Suse
Monthly
NULL pointer dereference in the Linux kernel's SPI QUP (Qualcomm Universal Peripheral) driver causes a local denial-of-service condition affecting Qualcomm SoC-based Linux systems. When DMA setup fails during driver probe, the fallback to PIO mode leaves DMA channel pointers in a stale error state rather than clearing them to NULL; a subsequent probe failure or driver unbind then dereferences those error pointers, triggering a kernel panic. Patches are available across all active stable branches (5.10.259, 5.15.210, 6.1.176, 6.6.142, 6.12.92, 6.18.34, 7.0.11, 7.1); no public exploit has been identified and EPSS is at the 6th percentile, indicating negligible exploitation probability at this time.
Error pointer dereference in the Linux kernel ep93xx SPI driver causes kernel panic (denial of service) under specific driver lifecycle conditions on Cirrus Logic EP93xx ARM SoC hardware. When DMA channel setup fails during driver probe and falls back to PIO mode, the driver fails to clear the DMA channel pointers; any subsequent probe error or driver unbind then dereferences those stale error pointers, triggering a kernel oops or panic. No public exploit exists and EPSS of 0.16% (5th percentile) reflects negligible real-world exploitation probability - this is a targeted stability fix for a niche embedded platform.
Error pointer dereference in the Linux kernel's spi-sprd driver causes local denial of service on systems equipped with Spreadtrum (SPRD) SoC hardware. When DMA setup fails during driver probe and the driver falls back to PIO mode, a subsequent late probe error triggers a cleanup path that does not check the dma.enabled flag before attempting to release DMA channels - resulting in an error pointer dereference or double-channel-release and consequent kernel panic. No public exploit exists and EPSS sits at 0.17% (6th percentile), reflecting the highly hardware-specific nature of this flaw. Vendor-released patches are confirmed across multiple Linux stable branches.
Crash kernel panic in Linux kernel's KHO (Kexec Handover) subsystem causes kdump capture to fail due to a missing crash-kernel guard in kho_fill_kimage(). Systems configured with both KHO and a crash kernel (kdump) are affected: when a kernel crash transfers control to the crash kernel, KHO metadata pointing outside the reserved crash region triggers an invalid phys_to_virt() translation in kho_memory_init(), crashing the crash kernel itself and defeating the crash dump mechanism. No public exploit exists and EPSS at 0.16% (6th percentile) reflects appropriately low exploitation probability given the local-only, configuration-dependent nature of the flaw.
NULL pointer dereference in the Linux kernel's ARM Firmware Framework for Armv8-A (arm_ffa) bus driver allows a local actor with kernel module loading rights to crash the host system. The bus match callback unconditionally dereferences the id_table pointer of any registering FF-A client driver; a driver that omits id_table triggers an immediate kernel panic, producing a denial-of-service condition. EPSS at 0.17% (6th percentile) and absence from the CISA KEV catalog indicate no public exploit and negligible observed exploitation activity.
Early boot initialization on ARM Integrator/CP hardware in the Linux kernel triggers a NULL pointer dereference by invoking memory allocation routines before the memory management subsystem is operational, causing a kernel panic that renders affected systems unbootable. The regression was introduced by commit bdb249fce9ad4 and affects all Linux stable branches from that point through patched releases (5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, 7.1). No public exploit exists, CISA KEV does not list this vulnerability, and EPSS sits at 0.17% (7th percentile), reflecting the narrowly scoped, hardware-specific nature of the defect.
Sleep-in-atomic-context denial of service in the Linux kernel btrfs filesystem driver allows a local low-privileged user to crash the system by triggering file sync operations while kernel tracing is active. The btrfs_sync_file trace event erroneously calls dput() - a function that may sleep - within an atomic context where sleeping is forbidden, producing a kernel BUG splat and potential panic. No active exploitation has been identified, EPSS is 0.16% (6th percentile), and the vulnerability requires a non-default kernel tracing configuration to be exploitable, substantially limiting real-world exposure.
Kernel panic in the Linux kernel's kprobes self-test module (test_kprobes) allows a local attacker or privileged user with debugfs write access to crash the kernel by triggering the KUnit kprobes test suite twice in succession. The root cause is that static kprobe and kretprobe variables retain stale address and flag data after unregister_kprobe, causing re-registration to fail with -EINVAL and subsequently triggering a kernel paging fault on the second test run. No public exploit is identified at time of analysis; EPSS at the 6th percentile and absence from CISA KEV confirm this as low-priority in production contexts.
Resource leak in the Texas Instruments ICSSG PRUETH Ethernet driver causes a device-tree node reference count to go unreleased on a specific probe error path, degrading kernel resource availability. Affected kernels from commit 511f6c1ae093c7045742299d29eba71925709a71 onward, prior to stable backports landing in 6.18.34, 7.0.11, and 7.1, are at risk only on hardware platforms carrying TI ICSSG silicon. EPSS sits at 0.17% (6th percentile) and no public exploit or CISA KEV entry exists, positioning this as a maintenance-tier stability fix rather than an active threat.
Incorrect dirty-region bookkeeping in the Linux kernel netfs subsystem (netfs_invalidate_folio) causes a local denial-of-service condition when streaming-write folios are partially invalidated. The bug is present in kernels from commit cce6bfa6ca0e through multiple stable branches and is fixed in 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit or active exploitation has been identified; EPSS sits at 0.17% (6th percentile), reflecting very low real-world exploitation probability despite the kernel's ubiquitous deployment.
Incorrect writeback state management in the Linux kernel's netfs and AFS subsystems allows a local low-privileged user on an AFS-mounted system to cause filesystem availability degradation. When netfs_write_single() or afs_single_writepages() skips a write due to lock contention under asynchronous writeback (WB_SYNC_NONE), the affected inode loses its dirty mark without the write being rescheduled, meaning data may never be flushed to the AFS server. No public exploit has been identified and the EPSS score of 0.17% at the 6th percentile reflects very low exploitation probability; patched versions are confirmed available across multiple stable kernel branches.
Memory leak in the Linux kernel's ath11k WiFi driver (Qualcomm Atheros 802.11ax) allows a local low-privileged user to exhaust kernel memory by triggering error paths in two WMI Wake-on-WLAN (WOW) command functions that fail to free associated socket buffers (skb) on failure. Patched across all active stable kernel branches (5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and mainline 7.1). No active exploitation has been identified, with EPSS at 0.17% (7th percentile), consistent with a routine driver memory management fix rather than a weaponizable vulnerability.
DMA mapping failures in the Linux kernel's dma-mapping subsystem crash device driver probes on ARM64 systems with SPARSEMEM due to an incorrect pfn_valid() precondition check in dma_map_resource(). On Raspberry Pi 4 and similar ARM64/SPARSEMEM platforms, MMIO registers whose physical addresses share a 128MB sparsemem section with RAM are misidentified as RAM, causing WARN_ON_ONCE to fire and dma_map_resource() to return DMA_MAPPING_ERROR, breaking peripheral initialization (e.g., spi_bcm2835 SPI controller). No public exploit identified at time of analysis; this is a functional kernel regression with local availability impact rather than a remotely exploitable security flaw.
The pds_core driver in the Linux kernel leaks debugfs dentry references on every firmware reset recovery due to missing dput() calls after debugfs_lookup(), and can crash the kernel when CONFIG_DEBUG_FS is disabled because ERR_PTR(-ENODEV) is not properly distinguished from NULL. A local user with standard privileges on a system hosting AMD/Pensando DPU hardware can trigger repeated firmware reset cycles to exhaust kernel memory, causing denial of service; on kernels with CONFIG_DEBUG_FS=n, a single reset recovery call can immediately crash the system via an invalid dput() on an error pointer. No public exploit exists and EPSS is 0.18% (7th percentile), but patches are available across multiple stable branches.
Memory leak in the Linux kernel's btmtk (MediaTek Bluetooth USB) driver allows a local low-privileged user to exhaust kernel memory, causing denial of service. The vulnerability affects systems running Linux kernel from commit a1c49c434e15050b5dafe3b6f5cc732d4f02d657 onward, with patches confirmed in stable releases 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and no active exploitation has been confirmed; an EPSS of 0.18% at the 7th percentile places this firmly in low-priority territory for most organizations.
Permanent battery hardware damage on Uniwell-based laptops can be triggered via the platform/x86/uniwill-laptop kernel driver by enabling the battery charging limit through the 'force' module parameter. Affected hardware is limited to older Uniwell OEM models manufactured around 2020 where the charging limit circuitry is incompatible with the feature and causes irreversible battery degradation. No public exploit exists and EPSS stands at 0.16% (6th percentile), reflecting the narrow hardware and configuration prerequisites; however, the impact is severe and permanent - affected batteries cannot be recovered once damaged.
Stack buffer overflow in the Linux kernel adm1266 PMBus hardware monitor driver allows a local low-privileged user to crash the kernel on systems equipped with an Analog Devices ADM1266 power sequencer chip. The vulnerable function allocates a 5-byte stack buffer but passes it to i2c_smbus_read_block_data(), which performs an unchecked memcpy of up to 32 bytes (I2C_SMBUS_BLOCK_MAX) before any length validation - overflowing the stack and causing a denial of service. No public exploit code exists and EPSS at 0.18% (7th percentile) confirms limited exploitation interest; patched versions are available across all active stable kernel branches.
Spurious kernel WARN() triggers in Linux kernel mm/memory.c during process teardown when NVIDIA UVM or HMM-capable GPU drivers are present alongside private file-backed mappings containing migrated anonymous folios. The unmap path incorrectly uses vma_is_anonymous() rather than folio_test_anon() to gate device-private/exclusive page handling, producing false-positive kernel warnings (not panics) during munmap or process exit in affected configurations. No public exploit has been identified at time of analysis; EPSS at 0.17% (7th percentile) reflects the narrow triggering conditions required and the non-weaponizable nature of a spurious WARN().
Stale ARM64 Memory Tagging Extension (MTE) tag exposure in the Linux kernel's huge zero folio allocation path undermines the init_on_free security guarantee on AArch64 systems. When the kernel is booted with init_on_free=1 and a 2MB anonymous mapping triggers the huge zero folio path (mapped as a PMD-special entry), the __GFP_ZEROTAGS flag causes post_alloc_hook() to skip tag memory clearing while content zeroing was already handled at free time - leaving whatever allocation tags were previously set accessible to user space. No public exploit has been identified at time of analysis, and EPSS stands at 0.17% (6th percentile), consistent with the narrow architectural and configuration prerequisites required to trigger the flaw.
Spinlock leak in the Linux kernel's huge page device migration subsystem causes a local denial of service via deadlock. A low-privileged local user who can trigger the `migrate_vma_insert_huge_pmd_page` code path while inducing `check_stable_address_space()` to fail will leave the PMD spinlock permanently held, deadlocking any subsequent thread that attempts to acquire it. No public exploit has been identified and EPSS at 0.17% (7th percentile) reflects negligible real-world exploitation probability; the vulnerability is not in CISA KEV.
Null pointer dereference in the Linux kernel's Bluetooth ISO reassembly path allows any Bluetooth broadcaster within radio range to crash a victim Linux host by transmitting an ISO_END PDU without a preceding ISO_START on a BIS (Broadcast Isochronous Stream) connection. Affected kernels span all stable branches from the ISO introduction commit (ccf74f2390d60a2f9a75ef496d2564abb478f46a) through fixed releases 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code or CISA KEV listing exists at time of analysis; EPSS is 0.18% (8th percentile), reflecting low current exploitation probability despite the unauthenticated wireless trigger available to BIS attackers.
Kernel stack address disclosure in the Linux kernel's Bluetooth L2CAP subsystem leaks 8 bytes of kernel virtual address space to a paired Bluetooth peer whenever a local user triggers an L2CAP Enhanced Credit-Based Reconfigure (ECRED) request. The flaw was introduced by commit 1c08108f3014 when DEFINE_RAW_FLEX() converted the on-stack PDU struct but left l2cap_send_cmd() receiving the local pointer's stack storage address and sizeof(pointer) instead of the struct address and struct size. As a result, the ECRED reconfigure feature has been functionally broken for local initiators since that commit, and every reconfigure attempt passively leaks a KASLR-randomized kernel stack address to the Bluetooth peer, potentially aiding ASLR/KASLR bypass. No public exploit is identified at time of analysis, and the EPSS score of 0.18% (7th percentile) reflects low automated exploitation probability.
