Use After Free
Monthly
Remote code execution in Google Chrome desktop before version 151.0.7922.72 stems from a use-after-free in the browser's Input component (Chromium severity High, CVSS 8.8), permitting a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. Exploitation requires user interaction (visiting the malicious page) but no authentication or prior privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.26% (17th percentile), consistent with a freshly patched browser bug not yet weaponized publicly.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows a remote attacker to break out of the renderer sandbox via a crafted HTML page, leveraging a use-after-free memory-corruption bug. Google rates the Chromium severity High and the CVSS is 9.6 due to the scope change from sandboxed renderer to host. There is no public exploit identified at time of analysis and the EPSS exploitation probability is low (0.21%, 11th percentile), consistent with CISA SSVC recording no known exploitation.
Privilege escalation in Google Chrome's Updater component on macOS (versions before 151.0.7922.72) stems from a use-after-free (CWE-416) that a local attacker can trigger via malicious network traffic, letting them execute code in the context of the privileged updater process. Google rated the Chromium severity as High and has shipped a fixed stable-channel build; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile). CISA's SSVC framework records no observed exploitation and marks the flaw as not automatable but with total technical impact.
Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 lets an attacker who has already compromised the renderer process leverage a use-after-free in the Audio component to break out of the sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6 due to scope change, this is a second-stage exploit primitive rather than an initial-access bug; no public exploit has been identified at time of analysis and EPSS is low at 0.29%. A vendor patch is available in Chrome 151.0.7922.72.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Chromium severity High with a CVSS 9.6, the flaw is a use-after-free (CWE-416) reported by Google's own Chrome team; a vendor patch is available. There is no public exploit identified at time of analysis and EPSS is low (0.29%), consistent with SSVC showing no known exploitation.
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Views UI framework, letting a local attacker who lures a user into opening a malicious file break out of the renderer sandbox with high-severity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; SSVC records exploitation as none, and the EPSS score is very low (0.18%, 7th percentile). Google has released a fixed stable-channel build.
Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 arises from a use-after-free in the DOM implementation, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code within the renderer sandbox. The flaw was reported internally by the Chrome team, rated High by Chromium, and carries CVSS 8.8; there is no public exploit identified at time of analysis and EPSS is low at 0.35% (28th percentile). Because execution is confined to the sandbox (Scope: Unchanged), full host compromise would additionally require a separate sandbox-escape chain.
Sandbox escape in Google Chrome on Windows before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process leverage a use-after-free in the DataTransfer component (clipboard/drag-and-drop data) to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 driven by scope change and full CIA impact, though EPSS is low (0.29%) and there is no public exploit identified at time of analysis. It is not on CISA KEV and requires an existing renderer compromise plus user interaction, making it a second-stage bug in an exploit chain rather than a standalone entry point.
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the browser's Input handling, which an attacker who has already compromised the renderer process can leverage via a crafted HTML page to break out of the renderer sandbox. Rated High by Chromium and CVSS 9.6 due to scope change, it requires user interaction (visiting a malicious page) and a prior renderer foothold. There is no public exploit identified at time of analysis and EPSS is low (0.29%), reflecting a chained, non-trivial exploitation path rather than trivial mass exploitation.
Remote code execution in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Autofill component, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code within the renderer sandbox. Rated High by Chromium and CVSS 8.8, it requires user interaction (visiting a malicious page) but no authentication. No public exploit identified at time of analysis, and EPSS is low (0.35%, 28th percentile), consistent with a freshly patched browser bug not yet weaponized.
Sandbox escape in Google Chrome desktop versions prior to 151.0.7922.72 stems from a use-after-free in the Views UI framework, letting a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 due to scope change and total confidentiality/integrity/availability impact, though there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low (0.29%, 21st percentile), consistent with a second-stage bug that requires prior renderer compromise rather than a directly weaponizable entry point.
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium with a CVSS of 8.8, but there is no public exploit identified at time of analysis, EPSS is low (0.35%, 28th percentile), and CISA SSVC marks exploitation as none. Because code execution is confined to the sandbox, full host compromise would require chaining with a separate sandbox-escape.
Remote code execution in Google Chrome's Loader component before 151.0.7922.72 allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox by luring a victim to a crafted HTML page (CWE-416 use-after-free). The flaw carries a High Chromium severity and CVSS 8.8, but code execution is confined to the sandbox and requires user interaction (visiting the page); a full-system compromise would need an additional sandbox-escape bug. No public exploit identified at time of analysis, and EPSS is low at 0.35% (28th percentile).
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and CVSS 8.8, requiring user interaction (visiting a page) but no authentication. There is no public exploit identified at time of analysis and EPSS is low (0.35%, 28th percentile), consistent with a freshly patched, vendor-reported bug rather than one under active exploitation.
Sandbox escape in Google Chrome's Navigation component (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, escalating a renderer-level foothold toward host-level code execution. Chromium rates the security severity High and the CVSS is 8.3; no public exploit identified at time of analysis, and the EPSS probability is low at 0.29% (21st percentile). This is the second-stage bug in a typical Chrome exploit chain rather than a standalone remote-code-execution primitive.
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Ozone platform abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox and gain broader host access. Rated Critical by Chromium with CVSS 9.6 and a scope-changed vector, though exploitation currently shows as none in CISA SSVC and EPSS is low (0.31%). Vendor patch is available; no public exploit or KEV listing has been identified at time of analysis.
Sandbox escape in Google Chrome's Skia graphics library (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader access on the host via a crafted HTML page. Google rates the Chromium severity as Critical, and CVSS is 8.3 due to the scope change (S:C) reflecting the sandbox boundary crossing. No public exploit identified at time of analysis, and EPSS probability is low (0.31%), consistent with an exploit that requires chaining from a prior renderer compromise.
Sandbox escape in Google Chrome's Views UI framework (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Google rates the Chromium severity Critical (CVSS 9.6), and while a patch is available on the Stable channel, there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.31%. Exploitation depends on chaining a prior renderer compromise, so this is one link in a full exploit chain rather than a standalone remote-code-execution bug.
Sandbox escape in Google Chrome's Compositing component (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox and gain broader code execution via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3 (scope-changing use-after-free, CWE-416), it is a second-stage bug that presumes an existing renderer compromise rather than a standalone entry point. There is no public exploit identified at time of analysis and EPSS is low (0.31%, 23rd percentile), consistent with CISA SSVC marking exploitation as none.
Use-after-free memory corruption in SQLite 3.41's JSON extension (json.c, jsonCacheInsert) can be triggered when an application processes attacker-influenced JSON through SQLite's JSON1 functions, potentially leading to a crash (denial of service) or, if the freed heap object is reclaimed and controlled, memory disclosure or code execution in the host process. Because SQLite is an embedded library, real-world reach depends on whether the front-end application exposes JSON functions to untrusted input. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none' - the 9.8 rating appears heavily influenced by an assumed network vector rather than demonstrated remote exploitability.
Memory disclosure and denial of service in SQLite 3.41 arise from a use-after-free in the btree module's shared-cache lock management, where a BtLock structure is freed but never unlinked from its linked list. Applications that enable SQLite shared-cache mode can have subsequent list traversals read freed memory, leaking sensitive process memory (CVSS C:H) or crashing the process (A:H). No public exploit identified at time of analysis, and SSVC lists exploitation status as none, though the flaw is assessed as automatable.
Use-after-free in Node.js HTTP/2 implementation allows remote unauthenticated attackers to crash the Node.js process by sending crafted HTTP/2 RST_STREAM frames while the stream object remains in scope. The fix - 'defer rst stream while in scope' - confirms that RST_STREAM processing freed or invalidated memory still referenced by the active stream context. With CVSS A:H and AV:N/AC:L/PR:N/UI:N, this is a straightforward remote denial-of-service against any Node.js server with HTTP/2 enabled. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity network vector and multi-LTS-branch impact make patching urgent.
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a use-after-free (CWE-416) in the intercept plugin, allowing a remote attacker to crash or destabilize the proxy server. The flaw carries a CVSS 4.0 base score of 8.2, driven entirely by high availability impact with no confidentiality or integrity effect, and exploitation depends on a specific attack condition (AT:P) rather than being trivially reproducible. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free and time-of-check/time-of-use race, primarily crashing the proxy (high availability impact) with secondary low-level confidentiality and integrity exposure. It affects the 8.x, 9.x, and 10.x branches up to 8.1.9, 9.2.14, and 10.1.3, and is fixed in 9.2.15 and 10.1.4. Reported by Apache with a CVSS 4.0 score of 8.3; no public exploit identified at time of analysis and it is not on CISA KEV.
Remote code execution in pglogical extension for PostgreSQL allows a low-privileged user to crash replication workers, with potential for arbitrary code execution. A use-after-free condition in worker signaling code is triggered during normal replication operations when worker lifecycle events race. While typical effect is denial-of-service, a successful exploit can give complete control of the database backend process.
Use-after-free vulnerability in Safari’s web content processing allows remote attackers to execute arbitrary code on affected Apple devices when a user visits a malicious website. Affected versions include Safari prior to 26.6, iOS and iPadOS prior to 26.6, macOS Tahoe prior to 26.6, visionOS prior to 26.6, and watchOS prior to 26.6. No public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.13%).
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe/tvOS/visionOS/watchOS before 26.6 - where a use-after-free (CWE-416) lets a locally installed app crash the system. There is no public exploit identified at time of analysis and the NVD CVSS 9.8 (C:H/I:H/A:H) conflicts with Apple's own description, which states only 'unexpected system termination' (availability impact), suggesting the true impact is a DoS crash rather than full compromise. EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV.
