Information Disclosure

Integrity bypass in the Linux kernel dm-integrity device mapper subsystem allows low-privileged users to undermine block-level data integrity guarantees through a double-increment logic error in hash_offset tracking. The introduced commit 84597a44a9d86ac949900441cea7da0af0f2f473 (present since Linux 5.7) causes the hash_offset variable to advance by two positions per iteration instead of one, meaning integrity hashes are verified against incorrect offsets - allowing corrupted data to pass or valid data to fail integrity checks. No public exploit identified at time of analysis, and EPSS at 0.21% (11th percentile) reflects low near-term exploitation probability.

Uninitialized memory dereference in the Linux kernel's dma-fence subsystem allows a local low-privileged user on AMD GPU-equipped systems to trigger memory corruption via the amdgpu userqueue wait path. The root cause is an off-by-one logic error in `dma_fence_dedup_array()` that returns 1 instead of 0 for empty input, which the primary caller guards against but `amdgpu_userq_wait_*()` does not, exposing an uninitialized fence slot to dereference. Patch commits are available for stable branches 6.18.40 and 7.1.5; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), indicating low real-world exploitation activity.

Use-after-free in the Linux kernel's amdxdna DMA buffer memory mapping function exposes systems with AMD XDna AI accelerator hardware to local privilege escalation. When vm_insert_pages() fails inside amdxdna_gem_dmabuf_mmap(), the error path triggers drm_gem_object_put() twice on the same GEM object - once through the VMA close handler and again through the fall-through put_obj label - freeing the object and then accessing freed memory. EPSS sits at 0.21% (11th percentile) and the vulnerability is not listed in CISA KEV, indicating no known active exploitation; however, the CVSS 7.8 high score reflects the full C/H/I:H/A:H kernel memory corruption potential if successfully triggered locally.

Client pointer confusion in the Linux kernel's amdxdna DRM accelerator driver allows a local low-privileged user to trigger cross-process access to another process's hardware context and debug buffer objects via a misrouted SYNC_DIRECT_FROM_DEVICE ioctl. Systems running AMD XDNA NPU hardware (such as AMD Ryzen AI series processors) with the amdxdna kernel module loaded are affected across kernel versions from the driver's introduction up to the patched releases in 7.1.5 and 7.2-rc1. No public exploit exists and the EPSS score of 0.20% (10th percentile) reflects low near-term exploitation probability, though the CVSS 7.8 score correctly captures the high CIA impact should exploitation succeed.

Integer underflow in the Linux kernel's Intel VPU accelerator driver (accel/ivpu) allows a local low-privileged attacker to trigger out-of-bounds kernel memory reads and infinite loops via a malformed firmware log buffer. The vulnerability exists because fw_log_from_bo() never validates that log->size is at least log->header_size before fw_log_print_buffer() computes data_size = log->size - log->header_size - a u32 subtraction that wraps to near-U32_MAX, defeating the bounds checks from commit dd1311bcf0e6 and enabling fw_log_print_lines() to read far past the allocated BO region. No active exploitation is confirmed (not in CISA KEV), and EPSS is 0.21% (11th percentile), indicating low near-term exploitation likelihood despite the 7.1 CVSS score.

Denial of service in the Linux kernel's Xen paravirtualized SCSI backend (xen-scsiback) lets a malicious pvSCSI guest exhaust every command tag of a target LUN's session by driving the pre-submission error paths, which call transport_generic_free_cmd() on an se_cmd whose cmd_kref is still 0. The resulting refcount underflow is a use-after-free that leaks the tag and stops the LUN; on hosts booted with panic_on_warn it crashes the host outright. There is no public exploit identified at time of analysis and EPSS is low (0.21%), but the fix is shipped across multiple stable kernel trees.

Use-after-free in the Linux kernel's LIO SCSI target core (iSCSI transport) lets an initiator that can issue a PERSISTENT RESERVE OUT / REGISTER AND MOVE command trigger reads of an unmapped kernel virtual address, risking information disclosure or a kernel crash. The flaw exists only in the target-mode stack (drivers/target) and only manifests when the PR OUT parameter list exceeds one page (>4096 bytes), forcing transport_kmap_data_sg() down its vmap()/vunmap() path. EPSS is low (0.22%, 13th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.

Use-after-free in the Linux kernel's resctrl filesystem subsystem allows a local low-privileged user to dereference freed kernel memory during a race between a concurrent monitoring file reader and resctrl unmount or fatal teardown. The vulnerable code path affects multiple stable kernel series, with fixes confirmed in 6.18.42, 7.1.5, and 7.2-rc3. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% reflects low current exploitation probability, though kernel use-after-free primitives are commonly developed into local privilege escalation exploits.

Use-after-free and initialization-order race conditions in the Linux kernel's mlx5e MACsec hardware offload driver allow a local low-privileged user to corrupt kernel memory during RX Security Channel deletion. The delete path in macsec_del_rxsc_ctx() called metadata_dst_free() unconditionally, bypassing reference counting, while concurrent RX datapath readers operating under rcu_read_lock() could still hold and dereference the freed dst object. A secondary race in the add path published the SC's xarray entry before md_dst was fully initialized, allowing readers to observe NULL or partially-constructed pointers. Patches are available across multiple stable branches (6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2-rc2); no public exploit has been identified at time of analysis.

Use-after-free race condition in the Linux kernel's tracing/user_events subsystem allows a low-privileged local user to corrupt kernel heap memory during fork(), potentially enabling privilege escalation to root. The race is triggered when a multithreaded process concurrently unregisters a user event enabler while calling fork(), causing user_event_mm_dup() to dereference enabler and user_event structures freed without observing the required RCU grace period. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, the low privilege bar and full C/I/A impact make it a meaningful escalation primitive on any multi-user or shared Linux system running an unpatched kernel with CONFIG_USER_EVENTS enabled.

Local privilege escalation / memory corruption in the Linux kernel's PREEMPT_RT locking substitution stems from rt_spin_unlock() (and the rwlock substitution) releasing RCU read-side protection before completing the unlock, creating a use-after-free window where an object freed via kfree_rcu() can be accessed by rt_mutex_cmpxchg_release(). Only PREEMPT_RT (real-time) kernel builds are affected, since regular spinlocks keep preemption disabled across unlock and thus retain full RCU protection. The upstream fix has been merged and backported to multiple stable trees; no public exploit identified at time of analysis, and EPSS is low (0.21%).

Error-masking in the Linux kernel CPU hotplug subsystem allows a failed CPU state transition to silently appear successful to callers, spanning stable branches from 4.14 through 7.1.x. The root cause is that cpuhp_invoke_callback() reuses the ret variable in its rollback path: when one instance callback fails and the subsequent rollback succeeds, the rollback's zero return overwrites the original non-zero error, hiding the failure from higher-level consumers. No active exploitation is confirmed - EPSS sits at 0.22% (13th percentile) and there is no CISA KEV listing - but patches are available across all affected stable branches.

