Suse
Monthly
A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the info() function of bin_ne.c. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load() function of bin_dyldcache.c. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Local privilege-adjacent memory corruption in the Linux kernel's listmount() mount-enumeration syscall arises because the code invoked path_put() while still holding the namespace semaphore; if that call drops the final reference to a path, cleanup runs under the held lock and can trigger a use-after-free or deadlock. Any local user able to call listmount() is affected on vulnerable stable kernels, and while EPSS is very low (0.03%) with no public exploit identified at time of analysis, the NVD-assigned CVSS of 7.8 reflects full CIA impact from local exploitation. The fix relocates the reference drop to outside the lock across three stable-branch commits.
Local privilege-relevant memory corruption in the Linux kernel's IPMI (Intelligent Platform Management Interface) subsystem stems from flawed user-message limit accounting, including improper reference counting and a use-after-free when messages are allocated in the receive path. A local user with access to the IPMI device can trigger the flaw to crash the system or potentially corrupt kernel memory, and while tagged as Denial of Service, the CVSS:3.1 vector rates full confidentiality, integrity, and availability impact (7.8). There is no public exploit identified at time of analysis, and the very low EPSS score (0.03%, 10th percentile) reflects limited near-term mass-exploitation expectation.
Filesystem corruption and denial of service in the Linux kernel's ext4 extended-attribute (EA) inode handling allows a local attacker who can mount a crafted or corrupted ext4 image to trigger a reference-count underflow in ext4_xattr_inode_update_ref(). Because the code previously read an EA inode refcount that was already <= 0 and still applied the change (typically -1), it proceeded on a bogus negative value, spawning EXT4-fs errors and orphan/cleanup churn. No public exploit identified at time of analysis, and the EPSS score is very low (0.07%), consistent with a corruption-triggered fault rather than a readily weaponized remote flaw.
Local privilege-escalation and memory-corruption in the Linux kernel's crypto skcipher (symmetric block cipher) framework allows a low-privileged local user to corrupt kernel memory by exercising an skcipher algorithm that declares its request size via the new cra_reqsize field. The regression stems from commit afddce13ce81d, which added cra_reqsize for ahash/acomp but left skcipher's framework paths unaware of it, so per-request scratch buffers are undersized. EPSS is negligible (0.03%), the issue is not on the CISA KEV list, and no public exploit is identified - the tags characterize the practical outcome as denial of service (kernel crash), though memory corruption leaves privilege escalation theoretically possible.
Ceph is a distributed object, block, and file storage platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE) token with an exceptionally high. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Missing memory-barrier ordering in the x86 memory-management code of the Linux kernel allows stale TLB entries to persist after an address-space switch, because switch_mm_irqs_off() can fail to observe a recent tlb_gen update from flush_tlb_mm_range(). On affected x86 SMP systems a local, low-privileged process could read or corrupt memory mappings it should no longer have access to, mapping to the CVSS 7.8 high/high/high impact. No public exploit identified at time of analysis, and the EPSS score is negligible (0.03%, 10th percentile), indicating this is a subtle correctness/race fix rather than an actively-targeted flaw.
Memory corruption in the Linux kernel's accel/qaic driver (Qualcomm Cloud AI 100 accelerator) allows a local user to trigger a general protection fault by submitting a DMA transfer request with a zero length, or when the device requests continuation (QAIC_TRANS_DMA_XFER_CONT) after all bytes have already been transferred. In these cases find_and_map_user_pages() returns 0 without allocating the scatter-gather table, and encode_addr_size_pairs() then dereferences the unallocated sgt, faulting the kernel. EPSS is very low (0.03%) and there is no public exploit identified at time of analysis, but distro patches (Ubuntu USN-8125-1/8126-1) are already shipping.
Local information disclosure and potential use-after-free in the Linux kernel networking stack stems from unprotected reads of the destination cache device pointer (dst->dev) in sk_setup_caps() and related IPv4/IPv6 forwarding paths. Affected builds accessed dst->dev without RCU protection, allowing a concurrent update to free the device while another CPU dereferenced it. There is no public exploit identified at time of analysis, EPSS probability is negligible (0.03%), and the issue is not in CISA KEV; the upstream fix switches these call sites to the RCU-safe dst_dev_rcu()/dst_dev_net_rcu() helpers.
Improper resource cleanup in the Linux kernel's Intel Xe DRM driver (drm/xe/guc) lets a local user trigger a memory-management fault when destroying a GPU exec queue after the GuC firmware has already been stopped - for example during a forced driver unbind. Because the driver waits for a GuC response that can never arrive, exec queue resources are never freed, leaving the GuC ID manager and VRAM manager in an unclean state and producing kernel WARNING/ERROR traces. The upstream fix (cherry-picked from commit 9b42321a02c5) releases the resources directly when the GuC is not running; EPSS is very low (0.03%) and there is no public exploit identified at time of analysis.
Local resource-leak and kernel-warning condition in the Linux kernel's NXP i.MX8-ISI mem2mem (m2m) media driver (imx8-isi) lets a local user with access to the V4L2 video device leave an ISI channel permanently allocated by terminating a streaming application uncleanly (e.g. Ctrl+C), because imbalanced streamon/streamoff calls prevent the m2m usage_count from reaching zero. On i.MX95-class hardware, streaming with an input line width greater than 2K additionally trips a WARN_ON() in mxc_isi_channel_chain(). This carries a low EPSS (0.03%, 10th percentile), is not on CISA KEV, and has no public exploit identified at time of analysis; a vendor fix is available.
Denial of service (and potential information disclosure) in the Linux kernel's Intel VT-d IOMMU debugfs interface allows a privileged local user to crash the host by reading the domain translation dump. When a device's context entry uses a legacy-mode translation type other than 00b/01b, the SSPTPTR field is uninitialized or zero, and the debugfs code walks it as a valid page-table pointer, producing a general-protection fault on a non-canonical address. No public exploit identified at time of analysis; EPSS is negligible (0.03%) and this is not in CISA KEV.
Local denial of service in the Linux kernel's LoongArch BPF JIT allows a low-privileged local user with BPF tracing capability to crash the system by attaching a trampoline (fentry/fexit) program to a function whose arguments include a struct passed by value. On LoongArch the trampoline code never implemented struct-by-value handling, so the generated code dereferences an invalid address and triggers a kernel oops with subsequent RCU stalls. This is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is 0.03% (10th percentile), consistent with a niche, architecture-specific crash rather than a widely weaponized flaw.
Denial-of-service race condition in the Linux kernel's rtl8150 USB-to-Ethernet driver allows a kernel WARNING and double URB submission when the ndo_set_rx_mode path (rtl8150_set_multicast) improperly wakes the TX queue before an in-flight transmit URB completes, colliding with rtl8150_start_xmit. It affects systems using an RTL8150-based USB Ethernet adapter and was surfaced by syzbot fuzzing; no public exploit identified at time of analysis and EPSS is low (0.07%). The supplied 8.8 CVSS (AV:A/C:H/I:H/A:H) appears substantially inflated for what is fundamentally a local driver race with availability impact.
Use-after-free in the Linux kernel's MPTCP (Multipath TCP) subsystem allows potential kernel memory corruption during active connection establishment. The flaw lives in mptcp_active_enable(), reached via subflow_finish_connect()/sk_rx_dst_set(), where the destination cache is dereferenced (sk_dst_get(sk)->dev) outside RCU protection, permitting a freed dst/device pointer to be accessed. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), indicating negligible observed exploitation despite the 8.1 CVSS.
Local memory-safety mishandling in the Linux kernel's SPARC (UltraSPARC III) copy_from_user/copy_to_user routines causes these functions to return impossibly large "bytes not copied" values when a user-space access faults, because the %o2 register masking was performed after the bulk copy loop instead of before the exception handlers ran. Downstream consumers such as __copy_from_iter propagate the bogus count, which was observed triggering a BUG_ON in ext4 with large folios enabled, and can lead to kernel state corruption, information disclosure of uninitialized memory, or denial of service. No public exploit is identified at time of analysis (EPSS 0.09%, not in CISA KEV); the flaw is limited to legacy SPARC hardware.
