Information Disclosure

PowerPC 64-bit (ppc64le/Book3S64) Linux kernel systems from version 5.8 onward can be crashed via a local race condition between concurrent move_pages() and munmap() operations on Transparent Huge Page (THP) PMD-backed memory. During the PMD migration sequence, a narrow window exists where the PMD entry holds a migration swap entry with pmd_present=0; a concurrent munmap() acquiring the same page table lock during this window triggers a VM_BUG_ON() assertion in pmdp_huge_get_and_clear_full(), causing a kernel panic. No public exploit is identified and EPSS stands at 0.15% (5th percentile), but the DoS impact is confirmed by upstream kernel developers with real hardware traces on IBM POWER10 and is patched in stable releases 7.0.10 and 7.1.

The Marvell Libertas USB WiFi driver in the Linux kernel invokes usb_kill_urb() and usb_kill_anchored_urbs() from interrupt context during the HCD giveback path, causing a kernel BUG() or deadlock because those functions may sleep. Systems with a Marvell Libertas USB WiFi adapter attached can be crashed by a local low-privileged user triggering the race condition, resulting in a denial of service via kernel panic. No public exploit exists and EPSS is 0.15% (5th percentile), indicating negligible exploitation probability; the constraint to specific legacy hardware further limits real-world impact.

BPF local storage deletion in the Linux kernel deadlocks when `bpf_xxx_storage_delete()` helpers execute within a Non-Maskable Interrupt (NMI) context, because the underlying RCU-based freeing mechanisms (`kfree_rcu`, `call_rcu`, `call_rcu_tasks_trace`) are not safe in NMI or reentrant execution paths. Locally privileged users capable of loading BPF programs attached to NMI-triggerable events can exploit this to cause a CPU-level deadlock, denying availability on the affected processor. No public exploit has been identified and EPSS at 0.14% (4th percentile) confirms this is a very low probability of opportunistic exploitation; impact is purely availability.

Memory exhaustion in the Linux kernel mt76 WiFi driver allows a local low-privileged user on systems with MediaTek MT76 hardware to cause denial of service through kernel memory leakage during module teardown. The mt76_dma_cleanup routine fails to destroy page_pools associated with WED RRO receive queues (queues not tied to NAPI), and does not return pages to the pool when WED is not enabled - resulting in unreclaimed kernel memory on each module unload cycle. No public exploit exists and EPSS probability sits at 0.17% (6th percentile), consistent with a niche hardware-specific leak with no code-execution path.

Deadlock in the Linux kernel's mt76/mt7925 MediaTek WiFi driver can be triggered by a local low-privileged user, causing the wireless networking subsystem to hang indefinitely. The flaw exists in mt7925_roc_abort_sync(), which calls cancel_work_sync() while already holding dev->mt76.mutex - the same mutex held by roc_work() - producing a classic mutual-wait deadlock with no path to resolution. Systems running affected kernel versions with MediaTek MT7925 WiFi hardware are vulnerable to a local denial of service; no public exploit has been identified and EPSS places exploitation probability at 0.17% (6th percentile), consistent with the niche hardware requirement.

Kernel memory exhaustion in the Linux mt76 WiFi driver allows a local low-privileged user on affected hardware to gradually degrade system availability. The functions mt76_connac_mcu_sta_wed_update() and mt76_connac_mcu_sta_key_tlv() may fail before the allocated socket buffer (skb) is handed off to mt76_mcu_skb_send_msg() for transmission and cleanup, leaving the skb permanently leaked. With EPSS at the 5th percentile, no KEV listing, and discovery solely via static analysis, this is a stability maintenance concern rather than an active security threat.

Mutex deadlock in the Linux kernel's mt7921 WiFi driver (mt76/mt7921 subsystem) can render the WiFi subsystem permanently unresponsive on affected systems. The deadlock arises during station removal: the call chain mt76_sta_state() → mt76_sta_remove() → mt7921_mac_sta_remove() → mt7921_roc_abort_sync() invokes cancel_work_sync() while roc_work() holds dev->mt76.mutex and the removal path already owns the same lock - a classic ABBA deadlock with no progress possible. No public exploit is identified and EPSS sits at 0.17% (6th percentile), placing this firmly in the patch-and-move-on category for most organisations, though Linux distributions serving MT7921 hardware (common in consumer laptops) should prioritise kernel updates.

Deadlock in the Linux kernel mt76 WiFi driver's remain-on-channel path allows a local low-privileged user to crash or hang the WiFi subsystem. The flaw affects kernels containing the mt76 driver from commit a8f424c128 through the fixed releases (6.18.33, 7.0.10, 7.1), with no confidentiality or integrity impact - only availability. No public exploit code exists and EPSS sits at 0.17% (6th percentile), consistent with a local, hardware-specific denial-of-service with negligible opportunistic exploitation risk.

Control Flow Integrity (CFI) protection for the BPF subsystem's btf_dtor_kfunc_t type is silently compiled out in affected Linux kernel versions because BPF code references the deprecated CONFIG_CFI_CLANG symbol rather than the renamed CONFIG_CFI, leaving CFI violations in BPF destructor functions unchecked and capable of crashing the kernel. Locally-privileged users on affected kernel builds - those compiled with CFI support, typically Clang-built distributions - can trigger a kernel panic by interacting with the BPF subsystem. This vulnerability is not listed in the CISA KEV catalog, no public exploit has been identified, and the EPSS score of 0.16% (5th percentile) reflects minimal real-world exploitation probability.

BPF subsystem argument-tampering in the Linux kernel allows local attackers with CAP_BPF privileges to abuse the kprobe+freplace program chaining path to overwrite kernel function arguments via a manipulated `struct pt_regs`, causing kernel denial of service or subversion of kernel function behavior. The root mechanism is that freplace programs inherit the `kprobe_write_ctx=true` permission from a parent kprobe program, enabling register writes that should be confined to uprobe contexts. No public exploit or CISA KEV listing is confirmed; EPSS sits at the 6th percentile. Patches are available in Linux 6.18.33, 7.0.10, and the 7.1 mainline branch.

Lock ordering deadlock in the Linux kernel BPF task_vma iterator allows a local low-privileged user with BPF program execution rights to trigger a system hang or denial of service. Holding the per-VMA lock across BPF program body execution creates a circular dependency (vm_lock → i_rwsem → mmap_lock → vm_lock) when BPF helpers internally acquire mmap_lock. Patches are available across multiple stable branches; EPSS is low at 0.16% and no public exploit or active exploitation has been identified.

