Suse
Monthly
Corrupted or attacker-crafted OCFS2 on-disk metadata can trigger an out-of-bounds read in the Linux kernel because inode-block validation (ocfs2_validate_inode_block) never bounds-checked inline xattr entry name/value offsets, allowing getxattr()/listxattr() to walk past the inline storage and producing a KASAN use-after-free READ in ocfs2_xattr_find_entry(). Exploitation is local and requires the victim to mount or read a malicious OCFS2 image (CVSS:3.1/AV:L/AC:L/PR:L/UI:R), so the practical exposure is limited to systems that mount untrusted OCFS2 volumes such as removable media, shared disk images, or cluster-shared storage; no public exploit identified at time of analysis. Vendor-released fixes exist in the 7.2.6 stable release and the corresponding mainline 7.3-rc1 merge.
Out-of-bounds metadata reads in the Linux kernel's ocfs2 filesystem allow a local attacker who can mount a crafted or corrupted ocfs2 volume to walk past the ends of external extended-attribute structures, producing a kernel crash (reproduced as a KASAN out-of-bounds/use-after-free read in ocfs2_xattr_list_entries) and a potential leak of kernel memory contents. The flaw exists because ocfs2_validate_xattr_block() checks only the xattr block header and never confirms that a non-indexed block's xh_count and entry offsets fit inside the block, while indexed xattr buckets reach list/get consumers after ECC without any entry-bounds check; any local listxattr() or getxattr() call against files on a malicious volume then triggers the walk. Exploitation is not remote and depends on the attacker controlling on-disk metadata (mount privilege or user interaction to attach an attacker-supplied device); the primary outcome per our assessment is denial of service via kernel crash rather than reliable code execution, and no public exploit code was identified at time of analysis.
A use-after-free race condition in the Linux kernel's OMAP DRM DSI display driver (drm/omapdrm) lets a locally authenticated user crash the kernel by forcing interrupt-handler teardown while a handler is still running against a stack-allocated object. The driver made a private copy of its ISR table so entries could be unregistered at runtime, but nothing actually uses that mechanism, so the copy serves only to create a window where IRQ unregistration can free state still referenced by an in-flight handler. Exploitation requires local access to TI OMAP-family hardware with an active DSI-connected panel and a successful timing race; no public exploit code has been identified at time of analysis, and the realistic outcome is denial of service (kernel crash), not privilege escalation.
A type-confusion flaw in the Linux kernel BPF verifier lets a local user who is allowed to load eBPF programs (CAP_BPF or CAP_SYS_ADMIN) turn an otherwise-rejected load-acquire of a disallowed context pointer - such as the sk field of struct __sk_buff - into an unchecked raw read of the underlying kernel object, after which the register can be reused with an inconsistent pointer type. Kernels from 6.15 up to the fixed stable releases 6.18.52 and 7.2.6 (mainline 7.3-rc1) are affected. CVSS 3.1 rates it 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code and no CISA KEV entry were identified at time of analysis, and real-world exposure is narrowed because unprivileged BPF is disabled by default (kernel.unprivileged_bpf_disabled=1) on mainstream distributions.
A use-after-free race condition in the Linux kernel's RDMA/erdma driver (present since Linux v6.0) lets a local user with RDMA verbs access crash or destabilize the kernel on hosts where the erdma module - the driver for Alibaba Elastic RDMA Adapter hardware, typically seen on Alibaba Cloud ECS instances - is loaded. The bug occurs because the EQ (event queue) handler looks up completion queues from dev->cq_xa and invokes their callbacks outside the xarray lock, while erdma_destroy_cq() can concurrently erase the CQ and free its queue buffer and doorbell record, leaving the handler operating on freed memory. Exploitation requires winning a narrow timing race between CQ destruction and a previously scheduled EQ handler, so the independent assessment scores the impact as high availability loss with no confidentiality or integrity effect; vendor patches are available for the affected stable branches, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Use-after-free in the Linux kernel's RDMA/erdma driver (Alibaba Elastic RDMA) lets a local, low-privileged user who can reach an erdma RDMA device kernel-crash the host by racing a queue-pair teardown against asynchronous-event (AE) or iWARP connection-management (CM) processing that looks the QP up in dev->qp_xa and dereferences it outside the xarray lock. Only systems with the erdma driver loaded and an accessible erdma/verbs interface are exposed - in practice specific Alibaba Cloud instance types - and exploitation is local-only, requiring a narrow concurrency window rather than a remote or unauthenticated path. Vendor-released patches exist (Linux 6.12.110, 6.18.52, 7.2.6, and 7.3-rc1), no public exploit code was identified at time of analysis, and the realistic risk is denial of service (kernel crash/instability) rather than the information-disclosure framing suggested by the input tagging.
A race in the Linux kernel's iSER (IB/isert) iSCSI target transport lets an initiator on an RDMA fabric crash the target host: the final iSCSI Login Response is put on the wire before __transport_register_session() has populated the session's se_tpg, so a SCSI command issued immediately after the initiator sees login success reaches target_submit() against a half-initialized se_session and the ib-comp-wq worker oopses on a NULL/non-canonical pointer dereference (KASAN null-ptr-deref at offset 0x78). Only LIO/TCM iSCSI targets using the isert RDMA transport over InfiniBand, RoCE, or iWARP are affected; plain iscsi-TCP and cxgbit are not, because they already pull PDUs from iscsi_target_rx_thread. Exploitation is a probabilistic race (the maintainer reproduced the oops in 10 of 20 unpatched runs over rxe), vendor CVSS is 7.5 while our assessed vector is AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H given the RDMA-fabric adjacency requirement and timing difficulty; there is no public exploit code and no CISA KEV listing at time of analysis.
A use-before-initialization race in the Linux kernel's iSER target stack (IB/isert) lets a non-compliant iSCSI initiator crash the target host by issuing a SCSI command before it has received the final Login Response, dereferencing a se_session whose se_tpg is still NULL and producing a kernel oops at target_submit+0xbe. Only systems running the LIO/isert target over an RDMA fabric (InfiniBand, RoCE, or iWARP) are affected, and the exploit window is sub-millisecond - a median of roughly 92 microseconds before the fix, widening to about 172 microseconds after re-posting the buffers later in the login flow. Impact is availability only (denial of service via kernel panic), no public exploit has been identified at time of analysis, and although the published CVSS of 7.5 looks high, our independent assessment rates it AV:A/AC:H with a low real-world priority because success is probabilistic and requires a deliberately non-compliant initiator on the RDMA fabric.
Use-after-free in the Linux kernel's RDMA siw (software iWARP) driver lets a local low-privileged user crash the kernel by passing a queue pair that is already in the RTS state to siw_accept(). The flaw lies in the error-cleanup path, which assumes the current call installed the QP-to-endpoint association and therefore releases the wrong endpoint reference, potentially freeing the incoming endpoint before a subsequent cep->qp store and also tearing down a pre-existing association. Real-world impact is bounded: the vulnerable path requires the siw driver to be loaded and a siw device configured (not present in default server or desktop installs), and the trigger depends on a race window in which the freed endpoint loses its remaining references in time; the realistic outcome is a kernel crash (denial of service) rather than code execution or data disclosure. No public exploit code has been identified at time of analysis, and the vendor CVSS score of 7.8 (C:H/I:H/A:H) overstates the risk relative to the independent assessment, which rates confidentiality and integrity impact as none and availability as high.
Use-after-free in the Linux kernel's kmod request-deduplication code (module/dups) allows a local authenticated user who can force concurrent kernel module auto-load requests for the same module to race kmod_dup_request_delete() against kmod_dup_request_exists_wait() and free a kmod_dup_req structure while another thread still holds a reference to it, corrupting kernel memory. The flaw was introduced with the kmod dups code in Linux 6.4 and is fixed by the stable commits referenced under CVE-2026-90291; no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). Although the vendor scores this 7.8 with confidentiality and integrity impact, our independent assessment rates it substantially lower (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) because the race is non-deterministic and crash-primary, with no demonstrated path to code execution or data disclosure.
Double release of an OpenFirmware device-tree node reference in the Linux kernel's Renesas R-Car Gen2 USB PHY driver (drivers/phy/renesas/phy-rcar-gen2.c) can corrupt kernel memory and crash the system if PHY creation fails during driver probe. Only R-Car Gen2 automotive/embedded ARM platforms are affected, and the bug is reachable only at boot or module load when devm_phy_create() returns an error, not from ordinary userspace requests - per the authoritative independent assessment the impact is availability-only (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), with the vendor's PR:N / C:H/I:H/A:H vector not reflecting the real prerequisites. Vendor-released patch: Linux 7.2.6 and 7.3-rc1 (stable commits b780b892 and 5374f3d5); no public exploit was identified at time of analysis.
The Linux kernel's amdgpu driver for GFX6 (Southern Islands) hardware fails to use the PFP (pre-fetch parser) on compute queues, letting a local user who can open the DRI/render node submit a sequence of GPU command submissions in which the PFP starts executing the next submission while the ME is still working through the previous one; the resulting out-of-order register writes and fence waits can corrupt GPU command-stream state, leak stale register/memory contents, or hang the GPU and driver. Only systems with AMD GFX6-era GPUs (Radeon HD 7700/7800/7900-class and rebadges, roughly 2012) driven by amdgpu are affected, and the race is probabilistic because the attacker must win a narrow ordering window; authentication requirements per the CVSS vector are local with low privileges (PR:L), and no public exploit code was identified at time of analysis. Note that the vendor score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) overstates real-world risk: our assessment reduces it to AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H because the race is difficult to time reliably, the impact stays within the local kernel/GPU context rather than crossing a security scope boundary, and confidentiality/integrity effects are limited, with availability (GPU/system hang) being the most likely observable outcome.
A flawed error path in the Linux kernel's SCSI disk (sd) driver can free a disk object that has already been registered with the driver core when the driver's large DMA pool allocation fails during probe, corrupting kernel memory, leaking a sysfs entry and taking the host down. Exposure is limited to systems running an affected kernel (through the 7.1 series) where a SCSI/SATA/SAS/USB disk is being attached and sd_large_pool_create() fails at exactly the post-registration moment, so the authoritative assessment rates this as local, high-complexity and requiring privileged access rather than the remote 8.1 vector published by the vendor. No public exploit code or confirmed active exploitation exists at time of analysis; fixed builds are Linux 7.2.6 and 7.3-rc1, tracked by upstream commits 748a14a0d41cfe3017251c11b314f85045414942 and e3cc6ea1a745e7f5d326f919a428b244fa119d8f.
Incorrect zero-out handling in the Linux kernel's btrfs zoned-mode write path can corrupt on-disk filesystem metadata, because btree_csum_one_bio() memzeroed an extent buffer's own folios in place while the buffer could still be referenced, so a later btrfs_free_tree_block() read a zeroed header and freed bytenr 0, corrupting the extent tree. Only Linux kernels running btrfs on a zoned block device (ZNS NVMe or host-managed SMR) from the 6.8 era through the fixed stable releases are affected; non-zoned btrfs deployments are unaffected. Triggering requires local authenticated filesystem activity with heavy concurrent metadata operations (the upstream report notes it reproduces flakily under fsstress/xfstests generic/461 and generic/013), authentication requirements follow the assessed vector as PR:L, and no public exploit identified at time of analysis. The impact is integrity and availability of filesystem metadata (potential abort/ASSERT and metadata loss), not a remotely reachable or memory-disclosure primitive.
A race condition in the Linux kernel's Bluetooth L2CAP subsystem allows a use-after-free of the hci_conn::l2cap_data pointer: the disconnect-work handler (disc_work) reaches l2cap_disconn_ind via hci_conn_timeout and hci_proto_disconn_ind and dereferences l2cap_data without locking, so a concurrent teardown that deletes the associated l2cap_conn can free the structure out from under that read, crashing or corrupting kernel memory. Affected systems run kernel builds in the 6.6.84 through 6.14 ranges listed by EUVD that lack the proto_lock fix, and the attacker must be within Bluetooth radio range (AV:A) and unauthenticated (PR:N); the trigger is timing-dependent, requiring a race to be won rather than a deterministic sequence. Independent assessment rates real-world impact as availability-only (C:N/I:N/A:H) at high attack complexity (AC:H), well below the vendor's 8.8 vector, and no public exploit code or CISA KEV listing has been identified at time of analysis; headless servers and systems without Bluetooth hardware or an enabled Bluetooth stack are not exposed.
A memory leak combined with a use-after-free in the Linux kernel's Bluetooth HCI connection-setup path can crash the kernel or gradually exhaust kernel memory when a synchronous (SCO/eSCO) audio connection setup entry is cancelled instead of executed. The defect is in hci_setup_sync(), which queues a wrapper context (conn_handle_t) carrying a NULL destroy callback and a bare hci_conn pointer, so cancelling the entry leaks the context and freeing the connection while its setup work is still queued leaves the driver dereferencing memory it no longer owns. Kernels built with the Bluetooth HCI sync path and containing the introducing commit across the 6.1, 6.6, 6.12, 6.18 and 7.x stable branches are affected; exploitation is timing- and teardown-dependent and practically limited to denial of service, with no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV). Note that the vendor CVSS 3.1 base of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is judged to overstate real-world risk; an independent assessment scores it CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, i.e. an availability-only impact.
An integer overflow in the Linux kernel's AppArmor verify_tags() bounds check allows an authenticated local attacker with low privileges to trigger an out-of-bounds read by loading a crafted AppArmor policy blob, primarily causing a kernel crash and limited potential information disclosure. Reachability requires the ability to manage AppArmor policy; under the default unprivileged_userns_apparmor_policy=1 setting an unprivileged user in a matched-level nested user namespace can reach the path, otherwise CAP_MAC_ADMIN in the initial user namespace is required. The assessed vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, no public exploit was identified at time of analysis, and vendor patches exist.
A locking regression in the Linux kernel's iommu/dma MSI page allocator lets a local actor with VFIO device-fd access corrupt the shared msi_page_list when two passthrough devices are merged into a single IOMMU domain under VFIO type1's legacy container mode. The flaw only manifests on IOMMUs that publish IOMMU_RESV_SW_MSI (in practice ARM SMMU), where the caller's per-group mutex is insufficient because the merged domain is shared across groups; a race between two concurrent iommu_dma_get_msi_page() calls is required, so exploitation is timing-dependent and local-only - x86 systems without SW_MSI regions and iommufd-based setups (which serialize through sw_msi_lock) are unaffected. No public exploit code has been identified at time of analysis; vendor-released fixes are available in Linux 6.18.52, 7.2.6, and 7.3-rc1.
Intel VT-d (iommu/vt-d) context-entry teardown in the Linux kernel can briefly expose IOMMU hardware to a torn 128-bit context entry, yielding spurious DMA faults or unpredictable IOMMU behaviour during the copied-context handover path used by kexec/kdump-style kernel transitions. The defect sits in copied_context_tear_down(), which zeroes the entry via context_clear_entry() while the Present bit is still set and only then issues context-cache and IOTLB invalidations, so hardware may fetch a partially zeroed entry that still appears present; on IOMMUs without coherent access to the context table there is additionally no cacheline flush before invalidation. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor CVSS of 8.1 is significantly overstated relative to the independent assessment (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H), which characterises this as a local, high-complexity race reachable only through a kernel-internal boot/teardown path, with random spurious faults rather than a controllable memory-corruption or disclosure primitive.
Linux kernel's Intel VT-d IOMMU scalable-mode probe failure path can leave context entries pointing to a freed PASID table, leading to a kernel crash (availability-only DoS). Affected systems are x86 hosts using Intel VT-d in scalable mode with PCI(e) devices that expose a dma_alias_mask, and the bug is reachable only when intel_pasid_setup_sm_context() fails partway through programming multiple RIDs during device probe or hot-plug. No public exploit code or CISA KEV entry was identified at time of analysis; exploitation requires high privileges (CVSS PR:H) and the assessed impact is availability-only.
Use-after-free in the Intel VT-d IOMMU teardown path of the Linux kernel (6.11 and later, including stable branches before 6.18.52/7.2.6/7.3-rc1) leaves a cleared DMA-alias context entry cached when domain_context_clear_one() or device_pasid_table_teardown() flushes using the device's own requester ID instead of the alias SID. A local actor able to destroy IOMMU domains or unbind/detach devices (assessed PR:H, effectively CAP_SYS_ADMIN) can cause the IOMMU to walk freed PASID-directory memory, giving likely memory-corruption and availability impact within a confined, privilege-gated teardown scenario. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor CVSS 8.8 overstates risk, and the assessed vector is AV:L/PR:H/UI:N/S:U with low confidentiality/integrity and high availability impact.
Memory-safety corruption in the Linux kernel's netfilter nft_ct conntrack expectation code lets a local user with CAP_NET_ADMIN in a network namespace leave a stale hlist pointer (.pprev) behind after the conntrack extension area is reallocated, enabling use-after-free style reads and writes against freed memory. Affected systems run kernels from 5.3 up to the versions fixed by 7.2.6 and 7.3-rc1, and exploitation requires the nf_conntrack/nft_ct subsystem to be in use plus the ability to install an nft_ct rule that creates custom expectations and then drive matching traffic; the assessed CVSS is 5.9 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H), meaning denial of service and limited disclosure/modification rather than the C:H/I:H/A:H impact suggested by the vendor's 7.8 score. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the affected code path is reachable by unprivileged users on multi-tenant or container hosts where unprivileged user namespaces are enabled.