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected system termination. Affected versions include iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. While the NVD assigns CVSS 9.8, the actual impact is limited to availability; no active exploitation or public exploit code is identified, and EPSS indicates very low exploitation probability (0.17%).
Unexpected system termination in iOS and iPadOS prior to 26.6, as well as in certain versions of macOS, tvOS, and visionOS, resulting from a use-after-free memory corruption. Apple's description indicates a local denial-of-service where a malicious app can crash the system, while the NVD-assigned CVSS 9.8 erroneously implies unauthenticated remote code execution. A patch is available, no active exploitation has been reported, and EPSS suggests a very low probability of wide exploitation.
Use-after-free memory corruption in Apple's core operating-system platforms - iOS/iPadOS, macOS Tahoe, tvOS, and watchOS before version 26.6 - allows a locally installed and executed application to crash or unexpectedly terminate the system. Exploitation requires the victim to run attacker-supplied code as an app on an unpatched device; there is no remote attack surface, and the demonstrable impact is availability only (system termination/reboot), with no data disclosure, modification, or code execution established - meaning the publicly circulated CVSS 9.8 network vector materially overstates the real reachability and impact of this bug. No public exploit identified at time of analysis, EPSS is low at 0.16% (6th percentile), CISA SSVC records Exploitation: none with total technical impact if reached, and Apple has shipped fixes in 26.6 across all four platforms.
Use-after-free memory corruption in Apple's iOS 26.6-era platform family lets an already-installed app crash the operating system kernel or a system service, producing an unexpected system termination (denial of service). Affected software spans iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe before 26.6, and tvOS, visionOS and watchOS before 26.6; exploitation requires the attacker's app to run locally on the device, since the flaw is only reachable from within an executing process. The headline input score of CVSS 9.8 (AV:N) overstates the issue - Apple's own advisory describes impact limited to a crashing app, EPSS is a low 0.17% (6th percentile), CISA SSVC records no exploitation and no public exploit code exists, and no KEV listing or POC is associated with CVE-2026-43822.
A use-after-free vulnerability in Apple operating systems allows a malicious app to cause unexpected system termination or write to kernel memory. The issue affects iOS
Denial of service in Apple iOS, macOS, and related operating systems due to a use-after-free flaw could allow a malicious app to crash the device. Apple's advisory only confirms unexpected system termination, but an independent CVSS score of 9.8 suggests potential for full system compromise; however, the CVSS vector appears inconsistent with the vendor description. The vulnerability is patched in versions 26.6 for all affected OSes, and no active exploitation or public exploit code is known.
A use-after-free memory-corruption flaw in Apple's mobile and desktop operating systems lets an app already running on the device trigger an unexpected system termination - a denial-of-service condition affecting availability only. The issue is fixed in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6, meaning every device running an earlier build of those platforms is exposed. There is no evidence of active exploitation (not in CISA KEV, SSVC exploitation: none) and no public exploit code has been identified; EPSS is just 0.16% (6th percentile), and the widely circulated CVSS 9.8 AV:N/PR:N vector is grossly inflated relative to the assessed AV:L/AC:L/PR:N/UI:N impact of C:N/I:N/A:H.
A use-after-free vulnerability in macOS allows a local application to cause a denial-of-service by crashing the system or a key service. The flaw affects multiple macOS versions prior to the Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 updates. Despite an assigned CVSS score of 9.8 suggesting remote pre-authentication full compromise, the Apple advisory explicitly describes only a local denial-of-service impact, and the EPSS exploitation probability is very low (0.16%). No active exploitation or public proof-of-concept has been reported, and a vendor patch is available.
Kernel memory corruption in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows a malicious app to cause system termination or corrupt kernel memory. A use-after-free issue in the kernel’s memory management could be triggered by an app, leading to unexpected system behavior or potential code execution. Patches are available across all affected operating systems; no active exploitation has been observed.
Use-after-free in SQLite 3.41 expression parsing leads to memory corruption, allowing remote attackers to crash applications and leak sensitive memory contents via crafted SQL queries. Public proof-of-concept exists but there is no evidence of active exploitation. The vulnerability is triggered by sending malicious SQL statements that cause the parser to access a freed expression object.
Remote denial of service and heap memory leak in SQLite 3.41 via the json_remove() function allows attackers with the ability to execute SQL queries to crash the database process or leak sensitive heap data. A use-after-free in jsonRemoveFunc is triggered by malformed JSON and a deep path parameter; publicly available proof-of-concept code exists, and low EPSS risk indicates limited exploitation likelihood.
Use-after-free in SQLite 3.41's JSON parser allows remote code execution. A remote attacker can deliver a crafted JSON payload; if a user or application processes it with SQLite, the vulnerability triggers memory corruption, potentially enabling full system compromise. A proof-of-concept advisory is publicly available, though no active exploitation has been confirmed.
Use-after-free in SQLite 3.41's expression-evaluation path lets an attacker who can submit a crafted SQL statement crash the process, leak adjacent memory, or potentially achieve code execution. The flaw stems from sqlite3ReleaseTempReg() prematurely freeing a temporary register that exprComputeOperands() then dereferences. Rated CVSS 7.5 (AV:N/AC:H/PR:L); publicly available exploit code exists per the CISA SSVC 'poc' determination, but it is not on the CISA KEV list and EPSS is low (0.24%, 16th percentile), indicating no evidence of widespread active exploitation.
Memory corruption in SQLite 3.41's ORDER BY parsing allows remote attackers to crash the database process or leak sensitive data via crafted SQL queries. A use-after-free in ExprList handling, triggered by an ORDER BY clause with many items, can also lead to arbitrary code execution under specific memory conditions. A public advisory exists, but no active exploitation (KEV) or EPSS data is available.
Use-after-free in SQLite 3.41 allows remote attackers supplying crafted SQL to trigger memory corruption during parsing, leading to denial of service, sensitive information leakage, and potential arbitrary code execution.
Use-after-free in the Linux kernel's usbio (USB I/O bridge) driver allows a local, low-privileged attacker to corrupt kernel slab memory during USB device disconnect, potentially achieving privilege escalation or triggering a kernel panic. The bug lies in usbio_disconnect(), which iterates the client list in reverse using list_for_each_entry_reverse() - a macro that reads client->link.prev after the loop body, but auxiliary_device_uninit() can free the current client before that read, dereferencing freed slab memory. Patches are confirmed in Linux stable branches 6.18.39, 7.1.4, and 7.2-rc3; no public exploit or active exploitation is identified at time of analysis.
Use-after-free in the Linux kernel's 6LoWPAN NHC handler may allow network-adjacent attackers to execute arbitrary code or trigger denial of service by sending a malformed packet. Affects kernels with 6LoWPAN support from commit 92aa7c65d295 up to the patched versions. No active exploitation or public exploit code is known; EPSS probability is low at 0.22%.
Use-after-free in the Linux kernel's crypto/krb5 helper library (introduced in 6.15) occurs when Kerberos AEAD encrypt/decrypt operations are backed by an asynchronous AEAD implementation. The synchronous helpers in rfc3961_simplified.c and rfc8009_aes2.c set a NULL completion callback and treat any negative return as terminal, so an async backend returning -EINPROGRESS causes the buffer to be freed with kfree_sensitive() while the backend worker still dereferences it. This is reachable through kernel consumers of krb5 crypto (rxrpc/rxgk, AFS cm_security, and Ceph), but only on systems where an async AEAD provider is bound to the krb5 enctype name; no public exploit identified at time of analysis and EPSS is low at 0.21%.
Use-after-free in the Linux kernel's Intel QuickAssist Technology (QAT) SR-IOV driver allows a local low-privileged attacker - including a VM tenant with a VF assigned - to corrupt host kernel memory by racing VF2PF workqueue processing against SR-IOV teardown in adf_disable_sriov(). The VF2PF interrupt handler enqueues work that holds raw pointers to per-VF state (struct adf_accel_vf_info); adf_disable_sriov() freed that state without draining in-flight workers, enabling a concurrent worker to deref freed memory. No public exploit is known at time of analysis, and EPSS is 0.22% (13th percentile), indicating negligible observed exploitation pressure despite the 8.8 CVSS score.
Use-after-free in the Linux kernel's ksmbd (SMB server) allows authenticated remote attackers to trigger memory corruption, potentially leading to arbitrary code execution or denial of service. The flaw occurs when an SMB2_CLOSE on a locked file is followed by an SMB2_CANCEL, causing a freed file_lock to be re-accessed. A patch is available for affected kernel versions, and while no active exploitation is confirmed, a proof-of-concept exists; EPSS indicates low exploitation likelihood.
Use-after-free in the Linux kernel's Bluetooth L2CAP subsystem can be triggered by an adjacent attacker, potentially leading to arbitrary code execution or kernel memory corruption. The flaw occurs when a channel timeout callback races with connection teardown, allowing a freed connection object to be accessed. Patched kernels are available; no active exploitation is confirmed, but the vulnerability is remotely exploitable within Bluetooth range without authentication or user interaction.
Use-after-free in the Linux kernel Bluetooth MGMT subsystem allows a local attacker with low privileges to trigger kernel memory corruption via a race condition between add_device and remove_device operations. The flaw exists in add_device_complete(), which dereferences a hci_conn_params pointer without holding hci_dev_lock, while a concurrent MGMT_OP_REMOVE_DEVICE path frees the same object under that lock. KASAN confirms exploitation as slab-use-after-free; no public exploit or active exploitation (CISA KEV) has been identified, and patches have been released across multiple stable branches.
