Information Disclosure

Memory leak in Linux kernel fbdev vt8500lcdfb driver allows local authenticated users to cause denial of service via unfreed DMA-allocated buffer on error path. The vulnerability exists in the framebuffer initialization code where dma_alloc_coherent() allocation for fbi->fb.screen_buffer is not properly freed if an error occurs during probe, leading to memory exhaustion on repeated device initialization attempts. Local privilege required; no remote or unauthenticated attack vector.

Denial of service in Linux kernel APEI/GHES ARM processor error handling allows local authenticated attackers to trigger kernel oops by crafting malformed ARM Processor Error records with incomplete or oversized section data, causing out-of-bounds memory dereference. CVSS 5.5 (local, low complexity, authenticated, availability impact only) with EPSS 0.02% indicates low real-world exploitation probability despite public patch availability.

Missing input validation in the Linux kernel's amdgpu DRM driver allows a local user with low privileges to trigger GPU faults by supplying invalid user queue sizes. The driver fails to enforce two hardware requirements - that queue sizes be a power-of-two and at least AMDGPU_GPU_PAGE_SIZE - enabling crafted queue configurations that cause availability loss (GPU faults or unexpected GPU subsystem behavior). No public exploit is identified at time of analysis, and EPSS at 0.02% (4th percentile) reflects very low real-world exploitation probability. Patches are available in kernel stable branches 6.18.16, 6.19.6, and 7.0.

Reference count leak in the Linux kernel's NFS server daemon (nfsd) subsystem allows a local low-privileged user on a system running NFSv4 to exhaust kernel file object resources, resulting in denial of service. The vulnerability lies in nfsd_get_dir_deleg(), which fails to release the nfs4_file reference before early return paths. No public exploit exists and the EPSS score of 0.02% (5th percentile) reflects very low real-world exploitation probability; there is no CISA KEV listing.

Resource reference leak in the Linux kernel's dm-multipath (dm mpath) subsystem allows a local low-privileged user to trigger an availability impact against systems using multipath SCSI storage. Specifically, the `parse_path()` function fails to call `dm_put_device()` when `scsi_dh_attached_handler_name()` returns -ENOMEM during path parsing, leaving a dangling device reference that is never released. No public exploit exists and EPSS probability is 0.02%, placing this firmly in the low-exploitation-likelihood tier, but enterprise Linux systems with SAN-backed multipath storage are in scope. Vendor-released patches are available in Linux 6.19.6 and the 7.0 stable branch.

System hang vulnerability in the AMD DCN35 display engine driver allows a local low-privilege user to trigger an unrecoverable kernel hang by initiating a TMDS display disable event on affected AMD hardware. The hang arises because the PHY FSM transition from TX_EN to PLL_ON is non-atomic, leaving the Output Timing Generator stuck and blocking DCHVM IOMMU invalidation acknowledgments - a condition that can arise under normal display reconfiguration. No public exploit code exists and EPSS is 0.02% (5th percentile), indicating no meaningful exploitation interest; the CISA KEV does not list this vulnerability.

Error handling flaws in the Linux kernel's V4L2 async media subsystem allow a local low-privileged attacker to crash the kernel, causing a denial of service. Two bugs exist in the post-match processing path: an async connection is double-removed from the sub-device's connection list when v4l2_async_match_notify() fails mid-way, and the connection's sd pointer is dereferenced in the unbind error path before it is initialized - a NULL pointer dereference. No public exploit or active exploitation has been identified; EPSS at 0.02% (5th percentile) confirms very low current exploitation probability and this vulnerability is not listed in CISA KEV.

Kernel worker crash (BUG_ON oops) in the Linux kernel Ceph filesystem driver occurs when fscrypt encryption is enabled and GFP_NOWAIT bounce buffer allocations fail during writeback batch processing. A local user with write access to an fscrypt-encrypted Ceph mount can trigger this under memory pressure, causing the writeback loop to pass a stale page array pointer to ceph_allocate_page_array(), firing its BUG_ON assertion and crashing the worker. No public exploit is identified; EPSS of 0.02% (4th percentile) and absence from CISA KEV confirm negligible real-world exploitation activity.

Resource leak in the Linux kernel cx25821 media driver allows a local low-privileged user on a system with CX25821 video capture hardware to degrade system availability by exhausting kernel I/O memory regions. The flaw exists in cx25821_dev_setup() where a call to release_mem_region() is missing on the ioremap() failure path, leaving a memory region claimed by cx25821_get_resources() permanently unreleased. No public exploit code exists and EPSS sits at 0.02% (7th percentile), confirming this as a low-exploitation-risk maintenance fix rather than an active threat; patches are available across all active stable kernel branches.

Division by zero in the Linux kernel's CCS (Camera Control Set) media driver can be triggered by a local authenticated user, causing a kernel crash and denial of service. The flaw exists in scaler configuration logic where the MAX_M calculation divides by the MIN_X_OUTPUT_SIZE limit register value without first validating it is non-zero. Affected systems must have a CCS-compatible camera device attached and the ccs media driver loaded; no public exploit or active exploitation (CISA KEV) has been identified, and EPSS sits at 0.02%, reflecting very low real-world exploitation probability.

GPIO sysfs teardown in the Linux kernel fails to drop the final sysfs attribute reference when a GPIO controller is unbound while pins remain exported, leaving stale /sys/class/gpio entries and causing a kernel availability impact on affected systems. Kernels from commit 1cd53df733c21ae0d344a2dec941a3e2a06fefd9 through the fix are affected, with patched stable releases at 6.18.16, 6.19.6, and 7.0; Red Hat and SUSE downstream kernels incorporating the affected range are similarly impacted. No public exploit exists and the EPSS score is 0.02% (4th percentile), making this primarily a stability concern for embedded Linux deployments actively using the GPIO sysfs interface.

