Information Disclosure

UI spoofing in Google Chrome's Media component prior to version 148.0.7778.96 enables remote attackers to deceive users via a specially crafted HTML page that abuses inappropriate media rendering behavior to misrepresent browser interface elements. The CVSS vector (PR:N/UI:R/S:U) indicates unauthenticated remote exploitation is possible but requires the victim to visit a malicious page, with limited confidentiality impact. SSVC classifies exploitation as none and automatable as no; EPSS at 0.06% (18th percentile) corroborates low exploitation likelihood, and no public exploit or active exploitation has been identified.

Cross-origin data leakage in Google Chrome's Preload subsystem (prior to 148.0.7778.96) allows a remote attacker to infer cross-origin information by luring a victim to a crafted HTML page. The flaw is a protection mechanism failure (CWE-693) in Chrome's speculative resource-fetching logic, breaking expected Same-Origin Policy isolation. No public exploit code exists and CISA has not listed this in KEV; an EPSS of 0.03% (9th percentile) and an SSVC exploitation rating of 'none' confirm negligible real-world exploitation interest at time of analysis.

Cross-origin data leakage in Google Chrome's FedCM (Federated Credential Management) component prior to version 148.0.7778.96 allows remote attackers to bypass same-origin isolation and read data from cross-origin contexts. Exploitation requires a victim to visit a crafted HTML page, constraining mass automation. EPSS is 0.02% (7th percentile), SSVC records no active exploitation, and CISA KEV has not listed this vulnerability - signals that consistently place this at lower real-world priority despite its network accessibility.

Cross-origin data leakage in Google Chrome's Search feature prior to version 148.0.7778.96 allows a remote unauthenticated attacker to read data from a different origin by luring a user to a crafted HTML page. The flaw stems from insufficient policy enforcement in the Search component (CWE-693), bypassing intended cross-origin isolation protections. No public exploit code has been identified and CISA has not added this to the KEV catalog; with an EPSS of 0.03%, real-world exploitation probability is very low at time of analysis.

UI spoofing in Google Chrome's DevTools subsystem (all versions prior to 148.0.7778.96) enables a crafted browser extension to misrepresent critical UI elements to the victim, exploiting an inappropriate implementation classified as CWE-451. The attack requires social engineering the user into installing a malicious extension, after which the extension manipulates DevTools rendering to deceive the user about browser or page state. No active exploitation is confirmed (absent from CISA KEV), EPSS is negligible at 0.01% (3rd percentile), and SSVC rates exploitation as none with partial technical impact, placing this firmly in the low-priority tier despite the Medium CVSS score.

UI spoofing in Google Chrome's DevTools prior to version 148.0.7778.96 enables a crafted extension to misrepresent critical interface information to users, exploitable only after an attacker convinces a target to install the malicious extension. Exploitation requires meaningful social engineering effort and no public exploit code or active exploitation has been identified at time of analysis - SSVC rates exploitation as none and EPSS places this at only the 3rd percentile. The Chrome security team rated this Low severity internally, consistent with the multi-step prerequisite chain and limited post-exploitation impact.

Cross-origin data leakage in Google Chrome's DevTools prior to version 148.0.7778.96 allows a network-positioned attacker to exfiltrate cross-origin data by convincing a user to install a malicious Chrome Extension that exploits insufficient policy enforcement. The attacker must socially engineer the target into installing the malicious extension, after which the extension can bypass cross-origin isolation policies through DevTools APIs. No active exploitation has been confirmed (CISA KEV absent), and EPSS places this in the 4th percentile, indicating minimal real-world exploitation pressure.

UI spoofing via malicious network traffic is possible in Google Chrome's TabGroups component in all versions prior to 148.0.7778.96, exploitable by unauthenticated remote attackers who can induce user interaction. The root cause is insufficient input validation (CWE-20) in the TabGroups feature, allowing crafted network traffic to manipulate browser UI elements and deceive users about page origin or content. No public exploit exists and EPSS sits at 0.05% (17th percentile), consistent with SSVC's 'exploitation: none' and the vendor's own 'Low' Chromium severity rating - real-world risk is low despite the broad attack surface of a ubiquitous browser.

V8 JavaScript engine information disclosure in Google Chrome prior to 148.0.7778.96 exposes potentially sensitive process memory content to remote attackers via specially crafted HTML pages. Exploitation requires user interaction - specifically visiting a malicious page - and impact is confined to partial confidentiality loss with no integrity or availability consequence. No public exploits have been identified, EPSS sits at 0.03% (7th percentile), and CISA SSVC rates exploitation as none, collectively indicating low urgency relative to the broad attack surface.

UI spoofing in Google Chrome's Dialog component prior to version 148.0.7778.96 allows a remote attacker who has already compromised the renderer process to deceive users with falsified browser UI elements via a crafted HTML page. The vulnerability stems from insufficient validation of untrusted input (CWE-20) in Dialog handling, enabling manipulation of how dialog boxes are rendered. No public exploit or active exploitation has been identified; EPSS is 0.05% and SSVC classifies exploitation as none, placing real-world urgency well below what the moderate CVSS score alone might suggest.