Use-after-free memory corruption in the Linux kernel's netpoll subsystem allows a local attacker or concurrent kernel path to access freed memory during the netpoll shutdown sequence. The flaw exists because cancel_delayed_work() - called from softirq context during __netpoll_cleanup() - does not block until the TX worker finishes, permitting queue_process() to dereference a kfree'd npinfo struct via container_of(). KASAN confirms the UAF; patches are available across multiple stable kernel branches, and no public exploit or KEV listing exists at time of analysis.
Use-after-free in the Linux kernel IPv4 IGMP subsystem allows a local low-privileged attacker to trigger kernel memory corruption or a system crash by racing network device destruction against concurrent multicast group lookups in softirq context. During ip_mc_destroy_dev(), multicast membership entries are scheduled for RCU reclamation via ip_ma_put() but are not unlinked from the per-device mc_hash table; concurrent softirq-path readers such as ip_check_mc_rcu() can then dereference a freed slab object, as confirmed by the embedded KASAN trace showing a read of freed memory during UDP packet processing. No public exploit code or CISA KEV listing exists at time of analysis; Ubuntu USN-8726/8727-1 and a Siemens ICS advisory confirm active patching across distributions.
Use-after-free memory corruption in the Linux kernel's NXP i.MX8 ISI (Image Sensing Interface) media driver is triggered during module removal (rmmod of imx8_isi), confirmed by KASAN slab-use-after-free reports. The root cause is an incorrect teardown order in mxc_isi_remove(): the crossbar cleanup frees media entity pads before the V4L2 cleanup has finished removing media links that reference those same pads, resulting in a dangling pointer dereference in __media_entity_remove_link(). No public exploit has been identified at time of analysis, and with EPSS at 0.21% (11th percentile), real-world weaponization appears unlikely despite the CVSS 7.8 score.
Use-after-free in the Linux kernel Bluetooth subsystem's bt_accept_dequeue() function allows an attacker with local or adjacent Bluetooth access to corrupt kernel heap memory or crash the system during L2CAP listening socket teardown. The bug stems from a reference-count sequencing error: the temporary queue-walk reference is dropped before bt_accept_unlink() removes the socket from the accept queue and drops its own reference, so if that was the final reference, the subsequent sock_hold() call dereferences freed slab memory. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS is 0.22% (13th percentile), consistent with low opportunistic exploitation risk.
Local privilege escalation in the Linux kernel's SMB client witness notification handler allows a low-privileged attacker to exploit a use-after-free condition. Affected are Linux kernel versions 5.11 and later that have the CIFS witness feature enabled. Successful exploitation can lead to arbitrary code execution with elevated privileges, fully compromising the system.
Use-after-free vulnerability in the Linux kernel's ksmbd SMB server allows remote attackers to execute arbitrary code. All kernel versions with ksmbd enabled from early commits up to the patched releases are affected, and the issue can be triggered by concurrent QUERY_DIRECTORY requests on the same file handle. A fix is available via multiple stable kernel branches, no active exploitation is reported in KEV, and EPSS indicates a low probability of widespread exploitation (0.21%).
Use-after-free in Linux kernel’s ksmbd SMB server occurs during deferred byte-range lock cancellation, allowing an authenticated attacker to potentially execute arbitrary code or crash the system. The vulnerability affects ksmbd versions prior to the released fixes (6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, 7.2-rc1). No active exploitation has been confirmed (no CISA KEV listing), and EPSS indicates a low probability of widespread exploitation.
Local privilege escalation in the Linux kernel's pcc-cpufreq driver allows a low-privileged user to gain full root privileges. The vulnerability is a use-after-free and double-free flaw when evaluating ACPI _OSC negotiation, affecting all kernel versions from 2.6.34 until the fixed stable releases (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1). No active exploitation or public exploit has been identified, and EPSS indicates a low probability of widespread exploitation.
Use-After-Free in the Linux kernel HID letsketch driver allows local exploitation during device unbind, potentially enabling kernel memory corruption and privilege escalation on affected systems. The letsketch_probe() function arms a per-device kernel timer (inrange_timer) with a 100 ms timeout, but no .remove callback exists to drain the timer before devm cleanup frees letsketch_data and input_dev structures on USB unplug or rmmod, producing a UAF read/write into freed kernel memory. Patches are backported across six stable kernel branches; no public exploit code exists and EPSS is 0.21% (12th percentile), reflecting the niche device requirement and race-condition complexity.
Use-after-free in the Linux kernel HID appleir driver allows a local attacker to corrupt kernel memory during device removal, potentially achieving privilege escalation. The race condition exists between the key_up_timer callback (armed by appleir_raw_event() on each keydown/key-repeat) and hid_hw_stop(), which frees the underlying input_dev before the timer is drained. A second race window, where a USB URB completion during hid_hw_stop() can re-arm the timer via mod_timer(), means a simple teardown reorder is insufficient — the fix introduces a spinlock-gated 'removing' flag combined with timer_shutdown_sync() to permanently disable further callbacks. No public exploit has been identified at time of analysis, and EPSS is 0.22% (13th percentile).
Use-after-free in the Linux kernel HID lg-g15 driver allows a local attacker to trigger kernel memory corruption by racing device input events against USB keyboard removal. The driver allocates lg_g15_data via devm and schedules work items from HID report handlers (backlight cycle key on G15, G15 v2, G510), but lacked a remove callback to cancel pending work before devres freed the allocation. On kernel versions from approximately 5.5 through the unfixed stable branches, unplugging the keyboard while a work item is pending causes the worker to dereference freed memory via container_of, potentially enabling local privilege escalation. No public exploit has been identified and EPSS is 0.22% (13th percentile), indicating no observed widespread exploitation.
Incorrect RCU lock annotations in the Linux kernel's BPF LPM trie map implementation (`kernel/bpf/lpm_trie.c`) cause lockdep false positives on debug kernels when sleepable BPF programs access `BPF_MAP_TYPE_LPM_TRIE` maps via lookup, update, or delete operations. The mismatch arises because sleepable BPF programs hold `rcu_read_lock_trace()` while the trie code asserts `rcu_read_lock_bh_held()` or `rcu_read_lock_held()`, producing repeated 'suspicious RCU usage' kernel warnings per distinct callsite. The Linux kernel developers explicitly state no actual use-after-free occurs, since Tasks Trace RCU already serializes against trie node reclaim; however, the incorrect annotation undermines lockdep's ability to detect future regressions and is increasingly impactful as sleepable BPF LSM programs become common in production security tooling. No public exploit exists and no CISA KEV listing has been issued.
Use-after-free and memory leak in the Linux kernel's EHCI and FOTG210 USB isochronous submit paths expose systems running kernel versions from 2.6.15 through 7.1.3 to local kernel memory corruption by a low-privileged user. When an isochronous URB submission fails before the staged schedule handoff - either because the host controller becomes inaccessible or usb_hcd_link_urb_to_ep() returns an error - the ehci_iso_sched allocation is not freed and urb->hcpriv retains a dangling pointer, creating a UAF condition. No public exploit exists and the EPSS score is 0.21% (12th percentile), but vendor-released patches across multiple stable branches are available and should be applied to eliminate the risk.
Use-after-free in the Linux kernel USB gadget UDC subsystem exposes systems with DWC3-based USB controllers to a race condition between usb_del_gadget() and gadget_match_driver(), enabling a NULL pointer dereference that can crash the kernel or enable privilege escalation on unpatched systems. The flaw affects all major Linux stable branches from 5.15.x through 7.1.x prior to the patched releases, and is particularly relevant for embedded Linux, Android-based devices, and IoT hardware that use USB gadget/device mode. No public exploit has been identified at time of analysis, and EPSS remains at 0.21% (12th percentile), reflecting current low exploitation interest.
Use-after-free in the Linux kernel's idmouse USB fingerprint driver allows a low-privileged local attacker to corrupt kernel memory by racing a device disconnect against a file-descriptor release, potentially enabling local privilege escalation to root. The bug stems from `mutex_unlock()` accessing the freed driver-data structure after the lock is released, a documented non-atomic behavior; the fix introduces a `kref` reference counter to correctly manage object lifetime. Patches are available across all active stable branches; no active exploitation or public exploit has been reported.
Use-after-free in the Linux kernel's USB ldusb driver allows a local unprivileged user to corrupt kernel memory by racing disconnect() against release() on a connected USB device. The root cause is that mutex_unlock() is documented as non-atomic and may access the mutex object after it logically releases the lock, creating a window where the driver data structure can be freed while still in use. No public exploit has been identified at time of analysis, and EPSS is low (0.22%), but the C:H/I:H/A:H CVSS impact vector reflects the potential for full kernel privilege escalation if successfully triggered.
Use-after-free in the Linux kernel's USB iowarrior driver exposes systems with Code Mercantile IO-Warrior USB devices to kernel memory corruption, potentially enabling local privilege escalation to root. The defect exists because submitted write URBs are not cancelled during close(), leaving them in-flight at disconnect time; the completion handler then fires against already-freed device structures. No public exploit code has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects minimal observed exploitation pressure, though the C:H/I:H/A:H CVSS impact reflects genuine kernel-level consequence.
Use-after-free in the Linux kernel USB iowarrior driver allows a local unprivileged user to corrupt kernel memory when a USB device disconnect races with a file release operation. The root cause is that mutex_unlock() is documented as non-atomic and may access the mutex structure after releasing the lock, meaning the driver data object can be freed while mutex_unlock() is still executing. An attacker who can trigger the race - by opening the iowarrior device and simultaneously provoking a USB disconnect - may achieve kernel memory corruption leading to privilege escalation. No public exploit code exists and EPSS is low (0.21%), but the impact class is standard kernel UAF.