Runtime PM reference leak in the Linux kernel's Intel IPU6 PCI driver causes a local denial-of-service condition on systems with compatible Intel Image Processing Unit hardware. Low-privileged local users on affected kernel versions can trigger unbalanced runtime power management reference counts when the ipu6_pci_probe() function traverses error paths without calling pm_runtime_put_sync(), leaving the device in a corrupted power management state. No public exploit exists and the EPSS score of 0.02% (5th percentile) reflects negligible real-world exploitation interest; no active exploitation has been confirmed.

Improper error handling in the Linux kernel's io_uring zero-copy receive (zcrx) subsystem causes a premature release of the zcrx context when closing a queue, leading to a local denial-of-service (kernel crash). Affected kernels include Linux 6.15 series; the root cause is that queue closure does not guarantee immediate termination of all associated page pools, and the code incorrectly released the zcrx ctx directly rather than delegating cleanup to the reference-counting mechanism. No public exploit exists and no active exploitation has been identified at time of analysis; EPSS is 0.02% (5th percentile), consistent with the low real-world exploitation risk.

Integer underflow in the Linux kernel's EFI/CPER firmware error logging function (cper_print_fw_err) allows local authenticated attackers to trigger denial of service via memory dump of unmapped regions, disclose kernel memory contents, or cause system crash when processing malformed EFI firmware error records with invalid offsets. The vulnerability stems from insufficient validation of error record length before subtracting an offset, causing integer wraparound that permits dumping of arbitrary kernel memory regions.

Kernel panic occurs in Linux kernel USB gadget driver (dwc3) when vbus_draw function executes PMIC power-supply APIs from atomic context, causing sleep operations in non-sleepable context. The vulnerability affects Linux kernel versions prior to 5.13 and various stable series (6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0) and is resolved by deferring vbus_draw operations to workqueue context. Local authenticated users with privilege level PR:L can trigger denial of service by invoking affected USB gadget functionality, with EPSS exploitation probability at 0.02% percentile indicating extremely low practical risk despite moderate CVSS severity.

Denial of service via kernel panic in the DRM buddy allocator when rounded allocation sizes exceed available memory. Local authenticated attackers can trigger a BUG_ON() crash by requesting contiguous or large-aligned GPU memory allocations that, after power-of-two or block-size rounding, exceed the total VRAM size. Example: a 9GB contiguous allocation request on 10GB VRAM rounds to 16GB, causing immediate kernel panic. No authentication bypass or privilege escalation; requires local access and appropriate user permissions to invoke DRM allocator.

Denial of service via incomplete xattr cleanup in the Linux kernel OCFS2 filesystem causes memory corruption when processing reflinked files with extended attributes. A local user with standard privileges can trigger this vulnerability through crafted xattr operations, resulting in system crashes or data integrity issues. The flaw affects Linux kernel versions from 2.6.32 through multiple recent releases (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 6.19), with vendor-released patches available for supported stable branches.

Resource leak in Linux kernel xfrm (IPsec) subsystem allows local authenticated users to exhaust kernel memory and trigger denial of service by preventing proper cleanup of IPsec hardware offload device references during network device unregistration. The vulnerability affects XFRM state management when IPsec hardware offloading is configured, particularly when the hardware offload capability (NETIF_F_HW_ESP) is disabled after state creation but before device removal.

Resource leak in the Linux kernel's hwmon nct7363 hardware monitor driver allows a local, low-privileged user to cause a denial-of-service condition through repeated reference exhaustion. The vulnerability resides in nct7363_present_pwm_fanin, which calls of_parse_phandle_with_args() but never releases the acquired device node reference via of_node_put(), violating the kernel's reference-counting contract for device tree nodes. Exploitation requires physical or local authenticated access to a system equipped with NCT7363 hardware and the driver loaded; no public exploit exists and no active exploitation is confirmed (EPSS: 0.02%, 4th percentile).

Use-after-free in the Linux kernel's md/bitmap subsystem triggers a General Protection Fault (GPF) in write_page() during MD array resize operations, resulting in a kernel crash and denial of service. Affected are systems using Software RAID (md) with bitmap support across a wide range of stable kernel series from 3.5 through 7.0, with patches backported to 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, and 6.19.6. No public exploit code exists and the EPSS score of 0.02% (7th percentile) indicates very low exploitation probability; however, Red Hat has issued a formal advisory (RHSA-2026:19568), confirming vendor acknowledgment.

Memory leak in the Linux kernel's tegra-video media driver causes local denial-of-service on NVIDIA Tegra-based systems. The `__tegra_channel_try_format()` function fails to free a V4L2 subdev state object on two error paths after `v4l2_subdev_call()` fails, leaking kernel memory on each invocation. A local authenticated attacker with access to a Tegra video capture device can repeatedly trigger the error paths to exhaust kernel memory, degrading or crashing the system. No public exploit exists and EPSS is 0.02% (7th percentile), consistent with a niche, hardware-specific availability issue.