Unbounded sprintf() calls in the Linux kernel's CPU hotplug sysfs interface (states_show()) can overflow the PAGE_SIZE kernel buffer when a sufficient number of hotplug states are registered, enabling a local low-privileged user to corrupt adjacent kernel memory with potential high impact on confidentiality, integrity, and availability. Affected kernel versions span from the 4.6 era through multiple current stable branches (5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x), each with vendor-released patch versions confirmed by ENISA EUVD-2026-59024. No public exploit has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), indicating limited real-world exploitation probability despite the 7.8 CVSS score.

Out-of-bounds memory access in the Linux kernel MANA (Microsoft Azure Network Adapter) Ethernet driver arises because the RX completion queue entry (CQE) packet length reported by the NIC was passed to skb processing without validation. Affected systems are Linux VMs running the mana_en driver, predominantly Azure guests using MANA/SR-IOV networking. A NIC (or malicious hypervisor/device) supplying a crafted oversized length can trigger an out-of-bounds read leading to information disclosure or a kernel crash; the vulnerability is tagged Information Disclosure, has no public exploit identified at time of analysis, and carries a low EPSS of 0.21%.

Missing DMA sync-for-CPU in the Linux kernel's MANA (Microsoft Azure Network Adapter) RX path can hand stale or uninitialized buffer memory to the networking stack on systems that require explicit DMA syncing, such as those booted with swiotlb=force. The flaw affects the mana Ethernet driver when RX buffers come from page-pool fragments (frag_count > 1), where the DMA unmap that normally performs the implicit CPU sync is skipped. There is no public exploit identified at time of analysis, EPSS is low (0.20%), and it is not listed in CISA KEV.

Cross-namespace privilege escalation in the Linux kernel SIT (IPv6-in-IPv4) tunnel driver allows a local attacker with CAP_NET_ADMIN in one network namespace to rewrite SIT tunnel configuration belonging to a distinct, more privileged network namespace, bypassing the intended authorization boundary. This is particularly impactful in containerized environments where network namespace isolation is a primary security boundary, as tenant containers are commonly granted CAP_NET_ADMIN within their own namespace. Patches are confirmed available across all active stable kernel branches (5.10 through 7.x); no public exploit or CISA KEV entry exists at time of analysis, and EPSS is 0.22%, reflecting very low observed exploitation activity.

Metadata corruption in the Linux kernel traffic control connection-tracking action (act_ct) allows remote attackers to crash systems or corrupt qdisc packet-segment state by sending fragmented IP or IPv6 traffic. The flaw exists because tcf_ct_handle_fragments() invokes nf_ct_handle_fragments() without preserving skb->cb, so the netfilter defragmentation helper silently overwrites tc_skb_cb/qdisc_skb_cb in-place - the same memory region. On hosts with panic_on_warn enabled, this triggers a WARN_ON_ONCE in qdisc_pkt_segs() that escalates to a kernel panic. EPSS is low (0.21%, 11th percentile) and the vulnerability is not in CISA KEV, indicating opportunistic exploitation is unlikely but targeted denial-of-service against network appliances or container hosts using tc act_ct is realistic.

Privilege boundary bypass in the Linux kernel's ip6_vti (IPv6 Virtual Tunnel Interface) subsystem allows a local user with CAP_NET_ADMIN in one network namespace to reconfigure VTI6 tunnels residing in a separate, unprivileged network namespace. The rtnl changelink path validates CAP_NET_ADMIN only against dev_net(dev), leaving t->net unchecked when the device spans namespaces - enabling unauthorized rewrites of cross-namespace tunnel configurations with full confidentiality, integrity, and availability impact on the affected namespace. No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (12th percentile) reflects low current exploitation probability, though the capability misuse pattern is well-understood in container-escape research.

Privilege escalation in the Linux kernel's IP VTI (Virtual Tunnel Interface) subsystem allows a local attacker holding CAP_NET_ADMIN in one network namespace to reconfigure VTI tunnel endpoints anchored in a separate, more privileged network namespace they do not control. Affected kernel versions span from approximately 3.15 through all stable branches prior to 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code has been identified and no CISA KEV listing exists, but the scope-changed CVSS rating (8.8) reflects real cross-namespace boundary violation risk relevant to container and VNF deployments.

Cross-namespace capability bypass in the Linux kernel's IPIP (IP-in-IP) tunnel driver allows a local process holding CAP_NET_ADMIN within one network namespace to modify IPIP tunnel parameters governed by a separate, more privileged network namespace. By exploiting the missing rtnl_dev_link_net_capable() check in ipip_changelink(), an attacker can redirect or disrupt encapsulated tunnel traffic across namespace boundaries - a meaningful concern in containerized environments where namespace separation is a security boundary. No public exploit code or CISA KEV listing has been identified; EPSS stands at 0.21% (11th percentile), indicating low current exploitation probability despite the high CVSS score of 8.8.

IPv6 GRE tunnel management in the Linux kernel allows a local attacker holding CAP_NET_ADMIN in one network namespace to modify tunnel configurations residing in a separate, unauthorized namespace - effectively escalating privilege across namespace security boundaries. Affected kernels span multiple long-term support trees from at least 4.19.100 onward, with patches released across stable series including 6.12.97, 6.6.145, 6.1.178, 6.18.40, 5.10.261, 5.15.212, and 7.1.5. No public exploit code has been identified at time of analysis; EPSS exploitation probability stands at 0.21% (12th percentile), indicating limited current attacker interest despite the high CVSS score.

Insufficient capability gating in the Linux kernel's IPv6 tunnel subsystem allows a local attacker with CAP_NET_ADMIN in one network namespace to reconfigure tunnel devices residing in a separate, more privileged namespace. Affected versions span from Linux 3.12 through all stable branches prior to 6.6.148, 6.12.101, 6.18.40, and 7.1.5, with the CVSS Scope:Changed metric confirming cross-namespace impact. This vulnerability is not listed in CISA KEV and carries an EPSS score of 0.20% (10th percentile), indicating limited observed exploitation at time of analysis; however, it is a meaningful privilege escalation primitive in containerized deployments where CAP_NET_ADMIN is routinely granted.

Raw AES-128 LLSEC key exposure in the Linux kernel's legacy ieee802154 netlink family allows any local user to extract 16-byte cryptographic key material directly from the kernel keytable on systems running IEEE 802.15.4 (wpan) interfaces with link-layer security configured. Because IEEE 802.15.4 LLSEC uses CCM* mode where the same key both encrypts frames and provides message authentication, key disclosure simultaneously breaks confidentiality and authenticity of the entire 802.15.4 wireless network. No confirmed active exploitation and no public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), consistent with the niche hardware requirement.