The Linux kernel's legousbtower USB driver contains a use-after-free race condition between the release() and disconnect() code paths, present since Linux 2.6.25. An authenticated local user with a LEGO USB Tower device attached can trigger the race at disconnect time to corrupt freed kernel memory, potentially gaining elevated privileges or crashing the system. Patches have been issued across all active stable branches (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1); no public exploit code or CISA KEV listing exists at time of analysis.
Use-after-free in the Linux kernel's USB Type-C UCSI CCG driver allows a local attacker with low privileges to corrupt kernel memory, potentially achieving arbitrary kernel code execution. The flaw exists in the module teardown path of the Cypress CCG UCSI driver: ucsi_ccg_remove() calls ucsi_destroy() - which kfree()s the ucsi object - before calling free_irq(), leaving a window in which the threaded IRQ handler ccg_irq_handler() can access the freed ucsi struct via ucsi_notify_common(). No public exploit code exists and the bug was discovered by static analysis; EPSS is 0.22% (13th percentile), reflecting no observed in-the-wild activity.
Use-after-free and missing forward security in the loongson-rng crypto driver of the Linux kernel allow a local, low-privilege attacker to corrupt memory and potentially execute arbitrary code, compromise system integrity, or read sensitive information. Affected systems are primarily Loongson-based machines running kernels between v6.18 and the respective fix versions; the driver itself is unused by any in‑kernel consumer and is being removed entirely rather than patched. No active exploitation or public exploit code is known, and the EPSS exploitation probability is low (0.21%).
Use-after-free and list corruption in the Linux kernel's Intel QuickAssist Technology (QAT) crypto driver allows a local low-privileged attacker to trigger kernel memory corruption by racing concurrent service registration and device lifecycle operations. The crypto/qat subsystem's service_table linked list is guarded by service_lock only during insertions and deletions, but seven device-state functions iterate the list unprotected, enabling a concurrent adf_service_register() or adf_service_unregister() call to mutate the list mid-traversal. Exploiting this race can result in kernel crash, arbitrary kernel memory read, or local privilege escalation to root. No public exploit code has been identified and EPSS stands at 0.21% (11th percentile), but the impact class is high for systems running QAT-capable Intel hardware.
Use-after-free vulnerability in the Linux kernel's fsl-lpspi SPI driver can lead to memory corruption or arbitrary code execution with kernel privileges. A local attacker with high privileges on systems using the affected driver can trigger this flaw, potentially causing a kernel panic or full system compromise. At time of analysis, no public exploit or active exploitation is identified, and EPSS indicates low exploitation probability (0.22%).
Page use-after-free in the Linux kernel perf/aux subsystem allows a local authenticated attacker to read or write freed kernel memory, potentially achieving privilege escalation. The flaw arises because map_range() accesses rb->aux_pages[], rb->aux_nr_pages, and rb->aux_pgoff while holding only the per-event mmap_mutex, whereas those fields are serialised by the ring-buffer-level rb->aux_mutex; two events sharing one ring buffer via PERF_EVENT_IOC_SET_OUTPUT can therefore race rb_alloc_aux() against map_range(), leaving a VM_PFNMAP mapping pointing to a freed physical frame. No public exploit has been identified at time of analysis, and EPSS exploitation probability is very low at 0.21% (11th percentile).
A use-after-free in the FUSE subsystem of the Linux kernel allows a local attacker with permission to mount a FUSE filesystem to escalate privileges or crash the system. The vulnerability exists in fuse_ref_folio() due to improper request locking, and affects kernel versions from 2.6.35 through unpatched longterm branches. Patches are available, and no active exploitation or public exploit code has been identified.
Local privilege escalation in the Linux kernel FUSE subsystem allows a low-privileged attacker to corrupt kernel memory
Local privilege escalation in the Linux kernel's fuse-uring subsystem allows a local attacker to trigger a use-after-free condition by racing with the async stop queues function, potentially resulting in arbitrary code execution and complete system compromise. The vulnerability affects Linux kernel versions 6.14 through 6.18.x (patched in 6.18.39, 7.1.4,
Use-after-free in the Linux kernel’s fuse-uring subsystem allows a local authenticated attacker to escalate privileges. The race condition occurs when a malicious userspace sends a commit SQE before the kernel completes the memcpy of request data, triggering a freed fuse_req to be reused. CVSS base score is 7.8 but EPSS probability is low (0.21%), and no public exploit or active exploitation has been reported.
Use-after-free in the Linux kernel's power sequence (pwrseq) debugfs seq_file handler allows a local attacker with low privileges to achieve privilege escalation or system compromise. The flaw arises from incorrect device reference counting in the seq_next callback, leading to reuse of a freed pointer. Affected kernels include versions since commit 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c; no active exploitation or public exploit has been confirmed at the time of analysis.
Use-after-free in the Linux kernel FPGA region subsystem allows a local authenticated attacker with low privileges to corrupt kernel memory, potentially achieving full confidentiality, integrity, and availability impact. The flaw in `child_regions_with_firmware()` stems from `of_node_put(child_region)` freeing the node before `pr_err()` dereferences the same pointer on an error path - a deterministic UAF triggered by a specific error condition in FPGA device tree enumeration. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), placing this firmly as a maintenance-priority fix for most environments rather than an emergency response item.
Use-after-free in the Linux kernel's linkstation-poweroff driver exposes systems running affected kernel versions on Buffalo LinkStation NAS hardware to local privilege escalation. The flaw resides in linkstation_poweroff_init(), where of_node_put(dn) was called before of_match_node() finished using the pointer, producing a kernel-space use-after-free that can corrupt slab-allocated memory. No public exploit has been identified and the EPSS score of 0.16% (6th percentile) indicates very low observed exploitation probability, though the official CVSS base severity is 7.8 (High) with confirmed high impact to confidentiality, integrity, and availability.
Use-after-free in the Linux kernel fbdev subsystem's fb_find_mode() function allows a local attacker with low privileges to read freed kernel heap memory, potentially achieving information disclosure, memory corruption, or privilege escalation. The flaw exists when mode_option is NULL: a heap-allocated buffer (mode_option_buf) is freed while the local alias name still references it during the name_matches() comparison loop. Patched versions are available across multiple stable branches (6.6.144, 6.12.95, 6.18.38, 7.1.3, 7.2-rc1). No public exploit exists and EPSS sits at the 6th percentile, but the CVSS 7.8 High score correctly reflects the maximum-impact potential of kernel-level heap memory corruption.
Use-after-free in the Linux kernel DAMON (Data Access Monitor) sysfs subsystem allows a local, low-privileged user with sysfs write access to corrupt kernel memory structures, potentially escalating to full kernel-level code execution. The DAMOS tried-region directory removal function (damon_sysfs_scheme_regions_rm_dirs()) decrements kobject reference counts but omits removing region objects from the tracking linked list; asynchronous execution of the kobj release callback leaves dangling list entries that a concurrent list rebuild can write into freed memory. No public exploit or active exploitation has been identified - EPSS is 0.16% (5th percentile) and the vulnerability is absent from CISA KEV - consistent with a hardening fix rather than an actively weaponized flaw.
Local privilege escalation in the Linux kernel's sched_ext subsystem allows a low-privileged local attacker to achieve root access via a use-after-free error in the scx_root_enable_workfn() initialization failure path. The vulnerability is fixed by reordering the put_task_struct() call after scx_error() to prevent premature freeing of the task structure. No active exploitation or public exploit has been reported, and EPSS indicates low exploitation likelihood.
Local privilege escalation in the Linux kernel's ti-qspi SPI driver results from a use-after-free when DMA setup fails, allowing a local attacker to potentially execute arbitrary code or crash the system. The vulnerability affects Linux kernels from version 4.12 up to the patched stable releases 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No active exploitation has been confirmed (CISA KEV not listed), and the EPSS probability is low (0.18%), indicating limited real-world likelihood.
Use-after-free in the Linux kernel’s netfs library allows a local attacker to escalate privileges or cause denial of service. The race condition occurs when unlocking abandoned read folios after a netfs request completes, potentially corrupting kernel memory. No active exploitation or public exploit is known at this time.
Memory corruption and use-after-free in Imagination Technologies Graphics DDK allows local attackers to escalate privileges. The vulnerability stems from improper reference counting on synchronization primitives during fence export, enabling a low-privileged user to achieve kernel read/write and full system compromise. No active exploitation or public exploit is confirmed, and EPSS indicates low exploitation probability.
Use-after-free in Chrome's Input component enables an attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. Affected versions span all Google Chrome releases prior to 150.0.7871.186 across Windows, macOS, and Linux. Successful exploitation grants code execution outside the sandbox with the full privileges of the browser process on the underlying host. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS stands at 0.25% (16th percentile), consistent with no observed in-the-wild activity.
Remote code execution in the Blink rendering engine of Google Chrome versions prior to 150.0.7871.186 allows an attacker to run arbitrary code inside Chrome's sandbox when a victim visits a crafted HTML page. The vulnerability has a high CVSS score (8.8) but a low EPSS exploitation probability (0.30%), and no active exploitation has been observed (CISA KEV not listed). A vendor patch is available.
Remote code execution inside a sandbox in Google Chrome prior to 150.0.7871.186 allows attackers to execute arbitrary code via a crafted HTML page. This use-after-free vulnerability requires user interaction and has a high CVSS score but low real-world exploitation probability (EPSS 0.30%). No active exploitation or public exploit code has been identified.