NULL pointer dereference in the Linux kernel's ethtool PHY subsystem allows a local low-privileged user to crash the kernel and cause a denial of service. The flaw in `phy_prepare_data()` fails to check return values from `kstrdup()` for the strings `name`, `drvname`, `upstream_sfp_name`, and `downstream_sfp_name`; when allocation fails and returns NULL, `phy_reply_size()` subsequently calls `strlen()` unconditionally on the NULL pointer, triggering a kernel oops and system panic. No public exploit code has been identified and EPSS stands at 0.17% (6th percentile), but the availability impact is total - a kernel panic - making this a standard patching priority for any multi-user or shared Linux environment.
CPU pinning denial-of-service in the Linux kernel L2TP subsystem allows an unprivileged local user to wedge a host CPU indefinitely by exploiting an RCU list management mismatch in l2tp_session_unhash(). By creating a user network namespace (unshare -Urn) to obtain CAP_NET_ADMIN and then racing L2TP_CMD_SESSION_CREATE, L2TP_CMD_SESSION_DELETE, and L2TP_CMD_SESSION_GET against the same tunnel, an attacker causes a session list walker to enter an infinite loop with BH and preemption disabled - stalling RCU grace periods system-wide and rendering the thread unkillable via SIGKILL. No public exploit has been identified at time of analysis; EPSS at 0.17% (6th percentile) indicates low automated exploitation probability and no CISA KEV listing.
Memory leak in the Linux kernel igc driver's Frame Preemption (FPE) implementation affects systems with Intel I225/I226 Ethernet controllers running kernel versions from commit 5422570c0010bb968738f9256eb2bf83e79b4d63 onward. The function igc_fpe_xmit_smd_frame() allocates a socket buffer for SMD frame transmission but fails to release it when igc_fpe_init_tx_descriptor() returns an error, confirmed by kernel SLAB unreferenced-object traces showing 224-byte skb allocations going unfreed. No public exploit has been identified and EPSS stands at 0.17%, indicating negligible broad exploitation interest; the practical exposure is limited to TSN-capable deployments with FPE explicitly enabled.
NULL pointer dereference in the Linux kernel's PCM512x ASoC audio codec driver crashes the kernel when a local low-privileged user writes to the overclocking mixer kcontrol. The driver's pcm512x_overclock_xxx_put() handler incorrectly invokes snd_soc_dapm_kcontrol_to_dapm() on a standard mixer kcontrol - an accessor only valid for DAPM kcontrols - returning NULL and triggering a kernel panic. No public exploit has been identified and EPSS stands at 0.16% (6th percentile), reflecting low exploitation likelihood; impact is confined to denial of service on systems with PCM512x audio hardware.
KVM arm64 vGIC in the Linux kernel leaks kernel memory when vCPU initialization fails, enabling a local attacker with VM-creation privileges to exhaust host memory and cause denial of service. The defect is a missing cleanup call in the kvm_vgic_vcpu_init() error path: private IRQs allocated prior to a redistributor iodev registration failure are never freed before the failed vCPU structure is released. No public exploit has been identified at time of analysis; an EPSS score of 0.17% (6th percentile) reflects low opportunistic exploitation probability, and the flaw is not listed in CISA KEV.
Out-of-bounds heap read in the Linux kernel's fwctl pds driver allows a local low-privileged user to crash the kernel by submitting an undersized RPC buffer, resulting in a denial of service. Affected kernel versions include Linux 6.15 and all stable trees prior to 6.18.34, 7.0.11, and 7.1, with exploitation requiring the pds_fwctl module loaded and a compatible PDS network adapter present. No public exploit exists and EPSS is 0.17% (7th percentile), placing this as a low-priority stability fix unless deployments expose the fwctl device node to untrusted local users.
Deadlock in the Linux kernel's drm/msm (Qualcomm Snapdragon GPU) shrinker causes full kernel hang under memory reclaim pressure. The circular lock dependency arises when the kswapd0 thread holds fs_reclaim and the MSM gem shrinker calls dma_resv_lock(), which internally attempts to re-acquire fs_reclaim - producing a ABBA deadlock that renders the system unresponsive. Kernels in the affected range on Snapdragon-based hardware (Linux 6.17 through pre-patch 7.0.x and 6.18.x) are vulnerable; no public exploit code exists and no active exploitation has been confirmed.
NULL pointer dereference in the Linux kernel's batman-adv Bridge Loop Avoidance (BLA) subsystem crashes the kernel when a hard interface is concurrently decoupled from its mesh interface during ARP processing. Local users with low privileges on systems running batman-adv mesh networking can trigger a kernel panic, causing a full denial of service. No public exploit exists and EPSS stands at 0.21% (11th percentile), marking this as a low-urgency stability fix rather than an active threat.
Availability degradation in the Linux kernel's batman-adv throughput meter (tp_meter) subsystem arises from a reference counting race in the receiver shutdown path, where both `batadv_tp_receiver_shutdown()` and `batadv_tp_stop_all()` can simultaneously skip the `tp_vars` reference release when the shutdown timer expires before `timer_shutdown_sync()` is evaluated. The leaked reference accumulates with repeated triggering, progressively exhausting kernel memory resources and resulting in a local denial-of-service condition on systems running the batman-adv mesh networking module. With no public exploit identified at time of analysis and an EPSS score of 0.18% (8th percentile), this is a correctness-class fix with real impact only on systems explicitly running batman-adv.
Denial-of-service via the batman-adv Translation Table (TT) subsystem in the Linux kernel allows a local low-privileged attacker to trigger empty VLAN responses through the global TT state path, causing availability loss in the mesh networking stack. The flaw traces to an incomplete prior fix: commit 16116dac2339 patched the direct TT response path against inconsistent TT TLVLs, but left the indirect global TT response path unguarded, enabling the same class of inconsistency state. No public exploit has been identified and EPSS stands at 0.18% (8th percentile), reflecting low real-world exploitation probability.
Heap buffer overflow in the Linux kernel's hwmon adm1266 PMBus driver allows a local attacker or a malicious/buggy PMBus device to crash the kernel by inducing a record_count value exceeding 32 in a BLACKBOX_INFO response, overrunning the fixed 2048-byte dev_mem allocation in adm1266_nvmem_read_blackbox(). Systems with the adm1266 driver loaded against ADM1266 hardware are affected across multiple stable kernel branches; patched versions are confirmed across Linux 5.10.258 through 7.0.11. EPSS at 0.18% and absence of KEV listing indicate no active exploitation at time of analysis.
Kernel stack memory leaks to userspace through the adm1266 PMBus GPIO driver in the Linux kernel when the ADM1266 hardware returns a shorter-than-expected I2C block-read response. Both adm1266_gpio_get() and adm1266_gpio_get_multiple() assemble a 16-bit status word from two buffer bytes without first verifying that at least two bytes were returned; uninitialized stack data then propagates through the gpiolib subsystem into sysfs and char-device ioctls accessible to local users. No public exploit exists and EPSS probability is 0.18% (8th percentile), consistent with the hardware-specific, locally-exploitable nature of this flaw; patches have been released across all active stable kernel branches.
Bio memory leak in the Linux kernel NVMe driver causes kernel memory exhaustion under integrity-mapping failure conditions, affecting local low-privileged users on systems with NVMe integrity features enabled. The defect lies in the NVMe block-I/O path: a local `bio` pointer is always NULL, so when integrity mapping fails the associated bio object is never freed - the fix retrieves the bio directly from the request structure. With EPSS at 0.17% (7th percentile) and no CISA KEV listing, no public exploit has been identified at time of analysis, and real-world risk is confined to gradual memory exhaustion rather than immediate system compromise.
Preempt count leak in four hv-gpci sysfs show() callbacks in the Linux kernel powerpc subsystem causes progressive kernel stability degradation on IBM Power systems compiled with CONFIG_PREEMPT=y. Each successful read of the affected sysfs nodes leaves one preempt_disable() unmatched, incrementally raising preempt_count; once the count becomes non-zero on return to userspace, the next page fault is misidentified as occurring in an atomic context, generating SIGSEGV and triggering 'BUG: scheduling while atomic' during the resulting coredump. Patches are available across the 6.6, 7.0, and 7.1 stable kernel trees, with no public exploit identified at time of analysis.
Kernel panic (BUG) in the Linux netfs subsystem's netfs_write_begin() function causes local denial of service when a folio is unlocked without holding the lock, triggering the VM_BUG_ON_FOLIO(!folio_test_locked(folio)) assertion at mm/filemap.c:1504. The defect surfaces under concurrent write workloads on Ceph-backed filesystems using the netfs layer - the generic/013 xfstests case reproduces it with approximately 30% probability per run. A local, low-privileged user who can write to a Ceph mount can crash the kernel; no confidentiality or integrity impact is observed. No public exploit code exists and EPSS stands at 0.17% (6th percentile), consistent with a race-condition DoS confined to specific filesystem configurations.
Kernel crash via NULL pointer dereference in the Linux netfs layer is triggered by a local low-privileged user combining a streaming write, file truncation, and mmap read on the same netfs-backed file. Affected kernel versions span from 6.8 (commit 9ebff83e) through stable branches prior to 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and EPSS is 0.17%, indicating very low observed exploitation probability; however, a precise reproduction recipe is embedded in the upstream fix commit, substantially lowering the knowledge barrier for any attacker already holding local access.
Write-through mode deadlock in the Linux kernel netfs subsystem allows a local low-privileged user to hang the kernel, causing a denial of service. The defect in netfs_advance_writethrough() fails to unconditionally unlock a supplied folio, and prematurely marks it for writeback before the folio is fully written, creating a lock-ordering conflict against concurrent mmapped reads and writes. Patches are available across multiple stable kernel branches; no public exploit code or active exploitation has been identified.
Reference leak in the Linux kernel netfs subsystem exposes systems with network filesystem mounts to a local denial-of-service condition. The `netfs_write_begin()` function fails to drop its held reference on the netfs request object when `netfs_wait_for_read()` returns an error, violating reference-counting invariants in the kernel's network filesystem abstraction layer. A low-privileged local user who can trigger repeated write errors on a netfs-backed mount (NFS, Ceph, AFS, or similar) can slowly exhaust kernel memory resources. No public exploit code exists and EPSS is 0.17% (6th percentile), consistent with a low-priority kernel maintenance fix.
Reference leaks and memory corruption in the Linux kernel netfs subsystem allow a local unprivileged user to crash the system via crafted write operations on network-backed filesystems. The flaw in netfs_perform_write() incorrectly transitions folio->private between NULL, the NETFS_FOLIO_COPY_TO_CACHE sentinel, netfs_group pointers, and netfs_folio structs, enabling multiple private-data attachments, folio reference leaks, and netfs_group struct leaks that can exhaust kernel resources or trigger a kernel panic. No public exploit exists and EPSS sits at 0.17% (6th percentile), indicating no observed exploitation activity.
Null pointer dereference in the Linux kernel's block bio-integrity subsystem (`bio_integrity_map_user()`) allows a local low-privileged attacker to crash the kernel, causing a denial of service. The flaw stems from `pin_user_pages_fast()` being permitted to return a partial page-pin result that is never validated before `bvec_from_pages()` dereferences the uninitialized zero-address entry. Patches are available across multiple stable kernel branches and Ubuntu has issued USN-8593-1; no active exploitation has been identified (EPSS 0.17%, no CISA KEV listing).
NULL pointer dereference in the Linux kernel's drm/msm/adreno driver allows local low-privilege users to crash systems equipped with older Qualcomm Adreno GPU generations (a2xx through a4xx). Querying UBWC (Universal Bandwidth Compression) parameters from userspace on these GPU families - which have no UBWC support and therefore no initialized UBWC config structure - triggers a NULL dereference in adreno_get_param(), resulting in a kernel panic. No public exploit has been identified at time of analysis; EPSS is 0.17% (6th percentile), consistent with the hardware-specific, local-only scope.
Deleting an ovpn (OpenVPN data-channel-offload) netdevice while a concurrent netlink CMD_PEER_NEW request adds a fresh peer can leave the interface permanently hung and impossible to unregister in Linux kernel 6.16 and later. The flaw is a local, root-privilege-adjacent denial of service: an attacker who already holds CAP_NET_ADMIN (obtainable inside a user namespace) must repeatedly win a very narrow race between ovpn_dellink() teardown and the peer-add path, which re-takes a netdev reference after all peers were assumed freed. Impact is limited to availability of the affected ovpn device - there is no confidentiality or integrity effect and no remote vector - and EPSS is only 0.20% (10th percentile), with no public exploit identified at time of analysis and no CISA KEV listing. Vendor patches are available in stable releases 6.18.34, 7.0.11 and 7.1, and Ubuntu has issued USN-8593-1; the issue is rated LOW priority despite the valid CVSS 4.7 MEDIUM score.