RCU stall denial-of-service in the Linux kernel BPF subsystem allows a local low-privileged user to cause kernel-level availability degradation by triggering map clearing on a large PROG_ARRAY BPF map. The missing cond_resched() call in bpf_fd_array_map_clear() prevents CPU yielding during an expensive per-entry loop, starving the RCU grace period mechanism and triggering watchdog stalls in the deferred workqueue. No active exploitation is confirmed - EPSS is 0.16% (5th percentile) and the vulnerability is absent from CISA KEV - making this a maintenance-tier patch rather than an emergency response priority.

Uninitialized memory read in the Linux kernel's hamradio 6pack TTY driver (net/hamradio/6pack.c) allows a local low-privileged user to crash the kernel, causing a denial of service. The flaw exists across a broad range of stable kernel branches from 2.6.12 through at least 7.0, and patches have been issued across eight stable series. No public exploit code exists and no active exploitation has been reported; with an EPSS of 0.16% at the 6th percentile, real-world risk is constrained by the highly niche deployment context of amateur-radio 6pack hardware.

Memory leak in the Linux kernel's network scheduler (net_sched) subsystem allows a local low-privileged user to exhaust kernel memory and degrade system availability. The flaw resides in qdisc_dequeue_drop(), which fails to account for root qdiscs that lack the TCQ_F_DEQUEUE_DROPS flag - leaving packet buffers stranded indefinitely on child qdisc to_free lists during qdisc_run_end() cleanup. No active exploitation is confirmed (not in CISA KEV) and EPSS sits at 0.14% (4th percentile), reflecting the low probability of opportunistic abuse given the local access and specific configuration requirements.

Out-of-bounds read in the Linux kernel's BPF test interface (bpf_prog_test_run_skb) allows local users with BPF syscall access to crash the kernel by supplying a crafted test packet containing only an Ethernet header bearing an IPv4 or IPv6 EtherType but no L3 payload. The code calls eth_type_trans() to set skb->protocol and then unconditionally dereferences ip_hdr(skb) or ipv6_hdr(skb) without first validating that the supplied buffer is large enough to contain an IP or IPv6 header, producing a kernel panic. Patched stable releases are confirmed across eight kernel branches; no public exploit or CISA KEV listing exists, and EPSS probability is 0.16% (6th percentile).

Resource leak in the Linux kernel ASoC STI audio driver allows a local authenticated user to exhaust kernel memory by repeatedly loading and unloading the driver, degrading system availability. The vulnerability stems from regmap_field objects allocated during STI audio player initialization never being released on driver removal. With EPSS at 0.17% (7th percentile), no KEV listing, and no public exploit, this is a low-priority maintenance fix rather than an actively weaponizable flaw. Vendor-released patches are available across multiple stable kernel branches.

Write operation hang in the Linux kernel dm-cache subsystem's passthrough mode allows a local user with low privileges to stall I/O indefinitely on affected block devices. The defect lies in `invalidate_remove()`, which configures a remapped bio for submission to the cache origin but discards it without dispatching, leaving write operations permanently pending. No public exploit has been identified at time of analysis; EPSS at 0.18% (8th percentile) and a strictly local attack vector place this firmly in the operational-bug category rather than an active threat.

Data loss in the Linux kernel dm-cache subsystem occurs when LVM's table preload feature is used to switch a writeback cache to passthrough mode while dirty mappings exist. The dirty mapping check was designed assuming table reloads happen only after device suspension (which flushes dirty blocks), but LVM's preload path bypasses this assumption, allowing dirty cache blocks to be silently loaded into passthrough mode where they will never be written back to the origin device. No public exploit code exists; reproduction requires a deliberate sequence of dmsetup and fio operations documented in the CVE description itself. EPSS is 0.18% (7th percentile), consistent with a local, configuration-specific data-loss condition rather than a remotely exploitable flaw.

Memory leak in the Linux kernel dm-cache metadata subsystem can be triggered by local users with low privileges to gradually exhaust kernel memory, causing system availability degradation. The flaw resides in dm_cache_metadata_abort, where a temporary block_manager object allocated before acquiring root_lock is not freed when the lock acquisition fails due to a read-only block manager - a condition reproducible by reloading a dm-cache table during metadata error states. No public exploit code and no CISA KEV listing have been identified; EPSS of 0.18% (8th percentile) confirms very low current exploitation probability.

Incorrect memory access in the Linux kernel's ASoC Qualcomm QDSP6 audio topology driver can trigger a kernel panic on affected Qualcomm Snapdragon hardware when virtual DAPM widgets are processed without a type guard. The flaw, introduced at commit 36ad9bf1d93d66b901342eab9f8ed6c1537655a6, affects kernel branches from 5.16 onward until the respective stable fixes. No active exploitation has been identified (not in CISA KEV) and the EPSS score of 0.17% (7th percentile) reflects negligible real-world exploitation probability; hardware dependency further constrains the affected population.

Operation sequencing flaw in the Linux kernel's tegra194 PCIe endpoint driver causes a Control Backbone (CBB) timeout when PERST# is deasserted twice in succession. During the second deassert cycle, the driver invokes pci_epc_deinit_notify() and dw_pcie_ep_cleanup() - which access DBI register PCIE_MISC_CONTROL_1_OFF at offset 0x8bc - before reset_control_deassert() powers on the PCIe controller core, triggering a hardware bus timeout and denying availability of the PCIe subsystem. With an EPSS of 0.18% (7th percentile), no CISA KEV listing, and hardware-specific scope limited to NVIDIA Tegra194 SoCs, this is a low-probability exploitation target with real-world impact confined to embedded and automotive Linux deployments.

Kernel panic via reachable assertion in the OCFS2 cluster filesystem allows a local, low-privileged user to crash the system by issuing a crafted OCFS2_IOC_GROUP_ADD ioctl. The root cause is that ocfs2_group_add() invokes ocfs2_set_new_buffer_uptodate() on a user-supplied group block number before ocfs2_verify_group_and_input() has validated that number; if the block already exists in the metadata cache, the BUG_ON at uptodate.c:509 fires unconditionally, triggering a kernel oops. No public exploit has been identified and EPSS is 0.18% (7th percentile), but the fix is widely available across maintained stable branches.