Memory corruption in the Linux kernel pm80xx SCSI driver (drivers/scsi/pm8001/pm8001_sas.c) lets a privileged local operation trigger an out-of-bounds array write when a module unload (rmmod) occurs on a system with a SAS expander attached. Introduced by commit f7b705c238d1, the flaw causes the driver to index the fixed 16-entry pm8001_ha->phy array with a remote expander phy id (observed index 28), corrupting kernel memory during teardown. No public exploit identified at time of analysis; EPSS is low (0.07%, 21st percentile) and it is not on CISA KEV, consistent with a stability/robustness bug rather than a weaponized escalation path.
Local privilege escalation and memory corruption in the Linux kernel's pci_endpoint_test misc driver stems from an array underflow reachable through the driver's ioctl handler. A regression from commit eefb83790a0d (which added the doorbell test case and introduced NO_BAR = -1 into the pci_barno enum, silently converting it to a signed type) lets a user passing a negative BAR number in pci_endpoint_test_ioctl() drive pci_endpoint_test_bar() to index before the start of the BAR array. There is no public exploit identified at time of analysis and EPSS rates near-term mass exploitation at 0.03%, but the flaw affects the ubiquitous Linux kernel wherever the pci-endpoint-test device node is exposed.
Incorrect fault-handling in the SPARC (Niagara) implementation of copy_from_user and copy_to_user in the Linux kernel causes wrong remaining-byte calculations and a broken epilogue when a user-space memory reference faults, leading to kernel crashes and incorrect return values from these core copy routines. The flaw is SPARC-architecture specific (Niagara/UltraSPARC T-series) and is fixed upstream; it is tagged as a denial-of-service issue. No public exploit identified at time of analysis, and EPSS is very low (0.07%, 21st percentile).
Soft Serve is a self-hostable Git server for the command line. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Milvus is an open-source vector database built for generative AI applications. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Incus is a system container and virtual machine manager. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Soft Serve is a self-hostable Git server for the command line. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
calibre is an e-book manager. Rated critical severity (CVSS 9.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 5.0). Public exploit code available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. Public exploit code available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 4.7). Public exploit code available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 4.7). Public exploit code available.
Zitadel is an open source identity management platform. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
containerd is an open-source container runtime. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. This Memory Leak vulnerability could allow attackers to exhaust available memory leading to denial of service.
kgateway is a Cloud-Native API and AI Gateway. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required. No vendor patch available.
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Jellysweep is a cleanup tool for the Jellyfin media server. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
runc is a CLI tool for spawning and running containers according to the OCI specification. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
containerd is an open-source container runtime. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity.
MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved handling of caches. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected cross-site scripting in the search fields of SUSE Manager Server lets an attacker run arbitrary JavaScript in an authenticated administrator's browser when the victim opens a crafted URL, potentially exposing session data and allowing actions with the victim's privileges. The flaw affects SUSE Manager 5.0 container builds before 5.0.28-150600.3.36.8 and SUSE Manager Server LTS 4.3 before 4.3.88-150400.3.113.5; exploitation requires an authenticated victim (CVSS PR:L) to be socially engineered into loading the link. No public exploit code or confirmed active exploitation was identified at time of analysis, and the payload is non-persistent, so each victim must be individually targeted.
Path traversal in tftpsync's add and delete scripts allows an unauthenticated remote attacker on an adjacent network to write or delete files with the privileges of the unprivileged wwwrun user. Access is restricted to an explicit IP allow-list, so the attacker must originate from, spoof, or compromise an allow-listed host on that adjacent network; these constraints narrow the realistic attacker population. No public exploit code has been identified at time of analysis, and impact is capped by the wwwrun account rather than root.
Local memory corruption in the Linux kernel's DRM GPU scheduler (drm/sched) stems from a double free in drm_sched_job_add_resv_dependencies(), where a dma_fence reference that drm_sched_job_add_dependency() already consumed on its failure path is released a second time when the backing xarray fails to expand. Any local user able to submit GPU jobs on an affected kernel can trigger the flaw, leading to kernel memory corruption and denial of service. There is no public exploit identified at time of analysis, EPSS is low (0.19%), and it is not listed in CISA KEV.
Denial of service in the Linux kernel's USB gadget RNDIS function driver (f_rndis) lets a local privileged user crash the kernel via a NULL pointer dereference. After a bind/unbind cycle leaves rndis->notify_req stale, a subsequently failing bind reaches a unified error path that calls free_request on the stale request, dereferencing ep->ops->free_request on freed/NULL state. Tagged as Denial of Service; no public exploit is identified, EPSS is low (0.19%, 9th percentile), and it is not on CISA KEV.
Kernel NULL pointer dereference in the Linux USB gadget ACM function (f_acm) allows a local privileged operator to crash the kernel after a USB gadget bind/unbind cycle. After unbind, acm->notify_req is left stale; if a subsequent bind fails, the shared error path frees the stale request and dereferences a NULL ep->ops->free_request pointer in usb_ep_free_request(), producing a fatal oops. Tagged as a Denial of Service issue; EPSS is low (0.19%, 9th percentile), no public exploit is identified, and it is not listed in CISA KEV.
Denial of service in the Linux kernel USB gadget CDC ECM function driver (f_ecm) allows a local privileged operator to crash the kernel via a NULL pointer dereference. After a USB gadget bind/unbind cycle, ecm->notify_req is left stale; if a later bind attempt fails, the shared error path tries to free the stale request and dereferences ep->ops->free_request through a NULL endpoint pointer. No public exploit identified at time of analysis and the practical impact is a kernel crash rather than the full confidentiality/integrity loss implied by the assigned 7.8 CVSS score.
Local denial of service in the Linux kernel USB gadget NCM function driver (f_ncm) allows a privileged local user managing a USB peripheral-mode gadget to crash the kernel via a NULL pointer dereference. After a bind/unbind cycle leaves ncm->notify_req stale, a subsequent failing bind reaches a unified error path that frees the stale request, dereferencing ep->ops->free_request on a NULL endpoint. Tagged as Denial of Service; no public exploit identified at time of analysis and EPSS is low (0.19%).
Recursive rwsem deadlock in the Linux kernel's ksmbd SMB server subsystem causes ksmbd worker threads to hang indefinitely when any SMB client opens a named pipe, resulting in denial of service for all SMB connections. The flaw was introduced by commit 305853cce3794, which fixed a race condition in RPC handle list access but inadvertently created a deadlock: ksmbd_session_rpc_open acquires sess->rpc_lock as a write lock, then calls ksmbd_rpc_open → ksmbd_session_rpc_method, which attempts to re-acquire the same lock as a read lock - blocking the kernel worker thread indefinitely. No public exploit code exists and EPSS is 0.14% (4th percentile), but the trigger is deterministic and reliable against any ksmbd deployment once valid SMB credentials are obtained. This vulnerability is not in CISA KEV.
Out-of-bounds memory read in the Linux kernel's hfsplus filesystem driver (fixed in 6.17-rc series) allows a local user to leak adjacent slab memory and crash the system when the kernel parses a maliciously crafted HFS+ volume. The flaw lives in hfsplus_strcasecmp() during B-tree catalog record comparison and is reached through ordinary path lookup on a mounted HFS+ image. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), consistent with a local, filesystem-parsing memory-safety bug rather than a remotely weaponizable one.
Denial of service in the Linux kernel's NFS server (NFSD) allows a pNFS client to crash the host by sending a LAYOUTCOMMIT operation against a FlexFiles-type layout, for which NFSD previously defined no proc_layoutcommit handler. Any system exporting files over pNFS with the FlexFiles layout driver is affected until patched. This is a stability/availability bug (no confirmed data compromise); no public exploit identified at time of analysis and it is not listed in CISA KEV, with a low EPSS of 0.20% (10th percentile).
Use-after-free in X.Org X server and Xwayland during Present extension notification processing allows local authenticated users to achieve arbitrary code execution or denial of service. The flaw affects core display server components across multiple Linux distributions, with Red Hat confirming patches through 15 security advisories (RHSA-2025:19432 through RHSA-2025:22055). CVSS 7.3 reflects high integrity and availability impact with low confidentiality impact. No active exploitation confirmed (not in CISA KEV). EPSS data not provided, but the local attack vector and authentication requirement reduce remote exploitation risk despite the severity of potential impact.