A data race in the Linux kernel's SUNRPC socket transport layer (xprtsock) allows a stale sk_data_ready or sk_write_space callback snapshot to be invoked after SUNRPC has already restored the underlying lower-socket handlers during socket teardown, because the replace/restore of those shared callback pointers uses plain (non-atomic) stores and loads. Affected systems are Linux kernels that carry the SUNRPC socket-takeover code (xs_local_finish_connecting, xs_udp_finish_connecting, xs_tcp_finish_connecting, xs_restore_old_callbacks, xs_udp_do_set_buffer_size) and that use NFS or other RPC-over-socket traffic over AF_LOCAL, UDP or TCP, up to the fixed stable backports referenced in the EUVD data (6.6.157, 6.12.110, 6.18.52, 7.2.6 and 7.3-rc1). No public exploit has been identified at time of analysis and the issue is not in CISA KEV; note that the vendor-assigned CVSS of 9.8 is grossly overstated, as the assessed vector is AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, i.e. a locally driven, high-complexity race whose realistic consequence is availability loss (kernel instability), not remote unauthenticated code execution.
AppArmor confinement escape in the Linux kernel allows a local user who is already confined by a profile stack to pass through an unconfined profile and break out of the enforced AppArmor security boundary, yielding high confidentiality and integrity impact with changed scope (CVSS 8.4, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). The defect is that the unprivileged-transition restriction on unconfined is not applied when a task is already stacked, so the escape succeeds if two transitions through an unconfined profile can be executed; exploitation is local only, requires an existing confined/stacked context plus policy that permits such transitions, and therefore concentrates on hosts that deploy AppArmor with these restrictions (primarily Ubuntu and SUSE). Vendor-released patches exist for 6.18.52, 7.2.6 and 7.3-rc1, and no public exploit identified at time of analysis.
A heap out-of-bounds read in the Linux kernel's NVMe-over-Fabrics target (nvmet) DH-HMAC-CHAP authentication path lets a remote attacker who can reach a fabric transport trigger reads past an allocated message buffer by sending a crafted AUTH_Send negotiate command with an undersized transfer length or oversized hash/group identifier counts. Because authentication is negotiated before any credential check, no login is needed, but exploitation requires the target to have DH-HMAC-CHAP auth explicitly enabled (opt-in, not default) on a kernel in the affected range starting at 6.0. The reliable outcome is a kernel crash or corrupted response data rather than code execution or arbitrary memory disclosure, giving the flaw a strong availability impact with limited confidentiality impact; no public exploit code was identified at time of analysis, and it is not confirmed as actively exploited.
Kernel panic and NULL-pointer dereference in the Linux nvme-apple driver can crash Apple Silicon systems (e.g., Apple Mac mini M1) when an NVMe controller fails to initialize and is then immediately torn down, because the admin blk-mq queue allocated by blk_mq_alloc_queue() is never destroyed on that error path. The stale queue keeps its timeout timer and work armed, so blk_mq_timeout_work() later runs against freed state and oopses in percpu_ref_tryget_many after a WARN in blk_mq_release(). Our independent assessment rates this as a low-real-world-risk reliability defect rather than the vendor's high-severity base score: it is local-only, reachable exclusively on the failed-controller-plus-removal sequence (high attack complexity, low-privileged local context per the assessed vector AV:L/AC:H/PR:L), with no remote path and no public exploit identified at time of analysis.
A NULL pointer dereference in the Linux kernel's NVMe target (nvmet) subsystem causes a kernel oops and denial of service when a connected NVMe-over-Fabrics host issues an Identify command with CNS 05h (I/O Command Set specific Identify Namespace) and CSI 02h (ZNS Command Set) against a namespace that is backed by a file rather than a block device. The target-side bug, rated CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H in independent assessment, is exploitable by an authenticated fabric host only when the kernel is built with CONFIG_BLK_DEV_ZONED and the target exports at least one file-backed namespace; it is a crash-only availability issue with no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, and the bug does not appear in CISA KEV.
Local authorization bypass in the Linux kernel NVMe driver (NVMe ioctl path) lets an unprivileged user who holds a file descriptor to an affected block device submit arbitrary read and write I/O that the driver would otherwise reject. Specifically, NVME_IOCTL_SUBMIT_IO never invoked nvme_cmd_allowed(), so a caller with only a partition device node or a read-only file descriptor to the disk can issue I/O against the whole device - bypassing both partition boundaries and read-only protection - resulting in high confidentiality and integrity impact with limited availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). Exploitation requires pre-existing local access to an NVMe device node (for example via disk-group membership or permissive device permissions); no public exploit code has been identified and the flaw is not confirmed as actively exploited (not in CISA KEV), but vendor patches are available across all maintained stable branches.
A race condition in the Linux kernel's NFC LLCP socket layer allows a local user with the ability to open an AF_NFC LLCP socket to trigger a use-after-free in nfc_llcp_getsockopt() by interleaving a getsockopt() call with a bind() that fails and unwinds, freeing the nfc_llcp_local structure the cached pointer refers to. The practical outcome per the independent assessment is a kernel crash / denial of service (high availability impact) with only limited information exposure (low confidentiality impact) and no confirmed integrity impact, and because the exploit depends on hitting a narrow timing window, the attack complexity is high. No public exploit code was identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV). The issue is confined to the niche NFC LLCP stack, which only exists on kernels built with NFC/LLCP support.
Linux kernel builds with NFC NCI support can invoke the raw NFC socket data-exchange completion callback twice under a close-versus-softirq race, causing a second sock_put() on a socket that only ever received one sock_hold() - an NFC socket refcount underflow that frees the socket while it is still referenced. The flaw is a regression introduced by commit 4527025d440ce8, which moved flush_workqueue(ndev->rx_wq) after mutex_unlock(&ndev->req_lock) in nci_close_device() and thereby de-serialized the close path from nci_rx_work. Exploitation demands a kernel built with CONFIG_NFC and NCI plus a usable NFC device and a local process able to open an NFC raw socket and register a completion callback; success then depends on winning a narrow timing window, which is why our independent assessment scores it 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) rather than the vendor's 7.5 AV:A/PR:N vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the 'Information Disclosure' tag attached to this record is misleading - the defect is a use-after-free/refcount bug.
Malformed NFC LLCP Service Name Lookup (SNL) frames can drive an out-of-bounds read in the Linux kernel's nfc_llcp_recv_snl() routine, typically resulting in a kernel crash and denial of service, with a marginal possibility of limited memory disclosure. An attacker within NFC radio proximity (adjacent, AV:A) can trigger this without authentication or user interaction, because LLCP link activation happens automatically after NFC-DEP peer discovery; systems without CONFIG_NFC or NFC hardware are not affected. Vendor-released stable fixes cover 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, and 7.2.6, and no public exploit code was identified at time of analysis.
A use-after-free in the Linux kernel BPF trampoline multi-attach teardown path allows a local user who already holds CAP_BPF and/or CAP_SYS_ADMIN to crash the kernel - and potentially corrupt kernel memory - by forcing bpf_trampoline_update() to abort on an error path that runs before modify_fentry_multi()/unregister_fentry_multi(), leaving the erroneous free of old_image in bpf_trampoline_multi_attach_free() to release an ftrace image that is still live. Exploitation is confined to kernels that ship the new fentry_multi trampoline code (7.2.x and the 7.3-rc series), requires privileged BPF capability plus the ability to make an update fail in that specific corner, and is not remotely reachable or available to default unprivileged users. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the vendor's CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while our independent assessment scores it 6.4 (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H), treating the realistic outcome as kernel availability loss rather than broad code execution.
A timing-dependent race condition in the Linux kernel's ALSA sequencer MIDI input path (snd_seq_midi / snd_rawmidi) allows a local user who can open a rawmidi MIDI substream to crash the kernel via a NULL pointer dereference. The flaw occurs when snd_midi_input_event() is still executing as a substream is closing, letting the input event re-trigger after rawmidi_release_priv() has set rfile->rmidi to NULL, producing an 'Unable to handle kernel NULL pointer dereference' oops in snd_midi_input_event+0x3c/0x134. No public exploit was identified at time of analysis and there is no CISA KEV listing; the practical impact is denial of service (system crash) only, and the vendor-assigned CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates real-world risk and is internally inconsistent with the described defect, which carries no confidentiality or integrity impact and requires winning a race under AC:H. Vendor patches are available in the listed stable releases.
Out-of-bounds memory access in the Linux kernel's OCFS2 cluster filesystem can be triggered when a victim mounts and processes a crafted or corrupted OCFS2 image whose on-disk inode sets OCFS2_ORPHANED_FL with an i_orphaned_slot value outside the mounted filesystem's valid slot range, causing ocfs2_wipe_inode() to index osb_orphan_wipes out of bounds during orphan wipe and inode eviction. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H, i.e. a local, low-complexity, unauthenticated-per-vector flaw that nonetheless requires the victim to interactively mount the malicious image and, in most real deployments, to hold CAP_SYS_ADMIN to mount at all, which sharply narrows realistic exposure. Vendor patches are available in Linux 6.18.52, 7.2.6, and 7.3-rc1, and no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
A local attacker can trigger a slab use-after-free in the Linux kernel's ocfs2 cluster filesystem by mounting or otherwise processing a crafted ocfs2 disk image whose append-DIO dinode carries an i_dio_orphaned_slot outside the mounted filesystem's slot range (the description attributes this to a single high byte at offset 0xa1 corrupted from 0 to 1). The fault fires only during DIO orphan recovery (ocfs2_recover_orphans calling ocfs2_del_inode_from_orphan), where the out-of-range slot is used to index a slot-local system inode cache and the resulting invalid pointer is dereferenced as an inode, producing a KASAN slab-use-after-free in ocfs2_get_system_file_inode. Affected code is present in ocfs2 builds (CONFIG_OCFS2_FS) from Linux 4.0 onward through the unfixed commits listed in the stable trees, and is resolved by fixes released as Linux 6.18.52, 7.2.6, and 7.3-rc1; there is no KEV listing and no public exploit identified at time of analysis.
An out-of-bounds read in the Linux kernel's Squashfs filesystem driver allows local information disclosure - and, per the vendor score, a potential denial of service - when a crafted Squashfs image that encodes a negative block offset is mounted and a local user then reads the affected file. Because the malicious image must first be mounted, exploitation requires a privileged mounting step (CAP_SYS_ADMIN), so only environments that mount attacker-supplied images (auto-mount daemons, container runtimes, or an administrator mounting untrusted media) are realistically exposed; once mounted, the trigger is unprivileged per the CVSS vector (PR:N) and involves a user-initiated file read (UI:R). Vendor-released patches exist across all supported stable branches, and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a low-priority defensive hardening fix rather than an urgent threat.
Mounting an attacker-supplied, malformed NTFS filesystem image on a Linux system that uses the in-kernel ntfs3 driver can bypass virtual-cluster-number validation in mi_enum_attr(), permitting out-of-bounds accesses that leak kernel memory or crash the machine. The affected code ships in kernels carrying ntfs3, with the vulnerable range identified from 5.15.209 and the 6.x stable branches up to the corresponding fixed releases; exploitation requires local access plus the victim mounting or reading crafted NTFS media (removable drive, disk image, or shared volume), and auto-mount or CAP_SYS_ADMIN privileges are typically needed, so hosts that never mount untrusted NTFS volumes are not exposed. No public exploit code has been identified at time of analysis, though vendor patches for multiple stable branches are available.
An out-of-bounds read in the Linux kernel's RISC-V SBI MPXY mailbox driver (riscv-sbi-mpxy, present from around kernel 6.18) occurs because the SBI return value that dictates how many bytes are copied from RPMI shared memory into the notification buffer is never validated against the negotiated shared-memory size; the event walker additionally uses a reversed loop condition and can inspect a short event record. An actor controlling the SBI/firmware side of that trust boundary - a malicious or compromised SBI implementation, M-mode firmware, or platform management microcontroller - can therefore make the kernel copy and then parse data beyond the intended buffer, exposing kernel memory contents and risking a crash. The vendor scores this 8.4 (AV:L/AC:L/PR:N/UI:N/C:H/I:H/A:H), but our authoritative assessment rates it CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H, i.e. local, high complexity, requiring firmware-level privilege, with confidentiality and availability impact rather than integrity; there is no public exploit identified at time of analysis and the flaw is confined to RISC-V hardware running very recent kernels.
Mandatory byte-range lock enforcement is bypassed in the Linux kernel's in-kernel ksmbd SMB server, letting a client with a valid authenticated SMB session (CVSS PR:L) perform single-byte reads, writes, copychunk operations, and one-byte truncates against a byte that another client has already locked with a conflicting mandatory lock. The defect is a range-validation logic error: check_lock_range() uses inclusive ranges and its callers pass start + length - 1 as the end offset, so the start == end shortcut incorrectly treated a legitimate one-byte range as empty and skipped the lock check entirely; multi-byte ranges were always checked correctly. Exploitation requires a non-default configuration (CONFIG_SMB_SERVER enabled with an exported share) and a pre-existing conflicting lock, which sharply limits real-world exposure; no public exploit code has been identified at time of analysis, and the vendor CVSS of 8.1 (C:H/I:H) overstates impact relative to our assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.
A teardown race in the Linux kernel's SMB Direct (smbdirect) RDMA transport lets a freed completion queue be polled again, producing a slab-use-after-free that crashes the kernel rather than allowing code execution or data theft. An unauthenticated remote attacker who can reach an SMB Direct endpoint and win a timing-dependent race during connection teardown (a late RNR/error completion posted by the provider such as Soft-RoCE/rxe after rdma_destroy_qp() and before the workqueue-armed ib_cq_poll_work is cancelled) triggers the fault; the vendor-assigned CVSS 9.8 with full confidentiality/integrity/availability impact substantially overstates the defect, whose realistic impact is availability only. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the flaw is only reachable when SMB Direct over RDMA is configured and an RDMA provider is present.
A teardown-ordering defect in the Linux kernel's smbdirect (SMB Direct over RDMA) transport can crash the host when an RDMA accept request fails after a receive I/O has already been posted to the queue pair. Kernels running smbdirect with an active listener on RDMA-capable fabric (RoCE, iWARP, or InfiniBand) are affected - EUVD tracks the 7.1 series, with fixes landing in 7.2.6 and 7.3-rc1 - and the bug leaves an outstanding recv_io object at kmem_cache_destroy() time, later producing a NULL-pointer dereference in mempool_free_bulk. The impact is denial of service only (no confidentiality or integrity effect), triggering is unauthenticated in principle but gated on a narrow accept-failure window, so the assessed attack complexity is high; no public exploit code identified at time of analysis and no CISA KEV active-exploitation record.
An out-of-bounds read in the Linux kernel EROFS file-system driver lets a local attacker who can supply a crafted EROFS image cause unrelated kernel memory to be copied into a user-visible page cache when a victim mounts the image and reads the crafted file. The flaw requires user interaction (UI:R) and is local only (AV:L); the vendor CVSS 3.1 base is 7.1 with Confidentiality and Availability High, while independent assessment rates availability impact Low. No public exploit code was identified at time of analysis, and fixes are available in stable kernels 6.18.52, 7.2.6, and 7.3-rc1.
An access-control bypass in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated remote SMB client to have an access-granting ACE positioned beyond a DACL's declared boundary honored during SMB2_CREATE permission checks, resulting in unauthorized file reads and writes with high confidentiality and integrity impact but no availability impact. Only hosts running the ksmbd server (CONFIG_SMB_SERVER) with an actively exported SMB share are exposed - the module is not enabled by default and is far less common than userspace Samba - and the attacker must already hold an authenticated SMB session (PR:L, per CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with the ability to set a file's security descriptor. No public exploit identified at time of analysis, and the CVSS 3.1 base score is 8.1 (High); fixes are available in 6.6.157, 6.12.110, 7.2.6, 6.18.52, and 7.3-rc1.
A stale-pointer (use-after-free) lifetime bug in the Linux kernel NFSv4 client can leave a freed nfs_client reachable through the NFSv4.0 callback identifier registry, so that a later callback lookup by cb_ident takes a reference to freed memory with high confidentiality, integrity and availability impact. The defect is triggered only when the host is configured as an NFSv4.0 client and an initialization step inside nfs4_alloc_client() fails after the callback identifier has been registered - typically an allocation failure under memory pressure that is not attacker-controlled - which is why the input CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N) is badly overstated and the independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Linux kernels carrying the NFSv4 callback IDR code are affected up to the stable backports fixing it (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6 and 7.3-rc1); no public exploit identified at time of analysis, and the 'Authentication Bypass' tag does not match the assessed local, privileged failure-path defect.