Header buffer corruption in the Linux kernel gve (Google Virtual Ethernet) driver's DQO RX datapath lets header bytes from one packet be copied onto another, and lets header buffers be re-posted while the device still owns them, when both header-split and HW-GRO are enabled with many concurrent flows. The gve driver is used by Google Cloud Platform Linux VMs, so exposure is limited to GCP guests running affected kernels with that specific offload configuration. There is no public exploit identified at time of analysis, EPSS is very low (0.20%), and the observed effect is roughly a 30% throughput drop with heavy TCP retransmissions rather than code execution.

Cross-VF/PF LMTLINE physical address disclosure in the Linux kernel's octeontx2-af CN10K driver allows a low-privileged VF caller to read another PF's LMTLINE physical base address and map it into its own LMT table entry. Affected are Linux kernel trees from commit 893ae97214c3 across stable branches 6.6.x before 6.6.148, 6.12.x before 6.12.101, 6.18.x before 6.18.42, and mainline before 7.1.5/7.2-rc1. No public exploit code or CISA KEV listing exists at time of analysis; the EPSS score of 0.20% (10th percentile) indicates low exploitation probability, consistent with the hardware-specific attack surface.

Data corruption in the Linux kernel's LoongArch memory management subsystem allows a local low-privileged user to cause silent loss of written data or potential exposure of stale page contents via a race condition between hardware page table walker behavior and software dirty-bit tracking. Affected systems are those running LoongArch CPUs with hardware PTW enabled - a condition that applies to the architecture by design - across kernel versions from 5.19 through stable branches prior to 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code exists and EPSS stands at 0.21% (11th percentile), though the bug was reliably reproduced via the LTP madvise09 test, confirming it is not theoretical.

Reference count underflow in the Linux kernel IPMI subsystem's handle_read_event_rsp() function enables local privilege escalation on server hardware with active IPMI interfaces. The flaw resides in the error-rollback path: when event delivery fails after successfully allocating receive messages for some users, the rollback incorrectly drops the user reference count twice - once through ipmi_free_recv_msg() and again through a now-stale explicit put - freeing an ipmi_user object that remains linked on intf->users. Subsequent event delivery then dereferences the freed object or trips refcount_t's addition-on-zero guard, enabling kernel memory corruption leading to full system compromise. No public exploit or CISA KEV listing exists; EPSS is 0.20% at the 10th percentile, consistent with no active exploitation at time of analysis.

Memory-accounting corruption in the Linux kernel's espintcp (ESP-in-TCP / IPsec RFC 8229) send path was resolved by switching to sk_msg_free_partial(), which keeps the socket message (skmsg) consistent on partial sends. On affected kernels the previous code mishandled uncharges and offsets when the full payload was not transmitted, corrupting skmsg accounting on a system where TCP encapsulation of IPsec is in use. This is a stable-tree fix carrying an NVD CVSS of 9.8 and the 'Information Disclosure' tag, but EPSS is only 0.20% (10th percentile) and no public exploit is identified at time of analysis.

Kernel panic via NULL pointer dereference in the Linux kernel's multiq traffic scheduler (net/sched/sch_multiq) affects all kernels from 2.6.29 through unpatched stable trees. When multiq pairs with a non-work-conserving child qdisc (such as qfq) routed through a peeking intermediary (such as tbf), multiq_dequeue() invokes the child's raw ->dequeue() method directly instead of qdisc_dequeue_peeked(), orphaning the stash, corrupting qlen/backlog accounting, and triggering a NULL dereference in softirq context during ordinary egress. Exploitation requires local access with CAP_NET_ADMIN and a deliberately constructed qdisc hierarchy; no public exploit code exists and EPSS probability is 0.21% (12th percentile), consistent with the niche configuration requirement.

Kernel panic via NULL pointer dereference in Linux's taprio traffic scheduler (net/sched/sch_taprio) delivers system-level denial of service when a non-work-conserving child qdisc such as qfq is attached to a taprio parent. The defect in taprio_dequeue_from_txq() calls the child's ->dequeue() function pointer directly rather than via qdisc_dequeue_peeked(), bypassing the child's gso_skb stash, orphaning the peeked skb, desyncing qlen/backlog counters, and re-entering the child on an emptied list - triggering a NULL dereference from softirq context during ordinary egress traffic. No public exploit has been identified at time of analysis, and EPSS stands at 0.20% (10th percentile), indicating very low opportunistic exploitation probability; the vulnerability is not listed in CISA KEV.

Null pointer dereference in the Linux kernel's fhandle subsystem allows a local low-privileged user to trigger a kernel panic via a race condition in capable_wrt_mount(). The vulnerable path is reached when open_by_handle_at() processes a file handle whose detached mount - created via open_tree(OPEN_TREE_CLONE) - is concurrently dissolved by fput(), causing umount_tree() to clear mount->mnt_ns to NULL before capable_wrt_mount() can safely dereference mnt_ns->user_ns. No public exploit identified at time of analysis (EPSS 0.20%, no CISA KEV listing), and patched kernel versions 6.12.97, 6.18.40, 7.1.5, and 7.2-rc2 are available from upstream stable trees.

Memory corruption in the Linux kernel's compaction subsystem allows a local low-privileged attacker to trigger data corruption or potential privilege escalation by exploiting improper error handling in compaction_free(). The function ignores failure returns from free_pages_prepare(), causing hardware-poisoned pages (PageHWPoison) or bad pages (free_page_is_bad()) to be re-added to the compaction freepages list and subsequently reallocated to kernel or user structures. Exploitation requires low-privilege local access and is not confirmed actively exploited (absent from CISA KEV), with EPSS at a low 0.21% (11th percentile); vendor-released patches are available across multiple stable branches.

Race condition in the Linux kernel mac802154 subsystem allows a local low-privileged attacker to trigger kernel memory corruption by racing hardware teardown against an in-flight asynchronous transmit completion. Affected systems are those running IEEE 802.15.4 wireless networking hardware with the mac802154 module loaded; versions from Linux 3.19 through the respective stable-branch fix commits are vulnerable. No public exploit identified at time of analysis, and EPSS of 0.21% (12th percentile) reflects negligible observed exploitation activity; vendor patches have been released across all active stable kernel branches.

IPVS (IP Virtual Server) SCTP state tracking in the Linux kernel misreads chunk headers for IPv6 packets carrying extension headers, causing incorrect connection state transitions that affect load balancer behavior and resource accounting. The IPVS subsystem, widely deployed in Kubernetes and LVS environments via kube-proxy, can misclassify an SCTP INIT packet as an already-ESTABLISHED connection when the IPv6 packet includes extension headers (e.g., an 8-byte Destination Options header), because set_sctp_state() hardcodes sizeof(struct ipv6hdr) as the transport offset rather than using the offset already resolved by ipv6_find_hdr(). No public exploit identified at time of analysis, and EPSS at 0.21% (12th percentile) confirms very low current exploitation interest despite the CVSS 8.2 score.