Denial of service in ISC Kea's kea-dhcp4 DHCPv4 server (versions 3.0.1 and 3.1.1 through 3.1.2) lets a remote, unauthenticated attacker crash the daemon by sending DHCPv4 messages containing certain crafted option content, taking the DHCP service down for the whole subnet. The flaw is conditional: it is reachable only when the operator has set ddns-qualifying-suffix to a non-empty value while leaving hostname-char-set at its default ('[^A-Za-z0-9.-]') and hostname-char-replacement empty; DDNS updates themselves do not need to be enabled for the crash to occur. Exploitation results in availability loss only (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); there is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.42% (34th percentile).
Out-of-bounds read in the Linux kernel's ksmbd in-kernel SMB server allows a 4-byte read past a declared IPC payload boundary when handle_response() in transport_ipc.c dereferences a message handle without first validating that the payload is at least 4 bytes long. The flaw is triggered by a malformed or truncated message from the userspace ksmbd.mountd helper, potentially leaking a small amount of adjacent kernel memory or crashing the kernel. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low at 0.19% (9th percentile).
Unrestricted client-to-client traffic in Sliver's custom WireGuard netstack (1.5.43 and earlier, plus the 1.6.0-dev development build) lets any peer on the same WireGuard overlay reach every other peer, so a leaked or memory-recovered beacon keypair can be used to attack operators or to reach port forwardings exposed by other implants. Exploitation is not possible from the general internet: the attacker must already occupy a peer position on the Sliver WireGuard network, either by holding operator/beacon configurations that connect to the same CLI-created listener or by extracting a beacon's private key, public key and endpoint from a process dump. Vendor-released patch: 1.5.44. EPSS is low (0.24%, 14th percentile) and the CVE is not in CISA KEV; no public exploit code identified at time of analysis, though the upstream advisory describes a step-by-step reproduction procedure.
Kernel panic (and potential memory corruption) in the Linux kernel BPF JIT on the RISC-V architecture allows a local privileged actor to crash the system when a BPF struct_ops program (such as a bpf_qdisc scheduler) returns a pointer. The RISC-V JIT epilogue sign-extended struct_ops return values as if they were 32-bit scalars, violating the RISC-V calling convention and corrupting the returned 64-bit pointer, which the network qdisc path then dereferences. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and this affects only RISC-V builds using the BPF qdisc/struct_ops feature.
Memory/object reference leak in the Linux kernel's drm/msm (Qualcomm Adreno GPU) driver lets a local user with GPU device access leak kernel object references when the VM_BIND ioctl error path fails a handle lookup partway through, dropping already-obtained GEM object references incorrectly. It affects Linux kernels carrying the newer MSM VM_BIND uAPI and is patched upstream via kernel.org stable commits. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not listed in CISA KEV.
Local privilege-to-data compromise in the Linux kernel NTFS3 driver allows an attacker who can supply a crafted NTFS volume to bypass inode access checks and read or destroy arbitrary on-disk data. The flaw is an unvalidated integer overflow in run_unpack(), which decodes the compressed runlist ($DATA runs) mapping virtual clusters to logical clusters (LCNs); a forged runlist yields out-of-bounds LCNs. Rated CVSS 8.4 (high) with no public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and it is not in CISA KEV.
Local filesystem corruption / potential memory corruption in the Linux kernel's ntfs3 driver arises when an index allocation is performed against a $BITMAP attribute that is empty while index blocks already exist on disk. An attacker who can get a victim to mount a malformed NTFS image can drive the driver into an inconsistent index state during rename() of long filenames, causing subsequent operations to fail (-ENOENT) and reflecting on-disk corruption that the driver previously failed to reject. There is no public exploit identified at time of analysis, the EPSS probability is low (0.19%, 9th percentile), and it is not listed in CISA KEV.
Memory corruption in the Linux kernel's crypto compression subsystem (scomp/acomp) arises because struct layout randomization can reorder the alloc_ctx and free_ctx function pointers in scomp_alg independently of the crypto_acomp_streams struct that was built to mirror them, introduced by commit 42d9f6c77479. When the CONFIG_RANDSTRUCT hardening feature reorders these pure ops structures inconsistently, the kernel invokes the wrong context allocation/free callback, leading to high-impact confidentiality, integrity, and availability effects for a local low-privileged actor. No public exploit identified at time of analysis and EPSS probability is low (0.17%), so this is a hardening-regression fix rather than an actively exploited flaw.
Improper enablement of IOMMU dirty page tracking in the Intel VT-d (iommu/vt-d) driver of the Linux kernel allows a misconfiguration where dirty tracking is offered even when the IOMMU performs incoherent page walks. Because the hardware cannot atomically update A/EA/D bits in non-snooped paging-structure entries, this triggers a non-recoverable fault and can corrupt or silently drop dirty-page state used during operations like VM live migration. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and this is a corrective hardening patch rather than an actively exploited flaw.
Local privilege escalation risk in the Linux kernel's io_uring waitid handling stems from a race condition in io_waitid_wait(), where a successful return failed to prune the task's entry from the wait queue when a cancelation was concurrently in progress, allowing the wait queue callback to be invoked twice against a stale entry. Authenticated local attackers (PR:L per CVSS) could exploit this to corrupt kernel memory with high confidentiality, integrity, and availability impact (CVSS 7.8). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Improper accounting in the Linux kernel's io_uring zero-copy receive (zcrx) path allows a zcrx recv request to return more data than the caller requested, caused by desc->count being adjusted for all received buffers and then double-counted during recursive processing of frag-list skbs, leading to counter underflow. Affected are Linux kernels shipping the io_uring zcrx feature, where a local process using this interface can read beyond the intended receive limit. There is no public exploit identified at time of analysis, and EPSS is low (0.19%, 9th percentile), consistent with an internal kernel-hardening fix rather than an actively exploited flaw.
Memory corruption in the Linux kernel's wcd937x ASoC audio codec driver occurs because the SoundWire port for the HPHL_COMP and HPHR_COMP compander components is set to zero, causing an out-of-bounds access at index -1 of the port_map array during driver operation. Local low-privileged users on devices using this Qualcomm codec can trigger kernel memory corruption (CVSS 7.8). There is no public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and the fix has already been merged upstream.
Uninitialized-memory disclosure in the Linux kernel's NFC NCI subsystem lets a local actor with access to the NCI interface trigger reads of unallocated skb->data by submitting NCI control packets whose declared header length passes the weak nic_valid_size() check but does not match the actual buffer layout expected per opcode. The flaw, found by Syzbot in nci_init_req, affects Linux kernels built with the NFC/NCI stack; it is tagged Information Disclosure with an EPSS of 0.21% (11th percentile) and no public exploit identified at time of analysis. Upstream fixes add per-handler parameter validation and silently drop malformed packets.
Kernel panic (denial of service) in the Linux kernel's LoongArch BPF JIT compiler affects systems running on LoongArch (Loongson) 64-bit CPUs when BPF struct_ops programs - such as a BPF-based qdisc - are attached and their pointer return values are consumed by the kernel networking path. The LoongArch JIT epilogue sign-extended 32-bit return values as it does for ordinary BPF programs, but struct_ops functions must follow the LoongArch calling ABI, so a returned pointer (e.g. an skb from bpf_fifo_dequeue) was truncated/sign-extended into an invalid address that the kernel then dereferenced, causing an unhandled paging fault in __qdisc_run(). This is no public exploit identified at time of analysis and is not on CISA KEV; EPSS is low (0.19%, 9th percentile).
Race conditions in the ksmbd in-kernel SMB server's RPC handle list (sess->rpc_handle_list XArray) expose systems to use-after-free and kernel availability loss. ksmbd_session_rpc_open() incorrectly acquired only a read lock before performing mutating XArray operations, and ksmbd_session_rpc_method() performed xa_load() with no lock at all - creating a window where concurrent session operations can corrupt or dereference freed memory. No public exploit exists and EPSS is 0.13% (3rd percentile), placing real-world exploitation risk very low, though the use-after-free primitive carries latent potential beyond the scored availability impact.
Local privilege escalation and memory corruption in the Linux kernel's Android binder IPC driver arises from a double-free in the dynamic bitmap (dbitmap) allocator used for per-process reference tracking. When a process's dmap expansion fails, dbitmap_grow() frees the old bitmap, but the pointer is not cleared, so binder_proc_dec_tmpref() frees it a second time at process teardown, corrupting the kernel heap. This is a memory-safety flaw exploitable by any local user with binder access (default on Android and many Linux systems); there is no public exploit identified at time of analysis and the EPSS score is low (0.19%).