UI spoofing in Google Chrome's SSL input validation layer affects all versions prior to 148.0.7778.96, requiring an attacker to have already compromised the renderer process before the flaw can be leveraged via a crafted HTML page. This is a chained, second-stage capability - not a standalone initial-access vector - rated Low severity by the Chromium security team and scoring 4.2 CVSS. No public exploit code exists, EPSS sits at 0.07% (21st percentile), and CISA SSVC confirms no active exploitation, placing this firmly in the lower tier of Chrome's vulnerability landscape.

Omnibox (URL bar) spoofing in Google Chrome on Android prior to 148.0.7778.96 allows a remote attacker who has already compromised the renderer process to display falsified URL content via a crafted HTML page exploiting insufficient input validation in the Payments subsystem. No public exploit identified at time of analysis; EPSS stands at 0.07% (21st percentile) and SSVC records exploitation status as none, consistent with the high attack complexity imposed by the mandatory renderer pre-compromise prerequisite. The primary impact is user deception - a victim may believe they are interacting with a legitimate payment origin while the Omnibox displays attacker-controlled content.

Arbitrary read/write in Google Chrome's DataTransfer component prior to version 148.0.7778.96 is exploitable by a remote attacker who has already compromised the renderer process, using a specially crafted HTML page to bypass input validation. This is a chained post-exploitation primitive rather than an initial-access vector - the renderer must already be under attacker control before this flaw becomes useful. SSVC rates exploitation as none and technical impact as partial; EPSS at 0.03% (9th percentile) and the absence of any CISA KEV listing indicate no observed active exploitation at time of analysis.

Cross-origin data leakage in Google Chrome's Autofill component (all versions prior to 148.0.7778.96) enables a remote attacker to extract sensitive Autofill data across web origins when a victim visits a specially crafted HTML page. The flaw is rooted in insufficient origin policy enforcement (CWE-346) within the Autofill subsystem, allowing data bound to one origin to be read by a different origin in violation of the browser's same-origin policy. No active exploitation has been confirmed - the vulnerability is absent from CISA KEV, EPSS sits at a negligible 0.01%, and SSVC classifies exploitation as none - making this a patch-and-monitor priority rather than an emergency response.

Cross-origin data leakage in Google Chrome's Dawn WebGPU subsystem (versions prior to 148.0.7778.96) enables remote attackers to read memory beyond buffer boundaries and expose sensitive cross-origin data when a user visits a crafted HTML page. The vulnerability (CWE-125 out-of-bounds read) affects the Dawn graphics abstraction layer, Chrome's implementation of the WebGPU API, and was rated Medium severity by the Chromium security team. No active exploitation has been identified; EPSS at 0.02% (6th percentile) and SSVC exploitation status of 'none' both confirm low community-assessed real-world risk at time of analysis.

Uninitialized memory use in Chrome's WebCodecs component exposes potentially sensitive process memory contents to remote attackers via crafted HTML pages. All Chrome versions prior to 148.0.7778.96 are affected, with the flaw requiring only that a victim navigate to an attacker-controlled page. No active exploitation has been identified; EPSS sits at the 7th percentile and SSVC rates exploitation as none, placing this in the moderate-priority tier despite the high confidentiality impact signaled by CVSS.

Cross-origin data leakage in Google Chrome's Media subsystem prior to version 148.0.7778.96 can be exploited by a remote attacker through a specially crafted HTML page, causing partial disclosure of sensitive content from another origin. The flaw is rooted in CWE-346 (Origin Validation Error), meaning Chrome's Media component fails to properly enforce the Same-Origin Policy during media processing. No active exploitation is confirmed in CISA KEV, and EPSS places this at 0.02% (6th percentile), indicating low real-world exploitation probability; patch availability from the vendor makes this a routine patch-cycle priority rather than an emergency.

Cross-origin data leakage in Google Chrome's GPU process (versions prior to 148.0.7778.96) is exploitable by an attacker who has already compromised the renderer process, allowing them to read uninitialized GPU memory and exfiltrate data belonging to other web origins via a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer compromise, substantially limiting real-world exploitation to multi-stage attack chains. No public exploit code exists and no active exploitation has been confirmed; EPSS is 0.03%, and CISA SSVC assesses exploitation as none at time of analysis.

Google Chrome versions prior to 148.0.7778.96 contain insufficient input validation in DevTools that allows remote attackers with a compromised renderer process to leak cross-origin data through crafted HTML pages. The vulnerability requires user interaction and a pre-compromised renderer, limiting real-world exploitation but presenting a significant attack chaining vector for multi-stage exploits. Patch available from vendor.

Insufficient input validation in the FileSystem API in Google Chrome prior to version 148.0.7778.96 allows a remote attacker with a compromised renderer process to perform arbitrary file read and write operations through a malicious HTML page. The vulnerability requires prior renderer compromise and user interaction with a crafted page, limiting its attack surface despite network-accessible vectors. Vendor has released a patched version.

Insufficient policy enforcement in DirectSockets API in Google Chrome prior to version 148.0.7778.96 allows remote attackers to perform arbitrary read and write operations through a crafted malicious Chrome extension. The vulnerability requires user interaction (extension installation) but affects the core security model of the browser's socket access control, exposing local network resources to unauthorized access by untrusted extensions.