Hard-lock denial of service in the Linux kernel's Intel VT-d IOMMU subsystem affects systems running PCIe passthrough configurations (QEMU, DPDK) without scalable mode enabled. When a PCIe endpoint's link drops - through surprise removal, link fault, or process termination - the kernel enters an indefinite wait inside qi_submit_sync() attempting an ATS invalidation that the disconnected device can never acknowledge. The existing partial fix (commit 4fc82cd907ac) guards this path only when Intel IOMMU scalable mode is active, leaving non-scalable-mode deployments unprotected. No public exploit identified at time of analysis and EPSS is 0.02%, but the impact is a complete host freeze with no recovery path short of power cycling.

NULL pointer dereferences in the Linux kernel's Apple SMC (System Management Controller) MFD driver expose Apple-hardware systems to local denial-of-service. The struct apple_smc mutex was never initialized in apple_smc_probe(), causing occasional crashes when sub-device probe() functions call apple_smc_read() and attempt to acquire the uninitialized lock. Only local, low-privileged users on Apple hardware running an affected kernel can trigger this condition. No public exploit code exists and no active exploitation has been reported; EPSS sits at 0.02% (4th percentile), consistent with a narrow hardware-specific attack surface.

Memory leak in the Linux kernel's octeontx2-af CGX driver causes kernel resource exhaustion on systems using Marvell OcteonTX2 network hardware. The rx_fc_pfvf_bmap and tx_fc_pfvf_bmap bitmaps allocated during cgx_lmac_init() are never freed in cgx_lmac_exit(), meaning each unbind/rebind cycle of the driver leaks 16 bytes of kernel memory, detectable via kmemleak. No public exploit is identified at time of analysis, and with an EPSS of 0.02% (7th percentile), real-world exploitation risk is negligible; this is a correctness and stability issue rather than an active security threat.

Memory leak in the Linux kernel's MMIO mux driver (mux/mmio subsystem) causes kernel memory exhaustion under local access conditions. The mmio regmap allocated during device probe is never released on probe failure paths or driver unbind, resulting in cumulative memory loss that can degrade availability. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.02% (4th percentile) reflects minimal real-world exploitation interest, consistent with the local-only attack vector and narrow hardware dependency.

Local denial-of-service in the Linux kernel's iris media driver (Qualcomm video codec) results from a regression introduced by commit ad699fa78b59241c9d71a8cafb51525f3dab04d4, now reverted. When a media session enters IRIS_INST_ERROR state and userspace subsequently calls stop_streaming for cleanup, the erroneous check skipped the handler entirely - preventing videobuf2 (vb2) buffer returns and leaving firmware in an inconsistent, non-recoverable state. Affected are systems running the iris V4L2 driver on Qualcomm hardware; no public exploit identified at time of analysis and EPSS is 0.02% (percentile 4%), indicating minimal real-world exploitation activity.

Incorrect DMA buffer cleanup in the Linux kernel's fsl_ucc_hdlc WAN driver (used on Freescale/NXP QorIQ embedded platforms) causes a double-free of coherent DMA memory, resulting in a kernel panic and system crash. The driver allocates rx_buffer and tx_buffer as a single contiguous DMA region in uhdlc_init() but mistakenly calls dma_free_coherent() twice - once per buffer pointer - in uhdlc_memclean(), corrupting the DMA allocator state. Any authenticated local user or kernel path that triggers interface teardown on affected hardware can cause a complete availability loss. No public exploit identified at time of analysis, and EPSS at 0.02% (7th percentile) reflects near-zero opportunistic exploitation probability given the narrow hardware scope.

Deadlock in the Linux Kernel PCI/IOV SR-IOV subsystem allows a local low-privileged user to trigger a kernel hang via a recursive mutex acquisition, resulting in a complete denial of service on the affected host. The root cause is commit 05703271c3cd, which added pci_rescan_remove_lock around SR-IOV enable/disable operations without accounting for the re-entrant path where sriov_del_vfs() is invoked from within pci_stop_and_remove_bus_device_locked(), which already holds the same lock. No public exploit has been identified at time of analysis, and EPSS probability is negligible at 0.02%, consistent with the local-only attack vector.

Denial of service in the Linux kernel's iris media driver results from improper error-path handling during internal buffer allocation. When DMA allocation via dma_alloc_attrs() fails, a partially initialized buffer that was prematurely added to the internal buffers->list remains in that list, leading to inconsistent kernel state and potential resource leaks or NULL-pointer dereferences on subsequent access. Affected systems running Linux 6.15 through pre-patch versions of 6.18 and 6.19 with the iris media subsystem active are at risk; no public exploit has been identified and EPSS is 0.02%, indicating low exploitation probability at time of analysis.

Memory exhaustion in the Linux kernel's iris gen1 media driver allows a local low-privileged user to progressively consume kernel memory until session close, causing a denial of service. The iris driver fails to destroy internal firmware-managed buffers upon receiving the firmware release response, with the leak compounding across video resolution changes as each change allocates new buffers without reclaiming the prior set. No public exploit exists and EPSS sits at the 4th percentile, indicating negligible opportunistic exploitation risk; impact is limited to availability on systems with iris-compatible media hardware.

Resource leak in the Linux kernel cx23885 media driver's ALSA interface causes local denial of service on systems with Conexant 23885 PCI TV tuner hardware. The `snd_cx23885_hw_params()` function fails to call `cx23885_alsa_dma_unmap()` in its error path, leaving DMA resources allocated by `cx23885_alsa_dma_map()` unreleased. A low-privileged local attacker on an affected system can repeatedly trigger the error path to exhaust DMA resources, crashing the kernel subsystem. No public exploit exists and EPSS is 0.02% (7th percentile), reflecting extremely low real-world exploitation probability.

