernel's usbip virtual UDC (vudc) subsystem crashes the kernel when FunctionFS AIO cancellations are processed. The `vep_alloc_request()` function never initialized `vrequest->udc`, so any AIO cancellation arriving at `vep_dequeue()` - such as one triggered by a host-side `usbip attach` - dereferences a null pointer and produces a kernel oops, denying service to the guest system. A local attacker with low privileges on a system configured for USB/IP with FunctionFS AIO endpoints can reliably reproduce this crash. No public exploit code exists, and EPSS at 0.22% (13th percentile) confirms the path has not seen meaningful exploitation despite the bug reportedly existing for approximately ten years since Linux 4.7.
Kernel memory leak in the Linux USB gadget FunctionFS (f_fs) subsystem allows a local low-privileged user to slowly exhaust kernel memory by repeatedly triggering DMA buffer transfers via the ffs_dmabuf_transfer() code path. Affected kernels span from the commit introducing DMA buffer sharing (7b07a2a7ca02) through versions prior to 6.12.96, 7.1.4, and 7.2-rc3. The root cause is a missing dma_fence_put() call after dma_resv_add_fence(), leaving the initial kref permanently outstanding and causing ffs_dma_fence objects to accumulate without ever being freed. No public exploit has been identified at time of analysis.
The USB gadget FunctionFS (f_fs) subsystem in the Linux kernel fails to initialize the endpoint direction field (epfile->in) until USB host connection, leaving it zero when userspace performs early DMA ioctl calls such as FUNCTIONFS_DMABUF_ATTACH before a host connects. This incorrect DMA direction causes kernel-mode availability loss - crashes or hangs - on systems actively using FunctionFS-based USB gadgets with DMABUF. No public exploit has been identified, and EPSS probability stands at 0.21% (11th percentile), reflecting very low opportunistic exploitation risk.
The block device layer in Linux Kernel hangs indefinitely during NVMe surprise removal when `bdev_mark_dead()` is called with `surprise=true`, because a missing guard causes `sync_blockdev()` to be invoked on an already-dead device, permanently blocking `folio_wait_writeback()`. Triggered via `nvme_reset_work()` I/O-queues-lost path, the bug wedges the NVMe reset worker and every task waiting on it, requiring a system reboot to recover. Discovered by FuzzNvme (syzkaller + FEMU fuzzing framework); no public exploit identified at time of analysis.
Sensitive cryptographic key material handled by the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver was unconditionally emitted to the kernel ring buffer via unguarded hex-dump calls in *_setkey() and gen_split_key(), exposing raw key bytes to any local user with dmesg access on kernels built with CONFIG_DYNAMIC_DEBUG. The exposure affects NXP CAAM-equipped platforms (i.MX, QorIQ SoC families) running kernel versions from approximately 5.3 through the fix commits across all active stable branches. No public exploit code exists and EPSS probability is 0.22%, but key material disclosure on a crypto-accelerator driver carries genuine confidentiality risk that the vendor-assigned CVSS (C:N/I:N/A:H) incorrectly characterizes - the real primary impact is confidentiality loss, not availability.
Null pointer dereference in the Linux kernel's chacha20poly1305 crypto template allows a local unprivileged user to crash the system. The flaw exists in chachapoly_create(), which passes the unvalidated return value of crypto_attr_alg_name() directly to strcmp() when the poly1305 sub-argument is absent in a malformed template string; since that function returns an ERR_PTR on failure, the subsequent strcmp() call dereferences an invalid pointer, triggering a kernel panic. Patches are available across multiple stable branches; no public exploit or active exploitation has been identified at time of analysis.
Denial of service in the Linux kernel's AMD CCP/SEV driver allows a local low-privileged process to crash a KVM hypervisor host by submitting SEV firmware ioctls to /dev/sev, which incorrectly triggers SNP initialization and zeroes the MSR_VM_HSAVE_PA register, causing a general protection fault on the next VMRUN and terminating all running virtual machines. Affected kernels span from the introducing commit (ceac7fb89e8da465aec3ac3c20477f912f5c3a6c) through the fixed stable releases 6.12.96, 6.18.39, and 7.1.4. No public exploit has been identified and EPSS is 0.22%, but the blast radius - crashing the host and all its tenant VMs - warrants prompt patching on AMD EPYC KVM deployments.