Local privilege escalation and denial of service in the Linux kernel's 9p (Plan 9) filesystem transport (net/9p/trans_fd.c) arises from a double request free in p9_fd_cancelled(). A race between p9_read_work() cancelling pending requests and p9_fd_cancelled() cleaning up a flush request causes the same req_list entry to be removed twice via list_del(), corrupting kernel list pointers (the classic 0xdead000000000100 poison), yielding a GPF/KASAN wild-memory-access that a local user can trigger by mounting a malicious 9p share. No public exploit identified at time of analysis; the flaw was found by the Linux Verification Center with Syzkaller, and EPSS is low at 0.22% (12th percentile).
Local denial-of-service in the Linux kernel's F2FS filesystem allows an attacker who can mount a crafted F2FS image to trigger a kernel BUG_ON panic during a fallocate punch-hole operation. The flaw stems from missing validation of the node footer for non-inode direct nodes (dnodes), which lets a corrupted dnode be misparsed as an inode and produce an invalid truncation count. No public exploit has been identified at time of analysis and EPSS is low (0.17%, 7th percentile); reproduction requires a deliberately fuzzed on-disk image (syzbot-discovered).
Use-after-free in the Linux kernel vhost subsystem allows a local attacker with access to vhost worker devices to trigger access to a freed task_struct, potentially leading to privilege escalation or a kernel crash on hosts running virtio/vhost-backed virtualization. The flaw occurs when a vhost_task exits early via a signal and a pending vhost_task_wake() dereferences the released task structure. There is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with a local race-condition bug rather than a mass-exploitation target.
Use-after-free and kernel WARNING in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local user to trigger memory corruption via the splice() path on an SMC socket. The smc_lo_register_dmb() loopback path allocates DMB buffers with kzalloc() (kmalloc memory, not page-backed), which are later handed to get_page() in smc_rx_splice(); this fires WARN_ON_ONCE() and can leave the buffer freed before splice_to_pipe() completes, creating a use-after-free. CVSS 7.8 (local, C:H/I:H/A:H); EPSS is low (0.22%, 13th percentile) and there is no public exploit identified at time of analysis.
Local denial of service (and potential memory corruption) in the Linux kernel's hugetlbfs subsystem occurs because remove_inode_single_folio checks folio mapping state without holding the folio lock, racing with page migration; when a hugepage is migrated to a migration entry, folio_mapped() wrongly returns false, migration is then reverted, and the folio ends up mapped after deletion, tripping a BUG in filemap_unaccount_folio. Affected are kernels using hugetlbfs with hole-punch fallocate concurrent with migration (observed on 6.17-rc5 and backported to multiple stable branches). No public exploit identified at time of analysis; EPSS is low (0.24%, 15th percentile) and the issue is not in CISA KEV.
An attacker-supplied PNG image can drive an out-of-bounds heap write in libwebsockets' UPNG decoder when a crafted oversized width value overflows the arithmetic used to size a heap allocation. Only deployments compiled with the non-default LWS_WITH_UPNG flag that also exercise the library's HTML display stack are exposed, and exploitation additionally requires a user to visit an attacker-controlled page serving the malicious PNG, so the realistically reachable population is small. Impact is limited to a crash or denial of service (availability only, no confidentiality or integrity loss); no public exploit code has been identified at time of analysis and EPSS is low at 0.39% (31st percentile).
A heap out-of-bounds read in libwebsockets' lws_upng_emit_next_line() function can crash an application when the library is compiled with the non-default LWS_WITH_UPNG flag and the HTML display stack is in use. A remote, unauthenticated attacker can trigger the flaw by hosting a crafted PNG with an abnormally large height dimension on a site the victim visits, causing the affected process to read past a heap-allocated buffer and potentially terminate. Exploitation is constrained by the compile-time feature gate and the requirement that the HTML display path be reachable, so vulnerable builds are uncommon; EPSS is low (0.39%, 31st percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Stack-based buffer overflow in the libwebsockets asynchronous DNS resolver (lws_adns_parse_label) can corrupt memory when the library is compiled with the LWS_WITH_SYS_ASYNC_DNS flag, which is not the default build configuration. An attacker positioned to observe a victim's outbound DNS query (adjacent/on-path, AV:A) can race to inject a spoofed response carrying a transaction ID that matches the pending query and a DNS label longer than the maximum supported length, overflowing the fixed label_stack and potentially achieving code execution or denial of service. Exploitation is conditional on the non-default async-DNS build and on the attacker's ability to sniff DNS traffic; no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Use-after-free in the WebSocket server handshake handling of libwebsockets (warmcat) can cause a denial of service when an application embedding the library provides a callback for the LWS_CALLBACK_HTTP_CONFIRM_UPGRADE event. Exploitation requires a specific, non-default configuration where that callback is registered; the attack is network-reachable and unauthenticated but has high attack complexity due to a timing-sensitive condition (AT:P). The impact is limited to availability (no confidentiality or integrity loss), EPSS is low (0.40%, 33rd percentile), and no public exploit or active exploitation has been identified; an upstream fix commit is available.
Use-after-free in the Linux kernel's iMON RC (remote control) driver (drivers/media/rc/imon.c) allows a local user with access to the device's VFD/LCD character-device interface to trigger memory corruption by racing writes against USB disconnect. The imon_disconnect() path unconditionally calls usb_put_dev() on usbdev_intf0/usbdev_intf1 without coordinating with in-flight writers, so a concurrent vfd_write()/send_packet() dereferences a freed usb_device pointer. Discovered via Syzkaller by the Linux Verification Center; no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.22%).
Local privilege-context buffer overflow in the Linux kernel's ETAS ES58x CAN USB driver (etas_es58x) lets a user with network capabilities corrupt kernel memory by injecting oversized CAN XL frames. Because the driver never implemented ndo_change_mtu(), an attacker can raise the interface MTU beyond CAN limits, then use a PF_PACKET raw socket with ETH_P_CANXL to smuggle a frame whose length field (up to 0xff) is memcpy'd into an 8-byte buffer, overflowing it by up to 247 bytes. CVSS is 7.8 (High); there is no public exploit identified at time of analysis and EPSS is low (0.22%), consistent with the requirement for local access and specific ETAS hardware.
Local privilege-to-kernel buffer overflow in the Linux kernel's hi311x (Holt HI-3110) CAN controller driver allows a user with network configuration capability to trigger an out-of-bounds heap write by injecting an oversized CAN XL frame. Because the driver never implemented ndo_change_mtu(), an attacker can raise the interface MTU beyond CAN_MTU and push a crafted frame through PF_PACKET whose length field (up to 0xff) is copied verbatim in hi3110_hw_tx(), overflowing an 8-byte buffer by up to 247 bytes. There is no public exploit identified at time of analysis, and the EPSS score is low (0.22%, 13th percentile); the issue has been resolved upstream in the mainline and stable kernel trees.
Local privilege-enabled buffer overflow in the Linux kernel's sun4i_can CAN controller driver (Allwinner A10/A20 SoCs) allows an attacker holding network-admin capability to write out of bounds by injecting oversized CAN XL frames. Because the driver never populated ndo_change_mtu(), the interface MTU can be raised past CAN_MTU, letting a PF_PACKET raw socket push a frame whose length field is misread as a CAN data length, overflowing a fixed buffer by up to 247 bytes. There is no public exploit identified at time of analysis and EPSS is low (0.22%), but the description includes a detailed, working reproduction path.
Local privilege-holders can trigger a kernel heap buffer overflow in the Linux mcba_usb CAN driver (Microchip CAN BUS Analyzer USB adapter) by raising the interface MTU beyond CAN_MTU and injecting a crafted CAN XL frame through a PF_PACKET raw socket. Because the driver never implemented ndo_change_mtu(), an attacker can set an oversized MTU (e.g. 9999), then send an ETH_P_CANXL frame whose flags byte is misread as the classic-CAN length field, causing memcpy to copy up to 247 bytes past the intended 8-byte buffer. This is a memory-corruption issue with high confidentiality, integrity and availability impact (CVSS 7.8); there is no public exploit identified at time of analysis, though the advisory includes a detailed reproduction, and EPSS is low at 0.22%.