Google Chrome prior to version 148.0.7778.96 contains insufficient validation of untrusted input in the Permissions system, allowing attackers on the local network segment to leak cross-origin data through malicious network traffic. The vulnerability requires network adjacency but no user interaction or authentication, affecting confidentiality with medium Chromium severity. Patch is available from Google.

Information disclosure in Google Chrome prior to 148.0.7778.96 allows remote attackers who have compromised the renderer process to extract potentially sensitive data from process memory through a race condition triggered by a crafted HTML page. The vulnerability requires renderer process compromise and user interaction but results in high confidentiality impact with no integrity or availability consequences. Chromium security team rates this as Medium severity; no active exploitation has been publicly confirmed.

Uninitialized memory use in the GPU component of Google Chrome prior to version 148.0.7778.96 allows remote attackers who have compromised the renderer process to extract potentially sensitive information from process memory through a malicious HTML page. The vulnerability requires renderer process compromise as a precondition and user interaction to trigger, but once achieved, enables confidentiality breach with no code execution or denial of service impact. Vendor-released patch available in Chrome 148.0.7778.96.

Google Chrome prior to version 148.0.7778.96 contains a race condition in shared storage that allows a remote attacker with a compromised renderer process to leak cross-origin data through a crafted HTML page. The vulnerability requires user interaction and renderer compromise but can disclose sensitive information across origin boundaries, classified as medium severity by Chromium security team.

Out-of-bounds read and write in the GFX component of Google Chrome prior to version 148.0.7778.96 allows remote attackers to perform arbitrary memory read and write operations through malicious network traffic. The vulnerability requires user interaction (clicking a link or visiting a malicious page) but does not require authentication. Chromium rated the security severity as Medium; CVSS 5.4 reflects moderate impact (confidentiality and integrity compromise without availability loss). No active exploitation confirmed in CISA KEV at time of analysis.

Out-of-bounds read in Skia graphics library within Google Chrome prior to version 148.0.7778.96 allows remote attackers who have compromised the renderer process to leak cross-origin data through a crafted Chrome Extension. The vulnerability requires user interaction and relies on renderer compromise, limiting real-world exploitation despite the information disclosure impact. Chromium classified this as Medium severity; no active exploitation has been publicly confirmed.

UI spoofing via insufficient input validation in Google Chrome prior to 148.0.7778.96 allows a remote attacker who has already compromised the renderer process to craft malicious HTML pages that deceive users about the legitimate UI elements. The attack requires renderer process compromise as a prerequisite and user interaction with the crafted page, limiting real-world applicability to multi-stage attacks. Chromium assessed this as medium severity; no public exploit code or active exploitation has been identified.

Insufficient input validation in ANGLE (Almost Native Graphics Layer Engine) in Google Chrome prior to version 148.0.7778.96 allows remote attackers who have compromised the renderer process to perform arbitrary memory read and write operations via a crafted HTML page. The vulnerability requires renderer process compromise as a precondition, user interaction, and high attack complexity, making it a post-exploitation vector rather than a primary attack surface. Patch is available from vendor.

Integer overflow in ANGLE graphics library in Google Chrome prior to version 148.0.7778.96 allows remote attackers to leak cross-origin data by delivering a crafted HTML page that triggers the vulnerability. The vulnerability requires user interaction (visiting a malicious webpage) but can bypass same-origin policy protections, exposing sensitive data from other domains. No public exploit code or active exploitation has been confirmed at analysis time.

Out-of-bounds memory read in Google Chrome's V8 JavaScript engine allows remote attackers to disclose sensitive information via a crafted HTML page. Affects Chrome versions prior to 148.0.7778.96. The vulnerability requires user interaction (opening a malicious page) but operates over the network with no authentication required. While classified as medium severity by Chromium, the impact is limited to information disclosure without code execution capability.

UI spoofing vulnerability in Google Chrome prior to 148.0.7778.96 allows remote attackers to deceive users through crafted HTML pages that manipulate the speech interface, potentially disclosing sensitive information or causing denial of service. The vulnerability requires user interaction (clicking or interacting with the malicious page) and affects the speech component's visual presentation. Chromium severity is rated Medium; no active exploitation has been publicly confirmed.

Out-of-bounds read in WebCodecs video processing in Google Chrome versions prior to 148.0.7778.96 allows remote attackers to leak sensitive memory contents via a crafted video file. The vulnerability requires user interaction to open a malicious video, but affects all users regardless of authentication. Chrome 148.0.7778.96 and later versions patch this information disclosure vulnerability, which could expose cryptographic keys, session tokens, or other sensitive data resident in adjacent memory.

UI spoofing in Google Chrome on iOS prior to version 148.0.7778.96 allows remote attackers to deceive users through crafted HTML pages that manipulate the browser interface. The vulnerability stems from insufficient validation of untrusted input and has a CVSS score of 5.4 (medium severity). Exploitation requires user interaction with a malicious webpage but can result in information disclosure and denial of service on affected iOS devices.

