Information Disclosure

Local privilege escalation in the Linux kernel's SMB client witness notification handler allows a low-privileged attacker to exploit a use-after-free condition. Affected are Linux kernel versions 5.11 and later that have the CIFS witness feature enabled. Successful exploitation can lead to arbitrary code execution with elevated privileges, fully compromising the system.

Use-after-free vulnerability in the Linux kernel's ksmbd SMB server allows remote attackers to execute arbitrary code. All kernel versions with ksmbd enabled from early commits up to the patched releases are affected, and the issue can be triggered by concurrent QUERY_DIRECTORY requests on the same file handle. A fix is available via multiple stable kernel branches, no active exploitation is reported in KEV, and EPSS indicates a low probability of widespread exploitation (0.21%).

Use-after-free in Linux kernel’s ksmbd SMB server occurs during deferred byte-range lock cancellation, allowing an authenticated attacker to potentially execute arbitrary code or crash the system. The vulnerability affects ksmbd versions prior to the released fixes (6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, 7.2-rc1). No active exploitation has been confirmed (no CISA KEV listing), and EPSS indicates a low probability of widespread exploitation.

Unauthorized information disclosure in Linux kernel's ksmbd module allows remote unauthenticated attackers to copy arbitrary file contents on SMB shares by exploiting a missing access check on the FSCTL_DUPLICATE_EXTENTS_TO_FILE operation. Attackers with only attribute access to a source file can read its contents without requiring the FILE_READ_DATA permission. No public exploit or active exploitation has been identified, though the vulnerability is patchable via kernel updates.

Unauthorized file modification in the Linux kernel's ksmbd SMB server allows remote attackers to modify file data and attributes by exploiting a credential confusion in SMB2 SET_INFO handlers. The vulnerability arises because the VFS operations used after permission checks run with the ksmbd worker credentials rather than the opener's credentials, effectively bypassing ownership and permission restrictions. No public exploit is known and EPSS is low (0.21%), but the network-accessible, low-complexity nature makes critical

Unauthorized read/write of Alternate Data Streams in Linux ksmbd allows remote attackers to access or modify file extended attributes. The vulnerability, present in Linux kernel versions with ksmbd up to before patches 6.18.39, 6.12.96, 7.1.4

Memory corruption in the Linux kernel's ksmbd SMB server allows authenticated remote code execution. A race condition in byte-range lock ownership tracking can lead to use-after-free when SMB3 multichannel is enabled, enabling an attacker with low privileges to escalate to full system compromise. No public exploit or active exploitation is known, and EPSS indicates low exploitation probability.

Double-free memory corruption in the Linux kernel SMB client when processing SMB2 QUERY_DIRECTORY responses. A remote attacker acting as a malicious SMB server can trigger the issue during directory enumeration, potentially leading to arbitrary code execution or denial of service on any unpatched Linux system that mounts an attacker-controlled share. The vulnerability is not known to be actively exploited, but patches are available across multiple stable kernel branches.

Double free in the Linux kernel's SMB client due to improper cleanup of response buffers when a reply error is replayed. An attacker controlling an SMB server can trigger memory corruption, potentially leading to code execution or a system crash, when a vulnerable client connects and processes a crafted response. Patches are available in multiple stable kernel branches, but no active exploitation or public exploit has been reported.

Double-free vulnerability in the Linux kernel's SMB client (cifs) allows remote code execution via crafted SMB2_ioctl replies. An attacker hosting a malicious SMB server can trigger a replay path memory double-free, leading to full system compromise. No active exploitation or public exploit has been identified at this time; EPSS score is low (0.21%).

Double-free memory corruption in the Linux kernel's SMB client (cifs) affects the SMB2_flush() replay path across many stable branches prior to 6.6.145, 6.12.96, 6.18.39 and 7.1.4. When a mounted client receives a replayable flush response and the subsequent retry fails before cifs_send_recv() installs a replacement response, flush_exit frees the stale response buffer a second time, corrupting kernel slab memory and typically crashing the client. No public exploit is identified at time of analysis (EPSS 0.21%, 11th percentile) and it is not in CISA KEV; exploitation requires a malicious or man-in-the-middle SMB server plus a replay/retry timing race, making it primarily a denial-of-service concern despite the 9.8 rating.

Double-free in the Linux kernel SMB client's SMB2_open() replay handler allows remote attackers to corrupt memory by inducing a user to mount a malicious SMB share. The flaw affects unpatched kernel versions with the cifs module loaded and can lead to arbitrary code execution, information disclosure, or denial of service. No active exploitation has been reported (not in CISA KEV), and EPSS score is 0.21%, indicating low exploitation probability; official kernel patches are available.

Out-of-bounds read in the Linux kernel's SMB/CIFS client POSIX SID parser allows a malicious or MITM SMB server to cause kernel memory disclosure and denial of service on connecting clients. The `posix_info_sid_size()` helper reads `sid[1]` (the SubAuthorityCount byte) after validating only one remaining byte, permitting a truncated server-supplied POSIX SID to trigger a one-byte OOB read - leaking a byte of kernel heap context (C:L) and risking a crash (A:H). No public exploit code exists and EPSS is 0.22%, but the vulnerability is client-facing and triggered entirely from the server side without client-side privilege. Patches are available across all maintained stable branches.