A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the info() function of bin_ne.c. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load() function of bin_dyldcache.c. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Local privilege-adjacent memory corruption in the Linux kernel's listmount() mount-enumeration syscall arises because the code invoked path_put() while still holding the namespace semaphore; if that call drops the final reference to a path, cleanup runs under the held lock and can trigger a use-after-free or deadlock. Any local user able to call listmount() is affected on vulnerable stable kernels, and while EPSS is very low (0.03%) with no public exploit identified at time of analysis, the NVD-assigned CVSS of 7.8 reflects full CIA impact from local exploitation. The fix relocates the reference drop to outside the lock across three stable-branch commits.
Local privilege-relevant memory corruption in the Linux kernel's IPMI (Intelligent Platform Management Interface) subsystem stems from flawed user-message limit accounting, including improper reference counting and a use-after-free when messages are allocated in the receive path. A local user with access to the IPMI device can trigger the flaw to crash the system or potentially corrupt kernel memory, and while tagged as Denial of Service, the CVSS:3.1 vector rates full confidentiality, integrity, and availability impact (7.8). There is no public exploit identified at time of analysis, and the very low EPSS score (0.03%, 10th percentile) reflects limited near-term mass-exploitation expectation.
Filesystem corruption and denial of service in the Linux kernel's ext4 extended-attribute (EA) inode handling allows a local attacker who can mount a crafted or corrupted ext4 image to trigger a reference-count underflow in ext4_xattr_inode_update_ref(). Because the code previously read an EA inode refcount that was already <= 0 and still applied the change (typically -1), it proceeded on a bogus negative value, spawning EXT4-fs errors and orphan/cleanup churn. No public exploit identified at time of analysis, and the EPSS score is very low (0.07%), consistent with a corruption-triggered fault rather than a readily weaponized remote flaw.
Local privilege-escalation and memory-corruption in the Linux kernel's crypto skcipher (symmetric block cipher) framework allows a low-privileged local user to corrupt kernel memory by exercising an skcipher algorithm that declares its request size via the new cra_reqsize field. The regression stems from commit afddce13ce81d, which added cra_reqsize for ahash/acomp but left skcipher's framework paths unaware of it, so per-request scratch buffers are undersized. EPSS is negligible (0.03%), the issue is not on the CISA KEV list, and no public exploit is identified - the tags characterize the practical outcome as denial of service (kernel crash), though memory corruption leaves privilege escalation theoretically possible.
Ceph is a distributed object, block, and file storage platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE) token with an exceptionally high. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Missing memory-barrier ordering in the x86 memory-management code of the Linux kernel allows stale TLB entries to persist after an address-space switch, because switch_mm_irqs_off() can fail to observe a recent tlb_gen update from flush_tlb_mm_range(). On affected x86 SMP systems a local, low-privileged process could read or corrupt memory mappings it should no longer have access to, mapping to the CVSS 7.8 high/high/high impact. No public exploit identified at time of analysis, and the EPSS score is negligible (0.03%, 10th percentile), indicating this is a subtle correctness/race fix rather than an actively-targeted flaw.
Memory corruption in the Linux kernel's accel/qaic driver (Qualcomm Cloud AI 100 accelerator) allows a local user to trigger a general protection fault by submitting a DMA transfer request with a zero length, or when the device requests continuation (QAIC_TRANS_DMA_XFER_CONT) after all bytes have already been transferred. In these cases find_and_map_user_pages() returns 0 without allocating the scatter-gather table, and encode_addr_size_pairs() then dereferences the unallocated sgt, faulting the kernel. EPSS is very low (0.03%) and there is no public exploit identified at time of analysis, but distro patches (Ubuntu USN-8125-1/8126-1) are already shipping.
Local information disclosure and potential use-after-free in the Linux kernel networking stack stems from unprotected reads of the destination cache device pointer (dst->dev) in sk_setup_caps() and related IPv4/IPv6 forwarding paths. Affected builds accessed dst->dev without RCU protection, allowing a concurrent update to free the device while another CPU dereferenced it. There is no public exploit identified at time of analysis, EPSS probability is negligible (0.03%), and the issue is not in CISA KEV; the upstream fix switches these call sites to the RCU-safe dst_dev_rcu()/dst_dev_net_rcu() helpers.
Improper resource cleanup in the Linux kernel's Intel Xe DRM driver (drm/xe/guc) lets a local user trigger a memory-management fault when destroying a GPU exec queue after the GuC firmware has already been stopped - for example during a forced driver unbind. Because the driver waits for a GuC response that can never arrive, exec queue resources are never freed, leaving the GuC ID manager and VRAM manager in an unclean state and producing kernel WARNING/ERROR traces. The upstream fix (cherry-picked from commit 9b42321a02c5) releases the resources directly when the GuC is not running; EPSS is very low (0.03%) and there is no public exploit identified at time of analysis.
Local resource-leak and kernel-warning condition in the Linux kernel's NXP i.MX8-ISI mem2mem (m2m) media driver (imx8-isi) lets a local user with access to the V4L2 video device leave an ISI channel permanently allocated by terminating a streaming application uncleanly (e.g. Ctrl+C), because imbalanced streamon/streamoff calls prevent the m2m usage_count from reaching zero. On i.MX95-class hardware, streaming with an input line width greater than 2K additionally trips a WARN_ON() in mxc_isi_channel_chain(). This carries a low EPSS (0.03%, 10th percentile), is not on CISA KEV, and has no public exploit identified at time of analysis; a vendor fix is available.
Denial of service (and potential information disclosure) in the Linux kernel's Intel VT-d IOMMU debugfs interface allows a privileged local user to crash the host by reading the domain translation dump. When a device's context entry uses a legacy-mode translation type other than 00b/01b, the SSPTPTR field is uninitialized or zero, and the debugfs code walks it as a valid page-table pointer, producing a general-protection fault on a non-canonical address. No public exploit identified at time of analysis; EPSS is negligible (0.03%) and this is not in CISA KEV.
Local denial of service in the Linux kernel's LoongArch BPF JIT allows a low-privileged local user with BPF tracing capability to crash the system by attaching a trampoline (fentry/fexit) program to a function whose arguments include a struct passed by value. On LoongArch the trampoline code never implemented struct-by-value handling, so the generated code dereferences an invalid address and triggers a kernel oops with subsequent RCU stalls. This is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is 0.03% (10th percentile), consistent with a niche, architecture-specific crash rather than a widely weaponized flaw.
Denial-of-service race condition in the Linux kernel's rtl8150 USB-to-Ethernet driver allows a kernel WARNING and double URB submission when the ndo_set_rx_mode path (rtl8150_set_multicast) improperly wakes the TX queue before an in-flight transmit URB completes, colliding with rtl8150_start_xmit. It affects systems using an RTL8150-based USB Ethernet adapter and was surfaced by syzbot fuzzing; no public exploit identified at time of analysis and EPSS is low (0.07%). The supplied 8.8 CVSS (AV:A/C:H/I:H/A:H) appears substantially inflated for what is fundamentally a local driver race with availability impact.
Use-after-free in the Linux kernel's MPTCP (Multipath TCP) subsystem allows potential kernel memory corruption during active connection establishment. The flaw lives in mptcp_active_enable(), reached via subflow_finish_connect()/sk_rx_dst_set(), where the destination cache is dereferenced (sk_dst_get(sk)->dev) outside RCU protection, permitting a freed dst/device pointer to be accessed. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), indicating negligible observed exploitation despite the 8.1 CVSS.
Local memory-safety mishandling in the Linux kernel's SPARC (UltraSPARC III) copy_from_user/copy_to_user routines causes these functions to return impossibly large "bytes not copied" values when a user-space access faults, because the %o2 register masking was performed after the bulk copy loop instead of before the exception handlers ran. Downstream consumers such as __copy_from_iter propagate the bogus count, which was observed triggering a BUG_ON in ext4 with large folios enabled, and can lead to kernel state corruption, information disclosure of uninitialized memory, or denial of service. No public exploit is identified at time of analysis (EPSS 0.09%, not in CISA KEV); the flaw is limited to legacy SPARC hardware.