Uninitialized memory use in Dawn (GPU abstraction layer) in Google Chrome prior to version 148.0.7778.96 allows remote attackers to read potentially sensitive information from process memory by opening a crafted HTML page. The vulnerability requires user interaction (clicking/viewing the malicious page) but no authentication, and has a high confidentiality impact. Chromium security team classified this as high severity; no public exploit code or active exploitation has been confirmed at time of analysis.

Out-of-bounds memory read in Google Chrome's font handling allows remote attackers to leak sensitive information via a crafted HTML page when users visit a malicious website. Chrome versions prior to 148.0.7778.96 are affected. The vulnerability requires user interaction (clicking a link or visiting a page) but occurs over the network without authentication. Information disclosure risk is limited (CVSS C:L) with no impact on integrity or availability, but the Chromium security severity designation of High indicates concern about potential information leakage in real-world exploitation.

HCL BigFix Service Management (SM) leaks sensitive information through improper error handling in its reporting module. Unauthenticated remote attackers can trigger unhandled exceptions by submitting invalid or out-of-range values to the consumer_company parameter during report-viewing requests, exposing application details in error messages. CVSS score is moderate (5.3) but reflects low confidentiality impact with no integrity or availability impact.

PyLoad-ng WebUI discloses internal Python stack traces and source file paths to unauthenticated remote attackers via a global exception handler on the `/web/<path:filename>` endpoint. An attacker can request non-existent templates or craft malformed requests to trigger server exceptions and extract implementation details in HTTP responses without authentication. This information disclosure facilitates reconnaissance for follow-on attacks but does not enable direct code execution or data theft.

Authenticated remote attackers with low privileges can read arbitrary files via insufficient access controls in the web-based management interface of Cisco IoT Field Network Director. Exploitation requires valid login credentials and submission of crafted input through the management UI; successful attacks result in unauthorized file disclosure but do not enable modification or system disruption. No public exploit code or active exploitation has been identified at time of analysis.

Unauthenticated remote attackers can enumerate valid user accounts on Cisco Identity Services Engine through an identity management API endpoint by analyzing differentiated error responses to crafted requests. The vulnerability enables account enumeration with no authentication required, network-accessible attack surface, and low complexity exploitation, resulting in partial information disclosure of valid usernames on affected systems.

FlowiseAI Flowise up to version 3.0.12 allows remote unauthenticated information disclosure through manipulation of the account verification endpoint. An attacker can exploit improper input validation in the verify function of the account service to extract sensitive information over the network. Publicly available exploit code exists, and the vendor has recommended upgrading to address this issue.

HCL BigFix Service Management exposes server banner information containing software versions and system details accessible to adjacent network attackers through a non-default interaction, enabling reconnaissance for targeted attacks against known vulnerabilities. The vulnerability requires adjacent network access and user interaction, resulting in limited confidentiality impact with no integrity or availability consequences. CVSS 2.6 indicates low severity, though information disclosure can facilitate secondary attacks.

HCL BigFix Service Management (SM) contains an insecure or outdated WSGI server implementation that exposes the application to known security weaknesses. Authenticated local attackers with high complexity conditions can achieve limited information disclosure and integrity compromise (CVSS 4.6). No active exploitation or public POC identified at time of analysis.

Credential exposure in HCL BigFix Service Management (SM) version 23 leaves credentials insufficiently protected for a brief window while the application communicates with an internal backend service, which an attacker who can capture that traffic could reuse to authenticate to the backend. The flaw was self-reported by HCL and carries a CVSS 7.5 (confidentiality-only) rating; there is no public exploit identified at time of analysis and EPSS is negligible (0.03%, 8th percentile). CISA's SSVC framing rates exploitation as none and the issue as not automatable, indicating low immediate urgency.

HCL BigFix Service Management fails to sanitize spreadsheet data (CSV, XLS, XLSX) before export, allowing authenticated users to inject formulas or malicious content that executes when recipients open the files in spreadsheet applications. An attacker with legitimate service management access can craft payloads in data fields that, when exported and opened by targeted users, may exfiltrate information or trigger unintended actions-though modern Excel versions mitigate this with untrusted content warnings. CVSS 4.6 reflects moderate risk limited to authenticated users and required user interaction (opening the file).

HCL BigFix Service Management fails to strip EXIF metadata from uploaded images, allowing authenticated users to inadvertently expose sensitive location information and other metadata embedded in image files. The vulnerability requires user interaction (image upload and viewing) but poses a direct confidentiality risk to organizations handling location-sensitive imagery through the application.

HCL BigFix Service Management contains unauthenticated-accessible directories that are not linked in the user interface but can be reached through direct URL access, enabling authenticated users with low privileges to disclose sensitive information or access restricted functionality. The vulnerability requires authenticated access, user interaction, and higher-than-average attack complexity; active exploitation status has not been confirmed.

HCL BigFix Service Management lacks secure X-Content-Type-Options HTTP headers, allowing browsers to perform MIME-type sniffing that could lead to malicious content being interpreted as executable code. The vulnerability requires local authentication, high attack complexity, and user interaction, affecting confidentiality and availability with a CVSS score of 3.7. No active exploitation or public exploit code is documented at time of analysis.