Out-of-bounds read in the Linux kernel's IMA (Integrity Measurement Architecture) filesystem subsystem causes a kernel panic during boot on systems with TPM chips advertising hash algorithms unsupported by the kernel. Specifically, when `ima_tpm_chip->allocated_banks[i].crypto_id` is set to the sentinel `HASH_ALGO__LAST` for an unmapped TPM algorithm (demonstrated with TPM_ALG_SHA3_256 = 0x0027), the `create_securityfs_measurement_lists` function dereferences the out-of-range index into `hash_algo_name[]`, triggering a KASAN-detected global-out-of-bounds read and kernel crash. No public exploit has been identified and EPSS is 0.17% (6th percentile), making deliberate exploitation unlikely; the primary risk is inadvertent boot-time denial of service on hardware with qualifying TPM chips.

Deadlock in the Linux kernel's usbhid driver (`hid_post_reset()`) can halt systems connected to composite USB devices that combine HID and block storage or UAS components. When such a device undergoes a reset during block IO error handling, memory allocations using the default GFP_KERNEL flag can trigger block IO reclaim, which deadlocks against the mutex already held by the reset path - producing a kernel hang. No public exploit has been identified, and EPSS of 0.18% (7th percentile) confirms very low exploitation likelihood; the fix replaces GFP_KERNEL with GFP_NOIO across all affected reset callbacks, and patches are available across multiple Linux stable branches.

The Linux kernel's BPF sockmap subsystem deadlocks when a BPF iterator program iterating over AF_UNIX sockets via `bpf_iter_unix_seq_show()` simultaneously attempts to update a sockmap entry during the same execution context. When `lock_sock_fast()` takes the spinlock fast path and holds `slock-AF_UNIX`, any subsequent `sock_map_update_elem()` call within the BPF iterator program spins indefinitely attempting to re-acquire the same spinlock on the same CPU, causing an unrecoverable kernel deadlock and loss of system availability. This is not confirmed actively exploited (not in CISA KEV), no public exploit has been identified, and EPSS at 0.17% (7th percentile) confirms negligible current exploitation interest; the real-world risk is constrained to specialized BPF workloads with specific capability requirements.

Memory leak in the Linux kernel's Renesas i3c master driver causes local denial of service through kernel memory exhaustion. Specifically, the xfer structure allocated by renesas_i3c_alloc_xfer() inside renesas_i3c_i3c_xfers() is never released, allowing a local user with low privileges on affected Renesas SoC hardware to exhaust kernel memory by repeatedly triggering i3c transfers. No public exploit has been identified at time of analysis, and EPSS probability sits at 0.17% (6th percentile), reflecting low real-world exploitation interest.

Uninitialized variable read in the NTFS3 filesystem driver (`ntfs_iomap_begin()`) of the Linux kernel allows a local authenticated user to crash the system by triggering a zero-length run condition that causes the `lcn` (logical cluster number) variable to be consumed before assignment. The flaw affects Linux 7.0 up to 7.0.10 and Linux 7.1 prior to the stable fix commits, with the defect discovered and confirmed by Google syzbot via KMSAN. No public exploit has been identified and EPSS probability is very low (0.17%, 7th percentile); patches are available in Linux 7.0.10 and 7.1.

Kernel availability impact in the Linux NTFS3 filesystem driver allows a local low-privileged user to trigger a WARN_ON(1) in attr_data_get_block_locked() by accessing NTFS volumes containing compressed or sparse attributes with frame-aligned cluster boundaries. The root cause is a missing run-segment load for vcn0 when it resides in a different attribute segment than vcn after cmask rounding, causing run_lookup_entry() to return SPARSE_LCN and fire the kernel warning. No public exploit has been identified and EPSS is 0.15% (5th percentile), confirming this as a low-probability exploitation target despite the confirmed vendor patch.

Missing NUL termination in the Linux kernel's ntfs3 filesystem driver allows a local attacker with filesystem mount privileges to trigger an out-of-bounds memory read, crashing the kernel. The defect in ntfs_fill_super() leaves sbi->volume.label unterminated when a UTF-16 volume label converts to a UTF-8 string that exactly fills the fixed buffer, causing ntfs3_label_show() to read past the buffer boundary via a %s format specifier. No public exploit has been identified at time of analysis and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation interest despite the High availability impact in CVSS.

Unbounded string concatenation in the Linux kernel's Dell WMI BIOS interface driver (dell-wmi-sysman) allows a local low-privileged attacker on Dell hardware to crash the kernel. The populate_enum_data() function bounds each individual firmware-provided string but applies no remaining-space check during cumulative strcat() calls into fixed 512-byte struct members, enabling a buffer overflow that results in complete system availability loss. With an EPSS of 0.17% (7th percentile), no public exploit code, and no CISA KEV listing, this is a low-likelihood but straightforward local denial-of-service on Dell platforms running unpatched kernel versions.

Kernel panic in the SpaceMIT clock controller driver (`clk-spacemit-ccu`) can be triggered during CPU frequency scaling on systems running SpaceMIT RISC-V hardware. The root cause is an inverted boolean condition in `ccu_mix_trigger_fc()` that causes the frequency change trigger to be skipped at the wrong time and fired at the wrong time, crashing the kernel under normal cpufreq governor activity. Exploitation requires only local low-privilege access, but is practically limited to the narrow hardware footprint of SpaceMIT K1-based boards; no public exploit or CISA KEV listing exists, and EPSS is 0.17% (6th percentile).

Kernel panic in the Linux f2fs garbage collector allows a local low-privileged user to crash the system by triggering a VM_BUG_ON_FOLIO assertion when GC attempts to re-read a page already marked uptodate after multiple block relocations. The affected subsystem is f2fs (Flash-Friendly File System); systems using ext4, XFS, or other filesystems are not impacted. EPSS is extremely low (0.17%, 6th percentile) and no active exploitation has been identified, making this a stability/DoS concern primarily relevant to mobile, embedded, and flash-storage Linux deployments.

Data loss in the Linux kernel's f2fs (Flash-Friendly File System) driver exposes files created and synced before any checkpoint has been written to permanent loss on sudden power off. The race condition between fsync on newly created files and concurrent checkpoint operations causes f2fs_need_inode_block_update() to misread prematurely set nat_entry flags (IS_CHECKPOINTED and HAS_LAST_FSYNC), leading fsync to skip the inode block flush it actually requires. No public exploit identified at time of analysis; the EPSS score of 0.16% at the 6th percentile reflects the narrow triggering conditions and local-only attack surface.