Kernel panics from NULL pointer dereferences in the Linux kernel's MANA (Microsoft Azure Network Adapter) driver can be triggered during device teardown or MTU reconfiguration after a partial queue-allocation failure, when apc->tx_qp and apc->rxqs have already been freed and NULLed but later code paths - mana_chn_setxdp(), mana_destroy_vport(), mana_fence_rqs() and mana_dealloc_queues() - dereference them without guarding for NULL. Only systems actually running the MANA driver are exposed (in practice Azure guests with a MANA NIC); the CVSS vector is AV:L/PR:L/UI:N with availability-only impact, meaning a local user able to invoke teardown-class operations (MTU/interface changes, typically requiring CAP_NET_ADMIN) is the prerequisite, and our independent assessment raises attack complexity to AC:H because the attacker must additionally benefit from a queue-allocation failure that cannot be reliably forced on demand. EPSS is 0.21% (11th percentile), the issue is not listed in CISA KEV, and no public exploit was identified at time of analysis; vendor patches exist for the affected stable branches.
Resource leak in the Linux kernel's ov8856 OmniVision I2C camera driver exposes systems with that hardware to local denial-of-service via kernel memory exhaustion. The driver's ov8856_init_controls() function fails to call v4l2_ctrl_handler_free() on error exit paths, leaving the control handler's allocated memory unreleased each time control registration fails. No public exploit exists and EPSS probability sits at 0.16% (6th percentile), reflecting that this hardware-specific driver code is rarely reachable in practice.
Memory leaks in the Linux kernel's DRM colorop subsystem allow a local low-privileged attacker to gradually exhaust kernel memory by triggering repeated DRM atomic state lifecycle operations, ultimately causing denial of service via out-of-memory conditions. Affected systems are those running Linux kernel versions between the introduction of the colorop subsystem (commit cfc27680ee208cdf7a61cda817b4158c4142595f) and the upstream fix commits, with patched versions available at 7.0.9 and 7.1. No active exploitation is confirmed (not in CISA KEV) and EPSS is extremely low at 0.14% (4th percentile), making this a low-urgency but legitimate kernel hygiene issue requiring patching during normal maintenance cycles.
Persistent GPU denial-of-service in the Linux kernel's drm/msm Qualcomm GPU driver allows a local low-privileged user to render the GPU permanently hung by submitting a single ring workload that triggers an unrecovered fault. The recover_worker function advances the hung ring's fence and early-exits when it detects no further queued work, bypassing the actual GPU reset sequence - leaving the hardware stuck until a reboot. No public exploit has been identified and EPSS is 0.15% (5th percentile), consistent with the narrow hardware and local-access prerequisites.
Missing upper bound validation on `num_of_nodes` in the AMD KFD ioctl handler `kfd_ioctl_get_process_apertures_new` allows a local low-privileged user with access to AMD GPU compute devices to crash the kernel, causing a denial of service. Affected are Linux kernel branches prior to 6.6.140, 6.12.90, 6.18.32, 7.0.9, and 7.1, restricted to systems with AMD GPU hardware and the amdkfd module loaded. EPSS is 0.16% (5th percentile), no public exploit or CISA KEV listing exists, and patched stable releases are available across all active stable branches.
Silent dirty page loss in the Linux kernel's Intel VT-d IOMMU subsystem (iommu/vt-d) allows a low-privileged local actor to trigger an availability impact by attaching a PASID to a nested IOMMU domain whose nesting parent domain already has dirty tracking configured. The kernel fails to block this invalid combination, causing dirty page tracking to silently fail - a condition critical to live VM migration correctness in virtualization environments. No public exploit has been identified; EPSS at 0.17% (6th percentile) reflects extremely low exploitation interest, and the vulnerability is absent from CISA KEV.
Out-of-bounds read in the Linux kernel RDMA/ionic driver's hca_type_show() sysfs handler allows a local user to trigger a kernel crash or leak adjacent kernel memory. The ionic driver's use of an unbounded "%s" format specifier on the 64-byte node_desc field - which is not guaranteed to be NUL-terminated - causes the kernel to read past the end of that field into adjacent members of struct ib_device when exactly 64 bytes have been written. Since ionic supports IB_DEVICE_MODIFY_NODE_DESC, this condition is reachable from unprivileged userspace. No public exploit or CISA KEV listing exists; EPSS is 0.17% (6th percentile), indicating low exploitation probability in the wild.
Multiple ACR mask validation and configuration flaws in the Linux kernel's perf/x86/intel subsystem allow a local low-privileged user to trigger incorrect Intel PMU hardware counter configuration, resulting in high availability impact. Three distinct weaknesses exist: incomplete user-space ACR mask validation permitting cross-group index bits, an early-return logic error that silently skips all subsequent ACR group configuration, and failure to clear stale hardware ACR masks (hw.config1) before writing new values. No public exploit code is identified and EPSS sits at 0.17% (6th percentile), indicating negligible active exploitation probability; this is a maintenance-patch priority rather than an emergency.
SELinux avdcache auditing in the Linux kernel incorrectly reuses a previously computed audited vector from avc_audit_required() rather than recomputing it against the current access request and its allow/deny outcome, causing certain permission checks to go silently unlogged. Affected are local, low-privileged users on kernels containing the per-task avdcache introduced at commit dde3a5d0f4dce1d1a6095e6b8eeb59b75d28fb3b, through versions prior to 6.18.30, 7.0.7, and 7.1. An attacker exploiting this gap can perform SELinux-policy-violating operations - such as directory writes following a cached directory search - that generate no audit record, directly undermining intrusion detection and compliance monitoring that depends on SELinux audit logs. No public exploit exists and EPSS is at the 6th percentile; however, organizations with strict SELinux audit compliance requirements face elevated effective risk.
Insufficient session expiration in django-oauth-toolkit 3.3.0 allows authenticated network attackers to exploit the `_load_id_token` function in `oauth2_provider/oauth2_validators.py`, bypassing token expiration enforcement and maintaining access beyond their authorized session lifetime. The CVSS 4.0 score of 5.3 with PR:L confirms exploitation requires low-privilege access (a valid or expired token), and impacts confidentiality, integrity, and availability at a low level. No public exploit or active exploitation has been confirmed; the issue was submitted via a GitHub issue report and the project has not yet issued a response or patch.
Token forgery is possible against any Perl application using Mojo::JWT versions before 1.02 due to a timing side-channel in HMAC signature verification. The decode() method compared the supplied signature against the recomputed HMAC using Perl's native eq operator, which short-circuits on the first differing byte, leaking the expected signature byte-by-byte through measurable response time variation. An attacker with the ability to submit many attacker-controlled tokens to an endpoint that calls decode() can statistically aggregate these timing differences to reconstruct the valid HMAC signature and subsequently forge arbitrary JWT tokens. No public exploit has been identified at time of analysis, and EPSS sits at the 7th percentile, indicating low automated exploitation probability.
YAML::Syck before version 1.47 crashes the Perl interpreter when parsing a YAML document that redefines an anchor name, due to a use-after-free and double-free in the bundled libsyck C library. Any caller invoking Load() or LoadFile() on attacker-controlled YAML - a common pattern in Perl web frameworks and data-pipeline tooling - is exposed to a denial-of-service condition that aborts the interpreter process. No public exploit beyond the CPANSec-confirmed 7-byte trigger document exists and no CISA KEV listing is present, but the trivially short trigger makes reliable reproduction straightforward.
Cross-user information disclosure in Cyrus IMAP through 3.12.2 allows any authenticated IMAP user to enumerate folder names and retrieve message UIDs belonging to arbitrary other accounts via the ESEARCH command, creating a content oracle. The flaw (CWE-204, Observable Response Discrepancy) leaks mailbox structure - including folder names that may reveal sensitive organizational or personal context - without permitting reads of actual message content. No public exploit code has been identified at time of analysis, no CISA KEV listing exists, and the CVSS score of 4.3 reflects the authentication prerequisite and limited confidentiality impact, though risk is elevated in shared multi-tenant deployments such as ISPs and universities.
Unauthorized mailbox deletion in Cyrus IMAP through 3.12.2 allows any authenticated non-admin user to invoke the admin-only LOCALDELETE command, bypassing ACL enforcement entirely. Any user with a valid account on an affected server can permanently delete arbitrary mailboxes - including those they have no read, write, or administrative permissions over - simply by issuing the improperly guarded command. No public exploit has been identified at time of analysis, but the attack requires only authentication and knowledge of the command, making it low-complexity for any insider or account-compromised attacker.
URLAUTH token forgery in Cyrus IMAP through 3.12.2 allows a network-based unauthenticated attacker to read the contents of a victim's mailbox folder by computing a forged authentication token using a predictable HMAC-SHA1 key. The predictability arises specifically when a victim has never issued a URLAUTH-authenticated URL for a given folder, leaving the per-folder mboxkey absent and thus falling back to a computable value. No public exploit code has been identified and no active exploitation has been confirmed; real-world impact is further constrained by URLAUTH being an obscure IMAP extension with negligible public client adoption.
Incorrect authorization in Cyrus IMAP through 3.12.2 allows authenticated users to bypass mailbox ACL enforcement via the vacation Sieve script `:fcc` (file carbon copy) feature, enabling unauthorized message injection into any mailbox nameable by the script regardless of insert permissions. The CVSS vector (PR:L, AV:N) confirms network-triggerable exploitation requiring only a valid authenticated account, with low integrity and availability impact (C:N/I:L/A:L). No public exploit code and no CISA KEV listing exist at time of analysis; vendor-released patch version 3.12.3 addresses the flaw.
Cyrus IMAP through 3.12.2 exposes mailbox ACL data to any authenticated user via the IMAP LISTRIGHTS command, which lacks the required admin-access authorization check. Any valid IMAP account holder can call LISTRIGHTS against arbitrary mailboxes they can name, learning which principals hold which access rights - data that should be restricted to mailbox administrators. No public exploit or active exploitation has been identified; vendor release notes reference 3.12.3 as the corrective release.
Resource limit bypass in the websocket-driver npm library (versions < 0.7.5) allows WebSocket messages to exceed the application's configured maximum message size when the permessage-deflate compression extension is active. The size enforcement is applied to compressed frame length headers rather than the decompressed payload, meaning a highly compressed message can appear within limits on the wire but expand arbitrarily upon decompression. Vendor-released patch is available in version 0.7.5; no public exploit has been identified at time of analysis.
Resource exhaustion in the websocket-driver Ruby gem (faye/websocket-driver-ruby) allows any WebSocket peer to bypass a configured maximum message size when the permessage-deflate compression extension is in use. The size limit is enforced against the compressed frame length rather than the post-decompression size, enabling a decompression-bomb style attack where a small compressed payload expands far beyond the intended ceiling. Applications on versions below 0.8.1 silently accept oversized payloads, potentially exhausting server memory or CPU and causing a denial-of-service condition. No public exploit exists at time of analysis, but the attack class is well understood and low-complexity to implement.
Network policy bypass in Cilium 1.19.0-1.19.4 allows workloads inside a Kubernetes namespace to reach peers that CIDR-based ipBlock NetworkPolicies should block. The flaw surfaces exclusively when Cilium is deployed with a custom clusterName (any value other than the default 'any'): the network-policy parser in parseNetworkPolicyPeer erroneously instantiates an empty pod selector for selectorless ipBlock peers, which compiles into a wildcard namespace-allow rule instead of a pure CIDR rule. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Zip-slip path traversal in File Browser 2.63.6–2.63.16 allows a low-privileged user with upload permission to plant a POSIX backslash-named file that the archive builder incorrectly normalizes into a directory traversal sequence, enabling arbitrary file write on any victim who downloads and extracts the generated archive. The root cause is the server-side conversion of `\` to `/` in archive entry names, which manufactures paths like `../../evil.sh` from the legal POSIX filename `..\..\evil.sh`. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the attack chain is straightforward for any user with upload access.
Path traversal in Apache Ivy's PackagerResolver (versions 2.0.0 through 2.5.3) allows an attacker with write access to a packager repository to overwrite arbitrary files outside the configured buildRoot directory by embedding '../' sequences in module coordinates such as organisation, name, or revision. The overwrite occurs during the Ant-script-driven repackaging phase that PackagerResolver triggers on artifact download. No public exploit code has been identified at time of analysis, and the vendor has released version 2.6.0 as the fix, confirmed via the Apache Ant project site on July 14, 2026.