Denial of service in MongoDB's mongod server allows any authenticated user holding only read privileges to crash the database by submitting aggregation pipeline expressions that invoke server-side JavaScript, triggering a use-after-free (CWE-416) during document processing. The flaw affects availability only and requires valid low-privilege credentials; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Google Chrome desktop before version 151.0.7922.72 stems from a use-after-free in the browser's Input component (Chromium severity High, CVSS 8.8), permitting a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. Exploitation requires user interaction (visiting the malicious page) but no authentication or prior privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.26% (17th percentile), consistent with a freshly patched browser bug not yet weaponized publicly.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows a remote attacker to break out of the renderer sandbox via a crafted HTML page, leveraging a use-after-free memory-corruption bug. Google rates the Chromium severity High and the CVSS is 9.6 due to the scope change from sandboxed renderer to host. There is no public exploit identified at time of analysis and the EPSS exploitation probability is low (0.21%, 11th percentile), consistent with CISA SSVC recording no known exploitation.
Privilege escalation in Google Chrome's Updater component on macOS (versions before 151.0.7922.72) stems from a use-after-free (CWE-416) that a local attacker can trigger via malicious network traffic, letting them execute code in the context of the privileged updater process. Google rated the Chromium severity as High and has shipped a fixed stable-channel build; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile). CISA's SSVC framework records no observed exploitation and marks the flaw as not automatable but with total technical impact.
Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 lets an attacker who has already compromised the renderer process leverage a use-after-free in the Audio component to break out of the sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6 due to scope change, this is a second-stage exploit primitive rather than an initial-access bug; no public exploit has been identified at time of analysis and EPSS is low at 0.29%. A vendor patch is available in Chrome 151.0.7922.72.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Chromium severity High with a CVSS 9.6, the flaw is a use-after-free (CWE-416) reported by Google's own Chrome team; a vendor patch is available. There is no public exploit identified at time of analysis and EPSS is low (0.29%), consistent with SSVC showing no known exploitation.
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Views UI framework, letting a local attacker who lures a user into opening a malicious file break out of the renderer sandbox with high-severity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; SSVC records exploitation as none, and the EPSS score is very low (0.18%, 7th percentile). Google has released a fixed stable-channel build.
Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 arises from a use-after-free in the DOM implementation, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code within the renderer sandbox. The flaw was reported internally by the Chrome team, rated High by Chromium, and carries CVSS 8.8; there is no public exploit identified at time of analysis and EPSS is low at 0.35% (28th percentile). Because execution is confined to the sandbox (Scope: Unchanged), full host compromise would additionally require a separate sandbox-escape chain.
Sandbox escape in Google Chrome on Windows before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process leverage a use-after-free in the DataTransfer component (clipboard/drag-and-drop data) to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 driven by scope change and full CIA impact, though EPSS is low (0.29%) and there is no public exploit identified at time of analysis. It is not on CISA KEV and requires an existing renderer compromise plus user interaction, making it a second-stage bug in an exploit chain rather than a standalone entry point.
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the browser's Input handling, which an attacker who has already compromised the renderer process can leverage via a crafted HTML page to break out of the renderer sandbox. Rated High by Chromium and CVSS 9.6 due to scope change, it requires user interaction (visiting a malicious page) and a prior renderer foothold. There is no public exploit identified at time of analysis and EPSS is low (0.29%), reflecting a chained, non-trivial exploitation path rather than trivial mass exploitation.
Remote code execution in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Autofill component, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code within the renderer sandbox. Rated High by Chromium and CVSS 8.8, it requires user interaction (visiting a malicious page) but no authentication. No public exploit identified at time of analysis, and EPSS is low (0.35%, 28th percentile), consistent with a freshly patched browser bug not yet weaponized.
Sandbox escape in Google Chrome desktop versions prior to 151.0.7922.72 stems from a use-after-free in the Views UI framework, letting a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 due to scope change and total confidentiality/integrity/availability impact, though there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low (0.29%, 21st percentile), consistent with a second-stage bug that requires prior renderer compromise rather than a directly weaponizable entry point.
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium with a CVSS of 8.8, but there is no public exploit identified at time of analysis, EPSS is low (0.35%, 28th percentile), and CISA SSVC marks exploitation as none. Because code execution is confined to the sandbox, full host compromise would require chaining with a separate sandbox-escape.
Remote code execution in Google Chrome's Loader component before 151.0.7922.72 allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox by luring a victim to a crafted HTML page (CWE-416 use-after-free). The flaw carries a High Chromium severity and CVSS 8.8, but code execution is confined to the sandbox and requires user interaction (visiting the page); a full-system compromise would need an additional sandbox-escape bug. No public exploit identified at time of analysis, and EPSS is low at 0.35% (28th percentile).
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and CVSS 8.8, requiring user interaction (visiting a page) but no authentication. There is no public exploit identified at time of analysis and EPSS is low (0.35%, 28th percentile), consistent with a freshly patched, vendor-reported bug rather than one under active exploitation.
Sandbox escape in Google Chrome's Navigation component (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, escalating a renderer-level foothold toward host-level code execution. Chromium rates the security severity High and the CVSS is 8.3; no public exploit identified at time of analysis, and the EPSS probability is low at 0.29% (21st percentile). This is the second-stage bug in a typical Chrome exploit chain rather than a standalone remote-code-execution primitive.
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Ozone platform abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox and gain broader host access. Rated Critical by Chromium with CVSS 9.6 and a scope-changed vector, though exploitation currently shows as none in CISA SSVC and EPSS is low (0.31%). Vendor patch is available; no public exploit or KEV listing has been identified at time of analysis.
Sandbox escape in Google Chrome's Skia graphics library (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader access on the host via a crafted HTML page. Google rates the Chromium severity as Critical, and CVSS is 8.3 due to the scope change (S:C) reflecting the sandbox boundary crossing. No public exploit identified at time of analysis, and EPSS probability is low (0.31%), consistent with an exploit that requires chaining from a prior renderer compromise.
Sandbox escape in Google Chrome's Views UI framework (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Google rates the Chromium severity Critical (CVSS 9.6), and while a patch is available on the Stable channel, there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.31%. Exploitation depends on chaining a prior renderer compromise, so this is one link in a full exploit chain rather than a standalone remote-code-execution bug.
Sandbox escape in Google Chrome's Compositing component (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox and gain broader code execution via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3 (scope-changing use-after-free, CWE-416), it is a second-stage bug that presumes an existing renderer compromise rather than a standalone entry point. There is no public exploit identified at time of analysis and EPSS is low (0.31%, 23rd percentile), consistent with CISA SSVC marking exploitation as none.
Use-after-free memory corruption in SQLite 3.41's JSON extension (json.c, jsonCacheInsert) can be triggered when an application processes attacker-influenced JSON through SQLite's JSON1 functions, potentially leading to a crash (denial of service) or, if the freed heap object is reclaimed and controlled, memory disclosure or code execution in the host process. Because SQLite is an embedded library, real-world reach depends on whether the front-end application exposes JSON functions to untrusted input. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none' - the 9.8 rating appears heavily influenced by an assumed network vector rather than demonstrated remote exploitability.
Memory disclosure and denial of service in SQLite 3.41 arise from a use-after-free in the btree module's shared-cache lock management, where a BtLock structure is freed but never unlinked from its linked list. Applications that enable SQLite shared-cache mode can have subsequent list traversals read freed memory, leaking sensitive process memory (CVSS C:H) or crashing the process (A:H). No public exploit identified at time of analysis, and SSVC lists exploitation status as none, though the flaw is assessed as automatable.
Use-after-free in Node.js HTTP/2 implementation allows remote unauthenticated attackers to crash the Node.js process by sending crafted HTTP/2 RST_STREAM frames while the stream object remains in scope. The fix - 'defer rst stream while in scope' - confirms that RST_STREAM processing freed or invalidated memory still referenced by the active stream context. With CVSS A:H and AV:N/AC:L/PR:N/UI:N, this is a straightforward remote denial-of-service against any Node.js server with HTTP/2 enabled. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity network vector and multi-LTS-branch impact make patching urgent.
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a use-after-free (CWE-416) in the intercept plugin, allowing a remote attacker to crash or destabilize the proxy server. The flaw carries a CVSS 4.0 base score of 8.2, driven entirely by high availability impact with no confidentiality or integrity effect, and exploitation depends on a specific attack condition (AT:P) rather than being trivially reproducible. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free and time-of-check/time-of-use race, primarily crashing the proxy (high availability impact) with secondary low-level confidentiality and integrity exposure. It affects the 8.x, 9.x, and 10.x branches up to 8.1.9, 9.2.14, and 10.1.3, and is fixed in 9.2.15 and 10.1.4. Reported by Apache with a CVSS 4.0 score of 8.3; no public exploit identified at time of analysis and it is not on CISA KEV.
Remote code execution in pglogical extension for PostgreSQL allows a low-privileged user to crash replication workers, with potential for arbitrary code execution. A use-after-free condition in worker signaling code is triggered during normal replication operations when worker lifecycle events race. While typical effect is denial-of-service, a successful exploit can give complete control of the database backend process.
Use-after-free vulnerability in Safari’s web content processing allows remote attackers to execute arbitrary code on affected Apple devices when a user visits a malicious website. Affected versions include Safari prior to 26.6, iOS and iPadOS prior to 26.6, macOS Tahoe prior to 26.6, visionOS prior to 26.6, and watchOS prior to 26.6. No public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.13%).
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe/tvOS/visionOS/watchOS before 26.6 - where a use-after-free (CWE-416) lets a locally installed app crash the system. There is no public exploit identified at time of analysis and the NVD CVSS 9.8 (C:H/I:H/A:H) conflicts with Apple's own description, which states only 'unexpected system termination' (availability impact), suggesting the true impact is a DoS crash rather than full compromise. EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV.
Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected system termination. Affected versions include iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. While the NVD assigns CVSS 9.8, the actual impact is limited to availability; no active exploitation or public exploit code is identified, and EPSS indicates very low exploitation probability (0.17%).
Unexpected system termination in iOS and iPadOS prior to 26.6, as well as in certain versions of macOS, tvOS, and visionOS, resulting from a use-after-free memory corruption. Apple's description indicates a local denial-of-service where a malicious app can crash the system, while the NVD-assigned CVSS 9.8 erroneously implies unauthenticated remote code execution. A patch is available, no active exploitation has been reported, and EPSS suggests a very low probability of wide exploitation.
Use-after-free memory corruption in Apple's core operating-system platforms - iOS/iPadOS, macOS Tahoe, tvOS, and watchOS before version 26.6 - allows a locally installed and executed application to crash or unexpectedly terminate the system. Exploitation requires the victim to run attacker-supplied code as an app on an unpatched device; there is no remote attack surface, and the demonstrable impact is availability only (system termination/reboot), with no data disclosure, modification, or code execution established - meaning the publicly circulated CVSS 9.8 network vector materially overstates the real reachability and impact of this bug. No public exploit identified at time of analysis, EPSS is low at 0.16% (6th percentile), CISA SSVC records Exploitation: none with total technical impact if reached, and Apple has shipped fixes in 26.6 across all four platforms.
Use-after-free memory corruption in Apple's iOS 26.6-era platform family lets an already-installed app crash the operating system kernel or a system service, producing an unexpected system termination (denial of service). Affected software spans iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe before 26.6, and tvOS, visionOS and watchOS before 26.6; exploitation requires the attacker's app to run locally on the device, since the flaw is only reachable from within an executing process. The headline input score of CVSS 9.8 (AV:N) overstates the issue - Apple's own advisory describes impact limited to a crashing app, EPSS is a low 0.17% (6th percentile), CISA SSVC records no exploitation and no public exploit code exists, and no KEV listing or POC is associated with CVE-2026-43822.
A use-after-free vulnerability in Apple operating systems allows a malicious app to cause unexpected system termination or write to kernel memory. The issue affects iOS
Denial of service in Apple iOS, macOS, and related operating systems due to a use-after-free flaw could allow a malicious app to crash the device. Apple's advisory only confirms unexpected system termination, but an independent CVSS score of 9.8 suggests potential for full system compromise; however, the CVSS vector appears inconsistent with the vendor description. The vulnerability is patched in versions 26.6 for all affected OSes, and no active exploitation or public exploit code is known.
A use-after-free memory-corruption flaw in Apple's mobile and desktop operating systems lets an app already running on the device trigger an unexpected system termination - a denial-of-service condition affecting availability only. The issue is fixed in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6, meaning every device running an earlier build of those platforms is exposed. There is no evidence of active exploitation (not in CISA KEV, SSVC exploitation: none) and no public exploit code has been identified; EPSS is just 0.16% (6th percentile), and the widely circulated CVSS 9.8 AV:N/PR:N vector is grossly inflated relative to the assessed AV:L/AC:L/PR:N/UI:N impact of C:N/I:N/A:H.
A use-after-free vulnerability in macOS allows a local application to cause a denial-of-service by crashing the system or a key service. The flaw affects multiple macOS versions prior to the Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 updates. Despite an assigned CVSS score of 9.8 suggesting remote pre-authentication full compromise, the Apple advisory explicitly describes only a local denial-of-service impact, and the EPSS exploitation probability is very low (0.16%). No active exploitation or public proof-of-concept has been reported, and a vendor patch is available.
Kernel memory corruption in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows a malicious app to cause system termination or corrupt kernel memory. A use-after-free issue in the kernel’s memory management could be triggered by an app, leading to unexpected system behavior or potential code execution. Patches are available across all affected operating systems; no active exploitation has been observed.
Use-after-free in SQLite 3.41 expression parsing leads to memory corruption, allowing remote attackers to crash applications and leak sensitive memory contents via crafted SQL queries. Public proof-of-concept exists but there is no evidence of active exploitation. The vulnerability is triggered by sending malicious SQL statements that cause the parser to access a freed expression object.
Remote denial of service and heap memory leak in SQLite 3.41 via the json_remove() function allows attackers with the ability to execute SQL queries to crash the database process or leak sensitive heap data. A use-after-free in jsonRemoveFunc is triggered by malformed JSON and a deep path parameter; publicly available proof-of-concept code exists, and low EPSS risk indicates limited exploitation likelihood.
Use-after-free in SQLite 3.41's JSON parser allows remote code execution. A remote attacker can deliver a crafted JSON payload; if a user or application processes it with SQLite, the vulnerability triggers memory corruption, potentially enabling full system compromise. A proof-of-concept advisory is publicly available, though no active exploitation has been confirmed.
Use-after-free in SQLite 3.41's expression-evaluation path lets an attacker who can submit a crafted SQL statement crash the process, leak adjacent memory, or potentially achieve code execution. The flaw stems from sqlite3ReleaseTempReg() prematurely freeing a temporary register that exprComputeOperands() then dereferences. Rated CVSS 7.5 (AV:N/AC:H/PR:L); publicly available exploit code exists per the CISA SSVC 'poc' determination, but it is not on the CISA KEV list and EPSS is low (0.24%, 16th percentile), indicating no evidence of widespread active exploitation.
Memory corruption in SQLite 3.41's ORDER BY parsing allows remote attackers to crash the database process or leak sensitive data via crafted SQL queries. A use-after-free in ExprList handling, triggered by an ORDER BY clause with many items, can also lead to arbitrary code execution under specific memory conditions. A public advisory exists, but no active exploitation (KEV) or EPSS data is available.
Use-after-free in SQLite 3.41 allows remote attackers supplying crafted SQL to trigger memory corruption during parsing, leading to denial of service, sensitive information leakage, and potential arbitrary code execution.
Use-after-free in the Linux kernel's usbio (USB I/O bridge) driver allows a local, low-privileged attacker to corrupt kernel slab memory during USB device disconnect, potentially achieving privilege escalation or triggering a kernel panic. The bug lies in usbio_disconnect(), which iterates the client list in reverse using list_for_each_entry_reverse() - a macro that reads client->link.prev after the loop body, but auxiliary_device_uninit() can free the current client before that read, dereferencing freed slab memory. Patches are confirmed in Linux stable branches 6.18.39, 7.1.4, and 7.2-rc3; no public exploit or active exploitation is identified at time of analysis.
Use-after-free in the Linux kernel's 6LoWPAN NHC handler may allow network-adjacent attackers to execute arbitrary code or trigger denial of service by sending a malformed packet. Affects kernels with 6LoWPAN support from commit 92aa7c65d295 up to the patched versions. No active exploitation or public exploit code is known; EPSS probability is low at 0.22%.
Use-after-free in the Linux kernel's crypto/krb5 helper library (introduced in 6.15) occurs when Kerberos AEAD encrypt/decrypt operations are backed by an asynchronous AEAD implementation. The synchronous helpers in rfc3961_simplified.c and rfc8009_aes2.c set a NULL completion callback and treat any negative return as terminal, so an async backend returning -EINPROGRESS causes the buffer to be freed with kfree_sensitive() while the backend worker still dereferences it. This is reachable through kernel consumers of krb5 crypto (rxrpc/rxgk, AFS cm_security, and Ceph), but only on systems where an async AEAD provider is bound to the krb5 enctype name; no public exploit identified at time of analysis and EPSS is low at 0.21%.
Use-after-free in the Linux kernel's Intel QuickAssist Technology (QAT) SR-IOV driver allows a local low-privileged attacker - including a VM tenant with a VF assigned - to corrupt host kernel memory by racing VF2PF workqueue processing against SR-IOV teardown in adf_disable_sriov(). The VF2PF interrupt handler enqueues work that holds raw pointers to per-VF state (struct adf_accel_vf_info); adf_disable_sriov() freed that state without draining in-flight workers, enabling a concurrent worker to deref freed memory. No public exploit is known at time of analysis, and EPSS is 0.22% (13th percentile), indicating negligible observed exploitation pressure despite the 8.8 CVSS score.
Use-after-free in the Linux kernel's ksmbd (SMB server) allows authenticated remote attackers to trigger memory corruption, potentially leading to arbitrary code execution or denial of service. The flaw occurs when an SMB2_CLOSE on a locked file is followed by an SMB2_CANCEL, causing a freed file_lock to be re-accessed. A patch is available for affected kernel versions, and while no active exploitation is confirmed, a proof-of-concept exists; EPSS indicates low exploitation likelihood.
Use-after-free in the Linux kernel's Bluetooth L2CAP subsystem can be triggered by an adjacent attacker, potentially leading to arbitrary code execution or kernel memory corruption. The flaw occurs when a channel timeout callback races with connection teardown, allowing a freed connection object to be accessed. Patched kernels are available; no active exploitation is confirmed, but the vulnerability is remotely exploitable within Bluetooth range without authentication or user interaction.
Use-after-free in the Linux kernel Bluetooth MGMT subsystem allows a local attacker with low privileges to trigger kernel memory corruption via a race condition between add_device and remove_device operations. The flaw exists in add_device_complete(), which dereferences a hci_conn_params pointer without holding hci_dev_lock, while a concurrent MGMT_OP_REMOVE_DEVICE path frees the same object under that lock. KASAN confirms exploitation as slab-use-after-free; no public exploit or active exploitation (CISA KEV) has been identified, and patches have been released across multiple stable branches.