HCL BigFix Service Management (SM) contains a cross-site request forgery (CSRF) vulnerability that allows authenticated users with sufficient privileges to perform unauthorized actions or access sensitive data through malicious web requests. The vulnerability requires user interaction (such as clicking a malicious link) and affects confidentiality but not integrity or availability, resulting in a CVSS score of 2.6. No active exploitation has been publicly reported.

Information disclosure in FlowiseAI Flowise up to version 3.0.12 allows remote attackers to extract sensitive data through the Login function in the API Response Handler component. The vulnerability requires high attack complexity and is difficult to exploit, but successful exploitation results in confidentiality impact without authentication requirements. No public confirmation of active exploitation has been identified at time of analysis.

HCL BigFix RunBookAI 11.2 contains weak input handling in a text input component that may disclose sensitive information to high-privilege users. The vulnerability stems from continued reliance on less-secure input validation mechanisms, creating operational risk through potential misconfiguration. While the CVSS score is low (2.7) due to requirement for high-privilege access and limited confidentiality impact, the information disclosure channel could expose credentials or operational data to authenticated administrators.

Memory exhaustion denial-of-service in the Linux kernel's ti_fpc202 misc driver allows a local low-privileged user to degrade system availability through a memory leak introduced in the probe function. The root cause is improper release of device tree child node references during driver initialization when iterating over nodes, classified as CWE-401 (Missing Release of Memory after Effective Lifetime). No active exploitation is confirmed - no public exploit identified at time of analysis - and the extremely low EPSS score of 0.02% (4th percentile) reflects the niche hardware dependency and local-only attack surface.

Silent error suppression in the Linux kernel's NTFS3 filesystem driver allows a local authenticated user to trigger inode inconsistency by causing attr_set_size() to fail during file truncation. Affected systems running NTFS3-mounted volumes may experience filesystem corruption or denial of service without any visible error signal to the kernel. No active exploitation has been identified (EPSS 0.02%, not in CISA KEV), and vendor-released patches are available in Linux 7.0 and 6.19.6.

Resource leak in the Linux kernel's mtk-smi (MediaTek System Memory Interface) driver allows a local, low-privileged attacker on MediaTek SoC-based systems to cause a denial of service by exhausting kernel device references. The driver fails to call put_device() on the SMI device reference obtained during common probe when late probe failure (e.g., -EPROBE_DEFER) or driver unbind occurs, leaving dangling references that accumulate over repeated cycles. No public exploit identified at time of analysis and EPSS at 0.02% (7th percentile) indicates very low exploitation probability; patches are available across multiple stable branches.

Device reference leak in the Linux kernel's MediaTek SMI (mtk-smi) memory driver can cause resource exhaustion and denial of service on affected MediaTek SoC-based systems. The flaw exists in the larb (Local Arbiter) probe path, where a reference acquired during SMI device lookup is never released when late probe failure occurs (e.g., probe deferral) or when the driver is unbound - leaving the kernel device struct's reference count permanently inflated. With EPSS at 0.02% (7th percentile), no KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is very low and narrowly scoped to hardware running MediaTek SoCs.

Memory allocation underflow in the Linux kernel ASoC SOF (Sound Open Firmware) ipc4-topology module allows local authenticated users to trigger a denial of service via bytes control handling that fails to account for the full data structure size. The vulnerability affects kernel versions prior to specific stable releases (6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0) where the allocation size calculation omits the sof_ipc4_control_data structure, potentially causing memory exhaustion or kernel crash when processing audio topology configuration.

Out-of-bounds read in the Linux kernel's APEI/GHES subsystem crashes affected systems when processing malformed or oversized CPER (Common Platform Error Record) data supplied by non-conformant firmware. The `ghes_new()` function enforces a maximum size check against `GHES_ESTATUS_MAX_SIZE` (64KB), but the underlying buffer is allocated using the actual page count from the BIOS CPER table location, which may be smaller; when firmware supplies error data exceeding the allocated buffer, subsequent CPER printing via `cper_estatus_print_section()` triggers a kernel OOPS (level-3 page fault) and system crash. No active exploitation is confirmed: EPSS is 0.02% at the 7th percentile, and this vulnerability is absent from the CISA KEV catalog.

Snapshot data integrity corruption in the Linux kernel's CephFS driver allows a local authenticated user to silently corrupt immutable snapshot content by performing a fallocate hole-punch operation on a mounted CephFS volume. The `ceph_zero_partial_object()` function omits the RADOS snapshot context (`snapc`) when issuing OSD zeroing writes, causing those writes to propagate into snapshot objects rather than being scoped to the live file layer only. Affected environments are limited to those running CephFS mounts with active snapshots; no active exploitation is confirmed (absent from CISA KEV), and EPSS sits at 0.02%, though a developer-supplied reproducer effectively functions as proof-of-concept.

Reference count leak in the Linux kernel's mtk-mdp (MediaTek Media Data Path) driver allows a local low-privileged user on MediaTek SoC hardware to cause incremental resource exhaustion. The missing platform_device_put() call in mtk_mdp_remove() means each driver removal cycle permanently leaks one reference to the VPU platform device, preventing kernel memory reclamation. No public exploit exists and EPSS sits at 0.02% (7th percentile); patches are confirmed across eight stable kernel branches.