Hard-lockup in Linux kernel IOMMU/VT-d subsystem when flushing device IOTLB during PCIe link-down events affects systems using scalable mode with PASID support. Local authenticated attackers can trigger denial of service by causing PCIe device disconnection followed by resource cleanup operations, such as releasing VFIO group file descriptors, which deadlock the system while attempting ATS invalidation on inaccessible devices. Patch available across multiple stable kernel series.

Linux kernel page fault in ima_restore_measurement_list() when the second-stage kernel is booted via kexec with memory-limiting command lines such as 'mem=<size>' allows local authenticated users to cause a denial of service by triggering an out-of-bounds memory access. The vulnerability occurs on x86_64 architectures when the IMA measurement buffer from the previous kernel falls outside the addressable RAM of the new kernel, resulting in a kernel panic during early IMA restoration.

A circular locking dependency in the Linux kernel's ntfs3 filesystem driver allows local authenticated attackers with low privileges to cause a denial of service (system hang or crash) by triggering simultaneous operations that deadlock between the MFT run lock and bitmap read-write lock. The vulnerability affects kernel versions prior to 6.18.16, 6.19.6, and 7.0, and requires local access with user-level privileges to exploit.

Use-after-free vulnerability in the Linux kernel rpmsg subsystem allows local attackers with low privileges to cause denial of service by exploiting a race condition between driver_override_show() and driver_override_store() functions. The show function reads the driver_override string without holding the device_lock while the store function modifies and frees it under lock, creating a window for memory corruption. The vulnerability requires local access and non-default timing conditions (AC:H), limiting real-world exploitation probability to 0.02% per EPSS scoring.

Memory leak in rtw88 WiFi driver allows local authenticated attackers to cause denial of service via supported band allocation failure. The rtw_set_supported_band() function in the rtl8821ce WiFi driver failed to free allocated memory in error paths during hardware registration, enabling a local privilege escalation attack that exhausts kernel memory. EPSS exploitation probability is very low (0.02%), indicating this is a hardening fix rather than a critical vulnerability.

Resource leak in Linux kernel's most_register_interface() function allows local attackers with low privileges to cause denial of service through memory exhaustion. The vulnerability occurs when most_register_interface() fails during early initialization stages, returning error codes without properly releasing allocated device resources via put_device(). Patch versions 6.12.75, 6.18.16, 6.19.6, and 7.0 address this issue.

Memory leak in hfsplus filesystem driver causes denial of service when superblock setup fails during mount operations. The vulnerability affects Linux kernels when hfsplus is mounted and the setup_bdev_super() function fails after superblock allocation but before hfsplus_fill_super() completes, leaving filesystem-specific data unfreed. Local authenticated users can trigger this condition to exhaust kernel memory and crash the system.

HCL DFXAnalytics exposes detailed stack traces in application responses due to improper error handling, allowing authenticated remote attackers with low privileges to gain insights into the application's internal structure, code logic, and environment configurations. The vulnerability requires high attack complexity and produces limited confidentiality impact, resulting in a CVSS score of 3.1. No active exploitation or public exploit code has been identified at the time of analysis.

HCL DFXAnalytics transmits sensitive data over the network without encryption, allowing network-positioned attackers to intercept and read confidential information. The vulnerability requires high attack complexity (likely man-in-the-middle positioning) but affects all versions of the product when unencrypted channels are in use. No active exploitation has been reported, and the low CVSS score (3.7) reflects limited confidentiality impact with no integrity or availability compromise.

Keylime verifier uses a hardcoded challenge nonce instead of cryptographically random values for TPM quote attestation, allowing local attackers with root access on enrolled machines to capture valid quotes and replay them to bypass detection after system compromise. The vulnerability affects only push-model deployments and requires root privileges on the monitored endpoint; exploitation enables information disclosure and system integrity evasion with CVSS 6.3 severity.

Wildcard TLS certificate validation in Eclipse Vert.x allows remote attackers to bypass Server Name Indication (SNI) hostname verification by presenting arbitrary subdomains matching wildcard patterns, potentially disclosing sensitive server configuration and enabling certificate reuse across unintended service endpoints. The vulnerability affects Vert.x versions using unbounded SNI cache mechanisms without proper hostname validation constraints, and is fixed by implementing bounded LRU caching with proper synchronization and hostname matching enforcement.

Data race conditions in the Linux kernel Bluetooth subsystem allow local authenticated attackers to cause denial of service by triggering concurrent access to hdev->req_status without proper synchronization. The vulnerability exists in the HCI synchronous command processing path where __hci_cmd_sync_sk() and multiple other functions access the same variable across different workqueues without holding locks, potentially causing memory corruption or system hangs.

Data corruption in Linux kernel btrfs filesystem log replay allows local authenticated attackers to cause files to retain incorrect sizes after crash recovery. When a file is truncated to zero bytes, fssynced, and then a hardlink is created, the file incorrectly retains its pre-truncation size after a power failure and log replay, resulting in data integrity violation with availability impact.

Denial of service in Linux kernel tiny SRCU (Synchronize-RCU) subsystem allows local authenticated attackers to trigger a system hang or crash by invoking call_srcu() while holding scheduler locks, causing a circular lock dependency and potential deadlock. The vulnerability affects kernel versions before 6.19.14 and 7.0, with EPSS score of 0.02% indicating low real-world exploitation probability despite moderate CVSS severity.