Integer truncation in the Linux kernel's EROFS filesystem driver on 32-bit platforms causes logical cluster number (LCN) calculations to overflow at the 4 GiB boundary, resulting in incorrect block addressing and potential kernel-level availability impact. Affected systems are those running 32-bit Linux kernels (where `unsigned long` is 32 bits wide) with EROFS filesystems mounted. No public exploit exists and no active exploitation has been confirmed; EPSS stands at a very low 0.17% (6th percentile), consistent with the niche attack surface of 32-bit deployments.

Kernel panic via skb headroom exhaustion in the Linux kernel's Traffic Control (TC) act_mirred subsystem affects systems using block-cast packet redirection across mixed device types. The root cause is a copy-paste error in tcf_blockcast_redir() where dev_is_mac_header_xmit() is queried against the next device in the iteration (dev) rather than the device currently being transmitted to (dev_prev), causing tcf_mirred_to_dev() to make wrong MAC header push/pull decisions for intermediate devices. In the worst case, skb_push_rcsum is called with an incorrect mac_len, exhausting socket buffer headroom and triggering a kernel panic. No public exploit code has been identified and EPSS is 0.17% at the 6th percentile, consistent with low real-world exploitation interest.

Denial-of-service in the Linux kernel macvlan driver allows local users with network interface management privileges to crash netlink interface dumps by exploiting a missing netlink buffer size reservation for the IFLA_MACVLAN_BC_CUTOFF attribute. When bc_cutoff is set to any value other than the default (1) on a macvlan bridge interface, any subsequent attempt to dump that interface via GETLINK triggers nla_put_s32() to return -EMSGSIZE, fires a WARN_ON in rtnetlink, and prevents the interface from being enumerated. No public exploit tool has been identified and no active exploitation is confirmed; EPSS is 0.17% (6th percentile).

Denial of service in the Linux kernel's netfilter xtables subsystem exposes systems to local kernel panics caused by using inet-specific match extensions (xt_mac, xt_owner, xt_physdev, xt_realm) in incompatible protocol family contexts such as ebtables. The flaw was introduced by commit ab4f21e6fb1c, which broadened these extensions to NFPROTO_UNSPEC, inadvertently permitting their use in Ethernet bridge filtering contexts where IPv4-specific kernel data structures (e.g., dst->tclassid for xt_realm) are undefined or null. No public exploit has been identified and EPSS is 0.18% at the 7th percentile, indicating low adversarial interest despite the ubiquitous deployment footprint of the Linux kernel.

Resource exhaustion in the Linux kernel ksmbd SMB server allows a low-privileged authenticated SMB client to leak kernel file descriptor references by sending repeated SMB2 CREATE requests with a DURABLE_HANDLE_REQUEST_V2 context that produces a CreateGuid hit but a ClientGUID mismatch. Each such request increments the refcount on a ksmbd_file via ksmbd_fp_get() in ksmbd_lookup_fd_cguid() but the mismatch code path never calls the matching release, causing global_ft entries to be pinned indefinitely. Over time this defeats the durable file scavenger and causes long-lived kernel resource leaks that can degrade or deny availability. No public exploit has been identified at time of analysis and EPSS is 0.19% (9th percentile), indicating low opportunistic exploitation probability.

Stack memory disclosure in the Linux kernel RDS/IB subsystem exposes up to 26 bytes of uninitialized kernel stack contents - including kernel text and data pointers - to local unprivileged users via the getsockopt(SOL_RDS, RDS_INFO_IB_CONNECTIONS) interface. The leak enables KASLR bypass on systems where the kernel was built without CONFIG_INIT_STACK_ALL_ZERO=y, making this a useful primitive for chaining into privilege escalation. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS is very low at 0.18% (7th percentile), but the CVE description itself supplies a complete, step-by-step reproduction recipe that reduces practical exploitation complexity to near-trivial for any local user with AF_RDS socket access.

Improper RLIMIT_MEMLOCK accounting in the Linux kernel's vsock/virtio MSG_ZEROCOPY path allows a local low-privileged user to bypass per-process pinned-page limits, enabling unbounded kernel memory pinning that can drive the system toward memory exhaustion. The flaw is confined to the virtio vsock transport and is not remotely exploitable. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), reflecting low exploitation interest; however, a vendor-confirmed fix is available in stable releases.

Resource leak in the Linux kernel fsnotify subsystem causes hung tasks and local denial of service via a race condition in fsnotify_recalc_mask(). A local low-privilege user can trigger concurrent mark addition and removal on a filesystem connector object, causing an inode pointer returned by __fsnotify_recalc_mask() to be silently discarded rather than released via fsnotify_drop_object() - permanently blocking the umount path as fsnotify_sb_delete() waits indefinitely on the leaked reference. No public exploit exists and EPSS is at the 7th percentile, indicating negligible opportunistic exploitation risk.

Uninitialized memory use in the Linux kernel netdevsim subsystem allows a local low-privileged attacker to cause kernel crashes or potentially expose residual kernel heap contents via dummy packet trap operations. The root defect is in `nsim_dev_trap_skb_build`, where `skb_put` allocated space for a `struct iphdr` without zeroing it, leaving uninitialized kernel memory accessible in a dummy `sk_buff`. No public exploit code exists and the vulnerability is not in CISA KEV; EPSS stands at 0.18% (7th percentile), consistent with negligible opportunistic exploitation risk. Vendor-released patches are confirmed across all actively supported stable kernel branches.

Unbounded queue growth in the Linux kernel's netem (Network Emulator) traffic control subsystem allows a local low-privileged user to exhaust kernel memory and trigger a denial of service. The flaw exists because netem_enqueue() enforces queue depth limits using only q->t_len (packets in the internal tfifo), while packets placed into sch->q via the reorder path (__qdisc_enqueue_head) are silently excluded from that count, allowing total queue occupancy to grow beyond sch->limit without bound. No public exploit has been identified and the EPSS score of 0.18% (8th percentile) places this in the lowest exploitation-probability tier; however, the vulnerability affects a wide range of active stable kernel branches and patched versions are available.