Memory exhaustion in the Linux kernel's drm/atmel-hlcdc DRM driver gradually degrades availability on systems using Atmel/Microchip HLCDC display controller hardware. The atomic_destroy_state callback incorrectly releases only framebuffer references while omitting the call to __drm_atomic_helper_plane_destroy_state(), causing drm_crtc_commit objects (64 bytes each) to accumulate in kernel slab memory across every DRM atomic commit operation. Impact is limited to local denial of service through eventual OOM on embedded platforms using SAMA5 SoCs; no public exploit identified at time of analysis and EPSS is 0.02% (7th percentile), reflecting negligible exploitation interest.

Kernel crash in the Linux hfsplus filesystem driver results from a VFS enforcement change (commit af153bb63a33) that requires all inodes to carry a standard file-type mode bit, which hfsplus special inodes (catalog file, extents overflow file, attributes file, etc.) historically did not. Any local user able to trigger access to those special inodes on a mounted HFS+ volume can cause a kernel panic, producing a high-availability denial-of-service. No public exploit code exists and EPSS sits at 0.02% (7th percentile), reflecting low opportunistic exploitation likelihood, but the bug is deterministically reproducible against any unpatched kernel configured with hfsplus support.

Division by zero in the Linux kernel's rtw89 WiFi driver can crash the kernel when beacon interval is zero during beacon tracking. Discovered via fuzz testing, this local vulnerability (AV:L/PR:L) affects systems running any Linux kernel from initial commit through stable branches prior to 6.18.16, 6.19.6, and 7.0. An authenticated local attacker can trigger a kernel panic, resulting in a complete denial of service on the affected host. No public exploit exists and no active exploitation has been observed.

Out-of-bounds read in the Linux kernel's EFI/CPER ARM processor error record handler allows firmware-supplied records with a crafted or malformed `section_length` value to cause the kernel to read far beyond the allocated CPER buffer, potentially leaking contents of firmware-mapped memory regions to system logs. Affected systems are ARM-based machines with UEFI/APEI/GHES support running any Linux kernel prior to the patched stable releases (5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0). No public exploit has been identified, EPSS is 0.02% (7th percentile), and the vulnerability is absent from CISA KEV.

Refcount leak in the Linux kernel's fbdev Open Firmware display timing subsystem (of_get_display_timings()) affects kernel versions from 3.9 through multiple stable branches, allowing a local low-privileged user to trigger resource exhaustion that degrades system availability. The flaw lies in error-path handling where of_parse_phandle() increments a device_node refcount into native_mode, but the goto target 'entryfail' at lines 184 and 192 never calls of_node_put(native_mode), leaving the refcount permanently elevated. No active exploitation has been identified - EPSS of 0.02% (7th percentile) and absence from CISA KEV confirm this as a maintenance-class kernel fix rather than an emergency threat.

Recursive glock deadlock in the Linux kernel GFS2 cluster filesystem driver allows a locally authenticated user to cause a kernel thread hang and denial of service. In gfs2_fiemap(), the inode glock is held while calling iomap_fiemap(); if the userspace fiemap output buffer is memory-mapped to the same GFS2 inode, a page fault during buffer writes triggers a second attempt to acquire the already-held glock, producing a deadlock. No public exploit or CISA KEV listing exists; EPSS is 0.02% (7th percentile), consistent with the niche GFS2 deployment footprint and the specific trigger conditions required.

Spectre-BHB (Branch History Buffer) software mitigation was absent in the Linux kernel arm64 subsystem for systems running the HiSilicon TSV110 processor, leaving those systems exposed to branch prediction side-channel attacks capable of leaking sensitive kernel memory contents across privilege boundaries. The root cause was the kernel lacking the TSV110 MIDR (Main ID Register) entry in its processor-specific mitigation table, meaning the software workaround was never applied on that hardware. No public exploit has been identified at time of analysis, and EPSS probability sits at a low 0.02% (7th percentile), though the real-world confidentiality risk on Huawei/HiSilicon arm64 deployments is meaningful given the class of attack.

NULL pointer dereference in the Linux kernel's fsl-imx8mq-usb PHY driver crashes systems built on NXP i.MX8MQ SoC when the driver is unloaded or the device is removed. The driver's probe function omits the required platform_set_drvdata() call, leaving the driver data pointer unset; when remove() subsequently dereferences it, a kernel panic results. Exploitation is limited to local, low-privilege users on specialized embedded hardware; EPSS at 0.02% (4th percentile) and absence from CISA KEV confirm no public exploit or in-the-wild exploitation at time of analysis.

Denial of service in Linux kernel media cx88 driver allows local authenticated attackers to exhaust system resources by triggering a missing DMA unmapping in the snd_cx88_hw_params() error path. The vulnerability causes resource leaks when audio hardware parameter initialization fails, potentially rendering the audio subsystem unavailable. CVSS 5.5 reflects local attack vector with low complexity; EPSS 0.02% indicates minimal real-world exploitation probability despite vendor-released patches across multiple kernel versions.