Linux kernel shadow stack implementation fails to check for errors from mmap_read_lock_killable() in shstk_pop_sigframe(), allowing a local authenticated attacker to trigger a denial of service by causing the function to proceed with a failed lock acquisition. The vulnerability affects multiple stable kernel versions prior to patched releases 6.18.24, 6.19.14, and 7.0, with EPSS exploitation probability of 0.02% suggesting low real-world exploit likelihood despite the availability of a vendor patch.

Denial of service in Linux kernel xfrm (IPsec transform) subsystem allows local authenticated attackers to trigger a kernel panic via improper netlink message size calculation when handling XFRM_MSG_GETAE requests for states with interface ID set. The xfrm_aevent_msgsize() function fails to account for XFRMA_IF_ID attribute space, causing build_aevent() to exceed buffer bounds and hit a BUG_ON assertion, resulting in kernel crash. EPSS exploitation probability is very low at 0.02% despite the local attack vector, suggesting limited real-world impact.

Memory leak in the Linux kernel's Direct Rendering Manager (DRM) vc4 driver allows local authenticated attackers to exhaust kernel memory and trigger a denial of service condition. The vulnerability stems from a missing kfree() call in vc4_free_hang_state() that fails to release a separately allocated BO (buffer object) array, enabling persistent memory exhaustion through repeated hang state operations.

Memory leak in the Linux kernel's vc4 DRM driver allows local authenticated attackers to cause denial of service via memory exhaustion in hang state error handling. The vc4_save_hang_state() function fails to free allocated kernel_state memory on early return paths, enabling a local user with limited privileges to trigger repeated memory leaks and degrade system availability.

Denial of service in Linux kernel lapbether driver allows local authenticated attackers to crash the system by triggering a device type change that violates the ARPHRD_ETHER requirement when transmitting data. The vulnerability exists in the lapbeth_data_transmit() function which assumes the underlying device type remains Ethernet; a local user with low privileges can manipulate the bonding driver to change the device type, causing the kernel to reach an unhandled state and crash. EPSS score of 0.02% indicates low real-world exploitation probability despite the vulnerability being patched across multiple kernel versions.

Memory leak in the Airoha QDMA RX packet processing function allows local authenticated attackers to cause a denial of service through resource exhaustion. The vulnerability occurs when page pool fragments fail to properly return to the pool during error handling in airoha_qdma_rx_process(), allowing an attacker with local access and low privileges to exhaust kernel memory and crash the system. EPSS exploitation probability is extremely low at 0.02%, reflecting the local-only attack vector and privilege requirement.

Denial of service via NULL pointer dereference in the NFC s3fwrn5 driver's UART receive handler allows local authenticated attackers to crash the system. The vulnerability exists in s3fwrn82_uart_read() which consumes bytes from the serial device before allocating a fresh receive buffer; if memory allocation fails after bytes are already consumed, the function incorrectly reports success while leaving the receive buffer NULL, causing a NULL dereference on the next skb_put_u8() call. This affects Linux kernel versions 5.11 and later, with patches available for stable branches 6.6.136, 6.12.83, 6.18.24, 6.19.14, and 7.0.

The AF_XDP socket subsystem (xsk) in the Linux kernel fails to validate that a network device's MTU fits within the usable UMEM frame space at bind time, allowing a local low-privileged user to trigger a kernel denial of service. Usable frame space - chunk size minus headroom and tailroom - can fall below a standard 1500-byte MTU when 2k chunks are used, a gap that became exploitable once tailroom subtraction was introduced. The kernel also omits validation of hardware zero-copy capabilities via net_device::xdp_zc_max_segs. No public exploit has been identified and EPSS is 0.02% (5th percentile), indicating low immediate exploitation risk.

Reference count leak in the Linux kernel's xfrm IPsec subsystem allows a local low-privileged attacker to exhaust kernel memory, resulting in denial of service. The defect resides in xfrm_migrate_policy_find(), where xfrm_pol_hold_rcu() is called twice - once implicitly by the lookup path (which already returns a held reference) and once redundantly - creating a refcount imbalance that prevents memory reclamation. Discovered by the Linux Verification Center using Syzkaller fuzzing; no public exploit identified at time of analysis, and EPSS is very low at 0.02% (5th percentile), indicating minimal observed exploitation activity.

Uninitialized kernel memory is leaked to userspace through the xfrm_user subsystem's build_mapping() function in the Linux Kernel, where a one-byte compiler padding hole in struct xfrm_usersa_id after the proto field is never zeroed before the structure is copied across the kernel/userspace boundary. Authenticated local users with access to XFRM netlink interfaces can read this stale padding byte, potentially extracting kernel stack or heap fragments usable as an information disclosure primitive. No public exploit exists and EPSS is 0.02% (5th percentile), indicating negligible real-world exploitation probability at this time.

Linux kernel PF_KEY IPSEC key management exports leak uninitialized kernel memory via SADB_ACQUIRE, SADB_X_NAT_T_NEW_MAPPING, and SADB_X_MIGRATE messages, allowing local authenticated users to disclose sensitive kernel memory. EPSS score of 0.02% (percentile 5%) indicates minimal real-world exploitation despite patch availability. The 4-byte information leak per message could enable ASLR bypass and kernel address disclosure attacks.

Kernel heap memory disclosure in Linux netfilter's nfnetlink_log subsystem exposes four bytes of stale kernel memory to unprivileged local userspace processes when NFLOG batch mode is active. The flaw exists in __nfulnl_send(), which appends an NLMSG_DONE terminator using nlmsg_put() - a helper that zero-pads alignment bytes but does not initialize the nfgenmsg payload itself - resulting in uninitialized kernel heap data transmitted to any userspace NFLOG consumer. No public exploit code exists and no active exploitation has been confirmed; however, CVSS vector AV:L/AC:L/PR:L signals that low-privileged local users can reliably trigger the leak without any special conditions beyond NFLOG batching being in use.