Memory corruption in the Linux kernel pm80xx SCSI driver (drivers/scsi/pm8001/pm8001_sas.c) lets a privileged local operation trigger an out-of-bounds array write when a module unload (rmmod) occurs on a system with a SAS expander attached. Introduced by commit f7b705c238d1, the flaw causes the driver to index the fixed 16-entry pm8001_ha->phy array with a remote expander phy id (observed index 28), corrupting kernel memory during teardown. No public exploit identified at time of analysis; EPSS is low (0.07%, 21st percentile) and it is not on CISA KEV, consistent with a stability/robustness bug rather than a weaponized escalation path.
Local privilege escalation and memory corruption in the Linux kernel's pci_endpoint_test misc driver stems from an array underflow reachable through the driver's ioctl handler. A regression from commit eefb83790a0d (which added the doorbell test case and introduced NO_BAR = -1 into the pci_barno enum, silently converting it to a signed type) lets a user passing a negative BAR number in pci_endpoint_test_ioctl() drive pci_endpoint_test_bar() to index before the start of the BAR array. There is no public exploit identified at time of analysis and EPSS rates near-term mass exploitation at 0.03%, but the flaw affects the ubiquitous Linux kernel wherever the pci-endpoint-test device node is exposed.
Incorrect fault-handling in the SPARC (Niagara) implementation of copy_from_user and copy_to_user in the Linux kernel causes wrong remaining-byte calculations and a broken epilogue when a user-space memory reference faults, leading to kernel crashes and incorrect return values from these core copy routines. The flaw is SPARC-architecture specific (Niagara/UltraSPARC T-series) and is fixed upstream; it is tagged as a denial-of-service issue. No public exploit identified at time of analysis, and EPSS is very low (0.07%, 21st percentile).
Soft Serve is a self-hostable Git server for the command line. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Milvus is an open-source vector database built for generative AI applications. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Incus is a system container and virtual machine manager. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Soft Serve is a self-hostable Git server for the command line. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
calibre is an e-book manager. Rated critical severity (CVSS 9.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 5.0). Public exploit code available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. Public exploit code available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 4.7). Public exploit code available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 4.7). Public exploit code available.
Zitadel is an open source identity management platform. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
containerd is an open-source container runtime. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. This Memory Leak vulnerability could allow attackers to exhaust available memory leading to denial of service.
kgateway is a Cloud-Native API and AI Gateway. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required. No vendor patch available.
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Jellysweep is a cleanup tool for the Jellyfin media server. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
runc is a CLI tool for spawning and running containers according to the OCI specification. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
containerd is an open-source container runtime. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity.
MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved memory handling. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The issue was addressed with improved handling of caches. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected cross-site scripting in the search fields of SUSE Manager Server lets an attacker run arbitrary JavaScript in an authenticated administrator's browser when the victim opens a crafted URL, potentially exposing session data and allowing actions with the victim's privileges. The flaw affects SUSE Manager 5.0 container builds before 5.0.28-150600.3.36.8 and SUSE Manager Server LTS 4.3 before 4.3.88-150400.3.113.5; exploitation requires an authenticated victim (CVSS PR:L) to be socially engineered into loading the link. No public exploit code or confirmed active exploitation was identified at time of analysis, and the payload is non-persistent, so each victim must be individually targeted.
Path traversal in tftpsync's add and delete scripts allows an unauthenticated remote attacker on an adjacent network to write or delete files with the privileges of the unprivileged wwwrun user. Access is restricted to an explicit IP allow-list, so the attacker must originate from, spoof, or compromise an allow-listed host on that adjacent network; these constraints narrow the realistic attacker population. No public exploit code has been identified at time of analysis, and impact is capped by the wwwrun account rather than root.
Local memory corruption in the Linux kernel's DRM GPU scheduler (drm/sched) stems from a double free in drm_sched_job_add_resv_dependencies(), where a dma_fence reference that drm_sched_job_add_dependency() already consumed on its failure path is released a second time when the backing xarray fails to expand. Any local user able to submit GPU jobs on an affected kernel can trigger the flaw, leading to kernel memory corruption and denial of service. There is no public exploit identified at time of analysis, EPSS is low (0.19%), and it is not listed in CISA KEV.
Denial of service in the Linux kernel's USB gadget RNDIS function driver (f_rndis) lets a local privileged user crash the kernel via a NULL pointer dereference. After a bind/unbind cycle leaves rndis->notify_req stale, a subsequently failing bind reaches a unified error path that calls free_request on the stale request, dereferencing ep->ops->free_request on freed/NULL state. Tagged as Denial of Service; no public exploit is identified, EPSS is low (0.19%, 9th percentile), and it is not on CISA KEV.
Kernel NULL pointer dereference in the Linux USB gadget ACM function (f_acm) allows a local privileged operator to crash the kernel after a USB gadget bind/unbind cycle. After unbind, acm->notify_req is left stale; if a subsequent bind fails, the shared error path frees the stale request and dereferences a NULL ep->ops->free_request pointer in usb_ep_free_request(), producing a fatal oops. Tagged as a Denial of Service issue; EPSS is low (0.19%, 9th percentile), no public exploit is identified, and it is not listed in CISA KEV.
Denial of service in the Linux kernel USB gadget CDC ECM function driver (f_ecm) allows a local privileged operator to crash the kernel via a NULL pointer dereference. After a USB gadget bind/unbind cycle, ecm->notify_req is left stale; if a later bind attempt fails, the shared error path tries to free the stale request and dereferences ep->ops->free_request through a NULL endpoint pointer. No public exploit identified at time of analysis and the practical impact is a kernel crash rather than the full confidentiality/integrity loss implied by the assigned 7.8 CVSS score.
Local denial of service in the Linux kernel USB gadget NCM function driver (f_ncm) allows a privileged local user managing a USB peripheral-mode gadget to crash the kernel via a NULL pointer dereference. After a bind/unbind cycle leaves ncm->notify_req stale, a subsequent failing bind reaches a unified error path that frees the stale request, dereferencing ep->ops->free_request on a NULL endpoint. Tagged as Denial of Service; no public exploit identified at time of analysis and EPSS is low (0.19%).
Recursive rwsem deadlock in the Linux kernel's ksmbd SMB server subsystem causes ksmbd worker threads to hang indefinitely when any SMB client opens a named pipe, resulting in denial of service for all SMB connections. The flaw was introduced by commit 305853cce3794, which fixed a race condition in RPC handle list access but inadvertently created a deadlock: ksmbd_session_rpc_open acquires sess->rpc_lock as a write lock, then calls ksmbd_rpc_open → ksmbd_session_rpc_method, which attempts to re-acquire the same lock as a read lock - blocking the kernel worker thread indefinitely. No public exploit code exists and EPSS is 0.14% (4th percentile), but the trigger is deterministic and reliable against any ksmbd deployment once valid SMB credentials are obtained. This vulnerability is not in CISA KEV.
Out-of-bounds memory read in the Linux kernel's hfsplus filesystem driver (fixed in 6.17-rc series) allows a local user to leak adjacent slab memory and crash the system when the kernel parses a maliciously crafted HFS+ volume. The flaw lives in hfsplus_strcasecmp() during B-tree catalog record comparison and is reached through ordinary path lookup on a mounted HFS+ image. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), consistent with a local, filesystem-parsing memory-safety bug rather than a remotely weaponizable one.
Denial of service in the Linux kernel's NFS server (NFSD) allows a pNFS client to crash the host by sending a LAYOUTCOMMIT operation against a FlexFiles-type layout, for which NFSD previously defined no proc_layoutcommit handler. Any system exporting files over pNFS with the FlexFiles layout driver is affected until patched. This is a stability/availability bug (no confirmed data compromise); no public exploit identified at time of analysis and it is not listed in CISA KEV, with a low EPSS of 0.20% (10th percentile).
Use-after-free in X.Org X server and Xwayland during Present extension notification processing allows local authenticated users to achieve arbitrary code execution or denial of service. The flaw affects core display server components across multiple Linux distributions, with Red Hat confirming patches through 15 security advisories (RHSA-2025:19432 through RHSA-2025:22055). CVSS 7.3 reflects high integrity and availability impact with low confidentiality impact. No active exploitation confirmed (not in CISA KEV). EPSS data not provided, but the local attack vector and authentication requirement reduce remote exploitation risk despite the severity of potential impact.