Server-Side Request Forgery in Cloudreve's remote download workflow (versions prior to 4.16.1) enables authenticated users holding the remote download permission to direct the application server to fetch arbitrary internal URLs via POST /api/v4/workflow/download. Because the downloader accepted user-supplied URLs without validating loopback, localhost, IPv6 localhost, or redirect-to-loopback targets, a low-privileged user could exfiltrate responses from internal services - including cloud instance metadata endpoints, internal APIs, or services bound to 127.0.0.1 - by reading the downloaded content from their own Cloudreve file storage. No public exploit has been identified at time of analysis; vendor-released patch 4.16.1 is available.
Flameshot's 'Open With' feature prior to version 14.0.0 contains a TOCTOU (time-of-check to time-of-use) symlink-following race condition that allows a local unprivileged attacker on the same machine to overwrite arbitrary files writable by the victim user. By pre-planting a symlink at the predictable temporary file path before Flameshot writes the screenshot PNG, an attacker can redirect the write operation to any file within the victim's permissions - including configuration files, SSH keys, or application data. No public exploit identified at time of analysis, though the attack is straightforward given the deterministic path; the vendor-confirmed fix is available in v14.0.0.
Unvalidated chown in Samba's pam_winbind module allows a local user with narrow sudo delegation to transfer ownership of the root filesystem directory to a system account, causing system-wide denial of service on Red Hat Enterprise Linux 6 through 10. When mkhomedir is enabled and a system account has its home directory set to '/', any PAM-triggered authentication event run as that account via sudo invokes the chown without path sanitization. The resulting ownership change breaks SSH, sudo, and package-manager functionality, though the 0555 permissions on RHEL prevent write access escalation, confining the impact to high-severity availability loss. No public exploit or CISA KEV listing is identified at time of analysis.
Memory leak in ImageMagick's ICON decoder exposes services that process user-supplied images to a potential denial of service. Both the 7.x and 6.x release branches are affected - specifically versions before 7.1.2-26 and 6.9.13-51 respectively. An unauthenticated remote attacker (per CVSS PR:N) who can supply a crafted ICON file to an ImageMagick-processing endpoint can repeatedly trigger allocation failures that are never cleaned up, gradually exhausting process memory. No public exploit or active exploitation has been identified at time of analysis.
Memory leak in ImageMagick's YUV decoder (versions before 7.1.2-26 and 6.9.x before 6.9.13-51) enables remote denial of service by repeatedly submitting malformed YUV images that trigger a failed blob open, leaking heap memory on each decode attempt. No confidentiality or integrity impact applies; exposure is limited to availability of image-processing services that accept untrusted input. No public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in ImageMagick's FreeType integration path allows remote denial of service against image processing pipelines using vulnerable 6.x or 7.x releases. When FreeType initialization fails during an image processing operation, the affected code path neglects to exit cleanly and continues referencing already-freed memory, causing process corruption or crash. No public exploit identified at time of analysis; the CVSS 4.0 score of 6.3 with AC:H and AT:P reflects meaningful preconditions required to trigger the failure path.
Memory exhaustion denial of service in ImageMagick through 7.1.2-18 arises from the ASHLAR coder failing to release a temporary image object when an internal action fails, allowing an attacker who can supply malicious ASHLAR files to a processing pipeline to cumulatively exhaust process memory. The CVSS 4.0 vector (AV:L/UI:P) confirms this is a local-vector attack requiring passive user or pipeline interaction to process the crafted file, not a remote unauthenticated scenario. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; confirmed fixed versions exist for Magick.NET NuGet packages at 14.11.1.
Denial of service in BusyBox 1.38.0 lets attackers crash the bundled ash shell by supplying crafted input that triggers a heap-based buffer overflow (CWE-122) in the ifsbreakup() field-splitting routine of shell/ash.c. Only availability is impacted - there is no public exploit identified at time of analysis, and the EPSS score is low (0.16%, 6th percentile), indicating little observed exploitation interest so far. The NVD-assigned CVSS of 7.5 rests on a network attack vector that is not clearly supported by the description, which points to input being fed to a local shell.
Missing SSH host key verification in Dulwich's paramiko vendor module exposes SSH connections to man-in-the-middle interception. The contrib/paramiko_vendor.py module used paramiko's MissingHostKeyPolicy, which silently accepts any server host key without checking it against known_hosts, allowing a network-positioned attacker to impersonate a legitimate SSH Git server. No public exploit has been identified at time of analysis and EPSS sits at 0.14% (4th percentile), but the attack is conceptually straightforward for any attacker with network access between client and server.
Denial of service in BusyBox 1.38.0 arises from a use-after-free in the awk_sub() routine of the AWK applet (editors/awk.c), allowing an attacker who can supply a crafted AWK script to crash the busybox awk process. The flaw is a memory-corruption bug (CWE-416) with availability-only impact and no confidentiality or integrity consequences. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and its EPSS score is low (0.14%, 4th percentile).
Path traversal (Zip Slip) in Rclone's archive extract command allows crafted archives containing `../` or `..\ ` path components in entry names to write extracted files outside the user-selected destination prefix. All Rclone versions prior to 1.74.4 are affected; an attacker who can induce a user to run `rclone archive extract` against a malicious archive can create or overwrite sibling objects in the same bucket or parent path scope. No public exploit code has been identified and the vulnerability is not in CISA KEV; EPSS at 0.14% (4th percentile) reflects low real-world exploitation probability.
Navigation input validation bypass in Google Chrome prior to 150.0.7871.125 enables a remote attacker who has already compromised the renderer process to circumvent navigation restrictions through a crafted HTML page. The flaw is classified as a second-stage, chained exploit - the attacker must first achieve renderer process compromise before this vulnerability becomes exploitable. With integrity rated High (I:H) and no confidentiality or availability impact, the practical danger is unauthorized navigation control, potentially enabling redirect-based phishing, cross-origin frame manipulation, or security boundary bypass. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability stands at 0.26% (17th percentile), consistent with low current threat activity.
Same Origin Policy bypass in Google Chrome's V8 JavaScript engine (prior to 150.0.7871.125) allows a remote attacker to cross origin security boundaries via a crafted HTML page, enabling high-impact integrity violations against cross-origin content. Exploitation requires the victim to visit the malicious page (UI:R), limiting automated mass exploitation - a constraint confirmed by SSVC's Automatable:no finding. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog; EPSS at 0.26% (17th percentile) is consistent with no observed active exploitation at time of analysis.
Process memory disclosure in Google Chrome's Media component on Windows (prior to 150.0.7871.125) enables an attacker who has already compromised the renderer process to read sensitive data from Chrome's memory via a crafted HTML page. This is a chained vulnerability - it is a second-stage exploit requiring a pre-compromised renderer, making it a useful component in multi-stage browser attack chains rather than a standalone threat. No public exploit identified at time of analysis, EPSS is 0.30% (22nd percentile), and SSVC exploitation status is 'none,' confirming no current active exploitation.
Uninitialized variable use in Google Chrome's V8 JavaScript engine (all versions prior to 150.0.7871.125) exposes potentially sensitive process memory contents to remote attackers who can induce a user to visit a crafted HTML page. The confidentiality impact is rated high under CVSS, as uninitialized heap or stack memory in V8 may contain residual data such as session tokens or cached credentials from the browser process. No public exploit code exists and no active exploitation has been identified - EPSS sits at 0.33% (25th percentile) and SSVC rates exploitation as none - but a vendor patch is confirmed available in Chrome 150.0.7871.125.
Same-origin policy bypass in Google Chrome prior to 150.0.7871.125 enables remote attackers to manipulate cross-origin content integrity through the browser's HTML-in-Canvas rendering subsystem. Exploitation requires a victim to visit a crafted HTML page, making this a socially-engineered attack rather than a fully autonomous one. No active exploitation has been recorded (CISA KEV: absent, SSVC exploitation: none), and EPSS sits at 0.26% - indicating low real-world exploitation activity at time of analysis.
Uninitialized memory use in Chrome's Skia graphics library exposes potentially sensitive process memory to remote attackers in all Chrome versions prior to 150.0.7871.125. An unauthenticated remote attacker can trigger the leak by inducing a user to visit a crafted HTML page, causing the Skia renderer to read and disclose uninitialized memory contents. No public exploit has been identified at time of analysis, and SSVC classifies exploitation status as none, though the CVSS Confidentiality impact is rated High given the potential for in-memory secrets exposure.
jackson-databind's @JsonView authorization guard is bypassable on deserialization when a property carries both @JsonView and @JsonUnwrapped annotations, allowing an authenticated or unauthenticated attacker to mass-assign privileged fields through a less-privileged active view. Affected are com.fasterxml.jackson.core:jackson-databind 2.18.0-2.18.8, 2.21.0-2.21.4, 2.22.0, and tools.jackson.core:jackson-databind 3.0.0-3.1.4, 3.2.0. A publicly available proof-of-concept demonstrates the bypass; SSVC reports no confirmed active exploitation at time of analysis, and EPSS sits at 0.42% (34th percentile), indicating low current threat velocity despite the high-integrity impact.
Out-of-bounds read in libsoup's multipart processing exposes applications on Red Hat Enterprise Linux 6 through 10 to remote denial-of-service or partial memory disclosure. The flaw resides in soup_multipart_input_stream_read_headers() where oversized or malformed multipart boundary strings are not adequately size-validated, allowing an attacker to cause the stream reader to exceed its allocated buffer. A proof-of-concept exists per SSVC data, the attack is rated automatable, and no active exploitation is confirmed in CISA KEV - placing this in a monitored-but-actionable risk tier rather than an emergency response category.
Memory leak in libsoup's HTTP/2 implementation allows a remote, unauthenticated attacker to incrementally exhaust heap memory and crash the affected application through a sustained out-of-memory condition. Affected deployments include any application linking libsoup on Red Hat Enterprise Linux 6 through 10 that handles HTTP/2 connections from untrusted peers. No public exploit code has been identified and CISA has not listed this in KEV; however, the network-accessible attack surface with no authentication requirement makes it relevant for internet-facing services using libsoup. Notably, the provided CVSS vector (C:H/I:N/A:N) is internally inconsistent with the DoS-only description - the correct impact metrics should reflect Availability, not Confidentiality, and this discrepancy is flagged in the risk assessment.
Local tampering via symbolic-link following in Microsoft .NET (versions 8.0, 9.0, and 10.0) and the bundled toolchain in Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7) allows an authorized local attacker to redirect a privileged file operation to an unintended target, corrupting or replacing files outside their normal permissions. Microsoft (the reporter) has released a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. The high CVSS 3.1 base score of 7.0 is tempered by high attack complexity and the requirement for existing low-level local access.
Heap buffer over-read in libsoup's HTTP/2 GOAWAY frame parser allows remote unauthenticated attackers to crash applications or leak heap memory fragments by sending a malformed frame with a non-NUL-terminated Additional Debug Data payload. Affected deployments include applications built on libsoup running on Red Hat Enterprise Linux 10 that accept or initiate HTTP/2 connections. A proof-of-concept exists per SSVC data, though exploitation is rated non-automatable and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Deserialization logic in FasterXML jackson-databind 2.15.0 through 2.18.7, 2.21.3, and 3.1.3 allows unauthenticated remote callers to bypass @JsonIgnore annotations on Java Record types when a PropertyNamingStrategy is configured. The renamed JSON key - e.g., 'internal_role' produced by SnakeCaseStrategy from 'internalRole' - is not registered in the ignore list, so Jackson's constructor-parameter binding accepts the attacker-supplied value despite the developer's explicit exclusion directive. No public exploit tooling has been identified at time of analysis, but the upstream fix PR includes a runnable proof-of-concept test that fully demonstrates the bypass, lowering the bar for independent reproduction.
Missing TLS certificate validation in the XAPI C# and PowerShell SDK bindings - specifically on secondary HTTP handler connections used for disk image transfers, host backups, RRD data, and patch delivery - allows a network-positioned attacker to intercept communications between third-party management tools and Xen hypervisor hosts. Successful Man-in-the-Middle exploitation can yield stolen administrative session tokens, enabling full hypervisor session hijack, or permit tampering with critical data such as imported disk images and host update packages in transit. No public exploit code has been identified at time of analysis, and the Xen Project advisory XSA-498 confirms no known mitigations exist short of patching.