NULL pointer dereference in the Linux kernel NFS client's pNFS flexfiles layout driver allows an unauthenticated remote party - specifically an NFSv4.0 data server referenced by a flexfiles layout - to crash the mounting client or drive its DS lease-renewal path into a busy-loop, yielding client-side denial of service (assessed AV:N/AC:H/PR:N/UI:N, C:N/I:N/A:H) with no code execution and no data exposure. The defect affects kernels from 4.12 up to the fixed releases 6.18.52, 7.2.6 and 7.3-rc1, but is reachable only where the client kernel is built and configured for pNFS with the flexfiles layout driver and the served layout points at a sessionless NFSv4.0 data server; NFSv4.1+ data servers carry a session and are unaffected. No public exploit code and no CISA KEV entry were identified at time of analysis, and the vendor's 7.5 (AC:L) score overstates practical reachability given the configuration prerequisites reflected in the AC:H assessment.
Out-of-bounds DMA reads and IOMMU faults, along with silent transmission of corrupted packets, can be triggered through the transmit path of the Huawei hinic3 NIC driver in Linux kernels from roughly 6.16 onward. Per the independent assessment (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H), the issue is local-only and requires an authenticated low-privileged user who can transmit a non-linear (fragmented) skb over a hinic3 interface using a tunnel checksum-offload configuration the driver cannot offload, which forces the skb_checksum_help() software fallback, linearizes the skb, and leaves the driver building a TX descriptor from a stale fragment count. Impact is availability-dominant (IOMMU fault/panic) with limited confidentiality exposure from the out-of-bounds DMA read; no public exploit code was identified at time of analysis and CISA KEV does not list this CVE. Systems without Huawei HiNIC3 hardware are unaffected regardless of kernel version, and vendor patches are available in Linux 6.18.52, 7.2.6, and 7.3-rc1.
Linux kernel's Kernel Connection Multiplexor (net/kcm) runs an attached BPF strparser program via bpf_prog_run_pin_on_cpu() without first entering an RCU read-side critical section, so BPF map operations executed by that program trigger WARN_ON_ONCE(!bpf_rcu_lock_held()) and can lead to a race-dependent memory-safety condition against a concurrently freed BPF map element. The assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - a local, low-privilege user (PR:L) on a kernel built with CONFIG_AF_KCM who can create a KCM socket, attach a BPF program and drive traffic through kcm_parse_func_strparser() is required, and the practical effect beyond a WARN splat is non-deterministic due to the race window, with impact scoped to availability (C:N/I:N/A:H). Vendor-released fixes are available for the stable branches; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Integer overflow in the Linux kernel's IPVS FTP application helper (ip_vs_ftp_get_addrport()) lets an unauthenticated remote attacker who can control an FTP PASV/EPSV reply that traverses an IPVS/LVS director wrap a data-connection port or address octet, causing the helper to program the expected data connection with a truncated port or address. Only kernels built with CONFIG_IP_VS_FTP and actively load-balancing FTP are exposed - a non-default, niche configuration - and the practical impact is confined to a misconfigured or truncated data connection rather than code execution or memory corruption, so the vendor CVSS of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) overstates real-world priority, as reflected in the independent assessment (A:N). Vendor patches are available in the stable branches (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6 and 7.3-rc1); no public exploit code and no confirmed active exploitation were identified at the time of analysis.
An out-of-bounds read in the Linux kernel's hp-bioscfg platform driver lets a malformed PSWD_ENCODINGS ACPI package cause the parser to read past the end of the ACPI object array and hand an out-of-bounds string pointer and length to hp_convert_hexstr_to_str(), resulting in kernel-memory disclosure or a kernel crash (the assessed vector is AV:L/AC:H/PR:H with high availability impact and limited confidentiality impact). Only systems running the hp-bioscfg driver - i.e. HP hardware whose firmware exposes the BIOS-configuration WMI/ACPI interface - are affected, and exploitation requires the attacker to control or modify the platform ACPI tables, since the index bound is only violated when firmware declares a non-zero encoding count without supplying enough string objects. The vendor-published CVSS of 7.7 depicts an unauthenticated, low-complexity local attacker, but this assessment rates the realistic path as higher-complexity and privileged because it depends on attacker-influenced firmware data; no public exploit code and no confirmed active exploitation were identified at time of analysis.
A heap out-of-bounds write in the Linux kernel's legacy in-tree NTFS driver (fs/ntfs) lets a local attacker corrupt kernel heap memory when a crafted NTFS filesystem image is mounted and subsequently triggers a directory index reparent, at which point ntfs_ir_to_ib() copies oversized index_root entries into an index_block_size allocation without a bounds check. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, 7.8) is local-only and requires the victim to mount and exercise an attacker-supplied image, and the maintainer explicitly notes that crafted-filesystem attacks fall outside the kernel threat model; no public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation. The real-world risk is LOW-to-MODERATE despite the High CVSS, because reach is sharply constrained by the local attack vector, the user-interaction requirement, the need for the legacy driver to be built and loaded, and the narrow reparent-only code path. Vendor-released patches are available (stable 7.2.6 and 7.3-rc1, plus the upstream commits referenced by the CVE), so exposure is largely limited to systems that still load fs/ntfs and process untrusted NTFS images.
Unprivileged local users on Linux kernels 7.1 through 7.2.5 can rewrite the reserved NTFS extended attributes ($LXUID, $LXGID, $LXMOD, $LXDEV) that record Linux ownership, permission, and device-number metadata on NTFS volumes, because the in-kernel ntfs driver accepted setxattr() on those names without any privilege check. An attacker holding an ordinary local account (CVSS 3.1 AV:L/PR:L, no user interaction) on a host where an affected kernel has an NTFS volume mounted writable can silently alter that metadata, undermining the confidentiality and integrity of the filesystem's access controls for a CVSS score of 7.1. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); exposure is limited to a narrow, very recent kernel window, with vendor-released fixes in 7.2.6 and 7.3-rc1.
Linux kernel 7.1 through 7.3-rc1 ships an iomap-based NTFS driver (fs/ntfs) whose resident-file read path, ntfs_read_iomap_begin_resident(), walks the MFT record via ntfs_attr_lookup()/ntfs_attr_find() without holding ni->mrec_lock, while ntfs_attr_record_resize(), ntfs_make_room_for_attr() and ntfs_resident_attr_record_add() memmove the same base_ni->mrec buffer under that lock. A local user who mmap-reads a small, MFT-resident NTFS file while concurrently calling link() or unlink() on it can win the narrow race window and observe torn attribute length and offset fields (KCSAN-reported at mft_record.bytes_in_use), giving a confirmed data race in the CWE-362 class that the vendor scores as high confidentiality and availability impact but which is not a directly weaponizable memory-corruption primitive. No public exploit code has been identified at the time of analysis; vendor patches are available for the affected kernels.
Out-of-bounds memory corruption during early-boot ACPI MADT parsing in the Linux kernel's irqchip/gic-v5 driver (gic_acpi_parse_iaffid) can crash or corrupt kernel memory on Arm systems that use the new GIC-v5 interrupt controller and boot via ACPI. The flaw affects mainline kernels up to the fix, with vendor-released fixes landing in Linux 7.2.6 and 7.3-rc1 (commits 6caeb878f809bdf0aec2fdd96f3d41ef4b69fc69 and 328affc639ce9873a7a0a3fd6b8339f19767529b); no public exploit code was identified at time of analysis and there is no CISA KEV listing. Although the vendor scored this 8.4 with PR:N, the realistic risk is far lower: triggering it requires GIC-v5 hardware that boots ACPI, a vulnerable kernel, and attacker control of the MADT firmware table (firmware or physical access), and the corruption occurs only during kernel initialization rather than from an unprivileged runtime process.
An off-by-one out-of-bounds write in the Linux kernel's legacy NTFS driver (fs/ntfs) allows a local user to corrupt kernel memory by mounting a crafted NTFS filesystem and reading a compressed file from it. ntfs_decompress() accepts dp_addr == dp_sb_end as a valid state, so the final symbol copy writes one byte past the destination page and leaves *dest_ofs pointing one past the sub-block end; because the page is never finalized, subsequent sub-blocks keep writing further out of bounds, producing a bounded run of writes beyond the page. The issue is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is local, requires no privileges but does require the victim to mount the image and read the offending file, and no public exploit code has been identified at time of analysis and there is no CISA KEV listing; the practical priority is moderate rather than urgent because the vulnerable code lives in the deprecated fs/ntfs driver that is frequently not built or loaded on modern systems.
Off-path attackers can defeat IP-keyed ICMP rate limiting in the Linux kernel by weaponizing the deterministic Red-Black tree that the inetpeer subsystem uses to store peer entries. Because tree ordering is derived directly from the remote IP address, an attacker who can send arbitrary packets can predict lookup and garbage-collection traversal paths, force eviction of targeted inet_peer nodes, and - when those nodes are recreated - have their token buckets reset to full capacity, yielding a rate-limit bypass and a timing oracle for inferring open UDP ports. The issue affects Linux kernel builds that carry the inetpeer code up to the fixed stable releases (6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6, and mainline 7.3-rc1); a vendor patch exists, and no public exploit has been identified at time of analysis. Our independent assessment rates this far below the vendor's CVSS 9.4: the practical impact is limited to rate-limit bypass and port-state inference (C:L/I:N/A:N, AC:H) with no memory corruption or code execution, and exploitation requires sustained packet volume plus precise timing observation - making the vendor vector's C:H/I:H/A:L materially overstated.
Linux kernel NFSv4.2 clients that use the flexible-files (flexfiles) pNFS layout driver can be driven into a permanent hang by a malicious or compromised NFS server, which returns maximally sized filehandles and network addresses through LAYOUTGET and GETDEVICEINFO so that the LAYOUTSTATS layoutupdate4 record exceeds the encoder's 256-byte reservation. When xdr_reserve_space() then returns NULL inside ff_layout_encode_io_latency(), the code path unwinds with dss_info->mirror->lock still held, leaving the lock permanently locked and hanging the client - a pure availability/denial-of-service condition with no code execution or data disclosure (C:N/I:N/A:H, vendor CVSS 3.1 7.5; our independent assessment rates the same impact but with AC:H rather than AC:L, since a hostile server, a mount relationship, and active flexfiles pNFS usage are all required). No public exploit code was identified and there is no CISA KEV entry at time of analysis; vendor-patched kernel releases are available.
NULL-pointer dereference in the Linux kernel's pNFS (parallel NFS) flexfiles data-server cache can crash an NFS client when it mounts a pNFS filesystem served by the flexfiles layout driver and connects to a server whose GETDEVICEINFO response returns two deviceids sharing one multipath data-server address but advertising different major NFS versions. The cache in nfs4_pnfs_ds_add() is keyed only on the address set, so the two mirrors alias to a single nfs4_pnfs_ds; whichever mirror connects first pins the client to its own NFS version, and the second mirror is then handed that client and selects rpc_call_ops for a protocol version the connection does not speak, causing mismatched sequence-slot handling and a kernel oops. The flaw is availability-only (no confidentiality or integrity impact), affects only hosts acting as NFS clients that mount pNFS with the flexfiles layout (CONFIG_NFS_V4_1), and there is no public exploit identified at time of analysis; exploitation requires the uncommon condition of mixed-version mirrors on a single data-server address, which is why our independent assessment raises attack complexity to AC:H relative to the vendor vector's AC:L.
Use-after-free in the Linux kernel Bluetooth L2CAP stack lets a Bluetooth-adjacent attacker corrupt kernel memory by racing an inbound L2CAP connection against the teardown of a parent listening socket, causing dereference of a dangling bt_sk(sk)->parent pointer. Kernels across the 5.10, 5.15, 6.1, 6.6, 6.12, 6.18 and 7.x stable lines are affected (EUVD lists fixed points at 6.1.188, 6.6.157, 6.12.110, 6.18.52 and 7.2.6), and exploitation requires a local process actively managing an L2CAP listener plus an attacker within Bluetooth radio range; the assessed vector is AV:A/AC:H/PR:L, so this is not default-configuration remote exploitation and hinges on winning a narrow timing window. No public exploit code has been identified at time of analysis, and the flaw is not confirmed actively exploited (CISA KEV), but vendor-released patches are available.
Kernel crashes with a NULL-pointer dereference in the Linux kernel's Bluetooth L2CAP socket layer when l2cap_sock_cleanup_listen() performs an unsafe lockless read of l2cap_pi(sk)->chan that races with l2cap_sock_kill() -> l2cap_sock_put_chan() executing on the hdev workqueue after a Bluetooth disconnect. Affected are systems built with Bluetooth support (CONFIG_BT) running unpatched Linux 6.1.x before 6.1.188, 6.6.x before 6.6.157, 6.12.x before 6.12.110, 6.18.x before 6.18.52, or 7.1.5 before 7.2; triggering requires a user able to create/operate a listening L2CAP socket (PR:L) plus an adjacent Bluetooth peer (AV:A) capable of inducing disconnect/teardown, and the timing window is narrow so the race is hard to win deterministically. Consistent with our independent assessment, the impact is confined to a kernel crash (availability only, AC:H) rather than the confidentiality/integrity impact suggested by the higher NVD-published score, and no public exploit code or confirmed active exploitation has been identified at time of analysis while vendor patches are available.
An out-of-bounds read in the Linux kernel's btnxpuart Bluetooth-over-UART driver lets an attacker who can influence frames emitted by an NXP controller force the driver to parse an 8-byte nxp_fw_dump_hdr structure from beyond the actual ACL payload, and because buf_len is what terminates a dump, a truncated frame can also abort a firmware crash dump early and reset the controller. Systems are exposed only when running the btnxpuart driver (CONFIG_BT_NXPUART) with an NXP Bluetooth controller attached over UART and the firmware-dump path active; the assessed vector is adjacent, low complexity, no authentication, no user interaction (CVSS 7.1, dominant impact A:H with limited C:L). The over-read is only a few header bytes that are not returned to the attacker, the affected hardware is niche, and no public exploit identified at time of analysis; vendor-released fixes exist.
Use-after-free in the Linux kernel's net/sched sch_teql qdisc lets a local attacker who holds CAP_NET_ADMIN (and can create a teql master with at least two slaves) leave skb->dev pointing at a slave net_device that is later freed, yielding kernel memory corruption, potential code execution, or a crash. The bug requires CONFIG_NET_SCH_TEQL, a transmit failure on one slave, a subsequent slave with an unresolved neighbour that queues the skb on arp_queue, and deletion of the prior slave within a narrow race window, so the assessed vector is AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H while NVD lists CVSS 7.8 with AC:L. Affected releases are Linux stable branches up to the fixed versions (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6, 7.3-rc1); no public exploit code or confirmed active exploitation was identified at time of analysis.
An out-of-bounds write in the Linux kernel's crypto ACOMP (asynchronous compression) layer allows a local user with low privileges (PR:L) to corrupt kernel slab memory on hosts running affected kernels - Linux 6.16 and kernels built from the 097c432caaa6 lineage before the 7.2.6, 6.18.52 and 7.3-rc1 fixes. The flaw arises because acomp_request_clone() copies only a stack-sized synchronous request when an asynchronous provider such as Intel QAT is selected, leaving no storage for the provider's request context, which is then written past the allocation through acomp_request_ctx() and detected by KASAN as a slab OOB write. Exploitation is constrained by the local vector and the need for an active asynchronous acomp provider, with no remote reach; there is no public exploit identified at time of analysis.
Remote denial of service in the Linux kernel's libceph Ceph messenger v2 client (net/ceph/messenger_v2.c), introduced with the in-kernel msgr2 client in Linux 5.11, allows a peer that controls the server side of a Ceph connection - or a man-in-the-middle - to send a banner whose payload_len field is smaller than the 16 bytes required for the server_feat and server_req_feat integers, causing the kernel to stage a 0-length socket read that trips the iov_iter invariant in populate_in_iter() and aborts the connection with a WARNING. The practical impact is limited: with default settings this yields a logged kernel warning and dropped connection, but hosts configured with panic_on_warn=1 will suffer a remote kernel panic, and the WARNING itself provides a weak log-flooding factor. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, though the vendor has shipped fixes across all supported stable branches.
Netfilter nf_tables in the Linux kernel performed the hardware-offload step before allocating the chain blob during ruleset commits, so an allocation failure at that point could leave the NIC-offloaded ruleset diverging from the in-kernel software ruleset. Affected are Linux kernel builds with nf_tables hardware offload enabled on an offload-capable NIC; the fix landed in stable releases 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52 and 7.2.6/7.3-rc1, and the bug traces back to code introduced in the 5.3 series. Exploitation requires local access with CAP_NET_ADMIN and an error/resource-pressure path, so no public exploit has been identified at time of analysis.
Remote unauthenticated packet reception can panic Linux kernel systems that use the stmmac Ethernet driver on ARM32 platforms where unaligned CPU loads trap, yielding a CVSS 3.1 base score of 7.5 with availability-only impact. The defect is a missing NET_IP_ALIGN in the stmmac RX DMA offset after the zero-copy RX conversion (commit df542f669307), so inbound IP headers land misaligned; on affected ARM32 hardware any received packet such as an ICMP echo request triggers an alignment exception and kernel panic. Patched kernels include 6.18.52, 7.2.6, and 7.3-rc1, and no public exploit code was identified at time of analysis.