Denial of service in ISC Kea's kea-dhcp4 DHCPv4 server (versions 3.0.1 and 3.1.1 through 3.1.2) lets a remote, unauthenticated attacker crash the daemon by sending DHCPv4 messages containing certain crafted option content, taking the DHCP service down for the whole subnet. The flaw is conditional: it is reachable only when the operator has set ddns-qualifying-suffix to a non-empty value while leaving hostname-char-set at its default ('[^A-Za-z0-9.-]') and hostname-char-replacement empty; DDNS updates themselves do not need to be enabled for the crash to occur. Exploitation results in availability loss only (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); there is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.42% (34th percentile).
Out-of-bounds read in the Linux kernel's ksmbd in-kernel SMB server allows a 4-byte read past a declared IPC payload boundary when handle_response() in transport_ipc.c dereferences a message handle without first validating that the payload is at least 4 bytes long. The flaw is triggered by a malformed or truncated message from the userspace ksmbd.mountd helper, potentially leaking a small amount of adjacent kernel memory or crashing the kernel. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low at 0.19% (9th percentile).
Unrestricted client-to-client traffic in Sliver's custom WireGuard netstack (1.5.43 and earlier, plus the 1.6.0-dev development build) lets any peer on the same WireGuard overlay reach every other peer, so a leaked or memory-recovered beacon keypair can be used to attack operators or to reach port forwardings exposed by other implants. Exploitation is not possible from the general internet: the attacker must already occupy a peer position on the Sliver WireGuard network, either by holding operator/beacon configurations that connect to the same CLI-created listener or by extracting a beacon's private key, public key and endpoint from a process dump. Vendor-released patch: 1.5.44. EPSS is low (0.24%, 14th percentile) and the CVE is not in CISA KEV; no public exploit code identified at time of analysis, though the upstream advisory describes a step-by-step reproduction procedure.
Kernel panic (and potential memory corruption) in the Linux kernel BPF JIT on the RISC-V architecture allows a local privileged actor to crash the system when a BPF struct_ops program (such as a bpf_qdisc scheduler) returns a pointer. The RISC-V JIT epilogue sign-extended struct_ops return values as if they were 32-bit scalars, violating the RISC-V calling convention and corrupting the returned 64-bit pointer, which the network qdisc path then dereferences. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and this affects only RISC-V builds using the BPF qdisc/struct_ops feature.
Memory/object reference leak in the Linux kernel's drm/msm (Qualcomm Adreno GPU) driver lets a local user with GPU device access leak kernel object references when the VM_BIND ioctl error path fails a handle lookup partway through, dropping already-obtained GEM object references incorrectly. It affects Linux kernels carrying the newer MSM VM_BIND uAPI and is patched upstream via kernel.org stable commits. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not listed in CISA KEV.
Local privilege-to-data compromise in the Linux kernel NTFS3 driver allows an attacker who can supply a crafted NTFS volume to bypass inode access checks and read or destroy arbitrary on-disk data. The flaw is an unvalidated integer overflow in run_unpack(), which decodes the compressed runlist ($DATA runs) mapping virtual clusters to logical clusters (LCNs); a forged runlist yields out-of-bounds LCNs. Rated CVSS 8.4 (high) with no public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and it is not in CISA KEV.
Local filesystem corruption / potential memory corruption in the Linux kernel's ntfs3 driver arises when an index allocation is performed against a $BITMAP attribute that is empty while index blocks already exist on disk. An attacker who can get a victim to mount a malformed NTFS image can drive the driver into an inconsistent index state during rename() of long filenames, causing subsequent operations to fail (-ENOENT) and reflecting on-disk corruption that the driver previously failed to reject. There is no public exploit identified at time of analysis, the EPSS probability is low (0.19%, 9th percentile), and it is not listed in CISA KEV.
Memory corruption in the Linux kernel's crypto compression subsystem (scomp/acomp) arises because struct layout randomization can reorder the alloc_ctx and free_ctx function pointers in scomp_alg independently of the crypto_acomp_streams struct that was built to mirror them, introduced by commit 42d9f6c77479. When the CONFIG_RANDSTRUCT hardening feature reorders these pure ops structures inconsistently, the kernel invokes the wrong context allocation/free callback, leading to high-impact confidentiality, integrity, and availability effects for a local low-privileged actor. No public exploit identified at time of analysis and EPSS probability is low (0.17%), so this is a hardening-regression fix rather than an actively exploited flaw.
Improper enablement of IOMMU dirty page tracking in the Intel VT-d (iommu/vt-d) driver of the Linux kernel allows a misconfiguration where dirty tracking is offered even when the IOMMU performs incoherent page walks. Because the hardware cannot atomically update A/EA/D bits in non-snooped paging-structure entries, this triggers a non-recoverable fault and can corrupt or silently drop dirty-page state used during operations like VM live migration. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and this is a corrective hardening patch rather than an actively exploited flaw.
Local privilege escalation risk in the Linux kernel's io_uring waitid handling stems from a race condition in io_waitid_wait(), where a successful return failed to prune the task's entry from the wait queue when a cancelation was concurrently in progress, allowing the wait queue callback to be invoked twice against a stale entry. Authenticated local attackers (PR:L per CVSS) could exploit this to corrupt kernel memory with high confidentiality, integrity, and availability impact (CVSS 7.8). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Improper accounting in the Linux kernel's io_uring zero-copy receive (zcrx) path allows a zcrx recv request to return more data than the caller requested, caused by desc->count being adjusted for all received buffers and then double-counted during recursive processing of frag-list skbs, leading to counter underflow. Affected are Linux kernels shipping the io_uring zcrx feature, where a local process using this interface can read beyond the intended receive limit. There is no public exploit identified at time of analysis, and EPSS is low (0.19%, 9th percentile), consistent with an internal kernel-hardening fix rather than an actively exploited flaw.
Memory corruption in the Linux kernel's wcd937x ASoC audio codec driver occurs because the SoundWire port for the HPHL_COMP and HPHR_COMP compander components is set to zero, causing an out-of-bounds access at index -1 of the port_map array during driver operation. Local low-privileged users on devices using this Qualcomm codec can trigger kernel memory corruption (CVSS 7.8). There is no public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and the fix has already been merged upstream.
Uninitialized-memory disclosure in the Linux kernel's NFC NCI subsystem lets a local actor with access to the NCI interface trigger reads of unallocated skb->data by submitting NCI control packets whose declared header length passes the weak nic_valid_size() check but does not match the actual buffer layout expected per opcode. The flaw, found by Syzbot in nci_init_req, affects Linux kernels built with the NFC/NCI stack; it is tagged Information Disclosure with an EPSS of 0.21% (11th percentile) and no public exploit identified at time of analysis. Upstream fixes add per-handler parameter validation and silently drop malformed packets.
Kernel panic (denial of service) in the Linux kernel's LoongArch BPF JIT compiler affects systems running on LoongArch (Loongson) 64-bit CPUs when BPF struct_ops programs - such as a BPF-based qdisc - are attached and their pointer return values are consumed by the kernel networking path. The LoongArch JIT epilogue sign-extended 32-bit return values as it does for ordinary BPF programs, but struct_ops functions must follow the LoongArch calling ABI, so a returned pointer (e.g. an skb from bpf_fifo_dequeue) was truncated/sign-extended into an invalid address that the kernel then dereferenced, causing an unhandled paging fault in __qdisc_run(). This is no public exploit identified at time of analysis and is not on CISA KEV; EPSS is low (0.19%, 9th percentile).
Race conditions in the ksmbd in-kernel SMB server's RPC handle list (sess->rpc_handle_list XArray) expose systems to use-after-free and kernel availability loss. ksmbd_session_rpc_open() incorrectly acquired only a read lock before performing mutating XArray operations, and ksmbd_session_rpc_method() performed xa_load() with no lock at all - creating a window where concurrent session operations can corrupt or dereference freed memory. No public exploit exists and EPSS is 0.13% (3rd percentile), placing real-world exploitation risk very low, though the use-after-free primitive carries latent potential beyond the scored availability impact.
Local privilege escalation and memory corruption in the Linux kernel's Android binder IPC driver arises from a double-free in the dynamic bitmap (dbitmap) allocator used for per-process reference tracking. When a process's dmap expansion fails, dbitmap_grow() frees the old bitmap, but the pointer is not cleared, so binder_proc_dec_tmpref() frees it a second time at process teardown, corrupting the kernel heap. This is a memory-safety flaw exploitable by any local user with binder access (default on Android and many Linux systems); there is no public exploit identified at time of analysis and the EPSS score is low (0.19%).