NULL pointer dereference in the Linux kernel's SPI QUP (Qualcomm Universal Peripheral) driver causes a local denial-of-service condition affecting Qualcomm SoC-based Linux systems. When DMA setup fails during driver probe, the fallback to PIO mode leaves DMA channel pointers in a stale error state rather than clearing them to NULL; a subsequent probe failure or driver unbind then dereferences those error pointers, triggering a kernel panic. Patches are available across all active stable branches (5.10.259, 5.15.210, 6.1.176, 6.6.142, 6.12.92, 6.18.34, 7.0.11, 7.1); no public exploit has been identified and EPSS is at the 6th percentile, indicating negligible exploitation probability at this time.
Error pointer dereference in the Linux kernel ep93xx SPI driver causes kernel panic (denial of service) under specific driver lifecycle conditions on Cirrus Logic EP93xx ARM SoC hardware. When DMA channel setup fails during driver probe and falls back to PIO mode, the driver fails to clear the DMA channel pointers; any subsequent probe error or driver unbind then dereferences those stale error pointers, triggering a kernel oops or panic. No public exploit exists and EPSS of 0.16% (5th percentile) reflects negligible real-world exploitation probability - this is a targeted stability fix for a niche embedded platform.
Error pointer dereference in the Linux kernel's spi-sprd driver causes local denial of service on systems equipped with Spreadtrum (SPRD) SoC hardware. When DMA setup fails during driver probe and the driver falls back to PIO mode, a subsequent late probe error triggers a cleanup path that does not check the dma.enabled flag before attempting to release DMA channels - resulting in an error pointer dereference or double-channel-release and consequent kernel panic. No public exploit exists and EPSS sits at 0.17% (6th percentile), reflecting the highly hardware-specific nature of this flaw. Vendor-released patches are confirmed across multiple Linux stable branches.
Crash kernel panic in Linux kernel's KHO (Kexec Handover) subsystem causes kdump capture to fail due to a missing crash-kernel guard in kho_fill_kimage(). Systems configured with both KHO and a crash kernel (kdump) are affected: when a kernel crash transfers control to the crash kernel, KHO metadata pointing outside the reserved crash region triggers an invalid phys_to_virt() translation in kho_memory_init(), crashing the crash kernel itself and defeating the crash dump mechanism. No public exploit exists and EPSS at 0.16% (6th percentile) reflects appropriately low exploitation probability given the local-only, configuration-dependent nature of the flaw.
NULL pointer dereference in the Linux kernel's ARM Firmware Framework for Armv8-A (arm_ffa) bus driver allows a local actor with kernel module loading rights to crash the host system. The bus match callback unconditionally dereferences the id_table pointer of any registering FF-A client driver; a driver that omits id_table triggers an immediate kernel panic, producing a denial-of-service condition. EPSS at 0.17% (6th percentile) and absence from the CISA KEV catalog indicate no public exploit and negligible observed exploitation activity.
Early boot initialization on ARM Integrator/CP hardware in the Linux kernel triggers a NULL pointer dereference by invoking memory allocation routines before the memory management subsystem is operational, causing a kernel panic that renders affected systems unbootable. The regression was introduced by commit bdb249fce9ad4 and affects all Linux stable branches from that point through patched releases (5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, 7.1). No public exploit exists, CISA KEV does not list this vulnerability, and EPSS sits at 0.17% (7th percentile), reflecting the narrowly scoped, hardware-specific nature of the defect.
Sleep-in-atomic-context denial of service in the Linux kernel btrfs filesystem driver allows a local low-privileged user to crash the system by triggering file sync operations while kernel tracing is active. The btrfs_sync_file trace event erroneously calls dput() - a function that may sleep - within an atomic context where sleeping is forbidden, producing a kernel BUG splat and potential panic. No active exploitation has been identified, EPSS is 0.16% (6th percentile), and the vulnerability requires a non-default kernel tracing configuration to be exploitable, substantially limiting real-world exposure.
Kernel panic in the Linux kernel's kprobes self-test module (test_kprobes) allows a local attacker or privileged user with debugfs write access to crash the kernel by triggering the KUnit kprobes test suite twice in succession. The root cause is that static kprobe and kretprobe variables retain stale address and flag data after unregister_kprobe, causing re-registration to fail with -EINVAL and subsequently triggering a kernel paging fault on the second test run. No public exploit is identified at time of analysis; EPSS at the 6th percentile and absence from CISA KEV confirm this as low-priority in production contexts.
Resource leak in the Texas Instruments ICSSG PRUETH Ethernet driver causes a device-tree node reference count to go unreleased on a specific probe error path, degrading kernel resource availability. Affected kernels from commit 511f6c1ae093c7045742299d29eba71925709a71 onward, prior to stable backports landing in 6.18.34, 7.0.11, and 7.1, are at risk only on hardware platforms carrying TI ICSSG silicon. EPSS sits at 0.17% (6th percentile) and no public exploit or CISA KEV entry exists, positioning this as a maintenance-tier stability fix rather than an active threat.
Incorrect dirty-region bookkeeping in the Linux kernel netfs subsystem (netfs_invalidate_folio) causes a local denial-of-service condition when streaming-write folios are partially invalidated. The bug is present in kernels from commit cce6bfa6ca0e through multiple stable branches and is fixed in 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit or active exploitation has been identified; EPSS sits at 0.17% (6th percentile), reflecting very low real-world exploitation probability despite the kernel's ubiquitous deployment.
Incorrect writeback state management in the Linux kernel's netfs and AFS subsystems allows a local low-privileged user on an AFS-mounted system to cause filesystem availability degradation. When netfs_write_single() or afs_single_writepages() skips a write due to lock contention under asynchronous writeback (WB_SYNC_NONE), the affected inode loses its dirty mark without the write being rescheduled, meaning data may never be flushed to the AFS server. No public exploit has been identified and the EPSS score of 0.17% at the 6th percentile reflects very low exploitation probability; patched versions are confirmed available across multiple stable kernel branches.
Memory leak in the Linux kernel's ath11k WiFi driver (Qualcomm Atheros 802.11ax) allows a local low-privileged user to exhaust kernel memory by triggering error paths in two WMI Wake-on-WLAN (WOW) command functions that fail to free associated socket buffers (skb) on failure. Patched across all active stable kernel branches (5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and mainline 7.1). No active exploitation has been identified, with EPSS at 0.17% (7th percentile), consistent with a routine driver memory management fix rather than a weaponizable vulnerability.
DMA mapping failures in the Linux kernel's dma-mapping subsystem crash device driver probes on ARM64 systems with SPARSEMEM due to an incorrect pfn_valid() precondition check in dma_map_resource(). On Raspberry Pi 4 and similar ARM64/SPARSEMEM platforms, MMIO registers whose physical addresses share a 128MB sparsemem section with RAM are misidentified as RAM, causing WARN_ON_ONCE to fire and dma_map_resource() to return DMA_MAPPING_ERROR, breaking peripheral initialization (e.g., spi_bcm2835 SPI controller). No public exploit identified at time of analysis; this is a functional kernel regression with local availability impact rather than a remotely exploitable security flaw.
The pds_core driver in the Linux kernel leaks debugfs dentry references on every firmware reset recovery due to missing dput() calls after debugfs_lookup(), and can crash the kernel when CONFIG_DEBUG_FS is disabled because ERR_PTR(-ENODEV) is not properly distinguished from NULL. A local user with standard privileges on a system hosting AMD/Pensando DPU hardware can trigger repeated firmware reset cycles to exhaust kernel memory, causing denial of service; on kernels with CONFIG_DEBUG_FS=n, a single reset recovery call can immediately crash the system via an invalid dput() on an error pointer. No public exploit exists and EPSS is 0.18% (7th percentile), but patches are available across multiple stable branches.
Memory leak in the Linux kernel's btmtk (MediaTek Bluetooth USB) driver allows a local low-privileged user to exhaust kernel memory, causing denial of service. The vulnerability affects systems running Linux kernel from commit a1c49c434e15050b5dafe3b6f5cc732d4f02d657 onward, with patches confirmed in stable releases 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and no active exploitation has been confirmed; an EPSS of 0.18% at the 7th percentile places this firmly in low-priority territory for most organizations.
Permanent battery hardware damage on Uniwell-based laptops can be triggered via the platform/x86/uniwill-laptop kernel driver by enabling the battery charging limit through the 'force' module parameter. Affected hardware is limited to older Uniwell OEM models manufactured around 2020 where the charging limit circuitry is incompatible with the feature and causes irreversible battery degradation. No public exploit exists and EPSS stands at 0.16% (6th percentile), reflecting the narrow hardware and configuration prerequisites; however, the impact is severe and permanent - affected batteries cannot be recovered once damaged.
Stack buffer overflow in the Linux kernel adm1266 PMBus hardware monitor driver allows a local low-privileged user to crash the kernel on systems equipped with an Analog Devices ADM1266 power sequencer chip. The vulnerable function allocates a 5-byte stack buffer but passes it to i2c_smbus_read_block_data(), which performs an unchecked memcpy of up to 32 bytes (I2C_SMBUS_BLOCK_MAX) before any length validation - overflowing the stack and causing a denial of service. No public exploit code exists and EPSS at 0.18% (7th percentile) confirms limited exploitation interest; patched versions are available across all active stable kernel branches.
Spurious kernel WARN() triggers in Linux kernel mm/memory.c during process teardown when NVIDIA UVM or HMM-capable GPU drivers are present alongside private file-backed mappings containing migrated anonymous folios. The unmap path incorrectly uses vma_is_anonymous() rather than folio_test_anon() to gate device-private/exclusive page handling, producing false-positive kernel warnings (not panics) during munmap or process exit in affected configurations. No public exploit has been identified at time of analysis; EPSS at 0.17% (7th percentile) reflects the narrow triggering conditions required and the non-weaponizable nature of a spurious WARN().
Stale ARM64 Memory Tagging Extension (MTE) tag exposure in the Linux kernel's huge zero folio allocation path undermines the init_on_free security guarantee on AArch64 systems. When the kernel is booted with init_on_free=1 and a 2MB anonymous mapping triggers the huge zero folio path (mapped as a PMD-special entry), the __GFP_ZEROTAGS flag causes post_alloc_hook() to skip tag memory clearing while content zeroing was already handled at free time - leaving whatever allocation tags were previously set accessible to user space. No public exploit has been identified at time of analysis, and EPSS stands at 0.17% (6th percentile), consistent with the narrow architectural and configuration prerequisites required to trigger the flaw.
Spinlock leak in the Linux kernel's huge page device migration subsystem causes a local denial of service via deadlock. A low-privileged local user who can trigger the `migrate_vma_insert_huge_pmd_page` code path while inducing `check_stable_address_space()` to fail will leave the PMD spinlock permanently held, deadlocking any subsequent thread that attempts to acquire it. No public exploit has been identified and EPSS at 0.17% (7th percentile) reflects negligible real-world exploitation probability; the vulnerability is not in CISA KEV.
Null pointer dereference in the Linux kernel's Bluetooth ISO reassembly path allows any Bluetooth broadcaster within radio range to crash a victim Linux host by transmitting an ISO_END PDU without a preceding ISO_START on a BIS (Broadcast Isochronous Stream) connection. Affected kernels span all stable branches from the ISO introduction commit (ccf74f2390d60a2f9a75ef496d2564abb478f46a) through fixed releases 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code or CISA KEV listing exists at time of analysis; EPSS is 0.18% (8th percentile), reflecting low current exploitation probability despite the unauthenticated wireless trigger available to BIS attackers.
Kernel stack address disclosure in the Linux kernel's Bluetooth L2CAP subsystem leaks 8 bytes of kernel virtual address space to a paired Bluetooth peer whenever a local user triggers an L2CAP Enhanced Credit-Based Reconfigure (ECRED) request. The flaw was introduced by commit 1c08108f3014 when DEFINE_RAW_FLEX() converted the on-stack PDU struct but left l2cap_send_cmd() receiving the local pointer's stack storage address and sizeof(pointer) instead of the struct address and struct size. As a result, the ECRED reconfigure feature has been functionally broken for local initiators since that commit, and every reconfigure attempt passively leaks a KASLR-randomized kernel stack address to the Bluetooth peer, potentially aiding ASLR/KASLR bypass. No public exploit is identified at time of analysis, and the EPSS score of 0.18% (7th percentile) reflects low automated exploitation probability.