Use-after-free memory corruption in the Linux kernel's netpoll subsystem allows a local attacker or concurrent kernel path to access freed memory during the netpoll shutdown sequence. The flaw exists because cancel_delayed_work() - called from softirq context during __netpoll_cleanup() - does not block until the TX worker finishes, permitting queue_process() to dereference a kfree'd npinfo struct via container_of(). KASAN confirms the UAF; patches are available across multiple stable kernel branches, and no public exploit or KEV listing exists at time of analysis.
Use-after-free in the Linux kernel IPv4 IGMP subsystem allows a local low-privileged attacker to trigger kernel memory corruption or a system crash by racing network device destruction against concurrent multicast group lookups in softirq context. During ip_mc_destroy_dev(), multicast membership entries are scheduled for RCU reclamation via ip_ma_put() but are not unlinked from the per-device mc_hash table; concurrent softirq-path readers such as ip_check_mc_rcu() can then dereference a freed slab object, as confirmed by the embedded KASAN trace showing a read of freed memory during UDP packet processing. No public exploit code or CISA KEV listing exists at time of analysis; Ubuntu USN-8726/8727-1 and a Siemens ICS advisory confirm active patching across distributions.
Use-after-free memory corruption in the Linux kernel's NXP i.MX8 ISI (Image Sensing Interface) media driver is triggered during module removal (rmmod of imx8_isi), confirmed by KASAN slab-use-after-free reports. The root cause is an incorrect teardown order in mxc_isi_remove(): the crossbar cleanup frees media entity pads before the V4L2 cleanup has finished removing media links that reference those same pads, resulting in a dangling pointer dereference in __media_entity_remove_link(). No public exploit has been identified at time of analysis, and with EPSS at 0.21% (11th percentile), real-world weaponization appears unlikely despite the CVSS 7.8 score.
Use-after-free in the Linux kernel Bluetooth subsystem's bt_accept_dequeue() function allows an attacker with local or adjacent Bluetooth access to corrupt kernel heap memory or crash the system during L2CAP listening socket teardown. The bug stems from a reference-count sequencing error: the temporary queue-walk reference is dropped before bt_accept_unlink() removes the socket from the accept queue and drops its own reference, so if that was the final reference, the subsequent sock_hold() call dereferences freed slab memory. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS is 0.22% (13th percentile), consistent with low opportunistic exploitation risk.
Local privilege escalation in the Linux kernel's SMB client witness notification handler allows a low-privileged attacker to exploit a use-after-free condition. Affected are Linux kernel versions 5.11 and later that have the CIFS witness feature enabled. Successful exploitation can lead to arbitrary code execution with elevated privileges, fully compromising the system.
Use-after-free vulnerability in the Linux kernel's ksmbd SMB server allows remote attackers to execute arbitrary code. All kernel versions with ksmbd enabled from early commits up to the patched releases are affected, and the issue can be triggered by concurrent QUERY_DIRECTORY requests on the same file handle. A fix is available via multiple stable kernel branches, no active exploitation is reported in KEV, and EPSS indicates a low probability of widespread exploitation (0.21%).
Use-after-free in Linux kernel’s ksmbd SMB server occurs during deferred byte-range lock cancellation, allowing an authenticated attacker to potentially execute arbitrary code or crash the system. The vulnerability affects ksmbd versions prior to the released fixes (6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, 7.2-rc1). No active exploitation has been confirmed (no CISA KEV listing), and EPSS indicates a low probability of widespread exploitation.
Local privilege escalation in the Linux kernel's pcc-cpufreq driver allows a low-privileged user to gain full root privileges. The vulnerability is a use-after-free and double-free flaw when evaluating ACPI _OSC negotiation, affecting all kernel versions from 2.6.34 until the fixed stable releases (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1). No active exploitation or public exploit has been identified, and EPSS indicates a low probability of widespread exploitation.
Use-After-Free in the Linux kernel HID letsketch driver allows local exploitation during device unbind, potentially enabling kernel memory corruption and privilege escalation on affected systems. The letsketch_probe() function arms a per-device kernel timer (inrange_timer) with a 100 ms timeout, but no .remove callback exists to drain the timer before devm cleanup frees letsketch_data and input_dev structures on USB unplug or rmmod, producing a UAF read/write into freed kernel memory. Patches are backported across six stable kernel branches; no public exploit code exists and EPSS is 0.21% (12th percentile), reflecting the niche device requirement and race-condition complexity.
Use-after-free in the Linux kernel HID appleir driver allows a local attacker to corrupt kernel memory during device removal, potentially achieving privilege escalation. The race condition exists between the key_up_timer callback (armed by appleir_raw_event() on each keydown/key-repeat) and hid_hw_stop(), which frees the underlying input_dev before the timer is drained. A second race window, where a USB URB completion during hid_hw_stop() can re-arm the timer via mod_timer(), means a simple teardown reorder is insufficient — the fix introduces a spinlock-gated 'removing' flag combined with timer_shutdown_sync() to permanently disable further callbacks. No public exploit has been identified at time of analysis, and EPSS is 0.22% (13th percentile).
Use-after-free in the Linux kernel HID lg-g15 driver allows a local attacker to trigger kernel memory corruption by racing device input events against USB keyboard removal. The driver allocates lg_g15_data via devm and schedules work items from HID report handlers (backlight cycle key on G15, G15 v2, G510), but lacked a remove callback to cancel pending work before devres freed the allocation. On kernel versions from approximately 5.5 through the unfixed stable branches, unplugging the keyboard while a work item is pending causes the worker to dereference freed memory via container_of, potentially enabling local privilege escalation. No public exploit has been identified and EPSS is 0.22% (13th percentile), indicating no observed widespread exploitation.
Incorrect RCU lock annotations in the Linux kernel's BPF LPM trie map implementation (`kernel/bpf/lpm_trie.c`) cause lockdep false positives on debug kernels when sleepable BPF programs access `BPF_MAP_TYPE_LPM_TRIE` maps via lookup, update, or delete operations. The mismatch arises because sleepable BPF programs hold `rcu_read_lock_trace()` while the trie code asserts `rcu_read_lock_bh_held()` or `rcu_read_lock_held()`, producing repeated 'suspicious RCU usage' kernel warnings per distinct callsite. The Linux kernel developers explicitly state no actual use-after-free occurs, since Tasks Trace RCU already serializes against trie node reclaim; however, the incorrect annotation undermines lockdep's ability to detect future regressions and is increasingly impactful as sleepable BPF LSM programs become common in production security tooling. No public exploit exists and no CISA KEV listing has been issued.
Use-after-free and memory leak in the Linux kernel's EHCI and FOTG210 USB isochronous submit paths expose systems running kernel versions from 2.6.15 through 7.1.3 to local kernel memory corruption by a low-privileged user. When an isochronous URB submission fails before the staged schedule handoff - either because the host controller becomes inaccessible or usb_hcd_link_urb_to_ep() returns an error - the ehci_iso_sched allocation is not freed and urb->hcpriv retains a dangling pointer, creating a UAF condition. No public exploit exists and the EPSS score is 0.21% (12th percentile), but vendor-released patches across multiple stable branches are available and should be applied to eliminate the risk.
Use-after-free in the Linux kernel USB gadget UDC subsystem exposes systems with DWC3-based USB controllers to a race condition between usb_del_gadget() and gadget_match_driver(), enabling a NULL pointer dereference that can crash the kernel or enable privilege escalation on unpatched systems. The flaw affects all major Linux stable branches from 5.15.x through 7.1.x prior to the patched releases, and is particularly relevant for embedded Linux, Android-based devices, and IoT hardware that use USB gadget/device mode. No public exploit has been identified at time of analysis, and EPSS remains at 0.21% (12th percentile), reflecting current low exploitation interest.
Use-after-free in the Linux kernel's idmouse USB fingerprint driver allows a low-privileged local attacker to corrupt kernel memory by racing a device disconnect against a file-descriptor release, potentially enabling local privilege escalation to root. The bug stems from `mutex_unlock()` accessing the freed driver-data structure after the lock is released, a documented non-atomic behavior; the fix introduces a `kref` reference counter to correctly manage object lifetime. Patches are available across all active stable branches; no active exploitation or public exploit has been reported.
Use-after-free in the Linux kernel's USB ldusb driver allows a local unprivileged user to corrupt kernel memory by racing disconnect() against release() on a connected USB device. The root cause is that mutex_unlock() is documented as non-atomic and may access the mutex object after it logically releases the lock, creating a window where the driver data structure can be freed while still in use. No public exploit has been identified at time of analysis, and EPSS is low (0.22%), but the C:H/I:H/A:H CVSS impact vector reflects the potential for full kernel privilege escalation if successfully triggered.
Use-after-free in the Linux kernel's USB iowarrior driver exposes systems with Code Mercantile IO-Warrior USB devices to kernel memory corruption, potentially enabling local privilege escalation to root. The defect exists because submitted write URBs are not cancelled during close(), leaving them in-flight at disconnect time; the completion handler then fires against already-freed device structures. No public exploit code has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects minimal observed exploitation pressure, though the C:H/I:H/A:H CVSS impact reflects genuine kernel-level consequence.
Use-after-free in the Linux kernel USB iowarrior driver allows a local unprivileged user to corrupt kernel memory when a USB device disconnect races with a file release operation. The root cause is that mutex_unlock() is documented as non-atomic and may access the mutex structure after releasing the lock, meaning the driver data object can be freed while mutex_unlock() is still executing. An attacker who can trigger the race - by opening the iowarrior device and simultaneously provoking a USB disconnect - may achieve kernel memory corruption leading to privilege escalation. No public exploit code exists and EPSS is low (0.21%), but the impact class is standard kernel UAF.