Use-after-free in the Linux kernel's SLIP line discipline allows an authenticated local attacker with the ability to attach the SLIP discipline (historically gated by CAP_NET_ADMIN) to corrupt kernel memory by racing a tty hangup against slip_receive_buf(). The flaw is caused by slip_hangup() calling slip_close() under only the tty->ldisc_sem read lock, freeing the netdev and struct slip while a concurrent reader may still dereference it. Vendor patches are available in 7.2.6, 6.6.157, 7.3-rc1, 6.12.110, 6.1.188, and 6.18.52; no public exploit identified at time of analysis, and our assessment notes the local-only, race-dependent nature lowers practical risk despite the vendor CVSS of 7.8.
A local heap out-of-bounds write exists in the Linux kernel's dm-integrity device-mapper target when a keyed sector marker is configured with a tag size smaller than the hash digest size, allowing a local actor holding some privilege to write past the end of a kmalloc'ed checksums buffer (the description cites a 4MiB discard under hmac(sha256) with tag size 16 writing 16 bytes beyond the page). It is assessed as CVSS 7.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting a locally reachable kernel memory-corruption primitive requiring low-level local privileges and a non-default dm-integrity configuration. Vendor fixes are available as stable-branch commits (59e6f919d77d72ec79cbf171256f2f7819737580, 9988c1c9e0d1c78391e3d8e2817beb667470c76f, dd08a645195f410f2dcaa40de379a45ce110e873) and no public exploit was identified at time of analysis, with no CISA KEV listing.
The Linux kernel's device-memory (devmem) TCP transmit path accepts non-zero-copy transmit requests that it should reject, allowing a local attacker with a low-privileged account to drive the kernel into copying from iovecs that actually contain dma-buf offsets instead of page pointers, breaking skb frag invariants and leading to high-impact confidentiality and integrity loss (assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected systems are Linux 6.16 and later kernels built with devmem TCP support where the transmit device does not advertise NETIF_F_SG, or where an io_uring request is crafted with a dmabuf_id and zero-copy flags but no valid devmem binding. No public exploit code has been identified at time of analysis, and the feature is new and rarely enabled, so realistic exposure is narrow; the vendor has released fixes in stable releases 6.18.52 and 7.2.6 and in 7.3-rc3.
Improper neutralization of newline sequences in NetworkManager-fortisslvpn credential handling allows a local user who can create or modify a FortiSSL VPN connection profile to inject directives that the root-privileged VPN helper executes, resulting in local privilege escalation to root. The flaw is scored 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was reported by Ubuntu, with Red Hat tracking it through its CVE page and Bugzilla 2533640 against an upstream tracking item in the archived GNOME GitLab project. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so risk is concentrated on multi-user Linux hosts where the plugin is installed and ordinary console users are permitted by policy to configure VPN connections.
Local privilege escalation in the NetworkManager-vpnc plugin lets a low-privileged user who can create or edit VPNC connection profiles inject a newline character into the username field, causing that value to spill into the root-run vpnc password helper and ultimately execute with root privileges (CWE-93, CVSS 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack requires local access and an unprivileged account with write permission to NetworkManager connection profiles, plus the vpnc plugin installed and in use; no victim interaction is needed because the attacker only uses their own session. It is not remotely reachable and there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, making this a prompt-patching priority for affected Ubuntu/RHEL systems that ship the plugin rather than a mass-exploitation emergency.
Local privilege escalation in the NetworkManager iodine VPN plugin (network-manager-iodine) lets an authenticated local user obtain code execution as root through option confusion in the root-privileged nm-iodine-service. A user who is permitted (typically via polkit for an active session) to create or edit an iodine VPN connection can supply a connection property value that iodine's command-line parser interprets as an option flag instead of data, producing behaviour that runs while the service is still root and before iodine drops privileges to an unprivileged user. Exploitation requires local access plus an installed, configured plugin, and no public exploit was identified at time of analysis; the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (high confidentiality, integrity and availability impact, scope unchanged). Note that no CVSS vector, CWE, EPSS, KEV, SSVC or POC signal was supplied in the source data, so severity here derives from the independent assessment rather than vendor scoring.
Local privilege escalation in NetworkManager-vpnc allows an authenticated low-privileged local user (CVSS AV:L/PR:L) who can create or modify VPNC-type VPN connection profiles to inject CRLF sequences into configuration fields, which are then serialized into the vpnc configuration file and acted on with root privileges. The flaw is an incomplete fix for CVE-2018-10900 and is classified as CWE-93 CRLF injection, with a CVSS 3.1 base score of 7.8 reflecting high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and exploitation is bounded by local access plus the presence of the optional plugin and profile-modification rights, so hosts where only administrators manage VPN connections are not exposed to unprivileged escalation.
Path traversal and arbitrary file write in the oras-go OCI artifact library prior to 2.6.2 allow a malicious artifact layer marked with the io.deis.oras.content.unpack=true annotation to escape the content/file.Store extraction root and create or overwrite any file writable by the pulling process, potentially leading to code execution. Exploitation is unauthenticated from an attacker's network position (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction (UI:R) because the victim must pull the attacker-controlled artifact reference; the bug bypasses the AllowPathTraversalOnWrite=false default, so no permissive configuration is needed. Scored 8.8 High, with no public exploit identified at time of analysis and no CISA KEV listing; a vendor patch is available in oras-go 2.6.2.
Denial of service in ISC BIND 9 recursive resolvers affects versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the subscription builds 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1. A validating resolver can be crashed when an authoritative server it queries returns a valid wildcard answer with a signed NSEC3 proof immediately followed by an unsigned NSEC record at the same owner name, causing an unexpected program exit via a reachable assertion (CWE-617). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this 7.5, availability-only, and exploitation requires the attacker to control or be on-path to the authoritative server answering the resolver's query, so an arbitrary external client cannot trigger the crash by sending queries alone; no public exploit code or CISA KEV entry was identified at time of analysis.
Denial of service in ISC BIND 9 allows a remote, unauthenticated attacker to terminate the named daemon by sending a single DNS query of QTYPE TKEY, causing an assertion failure and unexpected process exit, but only on servers loaded with a named.conf file that contains no global 'options' block. Affected builds are 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1; the CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting availability-only impact with no confidentiality or integrity loss. The prerequisite configuration (missing global options block) is uncommon in production deployments, which meaningfully limits real-world exposure; no public exploit code and no confirmed active exploitation were identified at the time of analysis, though the trigger is trivial to send for anyone who can reach the resolver or authoritative port.
Denial of service in ISC BIND 9 allows remote, unauthenticated attackers to terminate the named resolver process when it processes a specifically malformed answer that interacts with the DNS64 synthesis feature. Only resolvers explicitly configured with the dns64 option are affected - a non-default, opt-in capability - but for those systems any client of the resolver loses name resolution when named exits. The bug is a use-after-free (CWE-416) reachable from the network with low complexity (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), affecting BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the corresponding -S1 subscription builds. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation; vendor patches are available as BIND 9.20.29 and 9.21.26.
Resource exhaustion in ISC BIND 9 recursive resolvers allows unauthenticated remote attackers to cause a denial of service by repeatedly triggering a memory leak through crafted SVCB/HTTPS AliasMode records that reference 14 or more ServiceMode records. Affected versions include 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and corresponding -S1 subscription builds; patched versions are 9.20.29 and 9.21.26. No public exploit code has been identified at time of analysis, but the vulnerability is remotely exploitable without authentication and can gradually exhaust resolver resources, disrupting recursive lookups.
Unauthenticated remote attackers can abort the `named` process in BIND 9 by sending a crafted DNS-over-HTTPS request that carries a cryptographically invalid SIG(0) record and then prematurely closing the transport connection, producing a null pointer dereference (CWE-476) that terminates the server. Affected versions are 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the 9.20.9-S1 through 9.20.27-S1 subscription branch; the assessed CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), meaning no authentication or user interaction and availability-only impact. Exploitation requires the targeted named instance to have the DoH transport enabled and to process SIG(0)-signed messages, so server deployments without DoH exposed to the attacker have no reachable attack surface; impact is limited to a process abort with no data disclosure or modification. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available (9.20.29 and 9.21.26).
Remote denial of service in ISC BIND 9 lets an attacker-controlled (or spoofing-capable) authoritative DNS server crash a recursive resolver by returning a negative answer of exactly 65536 bytes, which `named` caches as a zero-length entry and later aborts on when the entry is read. The flaw affects 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the corresponding -S1 subscription releases, requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and is present in default configurations, though reachability is limited to resolvers that actually recurse against attacker-influenced or spoofable zones and then read the poisoned cache entry. Vendor patches are available (9.20.29 and 9.21.26); no public exploit identified at time of analysis, and the impact is availability-only with no confidentiality or integrity loss.
CPU-exhaustion denial of service in ISC BIND 9 recursive resolvers (9.18.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25, plus the 9.18.11-S1-9.18.50-S1 and 9.20.9-S1-9.20.27-S1 preview builds) can be triggered by a single remote, unauthenticated query for the root of an already-cached tree of SVCB/HTTPS AliasMode records. Once such an AliasMode chain is resident in the resolver cache, the triggering query causes the resolver to spend disproportionate CPU time constructing the response, degrading or stalling name resolution for all clients of that resolver; impact is availability-only with no confidentiality or integrity effect. The assessed CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is well calibrated, but exploitation is conditional on the attacker first causing the SVCB/HTTPS AliasMode tree to be resolved and cached (for example from an attacker-controlled zone) before issuing the trigger query; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Improper bit placement in the Linux kernel's zram slot-locking code allows a local, authenticated user on 64-bit big-endian systems (s390x, big-endian ppc64, sparc64) to corrupt a per-slot lock word, which can let two CPUs take the same slot lock simultaneously or leave a slot appearing permanently locked, yielding low integrity impact and possible hangs or availability loss. Exploitation requires a 64-bit big-endian kernel built with ZRAM_TRACK_ENTRY_ACTIME enabled, active zram usage (swap or block device) with local activity reaching mark_slot_accessed()/slot_free(), and a successful concurrency race; little-endian architectures such as x86-64 and arm64 are unaffected because the lock bit lands in the correct half of the word there. No public exploit has been identified at time of analysis, and although the vendor assigns CVSS 7.8 (AV:L/AC:L/PR:L/C:H/I:H/A:H), the independent assessment (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) rates real-world risk materially lower given the big-endian-only, race-dependent, non-default-config prerequisites.
A use-after-free in the Linux kernel NFSD (kernel NFS server) export-state revocation path can crash the server when a privileged administrator runs 'exportfs -u' to revoke an export while an NFSv4 client is concurrently expiring. Only recent 7.2.x kernels before 7.2.5 (and mainline before 7.3-rc1) are affected, and the trigger requires root/CAP_SYS_ADMIN on the NFS server plus a narrow race in which nn->client_lock is dropped across revoke_one_stid() and a subsequent read of clp->cl_minorversion, allowing a teardown to free the nfs4_client still being dereferenced. The realistic impact is a kernel crash / denial of service on the NFS server rather than remote code execution or data compromise; the vendor-supplied CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) drastically overstates real-world risk, and no public exploit code has been identified at time of analysis. A vendor patch is available (7.2.5 stable and 7.3-rc1).
A use-after-free in the Linux kernel's usbtv media driver ALSA audio path can crash the kernel or trigger limited memory corruption when a Fushicai USBTV007 USB analog TV/audio capture device is physically disconnected while a local user still has the PCM substream open. The driver frees its per-device state (struct usbtv) during the disconnect path while ALSA still references it via pcm->private_data, so a later snd_usbtv_pcm_close() dereferences freed memory; the kernel fix takes an extra V4L2 device reference for the lifetime of the ALSA card and releases it in the card's private_free callback. Vendor CVSS is 7.8, but the independent assessment rates the practical risk lower (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) because exploitation requires the specific USB hardware, a local user with ALSA access, a USB unplug race, and yields no confidentiality impact under assessment; no public exploit code or confirmed active exploitation was identified at time of analysis.
A race condition in the Linux kernel's Qualcomm PMIC USB Type-C driver (qcom-pmic-typec) can leave the cc_debounce_dwork delayed work queued after the port is torn down, resulting in a use-after-free once devres frees the pmic_typec_port structure. Systems running affected kernels from roughly 6.5 through the unfixed 6.12.110/6.18.51/7.2.5 baselines on Qualcomm PMIC Type-C hardware - typically Snapdragon-based phones and embedded boards - are exposed. Exploitation requires local privileged access (root or CAP_SYS_ADMIN) to trigger the port_stop()/tcpm_unregister_port() teardown path and the ability to win a narrow TCPM-kthread timing race; no public exploit code has been identified at time of analysis, and the independent assessment rates the practical severity lower than the vendor's published CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8), assigning AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H instead.
A use-after-free race in the Linux kernel's Qualcomm PMIC USB Type-C Power Delivery PHY driver (qcom-pmic) can be triggered during driver teardown: pdphy_stop() disables the PD interrupts but does not flush the pending reset_work work item, so if the IRQ handler schedules that work just before disable_irq() takes effect, the work can execute after remove() has already freed the containing structure through devm. Reachability is narrow - it requires local privileged access (the ability to unbind/remove the driver, typically root-gated), the specific Qualcomm PMIC Type-C hardware, and winning a tight timing window, so the assessed vector is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H rather than the higher base score sometimes published. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the flaw was found by an in-house static analysis tool.
Out-of-bounds array indexing in the Linux kernel's USB Type-C UCSI DisplayPort alternate-mode driver (drivers/usb/typec/ucsi/displayport.c) can crash the kernel when the UCSI platform firmware returns a GET_CURRENT_CAM response that exceeds UCSI_MAX_ALTMODES without being 0xff. All Linux kernels exposing the ucsi_displayport code path - introduced around 5.2 and present on modern USB-C laptops with DisplayPort alt-mode - are potentially affected; the vector is local (CVSS:3.1/AV:L/AC:L/PR:N/UI:N) and requires either rogue/buggy PPM firmware or a malicious USB-C DisplayPort partner to steer the alternate-mode negotiation, so stock systems with honest firmware are not reachable. Impact is limited to a kernel crash (denial of service); no confidentiality or integrity impact is supported by the assessed vector, and no public exploit code or CISA KEV entry has been identified at time of analysis.
Use-after-free in the Linux kernel's USB MIDI 2.0 gadget function driver (f_midi2) allows a local attacker who already holds privileged access to the gadget configfs interface to corrupt or read freed memory by winning a narrow race between a string attribute's show path and a concurrent store. The show handler f_midi2_opts_str_show() dereferences opts->info.<field> before acquiring opts->lock, while f_midi2_opts_str_store() frees the previous string under that same lock, so a colliding read can touch a pointer that has already been released - affecting iface_name, block name, and the EP string option attributes. Exploitation requires CAP_SYS_ADMIN-level local access to configfs on a kernel built with USB gadget support and f_midi2 configured; it is not remotely reachable, and no public exploit code or confirmed active exploitation was identified at time of analysis. NVD scores this at CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while our independent assessment rates it lower (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H) because of the privileged prerequisite and the narrow, timing-dependent race window.
A stack buffer overflow in the Linux kernel's staging rtl8723bs Wi-Fi driver allows an unauthenticated attacker within radio range to corrupt kernel memory by sending a crafted WPS information element in a beacon or probe-response frame that the target parses while scanning. Because the driver trusts an attacker-controlled 2-byte WPS attribute length as a memcpy() size without comparing it against the remaining bytes of the IE, the copy overruns single-byte stack variables such as the selected-registrar flag at call sites in ioctl_cfg80211.c and rtw_mlme_ext.c, yielding a kernel crash and, depending on build hardening, possible code execution; the independent assessment rates this AV:A/AC:L/PR:N/UI:N with high integrity and availability impact (confidentiality rated none). No public exploit code or confirmed active exploitation has been identified at time of analysis, and exposure is confined to systems with this niche driver loaded and an adversary physically close enough to inject 802.11 management frames.
A 1-2 byte out-of-bounds read in the Linux kernel's rtl8723bs staging Wi-Fi driver (rtw_action_frame_parse) lets a local attacker who can inject 802.11 management action frames cause a kernel fault, with practical impact typically limited to a crash when the read crosses a page boundary. The vendor assigned CVSS 7.1 (AV:A/AC:L/PR:N), but our independent assessment rates it CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L because exploitation requires the rtl8723bs driver to be loaded and bound to Realtek RTL8723BS hardware plus local interface access (typically CAP_NET_ADMIN) to reach the cfg80211 mgmt_tx path or a monitor-mode interface. No public exploit code identified at time of analysis, and this is not confirmed actively exploited (CISA KEV); vendor-released patches exist for the affected stable branches.
A use-after-free in the Linux kernel ftrace tracing subsystem lets a privileged local user crash the machine by racing a read of the newly added per-instance show_event_filters or show_event_triggers files against deletion (rmdir) of the trace instance those files belong to. The bug affects kernels that ship these files, i.e. roughly Linux 7.0 through the pre-fix 7.2.x and 7.3-rc series, and it was resolved by taking a trace_array reference in the files' open path (commits f4a771cc684c and 2ee3f7d43f79). Exploitation requires local access to a mounted tracefs, PR:H privileges per the assessed vector (normally root/CAP_SYS_ADMIN), and winning a tight timing race; there is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV), so real-world risk is far below the headline 7.8 score.