Information disclosure and TCP flow corruption in the Linux kernel's IPVS (IP Virtual Server) load balancer arises because ip_vs_conn_new() only zeroes the delta fields of its two ip_vs_seq structures, leaving init_seq and previous_delta filled with stale slab data. A director acting as a connection-sync backup can hash a connection with IP_VS_CONN_F_IN_SEQ/OUT_SEQ flags set (inherited from IP_VS_CONN_F_BACKUP_MASK) while an attacker-supplied sync message omits IPVS_OPT_SEQ_DATA, so an IPVS application helper later rewrites forwarded TCP sequence/ack numbers using uninitialized kernel memory. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and the issue is not in CISA KEV.

Kernel memory corruption in the Linux kernel's DRBD (Distributed Replicated Block Device) driver lets a malicious or man-in-the-middle replication peer write attacker-chosen bytes past a bio page in a receiving node. The flaw lives in recv_dless_read(), where a peer-supplied payload length is handled as a signed int (data_size) that can be driven negative, and it affects any node that reads from its peer - a diskless node or one using read-balancing - in the default configuration. Rated CVSS 9.8 by NVD; there is no public exploit identified at time of analysis and EPSS probability is low (0.20%).

Use-after-free race condition in the Linux kernel's osnoise tracing subsystem allows a local low-privileged attacker to potentially escalate privileges or destabilize the kernel. The flaw, present in kernels since commit a6ed2aee (Linux 5.17), stems from missing synchronize_rcu() synchronization during osnoise instance unregistration, leaving a window where RCU readers can dereference freed tracer memory. Patched stable releases (6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2-rc3) are available; no public exploit code and no CISA KEV listing have been identified at time of analysis.

Shared MIPI PHY resource mismanagement in the Linux kernel's NXP i.MX93 block-control power domain driver (imx93-blk-ctrl) allows a local attacker with low privileges to trigger kernel-level incorrect behavior - including potential memory corruption, information disclosure, and system instability - by exploiting the fact that the DSI and CSI subdomains share clock and reset control bits without coordination. Patches are available across stable branches (6.18.42, 7.1.5, 7.2-rc4), and exploitation probability is low per EPSS (0.20%, 10th percentile). No public exploit or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in the Linux kernel's rt2x00 WiFi driver stems from improper error handling during device probe, where early allocation failures invoke a full teardown path that assumes work items (intf_work, autowakeup_work, sleep_work) are already initialized. On systems with Ralink/MediaTek rt2x00-compatible WiFi hardware, a local low-privileged attacker who can trigger workqueue allocation failure during driver probe can corrupt uninitialized kernel work_struct objects, as confirmed by DEBUG_OBJECTS reporting invalid work drains. EPSS is low (0.21%, 12th percentile) and this is not listed in CISA KEV, though a QEMU-based proof-of-concept demonstrating the failure path was confirmed by the reporters.

Incorrect IPv6 transport-header offset handling in the Linux kernel's IPVS (IP Virtual Server) load-balancing subsystem causes application-layer helper code and ICMPv6 checksum validation to misread packet headers when IPv6 traffic - particularly packets carrying extension headers - is processed. The IPVS TCP application path wrongly assumed an IPv4 network header even after the ipvsh offset argument was supplied, and ip_vs_out_icmp_v6() used an incorrect ICMPv6 offset. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and this is not on CISA KEV, and for the only in-tree app (FTP) the maintainers note the effect is harmless because port mangling is handled by Netfilter without TCP sequence adjustment.

Memory-safety defect in the Linux kernel IPVS (IP Virtual Server) subsystem where __ip_vs_get_out_rt() calls skb_ensure_writable(), which can reallocate skb->head, leaving a stale IP-header pointer that is then dereferenced. Affected hosts are Linux systems acting as IPVS load balancers/directors; the flaw can lead to reads of freed/relocated packet memory (information disclosure) or kernel instability. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile); the upstream fix reloads the IP header after reallocation.

PowerPC E500 systems running Linux kernel 7.0 through 7.1.4 and 7.2-rc4 silently lose kernel address-masking protection due to a compile-time preprocessor symbol typo - `CONFIG_E500` instead of `CONFIG_PPC_E500` - causing `mask_user_address_isel()` to be omitted from E500 builds entirely. A local low-privileged user on affected E500 hardware can exploit the absent address-masking primitive to achieve high-impact memory disclosure, integrity corruption, or denial of service against the kernel. No public exploit exists, EPSS is 0.19% (9th percentile), and this vulnerability is not in CISA KEV, indicating very limited current exploitation activity despite a CVSS score of 7.8.

Out-of-bounds read in the Linux kernel cfg80211 WiFi subsystem allows an adjacent-network unauthenticated attacker to disclose kernel memory or crash the system by sending a crafted EHT Multi-Link Element inside an MBSSID beacon frame. Affected kernels fail to call ieee80211_mle_type_ok() before passing the element to ieee80211_mle_get_mld_id(), violating the helper's documented contract and allowing reads past the IE boundary. No public exploit exists and EPSS is 0.20% (10th percentile), but the attack requires only radio proximity to a device with Wi-Fi scanning active - no authentication and no user interaction needed.

Insufficient Multi-Link Element (MLE) common info length validation in the Linux kernel's IEEE 802.11 WiFi stack exposes adjacent-network attackers to high-impact memory corruption. Kernels from commit 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 onward failed to validate the advertised common-info length field for Reconfiguration and Priority Access MLE types - and also omitted the length octet when computing the minimum common size for Reconfiguration MLEs - meaning a malformed MLE frame crafted by a nearby attacker can trigger out-of-bounds access. The CVSS score of 8.8 (AV:A) and EPSS of 0.20% (10th percentile) together indicate high potential impact but no public exploit activity at time of analysis; no public exploit and no CISA KEV listing have been identified.

Remote kernel memory corruption in the Linux mac80211 WiFi subsystem allows an unauthenticated attacker within WiFi range to trigger out-of-bounds memory accesses by sending crafted 802.11 extension frames that bypass subtype validation and reach generic RX path code expecting regular 802.11 header layouts. Affected systems include any Linux host with an active mac80211-based WiFi driver across a broad range of kernel versions spanning 5.10 through pre-patch 7.x releases. The CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact at the kernel level; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Wrong MTD geometry is applied in the Linux kernel's mchp23k256 SPI SRAM driver when the chip is matched via the SPI id-table rather than via Device Tree, potentially exposing or corrupting unintended SRAM address regions. The driver's probe function calls of_device_get_match_data() exclusively, causing any non-OF SPI modalias match to silently fall back to the default mchp23k256_caps structure regardless of which part was actually selected by the SPI id-table, leading to incorrect chip capacity and address geometry. No public exploit exists and EPSS places this at the 7th percentile (0.17%), but the C:H/I:H/A:H CVSS impact flags reflect that incorrect geometry can expose the entire SRAM contents or allow out-of-bounds writes on affected embedded systems.