Denial-of-service via off-by-one allocation in the Linux kernel txgbe network driver allows a local low-privileged user to crash the kernel on systems hosting Wangxun 10GbE NICs. The driver allocates property_entry struct lists without reserving the mandatory null-terminator sentinel slot, meaning kernel subsystems iterating over the list read beyond allocated memory bounds. No active exploitation has been identified and EPSS is extremely low (0.02%, 5th percentile), but patches are available across multiple stable kernel branches including 6.6.136, 6.12.83, 6.18.24, 6.19.14, and 7.0.

Incorrect GENERIC_CMD register field masks in the Linux kernel's IPA (IP Accelerator) network driver for IPA v5.0+ hardware trigger a kernel WARN when a 'stop' command is sent to the MPSS (Modem Processor SubSystem) remoteproc while IPA is active. This availability-only vulnerability (CVSS C:N/I:N/A:H) affects authenticated local users on systems with Qualcomm IPA v5.0+ silicon. No public exploit exists and no KEV listing is present; with an EPSS of 0.02% this is a low-urgency stability fix rather than an active threat.

Local denial-of-service in the Linux kernel's AEAD crypto socket interface (`algif_aead`) allows a low-privileged local user to crash the kernel by submitting a decryption request where the minimum receive buffer size check fails to account for the authentication tag length. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms this is a locally exploitable, high-availability-impact issue with no confidentiality or integrity risk. Patches have been released across multiple Linux LTS stable branches (5.10.254, 5.15.204, 6.1.170, 6.6.136, 6.12.83, 6.18.24, 6.19.14, 7.0) and Ubuntu has issued multiple USN advisories (USN-8277-1 through USN-8281-1). No public exploit code has been identified and EPSS is 0.02%, indicating no public exploitation activity.

Zabbix Agent 2 allows remote attackers with high privileges to inject malicious Oracle TNS connection strings via the 'service' parameter, enabling credential theft from saved database sessions. The vulnerability requires network access and high-level privileges but can lead to disclosure of Oracle database credentials if they are stored in named sessions. CVSS 5.1 reflects the requirement for authenticated attacker access (PR:H), though the impact to stored credentials is significant.

Missing authorization in All-in-One WP Migration Unlimited Extension for WordPress versions up to 2.83 allows authenticated subscribers to create scheduled export jobs without capability verification, enabling attackers to exfiltrate full site backups by redirecting notifications to attacker-controlled email addresses and leveraging exposed backup filenames for download. This results in complete site data disclosure including sensitive information accessible to low-privilege authenticated users.

Paramiko through version 4.0.0 before commit a448945 accepts SHA-1-based RSA signatures (ssh-rsa algorithm) in host key verification and authentication contexts, violating modern cryptographic standards and enabling signature forgery attacks. The vulnerability affects SSH clients and servers using Paramiko for key exchange and authentication, allowing remote attackers on the same network segment to potentially forge host keys or perform man-in-the-middle attacks by exploiting the deprecated SHA-1 hash algorithm. No public exploit code has been identified at time of analysis, though the issue is cryptographically fundamental and OSTIF security audit documentation exists.

The discover_pipeline_files() function in ciguard v0.8.0-0.8.1 follows symlinks during directory traversal without validating that discovered paths remain within the scan root, allowing an attacker who plants symlinks in a scanned directory to cause the MCP server to leak file paths and contents from sensitive locations such as ~/.aws/, ~/.config/, and /etc/. This information disclosure vulnerability affects users of ciguard integrated with Claude Desktop, Claude Code, or Cursor, and is patched in v0.8.2 with default symlink following disabled and path validation applied.

OpenTelemetry OpAMP client allocates unbounded buffers when reading HTTP responses from an OpAMP server, enabling memory exhaustion denial-of-service attacks if the configured server is attacker-controlled or subject to network interception. An attacker can send an extremely large HTTP response body that forces the client application to allocate memory without limits, exhausting available memory and crashing the application. CVSS 5.9 reflects moderate severity; exploitation requires network positioning (man-in-the-middle or control of the OpAMP server endpoint), which limits real-world attack surface. Upstream fix available in version 0.2.0-alpha.1.

Kubewarden versions before 1.35.0 permit RBAC reconnaissance attacks when users with AdmissionPolicy or AdmissionPolicyGroup creation privileges craft policies using the unchecked `can_i` host capability. The vulnerability allows enumeration of any user or service account permissions across the cluster via SubjectAccessReview requests executed with policy-server privileges, despite the absence of context-aware resource grants. This information disclosure enables attackers to discover sensitive permission configurations without requiring cluster-wide policy creation rights, a capability not available by default but exploitable when granted.

Sensitive information disclosure in Grav CMS v1.8.0-beta.29 allows low-privileged users with page editing permissions to bypass Twig sandbox restrictions and extract administrative password hashes and security salts via the exposed `grav['accounts']` service. A content editor can inject a Twig template with `{{ grav['accounts'].load('admin').get('hashed_password') }}` to retrieve plaintext Bcrypt hashes accessible for offline brute-force attack. Vendor-released patch available (2.0.0-beta.2 and commit c66dfeb5ff679a1667678c6335eb9ff3255dfc47); publicly available proof-of-concept exists demonstrating practical exploitation.