NULL pointer dereference in the Linux kernel's ethtool PHY subsystem allows a local low-privileged user to crash the kernel and cause a denial of service. The flaw in `phy_prepare_data()` fails to check return values from `kstrdup()` for the strings `name`, `drvname`, `upstream_sfp_name`, and `downstream_sfp_name`; when allocation fails and returns NULL, `phy_reply_size()` subsequently calls `strlen()` unconditionally on the NULL pointer, triggering a kernel oops and system panic. No public exploit code has been identified and EPSS stands at 0.17% (6th percentile), but the availability impact is total - a kernel panic - making this a standard patching priority for any multi-user or shared Linux environment.
CPU pinning denial-of-service in the Linux kernel L2TP subsystem allows an unprivileged local user to wedge a host CPU indefinitely by exploiting an RCU list management mismatch in l2tp_session_unhash(). By creating a user network namespace (unshare -Urn) to obtain CAP_NET_ADMIN and then racing L2TP_CMD_SESSION_CREATE, L2TP_CMD_SESSION_DELETE, and L2TP_CMD_SESSION_GET against the same tunnel, an attacker causes a session list walker to enter an infinite loop with BH and preemption disabled - stalling RCU grace periods system-wide and rendering the thread unkillable via SIGKILL. No public exploit has been identified at time of analysis; EPSS at 0.17% (6th percentile) indicates low automated exploitation probability and no CISA KEV listing.
Memory leak in the Linux kernel igc driver's Frame Preemption (FPE) implementation affects systems with Intel I225/I226 Ethernet controllers running kernel versions from commit 5422570c0010bb968738f9256eb2bf83e79b4d63 onward. The function igc_fpe_xmit_smd_frame() allocates a socket buffer for SMD frame transmission but fails to release it when igc_fpe_init_tx_descriptor() returns an error, confirmed by kernel SLAB unreferenced-object traces showing 224-byte skb allocations going unfreed. No public exploit has been identified and EPSS stands at 0.17%, indicating negligible broad exploitation interest; the practical exposure is limited to TSN-capable deployments with FPE explicitly enabled.
NULL pointer dereference in the Linux kernel's PCM512x ASoC audio codec driver crashes the kernel when a local low-privileged user writes to the overclocking mixer kcontrol. The driver's pcm512x_overclock_xxx_put() handler incorrectly invokes snd_soc_dapm_kcontrol_to_dapm() on a standard mixer kcontrol - an accessor only valid for DAPM kcontrols - returning NULL and triggering a kernel panic. No public exploit has been identified and EPSS stands at 0.16% (6th percentile), reflecting low exploitation likelihood; impact is confined to denial of service on systems with PCM512x audio hardware.
KVM arm64 vGIC in the Linux kernel leaks kernel memory when vCPU initialization fails, enabling a local attacker with VM-creation privileges to exhaust host memory and cause denial of service. The defect is a missing cleanup call in the kvm_vgic_vcpu_init() error path: private IRQs allocated prior to a redistributor iodev registration failure are never freed before the failed vCPU structure is released. No public exploit has been identified at time of analysis; an EPSS score of 0.17% (6th percentile) reflects low opportunistic exploitation probability, and the flaw is not listed in CISA KEV.
Out-of-bounds heap read in the Linux kernel's fwctl pds driver allows a local low-privileged user to crash the kernel by submitting an undersized RPC buffer, resulting in a denial of service. Affected kernel versions include Linux 6.15 and all stable trees prior to 6.18.34, 7.0.11, and 7.1, with exploitation requiring the pds_fwctl module loaded and a compatible PDS network adapter present. No public exploit exists and EPSS is 0.17% (7th percentile), placing this as a low-priority stability fix unless deployments expose the fwctl device node to untrusted local users.
Deadlock in the Linux kernel's drm/msm (Qualcomm Snapdragon GPU) shrinker causes full kernel hang under memory reclaim pressure. The circular lock dependency arises when the kswapd0 thread holds fs_reclaim and the MSM gem shrinker calls dma_resv_lock(), which internally attempts to re-acquire fs_reclaim - producing a ABBA deadlock that renders the system unresponsive. Kernels in the affected range on Snapdragon-based hardware (Linux 6.17 through pre-patch 7.0.x and 6.18.x) are vulnerable; no public exploit code exists and no active exploitation has been confirmed.
NULL pointer dereference in the Linux kernel's batman-adv Bridge Loop Avoidance (BLA) subsystem crashes the kernel when a hard interface is concurrently decoupled from its mesh interface during ARP processing. Local users with low privileges on systems running batman-adv mesh networking can trigger a kernel panic, causing a full denial of service. No public exploit exists and EPSS stands at 0.21% (11th percentile), marking this as a low-urgency stability fix rather than an active threat.
Availability degradation in the Linux kernel's batman-adv throughput meter (tp_meter) subsystem arises from a reference counting race in the receiver shutdown path, where both `batadv_tp_receiver_shutdown()` and `batadv_tp_stop_all()` can simultaneously skip the `tp_vars` reference release when the shutdown timer expires before `timer_shutdown_sync()` is evaluated. The leaked reference accumulates with repeated triggering, progressively exhausting kernel memory resources and resulting in a local denial-of-service condition on systems running the batman-adv mesh networking module. With no public exploit identified at time of analysis and an EPSS score of 0.18% (8th percentile), this is a correctness-class fix with real impact only on systems explicitly running batman-adv.
Denial-of-service via the batman-adv Translation Table (TT) subsystem in the Linux kernel allows a local low-privileged attacker to trigger empty VLAN responses through the global TT state path, causing availability loss in the mesh networking stack. The flaw traces to an incomplete prior fix: commit 16116dac2339 patched the direct TT response path against inconsistent TT TLVLs, but left the indirect global TT response path unguarded, enabling the same class of inconsistency state. No public exploit has been identified and EPSS stands at 0.18% (8th percentile), reflecting low real-world exploitation probability.
Heap buffer overflow in the Linux kernel's hwmon adm1266 PMBus driver allows a local attacker or a malicious/buggy PMBus device to crash the kernel by inducing a record_count value exceeding 32 in a BLACKBOX_INFO response, overrunning the fixed 2048-byte dev_mem allocation in adm1266_nvmem_read_blackbox(). Systems with the adm1266 driver loaded against ADM1266 hardware are affected across multiple stable kernel branches; patched versions are confirmed across Linux 5.10.258 through 7.0.11. EPSS at 0.18% and absence of KEV listing indicate no active exploitation at time of analysis.
Kernel stack memory leaks to userspace through the adm1266 PMBus GPIO driver in the Linux kernel when the ADM1266 hardware returns a shorter-than-expected I2C block-read response. Both adm1266_gpio_get() and adm1266_gpio_get_multiple() assemble a 16-bit status word from two buffer bytes without first verifying that at least two bytes were returned; uninitialized stack data then propagates through the gpiolib subsystem into sysfs and char-device ioctls accessible to local users. No public exploit exists and EPSS probability is 0.18% (8th percentile), consistent with the hardware-specific, locally-exploitable nature of this flaw; patches have been released across all active stable kernel branches.
Bio memory leak in the Linux kernel NVMe driver causes kernel memory exhaustion under integrity-mapping failure conditions, affecting local low-privileged users on systems with NVMe integrity features enabled. The defect lies in the NVMe block-I/O path: a local `bio` pointer is always NULL, so when integrity mapping fails the associated bio object is never freed - the fix retrieves the bio directly from the request structure. With EPSS at 0.17% (7th percentile) and no CISA KEV listing, no public exploit has been identified at time of analysis, and real-world risk is confined to gradual memory exhaustion rather than immediate system compromise.
Preempt count leak in four hv-gpci sysfs show() callbacks in the Linux kernel powerpc subsystem causes progressive kernel stability degradation on IBM Power systems compiled with CONFIG_PREEMPT=y. Each successful read of the affected sysfs nodes leaves one preempt_disable() unmatched, incrementally raising preempt_count; once the count becomes non-zero on return to userspace, the next page fault is misidentified as occurring in an atomic context, generating SIGSEGV and triggering 'BUG: scheduling while atomic' during the resulting coredump. Patches are available across the 6.6, 7.0, and 7.1 stable kernel trees, with no public exploit identified at time of analysis.
Kernel panic (BUG) in the Linux netfs subsystem's netfs_write_begin() function causes local denial of service when a folio is unlocked without holding the lock, triggering the VM_BUG_ON_FOLIO(!folio_test_locked(folio)) assertion at mm/filemap.c:1504. The defect surfaces under concurrent write workloads on Ceph-backed filesystems using the netfs layer - the generic/013 xfstests case reproduces it with approximately 30% probability per run. A local, low-privileged user who can write to a Ceph mount can crash the kernel; no confidentiality or integrity impact is observed. No public exploit code exists and EPSS stands at 0.17% (6th percentile), consistent with a race-condition DoS confined to specific filesystem configurations.
Kernel crash via NULL pointer dereference in the Linux netfs layer is triggered by a local low-privileged user combining a streaming write, file truncation, and mmap read on the same netfs-backed file. Affected kernel versions span from 6.8 (commit 9ebff83e) through stable branches prior to 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and EPSS is 0.17%, indicating very low observed exploitation probability; however, a precise reproduction recipe is embedded in the upstream fix commit, substantially lowering the knowledge barrier for any attacker already holding local access.
Write-through mode deadlock in the Linux kernel netfs subsystem allows a local low-privileged user to hang the kernel, causing a denial of service. The defect in netfs_advance_writethrough() fails to unconditionally unlock a supplied folio, and prematurely marks it for writeback before the folio is fully written, creating a lock-ordering conflict against concurrent mmapped reads and writes. Patches are available across multiple stable kernel branches; no public exploit code or active exploitation has been identified.
Reference leak in the Linux kernel netfs subsystem exposes systems with network filesystem mounts to a local denial-of-service condition. The `netfs_write_begin()` function fails to drop its held reference on the netfs request object when `netfs_wait_for_read()` returns an error, violating reference-counting invariants in the kernel's network filesystem abstraction layer. A low-privileged local user who can trigger repeated write errors on a netfs-backed mount (NFS, Ceph, AFS, or similar) can slowly exhaust kernel memory resources. No public exploit code exists and EPSS is 0.17% (6th percentile), consistent with a low-priority kernel maintenance fix.
Reference leaks and memory corruption in the Linux kernel netfs subsystem allow a local unprivileged user to crash the system via crafted write operations on network-backed filesystems. The flaw in netfs_perform_write() incorrectly transitions folio->private between NULL, the NETFS_FOLIO_COPY_TO_CACHE sentinel, netfs_group pointers, and netfs_folio structs, enabling multiple private-data attachments, folio reference leaks, and netfs_group struct leaks that can exhaust kernel resources or trigger a kernel panic. No public exploit exists and EPSS sits at 0.17% (6th percentile), indicating no observed exploitation activity.
Null pointer dereference in the Linux kernel's block bio-integrity subsystem (`bio_integrity_map_user()`) allows a local low-privileged attacker to crash the kernel, causing a denial of service. The flaw stems from `pin_user_pages_fast()` being permitted to return a partial page-pin result that is never validated before `bvec_from_pages()` dereferences the uninitialized zero-address entry. Patches are available across multiple stable kernel branches and Ubuntu has issued USN-8593-1; no active exploitation has been identified (EPSS 0.17%, no CISA KEV listing).
NULL pointer dereference in the Linux kernel's drm/msm/adreno driver allows local low-privilege users to crash systems equipped with older Qualcomm Adreno GPU generations (a2xx through a4xx). Querying UBWC (Universal Bandwidth Compression) parameters from userspace on these GPU families - which have no UBWC support and therefore no initialized UBWC config structure - triggers a NULL dereference in adreno_get_param(), resulting in a kernel panic. No public exploit has been identified at time of analysis; EPSS is 0.17% (6th percentile), consistent with the hardware-specific, local-only scope.
Deleting an ovpn (OpenVPN data-channel-offload) netdevice while a concurrent netlink CMD_PEER_NEW request adds a fresh peer can leave the interface permanently hung and impossible to unregister in Linux kernel 6.16 and later. The flaw is a local, root-privilege-adjacent denial of service: an attacker who already holds CAP_NET_ADMIN (obtainable inside a user namespace) must repeatedly win a very narrow race between ovpn_dellink() teardown and the peer-add path, which re-takes a netdev reference after all peers were assumed freed. Impact is limited to availability of the affected ovpn device - there is no confidentiality or integrity effect and no remote vector - and EPSS is only 0.20% (10th percentile), with no public exploit identified at time of analysis and no CISA KEV listing. Vendor patches are available in stable releases 6.18.34, 7.0.11 and 7.1, and Ubuntu has issued USN-8593-1; the issue is rated LOW priority despite the valid CVSS 4.7 MEDIUM score.