Corrupted or attacker-crafted OCFS2 on-disk metadata can trigger an out-of-bounds read in the Linux kernel because inode-block validation (ocfs2_validate_inode_block) never bounds-checked inline xattr entry name/value offsets, allowing getxattr()/listxattr() to walk past the inline storage and producing a KASAN use-after-free READ in ocfs2_xattr_find_entry(). Exploitation is local and requires the victim to mount or read a malicious OCFS2 image (CVSS:3.1/AV:L/AC:L/PR:L/UI:R), so the practical exposure is limited to systems that mount untrusted OCFS2 volumes such as removable media, shared disk images, or cluster-shared storage; no public exploit identified at time of analysis. Vendor-released fixes exist in the 7.2.6 stable release and the corresponding mainline 7.3-rc1 merge.
Out-of-bounds metadata reads in the Linux kernel's ocfs2 filesystem allow a local attacker who can mount a crafted or corrupted ocfs2 volume to walk past the ends of external extended-attribute structures, producing a kernel crash (reproduced as a KASAN out-of-bounds/use-after-free read in ocfs2_xattr_list_entries) and a potential leak of kernel memory contents. The flaw exists because ocfs2_validate_xattr_block() checks only the xattr block header and never confirms that a non-indexed block's xh_count and entry offsets fit inside the block, while indexed xattr buckets reach list/get consumers after ECC without any entry-bounds check; any local listxattr() or getxattr() call against files on a malicious volume then triggers the walk. Exploitation is not remote and depends on the attacker controlling on-disk metadata (mount privilege or user interaction to attach an attacker-supplied device); the primary outcome per our assessment is denial of service via kernel crash rather than reliable code execution, and no public exploit code was identified at time of analysis.
A use-after-free race condition in the Linux kernel's OMAP DRM DSI display driver (drm/omapdrm) lets a locally authenticated user crash the kernel by forcing interrupt-handler teardown while a handler is still running against a stack-allocated object. The driver made a private copy of its ISR table so entries could be unregistered at runtime, but nothing actually uses that mechanism, so the copy serves only to create a window where IRQ unregistration can free state still referenced by an in-flight handler. Exploitation requires local access to TI OMAP-family hardware with an active DSI-connected panel and a successful timing race; no public exploit code has been identified at time of analysis, and the realistic outcome is denial of service (kernel crash), not privilege escalation.
A type-confusion flaw in the Linux kernel BPF verifier lets a local user who is allowed to load eBPF programs (CAP_BPF or CAP_SYS_ADMIN) turn an otherwise-rejected load-acquire of a disallowed context pointer - such as the sk field of struct __sk_buff - into an unchecked raw read of the underlying kernel object, after which the register can be reused with an inconsistent pointer type. Kernels from 6.15 up to the fixed stable releases 6.18.52 and 7.2.6 (mainline 7.3-rc1) are affected. CVSS 3.1 rates it 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code and no CISA KEV entry were identified at time of analysis, and real-world exposure is narrowed because unprivileged BPF is disabled by default (kernel.unprivileged_bpf_disabled=1) on mainstream distributions.
A use-after-free race condition in the Linux kernel's RDMA/erdma driver (present since Linux v6.0) lets a local user with RDMA verbs access crash or destabilize the kernel on hosts where the erdma module - the driver for Alibaba Elastic RDMA Adapter hardware, typically seen on Alibaba Cloud ECS instances - is loaded. The bug occurs because the EQ (event queue) handler looks up completion queues from dev->cq_xa and invokes their callbacks outside the xarray lock, while erdma_destroy_cq() can concurrently erase the CQ and free its queue buffer and doorbell record, leaving the handler operating on freed memory. Exploitation requires winning a narrow timing race between CQ destruction and a previously scheduled EQ handler, so the independent assessment scores the impact as high availability loss with no confidentiality or integrity effect; vendor patches are available for the affected stable branches, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Use-after-free in the Linux kernel's RDMA/erdma driver (Alibaba Elastic RDMA) lets a local, low-privileged user who can reach an erdma RDMA device kernel-crash the host by racing a queue-pair teardown against asynchronous-event (AE) or iWARP connection-management (CM) processing that looks the QP up in dev->qp_xa and dereferences it outside the xarray lock. Only systems with the erdma driver loaded and an accessible erdma/verbs interface are exposed - in practice specific Alibaba Cloud instance types - and exploitation is local-only, requiring a narrow concurrency window rather than a remote or unauthenticated path. Vendor-released patches exist (Linux 6.12.110, 6.18.52, 7.2.6, and 7.3-rc1), no public exploit code was identified at time of analysis, and the realistic risk is denial of service (kernel crash/instability) rather than the information-disclosure framing suggested by the input tagging.
A race in the Linux kernel's iSER (IB/isert) iSCSI target transport lets an initiator on an RDMA fabric crash the target host: the final iSCSI Login Response is put on the wire before __transport_register_session() has populated the session's se_tpg, so a SCSI command issued immediately after the initiator sees login success reaches target_submit() against a half-initialized se_session and the ib-comp-wq worker oopses on a NULL/non-canonical pointer dereference (KASAN null-ptr-deref at offset 0x78). Only LIO/TCM iSCSI targets using the isert RDMA transport over InfiniBand, RoCE, or iWARP are affected; plain iscsi-TCP and cxgbit are not, because they already pull PDUs from iscsi_target_rx_thread. Exploitation is a probabilistic race (the maintainer reproduced the oops in 10 of 20 unpatched runs over rxe), vendor CVSS is 7.5 while our assessed vector is AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H given the RDMA-fabric adjacency requirement and timing difficulty; there is no public exploit code and no CISA KEV listing at time of analysis.
A use-before-initialization race in the Linux kernel's iSER target stack (IB/isert) lets a non-compliant iSCSI initiator crash the target host by issuing a SCSI command before it has received the final Login Response, dereferencing a se_session whose se_tpg is still NULL and producing a kernel oops at target_submit+0xbe. Only systems running the LIO/isert target over an RDMA fabric (InfiniBand, RoCE, or iWARP) are affected, and the exploit window is sub-millisecond - a median of roughly 92 microseconds before the fix, widening to about 172 microseconds after re-posting the buffers later in the login flow. Impact is availability only (denial of service via kernel panic), no public exploit has been identified at time of analysis, and although the published CVSS of 7.5 looks high, our independent assessment rates it AV:A/AC:H with a low real-world priority because success is probabilistic and requires a deliberately non-compliant initiator on the RDMA fabric.
Use-after-free in the Linux kernel's RDMA siw (software iWARP) driver lets a local low-privileged user crash the kernel by passing a queue pair that is already in the RTS state to siw_accept(). The flaw lies in the error-cleanup path, which assumes the current call installed the QP-to-endpoint association and therefore releases the wrong endpoint reference, potentially freeing the incoming endpoint before a subsequent cep->qp store and also tearing down a pre-existing association. Real-world impact is bounded: the vulnerable path requires the siw driver to be loaded and a siw device configured (not present in default server or desktop installs), and the trigger depends on a race window in which the freed endpoint loses its remaining references in time; the realistic outcome is a kernel crash (denial of service) rather than code execution or data disclosure. No public exploit code has been identified at time of analysis, and the vendor CVSS score of 7.8 (C:H/I:H/A:H) overstates the risk relative to the independent assessment, which rates confidentiality and integrity impact as none and availability as high.
Use-after-free in the Linux kernel's kmod request-deduplication code (module/dups) allows a local authenticated user who can force concurrent kernel module auto-load requests for the same module to race kmod_dup_request_delete() against kmod_dup_request_exists_wait() and free a kmod_dup_req structure while another thread still holds a reference to it, corrupting kernel memory. The flaw was introduced with the kmod dups code in Linux 6.4 and is fixed by the stable commits referenced under CVE-2026-90291; no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). Although the vendor scores this 7.8 with confidentiality and integrity impact, our independent assessment rates it substantially lower (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) because the race is non-deterministic and crash-primary, with no demonstrated path to code execution or data disclosure.
Double release of an OpenFirmware device-tree node reference in the Linux kernel's Renesas R-Car Gen2 USB PHY driver (drivers/phy/renesas/phy-rcar-gen2.c) can corrupt kernel memory and crash the system if PHY creation fails during driver probe. Only R-Car Gen2 automotive/embedded ARM platforms are affected, and the bug is reachable only at boot or module load when devm_phy_create() returns an error, not from ordinary userspace requests - per the authoritative independent assessment the impact is availability-only (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), with the vendor's PR:N / C:H/I:H/A:H vector not reflecting the real prerequisites. Vendor-released patch: Linux 7.2.6 and 7.3-rc1 (stable commits b780b892 and 5374f3d5); no public exploit was identified at time of analysis.
The Linux kernel's amdgpu driver for GFX6 (Southern Islands) hardware fails to use the PFP (pre-fetch parser) on compute queues, letting a local user who can open the DRI/render node submit a sequence of GPU command submissions in which the PFP starts executing the next submission while the ME is still working through the previous one; the resulting out-of-order register writes and fence waits can corrupt GPU command-stream state, leak stale register/memory contents, or hang the GPU and driver. Only systems with AMD GFX6-era GPUs (Radeon HD 7700/7800/7900-class and rebadges, roughly 2012) driven by amdgpu are affected, and the race is probabilistic because the attacker must win a narrow ordering window; authentication requirements per the CVSS vector are local with low privileges (PR:L), and no public exploit code was identified at time of analysis. Note that the vendor score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) overstates real-world risk: our assessment reduces it to AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H because the race is difficult to time reliably, the impact stays within the local kernel/GPU context rather than crossing a security scope boundary, and confidentiality/integrity effects are limited, with availability (GPU/system hang) being the most likely observable outcome.
A flawed error path in the Linux kernel's SCSI disk (sd) driver can free a disk object that has already been registered with the driver core when the driver's large DMA pool allocation fails during probe, corrupting kernel memory, leaking a sysfs entry and taking the host down. Exposure is limited to systems running an affected kernel (through the 7.1 series) where a SCSI/SATA/SAS/USB disk is being attached and sd_large_pool_create() fails at exactly the post-registration moment, so the authoritative assessment rates this as local, high-complexity and requiring privileged access rather than the remote 8.1 vector published by the vendor. No public exploit code or confirmed active exploitation exists at time of analysis; fixed builds are Linux 7.2.6 and 7.3-rc1, tracked by upstream commits 748a14a0d41cfe3017251c11b314f85045414942 and e3cc6ea1a745e7f5d326f919a428b244fa119d8f.
Incorrect zero-out handling in the Linux kernel's btrfs zoned-mode write path can corrupt on-disk filesystem metadata, because btree_csum_one_bio() memzeroed an extent buffer's own folios in place while the buffer could still be referenced, so a later btrfs_free_tree_block() read a zeroed header and freed bytenr 0, corrupting the extent tree. Only Linux kernels running btrfs on a zoned block device (ZNS NVMe or host-managed SMR) from the 6.8 era through the fixed stable releases are affected; non-zoned btrfs deployments are unaffected. Triggering requires local authenticated filesystem activity with heavy concurrent metadata operations (the upstream report notes it reproduces flakily under fsstress/xfstests generic/461 and generic/013), authentication requirements follow the assessed vector as PR:L, and no public exploit identified at time of analysis. The impact is integrity and availability of filesystem metadata (potential abort/ASSERT and metadata loss), not a remotely reachable or memory-disclosure primitive.
A race condition in the Linux kernel's Bluetooth L2CAP subsystem allows a use-after-free of the hci_conn::l2cap_data pointer: the disconnect-work handler (disc_work) reaches l2cap_disconn_ind via hci_conn_timeout and hci_proto_disconn_ind and dereferences l2cap_data without locking, so a concurrent teardown that deletes the associated l2cap_conn can free the structure out from under that read, crashing or corrupting kernel memory. Affected systems run kernel builds in the 6.6.84 through 6.14 ranges listed by EUVD that lack the proto_lock fix, and the attacker must be within Bluetooth radio range (AV:A) and unauthenticated (PR:N); the trigger is timing-dependent, requiring a race to be won rather than a deterministic sequence. Independent assessment rates real-world impact as availability-only (C:N/I:N/A:H) at high attack complexity (AC:H), well below the vendor's 8.8 vector, and no public exploit code or CISA KEV listing has been identified at time of analysis; headless servers and systems without Bluetooth hardware or an enabled Bluetooth stack are not exposed.
A memory leak combined with a use-after-free in the Linux kernel's Bluetooth HCI connection-setup path can crash the kernel or gradually exhaust kernel memory when a synchronous (SCO/eSCO) audio connection setup entry is cancelled instead of executed. The defect is in hci_setup_sync(), which queues a wrapper context (conn_handle_t) carrying a NULL destroy callback and a bare hci_conn pointer, so cancelling the entry leaks the context and freeing the connection while its setup work is still queued leaves the driver dereferencing memory it no longer owns. Kernels built with the Bluetooth HCI sync path and containing the introducing commit across the 6.1, 6.6, 6.12, 6.18 and 7.x stable branches are affected; exploitation is timing- and teardown-dependent and practically limited to denial of service, with no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV). Note that the vendor CVSS 3.1 base of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is judged to overstate real-world risk; an independent assessment scores it CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, i.e. an availability-only impact.
An integer overflow in the Linux kernel's AppArmor verify_tags() bounds check allows an authenticated local attacker with low privileges to trigger an out-of-bounds read by loading a crafted AppArmor policy blob, primarily causing a kernel crash and limited potential information disclosure. Reachability requires the ability to manage AppArmor policy; under the default unprivileged_userns_apparmor_policy=1 setting an unprivileged user in a matched-level nested user namespace can reach the path, otherwise CAP_MAC_ADMIN in the initial user namespace is required. The assessed vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, no public exploit was identified at time of analysis, and vendor patches exist.
A locking regression in the Linux kernel's iommu/dma MSI page allocator lets a local actor with VFIO device-fd access corrupt the shared msi_page_list when two passthrough devices are merged into a single IOMMU domain under VFIO type1's legacy container mode. The flaw only manifests on IOMMUs that publish IOMMU_RESV_SW_MSI (in practice ARM SMMU), where the caller's per-group mutex is insufficient because the merged domain is shared across groups; a race between two concurrent iommu_dma_get_msi_page() calls is required, so exploitation is timing-dependent and local-only - x86 systems without SW_MSI regions and iommufd-based setups (which serialize through sw_msi_lock) are unaffected. No public exploit code has been identified at time of analysis; vendor-released fixes are available in Linux 6.18.52, 7.2.6, and 7.3-rc1.
Intel VT-d (iommu/vt-d) context-entry teardown in the Linux kernel can briefly expose IOMMU hardware to a torn 128-bit context entry, yielding spurious DMA faults or unpredictable IOMMU behaviour during the copied-context handover path used by kexec/kdump-style kernel transitions. The defect sits in copied_context_tear_down(), which zeroes the entry via context_clear_entry() while the Present bit is still set and only then issues context-cache and IOTLB invalidations, so hardware may fetch a partially zeroed entry that still appears present; on IOMMUs without coherent access to the context table there is additionally no cacheline flush before invalidation. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor CVSS of 8.1 is significantly overstated relative to the independent assessment (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H), which characterises this as a local, high-complexity race reachable only through a kernel-internal boot/teardown path, with random spurious faults rather than a controllable memory-corruption or disclosure primitive.
Linux kernel's Intel VT-d IOMMU scalable-mode probe failure path can leave context entries pointing to a freed PASID table, leading to a kernel crash (availability-only DoS). Affected systems are x86 hosts using Intel VT-d in scalable mode with PCI(e) devices that expose a dma_alias_mask, and the bug is reachable only when intel_pasid_setup_sm_context() fails partway through programming multiple RIDs during device probe or hot-plug. No public exploit code or CISA KEV entry was identified at time of analysis; exploitation requires high privileges (CVSS PR:H) and the assessed impact is availability-only.
Use-after-free in the Intel VT-d IOMMU teardown path of the Linux kernel (6.11 and later, including stable branches before 6.18.52/7.2.6/7.3-rc1) leaves a cleared DMA-alias context entry cached when domain_context_clear_one() or device_pasid_table_teardown() flushes using the device's own requester ID instead of the alias SID. A local actor able to destroy IOMMU domains or unbind/detach devices (assessed PR:H, effectively CAP_SYS_ADMIN) can cause the IOMMU to walk freed PASID-directory memory, giving likely memory-corruption and availability impact within a confined, privilege-gated teardown scenario. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor CVSS 8.8 overstates risk, and the assessed vector is AV:L/PR:H/UI:N/S:U with low confidentiality/integrity and high availability impact.
Memory-safety corruption in the Linux kernel's netfilter nft_ct conntrack expectation code lets a local user with CAP_NET_ADMIN in a network namespace leave a stale hlist pointer (.pprev) behind after the conntrack extension area is reallocated, enabling use-after-free style reads and writes against freed memory. Affected systems run kernels from 5.3 up to the versions fixed by 7.2.6 and 7.3-rc1, and exploitation requires the nf_conntrack/nft_ct subsystem to be in use plus the ability to install an nft_ct rule that creates custom expectations and then drive matching traffic; the assessed CVSS is 5.9 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H), meaning denial of service and limited disclosure/modification rather than the C:H/I:H/A:H impact suggested by the vendor's 7.8 score. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the affected code path is reachable by unprivileged users on multi-tenant or container hosts where unprivileged user namespaces are enabled.