Kernel memory corruption in the Linux MTD raw NAND driver for NXP LPC32xx SLC hardware arises because lpc32xx_xmit_dma() silently discards the return value of wait_for_completion_timeout(), treating an expired DMA transfer as successful. The timed-out DMA engine can continue accessing a scatterlist buffer after it has been unmapped and potentially reused by the NAND read/write path, creating a use-after-free condition in kernel space. Exploitation requires local access to an embedded Linux system built on LPC32xx silicon with NAND flash; no public exploit has been identified and EPSS probability sits at 0.18% (7th percentile), indicating limited real-world exploitation interest.

The BPF verifier in the Linux kernel incorrectly accepts constant negative offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF pointer accesses, enabling a local attacker with BPF program loading privileges to perform out-of-bounds kernel memory reads and writes by bypassing the boundary enforcement in __check_buffer_access(). The regression was introduced when commit 022ac0750883 moved constant pointer offsets from reg->off to reg->var_off without updating the corresponding validation logic, leaving a signedness blind spot that allows programs with negative var_off values to load and attach to raw tracepoints undetected. No public exploit code has been identified at time of analysis and the vulnerability is absent from the CISA KEV catalog, but the well-documented commit trail makes independent derivation feasible for a skilled kernel researcher.

Uninitialized pointer dereference in the Linux kernel's `fwnode_init()` function exposes systems to local privilege escalation or kernel crash via a garbage `secondary` pointer in `struct fwnode_handle`. When firmware nodes are allocated on the stack or via non-zeroing heap allocators, `fwnode_init()` leaves `fwnode->secondary` containing arbitrary memory content; subsequent kernel functions such as `dev_to_swnode()` that check `IS_ERR_OR_NULL()` before dereferencing will silently proceed with the garbage pointer. Patches are confirmed available across all active stable kernel branches (5.15.x through 7.x); no public exploit code exists and this CVE is not listed in the CISA KEV catalog.

The Linux kernel's binder IPC driver contains a use-after-clear bug in binder_transaction() where lsmctx.len is re-read after security_release_secctx() has already zeroed the field via memset, causing sg_buf_end_offset to be inflated by the full aligned LSM security context size on every transaction to a txn_security_ctx binder node. This allows BINDER_TYPE_PTR scatter-gather copies to overrun into bytes already populated with the secctx data, enabling LSM security context disclosure and potential kernel buffer corruption. No public exploit or CISA KEV listing exists at time of analysis; the EPSS score of 0.17% reflects low current exploitation probability, though the low-privilege local attack vector is meaningful on Android where binder IPC is the foundational IPC mechanism.

Improper credential context in the Linux kernel's in-kernel SMB3 server (ksmbd) allows an attacker with an open SMB handle to have SET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION FSCTL operations executed under the ksmbd worker's credentials instead of the credentials captured when the file was opened. Because the underlying VFS xattr, fallocate and fileattr helpers revalidate inode permissions, ownership and LSM policy against those worker credentials rather than the SMB handle's access mask, an attacker can corrupt or zero file data and alter file attributes beyond what their handle should permit (CVSS 9.1, I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not in CISA KEV; the upstream fix is merged into stable kernels.

Unauthenticated information disclosure in Product Feed PRO for WooCommerce by AdTribes (WordPress plugin) before version 13.5.7 exposes sensitive WooCommerce store configuration to any remote party without credentials. A missing authorization check on a REST API read route allows retrieval of feed rules, filters, and field mappings - internal merchandising logic that store operators typically treat as proprietary business configuration. Additionally, the full product category taxonomy can be enumerated, enabling competitive intelligence gathering. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates low observed exploitation probability despite the straightforward unauthenticated attack vector.

Use-after-free / torn-entry race in the Linux kernel's Intel VT-d IOMMU driver (iommu/vt-d) lets the hardware walk a stale scalable-mode context entry pointing at freed PASID directory memory during device_pasid_table_teardown(), producing spurious DMA faults, unpredictable IOMMU behavior, and potential memory corruption. It affects Linux 6.8.2 through the 6.x/7.x stable series on systems using Intel scalable-mode (PASID) IOMMU translation. There is no public exploit identified at time of analysis and EPSS is low (0.16%), but the vendor-released fix is available in the stable trees.

Use-after-free in the Linux kernel's AF_RXRPC (rxrpc) networking subsystem lets a freed struct rxrpc_backlog be reused when kernel accept preallocation races against socket teardown. The flaw affects kernels using the rxrpc transport (notably kAFS/AFS clients) prior to the fixed stable releases; a kernel worker calling rxrpc_kernel_charge_accept() reads rx->backlog with no lock while rxrpc_discard_prealloc() concurrently NULLs and frees it, corrupting backlog head/tail pointers and array slots. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.16% (5th percentile).

Memory corruption in the Linux kernel's rxrpc networking subsystem (rxgk/GSS Kerberos security class) affects kernels from 6.16 onward, where rxgk_issue_challenge() frees the page holding challenge content before a tracepoint reads the wire header (whdr) that still points into that freed page, creating a use-after-free. The flaw is patched in stable releases 6.18.40, 7.1.5 and 7.2-rc1, and is triggerable only where the rxrpc RxGK security class is active (primarily kAFS deployments). There is no public exploit identified at time of analysis, and the EPSS score is very low at 0.15% (5th percentile), indicating negligible observed exploitation interest.

Null-pointer dereference in the Linux kernel's rxrpc subsystem allows a remote unauthenticated attacker to crash the kernel by sending a forged ACKALL control packet to an exposed rxrpc service. Affected systems run Linux from commit b341a0263b1b804d329f864c2dc24815364510ec through the fixes landed in stable releases 6.18.40 and 7.1.5; Linux 6.14 is explicitly confirmed affected. No public exploit has been identified and EPSS probability is very low at 0.15%, but the network-accessible, no-authentication attack path warrants immediate patching on any system actively serving rxrpc traffic.

Kernel panic via rxrpc protocol mishandling in the Linux kernel allows a network-positioned attacker to crash an AFS client system by sending a premature reply DATA packet before any request packets have been transmitted on a client call. The flaw resides in rxrpc_receiving_reply(), which fails to verify call exposure state before invoking rxrpc_rotate_tx_window() - a function whose do...while loop oopses on an empty transmit queue. Fixes have been backported to stable branches 7.1.5 and 6.18.40; no public exploit has been identified and EPSS exploitation probability is extremely low at 0.15% (5th percentile), indicating no known active exploitation.