A use-after-free condition in the libertas USB wireless driver allows local attackers with user privileges to cause a denial of service by triggering a kernel warning and potential crash through rapid firmware loading or repeated usb_tx_block() calls while a USB request is still active. The vulnerability stems from insufficient synchronization of USB URB submissions, enabling concurrent requests on the same URB without enforcing completion of prior transmissions.

Denial of service via kernel warning in MPTCP path manager occurs when combining endpoint removal with fullmesh and flag-setting operations through netlink in the Linux kernel. A local attacker with low privileges can trigger a WARNING in net/mptcp/pm_kernel.c:1074 by sending a crafted sequence of netlink commands, causing the system to emit a kernel warning and potentially become unstable. No known public exploit code exists, but the low CVSS (5.5) and minimal EPSS (0.03%) indicate this is a local DoS with limited real-world impact.

Kernel panic via SError interrupt in Linux kernel media driver (chips-media wave5) when device enters autosuspend during video decoding operations. Local authenticated attackers can trigger a denial of service by queuing buffers to the wave5 video decoder while autosuspend timeout occurs, causing the CPU to access suspended hardware and generate an unrecoverable asynchronous SError, crashing the system. No privilege escalation or code execution; impact limited to availability.

Memory leak in the tw9906 media driver's probe function allows local authenticated attackers to cause denial of service through memory exhaustion. The vulnerability occurs in tw9906_probe() when an error path fails to free memory allocated by v4l2_ctrl_handler_init() and v4l2_ctrl_new_std(), potentially leading to kernel memory depletion on repeated device probe attempts. Vendor-released patches are available across multiple stable kernel branches.

Denial of service in Linux kernel KCM (kernel connection multiplexer) subsystem when processing messages with zero-fragment skbs in frag_list after partial sendmsg failures. A local authenticated attacker can trigger a kernel warning and potentially crash the system by sending a malformed message that fails during data copy, leaving an empty skb in the fragment list. The vulnerability requires local access and low-level socket manipulation, affecting systems running vulnerable Linux kernel versions prior to patching.

Memory leak in the Linux kernel's TI K3 SoC info driver (soc/ti/k3-socinfo) fails to release an allocated mmio regmap, causing denial of service through resource exhaustion on probe failures and driver unbind. Local attackers with low privileges can trigger probe deferral or driver unbind to exhaust kernel memory, affecting systems running vulnerable Linux kernel versions. The vulnerability has a low EPSS score (0.02%) but enables practical local DoS against systems where low-privilege users can control driver lifecycle.

Linux kernel x86 architecture fails to validate IMA measurement list memory bounds during kexec boot with restricted memory parameters, causing kernel panic when the carried-over IMA buffer falls outside truncated RAM. Authenticated local users with kexec privileges can trigger a denial of service. The fix adds a sanity check to validate the previous kernel's IMA kexec buffer against actual memory bounds before restoration, aligning x86 behavior with other architectures.

Availability failure in the Linux kernel's iris media driver for Qualcomm SM8750 (Snapdragon 8 Elite) causes video codec sessions to crash during bring-up due to two missing platform data entries. The absent get_vpu_buffer_size field prevents internal VPU buffer allocation, while the missing max_core_mbps entry causes incomplete capability checks and v4l2-compliance failures for the encoder. No public exploit exists and EPSS is 0.02% (4th percentile), consistent with the niche hardware dependency; this is a functional defect with availability impact rather than a traditional exploitable security weakness.

Denial of service in the Linux kernel team network driver arises when a slave interface is moved to a different network namespace and then deleted, causing team_port_del() to fire a spurious NETDEV_CHANGEMTU event during slave unregistration that prompts inetdev_init() to acquire an unreleased reference on the device. This reference leak prevents the device from completing unregistration, hanging the kernel with 'unregister_netdevice: waiting for [device] to become free.' The bug is confined to local authenticated access and no public exploit exists (EPSS 0.02%, 4th percentile); however, the Linux kernel's ubiquitous deployment makes patch application broadly relevant. Upstream stable fixes are confirmed available in Linux 6.18.16, 6.19.6, and 7.0.

Memory leak in the Linux kernel's radio-keene USB FM transmitter driver (radio-keene.c) leaves a v4l2 control handler unfreed when either v4l2_device_register() or video_register_device() fails during device probe. Affected kernel versions range from the commit introducing the flaw (1bf20c3a0c616f44359c573b533d06bae960ee45) through multiple stable branches, with fixed versions confirmed across 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0. No public exploit has been identified at time of analysis, and EPSS at 0.02% (7th percentile) confirms negligible real-world exploitation probability.

Kernel panic in the Linux kernel's chips-media wave5 VPU driver stems from an incorrect device cleanup order during module removal or autosuspend, allowing a powered-down hardware state to be accessed by a still-running worker thread. Systems with chips-media wave5 VPU hardware running video encoding workloads are vulnerable to a local denial-of-service via synchronous external abort (bus error). No public exploit exists and no active exploitation is confirmed; EPSS is 0.02% (5th percentile), reflecting the niche hardware requirement.