Kernel panics from NULL pointer dereferences in the Linux kernel's MANA (Microsoft Azure Network Adapter) driver can be triggered during device teardown or MTU reconfiguration after a partial queue-allocation failure, when apc->tx_qp and apc->rxqs have already been freed and NULLed but later code paths - mana_chn_setxdp(), mana_destroy_vport(), mana_fence_rqs() and mana_dealloc_queues() - dereference them without guarding for NULL. Only systems actually running the MANA driver are exposed (in practice Azure guests with a MANA NIC); the CVSS vector is AV:L/PR:L/UI:N with availability-only impact, meaning a local user able to invoke teardown-class operations (MTU/interface changes, typically requiring CAP_NET_ADMIN) is the prerequisite, and our independent assessment raises attack complexity to AC:H because the attacker must additionally benefit from a queue-allocation failure that cannot be reliably forced on demand. EPSS is 0.21% (11th percentile), the issue is not listed in CISA KEV, and no public exploit was identified at time of analysis; vendor patches exist for the affected stable branches.
Resource leak in the Linux kernel's ov8856 OmniVision I2C camera driver exposes systems with that hardware to local denial-of-service via kernel memory exhaustion. The driver's ov8856_init_controls() function fails to call v4l2_ctrl_handler_free() on error exit paths, leaving the control handler's allocated memory unreleased each time control registration fails. No public exploit exists and EPSS probability sits at 0.16% (6th percentile), reflecting that this hardware-specific driver code is rarely reachable in practice.
Memory leaks in the Linux kernel's DRM colorop subsystem allow a local low-privileged attacker to gradually exhaust kernel memory by triggering repeated DRM atomic state lifecycle operations, ultimately causing denial of service via out-of-memory conditions. Affected systems are those running Linux kernel versions between the introduction of the colorop subsystem (commit cfc27680ee208cdf7a61cda817b4158c4142595f) and the upstream fix commits, with patched versions available at 7.0.9 and 7.1. No active exploitation is confirmed (not in CISA KEV) and EPSS is extremely low at 0.14% (4th percentile), making this a low-urgency but legitimate kernel hygiene issue requiring patching during normal maintenance cycles.
Persistent GPU denial-of-service in the Linux kernel's drm/msm Qualcomm GPU driver allows a local low-privileged user to render the GPU permanently hung by submitting a single ring workload that triggers an unrecovered fault. The recover_worker function advances the hung ring's fence and early-exits when it detects no further queued work, bypassing the actual GPU reset sequence - leaving the hardware stuck until a reboot. No public exploit has been identified and EPSS is 0.15% (5th percentile), consistent with the narrow hardware and local-access prerequisites.
Missing upper bound validation on `num_of_nodes` in the AMD KFD ioctl handler `kfd_ioctl_get_process_apertures_new` allows a local low-privileged user with access to AMD GPU compute devices to crash the kernel, causing a denial of service. Affected are Linux kernel branches prior to 6.6.140, 6.12.90, 6.18.32, 7.0.9, and 7.1, restricted to systems with AMD GPU hardware and the amdkfd module loaded. EPSS is 0.16% (5th percentile), no public exploit or CISA KEV listing exists, and patched stable releases are available across all active stable branches.
Silent dirty page loss in the Linux kernel's Intel VT-d IOMMU subsystem (iommu/vt-d) allows a low-privileged local actor to trigger an availability impact by attaching a PASID to a nested IOMMU domain whose nesting parent domain already has dirty tracking configured. The kernel fails to block this invalid combination, causing dirty page tracking to silently fail - a condition critical to live VM migration correctness in virtualization environments. No public exploit has been identified; EPSS at 0.17% (6th percentile) reflects extremely low exploitation interest, and the vulnerability is absent from CISA KEV.
Out-of-bounds read in the Linux kernel RDMA/ionic driver's hca_type_show() sysfs handler allows a local user to trigger a kernel crash or leak adjacent kernel memory. The ionic driver's use of an unbounded "%s" format specifier on the 64-byte node_desc field - which is not guaranteed to be NUL-terminated - causes the kernel to read past the end of that field into adjacent members of struct ib_device when exactly 64 bytes have been written. Since ionic supports IB_DEVICE_MODIFY_NODE_DESC, this condition is reachable from unprivileged userspace. No public exploit or CISA KEV listing exists; EPSS is 0.17% (6th percentile), indicating low exploitation probability in the wild.
Multiple ACR mask validation and configuration flaws in the Linux kernel's perf/x86/intel subsystem allow a local low-privileged user to trigger incorrect Intel PMU hardware counter configuration, resulting in high availability impact. Three distinct weaknesses exist: incomplete user-space ACR mask validation permitting cross-group index bits, an early-return logic error that silently skips all subsequent ACR group configuration, and failure to clear stale hardware ACR masks (hw.config1) before writing new values. No public exploit code is identified and EPSS sits at 0.17% (6th percentile), indicating negligible active exploitation probability; this is a maintenance-patch priority rather than an emergency.
SELinux avdcache auditing in the Linux kernel incorrectly reuses a previously computed audited vector from avc_audit_required() rather than recomputing it against the current access request and its allow/deny outcome, causing certain permission checks to go silently unlogged. Affected are local, low-privileged users on kernels containing the per-task avdcache introduced at commit dde3a5d0f4dce1d1a6095e6b8eeb59b75d28fb3b, through versions prior to 6.18.30, 7.0.7, and 7.1. An attacker exploiting this gap can perform SELinux-policy-violating operations - such as directory writes following a cached directory search - that generate no audit record, directly undermining intrusion detection and compliance monitoring that depends on SELinux audit logs. No public exploit exists and EPSS is at the 6th percentile; however, organizations with strict SELinux audit compliance requirements face elevated effective risk.
Insufficient session expiration in django-oauth-toolkit 3.3.0 allows authenticated network attackers to exploit the `_load_id_token` function in `oauth2_provider/oauth2_validators.py`, bypassing token expiration enforcement and maintaining access beyond their authorized session lifetime. The CVSS 4.0 score of 5.3 with PR:L confirms exploitation requires low-privilege access (a valid or expired token), and impacts confidentiality, integrity, and availability at a low level. No public exploit or active exploitation has been confirmed; the issue was submitted via a GitHub issue report and the project has not yet issued a response or patch.
Token forgery is possible against any Perl application using Mojo::JWT versions before 1.02 due to a timing side-channel in HMAC signature verification. The decode() method compared the supplied signature against the recomputed HMAC using Perl's native eq operator, which short-circuits on the first differing byte, leaking the expected signature byte-by-byte through measurable response time variation. An attacker with the ability to submit many attacker-controlled tokens to an endpoint that calls decode() can statistically aggregate these timing differences to reconstruct the valid HMAC signature and subsequently forge arbitrary JWT tokens. No public exploit has been identified at time of analysis, and EPSS sits at the 7th percentile, indicating low automated exploitation probability.
YAML::Syck before version 1.47 crashes the Perl interpreter when parsing a YAML document that redefines an anchor name, due to a use-after-free and double-free in the bundled libsyck C library. Any caller invoking Load() or LoadFile() on attacker-controlled YAML - a common pattern in Perl web frameworks and data-pipeline tooling - is exposed to a denial-of-service condition that aborts the interpreter process. No public exploit beyond the CPANSec-confirmed 7-byte trigger document exists and no CISA KEV listing is present, but the trivially short trigger makes reliable reproduction straightforward.
Cross-user information disclosure in Cyrus IMAP through 3.12.2 allows any authenticated IMAP user to enumerate folder names and retrieve message UIDs belonging to arbitrary other accounts via the ESEARCH command, creating a content oracle. The flaw (CWE-204, Observable Response Discrepancy) leaks mailbox structure - including folder names that may reveal sensitive organizational or personal context - without permitting reads of actual message content. No public exploit code has been identified at time of analysis, no CISA KEV listing exists, and the CVSS score of 4.3 reflects the authentication prerequisite and limited confidentiality impact, though risk is elevated in shared multi-tenant deployments such as ISPs and universities.
Unauthorized mailbox deletion in Cyrus IMAP through 3.12.2 allows any authenticated non-admin user to invoke the admin-only LOCALDELETE command, bypassing ACL enforcement entirely. Any user with a valid account on an affected server can permanently delete arbitrary mailboxes - including those they have no read, write, or administrative permissions over - simply by issuing the improperly guarded command. No public exploit has been identified at time of analysis, but the attack requires only authentication and knowledge of the command, making it low-complexity for any insider or account-compromised attacker.
URLAUTH token forgery in Cyrus IMAP through 3.12.2 allows a network-based unauthenticated attacker to read the contents of a victim's mailbox folder by computing a forged authentication token using a predictable HMAC-SHA1 key. The predictability arises specifically when a victim has never issued a URLAUTH-authenticated URL for a given folder, leaving the per-folder mboxkey absent and thus falling back to a computable value. No public exploit code has been identified and no active exploitation has been confirmed; real-world impact is further constrained by URLAUTH being an obscure IMAP extension with negligible public client adoption.
Incorrect authorization in Cyrus IMAP through 3.12.2 allows authenticated users to bypass mailbox ACL enforcement via the vacation Sieve script `:fcc` (file carbon copy) feature, enabling unauthorized message injection into any mailbox nameable by the script regardless of insert permissions. The CVSS vector (PR:L, AV:N) confirms network-triggerable exploitation requiring only a valid authenticated account, with low integrity and availability impact (C:N/I:L/A:L). No public exploit code and no CISA KEV listing exist at time of analysis; vendor-released patch version 3.12.3 addresses the flaw.
Cyrus IMAP through 3.12.2 exposes mailbox ACL data to any authenticated user via the IMAP LISTRIGHTS command, which lacks the required admin-access authorization check. Any valid IMAP account holder can call LISTRIGHTS against arbitrary mailboxes they can name, learning which principals hold which access rights - data that should be restricted to mailbox administrators. No public exploit or active exploitation has been identified; vendor release notes reference 3.12.3 as the corrective release.
Resource limit bypass in the websocket-driver npm library (versions < 0.7.5) allows WebSocket messages to exceed the application's configured maximum message size when the permessage-deflate compression extension is active. The size enforcement is applied to compressed frame length headers rather than the decompressed payload, meaning a highly compressed message can appear within limits on the wire but expand arbitrarily upon decompression. Vendor-released patch is available in version 0.7.5; no public exploit has been identified at time of analysis.
Resource exhaustion in the websocket-driver Ruby gem (faye/websocket-driver-ruby) allows any WebSocket peer to bypass a configured maximum message size when the permessage-deflate compression extension is in use. The size limit is enforced against the compressed frame length rather than the post-decompression size, enabling a decompression-bomb style attack where a small compressed payload expands far beyond the intended ceiling. Applications on versions below 0.8.1 silently accept oversized payloads, potentially exhausting server memory or CPU and causing a denial-of-service condition. No public exploit exists at time of analysis, but the attack class is well understood and low-complexity to implement.
Network policy bypass in Cilium 1.19.0-1.19.4 allows workloads inside a Kubernetes namespace to reach peers that CIDR-based ipBlock NetworkPolicies should block. The flaw surfaces exclusively when Cilium is deployed with a custom clusterName (any value other than the default 'any'): the network-policy parser in parseNetworkPolicyPeer erroneously instantiates an empty pod selector for selectorless ipBlock peers, which compiles into a wildcard namespace-allow rule instead of a pure CIDR rule. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Zip-slip path traversal in File Browser 2.63.6–2.63.16 allows a low-privileged user with upload permission to plant a POSIX backslash-named file that the archive builder incorrectly normalizes into a directory traversal sequence, enabling arbitrary file write on any victim who downloads and extracts the generated archive. The root cause is the server-side conversion of `\` to `/` in archive entry names, which manufactures paths like `../../evil.sh` from the legal POSIX filename `..\..\evil.sh`. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the attack chain is straightforward for any user with upload access.
Path traversal in Apache Ivy's PackagerResolver (versions 2.0.0 through 2.5.3) allows an attacker with write access to a packager repository to overwrite arbitrary files outside the configured buildRoot directory by embedding '../' sequences in module coordinates such as organisation, name, or revision. The overwrite occurs during the Ant-script-driven repackaging phase that PackagerResolver triggers on artifact download. No public exploit code has been identified at time of analysis, and the vendor has released version 2.6.0 as the fix, confirmed via the Apache Ant project site on July 14, 2026.