Crash of a Linux KVM host is achievable by a local low-privileged user via the /dev/sev ioctl interface on systems running AMD SEV-SNP firmware. When SNP_COMMIT is issued after a prior failed SEV initialization, the crypto/ccp driver incorrectly proceeds with SNP initialization, zeroing out MSR_VM_HSAVE_PA - the model-specific register holding the AMD SVM host save-area pointer. Any subsequent VMRUN instruction by KVM for an already-running VM will generate a General Protection Fault, crashing the host and terminating all guest workloads. No public exploit has been identified at time of analysis; patch commits are available across multiple stable branches.
Uncontrolled SNP initialization in the Linux kernel's CCP/SEV driver allows a local low-privileged user with /dev/sev access to crash the host kernel on AMD SEV/SNP-capable systems running KVM. Sending a SNP_VLEK_LOAD ioctl when SNP has not been initialized triggers an unnecessary initialization/shutdown wrapper that zeros MSR_VM_HSAVE_PA globally; the subsequent VMRUN instruction for any active KVM guest then triggers a General Protection Fault, bringing down the host and terminating all co-hosted VMs. No public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects the specialized attack environment required.
Host crash vulnerability in the Linux kernel's AMD SEV/SNP subsystem allows a local low-privileged user to take down a virtualization host by triggering SNP re-initialization via the `/dev/sev` `SNP_CONFIG` ioctl when SNP has previously failed to initialize. When re-initialization executes while KVM guests are running, it zeroes `MSR_VM_HSAVE_PA` globally across all CPUs; the next VMRUN instruction on any active guest then raises a General Protection Fault, crashing the host kernel and terminating all hosted VMs. No public exploit identified at time of analysis; EPSS is 0.22% at the 13th percentile, consistent with low opportunistic exploitation probability.
Silent error propagation in the Linux kernel's CTR_DRBG implementation (`drbg_ctr_generate()`) causes the function to return a success code while leaving its output buffer uninitialized when an internal operation fails. Code that relies on the generated random material receives garbage data, which can trigger kernel crashes or hangs depending on how the uninitialized buffer is consumed downstream. No public exploit has been identified; patched stable kernel releases are available across all active longterm-support branches.
PMD-sized vmemmap pages are silently leaked in the Linux kernel's x86 memory management subsystem following a regression introduced in commit bf9e4e30f353, which replaced __free_pages() with pagetable_free() for vmemmap page freeing. Because vmemmap pages are not compound pages (outside of HVO, which does not apply here), pagetable_free() resolves compound_order() to zero and frees only the first page of a PMD-sized block, leaking the remaining pages on every memory section removal. Systems running affected kernel versions (6.18.7-6.18.38, 6.19 series through 7.1.3) that perform x86 memory hotplug operations will experience progressive physical memory loss; no public exploit has been identified and this vulnerability is not in CISA KEV.
Reference count leak in the Linux kernel's SCMI regulator driver can exhaust kernel memory resources, leading to a denial-of-service condition on affected systems. The flaw resides in scmi_regulator_probe(), where of_find_node_by_name() acquires a reference on a device-tree node but the corresponding of_node_put() release call is omitted on the error path when process_scmi_regulator_of_node() fails, permanently leaking the reference. Exploitation requires local access; no public exploit code has been identified and EPSS probability stands at 0.21%, indicating very low likelihood of opportunistic exploitation.
Hostname verification missing in Apache Thrift Python TSSLSocket before 0.24.0 enables man-in-the-middle impersonation, allowing interception and manipulation of RPC traffic. This flaw violates TLS certificate hostname matching, effectively letting an attacker with a valid certificate for any domain present as a legitimate server. No active exploitation or public exploit code is known.
Out-of-bounds read vulnerability in the c_glib language bindings of Apache Thrift before 0.24.0 may allow remote attackers to read heap memory contents through crafted Thrift messages. Affected users should upgrade to version 0.24.0. No public exploit or active exploitation has been identified at this time.
Heap out-of-bounds read in Apache Thrift's C++ THeaderTransport::readHeaderFormat() allows remote attackers to read unintended memory contents, potentially leading to information disclosure or denial of service. All versions before 0.24.0 are affected. No public exploit code has been reported.
Resource exhaustion in Apache Thrift Java bindings 0.19.0 through 0.23.x allows remote denial of service via an unbounded read. No authentication or user interaction is required, and no public exploit code is known. Users should upgrade to version 0.24.0 to remediate the issue.