Race condition in Parse Server MFA SMS one-time password validation allows two concurrent login requests using the same OTP to both succeed and receive valid session tokens, breaking the single-use property of SMS-based multi-factor authentication. The vulnerability affects Parse Server versions 8.x before 8.6.76 and 9.x before 9.9.0-alpha.2, requires the attacker to already possess the victim's password and intercept the active SMS OTP via SIM swap, network interception, or phishing relay, then race a legitimate login request. This represents an incomplete fix of a prior optimistic locking vulnerability that affected only array-typed authData fields; SMS OTP storage as a string was not covered by the original guard.

OpenBao namespace deletion fails to properly clean up data and revoke leases when the initial deletion attempt is interrupted, potentially leaving orphaned storage entries and outstanding leases in the system. Subsequent retry attempts to delete the same namespace do not trigger proper cleanup, creating information disclosure and data integrity risks. This affects OpenBao versions prior to v2.5.3, with a vendor-released patch available.

Sandboxie-Plus versions 1.17.2 and earlier are vulnerable to privilege escalation via a Time-of-Check-to-Time-of-Use (TOCTOU) race condition during addon installation. When a user initiates addon installation through the SandMan interface, the UpdUtil.exe process runs as SYSTEM and stages files in the user-writable %TEMP%\sandboxie-updater directory. An unprivileged local attacker can exploit the window between hash verification and file extraction to replace the addon cabinet file with a malicious executable, resulting in arbitrary code execution as SYSTEM without UAC prompts. Patch version 1.17.3 addresses this flaw; no active exploitation has been publicly confirmed, though the attack is trivially reproducible given local access and user interaction.

Sandboxie-Plus versions 1.17.2 and earlier contain a cryptographic implementation flaw in SbieIniServer::HashPassword that reduces SHA-1 password hash entropy from 160 bits to 80 bits by incorrectly shifting the high nibble of each byte right by 8 instead of 4, combined with an unsalted hashing scheme. This makes leaked or backed-up EditPassword hashes significantly easier to brute-force, enabling attackers with local access and low privileges to recover plaintext passwords through offline attack. The vulnerability is fixed in version 1.17.3.

Arbitrary file read as root via symlink following vulnerability in Tunnelblick versions 3.3beta26 through 9.0beta01 allows any local user to exploit tunnelblick-helper through the world-accessible tunnelblickd Unix socket to read arbitrary root-owned files. The vulnerability exists because tunnelblick-helper constructs paths to configuration files within user-controlled directories and reads them as root without validating symlinks, enabling attackers to redirect reads to sensitive files. Vendor-released patch available in version 9.0beta02. SSVC framework identifies this as exploitable with publicly available proof-of-concept code but not automatically exploitable.

JWT type confusion in Nuts Node v1 access token introspection endpoint allows authenticated attackers to replay Verifiable Presentation (VP) JWTs as access tokens, receiving active:true responses without proper validation of JWT type, issuer-to-key binding, or required claims. Exploitation requires prior receipt of a VP JWT during legitimate protocol flow and low attack complexity due to lenient JWT processing, though real-world impact is constrained by resource servers requiring valid service, iss, and aud fields for routing. Confirmed patched in v5.4.31 and v6.2.3.

Insufficiently random file ID generation in Langchain-Chatchat up to version 0.3.1.3 allows authenticated local network attackers to predict uploaded file identifiers via the _get_file_id function, enabling information disclosure. The vulnerability requires local network access and authenticated privileges but carries low exploitability due to high attack complexity. A public exploit is available, though the project has not responded to early disclosure notifications.

Weak hash function in the Vision Chat Paste Image Handler of Langchain-Chatchat up to 0.3.1.3 allows local network attackers with low privileges to cause information disclosure via hash collision attacks on image data processed through PIL.Image.tobytes. The vulnerability requires high attack complexity and local network presence, resulting in minimal direct impact (CVSS 1.2); however, publicly available exploit code exists and the vendor has not responded to disclosure.

Misuse of the `__copy_user_nocache()` function in the Linux kernel's x86-64 subsystem - specifically within NTB driver code and several other drivers - causes STAC/CLAC (SMAP-disabling) instructions to execute during kernel-to-kernel memory copies where no user-space access is actually performed. This incorrect usage defeats the Supervisor Mode Access Prevention (SMAP) protection temporarily and, critically, attaches user-space exception handling semantics to pure kernel copies; if a machine check exception or memory fault occurs during this window, the kernel may not handle it gracefully, resulting in a kernel panic. The CVSS availability-high rating (A:H) reflects this crash potential for any local authenticated user able to trigger the affected driver paths. No public exploit has been identified at time of analysis, and EPSS probability is negligible at 0.02%.

Unchecked return value in the drm/vc4 DRM driver allows a local low-privileged user to cause a kernel crash and denial of service on systems equipped with Broadcom VideoCore 4 GPU hardware. The driver's initialization path passes the return value of platform_get_irq_byname() - which returns a negative errno on failure - directly into devm_request_threaded_irq() without validation, causing undefined kernel behavior when IRQ resource lookup fails. No public exploit exists and EPSS is 0.02% (7th percentile), but unpatched systems running the vc4 module (primarily Raspberry Pi devices) remain susceptible to local DoS via kernel crash.

Resource leak in the Linux kernel's Bluetooth hci_ll driver allows a local authenticated user to cause kernel memory exhaustion by repeatedly triggering an error path in download_firmware() where firmware objects allocated by request_firmware() are never released when their content is invalid. Systems equipped with Texas Instruments Bluetooth hardware (using the hci_ll driver) are affected across numerous stable kernel branches dating back to Linux 4.12. No public exploit exists and EPSS is 0.02% (7th percentile), classifying this as a low-urgency maintenance fix; patches are available across all actively maintained stable branches.