Race condition in the Linux kernel PSP network subsystem allows a local low-privileged attacker to crash the kernel through a TOCTOU flaw in device association creation. In `psp_assoc_device_get_locked()`, a device reference acquired under RCU becomes stale before the protecting lock is taken if `psp_dev_unregister()` completes concurrently, leaving the kernel operating on freed or invalid device state. No public exploit has been identified and EPSS stands at 0.17% (6th percentile), reflecting minimal active exploitation risk despite the well-characterized code-level race condition.

Missing CAP_NET_ADMIN enforcement in the Linux kernel PSP (PSP Security Protocol) netlink subsystem allows any local user with low privileges within the same network namespace to invoke the dev-set and key-rotate operations - modifying PSP version configuration and rotating cryptographic key material without authorization. The only access control in place, psp_dev_check_access(), validates only network namespace membership and does not enforce administrative capability. This enables unauthorized disruption of PSP-encrypted network communications and unauthorized modification of in-use cryptographic keying material. No public exploit code has been identified at time of analysis, and EPSS exploitation probability is very low at 0.17% (7th percentile).

Livelock in the Linux kernel's futex requeue-PI subsystem can hang a system when a signal or timeout interrupts a FUTEX_WAIT_REQUEUE_PI operation concurrently with an active FUTEX_CQ_REQUEUE_PI requeue. The race causes a waiting thread (Task A) to block indefinitely on a hash-bucket lock while a requeue thread (Task B) busy-loops retrying the same operation, consuming all available CPU - worst-case on uniprocessor systems where Task A cannot be scheduled at all. No public exploit is identified and EPSS is 0.17% (7th percentile), but the deterministic nature of the livelock on UP or real-time-scheduled hardware makes this a genuine denial-of-service risk; patches are available across six Linux stable branches.

Reference count exhaustion in the Linux kernel's netfilter nft_ct subsystem allows a local low-privileged user to trigger a denial-of-service condition by repeatedly invoking nftables rules that use the ct expect object type. The function nft_ct_expect_obj_eval() allocates a connection tracking expectation and may call nf_ct_expect_related(), but never releases the local reference via nf_ct_expect_put() before returning, causing an unbounded accumulation of unreleased kernel memory references. No public exploit exists and EPSS probability stands at 0.18% (8th percentile), with no CISA KEV listing - consistent with a low real-world exploitation risk despite the High availability impact assigned by CVSS.

Kernel availability impact in the Linux DRM PRIME buffer-sharing subsystem results from a pointer replacement logic error introduced by commit 5e28b7b94408, where the new IDR object pointer fails to overwrite the original handle's pointer at the correct location during the 'change handle' flow. Local users with low privileges holding access to a DRM device node can trigger a kernel WARNING assertion failure in drm_prime_destroy_file_private (drm_prime.c:224) upon file close, destabilizing the system. No public exploit exists and EPSS sits at 0.19% (8th percentile), indicating low real-world exploitation probability; the vendor patch is available in Linux stable trees at 7.0.10 and 6.18.33.

Out-of-bounds descriptor read in the Linux kernel ALSA USB MIDI 2.0 subsystem allows a physically proximate or low-privileged local attacker to crash the kernel by presenting a malformed USB audio device with crafted MIDI 2.0 endpoint descriptors. The USB MIDI 2.0 endpoint parser validates bLength against bNumGrpTrmBlock but omits validation against remaining bytes in the endpoint-extra scan, allowing baAssoGrpTrmBlkID[] reads to advance past the descriptor buffer boundary. No public exploit is identified; EPSS stands at 0.18% (7th percentile), consistent with narrow, hardware-dependent attack surface and no active exploitation.

Out-of-bounds read in the Linux kernel's ALSA USB MIDI subsystem (`snd_usbmidi_get_ms_info()`) allows a local attacker to trigger a kernel panic and denial of service by presenting a crafted USB MIDI device with a malformed endpoint descriptor `bLength` field. The descriptor walker fails to verify that `bLength` stays within the remaining endpoint-extra scan bytes, leaving flexible-array reads of `baAssocJackID[]` potentially unbounded by the actual buffer limit. No public exploit is identified at time of analysis, and EPSS places exploitation probability at 0.18% (8th percentile), consistent with the local attack vector.

Infinite LRU list traversal in the Linux kernel's drm/ttm memory management subsystem allows a local low-privileged user to cause a kernel hang or denial of service on GPU-equipped systems. The flaw resides in ttm_bo_shrink(), where the bulk-move removal step was executed before confirming successful buffer object backup, leaving the LRU list in a corrupted state that loops indefinitely on backup failure. Notably, the 'Information Disclosure' tag in source intelligence conflicts with the CVSS C:N metric - the actual impact is availability only. No public exploit code has been identified, and EPSS exploitation probability is very low at 0.16% (6th percentile).

Plaintext credential storage in Jenkins FitNesse Plugin 1.36 and earlier exposes job-level passwords to any user holding Extended Read permission or with direct access to the Jenkins controller filesystem via job config.xml files. The flaw (CWE-256) means credentials configured within FitNesse jobs are persisted unobfuscated on disk and retrievable through the Jenkins UI without requiring elevated administrative rights. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating low opportunistic exploitation activity, though the impact is meaningful in environments where FitNesse jobs store sensitive credentials.

Jenkins Bitbucket Push and Pull Request Plugin versions 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for all outbound Bearer token authenticated requests to configured Bitbucket Server endpoints, creating a man-in-the-middle exposure. Any attacker positioned to intercept network traffic on the path between the Jenkins controller and the Bitbucket Server can capture the Bearer token and subsequently authenticate directly to the Bitbucket Server API. No public exploit is identified at time of analysis, and SSVC rates exploitation as none with partial technical impact; however, the token capture risk is non-trivial for deployments routing Jenkins traffic over untrusted or shared network segments.

Jenkins Job Configuration History Plugin version 1356.ve360da_6c523a_ and earlier exposes encrypted secret values to any Jenkins user holding Extended Read permission by failing to apply Jenkins' standard secret redaction when rendering historical job and agent configurations. Encrypted credential values that Jenkins would normally mask are displayed in full within the plugin's history view, potentially enabling offline analysis of those values. No public exploit or active exploitation has been identified; SSVC rates this as non-automatable with partial technical impact.