Authorization bypass in Cloudreve WOPI integration allows view-only sessions to modify files. The WOPI access token secret is ignored, and view-created sessions can call write endpoints, enabling unintended file modification even when the viewer should be read-only. An attacker with a valid user session or control of a WOPI viewer can exploit this to overwrite files. Publicly available exploit code exists, but no active exploitation confirmed.
Metadata leakage in Cloudreve single-file shares allows an authenticated recipient to observe file activity (rename, create, delete) of unshared siblings in the owner's parent folder via the event stream endpoint, exposing file names and operation types but not file contents.
Denial of service in Cloudreve v4 and v3 allows any authenticated user to crash the entire server instance by uploading a tiny, maliciously crafted PNG/JPG/GIF file. The built-in image processor, enabled by default, decodes images without a pixel dimension cap, causing the Go stdlib to allocate large memory buffers from header‑supplied dimensions, triggering a fatal out‑of‑memory kill. A public proof‑of‑concept exploit is available, and the vendor has released a patch in version 4.17.0.
Information disclosure in Cloudreve allows any logged-in user to enumerate and harvest email addresses of inactive and banned accounts via the user search API. The `SearchActive` method in v4 and v3 omits the required status filter, exposing basic profile metadata to authenticated attackers. No account credentials are compromised, but the leaked PII enables user enumeration across the platform.
Path traversal in Cloudreve's WOPI PUT_RELATIVE handler permits authenticated attackers with a WOPI access token to write files to arbitrary locations within the same user account, bypassing the token's single-file scope. A crafted X-WOPI-SuggestedTarget header with directory traversal sequences (e.g., a/../../evil.docx) resolves outside the source
Heap buffer over-write in Magick.NET versions before 14.15.0 on 32-bit platforms when processing extremely large JNX files can lead to a denial-of-service condition by crashing the application. The vulnerability resides in the bundled ImageMagick library's JNX decoder, where an integer overflow occurs during file handling. Exploitation requires the attacker to supply a malicious JNX file to a locally running .NET application using Magick.NET; no public exploit or active exploitation is known.
A heap buffer over-write in ImageMagick's fx operation can be triggered via a crafted argument when processing images with the Magick.NET library, leading to a denial of service. Affected versions of the Magick.NET NuGet package (before 14.15.0) are confirmed vulnerable; no active exploitation or public proof-of-concept has been identified. The vulnerability has a medium CVSS score (5.0) with local attack vector and user interaction required.
Heap buffer overwrite in ImageMagick's morphology operation when an invalid user-supplied kernel is provided, leading to a denial-of-service condition. This integer overflow flaw (CWE-190) affects ImageMagick versions prior to 7.1.2-27 and the Magick.NET wrapper below 14.15.0. No active exploitation or public proof-of-concept has been identified, and EPSS data is unavailable.
Improper ordering of resource assignment in the Linux kernel's memory hotplug subsystem causes a spurious WARN_ON during error recovery in __add_memory_block(). When xa_store() fails under memory pressure, device_unregister() is invoked while mem->altmap is already set, triggering memory_block_release() with a non-NULL altmap pointer and producing a kernel warning that can lead to system instability or crash. Affected systems are those running Linux kernel versions from the introduction commit 1a8c64e110435e44e71bcd50a75663174b575f22 through the respective fix commits across the 6.6, 6.12, 6.18, 7.0, and 7.1 stable series; patches are confirmed available. No public exploit has been identified and EPSS stands at 0.16% (6th percentile), consistent with a stability regression rather than an actively targeted security flaw.
Resource leaks and teardown race conditions in the Linux kernel's gpio-rockchip driver expose Rockchip-based systems to kernel panic and memory exhaustion. Three distinct defects exist in the driver's remove path: an unreleased debounce clock reference, a stale chained IRQ handler left registered after driver removal, and an unfreed IRQ domain with its generic chips. The IRQ handler defect is the most severe - if a stray GPIO interrupt arrives after the driver is unbound, the kernel dereferences a stale function pointer and panics. No public exploit identified at time of analysis; EPSS of 0.16% (5th percentile) reflects the niche, hardware-specific exploitation surface.