Repeated data loss occurs on Linux kernel systems using ext4 filesystems due to the `ext4_mb_find_by_goal()` function failing to skip corrupted block groups during block allocation. Affected kernels from commit 163a203ddb36 through multiple stable branches will continuously attempt to allocate blocks from a group flagged `EXT4_MB_GRP_BBITMAP_CORRUPT`, producing kernel error messages stating 'This should not happen!! Data will be lost' and causing permanent inode data loss. No public exploit has been identified and EPSS is 0.02%, but the availability impact is rated High; this is a resilience defect in ext4 error-handling that requires local access and pre-existing filesystem corruption to manifest.

Buffer-head reference leak in Linux kernel ext4 fast-commit replay (ext4_fc_replay_inode()) allows local authenticated users to exhaust kernel memory, resulting in denial of service. Four distinct error paths in the function skip the mandatory brelse() call on iloc.bh, and the function previously masked all errors by always returning 0. No public exploit identified at time of analysis; EPSS at 0.02% (7th percentile) reflects very low real-world exploitation probability and no CISA KEV listing corroborates the absence of observed active exploitation.

Availability impact in the Linux kernel's ext4 filesystem subsystem arises from improperly managed discard workqueue lifecycle during remount and unmount operations. When a filesystem mounted with `-o discard` is remounted with `-o nodiscard` and then immediately unmounted, pending `s_discard_work` workqueue items are neither cancelled nor flushed before superblock teardown, potentially causing the work callback to reference freed memory and crash the kernel. Patch commits are confirmed across multiple stable branches; EPSS is 0.02% (7th percentile) and no KEV listing or public exploit exists, indicating negligible real-world exploitation risk outside of automated fuzzer (syzkaller) scenarios.

Resource leak in the Linux kernel dmaengine idxd subsystem allows a local low-privileged user to cause availability impact on systems equipped with Intel DSA (Data Streaming Accelerator) or IAA (Intel Analytics Accelerator) hardware. The .release() callback for the associated workqueue fails to free the workqueue when the device object is destroyed, meaning repeated allocation and deallocation cycles progressively exhaust kernel workqueue resources. No public exploit identified at time of analysis, and an EPSS score of 0.02% (7th percentile) confirms negligible real-world exploitation probability; however, patched stable kernel releases are available and should be applied on affected hardware platforms.

TX deadlock in the Linux kernel's 8250 serial UART driver permanently blocks DMA transmissions when a DMA transaction is terminated without its completion callback executing. Specifically, `dmaengine_terminate_async` does not guarantee that `__dma_tx_complete` runs, leaving `dma->tx_running` permanently set and preventing any subsequent TX DMA scheduling. This availability-only denial-of-service (CVSS A:H) requires local low-privileged access and only manifests on systems with 8250 UART hardware operating in DMA mode; no public exploit exists and no KEV listing is present.

Django 6.0 before 6.0.5 and 5.2 before 5.2.14 fail to vary response headers on session cookies when SESSION_SAVE_EVERY_REQUEST is enabled but the session is unmodified, allowing remote attackers with user interaction to steal session tokens from cached public pages. The vulnerability affects server configurations that cache responses aggressively while maintaining per-request session handling, exposing authenticated users to session hijacking after visiting pages served from cache.

Django's UpdateCacheMiddleware incorrectly caches HTTP responses containing a Vary header with an asterisk value in versions 6.0 before 6.0.5 and 5.2 before 5.2.14, causing private user data to be cached and served to other users. The vulnerability has low confidentiality impact and requires user interaction (UI:P) combined with passive attack timing, making real-world exploitation dependent on specific cache timing conditions and application architecture.

Out-of-bounds read in X.Org X server XKB geometry processing allows local or remote attackers with X11 server access to disclose sensitive memory contents or cause denial of service by crashing the server. The vulnerability exists in CheckSetGeom() and XkbAddGeomKeyAlias functions and requires low privileges but no user interaction. No public exploit code or active exploitation has been identified at time of analysis.

IObit Advanced SystemCare 19 contains a symlink following vulnerability in the ASC.exe Service component that allows local authenticated attackers to achieve high-impact confidentiality and integrity violations. The vulnerability requires local access and elevated privileges (PR:L) but has high attack complexity (AC:H), making real-world exploitation difficult despite public exploit availability. CVSS 6.4 reflects the local-only attack vector and privilege requirement, though the confidentiality and integrity impacts are rated high.

OpenClaw before version 2026.4.12 contains an improper authorization flaw in helper-backed channels where empty resolved approver lists are incorrectly interpreted as explicit approval authorization. Authenticated attackers who know an approval ID can resolve pending approvals without proper authorization by exploiting this logic error, bypassing intended sender authorization checks. This vulnerability has a CVSS score of 6.5 (medium) with network attack vector and requires only low privileges, though no public exploit code or active exploitation has been identified.

Symlink traversal in OpenClaw versions 2026.3.22 before 2026.4.5 allows unauthenticated remote attackers with user interaction to read arbitrary files outside the remote marketplace repository root. The vulnerability exploits improper path canonicalization in the marketplace plugin's remote repository handler, exposing sensitive information with a CVSS score of 6.5. Vendor-released patch available in version 2026.4.5.

WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by accessing predictable file. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.