A data race in the Linux kernel's SUNRPC socket transport layer (xprtsock) allows a stale sk_data_ready or sk_write_space callback snapshot to be invoked after SUNRPC has already restored the underlying lower-socket handlers during socket teardown, because the replace/restore of those shared callback pointers uses plain (non-atomic) stores and loads. Affected systems are Linux kernels that carry the SUNRPC socket-takeover code (xs_local_finish_connecting, xs_udp_finish_connecting, xs_tcp_finish_connecting, xs_restore_old_callbacks, xs_udp_do_set_buffer_size) and that use NFS or other RPC-over-socket traffic over AF_LOCAL, UDP or TCP, up to the fixed stable backports referenced in the EUVD data (6.6.157, 6.12.110, 6.18.52, 7.2.6 and 7.3-rc1). No public exploit has been identified at time of analysis and the issue is not in CISA KEV; note that the vendor-assigned CVSS of 9.8 is grossly overstated, as the assessed vector is AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, i.e. a locally driven, high-complexity race whose realistic consequence is availability loss (kernel instability), not remote unauthenticated code execution.
AppArmor confinement escape in the Linux kernel allows a local user who is already confined by a profile stack to pass through an unconfined profile and break out of the enforced AppArmor security boundary, yielding high confidentiality and integrity impact with changed scope (CVSS 8.4, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). The defect is that the unprivileged-transition restriction on unconfined is not applied when a task is already stacked, so the escape succeeds if two transitions through an unconfined profile can be executed; exploitation is local only, requires an existing confined/stacked context plus policy that permits such transitions, and therefore concentrates on hosts that deploy AppArmor with these restrictions (primarily Ubuntu and SUSE). Vendor-released patches exist for 6.18.52, 7.2.6 and 7.3-rc1, and no public exploit identified at time of analysis.
A heap out-of-bounds read in the Linux kernel's NVMe-over-Fabrics target (nvmet) DH-HMAC-CHAP authentication path lets a remote attacker who can reach a fabric transport trigger reads past an allocated message buffer by sending a crafted AUTH_Send negotiate command with an undersized transfer length or oversized hash/group identifier counts. Because authentication is negotiated before any credential check, no login is needed, but exploitation requires the target to have DH-HMAC-CHAP auth explicitly enabled (opt-in, not default) on a kernel in the affected range starting at 6.0. The reliable outcome is a kernel crash or corrupted response data rather than code execution or arbitrary memory disclosure, giving the flaw a strong availability impact with limited confidentiality impact; no public exploit code was identified at time of analysis, and it is not confirmed as actively exploited.
Kernel panic and NULL-pointer dereference in the Linux nvme-apple driver can crash Apple Silicon systems (e.g., Apple Mac mini M1) when an NVMe controller fails to initialize and is then immediately torn down, because the admin blk-mq queue allocated by blk_mq_alloc_queue() is never destroyed on that error path. The stale queue keeps its timeout timer and work armed, so blk_mq_timeout_work() later runs against freed state and oopses in percpu_ref_tryget_many after a WARN in blk_mq_release(). Our independent assessment rates this as a low-real-world-risk reliability defect rather than the vendor's high-severity base score: it is local-only, reachable exclusively on the failed-controller-plus-removal sequence (high attack complexity, low-privileged local context per the assessed vector AV:L/AC:H/PR:L), with no remote path and no public exploit identified at time of analysis.
A NULL pointer dereference in the Linux kernel's NVMe target (nvmet) subsystem causes a kernel oops and denial of service when a connected NVMe-over-Fabrics host issues an Identify command with CNS 05h (I/O Command Set specific Identify Namespace) and CSI 02h (ZNS Command Set) against a namespace that is backed by a file rather than a block device. The target-side bug, rated CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H in independent assessment, is exploitable by an authenticated fabric host only when the kernel is built with CONFIG_BLK_DEV_ZONED and the target exports at least one file-backed namespace; it is a crash-only availability issue with no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, and the bug does not appear in CISA KEV.
Local authorization bypass in the Linux kernel NVMe driver (NVMe ioctl path) lets an unprivileged user who holds a file descriptor to an affected block device submit arbitrary read and write I/O that the driver would otherwise reject. Specifically, NVME_IOCTL_SUBMIT_IO never invoked nvme_cmd_allowed(), so a caller with only a partition device node or a read-only file descriptor to the disk can issue I/O against the whole device - bypassing both partition boundaries and read-only protection - resulting in high confidentiality and integrity impact with limited availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). Exploitation requires pre-existing local access to an NVMe device node (for example via disk-group membership or permissive device permissions); no public exploit code has been identified and the flaw is not confirmed as actively exploited (not in CISA KEV), but vendor patches are available across all maintained stable branches.
A race condition in the Linux kernel's NFC LLCP socket layer allows a local user with the ability to open an AF_NFC LLCP socket to trigger a use-after-free in nfc_llcp_getsockopt() by interleaving a getsockopt() call with a bind() that fails and unwinds, freeing the nfc_llcp_local structure the cached pointer refers to. The practical outcome per the independent assessment is a kernel crash / denial of service (high availability impact) with only limited information exposure (low confidentiality impact) and no confirmed integrity impact, and because the exploit depends on hitting a narrow timing window, the attack complexity is high. No public exploit code was identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV). The issue is confined to the niche NFC LLCP stack, which only exists on kernels built with NFC/LLCP support.
Linux kernel builds with NFC NCI support can invoke the raw NFC socket data-exchange completion callback twice under a close-versus-softirq race, causing a second sock_put() on a socket that only ever received one sock_hold() - an NFC socket refcount underflow that frees the socket while it is still referenced. The flaw is a regression introduced by commit 4527025d440ce8, which moved flush_workqueue(ndev->rx_wq) after mutex_unlock(&ndev->req_lock) in nci_close_device() and thereby de-serialized the close path from nci_rx_work. Exploitation demands a kernel built with CONFIG_NFC and NCI plus a usable NFC device and a local process able to open an NFC raw socket and register a completion callback; success then depends on winning a narrow timing window, which is why our independent assessment scores it 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) rather than the vendor's 7.5 AV:A/PR:N vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the 'Information Disclosure' tag attached to this record is misleading - the defect is a use-after-free/refcount bug.
Malformed NFC LLCP Service Name Lookup (SNL) frames can drive an out-of-bounds read in the Linux kernel's nfc_llcp_recv_snl() routine, typically resulting in a kernel crash and denial of service, with a marginal possibility of limited memory disclosure. An attacker within NFC radio proximity (adjacent, AV:A) can trigger this without authentication or user interaction, because LLCP link activation happens automatically after NFC-DEP peer discovery; systems without CONFIG_NFC or NFC hardware are not affected. Vendor-released stable fixes cover 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, and 7.2.6, and no public exploit code was identified at time of analysis.
A use-after-free in the Linux kernel BPF trampoline multi-attach teardown path allows a local user who already holds CAP_BPF and/or CAP_SYS_ADMIN to crash the kernel - and potentially corrupt kernel memory - by forcing bpf_trampoline_update() to abort on an error path that runs before modify_fentry_multi()/unregister_fentry_multi(), leaving the erroneous free of old_image in bpf_trampoline_multi_attach_free() to release an ftrace image that is still live. Exploitation is confined to kernels that ship the new fentry_multi trampoline code (7.2.x and the 7.3-rc series), requires privileged BPF capability plus the ability to make an update fail in that specific corner, and is not remotely reachable or available to default unprivileged users. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the vendor's CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while our independent assessment scores it 6.4 (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H), treating the realistic outcome as kernel availability loss rather than broad code execution.
A timing-dependent race condition in the Linux kernel's ALSA sequencer MIDI input path (snd_seq_midi / snd_rawmidi) allows a local user who can open a rawmidi MIDI substream to crash the kernel via a NULL pointer dereference. The flaw occurs when snd_midi_input_event() is still executing as a substream is closing, letting the input event re-trigger after rawmidi_release_priv() has set rfile->rmidi to NULL, producing an 'Unable to handle kernel NULL pointer dereference' oops in snd_midi_input_event+0x3c/0x134. No public exploit was identified at time of analysis and there is no CISA KEV listing; the practical impact is denial of service (system crash) only, and the vendor-assigned CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates real-world risk and is internally inconsistent with the described defect, which carries no confidentiality or integrity impact and requires winning a race under AC:H. Vendor patches are available in the listed stable releases.
Out-of-bounds memory access in the Linux kernel's OCFS2 cluster filesystem can be triggered when a victim mounts and processes a crafted or corrupted OCFS2 image whose on-disk inode sets OCFS2_ORPHANED_FL with an i_orphaned_slot value outside the mounted filesystem's valid slot range, causing ocfs2_wipe_inode() to index osb_orphan_wipes out of bounds during orphan wipe and inode eviction. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H, i.e. a local, low-complexity, unauthenticated-per-vector flaw that nonetheless requires the victim to interactively mount the malicious image and, in most real deployments, to hold CAP_SYS_ADMIN to mount at all, which sharply narrows realistic exposure. Vendor patches are available in Linux 6.18.52, 7.2.6, and 7.3-rc1, and no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
A local attacker can trigger a slab use-after-free in the Linux kernel's ocfs2 cluster filesystem by mounting or otherwise processing a crafted ocfs2 disk image whose append-DIO dinode carries an i_dio_orphaned_slot outside the mounted filesystem's slot range (the description attributes this to a single high byte at offset 0xa1 corrupted from 0 to 1). The fault fires only during DIO orphan recovery (ocfs2_recover_orphans calling ocfs2_del_inode_from_orphan), where the out-of-range slot is used to index a slot-local system inode cache and the resulting invalid pointer is dereferenced as an inode, producing a KASAN slab-use-after-free in ocfs2_get_system_file_inode. Affected code is present in ocfs2 builds (CONFIG_OCFS2_FS) from Linux 4.0 onward through the unfixed commits listed in the stable trees, and is resolved by fixes released as Linux 6.18.52, 7.2.6, and 7.3-rc1; there is no KEV listing and no public exploit identified at time of analysis.
An out-of-bounds read in the Linux kernel's Squashfs filesystem driver allows local information disclosure - and, per the vendor score, a potential denial of service - when a crafted Squashfs image that encodes a negative block offset is mounted and a local user then reads the affected file. Because the malicious image must first be mounted, exploitation requires a privileged mounting step (CAP_SYS_ADMIN), so only environments that mount attacker-supplied images (auto-mount daemons, container runtimes, or an administrator mounting untrusted media) are realistically exposed; once mounted, the trigger is unprivileged per the CVSS vector (PR:N) and involves a user-initiated file read (UI:R). Vendor-released patches exist across all supported stable branches, and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a low-priority defensive hardening fix rather than an urgent threat.
Mounting an attacker-supplied, malformed NTFS filesystem image on a Linux system that uses the in-kernel ntfs3 driver can bypass virtual-cluster-number validation in mi_enum_attr(), permitting out-of-bounds accesses that leak kernel memory or crash the machine. The affected code ships in kernels carrying ntfs3, with the vulnerable range identified from 5.15.209 and the 6.x stable branches up to the corresponding fixed releases; exploitation requires local access plus the victim mounting or reading crafted NTFS media (removable drive, disk image, or shared volume), and auto-mount or CAP_SYS_ADMIN privileges are typically needed, so hosts that never mount untrusted NTFS volumes are not exposed. No public exploit code has been identified at time of analysis, though vendor patches for multiple stable branches are available.
An out-of-bounds read in the Linux kernel's RISC-V SBI MPXY mailbox driver (riscv-sbi-mpxy, present from around kernel 6.18) occurs because the SBI return value that dictates how many bytes are copied from RPMI shared memory into the notification buffer is never validated against the negotiated shared-memory size; the event walker additionally uses a reversed loop condition and can inspect a short event record. An actor controlling the SBI/firmware side of that trust boundary - a malicious or compromised SBI implementation, M-mode firmware, or platform management microcontroller - can therefore make the kernel copy and then parse data beyond the intended buffer, exposing kernel memory contents and risking a crash. The vendor scores this 8.4 (AV:L/AC:L/PR:N/UI:N/C:H/I:H/A:H), but our authoritative assessment rates it CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H, i.e. local, high complexity, requiring firmware-level privilege, with confidentiality and availability impact rather than integrity; there is no public exploit identified at time of analysis and the flaw is confined to RISC-V hardware running very recent kernels.
Mandatory byte-range lock enforcement is bypassed in the Linux kernel's in-kernel ksmbd SMB server, letting a client with a valid authenticated SMB session (CVSS PR:L) perform single-byte reads, writes, copychunk operations, and one-byte truncates against a byte that another client has already locked with a conflicting mandatory lock. The defect is a range-validation logic error: check_lock_range() uses inclusive ranges and its callers pass start + length - 1 as the end offset, so the start == end shortcut incorrectly treated a legitimate one-byte range as empty and skipped the lock check entirely; multi-byte ranges were always checked correctly. Exploitation requires a non-default configuration (CONFIG_SMB_SERVER enabled with an exported share) and a pre-existing conflicting lock, which sharply limits real-world exposure; no public exploit code has been identified at time of analysis, and the vendor CVSS of 8.1 (C:H/I:H) overstates impact relative to our assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.
A teardown race in the Linux kernel's SMB Direct (smbdirect) RDMA transport lets a freed completion queue be polled again, producing a slab-use-after-free that crashes the kernel rather than allowing code execution or data theft. An unauthenticated remote attacker who can reach an SMB Direct endpoint and win a timing-dependent race during connection teardown (a late RNR/error completion posted by the provider such as Soft-RoCE/rxe after rdma_destroy_qp() and before the workqueue-armed ib_cq_poll_work is cancelled) triggers the fault; the vendor-assigned CVSS 9.8 with full confidentiality/integrity/availability impact substantially overstates the defect, whose realistic impact is availability only. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the flaw is only reachable when SMB Direct over RDMA is configured and an RDMA provider is present.
A teardown-ordering defect in the Linux kernel's smbdirect (SMB Direct over RDMA) transport can crash the host when an RDMA accept request fails after a receive I/O has already been posted to the queue pair. Kernels running smbdirect with an active listener on RDMA-capable fabric (RoCE, iWARP, or InfiniBand) are affected - EUVD tracks the 7.1 series, with fixes landing in 7.2.6 and 7.3-rc1 - and the bug leaves an outstanding recv_io object at kmem_cache_destroy() time, later producing a NULL-pointer dereference in mempool_free_bulk. The impact is denial of service only (no confidentiality or integrity effect), triggering is unauthenticated in principle but gated on a narrow accept-failure window, so the assessed attack complexity is high; no public exploit code identified at time of analysis and no CISA KEV active-exploitation record.
An out-of-bounds read in the Linux kernel EROFS file-system driver lets a local attacker who can supply a crafted EROFS image cause unrelated kernel memory to be copied into a user-visible page cache when a victim mounts the image and reads the crafted file. The flaw requires user interaction (UI:R) and is local only (AV:L); the vendor CVSS 3.1 base is 7.1 with Confidentiality and Availability High, while independent assessment rates availability impact Low. No public exploit code was identified at time of analysis, and fixes are available in stable kernels 6.18.52, 7.2.6, and 7.3-rc1.
An access-control bypass in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated remote SMB client to have an access-granting ACE positioned beyond a DACL's declared boundary honored during SMB2_CREATE permission checks, resulting in unauthorized file reads and writes with high confidentiality and integrity impact but no availability impact. Only hosts running the ksmbd server (CONFIG_SMB_SERVER) with an actively exported SMB share are exposed - the module is not enabled by default and is far less common than userspace Samba - and the attacker must already hold an authenticated SMB session (PR:L, per CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with the ability to set a file's security descriptor. No public exploit identified at time of analysis, and the CVSS 3.1 base score is 8.1 (High); fixes are available in 6.6.157, 6.12.110, 7.2.6, 6.18.52, and 7.3-rc1.
A stale-pointer (use-after-free) lifetime bug in the Linux kernel NFSv4 client can leave a freed nfs_client reachable through the NFSv4.0 callback identifier registry, so that a later callback lookup by cb_ident takes a reference to freed memory with high confidentiality, integrity and availability impact. The defect is triggered only when the host is configured as an NFSv4.0 client and an initialization step inside nfs4_alloc_client() fails after the callback identifier has been registered - typically an allocation failure under memory pressure that is not attacker-controlled - which is why the input CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N) is badly overstated and the independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Linux kernels carrying the NFSv4 callback IDR code are affected up to the stable backports fixing it (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6 and 7.3-rc1); no public exploit identified at time of analysis, and the 'Authentication Bypass' tag does not match the assessed local, privileged failure-path defect.