The Pipeline Snippet Generator in Jenkins Pipeline: Groovy Plugin versions through 4331.v9d06ed4658ff fails to enforce type restrictions, enabling authenticated low-privilege users to instantiate arbitrary Java/Groovy types - including those governing job and system configuration - far beyond the intended scope of Pipeline step generation. Confirmed by the Jenkins security team under SECURITY-3677, this flaw could allow an internal attacker to access or manipulate configuration objects outside their authorized permission set. No public exploit code has been identified and CISA SSVC rates exploitation as none with no automatable path, placing this as a credible but lower-urgency remediation target.

Out-of-bounds read in ImageMagick's ConnectedComponentsImage() function allows local attackers to trigger access violations by supplying malformed connected-components artifact definitions via the CLI, leading to denial of service or potential arbitrary code execution. All ImageMagick releases before 7.1.2-19 are affected, as are Magick.NET NuGet packages before 14.12.0. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the RCE and information-disclosure tags warrant attention in environments that process untrusted image inputs through automated pipelines.

Unauthenticated app enumeration in Capgo before 12.128.2 allows remote attackers to determine whether specific app_ids exist across all tenants by querying the exposed exist_app_v2 RPC endpoint without credentials. The root cause is a PostgreSQL SECURITY DEFINER function that executes with elevated owner privileges, bypassing row-level security policies and enabling cross-tenant information disclosure via the PostgREST API at POST /rest/v1/rpc/exist_app_v2. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis, though the attack requires no authentication and trivial HTTP tooling.

Flowise versions up to and including 3.0.12 hash passwords using bcrypt with a default cost factor of 5 rounds - yielding only 32 iterations versus the OWASP-recommended minimum of 1,024 at 10 rounds - making stored password hashes approximately 30 times faster to crack with modern GPU hardware. All deployments where the PASSWORD_SALT_HASH_ROUNDS environment variable has not been manually overridden to 10 or higher are affected, which represents the majority of real-world installs since defaults predominate. In a database breach scenario, an attacker who obtains the hash table can leverage GPU-accelerated tools to recover plaintext passwords at roughly 300,000 attempts per second versus ~10,000 at the recommended work factor; no public exploit identified at time of analysis.

Unauthorized file attribute modification in the Linux kernel's ksmbd SMB server allows authenticated SMB clients to invoke FSCTL_SET_SPARSE and alter a file's sparse xattr without required permissions, bypassing both share-level and per-handle access controls. Two distinct authorization gaps exist: clients on read-only shares can issue the control code because fsctl_set_sparse() omits the KSMBD_TREE_CONN_FLAG_WRITABLE check that other FSCTL write operations enforce, and clients on writable shares with insufficient handle rights (lacking FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES) can modify the attribute because per-handle checks are entirely absent. No active exploitation is confirmed - the vulnerability is absent from CISA KEV and carries an EPSS of 0.22% (12th percentile) - but the exposure surface is any network-reachable ksmbd deployment serving untrusted SMB clients.

Kernel stack memory disclosure in the Linux TUN driver exposes 14 bytes of uninitialized stack data to unprivileged local users on every read of a non-tunnel packet. The flaw affects Linux systems where a local user can open a TUN device and issue the TUNSETVNETHDRSZ ioctl to set the vnet header size to 24 bytes. No public exploit or active exploitation has been identified; EPSS is 0.15% (5th percentile), consistent with a local-only information disclosure requiring deliberate TUN device configuration.

Stack information disclosure in the Linux kernel's tap/macvtap driver exposes 8 bytes of uninitialized kernel stack contents to local users via the SIOCGIFHWADDR ioctl, leaking kernel .text and direct-map pointers that defeat KASLR. The affected code path in tap_ioctl() copies a 16-byte sockaddr_storage to userspace while netif_get_mac_address() initializes only 8 bytes (sa_family plus 6-byte Ethernet address), leaving the trailing 8 bytes unread. No public exploit is identified at time of analysis and EPSS sits at 0.15% (5th percentile), but KASLR bypass primitives of this type are routinely chained with local privilege-escalation exploits to gain kernel code-execution. NOTE: The provided CVSS vector (C:N/I:N/A:H) appears to misclassify this vulnerability - confidentiality is the impacted property, not availability; the assessed vector below corrects this.

CPU stall vulnerability in the Linux kernel jitterentropy subsystem allows local low-privileged users to trigger prolonged non-preemptible spinlock holds by spawning concurrent entropy requests through jent_kcapi_random(), which holds a spinlock across expensive SHA3 conditioning and jitter collection. Systems running kernel versions from approximately 4.2 through pre-fix stable branches face entropy starvation and CPU busy-wait degradation under parallel getrandom() load. No public exploit identified at time of analysis; EPSS is 0.16% at the 5th percentile and no CISA KEV listing applies, making this a low-urgency, operator-pace patch for most deployments.

Race condition in the Linux kernel's System V IPC shared memory subsystem allows a local low-privileged attacker to crash the kernel. The `shm_destroy_orphaned()` cleanup path evaluates whether an orphaned segment is safe to destroy by checking `shm_nattch` without holding `shm_perm.lock`, while the attach/detach paths update that counter independently of `shm_ids(ns).rwsem`, creating a window where a still-attached segment is erroneously destroyed. The EPSS score is 0.17% (6th percentile) and no KEV listing or public exploit exists, placing this firmly in the routine-patching tier rather than emergency response.

Availability disruption in the Linux kernel's AF_UNIX socket subsystem allows a local low-privileged user to trigger an unhandled code path by issuing a SIOCATMARK ioctl on non-stream (SOCK_DGRAM or SOCK_SEQPACKET) AF_UNIX sockets, which the kernel incorrectly permits to proceed into receive-queue inspection logic intended only for SOCK_STREAM. The flaw stems from a logic inconsistency: while SOCK_DGRAM and SOCK_SEQPACKET already reject MSG_OOB in sendmsg()/recvmsg(), the SIOCATMARK ioctl handler lacked the corresponding guard, creating an exploitable divergence. No public exploit or CISA KEV listing exists; EPSS at 0.16% (5th percentile) reflects a very low real-world exploitation probability.

Stale gateway pointer in the Linux kernel's batman-adv mesh networking subsystem causes availability failures during mesh teardown and recreation. The batman-adv gateway cleanup function `batadv_gw_node_free()` frees gateway list entries without clearing `bat_priv->gw.curr_gw`, leaving a dangling reference that persists across cleanup and breaks subsequent mesh recreation attempts. No public exploit exists and EPSS sits at 0.16% (6th percentile), indicating negligible opportunistic exploitation interest at time of analysis.