Local privilege escalation and denial of service in the Linux kernel's 9p (Plan 9) filesystem transport (net/9p/trans_fd.c) arises from a double request free in p9_fd_cancelled(). A race between p9_read_work() cancelling pending requests and p9_fd_cancelled() cleaning up a flush request causes the same req_list entry to be removed twice via list_del(), corrupting kernel list pointers (the classic 0xdead000000000100 poison), yielding a GPF/KASAN wild-memory-access that a local user can trigger by mounting a malicious 9p share. No public exploit identified at time of analysis; the flaw was found by the Linux Verification Center with Syzkaller, and EPSS is low at 0.22% (12th percentile).
Local denial-of-service in the Linux kernel's F2FS filesystem allows an attacker who can mount a crafted F2FS image to trigger a kernel BUG_ON panic during a fallocate punch-hole operation. The flaw stems from missing validation of the node footer for non-inode direct nodes (dnodes), which lets a corrupted dnode be misparsed as an inode and produce an invalid truncation count. No public exploit has been identified at time of analysis and EPSS is low (0.17%, 7th percentile); reproduction requires a deliberately fuzzed on-disk image (syzbot-discovered).
Use-after-free in the Linux kernel vhost subsystem allows a local attacker with access to vhost worker devices to trigger access to a freed task_struct, potentially leading to privilege escalation or a kernel crash on hosts running virtio/vhost-backed virtualization. The flaw occurs when a vhost_task exits early via a signal and a pending vhost_task_wake() dereferences the released task structure. There is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with a local race-condition bug rather than a mass-exploitation target.
Use-after-free and kernel WARNING in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local user to trigger memory corruption via the splice() path on an SMC socket. The smc_lo_register_dmb() loopback path allocates DMB buffers with kzalloc() (kmalloc memory, not page-backed), which are later handed to get_page() in smc_rx_splice(); this fires WARN_ON_ONCE() and can leave the buffer freed before splice_to_pipe() completes, creating a use-after-free. CVSS 7.8 (local, C:H/I:H/A:H); EPSS is low (0.22%, 13th percentile) and there is no public exploit identified at time of analysis.
Local denial of service (and potential memory corruption) in the Linux kernel's hugetlbfs subsystem occurs because remove_inode_single_folio checks folio mapping state without holding the folio lock, racing with page migration; when a hugepage is migrated to a migration entry, folio_mapped() wrongly returns false, migration is then reverted, and the folio ends up mapped after deletion, tripping a BUG in filemap_unaccount_folio. Affected are kernels using hugetlbfs with hole-punch fallocate concurrent with migration (observed on 6.17-rc5 and backported to multiple stable branches). No public exploit identified at time of analysis; EPSS is low (0.24%, 15th percentile) and the issue is not in CISA KEV.
An attacker-supplied PNG image can drive an out-of-bounds heap write in libwebsockets' UPNG decoder when a crafted oversized width value overflows the arithmetic used to size a heap allocation. Only deployments compiled with the non-default LWS_WITH_UPNG flag that also exercise the library's HTML display stack are exposed, and exploitation additionally requires a user to visit an attacker-controlled page serving the malicious PNG, so the realistically reachable population is small. Impact is limited to a crash or denial of service (availability only, no confidentiality or integrity loss); no public exploit code has been identified at time of analysis and EPSS is low at 0.39% (31st percentile).
A heap out-of-bounds read in libwebsockets' lws_upng_emit_next_line() function can crash an application when the library is compiled with the non-default LWS_WITH_UPNG flag and the HTML display stack is in use. A remote, unauthenticated attacker can trigger the flaw by hosting a crafted PNG with an abnormally large height dimension on a site the victim visits, causing the affected process to read past a heap-allocated buffer and potentially terminate. Exploitation is constrained by the compile-time feature gate and the requirement that the HTML display path be reachable, so vulnerable builds are uncommon; EPSS is low (0.39%, 31st percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Stack-based buffer overflow in the libwebsockets asynchronous DNS resolver (lws_adns_parse_label) can corrupt memory when the library is compiled with the LWS_WITH_SYS_ASYNC_DNS flag, which is not the default build configuration. An attacker positioned to observe a victim's outbound DNS query (adjacent/on-path, AV:A) can race to inject a spoofed response carrying a transaction ID that matches the pending query and a DNS label longer than the maximum supported length, overflowing the fixed label_stack and potentially achieving code execution or denial of service. Exploitation is conditional on the non-default async-DNS build and on the attacker's ability to sniff DNS traffic; no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Use-after-free in the WebSocket server handshake handling of libwebsockets (warmcat) can cause a denial of service when an application embedding the library provides a callback for the LWS_CALLBACK_HTTP_CONFIRM_UPGRADE event. Exploitation requires a specific, non-default configuration where that callback is registered; the attack is network-reachable and unauthenticated but has high attack complexity due to a timing-sensitive condition (AT:P). The impact is limited to availability (no confidentiality or integrity loss), EPSS is low (0.40%, 33rd percentile), and no public exploit or active exploitation has been identified; an upstream fix commit is available.
Use-after-free in the Linux kernel's iMON RC (remote control) driver (drivers/media/rc/imon.c) allows a local user with access to the device's VFD/LCD character-device interface to trigger memory corruption by racing writes against USB disconnect. The imon_disconnect() path unconditionally calls usb_put_dev() on usbdev_intf0/usbdev_intf1 without coordinating with in-flight writers, so a concurrent vfd_write()/send_packet() dereferences a freed usb_device pointer. Discovered via Syzkaller by the Linux Verification Center; no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.22%).
Local privilege-context buffer overflow in the Linux kernel's ETAS ES58x CAN USB driver (etas_es58x) lets a user with network capabilities corrupt kernel memory by injecting oversized CAN XL frames. Because the driver never implemented ndo_change_mtu(), an attacker can raise the interface MTU beyond CAN limits, then use a PF_PACKET raw socket with ETH_P_CANXL to smuggle a frame whose length field (up to 0xff) is memcpy'd into an 8-byte buffer, overflowing it by up to 247 bytes. CVSS is 7.8 (High); there is no public exploit identified at time of analysis and EPSS is low (0.22%), consistent with the requirement for local access and specific ETAS hardware.
Local privilege-to-kernel buffer overflow in the Linux kernel's hi311x (Holt HI-3110) CAN controller driver allows a user with network configuration capability to trigger an out-of-bounds heap write by injecting an oversized CAN XL frame. Because the driver never implemented ndo_change_mtu(), an attacker can raise the interface MTU beyond CAN_MTU and push a crafted frame through PF_PACKET whose length field (up to 0xff) is copied verbatim in hi3110_hw_tx(), overflowing an 8-byte buffer by up to 247 bytes. There is no public exploit identified at time of analysis, and the EPSS score is low (0.22%, 13th percentile); the issue has been resolved upstream in the mainline and stable kernel trees.
Local privilege-enabled buffer overflow in the Linux kernel's sun4i_can CAN controller driver (Allwinner A10/A20 SoCs) allows an attacker holding network-admin capability to write out of bounds by injecting oversized CAN XL frames. Because the driver never populated ndo_change_mtu(), the interface MTU can be raised past CAN_MTU, letting a PF_PACKET raw socket push a frame whose length field is misread as a CAN data length, overflowing a fixed buffer by up to 247 bytes. There is no public exploit identified at time of analysis and EPSS is low (0.22%), but the description includes a detailed, working reproduction path.
Local privilege-holders can trigger a kernel heap buffer overflow in the Linux mcba_usb CAN driver (Microchip CAN BUS Analyzer USB adapter) by raising the interface MTU beyond CAN_MTU and injecting a crafted CAN XL frame through a PF_PACKET raw socket. Because the driver never implemented ndo_change_mtu(), an attacker can set an oversized MTU (e.g. 9999), then send an ETH_P_CANXL frame whose flags byte is misread as the classic-CAN length field, causing memcpy to copy up to 247 bytes past the intended 8-byte buffer. This is a memory-corruption issue with high confidentiality, integrity and availability impact (CVSS 7.8); there is no public exploit identified at time of analysis, though the advisory includes a detailed reproduction, and EPSS is low at 0.22%.