NULL pointer dereference in the Linux kernel NFS client's pNFS flexfiles layout driver allows an unauthenticated remote party - specifically an NFSv4.0 data server referenced by a flexfiles layout - to crash the mounting client or drive its DS lease-renewal path into a busy-loop, yielding client-side denial of service (assessed AV:N/AC:H/PR:N/UI:N, C:N/I:N/A:H) with no code execution and no data exposure. The defect affects kernels from 4.12 up to the fixed releases 6.18.52, 7.2.6 and 7.3-rc1, but is reachable only where the client kernel is built and configured for pNFS with the flexfiles layout driver and the served layout points at a sessionless NFSv4.0 data server; NFSv4.1+ data servers carry a session and are unaffected. No public exploit code and no CISA KEV entry were identified at time of analysis, and the vendor's 7.5 (AC:L) score overstates practical reachability given the configuration prerequisites reflected in the AC:H assessment.
Out-of-bounds DMA reads and IOMMU faults, along with silent transmission of corrupted packets, can be triggered through the transmit path of the Huawei hinic3 NIC driver in Linux kernels from roughly 6.16 onward. Per the independent assessment (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H), the issue is local-only and requires an authenticated low-privileged user who can transmit a non-linear (fragmented) skb over a hinic3 interface using a tunnel checksum-offload configuration the driver cannot offload, which forces the skb_checksum_help() software fallback, linearizes the skb, and leaves the driver building a TX descriptor from a stale fragment count. Impact is availability-dominant (IOMMU fault/panic) with limited confidentiality exposure from the out-of-bounds DMA read; no public exploit code was identified at time of analysis and CISA KEV does not list this CVE. Systems without Huawei HiNIC3 hardware are unaffected regardless of kernel version, and vendor patches are available in Linux 6.18.52, 7.2.6, and 7.3-rc1.
Linux kernel's Kernel Connection Multiplexor (net/kcm) runs an attached BPF strparser program via bpf_prog_run_pin_on_cpu() without first entering an RCU read-side critical section, so BPF map operations executed by that program trigger WARN_ON_ONCE(!bpf_rcu_lock_held()) and can lead to a race-dependent memory-safety condition against a concurrently freed BPF map element. The assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - a local, low-privilege user (PR:L) on a kernel built with CONFIG_AF_KCM who can create a KCM socket, attach a BPF program and drive traffic through kcm_parse_func_strparser() is required, and the practical effect beyond a WARN splat is non-deterministic due to the race window, with impact scoped to availability (C:N/I:N/A:H). Vendor-released fixes are available for the stable branches; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Integer overflow in the Linux kernel's IPVS FTP application helper (ip_vs_ftp_get_addrport()) lets an unauthenticated remote attacker who can control an FTP PASV/EPSV reply that traverses an IPVS/LVS director wrap a data-connection port or address octet, causing the helper to program the expected data connection with a truncated port or address. Only kernels built with CONFIG_IP_VS_FTP and actively load-balancing FTP are exposed - a non-default, niche configuration - and the practical impact is confined to a misconfigured or truncated data connection rather than code execution or memory corruption, so the vendor CVSS of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) overstates real-world priority, as reflected in the independent assessment (A:N). Vendor patches are available in the stable branches (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6 and 7.3-rc1); no public exploit code and no confirmed active exploitation were identified at the time of analysis.
An out-of-bounds read in the Linux kernel's hp-bioscfg platform driver lets a malformed PSWD_ENCODINGS ACPI package cause the parser to read past the end of the ACPI object array and hand an out-of-bounds string pointer and length to hp_convert_hexstr_to_str(), resulting in kernel-memory disclosure or a kernel crash (the assessed vector is AV:L/AC:H/PR:H with high availability impact and limited confidentiality impact). Only systems running the hp-bioscfg driver - i.e. HP hardware whose firmware exposes the BIOS-configuration WMI/ACPI interface - are affected, and exploitation requires the attacker to control or modify the platform ACPI tables, since the index bound is only violated when firmware declares a non-zero encoding count without supplying enough string objects. The vendor-published CVSS of 7.7 depicts an unauthenticated, low-complexity local attacker, but this assessment rates the realistic path as higher-complexity and privileged because it depends on attacker-influenced firmware data; no public exploit code and no confirmed active exploitation were identified at time of analysis.
A heap out-of-bounds write in the Linux kernel's legacy in-tree NTFS driver (fs/ntfs) lets a local attacker corrupt kernel heap memory when a crafted NTFS filesystem image is mounted and subsequently triggers a directory index reparent, at which point ntfs_ir_to_ib() copies oversized index_root entries into an index_block_size allocation without a bounds check. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, 7.8) is local-only and requires the victim to mount and exercise an attacker-supplied image, and the maintainer explicitly notes that crafted-filesystem attacks fall outside the kernel threat model; no public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation. The real-world risk is LOW-to-MODERATE despite the High CVSS, because reach is sharply constrained by the local attack vector, the user-interaction requirement, the need for the legacy driver to be built and loaded, and the narrow reparent-only code path. Vendor-released patches are available (stable 7.2.6 and 7.3-rc1, plus the upstream commits referenced by the CVE), so exposure is largely limited to systems that still load fs/ntfs and process untrusted NTFS images.
Unprivileged local users on Linux kernels 7.1 through 7.2.5 can rewrite the reserved NTFS extended attributes ($LXUID, $LXGID, $LXMOD, $LXDEV) that record Linux ownership, permission, and device-number metadata on NTFS volumes, because the in-kernel ntfs driver accepted setxattr() on those names without any privilege check. An attacker holding an ordinary local account (CVSS 3.1 AV:L/PR:L, no user interaction) on a host where an affected kernel has an NTFS volume mounted writable can silently alter that metadata, undermining the confidentiality and integrity of the filesystem's access controls for a CVSS score of 7.1. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); exposure is limited to a narrow, very recent kernel window, with vendor-released fixes in 7.2.6 and 7.3-rc1.
Linux kernel 7.1 through 7.3-rc1 ships an iomap-based NTFS driver (fs/ntfs) whose resident-file read path, ntfs_read_iomap_begin_resident(), walks the MFT record via ntfs_attr_lookup()/ntfs_attr_find() without holding ni->mrec_lock, while ntfs_attr_record_resize(), ntfs_make_room_for_attr() and ntfs_resident_attr_record_add() memmove the same base_ni->mrec buffer under that lock. A local user who mmap-reads a small, MFT-resident NTFS file while concurrently calling link() or unlink() on it can win the narrow race window and observe torn attribute length and offset fields (KCSAN-reported at mft_record.bytes_in_use), giving a confirmed data race in the CWE-362 class that the vendor scores as high confidentiality and availability impact but which is not a directly weaponizable memory-corruption primitive. No public exploit code has been identified at the time of analysis; vendor patches are available for the affected kernels.
Out-of-bounds memory corruption during early-boot ACPI MADT parsing in the Linux kernel's irqchip/gic-v5 driver (gic_acpi_parse_iaffid) can crash or corrupt kernel memory on Arm systems that use the new GIC-v5 interrupt controller and boot via ACPI. The flaw affects mainline kernels up to the fix, with vendor-released fixes landing in Linux 7.2.6 and 7.3-rc1 (commits 6caeb878f809bdf0aec2fdd96f3d41ef4b69fc69 and 328affc639ce9873a7a0a3fd6b8339f19767529b); no public exploit code was identified at time of analysis and there is no CISA KEV listing. Although the vendor scored this 8.4 with PR:N, the realistic risk is far lower: triggering it requires GIC-v5 hardware that boots ACPI, a vulnerable kernel, and attacker control of the MADT firmware table (firmware or physical access), and the corruption occurs only during kernel initialization rather than from an unprivileged runtime process.
An off-by-one out-of-bounds write in the Linux kernel's legacy NTFS driver (fs/ntfs) allows a local user to corrupt kernel memory by mounting a crafted NTFS filesystem and reading a compressed file from it. ntfs_decompress() accepts dp_addr == dp_sb_end as a valid state, so the final symbol copy writes one byte past the destination page and leaves *dest_ofs pointing one past the sub-block end; because the page is never finalized, subsequent sub-blocks keep writing further out of bounds, producing a bounded run of writes beyond the page. The issue is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is local, requires no privileges but does require the victim to mount the image and read the offending file, and no public exploit code has been identified at time of analysis and there is no CISA KEV listing; the practical priority is moderate rather than urgent because the vulnerable code lives in the deprecated fs/ntfs driver that is frequently not built or loaded on modern systems.
Off-path attackers can defeat IP-keyed ICMP rate limiting in the Linux kernel by weaponizing the deterministic Red-Black tree that the inetpeer subsystem uses to store peer entries. Because tree ordering is derived directly from the remote IP address, an attacker who can send arbitrary packets can predict lookup and garbage-collection traversal paths, force eviction of targeted inet_peer nodes, and - when those nodes are recreated - have their token buckets reset to full capacity, yielding a rate-limit bypass and a timing oracle for inferring open UDP ports. The issue affects Linux kernel builds that carry the inetpeer code up to the fixed stable releases (6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6, and mainline 7.3-rc1); a vendor patch exists, and no public exploit has been identified at time of analysis. Our independent assessment rates this far below the vendor's CVSS 9.4: the practical impact is limited to rate-limit bypass and port-state inference (C:L/I:N/A:N, AC:H) with no memory corruption or code execution, and exploitation requires sustained packet volume plus precise timing observation - making the vendor vector's C:H/I:H/A:L materially overstated.
Linux kernel NFSv4.2 clients that use the flexible-files (flexfiles) pNFS layout driver can be driven into a permanent hang by a malicious or compromised NFS server, which returns maximally sized filehandles and network addresses through LAYOUTGET and GETDEVICEINFO so that the LAYOUTSTATS layoutupdate4 record exceeds the encoder's 256-byte reservation. When xdr_reserve_space() then returns NULL inside ff_layout_encode_io_latency(), the code path unwinds with dss_info->mirror->lock still held, leaving the lock permanently locked and hanging the client - a pure availability/denial-of-service condition with no code execution or data disclosure (C:N/I:N/A:H, vendor CVSS 3.1 7.5; our independent assessment rates the same impact but with AC:H rather than AC:L, since a hostile server, a mount relationship, and active flexfiles pNFS usage are all required). No public exploit code was identified and there is no CISA KEV entry at time of analysis; vendor-patched kernel releases are available.
NULL-pointer dereference in the Linux kernel's pNFS (parallel NFS) flexfiles data-server cache can crash an NFS client when it mounts a pNFS filesystem served by the flexfiles layout driver and connects to a server whose GETDEVICEINFO response returns two deviceids sharing one multipath data-server address but advertising different major NFS versions. The cache in nfs4_pnfs_ds_add() is keyed only on the address set, so the two mirrors alias to a single nfs4_pnfs_ds; whichever mirror connects first pins the client to its own NFS version, and the second mirror is then handed that client and selects rpc_call_ops for a protocol version the connection does not speak, causing mismatched sequence-slot handling and a kernel oops. The flaw is availability-only (no confidentiality or integrity impact), affects only hosts acting as NFS clients that mount pNFS with the flexfiles layout (CONFIG_NFS_V4_1), and there is no public exploit identified at time of analysis; exploitation requires the uncommon condition of mixed-version mirrors on a single data-server address, which is why our independent assessment raises attack complexity to AC:H relative to the vendor vector's AC:L.
Use-after-free in the Linux kernel Bluetooth L2CAP stack lets a Bluetooth-adjacent attacker corrupt kernel memory by racing an inbound L2CAP connection against the teardown of a parent listening socket, causing dereference of a dangling bt_sk(sk)->parent pointer. Kernels across the 5.10, 5.15, 6.1, 6.6, 6.12, 6.18 and 7.x stable lines are affected (EUVD lists fixed points at 6.1.188, 6.6.157, 6.12.110, 6.18.52 and 7.2.6), and exploitation requires a local process actively managing an L2CAP listener plus an attacker within Bluetooth radio range; the assessed vector is AV:A/AC:H/PR:L, so this is not default-configuration remote exploitation and hinges on winning a narrow timing window. No public exploit code has been identified at time of analysis, and the flaw is not confirmed actively exploited (CISA KEV), but vendor-released patches are available.
Kernel crashes with a NULL-pointer dereference in the Linux kernel's Bluetooth L2CAP socket layer when l2cap_sock_cleanup_listen() performs an unsafe lockless read of l2cap_pi(sk)->chan that races with l2cap_sock_kill() -> l2cap_sock_put_chan() executing on the hdev workqueue after a Bluetooth disconnect. Affected are systems built with Bluetooth support (CONFIG_BT) running unpatched Linux 6.1.x before 6.1.188, 6.6.x before 6.6.157, 6.12.x before 6.12.110, 6.18.x before 6.18.52, or 7.1.5 before 7.2; triggering requires a user able to create/operate a listening L2CAP socket (PR:L) plus an adjacent Bluetooth peer (AV:A) capable of inducing disconnect/teardown, and the timing window is narrow so the race is hard to win deterministically. Consistent with our independent assessment, the impact is confined to a kernel crash (availability only, AC:H) rather than the confidentiality/integrity impact suggested by the higher NVD-published score, and no public exploit code or confirmed active exploitation has been identified at time of analysis while vendor patches are available.
An out-of-bounds read in the Linux kernel's btnxpuart Bluetooth-over-UART driver lets an attacker who can influence frames emitted by an NXP controller force the driver to parse an 8-byte nxp_fw_dump_hdr structure from beyond the actual ACL payload, and because buf_len is what terminates a dump, a truncated frame can also abort a firmware crash dump early and reset the controller. Systems are exposed only when running the btnxpuart driver (CONFIG_BT_NXPUART) with an NXP Bluetooth controller attached over UART and the firmware-dump path active; the assessed vector is adjacent, low complexity, no authentication, no user interaction (CVSS 7.1, dominant impact A:H with limited C:L). The over-read is only a few header bytes that are not returned to the attacker, the affected hardware is niche, and no public exploit identified at time of analysis; vendor-released fixes exist.
Use-after-free in the Linux kernel's net/sched sch_teql qdisc lets a local attacker who holds CAP_NET_ADMIN (and can create a teql master with at least two slaves) leave skb->dev pointing at a slave net_device that is later freed, yielding kernel memory corruption, potential code execution, or a crash. The bug requires CONFIG_NET_SCH_TEQL, a transmit failure on one slave, a subsequent slave with an unresolved neighbour that queues the skb on arp_queue, and deletion of the prior slave within a narrow race window, so the assessed vector is AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H while NVD lists CVSS 7.8 with AC:L. Affected releases are Linux stable branches up to the fixed versions (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6, 7.3-rc1); no public exploit code or confirmed active exploitation was identified at time of analysis.
An out-of-bounds write in the Linux kernel's crypto ACOMP (asynchronous compression) layer allows a local user with low privileges (PR:L) to corrupt kernel slab memory on hosts running affected kernels - Linux 6.16 and kernels built from the 097c432caaa6 lineage before the 7.2.6, 6.18.52 and 7.3-rc1 fixes. The flaw arises because acomp_request_clone() copies only a stack-sized synchronous request when an asynchronous provider such as Intel QAT is selected, leaving no storage for the provider's request context, which is then written past the allocation through acomp_request_ctx() and detected by KASAN as a slab OOB write. Exploitation is constrained by the local vector and the need for an active asynchronous acomp provider, with no remote reach; there is no public exploit identified at time of analysis.
Remote denial of service in the Linux kernel's libceph Ceph messenger v2 client (net/ceph/messenger_v2.c), introduced with the in-kernel msgr2 client in Linux 5.11, allows a peer that controls the server side of a Ceph connection - or a man-in-the-middle - to send a banner whose payload_len field is smaller than the 16 bytes required for the server_feat and server_req_feat integers, causing the kernel to stage a 0-length socket read that trips the iov_iter invariant in populate_in_iter() and aborts the connection with a WARNING. The practical impact is limited: with default settings this yields a logged kernel warning and dropped connection, but hosts configured with panic_on_warn=1 will suffer a remote kernel panic, and the WARNING itself provides a weak log-flooding factor. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, though the vendor has shipped fixes across all supported stable branches.
Netfilter nf_tables in the Linux kernel performed the hardware-offload step before allocating the chain blob during ruleset commits, so an allocation failure at that point could leave the NIC-offloaded ruleset diverging from the in-kernel software ruleset. Affected are Linux kernel builds with nf_tables hardware offload enabled on an offload-capable NIC; the fix landed in stable releases 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52 and 7.2.6/7.3-rc1, and the bug traces back to code introduced in the 5.3 series. Exploitation requires local access with CAP_NET_ADMIN and an error/resource-pressure path, so no public exploit has been identified at time of analysis.
Remote unauthenticated packet reception can panic Linux kernel systems that use the stmmac Ethernet driver on ARM32 platforms where unaligned CPU loads trap, yielding a CVSS 3.1 base score of 7.5 with availability-only impact. The defect is a missing NET_IP_ALIGN in the stmmac RX DMA offset after the zero-copy RX conversion (commit df542f669307), so inbound IP headers land misaligned; on affected ARM32 hardware any received packet such as an ICMP echo request triggers an alignment exception and kernel panic. Patched kernels include 6.18.52, 7.2.6, and 7.3-rc1, and no public exploit code was identified at time of analysis.