Denial of service (and potential memory corruption) in the Linux kernel's AF_RXRPC networking stack stems from a double unlock in rxrpc_recvmsg() triggered while handling out-of-band (OOB) messages, affecting kernels from roughly 6.16 up to the fixed 6.18.40, 7.1.5 and 7.2-rc1 releases. Releasing an already-released lock corrupts kernel lock state and can crash the host or open a race window. No public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile).

Use-after-free / stale work-item race in the Linux kernel's kAFS (Andrew File System client) network-namespace teardown path allows a use-after-free when an afs netns is destroyed. Fixed upstream (this issue was found by AI review), the flaw stems from afs_charge_preallocation() and afs_rx_new_call() failing to stop the rxrpc preallocation 'charger' work item before incoming calls are disabled during net-namespace deletion, so the charger can run against freed/torn-down state. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and it is not in CISA KEV, so this is a correctness/stability defect far below the raw CVSS 9.8 rating.

Denial-of-service in the Linux kernel's AFS (Andrew File System) cache manager allows remote attackers to crash or destabilize systems running AFS by sending a crafted CB.InitCallBackState3 callback request that arrives without an associated server record. The CB.InitCallBackState3 handler failed to perform the null-check present in all other callback handlers, meaning an unexpected or spoofed callback packet lacking a peer-to-server mapping causes a kernel-level fault. No public exploits have been identified, and EPSS places exploitation probability at just 0.16% (5th percentile), reflecting the niche deployment footprint of AFS.

Improper bounds enforcement in the Linux kernel's accel/amdxdna driver allows a local low-privileged user to trigger a kernel-to-userspace copy that exceeds the application-provided buffer size via a crafted ioctl call. The root cause is that copy_to_user() was using the kernel's internal data size rather than the caller-supplied buffer size to bound the copy, enabling overflow into adjacent userspace memory and exposure of unintended kernel data. No public exploit exists and no active exploitation has been confirmed, but the CVSS vector (C:H/I:H) reflects a real dual-impact risk: confidentiality loss from kernel memory spillover and integrity loss from overwriting adjacent user-space structures.

Type confusion in the rtw89 PCI Advanced Error Reporting (AER) handlers corrupts kernel memory on Linux systems equipped with Realtek RTL8852CE and related WiFi adapters. The driver stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() incorrectly retrieve it as a net_device pointer, causing netif_device_detach/attach to read and write at wrong memory offsets within a misidentified kernel struct. An adjacent-network attacker within WiFi range could potentially trigger the faulty AER handler path by inducing hardware-level PCI errors via crafted 802.11 frames, resulting in kernel memory corruption. No public exploit exists and EPSS is 0.17% (6th percentile), indicating low observed exploitation activity despite a high CVSS score of 8.8.

Type confusion in the rtw88 Realtek PCIe Wi-Fi driver's PCI Advanced Error Reporting (AER) handlers allows an adjacent-network attacker to corrupt kernel memory, potentially enabling privilege escalation or arbitrary kernel code execution on Linux systems using Realtek PCIe Wi-Fi hardware. The driver stores an ieee80211_hw pointer via pci_set_drvdata() at probe time but retrieves it as a net_device pointer in io_error_detected() and io_resume(), causing netif operations to read and write kernel memory at incorrect struct offsets. No public exploit code has been identified, EPSS places exploitation probability at 0.17% (6th percentile), and the vulnerability is not listed in CISA KEV.

Out-of-bounds array indexing in the Linux kernel's rtw89 WiFi driver exposes systems using Realtek 802.11ax hardware to kernel memory corruption or disclosure from adjacent network attackers. The driver accepts an 8-bit mac_id (range 0-255) from firmware-processed RX descriptors and uses it without validation to index into assoc_link_on_macid[], which contains only 128 entries - creating a 128-entry gap where attacker-controlled values trigger reads or writes beyond the array boundary. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at 0.17% (6th percentile), but the CVSS 8.8 score reflects the full kernel memory impact achievable by an unauthenticated adjacent attacker.

Out-of-bounds array access in the Linux kernel's ath9k WiFi driver allows an adjacent network attacker to trigger kernel memory corruption via a maliciously crafted firmware transmit status queue ID. The ath_tx_edma_tasklet() function blindly indexes sc->tx.txq[] using a 4-bit hardware field (range 0-15) against an array of only 10 entries (ATH9K_NUM_TX_QUEUES), meaning any qid value of 10 or greater causes an OOB memory access with potential for high confidentiality, integrity, and availability impact. No active exploitation is confirmed (not in CISA KEV), and EPSS stands at 0.18% (7th percentile), but the adjacent-network, no-authentication attack vector keeps this relevant for environments running Atheros 802.11n hardware.

Denial of service in the Linux kernel's VXLAN driver stems from a race condition in vxlan_gro_prepare_receive(): udp_tunnel_sock_release() can set sk->sk_user_data to NULL while GRO processing is mid-flight, producing a NULL-pointer dereference and kernel panic. It affects hosts using VXLAN overlay tunnels across numerous stable branches, is fixed upstream, and has no public exploit identified at time of analysis (EPSS 0.17%). The published NVD CVSS of 9.8 (C:H/I:H/A:H) overstates impact - the actual effect is a crash, not code execution or data disclosure.

Reference count corruption in the Linux kernel's Operating Performance Points (OPP) subsystem exposes systems to memory corruption and potential privilege escalation via a race condition between OPP object addition and frequency lookup. Affected kernels from 4.11 through stable branches predating commits to 7.1.5 and 6.18.40 are vulnerable when concurrent DVFS (Dynamic Voltage and Frequency Scaling) operations race during OPP table construction. No public exploit exists and EPSS sits at 0.17% (6th percentile), suggesting no known widespread exploitation; however, the H/H/H CVSS impact reflects the severity of kernel memory corruption if triggered.

Incorrect NULL-check ordering in the Linux kernel's crypto/ccp driver exposes AMD SEV-SNP systems to kernel memory corruption during Trusted I/O firmware initialization. On architectures without HASHED_PAGE_VIRTUAL, passing the return value of __snp_alloc_firmware_pages() directly to page_address() before checking for NULL causes page_address(NULL) to return a deterministic but invalid non-zero address, silently bypassing the allocation-failure guard and allowing sev_tsm_init_locked() to dereference garbage memory. Affected kernel versions span from commit 4be423572da1f4c1 through the patched releases (7.1.5, 7.2-rc1, 6.19); no public exploit identified at time of analysis, and EPSS is 0.16% (5th percentile), consistent with zero confirmed in-the-wild exploitation.