Stack exhaustion in the Linux kernel batman-adv mesh networking subsystem allows an attacker on the same batman-adv mesh to crash the kernel by sending matryoshka-nested BATADV_UNICAST_FRAG packets. The reassembled payload's packet type is not validated before re-processing, enabling unbounded recursion in batadv_batman_skb_recv() that exhausts kernel stack and causes a hard system crash. No active exploitation is recorded in CISA KEV and EPSS sits at 0.18% (7th percentile), making this a targeted DoS risk limited to environments running batman-adv mesh networking.

Insufficient REST API authorization in the Site Kit by Google WordPress plugin before version 1.176.0 permits users with dashboard sharing access - such as those granted the Editor role - to write to a site-wide settings endpoint that should be restricted to administrators. The integrity impact is confined to plugin-level configuration, but the flaw is significant because dashboard sharing is commonly granted to non-admin contributors on multi-author sites. A publicly available proof-of-concept exists per WPScan; exploitation probability remains very low (EPSS 0.13%, 3rd percentile) and the vulnerability is not listed in the CISA KEV catalog.

Unauthenticated mass PII harvesting is possible on any WordPress site running the WhatsOrder - Instant Checkout for WooCommerce plugin (all versions through 1.0.1) because the plugin writes customer invoice HTML files to a publicly accessible directory with no access restrictions. The `yapacdev_generate_order_pdf` function deposits invoices under `wp-content/uploads/whatsorder_invoices/` without generating an `.htaccess` deny rule or `index.php` guard, and because WooCommerce uses predictable sequential order IDs, any remote attacker can enumerate and download every customer invoice with no authentication. Exposed data includes full name, email, phone number, billing address, itemized order contents with pricing, applied coupon codes, shipping method, and order total. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.

Authenticated information disclosure in the 24liveblog WordPress plugin (versions ≤ 2.2) exposes third-party API credentials - including OAuth access tokens, refresh tokens, account UIDs, and usernames - to any contributor-level WordPress user who opens the block editor. The plugin's lb24_block_enqueue_scripts() function, hooked to enqueue_block_editor_assets, retrieves administrator-configured integration secrets from the WordPress options table and renders them into the page as a JavaScript global object (lb24BlockData) for all non-administrator users, where they are readable via basic browser source inspection. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, but exploitation is trivially simple for any user holding a WordPress contributor account.

Unauthenticated information disclosure in the Devs Accounting WordPress plugin (all versions through 1.2.0) exposes private financial account records to any internet-connected attacker. The REST API endpoint /devs-accounting/v1/get-account/<id> was registered with a permission_callback that unconditionally returns true, entirely bypassing WordPress authorization. By sequentially enumerating integer account IDs, an unauthenticated attacker can harvest account names, bank names, and opening balances for every financial account stored in the plugin. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the trivial attack complexity makes opportunistic automation highly likely.

Out-of-bounds heap read and integer underflow in libslirp's TCP urgent data handler (sosendoob) exposes gigabytes of host process heap memory to a privileged guest VM attacker. All libslirp releases before v4.9.2, as embedded in hypervisors such as QEMU, are affected when guest workloads hold root or CAP_NET_RAW privileges. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the cross-VM-boundary scope change (S:C) and high confidentiality impact make this a material risk in multi-tenant or shared virtualization environments.

Broken GCM integrity in Caliptra Core Runtime Firmware 2.0.0-2.1.0 allows an adjacent, low-privileged attacker to silently tamper with ciphertext produced by the streaming AES-256-GCM API when called with empty AAD. The root defect - a missing save of the hardware GHASH accumulator state after the first streaming update call - causes the final authentication tag to exclude the first batch of processed ciphertext, nullifying the integrity guarantee of authenticated encryption for that block. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Incorrect privilege assignment in Fortra File Integrity Monitoring (FIM) versions prior to 9.4.0 causes the `tetool import` command to assign elevated or incorrect effective permissions to newly created users when FIM is actively running during import. The flaw is compounded when the import operation also creates or modifies roles or role-permission relationships, meaning users may silently receive access levels beyond what was configured. No public exploit has been identified at time of analysis, and the CVSS score of 4.9 (Medium) reflects the high-privilege prerequisite that limits realistic exposure to administrative misuse or insider threat scenarios.

Per-property @JsonIgnoreProperties filtering in jackson-databind is silently bypassed when the same property also carries @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES), enabling unauthenticated network attackers (per CVSS AV:N/PR:N) to write to fields the application explicitly excluded from deserialization. The flaw spans versions from 2.8.0 through the 2.18.x, 2.19-2.21.x, and 3.1.x release lines and constitutes a mass-assignment integrity risk wherever ignored fields guard sensitive state such as privilege or role attributes. No public exploit tool or CISA KEV listing has been identified at time of analysis; vendor-released patches (2.18.9, 2.21.5, 3.1.4) were published 2026-06-04.

OAuth token persistence in NocoDB allows an attacker who previously obtained a user's OAuth credentials to maintain unauthorized account access even after the victim performs a password change, reset, or recovery - the exact security actions taken to revoke attacker access. All NocoDB versions up to 2026.05.0 (npm package: nocodb) are affected due to `revokeAllOAuthTokensByUser` being implemented as an empty stub in the users service, meaning no OAuth or refresh tokens were ever actually invalidated by any of the three password security flows. No public exploit has been identified at time of analysis, and a vendor-released patch is available in 2026.05.1.

Heap out-of-bounds read in GStreamer's gst-plugins-bad H.264 parser allows an attacker to crash a media application or leak a single byte of heap memory by tricking a victim into opening a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units. Affected systems span Red Hat Enterprise Linux versions 6 through 10 where gst-plugins-bad is installed. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; the narrow 1-byte read, required user interaction, and local attack vector substantially limit real-world exploitation impact.

Out-of-bounds read in the GStreamer gst-plugins-bad H.266/VVC parser allows a remote attacker to leak up to 8 bytes of application memory by delivering a crafted video file with a manipulated aspect ratio indicator value. Affected platforms include Red Hat Enterprise Linux 8, 9, and 10 wherever gst-plugins-bad processes H.266/VVC content. No public exploit code or active exploitation has been identified at time of analysis; the limited read window and user-interaction requirement constrain practical impact, but the network-reachable vector and zero-authentication requirement lower the delivery barrier.