Use-after-free in the Linux kernel's SLIP line discipline allows an authenticated local attacker with the ability to attach the SLIP discipline (historically gated by CAP_NET_ADMIN) to corrupt kernel memory by racing a tty hangup against slip_receive_buf(). The flaw is caused by slip_hangup() calling slip_close() under only the tty->ldisc_sem read lock, freeing the netdev and struct slip while a concurrent reader may still dereference it. Vendor patches are available in 7.2.6, 6.6.157, 7.3-rc1, 6.12.110, 6.1.188, and 6.18.52; no public exploit identified at time of analysis, and our assessment notes the local-only, race-dependent nature lowers practical risk despite the vendor CVSS of 7.8.
A local heap out-of-bounds write exists in the Linux kernel's dm-integrity device-mapper target when a keyed sector marker is configured with a tag size smaller than the hash digest size, allowing a local actor holding some privilege to write past the end of a kmalloc'ed checksums buffer (the description cites a 4MiB discard under hmac(sha256) with tag size 16 writing 16 bytes beyond the page). It is assessed as CVSS 7.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting a locally reachable kernel memory-corruption primitive requiring low-level local privileges and a non-default dm-integrity configuration. Vendor fixes are available as stable-branch commits (59e6f919d77d72ec79cbf171256f2f7819737580, 9988c1c9e0d1c78391e3d8e2817beb667470c76f, dd08a645195f410f2dcaa40de379a45ce110e873) and no public exploit was identified at time of analysis, with no CISA KEV listing.
The Linux kernel's device-memory (devmem) TCP transmit path accepts non-zero-copy transmit requests that it should reject, allowing a local attacker with a low-privileged account to drive the kernel into copying from iovecs that actually contain dma-buf offsets instead of page pointers, breaking skb frag invariants and leading to high-impact confidentiality and integrity loss (assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected systems are Linux 6.16 and later kernels built with devmem TCP support where the transmit device does not advertise NETIF_F_SG, or where an io_uring request is crafted with a dmabuf_id and zero-copy flags but no valid devmem binding. No public exploit code has been identified at time of analysis, and the feature is new and rarely enabled, so realistic exposure is narrow; the vendor has released fixes in stable releases 6.18.52 and 7.2.6 and in 7.3-rc3.
Improper neutralization of newline sequences in NetworkManager-fortisslvpn credential handling allows a local user who can create or modify a FortiSSL VPN connection profile to inject directives that the root-privileged VPN helper executes, resulting in local privilege escalation to root. The flaw is scored 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was reported by Ubuntu, with Red Hat tracking it through its CVE page and Bugzilla 2533640 against an upstream tracking item in the archived GNOME GitLab project. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so risk is concentrated on multi-user Linux hosts where the plugin is installed and ordinary console users are permitted by policy to configure VPN connections.
Local privilege escalation in the NetworkManager-vpnc plugin lets a low-privileged user who can create or edit VPNC connection profiles inject a newline character into the username field, causing that value to spill into the root-run vpnc password helper and ultimately execute with root privileges (CWE-93, CVSS 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack requires local access and an unprivileged account with write permission to NetworkManager connection profiles, plus the vpnc plugin installed and in use; no victim interaction is needed because the attacker only uses their own session. It is not remotely reachable and there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, making this a prompt-patching priority for affected Ubuntu/RHEL systems that ship the plugin rather than a mass-exploitation emergency.
Local privilege escalation in the NetworkManager iodine VPN plugin (network-manager-iodine) lets an authenticated local user obtain code execution as root through option confusion in the root-privileged nm-iodine-service. A user who is permitted (typically via polkit for an active session) to create or edit an iodine VPN connection can supply a connection property value that iodine's command-line parser interprets as an option flag instead of data, producing behaviour that runs while the service is still root and before iodine drops privileges to an unprivileged user. Exploitation requires local access plus an installed, configured plugin, and no public exploit was identified at time of analysis; the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (high confidentiality, integrity and availability impact, scope unchanged). Note that no CVSS vector, CWE, EPSS, KEV, SSVC or POC signal was supplied in the source data, so severity here derives from the independent assessment rather than vendor scoring.
Local privilege escalation in NetworkManager-vpnc allows an authenticated low-privileged local user (CVSS AV:L/PR:L) who can create or modify VPNC-type VPN connection profiles to inject CRLF sequences into configuration fields, which are then serialized into the vpnc configuration file and acted on with root privileges. The flaw is an incomplete fix for CVE-2018-10900 and is classified as CWE-93 CRLF injection, with a CVSS 3.1 base score of 7.8 reflecting high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and exploitation is bounded by local access plus the presence of the optional plugin and profile-modification rights, so hosts where only administrators manage VPN connections are not exposed to unprivileged escalation.
Path traversal and arbitrary file write in the oras-go OCI artifact library prior to 2.6.2 allow a malicious artifact layer marked with the io.deis.oras.content.unpack=true annotation to escape the content/file.Store extraction root and create or overwrite any file writable by the pulling process, potentially leading to code execution. Exploitation is unauthenticated from an attacker's network position (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction (UI:R) because the victim must pull the attacker-controlled artifact reference; the bug bypasses the AllowPathTraversalOnWrite=false default, so no permissive configuration is needed. Scored 8.8 High, with no public exploit identified at time of analysis and no CISA KEV listing; a vendor patch is available in oras-go 2.6.2.
Denial of service in ISC BIND 9 recursive resolvers affects versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the subscription builds 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1. A validating resolver can be crashed when an authoritative server it queries returns a valid wildcard answer with a signed NSEC3 proof immediately followed by an unsigned NSEC record at the same owner name, causing an unexpected program exit via a reachable assertion (CWE-617). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this 7.5, availability-only, and exploitation requires the attacker to control or be on-path to the authoritative server answering the resolver's query, so an arbitrary external client cannot trigger the crash by sending queries alone; no public exploit code or CISA KEV entry was identified at time of analysis.
Denial of service in ISC BIND 9 allows a remote, unauthenticated attacker to terminate the named daemon by sending a single DNS query of QTYPE TKEY, causing an assertion failure and unexpected process exit, but only on servers loaded with a named.conf file that contains no global 'options' block. Affected builds are 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1; the CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting availability-only impact with no confidentiality or integrity loss. The prerequisite configuration (missing global options block) is uncommon in production deployments, which meaningfully limits real-world exposure; no public exploit code and no confirmed active exploitation were identified at the time of analysis, though the trigger is trivial to send for anyone who can reach the resolver or authoritative port.
Denial of service in ISC BIND 9 allows remote, unauthenticated attackers to terminate the named resolver process when it processes a specifically malformed answer that interacts with the DNS64 synthesis feature. Only resolvers explicitly configured with the dns64 option are affected - a non-default, opt-in capability - but for those systems any client of the resolver loses name resolution when named exits. The bug is a use-after-free (CWE-416) reachable from the network with low complexity (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), affecting BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the corresponding -S1 subscription builds. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation; vendor patches are available as BIND 9.20.29 and 9.21.26.
Resource exhaustion in ISC BIND 9 recursive resolvers allows unauthenticated remote attackers to cause a denial of service by repeatedly triggering a memory leak through crafted SVCB/HTTPS AliasMode records that reference 14 or more ServiceMode records. Affected versions include 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and corresponding -S1 subscription builds; patched versions are 9.20.29 and 9.21.26. No public exploit code has been identified at time of analysis, but the vulnerability is remotely exploitable without authentication and can gradually exhaust resolver resources, disrupting recursive lookups.
Unauthenticated remote attackers can abort the `named` process in BIND 9 by sending a crafted DNS-over-HTTPS request that carries a cryptographically invalid SIG(0) record and then prematurely closing the transport connection, producing a null pointer dereference (CWE-476) that terminates the server. Affected versions are 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the 9.20.9-S1 through 9.20.27-S1 subscription branch; the assessed CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), meaning no authentication or user interaction and availability-only impact. Exploitation requires the targeted named instance to have the DoH transport enabled and to process SIG(0)-signed messages, so server deployments without DoH exposed to the attacker have no reachable attack surface; impact is limited to a process abort with no data disclosure or modification. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available (9.20.29 and 9.21.26).
Remote denial of service in ISC BIND 9 lets an attacker-controlled (or spoofing-capable) authoritative DNS server crash a recursive resolver by returning a negative answer of exactly 65536 bytes, which `named` caches as a zero-length entry and later aborts on when the entry is read. The flaw affects 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the corresponding -S1 subscription releases, requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and is present in default configurations, though reachability is limited to resolvers that actually recurse against attacker-influenced or spoofable zones and then read the poisoned cache entry. Vendor patches are available (9.20.29 and 9.21.26); no public exploit identified at time of analysis, and the impact is availability-only with no confidentiality or integrity loss.
CPU-exhaustion denial of service in ISC BIND 9 recursive resolvers (9.18.0-9.18.50, 9.20.0-9.20.27, 9.21.0-9.21.25, plus the 9.18.11-S1-9.18.50-S1 and 9.20.9-S1-9.20.27-S1 preview builds) can be triggered by a single remote, unauthenticated query for the root of an already-cached tree of SVCB/HTTPS AliasMode records. Once such an AliasMode chain is resident in the resolver cache, the triggering query causes the resolver to spend disproportionate CPU time constructing the response, degrading or stalling name resolution for all clients of that resolver; impact is availability-only with no confidentiality or integrity effect. The assessed CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is well calibrated, but exploitation is conditional on the attacker first causing the SVCB/HTTPS AliasMode tree to be resolved and cached (for example from an attacker-controlled zone) before issuing the trigger query; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Improper bit placement in the Linux kernel's zram slot-locking code allows a local, authenticated user on 64-bit big-endian systems (s390x, big-endian ppc64, sparc64) to corrupt a per-slot lock word, which can let two CPUs take the same slot lock simultaneously or leave a slot appearing permanently locked, yielding low integrity impact and possible hangs or availability loss. Exploitation requires a 64-bit big-endian kernel built with ZRAM_TRACK_ENTRY_ACTIME enabled, active zram usage (swap or block device) with local activity reaching mark_slot_accessed()/slot_free(), and a successful concurrency race; little-endian architectures such as x86-64 and arm64 are unaffected because the lock bit lands in the correct half of the word there. No public exploit has been identified at time of analysis, and although the vendor assigns CVSS 7.8 (AV:L/AC:L/PR:L/C:H/I:H/A:H), the independent assessment (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) rates real-world risk materially lower given the big-endian-only, race-dependent, non-default-config prerequisites.
A use-after-free in the Linux kernel NFSD (kernel NFS server) export-state revocation path can crash the server when a privileged administrator runs 'exportfs -u' to revoke an export while an NFSv4 client is concurrently expiring. Only recent 7.2.x kernels before 7.2.5 (and mainline before 7.3-rc1) are affected, and the trigger requires root/CAP_SYS_ADMIN on the NFS server plus a narrow race in which nn->client_lock is dropped across revoke_one_stid() and a subsequent read of clp->cl_minorversion, allowing a teardown to free the nfs4_client still being dereferenced. The realistic impact is a kernel crash / denial of service on the NFS server rather than remote code execution or data compromise; the vendor-supplied CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) drastically overstates real-world risk, and no public exploit code has been identified at time of analysis. A vendor patch is available (7.2.5 stable and 7.3-rc1).
A use-after-free in the Linux kernel's usbtv media driver ALSA audio path can crash the kernel or trigger limited memory corruption when a Fushicai USBTV007 USB analog TV/audio capture device is physically disconnected while a local user still has the PCM substream open. The driver frees its per-device state (struct usbtv) during the disconnect path while ALSA still references it via pcm->private_data, so a later snd_usbtv_pcm_close() dereferences freed memory; the kernel fix takes an extra V4L2 device reference for the lifetime of the ALSA card and releases it in the card's private_free callback. Vendor CVSS is 7.8, but the independent assessment rates the practical risk lower (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) because exploitation requires the specific USB hardware, a local user with ALSA access, a USB unplug race, and yields no confidentiality impact under assessment; no public exploit code or confirmed active exploitation was identified at time of analysis.
A race condition in the Linux kernel's Qualcomm PMIC USB Type-C driver (qcom-pmic-typec) can leave the cc_debounce_dwork delayed work queued after the port is torn down, resulting in a use-after-free once devres frees the pmic_typec_port structure. Systems running affected kernels from roughly 6.5 through the unfixed 6.12.110/6.18.51/7.2.5 baselines on Qualcomm PMIC Type-C hardware - typically Snapdragon-based phones and embedded boards - are exposed. Exploitation requires local privileged access (root or CAP_SYS_ADMIN) to trigger the port_stop()/tcpm_unregister_port() teardown path and the ability to win a narrow TCPM-kthread timing race; no public exploit code has been identified at time of analysis, and the independent assessment rates the practical severity lower than the vendor's published CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8), assigning AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H instead.
A use-after-free race in the Linux kernel's Qualcomm PMIC USB Type-C Power Delivery PHY driver (qcom-pmic) can be triggered during driver teardown: pdphy_stop() disables the PD interrupts but does not flush the pending reset_work work item, so if the IRQ handler schedules that work just before disable_irq() takes effect, the work can execute after remove() has already freed the containing structure through devm. Reachability is narrow - it requires local privileged access (the ability to unbind/remove the driver, typically root-gated), the specific Qualcomm PMIC Type-C hardware, and winning a tight timing window, so the assessed vector is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H rather than the higher base score sometimes published. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the flaw was found by an in-house static analysis tool.
Out-of-bounds array indexing in the Linux kernel's USB Type-C UCSI DisplayPort alternate-mode driver (drivers/usb/typec/ucsi/displayport.c) can crash the kernel when the UCSI platform firmware returns a GET_CURRENT_CAM response that exceeds UCSI_MAX_ALTMODES without being 0xff. All Linux kernels exposing the ucsi_displayport code path - introduced around 5.2 and present on modern USB-C laptops with DisplayPort alt-mode - are potentially affected; the vector is local (CVSS:3.1/AV:L/AC:L/PR:N/UI:N) and requires either rogue/buggy PPM firmware or a malicious USB-C DisplayPort partner to steer the alternate-mode negotiation, so stock systems with honest firmware are not reachable. Impact is limited to a kernel crash (denial of service); no confidentiality or integrity impact is supported by the assessed vector, and no public exploit code or CISA KEV entry has been identified at time of analysis.
Use-after-free in the Linux kernel's USB MIDI 2.0 gadget function driver (f_midi2) allows a local attacker who already holds privileged access to the gadget configfs interface to corrupt or read freed memory by winning a narrow race between a string attribute's show path and a concurrent store. The show handler f_midi2_opts_str_show() dereferences opts->info.<field> before acquiring opts->lock, while f_midi2_opts_str_store() frees the previous string under that same lock, so a colliding read can touch a pointer that has already been released - affecting iface_name, block name, and the EP string option attributes. Exploitation requires CAP_SYS_ADMIN-level local access to configfs on a kernel built with USB gadget support and f_midi2 configured; it is not remotely reachable, and no public exploit code or confirmed active exploitation was identified at time of analysis. NVD scores this at CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while our independent assessment rates it lower (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H) because of the privileged prerequisite and the narrow, timing-dependent race window.
A stack buffer overflow in the Linux kernel's staging rtl8723bs Wi-Fi driver allows an unauthenticated attacker within radio range to corrupt kernel memory by sending a crafted WPS information element in a beacon or probe-response frame that the target parses while scanning. Because the driver trusts an attacker-controlled 2-byte WPS attribute length as a memcpy() size without comparing it against the remaining bytes of the IE, the copy overruns single-byte stack variables such as the selected-registrar flag at call sites in ioctl_cfg80211.c and rtw_mlme_ext.c, yielding a kernel crash and, depending on build hardening, possible code execution; the independent assessment rates this AV:A/AC:L/PR:N/UI:N with high integrity and availability impact (confidentiality rated none). No public exploit code or confirmed active exploitation has been identified at time of analysis, and exposure is confined to systems with this niche driver loaded and an adversary physically close enough to inject 802.11 management frames.
A 1-2 byte out-of-bounds read in the Linux kernel's rtl8723bs staging Wi-Fi driver (rtw_action_frame_parse) lets a local attacker who can inject 802.11 management action frames cause a kernel fault, with practical impact typically limited to a crash when the read crosses a page boundary. The vendor assigned CVSS 7.1 (AV:A/AC:L/PR:N), but our independent assessment rates it CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L because exploitation requires the rtl8723bs driver to be loaded and bound to Realtek RTL8723BS hardware plus local interface access (typically CAP_NET_ADMIN) to reach the cfg80211 mgmt_tx path or a monitor-mode interface. No public exploit code identified at time of analysis, and this is not confirmed actively exploited (CISA KEV); vendor-released patches exist for the affected stable branches.
A use-after-free in the Linux kernel ftrace tracing subsystem lets a privileged local user crash the machine by racing a read of the newly added per-instance show_event_filters or show_event_triggers files against deletion (rmdir) of the trace instance those files belong to. The bug affects kernels that ship these files, i.e. roughly Linux 7.0 through the pre-fix 7.2.x and 7.3-rc series, and it was resolved by taking a trace_array reference in the files' open path (commits f4a771cc684c and 2ee3f7d43f79). Exploitation requires local access to a mounted tracefs, PR:H privileges per the assessed vector (normally root/CAP_SYS_ADMIN), and winning a tight timing race; there is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV), so real-world risk is far below the headline 7.8 score.