Use-after-free in the Linux kernel's DLM (Distributed Lock Manager) subsystem stems from incorrect sequence-number ordering of message handles in a node's send_queue, which breaks the before(mh->seq, seq) tail-walk in dlm_receive_ack and leads to refcounting corruption and freeing of an in-use send buffer. It affects Linux kernels using DLM (clustered filesystems such as GFS2/OCFS2) from 5.14 onward, and is fixed in stable releases 6.6.145, 6.12.97, 6.18.40 and 7.1.5. Despite a headline CVSS of 9.8, EPSS is only 0.17% (6th percentile), there is no public exploit, and it is not on CISA KEV - the reporter only reproduced it on an experimental branch with an io_uring userspace benchmark.

Denial of service (and potential memory corruption) in the Linux kernel IPv6 stack arises from a race condition in addrconf_dad_failure() where ifp->lock is transiently dropped, letting a concurrent ipv6_del_addr() poison a list entry that Duplicate Address Detection (DAD) work then dereferences, producing a general protection fault in ipv6_del_addr(). The flaw affects the addrconf DAD-failure path across a broad range of kernel versions and is fixed by folding the state transition into a single locked critical section. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%), and it is not listed in CISA KEV.

Resource leak and premature mutex use in the Linux kernel's mlx5 InfiniBand driver (IB/mlx5) expose systems with Mellanox/NVIDIA ConnectX hardware to local privilege escalation, denial of service, and potential information disclosure. When mlx5_ib_alloc_transport_domain() successfully allocates a transport domain (TD) but mlx5_ib_enable_lb() subsequently fails, the TD object is never freed, leaking kernel memory. Compounding this, the loopback mutex (dev->lb.mutex) was initialized too late - after code paths that could use it - creating a window for undefined kernel behavior. No public exploit exists and EPSS sits at 0.17% (7th percentile), placing real-world risk well below the CVSS 7.8 headline score.

Resource leak and potential mutex deadlock in the Linux kernel's RDMA/mlx5 driver (UMR XLT cleanup path) enables denial-of-service conditions on systems using Mellanox/NVIDIA ConnectX RDMA adapters. The vulnerability exists from commit 1efe8c0670d6a6883faa09c9abc746c741f5664a onward, including Linux 6.16, where a fallible error path in mlx5_odp_populate_xlt() skips the mandatory DMA buffer and XLT mapping cleanup performed by mlx5r_umr_unmap_free_xlt(), and if the emergency XLT page code path was taken, permanently locks xlt_emergency_page_mutex. EPSS is very low at 0.18% (8th percentile), no public exploit code exists, and the vulnerability is not listed in CISA KEV, but RDMA-enabled HPC, storage, and financial infrastructure running affected kernel versions should prioritize patching.

Use-after-free in the Linux kernel's ALSA OSS sequencer subsystem allows a local low-privileged attacker to corrupt kernel heap memory by racing SysEx MIDI event dispatch against concurrent sequencer port closure. The vulnerable code path in snd_seq_oss_process_event() stores a raw pointer to SysEx byte data in the event record without retaining a refcount across the full dispatch lifecycle, enabling freed memory to be accessed in snd_seq_event_dup() if the OSS MIDI port is closed before dispatch completes. Vendor-released patches are available at kernel versions 6.18.40 and 7.1.5; no public exploit code and no active exploitation have been identified at time of analysis.

Use-after-free and NULL-pointer dereference in the Linux kernel ALSA sequencer MIDI subsystem allows a local low-privileged user to crash the kernel or potentially escalate privileges by racing MIDI output event processing against port teardown. The flaw exists because `event_process_midi()` reads `msynth->output_rfile.output` without holding any lock, while `midisynth_unuse()` can concurrently free `substream->runtime` before `snd_rawmidi_kernel_write1()` pins its buffer reference - leaving the event path with a dangling pointer confirmed via KASAN null-ptr-deref reproduction. No public exploit identified at time of analysis, and EPSS of 0.17% (7th percentile) signals low current exploitation interest despite the 7.8 CVSS score.

Resource leakage in the Linux kernel's NVMe-over-TCP target subsystem (nvmet-tcp) allows unauthenticated network clients to exhaust kernel queue and socket resources by manipulating a TLS handshake. The flaw in `nvmet_tcp_tls_handshake_done()` ignores the return value of `nvmet_tcp_set_queue_sock()`, so if the socket leaves TCP_ESTABLISHED state during handshake completion - a condition an attacker can induce by timing a connection abort - resources are never cleaned up. No public exploit is identified and EPSS is 0.17%, but repeated triggering can deny service to storage infrastructure running nvmet-tcp with TLS configured.

Kernel memory (bio structure) leak in the Linux md/raid10 driver occurs when a discard operation reuses an r10bio object previously used for a read. Because put_all_bios() only releases the replacement bio (repl_bio) when read_slot is negative, a reused r10bio with a stale non-negative read_slot skips the bio_put() on repl_bio, leaking kernel memory on RAID10 arrays that have replacement/spare devices and receive discard (TRIM) traffic. There is no public exploit identified at time of analysis, and EPSS risk is very low (0.17%, 7th percentile).

Deadlock vulnerability in the Linux kernel md/raid1 and md/raid10 drivers can freeze systems running software RAID1 or RAID10 under concurrent memory pressure. The flaw causes incorrect GFP flag selection during block I/O error recovery - the kernel uses GFP_NOIO instead of GFP_NOIO|__GFP_HIGH after a failed bio is split and resubmitted, starving memory reclaim of emergency reserves and causing a kernel deadlock. No active exploitation has been identified (not in CISA KEV), and EPSS at 0.15% reflects low opportunistic risk; however, storage servers, hypervisors, and database hosts using Linux software RAID should prioritize patching to kernel 7.1.5 or 7.2-rc1.

Inconsistent arvif state management in the Linux kernel's ath12k Qualcomm WiFi 7 driver exposes local low-privileged users to kernel memory corruption, information disclosure, and system crash via stale pointer dereference. Three distinct error paths in ath12k_mac_vdev_create() fail to clear or properly unwind arvif->ar and associated vdev/peer state, leaving the driver operating against ghost structures never confirmed in firmware. No public exploit identified at time of analysis, and EPSS probability sits at 0.15% (5th percentile), reflecting low near-term exploitation likelihood despite the 7.8 CVSS score.

Use-after-free in the Linux kernel BPF filesystem (bpffs) inode lifecycle exposes freed kernel memory during concurrent path traversal, enabling local attackers with low privileges to crash the kernel or potentially escalate privileges. The flaw was introduced by commit 4f375ade6aa9, which incorrectly removed the RCU grace-period delay protecting inodes and cached symlink bodies accessible via concurrent RCU pathwalk operations (pick_link, may_lookup). KASAN confirmed the slab-use-after-free at inode offset +2 (i_opflags). No public exploit has been identified and EPSS is very low at 0.17% (7th percentile), with no CISA KEV listing.