Credential exposure in the Ansible keyring_info module (plugins/modules/keyring_info.py) causes master passwords, SSH key passphrases, and service credentials retrieved from OS-native keystores to be emitted as plaintext in task output, registered variables, and persistent log backends. Any local user with access to Ansible playbook output - including AWX/Tower job logs, Redis or JSON fact caches, and debug task output - can read credentials in full. A proof-of-concept demonstrating plaintext passphrase capture from Ansible output exists, though no confirmed active exploitation (CISA KEV) has been observed. Affected deployments span RHEL 8, 9, and 10 per Red Hat CPE data.

Cleartext credential persistence in foreman-mcp-server, a component of Red Hat Satellite 6, exposes session identifiers and authentication tokens through two independent logging paths. The INFO-level logger unconditionally records session identifiers (which function as authentication credentials) in plaintext, while a separate debug-mode logger incompletely sanitizes HTTP request headers, allowing Authorization tokens and API keys to persist in container logs. Any environment forwarding container logs to a centralized SIEM or log aggregation platform materially expands the attack surface beyond local disk access. No public exploit identified at time of analysis, and the CVE does not appear in CISA KEV.

Insecure Direct Object Reference in FOSSBilling's support ticket creation workflow allows authenticated clients on versions 0.6.21 through 0.7.2 to link tickets to orders owned by other clients by manipulating the rel_id parameter. The ticketCreateForClient() method omits ownership verification for non-upgrade ticket relations, enabling cross-client order association. While no automated harm occurs, staff can be deceived into acting on the wrong client's order - such as processing unauthorised cancellation or upgrade requests - with minimal order ID disclosure as a secondary confidentiality concern. No public exploit is identified at time of analysis; the issue is patched in version 0.8.0.

Acrobat Reader versions 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier are affected by an out-of-bounds read vulnerability that could. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

GnuPG's gpgsm component through version 2.5.20 improperly validates AES-GCM authentication tag length during CMS parsing, accepting a 4-byte ICV where the cryptographic standard mandates 12 bytes. This validation failure means gpgsm will process CMS-formatted messages with a truncated integrity check value, undermining the authentication guarantee that AES-GCM is specifically designed to provide. No public exploit has been identified at time of analysis; the low CVSS score of 2.9 reflects constrained attack conditions, though the related CVE-2026-34182 warrants cross-referencing as it may share the same code path.

Unauthenticated organization team enumeration in Gogs exposes team IDs, names, descriptions, and permission levels (read/write/admin/owner) to any network-accessible caller without credentials. All versions prior to 0.14.3 are affected - the `GET /api/v1/orgs/:orgname/teams` endpoint was placed in a route group missing the `reqToken()` middleware, meaning the `orgAssignment(true)` middleware loads the org object but enforces no authentication. A publicly available proof-of-concept demonstrates exploitation via a single unauthenticated `curl` command. No KEV listing is present, but the low attack complexity and zero authentication requirement make this a meaningful reconnaissance aid for follow-on attacks against Gogs installations.

Password-reset tokens in Gogs self-hosted Git service (versions before 0.14.3) remain valid for the full account-activation lifetime - up to 3 hours by default - regardless of the administrator-configured `RESET_PASSWORD_CODE_LIVES` setting, because `GenerateActivateCode()` hardcodes `conf.Auth.ActivateCodeLives` into the token at generation time. An attacker who obtains an intercepted reset token can exploit it far beyond the intended expiry window to perform full account takeover, exposing all private repositories and source code. No KEV listing at time of analysis, but publicly available exploit code exists within the GitHub Security Advisory GHSA-5c3f-6486-3g7g.

Memory disclosure in GNU SASL's NTLM client implementation allows a malicious or man-in-the-middle server to extract portions of client process memory by delivering a crafted undersized challenge to the `_gsasl_ntlm_client_step` function. All GNU SASL versions before 2.2.4 are affected, with the fix confirmed in the 2.2.4 release and a Debian security advisory issued downstream. No active exploitation has been identified; the high attack complexity required to position a malicious NTLM server tempers the already-low CVSS 3.7 rating.

Uncontrolled Search Path Element (DLL hijacking) in ABB Control Builder A and 800xA for Advant Master enables a local low-privileged attacker to achieve high-integrity code execution on industrial engineering workstations. Affected versions span Control Builder A through 1.4/4 and 800xA for Advant Master through 6.2.0-1, covering multiple release branches of ABB's flagship OT automation suite. No public exploit or CISA KEV listing is identified at time of analysis, limiting immediate mass-exploitation risk, though OT environments running these ICS platforms warrant targeted patching prioritization given integrity-impact severity.

Symlink following in NanoClaw's agent-to-agent file forwarding exposes arbitrary host-readable files to container-controlled agents. All releases before 2.1.17 are affected; the `forwardAttachedFiles` function validated attachment filenames with `isSafeAttachmentName` but called `fs.copyFileSync` without first resolving symlinks or confirming the resolved path remained inside the agent's outbox directory. A low-privileged agent can craft a symlink with a safe-looking filename, point it at any host file readable by the NanoClaw process, and receive its contents forwarded as a message attachment. No public exploit is identified at time of analysis, though the VulnCheck advisory and GitHub PR diff provide sufficient detail for a technically capable attacker to reproduce exploitation.

Heap out-of-bounds read in dnsmasq's find_soa() function allows a remote attacker controlling a DNS zone to leak up to 10 bytes of stale heap memory by serving a crafted NXDOMAIN response. The flaw exists because extract_name() is invoked with extrabytes=0 when parsing NS section records, skipping the mandatory boundary check for the 10-byte fixed-length DNS record trailer fields. Confirmed affected platforms include Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4; no public exploit or CISA KEV listing has been identified at time of analysis.

Memory exhaustion in ImageMagick's TXT file coder (coders/txt.c) leaks heap allocations each time a crafted TXT file carrying a texture attribute is processed and GetTypeMetrics subsequently fails. Affected are ImageMagick before 7.1.2-15 and 6.9.13-40, and transitively Magick.NET NuGet packages before 14.10.3. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the deterministic failure path makes repeated triggering straightforward in any service that accepts and processes user-supplied TXT files through ImageMagick.