Incorrect pointer passing in the Linux kernel's igorplugusb infrared USB receiver driver causes the USB core to misinterpret raw pointer bytes as a USB control setup packet, triggering a BOGUS control direction warning and a kernel-level denial of service. The regression was introduced by commit eac69475b01f, which allocated ir->request as a pointer for DMA coherency but left the usb_fill_control_urb() call referencing &ir->request (the pointer variable's address) rather than ir->request (the allocated struct usb_ctrlrequest). No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.17% (6th percentile), reflecting minimal real-world exploitation probability.
Deadlock vulnerability in the Linux kernel's GPIO shared proxy subsystem allows a local, low-privileged user to cause a system hang by triggering removal of a shared GPIO proxy's parent device. The root cause is an overly-wide mutex critical section introduced in commit 710abda58055, where the gpio_shared_entry mutex was held for too long, creating a locking inversion scenario during parent device teardown. No public exploit code exists and no active exploitation has been identified; the fix narrows the critical section to protect only offset reads.
Division-by-zero kernel panic in the Linux kernel's i2c-davinci driver causes a deterministic system crash on TI DaVinci SoC-based hardware when the 'clock-frequency' device tree property is absent. The root cause is a unit mismatch: DAVINCI_I2C_DEFAULT_BUS_FREQ was defined in kHz (100) but the probe path divided it by 1000, producing dev->bus_freq = 0, which then triggers an unconditional divide-by-zero during clock divider calculation. Availability impact is complete (kernel panic), but exploitation requires specific embedded hardware context; no public exploit exists and EPSS is 0.15%, consistent with a reliability defect rather than an adversarially exploitable flaw.
NULL pointer dereference in the Linux kernel's pch_uart serial driver allows a local low-privileged user to crash the kernel by triggering a failed DMA memory allocation in dma_handle_rx(). Systems running Intel PCH (Platform Controller Hub) hardware with the pch_uart driver active and DMA enabled are vulnerable to denial of service via kernel panic. No public exploit or CISA KEV listing exists; with an EPSS of 0.17% (6th percentile), real-world exploitation risk is low, but patches are confirmed across multiple stable kernel branches.
Use-after-free in the Linux kernel USB UVC gadget driver allows a privileged local user to crash the kernel by racing configfs extension-unit teardown against the bind-time list walks in uvc_function_bind(). The bind path walks opts->extension_units without holding opts->lock, while the configfs write path (uvcg_extension_drop) correctly holds the lock, creating an asymmetric locking pattern that enables a freed struct uvcg_extension to be dereferenced. No public exploit exists and EPSS sits at 0.16% (5th percentile), but patches are confirmed across multiple stable kernel branches including 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1.
Out-of-bounds memory access in the Linux kernel's drm/msm DSI display subsystem causes a kernel panic on systems with Qualcomm MSM DSI 6G hardware. The io_offset adjustment applied to the mapped IO base address is not reflected in the ctrl_size value passed to the snapshot dump routine, so msm_disp_snapshot_add_block reads past the end of the mapped region and crashes the kernel. Only devices with Qualcomm MSM DSI 6G display hardware running an unpatched kernel from 5.14 onward are affected; no public exploit exists and EPSS of 0.17% confirms very low exploitation probability.
Kernel panic via NULL pointer dereference in the Linux tps65219 PMIC regulator driver crashes affected systems when a hardware IRQ fires on the device, producing a local denial-of-service condition. The regression was introduced by commit 64a6b577490c, which removed the helper function `tps65219_get_rdev_by_name()` and inadvertently eliminated the only code path that assigned `irq_data.rdev`, leaving the pointer uninitialized for every registered IRQ. Systems running Linux kernel versions from that commit through the stable-branch fix points (6.18.34 and 7.0.11) on hardware equipped with the TI tps65219 PMIC are affected; no public exploit has been identified and the EPSS score of 0.17% reflects low exploitation probability.
Broadcast TLB flush in the Linux kernel x86 memory management subsystem triggers a General Protection Fault (#GP) on AMD INVLPGB-capable systems booted with the 'nopcid' parameter, causing a kernel panic and local denial of service. When PCID is disabled via 'nopcid', CR4.PCIDE is not set, but the INVLPGB broadcast TLB invalidation path remains enabled; once a memory descriptor becomes active across more than three CPUs, the kernel assigns it a global ASID and issues INVLPGB with a non-zero PCID - an illegal state that crashes the kernel. No public exploit exists, EPSS is 0.17% (6th percentile), and this is not in CISA KEV; real-world impact is constrained to the uncommon 'nopcid' boot configuration on AMD hardware.