Out-of-bounds access in the Linux kernel NVMe Flexible Data Placement (FDP) code allows an attacker who can submit NVMe commands to read beyond the fdpcidx configuration array. An off-by-one in the fdpcidx bounds check (using '>' instead of '>=' against n = NUMFDPC + 1) accepts an index one element past the valid range, tagged by intelligence sources as an information-disclosure issue. Affects Linux 6.16 through the fix; no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile), and the published CVSS 9.8 network vector appears inflated relative to the local/fabric-scoped nature of NVMe command handling.

Livelock in the Linux kernel's vhost-net subsystem can cause a host denial-of-service against KVM virtualization environments when mergeable receive buffers (VIRTIO_NET_F_MRG_RXBUF) are negotiated between host and guest. The defect in `vhost_get_avail_idx` propagates an incorrect return value through `vhost_enable_notify`, causing the host vhost kernel thread to spin in an immediate disable-then-retry notification loop when the guest is not consuming virtio ring entries fast enough. No public exploit code exists and EPSS stands at 0.17% (6th percentile), but the CVSS Scope Changed (S:C) metric confirms cross-VM-boundary impact on the hypervisor host, making this a meaningful availability risk for KVM-based virtualization fleets.

RB-tree corruption in the Linux kernel iommu/vt-d driver allows a privileged local attacker to corrupt kernel memory structures during device probe error handling, leading to potential kernel panic, privilege escalation, or information disclosure. Affected systems must have Intel VT-d IOMMU enabled and encounter a device that does not support Address Translation Services (ATS) followed by a probe step failure. No public exploit code has been identified and no CISA KEV listing exists, but the Changed Scope (S:C) CVSS flag signals that kernel-level corruption can cascade across process and subsystem boundaries. Upstream fixes are available in stable branches targeting kernel 6.18.40, 7.1.5, and 7.2-rc1.

Local privilege escalation in the Linux kernel's BPF arena subsystem arises from zap_pages() invoking zap_vma_range() without first acquiring the owning mm's mmap_lock, creating a lock-ordering race condition against arena_vm_close() and arena_map_mmap(), both of which acquire mmap_write_lock before arena->lock in reverse order. A low-privileged local user capable of loading BPF programs on affected Linux 6.9+ systems can exploit this AB-BA deadlock opportunity or operate on stale VMA pointers after concurrent unmapping, potentially corrupting kernel memory and escalating privileges. No public exploit code has been identified at time of analysis, and EPSS scores place current exploitation probability at a low 0.15%.

Out-of-bounds kernel memory read in the Linux kernel's ocfs2 filesystem allows disclosure of adjacent kernel data when a maliciously crafted or corrupted ocfs2 volume is mounted and a fast symlink is read. ocfs2_validate_inode_block() failed to validate zero-cluster (fast) symlink dinodes, so ocfs2_fast_symlink_read_folio() would strnlen()/memcpy an inline payload whose i_size exceeds the inline area or lacks a terminating NUL, copying past the inode block buffer (KASAN flagged a 3905-byte over-read via readlink). No public exploit identified at time of analysis; EPSS is low at 0.15% (5th percentile) and the issue is not in CISA KEV.

Integer underflow in the ocfs2 filesystem's FITRIM implementation allows a local low-privileged user to corrupt filesystem data or trigger a crash by submitting a trim range shorter than one cluster. The validation in ocfs2_trim_mainbm() checks against sb->s_blocksize instead of s_clustersize; on filesystems where cluster size exceeds block size, a range that passes the block-size check gets shifted to len==0, after which pointer arithmetic involving start + len - 1 and len -= ... underflows, driving the trim operation past the requested bounds. No public exploit has been identified at time of analysis, and EPSS is 0.18% (7th percentile), consistent with its low real-world exploitation priority.

Kernel memory corruption in the Linux RDMA/siw (soft-iWARP) driver lets a remote peer trigger a slab use-after-free during connection setup: siw_socket_disassoc() can drop the last reference on an endpoint and free it, after which siw_cm_work_handler() still dereferences the stale endpoint pointer. The demonstrated impact is a KASAN-confirmed use-after-free crash after a malformed MPA request, exploitable only where the siw module is loaded and an iWARP listener is active. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile) with no CISA KEV listing, so the 9.8 NVD score overstates practical risk for typical deployments.

Stale red-black tree node linkage in the Linux kernel BPF subsystem enables a use-after-free condition when a refcounted BPF object survives teardown of its owning rbtree root and that root's memory address is subsequently reused. Local attackers with BPF-capable low-privilege accounts can exploit the incorrect owner validation in bpf_rbtree_remove() to trigger rb_erase_cached() against stale, invalid tree pointers, potentially achieving kernel memory corruption with full confidentiality, integrity, and availability impact. No public exploit code has been identified and EPSS sits at the 6th percentile; patch commits are available across multiple stable branches.

Race condition in the kernfs xattr subsystem of Linux kernel 7.1 and earlier allows local low-privileged users to corrupt shared xattr structures across multiple superblocks, resulting in high-impact confidentiality, integrity, and availability compromise. The flaw arises specifically in namespace-multiplexed environments where kernfs_test_super() allows distinct superblocks to share a single kernfs_node while VFS locking remains per-inode and therefore insufficient. No public exploit has been identified at time of analysis; EPSS probability is 0.15% (5th percentile), indicating that despite the high CVSS score, widespread exploitation is currently assessed as unlikely.

Out-of-bounds heap read in the Linux kernel's wcn36xx WiFi driver exposes kernel memory and risks system crashes on any adjacent-network attacker within radio range of a device using a Qualcomm WCN36xx series chipset. The flaw, introduced at commit 43efa3c0f241e04862be8e6a68ff765d36cde1ba (Linux 4.11 era), allows the PRINT_REG_INFO firmware indication handler to iterate over rsp->regs[] using a firmware-controlled rsp->count value that is never validated against the actual received message length, enabling reads beyond the heap-allocated buffer. No public exploit has been identified and EPSS is very low at 0.18% (7th percentile), but the CVSS 8.1 score and the availability of patches across seven stable branches make this a concrete patch priority for platforms running Qualcomm WCN36xx hardware.

Race condition exploitation in the Linux kernel's RDMA/nldev subsystem allows a local low-privileged attacker to trigger a use-after-free or stale pointer dereference via racy access to the mr->pd pointer during concurrent rereg_mr and nldev introspection operations, with potential for kernel memory corruption yielding high confidentiality, integrity, and availability impact. The flaw affects Linux 4.18 and later on any system with RDMA-capable hardware, with upstream fixes committed to stable branches at 7.1.5 and 7.2-rc1. No public exploit code exists and EPSS exploitation probability is very low at 0.15%, consistent with the specialized hardware requirement and race timing dependency.