Server-Side Request Forgery in Cloudreve's remote download workflow (versions prior to 4.16.1) enables authenticated users holding the remote download permission to direct the application server to fetch arbitrary internal URLs via POST /api/v4/workflow/download. Because the downloader accepted user-supplied URLs without validating loopback, localhost, IPv6 localhost, or redirect-to-loopback targets, a low-privileged user could exfiltrate responses from internal services - including cloud instance metadata endpoints, internal APIs, or services bound to 127.0.0.1 - by reading the downloaded content from their own Cloudreve file storage. No public exploit has been identified at time of analysis; vendor-released patch 4.16.1 is available.
Flameshot's 'Open With' feature prior to version 14.0.0 contains a TOCTOU (time-of-check to time-of-use) symlink-following race condition that allows a local unprivileged attacker on the same machine to overwrite arbitrary files writable by the victim user. By pre-planting a symlink at the predictable temporary file path before Flameshot writes the screenshot PNG, an attacker can redirect the write operation to any file within the victim's permissions - including configuration files, SSH keys, or application data. No public exploit identified at time of analysis, though the attack is straightforward given the deterministic path; the vendor-confirmed fix is available in v14.0.0.
Unvalidated chown in Samba's pam_winbind module allows a local user with narrow sudo delegation to transfer ownership of the root filesystem directory to a system account, causing system-wide denial of service on Red Hat Enterprise Linux 6 through 10. When mkhomedir is enabled and a system account has its home directory set to '/', any PAM-triggered authentication event run as that account via sudo invokes the chown without path sanitization. The resulting ownership change breaks SSH, sudo, and package-manager functionality, though the 0555 permissions on RHEL prevent write access escalation, confining the impact to high-severity availability loss. No public exploit or CISA KEV listing is identified at time of analysis.
Memory leak in ImageMagick's ICON decoder exposes services that process user-supplied images to a potential denial of service. Both the 7.x and 6.x release branches are affected - specifically versions before 7.1.2-26 and 6.9.13-51 respectively. An unauthenticated remote attacker (per CVSS PR:N) who can supply a crafted ICON file to an ImageMagick-processing endpoint can repeatedly trigger allocation failures that are never cleaned up, gradually exhausting process memory. No public exploit or active exploitation has been identified at time of analysis.
Memory leak in ImageMagick's YUV decoder (versions before 7.1.2-26 and 6.9.x before 6.9.13-51) enables remote denial of service by repeatedly submitting malformed YUV images that trigger a failed blob open, leaking heap memory on each decode attempt. No confidentiality or integrity impact applies; exposure is limited to availability of image-processing services that accept untrusted input. No public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in ImageMagick's FreeType integration path allows remote denial of service against image processing pipelines using vulnerable 6.x or 7.x releases. When FreeType initialization fails during an image processing operation, the affected code path neglects to exit cleanly and continues referencing already-freed memory, causing process corruption or crash. No public exploit identified at time of analysis; the CVSS 4.0 score of 6.3 with AC:H and AT:P reflects meaningful preconditions required to trigger the failure path.
Memory exhaustion denial of service in ImageMagick through 7.1.2-18 arises from the ASHLAR coder failing to release a temporary image object when an internal action fails, allowing an attacker who can supply malicious ASHLAR files to a processing pipeline to cumulatively exhaust process memory. The CVSS 4.0 vector (AV:L/UI:P) confirms this is a local-vector attack requiring passive user or pipeline interaction to process the crafted file, not a remote unauthenticated scenario. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; confirmed fixed versions exist for Magick.NET NuGet packages at 14.11.1.
Denial of service in BusyBox 1.38.0 lets attackers crash the bundled ash shell by supplying crafted input that triggers a heap-based buffer overflow (CWE-122) in the ifsbreakup() field-splitting routine of shell/ash.c. Only availability is impacted - there is no public exploit identified at time of analysis, and the EPSS score is low (0.16%, 6th percentile), indicating little observed exploitation interest so far. The NVD-assigned CVSS of 7.5 rests on a network attack vector that is not clearly supported by the description, which points to input being fed to a local shell.
Missing SSH host key verification in Dulwich's paramiko vendor module exposes SSH connections to man-in-the-middle interception. The contrib/paramiko_vendor.py module used paramiko's MissingHostKeyPolicy, which silently accepts any server host key without checking it against known_hosts, allowing a network-positioned attacker to impersonate a legitimate SSH Git server. No public exploit has been identified at time of analysis and EPSS sits at 0.14% (4th percentile), but the attack is conceptually straightforward for any attacker with network access between client and server.
Denial of service in BusyBox 1.38.0 arises from a use-after-free in the awk_sub() routine of the AWK applet (editors/awk.c), allowing an attacker who can supply a crafted AWK script to crash the busybox awk process. The flaw is a memory-corruption bug (CWE-416) with availability-only impact and no confidentiality or integrity consequences. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and its EPSS score is low (0.14%, 4th percentile).
Path traversal (Zip Slip) in Rclone's archive extract command allows crafted archives containing `../` or `..\ ` path components in entry names to write extracted files outside the user-selected destination prefix. All Rclone versions prior to 1.74.4 are affected; an attacker who can induce a user to run `rclone archive extract` against a malicious archive can create or overwrite sibling objects in the same bucket or parent path scope. No public exploit code has been identified and the vulnerability is not in CISA KEV; EPSS at 0.14% (4th percentile) reflects low real-world exploitation probability.
Navigation input validation bypass in Google Chrome prior to 150.0.7871.125 enables a remote attacker who has already compromised the renderer process to circumvent navigation restrictions through a crafted HTML page. The flaw is classified as a second-stage, chained exploit - the attacker must first achieve renderer process compromise before this vulnerability becomes exploitable. With integrity rated High (I:H) and no confidentiality or availability impact, the practical danger is unauthorized navigation control, potentially enabling redirect-based phishing, cross-origin frame manipulation, or security boundary bypass. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability stands at 0.26% (17th percentile), consistent with low current threat activity.
Same Origin Policy bypass in Google Chrome's V8 JavaScript engine (prior to 150.0.7871.125) allows a remote attacker to cross origin security boundaries via a crafted HTML page, enabling high-impact integrity violations against cross-origin content. Exploitation requires the victim to visit the malicious page (UI:R), limiting automated mass exploitation - a constraint confirmed by SSVC's Automatable:no finding. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog; EPSS at 0.26% (17th percentile) is consistent with no observed active exploitation at time of analysis.
Process memory disclosure in Google Chrome's Media component on Windows (prior to 150.0.7871.125) enables an attacker who has already compromised the renderer process to read sensitive data from Chrome's memory via a crafted HTML page. This is a chained vulnerability - it is a second-stage exploit requiring a pre-compromised renderer, making it a useful component in multi-stage browser attack chains rather than a standalone threat. No public exploit identified at time of analysis, EPSS is 0.30% (22nd percentile), and SSVC exploitation status is 'none,' confirming no current active exploitation.
Uninitialized variable use in Google Chrome's V8 JavaScript engine (all versions prior to 150.0.7871.125) exposes potentially sensitive process memory contents to remote attackers who can induce a user to visit a crafted HTML page. The confidentiality impact is rated high under CVSS, as uninitialized heap or stack memory in V8 may contain residual data such as session tokens or cached credentials from the browser process. No public exploit code exists and no active exploitation has been identified - EPSS sits at 0.33% (25th percentile) and SSVC rates exploitation as none - but a vendor patch is confirmed available in Chrome 150.0.7871.125.
Same-origin policy bypass in Google Chrome prior to 150.0.7871.125 enables remote attackers to manipulate cross-origin content integrity through the browser's HTML-in-Canvas rendering subsystem. Exploitation requires a victim to visit a crafted HTML page, making this a socially-engineered attack rather than a fully autonomous one. No active exploitation has been recorded (CISA KEV: absent, SSVC exploitation: none), and EPSS sits at 0.26% - indicating low real-world exploitation activity at time of analysis.
Uninitialized memory use in Chrome's Skia graphics library exposes potentially sensitive process memory to remote attackers in all Chrome versions prior to 150.0.7871.125. An unauthenticated remote attacker can trigger the leak by inducing a user to visit a crafted HTML page, causing the Skia renderer to read and disclose uninitialized memory contents. No public exploit has been identified at time of analysis, and SSVC classifies exploitation status as none, though the CVSS Confidentiality impact is rated High given the potential for in-memory secrets exposure.
jackson-databind's @JsonView authorization guard is bypassable on deserialization when a property carries both @JsonView and @JsonUnwrapped annotations, allowing an authenticated or unauthenticated attacker to mass-assign privileged fields through a less-privileged active view. Affected are com.fasterxml.jackson.core:jackson-databind 2.18.0-2.18.8, 2.21.0-2.21.4, 2.22.0, and tools.jackson.core:jackson-databind 3.0.0-3.1.4, 3.2.0. A publicly available proof-of-concept demonstrates the bypass; SSVC reports no confirmed active exploitation at time of analysis, and EPSS sits at 0.42% (34th percentile), indicating low current threat velocity despite the high-integrity impact.
Out-of-bounds read in libsoup's multipart processing exposes applications on Red Hat Enterprise Linux 6 through 10 to remote denial-of-service or partial memory disclosure. The flaw resides in soup_multipart_input_stream_read_headers() where oversized or malformed multipart boundary strings are not adequately size-validated, allowing an attacker to cause the stream reader to exceed its allocated buffer. A proof-of-concept exists per SSVC data, the attack is rated automatable, and no active exploitation is confirmed in CISA KEV - placing this in a monitored-but-actionable risk tier rather than an emergency response category.
Memory leak in libsoup's HTTP/2 implementation allows a remote, unauthenticated attacker to incrementally exhaust heap memory and crash the affected application through a sustained out-of-memory condition. Affected deployments include any application linking libsoup on Red Hat Enterprise Linux 6 through 10 that handles HTTP/2 connections from untrusted peers. No public exploit code has been identified and CISA has not listed this in KEV; however, the network-accessible attack surface with no authentication requirement makes it relevant for internet-facing services using libsoup. Notably, the provided CVSS vector (C:H/I:N/A:N) is internally inconsistent with the DoS-only description - the correct impact metrics should reflect Availability, not Confidentiality, and this discrepancy is flagged in the risk assessment.
Local tampering via symbolic-link following in Microsoft .NET (versions 8.0, 9.0, and 10.0) and the bundled toolchain in Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7) allows an authorized local attacker to redirect a privileged file operation to an unintended target, corrupting or replacing files outside their normal permissions. Microsoft (the reporter) has released a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. The high CVSS 3.1 base score of 7.0 is tempered by high attack complexity and the requirement for existing low-level local access.
Heap buffer over-read in libsoup's HTTP/2 GOAWAY frame parser allows remote unauthenticated attackers to crash applications or leak heap memory fragments by sending a malformed frame with a non-NUL-terminated Additional Debug Data payload. Affected deployments include applications built on libsoup running on Red Hat Enterprise Linux 10 that accept or initiate HTTP/2 connections. A proof-of-concept exists per SSVC data, though exploitation is rated non-automatable and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Deserialization logic in FasterXML jackson-databind 2.15.0 through 2.18.7, 2.21.3, and 3.1.3 allows unauthenticated remote callers to bypass @JsonIgnore annotations on Java Record types when a PropertyNamingStrategy is configured. The renamed JSON key - e.g., 'internal_role' produced by SnakeCaseStrategy from 'internalRole' - is not registered in the ignore list, so Jackson's constructor-parameter binding accepts the attacker-supplied value despite the developer's explicit exclusion directive. No public exploit tooling has been identified at time of analysis, but the upstream fix PR includes a runnable proof-of-concept test that fully demonstrates the bypass, lowering the bar for independent reproduction.
Missing TLS certificate validation in the XAPI C# and PowerShell SDK bindings - specifically on secondary HTTP handler connections used for disk image transfers, host backups, RRD data, and patch delivery - allows a network-positioned attacker to intercept communications between third-party management tools and Xen hypervisor hosts. Successful Man-in-the-Middle exploitation can yield stolen administrative session tokens, enabling full hypervisor session hijack, or permit tampering with critical data such as imported disk images and host update packages in transit. No public exploit code has been identified at time of analysis, and the Xen Project advisory XSA-498 confirms no known mitigations exist short of patching.