Denial-of-service through an invalid spinlock context in the Linux kernel's sh_tmu (SH Timer Unit) clocksource/clockevent driver triggers a lockdep violation and system hang on PREEMPT_RT-enabled builds running on Renesas SH/ARM platforms. The driver invokes pm_runtime_*() and clk_*() functions while holding a raw spinlock required by the clockevent framework; on PREEMPT_RT kernels, these PM and clock management calls acquire regular spinlocks that can sleep, making the combined locking sequence illegal. No public exploit code exists and exploitation probability is negligible (EPSS 0.02%), but the impact on affected hardware is a full system availability loss. Patches are confirmed available across all active stable branches.

Memory leak in the Linux kernel's staging rtl8723bs Wi-Fi driver degrades system availability for hosts running affected kernel versions with Realtek RTL8723BS hardware. The flaw occurs in the BSS scanning code path where cfg80211_inform_bss_frame() can return NULL on failure, but the previously allocated 'buf' buffer is not released, causing unbounded kernel memory loss over time. With EPSS at 0.02% (7th percentile), no CISA KEV listing, and no public exploit code, this is a low-urgency memory management defect patched across all active stable kernel branches.

Memory leak in the Linux kernel io_uring zero-copy receive (zcrx) subsystem allows a local low-privileged attacker to exhaust kernel memory via repeated DMA mapping failures on PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA systems, causing denial of service. The root cause is a sgtable (scatter-gather table) resource that is initialized but never freed when io_populate_area_dma() fails, because the error path's cleanup guard (!is_mapped) incorrectly skips deallocation. No public exploit exists and EPSS is 0.02% (4th percentile), reflecting the narrow hardware-specific trigger condition.

URB (USB Request Block) leak in the Linux kernel pvrusb2 media driver causes a denial-of-service condition on systems with Hauppauge WinTV-PVR USB2 capture devices. The pvr2_send_request_ex() function fails to unlink and await the write URB before returning on read URB submission failure, leaving the URB in an active state; subsequent driver calls trigger a 'URB submitted while active' kernel warning that destabilizes the USB subsystem. No public exploit exists and EPSS is 0.02% (7th percentile), but vendor-released patches are available across all major stable kernel branches.

Uninitialized read bytes in the Linux kernel IPMI IPMB driver expose systems to a local denial-of-service condition. The IPMB subsystem does not use i2c reads by design, but when an i2c read is triggered through the event handler, an uninitialized value is returned from the underlying bus driver, potentially causing kernel instability or a crash on affected server hardware. No public exploit exists and EPSS is 0.02% (7th percentile), indicating low real-world exploitation probability despite patches being available across multiple stable branches.

Denial of service in the Linux kernel AMD IOMMU subsystem allows a local low-privileged user to crash or stall IOMMU completion waits on systems with AMD hardware and IOMMU enabled. The root cause is a race condition where cmd_sem_val was incremented outside the IOMMU spinlock, permitting CMD_COMPL_WAIT commands to queue out of order and breaking the ordering invariant in wait_on_sem() under concurrent TLB invalidations. No public exploit or active exploitation has been identified; EPSS stands at 0.02% (4th percentile), reflecting negligible real-world exploitation probability at time of analysis.

Improper error-path cleanup in the Linux kernel's cpsw_new (TI Common Platform Switch) network driver can trigger an attempt to unregister a net device that was never successfully registered, causing a kernel crash or panic and resulting in local denial of service. Systems running affected kernel versions on Texas Instruments SoC hardware - including BeagleBone and AM335x/AM437x platforms - are at risk when the CPSW driver encounters a failure during the first MAC's netdev registration. No public exploit identified at time of analysis and EPSS exploitation probability is extremely low at 0.02% (4th percentile), consistent with its hardware-specific, error-path nature.

Memory leak in Linux kernel tw9903 media driver probe function allows local authenticated attackers to cause denial of service through repeated device initialization failures. The v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() allocations are not freed in one error path of tw9903_probe(), enabling exhaustion of kernel memory. CVSS 5.5 (local, low complexity, requires low privileges). EPSS score of 0.02% indicates minimal exploitation probability.

Local denial of service in Linux kernel ring-buffer tracing code allows authenticated local users to crash the system by triggering invalid memory access through malformed event length fields. The vulnerability exists in rb_read_data_buffer(), which validates possibly corrupted ring buffers at boot but fails to verify event lengths are within acceptable ranges before calculating buffer offsets. EPSS exploitation probability is very low at 0.02%, and no public exploit code or active exploitation has been identified.

Denial of service in Linux kernel minix filesystem implementation allows local authenticated users to crash the system via crafted minix superblock structures due to missing validation of s_log_zone_size and other superblock fields in the minix_check_superblock() function.

Kernel lockup in the Qualcomm Q6ASM (Audio Stream Manager) driver allows a local low-privileged user to trigger a system hang by racing audio stream closure against in-flight DSP responses. Affected Linux kernel versions spanning from the initial commit (1da177e4c3f4) up to the stable fixes in 6.19.6 and 7.0 are vulnerable. A prior partial fix (commit a354f030dbce) attempted to suppress post-close DSP response handling but failed to prevent processing, leaving the lockup reachable. No public exploit code exists and no active exploitation has been confirmed - EPSS sits at 0.02% (5th percentile), consistent with a niche hardware-dependent kernel DoS.