The Linux kernel's legousbtower USB driver contains a use-after-free race condition between the release() and disconnect() code paths, present since Linux 2.6.25. An authenticated local user with a LEGO USB Tower device attached can trigger the race at disconnect time to corrupt freed kernel memory, potentially gaining elevated privileges or crashing the system. Patches have been issued across all active stable branches (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1); no public exploit code or CISA KEV listing exists at time of analysis.
Use-after-free in the Linux kernel's USB Type-C UCSI CCG driver allows a local attacker with low privileges to corrupt kernel memory, potentially achieving arbitrary kernel code execution. The flaw exists in the module teardown path of the Cypress CCG UCSI driver: ucsi_ccg_remove() calls ucsi_destroy() - which kfree()s the ucsi object - before calling free_irq(), leaving a window in which the threaded IRQ handler ccg_irq_handler() can access the freed ucsi struct via ucsi_notify_common(). No public exploit code exists and the bug was discovered by static analysis; EPSS is 0.22% (13th percentile), reflecting no observed in-the-wild activity.
Use-after-free and missing forward security in the loongson-rng crypto driver of the Linux kernel allow a local, low-privilege attacker to corrupt memory and potentially execute arbitrary code, compromise system integrity, or read sensitive information. Affected systems are primarily Loongson-based machines running kernels between v6.18 and the respective fix versions; the driver itself is unused by any in‑kernel consumer and is being removed entirely rather than patched. No active exploitation or public exploit code is known, and the EPSS exploitation probability is low (0.21%).
Use-after-free and list corruption in the Linux kernel's Intel QuickAssist Technology (QAT) crypto driver allows a local low-privileged attacker to trigger kernel memory corruption by racing concurrent service registration and device lifecycle operations. The crypto/qat subsystem's service_table linked list is guarded by service_lock only during insertions and deletions, but seven device-state functions iterate the list unprotected, enabling a concurrent adf_service_register() or adf_service_unregister() call to mutate the list mid-traversal. Exploiting this race can result in kernel crash, arbitrary kernel memory read, or local privilege escalation to root. No public exploit code has been identified and EPSS stands at 0.21% (11th percentile), but the impact class is high for systems running QAT-capable Intel hardware.
Use-after-free vulnerability in the Linux kernel's fsl-lpspi SPI driver can lead to memory corruption or arbitrary code execution with kernel privileges. A local attacker with high privileges on systems using the affected driver can trigger this flaw, potentially causing a kernel panic or full system compromise. At time of analysis, no public exploit or active exploitation is identified, and EPSS indicates low exploitation probability (0.22%).
Page use-after-free in the Linux kernel perf/aux subsystem allows a local authenticated attacker to read or write freed kernel memory, potentially achieving privilege escalation. The flaw arises because map_range() accesses rb->aux_pages[], rb->aux_nr_pages, and rb->aux_pgoff while holding only the per-event mmap_mutex, whereas those fields are serialised by the ring-buffer-level rb->aux_mutex; two events sharing one ring buffer via PERF_EVENT_IOC_SET_OUTPUT can therefore race rb_alloc_aux() against map_range(), leaving a VM_PFNMAP mapping pointing to a freed physical frame. No public exploit has been identified at time of analysis, and EPSS exploitation probability is very low at 0.21% (11th percentile).
A use-after-free in the FUSE subsystem of the Linux kernel allows a local attacker with permission to mount a FUSE filesystem to escalate privileges or crash the system. The vulnerability exists in fuse_ref_folio() due to improper request locking, and affects kernel versions from 2.6.35 through unpatched longterm branches. Patches are available, and no active exploitation or public exploit code has been identified.
Local privilege escalation in the Linux kernel FUSE subsystem allows a low-privileged attacker to corrupt kernel memory
Local privilege escalation in the Linux kernel's fuse-uring subsystem allows a local attacker to trigger a use-after-free condition by racing with the async stop queues function, potentially resulting in arbitrary code execution and complete system compromise. The vulnerability affects Linux kernel versions 6.14 through 6.18.x (patched in 6.18.39, 7.1.4,
Use-after-free in the Linux kernel’s fuse-uring subsystem allows a local authenticated attacker to escalate privileges. The race condition occurs when a malicious userspace sends a commit SQE before the kernel completes the memcpy of request data, triggering a freed fuse_req to be reused. CVSS base score is 7.8 but EPSS probability is low (0.21%), and no public exploit or active exploitation has been reported.
Use-after-free in the Linux kernel's power sequence (pwrseq) debugfs seq_file handler allows a local attacker with low privileges to achieve privilege escalation or system compromise. The flaw arises from incorrect device reference counting in the seq_next callback, leading to reuse of a freed pointer. Affected kernels include versions since commit 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c; no active exploitation or public exploit has been confirmed at the time of analysis.
Use-after-free in the Linux kernel FPGA region subsystem allows a local authenticated attacker with low privileges to corrupt kernel memory, potentially achieving full confidentiality, integrity, and availability impact. The flaw in `child_regions_with_firmware()` stems from `of_node_put(child_region)` freeing the node before `pr_err()` dereferences the same pointer on an error path - a deterministic UAF triggered by a specific error condition in FPGA device tree enumeration. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), placing this firmly as a maintenance-priority fix for most environments rather than an emergency response item.
Use-after-free in the Linux kernel's linkstation-poweroff driver exposes systems running affected kernel versions on Buffalo LinkStation NAS hardware to local privilege escalation. The flaw resides in linkstation_poweroff_init(), where of_node_put(dn) was called before of_match_node() finished using the pointer, producing a kernel-space use-after-free that can corrupt slab-allocated memory. No public exploit has been identified and the EPSS score of 0.16% (6th percentile) indicates very low observed exploitation probability, though the official CVSS base severity is 7.8 (High) with confirmed high impact to confidentiality, integrity, and availability.
Use-after-free in the Linux kernel fbdev subsystem's fb_find_mode() function allows a local attacker with low privileges to read freed kernel heap memory, potentially achieving information disclosure, memory corruption, or privilege escalation. The flaw exists when mode_option is NULL: a heap-allocated buffer (mode_option_buf) is freed while the local alias name still references it during the name_matches() comparison loop. Patched versions are available across multiple stable branches (6.6.144, 6.12.95, 6.18.38, 7.1.3, 7.2-rc1). No public exploit exists and EPSS sits at the 6th percentile, but the CVSS 7.8 High score correctly reflects the maximum-impact potential of kernel-level heap memory corruption.
Use-after-free in the Linux kernel DAMON (Data Access Monitor) sysfs subsystem allows a local, low-privileged user with sysfs write access to corrupt kernel memory structures, potentially escalating to full kernel-level code execution. The DAMOS tried-region directory removal function (damon_sysfs_scheme_regions_rm_dirs()) decrements kobject reference counts but omits removing region objects from the tracking linked list; asynchronous execution of the kobj release callback leaves dangling list entries that a concurrent list rebuild can write into freed memory. No public exploit or active exploitation has been identified - EPSS is 0.16% (5th percentile) and the vulnerability is absent from CISA KEV - consistent with a hardening fix rather than an actively weaponized flaw.
Local privilege escalation in the Linux kernel's sched_ext subsystem allows a low-privileged local attacker to achieve root access via a use-after-free error in the scx_root_enable_workfn() initialization failure path. The vulnerability is fixed by reordering the put_task_struct() call after scx_error() to prevent premature freeing of the task structure. No active exploitation or public exploit has been reported, and EPSS indicates low exploitation likelihood.
Local privilege escalation in the Linux kernel's ti-qspi SPI driver results from a use-after-free when DMA setup fails, allowing a local attacker to potentially execute arbitrary code or crash the system. The vulnerability affects Linux kernels from version 4.12 up to the patched stable releases 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No active exploitation has been confirmed (CISA KEV not listed), and the EPSS probability is low (0.18%), indicating limited real-world likelihood.
Use-after-free in the Linux kernel’s netfs library allows a local attacker to escalate privileges or cause denial of service. The race condition occurs when unlocking abandoned read folios after a netfs request completes, potentially corrupting kernel memory. No active exploitation or public exploit is known at this time.
Memory corruption and use-after-free in Imagination Technologies Graphics DDK allows local attackers to escalate privileges. The vulnerability stems from improper reference counting on synchronization primitives during fence export, enabling a low-privileged user to achieve kernel read/write and full system compromise. No active exploitation or public exploit is confirmed, and EPSS indicates low exploitation probability.
Use-after-free in Chrome's Input component enables an attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. Affected versions span all Google Chrome releases prior to 150.0.7871.186 across Windows, macOS, and Linux. Successful exploitation grants code execution outside the sandbox with the full privileges of the browser process on the underlying host. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS stands at 0.25% (16th percentile), consistent with no observed in-the-wild activity.
Remote code execution in the Blink rendering engine of Google Chrome versions prior to 150.0.7871.186 allows an attacker to run arbitrary code inside Chrome's sandbox when a victim visits a crafted HTML page. The vulnerability has a high CVSS score (8.8) but a low EPSS exploitation probability (0.30%), and no active exploitation has been observed (CISA KEV not listed). A vendor patch is available.
Remote code execution inside a sandbox in Google Chrome prior to 150.0.7871.186 allows attackers to execute arbitrary code via a crafted HTML page. This use-after-free vulnerability requires user interaction and has a high CVSS score but low real-world exploitation probability (EPSS 0.30%). No active exploitation or public exploit code has been identified.
Denial of service in MongoDB's mongod server allows any authenticated user holding only read privileges to crash the database by submitting aggregation pipeline expressions that invoke server-side JavaScript, triggering a use-after-free (CWE-416) during document processing. The flaw affects availability only and requires valid low-privilege credentials; no public exploit identified at time of analysis and it is not listed in CISA KEV.