Improper mode masking in the Linux kernel SMB client when the modefromsid mount option is used allows a remote attacker to cause denial of service and limited integrity impact via a crafted SMB response. The vulnerability arises because parse_dacl() fails to mask server-provided mode bits to 07777, potentially setting unexpected permission bits on files. No public exploit is identified at time of analysis.

Privilege escalation in the Linux kernel /proc filesystem allows a local attacker to bypass ptrace access restrictions when reading symbolic links in /proc/[pid]/fd/. By racing the task lookup and access check, an unauthenticated local user can gain unauthorized read and write access to sensitive file descriptors of other processes, potentially leading to full system compromise. The vulnerability affects a wide range of kernel versions and has a patch released by the Linux kernel project.

Local privilege escalation in the Linux kernel's pcc-cpufreq driver allows a low-privileged user to gain full root privileges. The vulnerability is a use-after-free and double-free flaw when evaluating ACPI _OSC negotiation, affecting all kernel versions from 2.6.34 until the fixed stable releases (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1). No active exploitation or public exploit has been identified, and EPSS indicates a low probability of widespread exploitation.

Memory disclosure in the Linux kernel's SLUB allocator allows local attackers to read uninitialized kernel memory when specific slab debugging options are enabled. The issue occurs when red zoning is active without store_user tracking, causing krealloc() to violate the __GFP_ZERO contract and return partially zeroed allocations. This can leak sensitive data, with an EPSS probability of 0.21% and no known active exploitation, though a vendor patch is available.

Use-after-free in the Linux kernel HID appleir driver allows a local attacker to corrupt kernel memory during device removal, potentially achieving privilege escalation. The race condition exists between the key_up_timer callback (armed by appleir_raw_event() on each keydown/key-repeat) and hid_hw_stop(), which frees the underlying input_dev before the timer is drained. A second race window, where a USB URB completion during hid_hw_stop() can re-arm the timer via mod_timer(), means a simple teardown reorder is insufficient — the fix introduces a spinlock-gated 'removing' flag combined with timer_shutdown_sync() to permanently disable further callbacks. No public exploit has been identified at time of analysis, and EPSS is 0.22% (13th percentile).

An out-of-bounds memory access in the Linux kernel's BPF devmap broadcast redirect for XDP frames, introduced in version 5.14, can be triggered by remote unauthenticated attackers sending specially crafted fragmented network packets. This could lead to kernel memory corruption and arbitrary code execution. Though CVSS rates this as critical (9.8), no public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.21%).

Arbitrary code execution in the Linux kernel's BPF BTF parser allows local privilege escalation. Malformed BTF data can cause an integer overflow in the repeated field count calculation, bypassing a capacity check and leading to a heap buffer overflow. With low EPSS score (0.21%), widespread exploitation is currently unlikely, but unprivileged local users who can load BPF programs are at risk of complete system compromise.

Use-after-free and memory leak in the Linux kernel's EHCI and FOTG210 USB isochronous submit paths expose systems running kernel versions from 2.6.15 through 7.1.3 to local kernel memory corruption by a low-privileged user. When an isochronous URB submission fails before the staged schedule handoff - either because the host controller becomes inaccessible or usb_hcd_link_urb_to_ep() returns an error - the ehci_iso_sched allocation is not freed and urb->hcpriv retains a dangling pointer, creating a UAF condition. No public exploit exists and the EPSS score is 0.21% (12th percentile), but vendor-released patches across multiple stable branches are available and should be applied to eliminate the risk.

Use-after-free in the Linux kernel's USB ldusb driver allows a local unprivileged user to corrupt kernel memory by racing disconnect() against release() on a connected USB device. The root cause is that mutex_unlock() is documented as non-atomic and may access the mutex object after it logically releases the lock, creating a window where the driver data structure can be freed while still in use. No public exploit has been identified at time of analysis, and EPSS is low (0.22%), but the C:H/I:H/A:H CVSS impact vector reflects the potential for full kernel privilege escalation if successfully triggered.

Slab out-of-bounds read in the Linux kernel usbio USB driver (drivers/usb/misc/usbio) leaks adjacent kernel heap memory to local unprivileged processes via the i2c subsystem. The flaw lies in usbio_bulk_msg(), which validates the device-supplied payload length against the TX buffer size rather than the smaller RX buffer size, allowing a malicious USB device with mismatched endpoint wMaxPacketSize values to drive memcpy() past the end of the rxbuf slab object. Over-read kernel heap bytes propagate through the i2c layer to userspace via i2c-dev, and under KASAN-enabled kernels the bug is reported as a slab-out-of-bounds crash. No public exploit has been identified at time of analysis; the bug was found by code review and confirmed with a userspace AddressSanitizer model and a USB raw-gadget plus dummy_hcd kernel reproducer.

Use-after-free in the Linux kernel's USB Type-C UCSI CCG driver allows a local attacker with low privileges to corrupt kernel memory, potentially achieving arbitrary kernel code execution. The flaw exists in the module teardown path of the Cypress CCG UCSI driver: ucsi_ccg_remove() calls ucsi_destroy() - which kfree()s the ucsi object - before calling free_irq(), leaving a window in which the threaded IRQ handler ccg_irq_handler() can access the freed ucsi struct via ucsi_notify_common(). No public exploit code exists and the bug was discovered by static analysis; EPSS is 0.22% (13th percentile), reflecting no observed in-the-wild activity.

Heap-based out-of-bounds read in the Linux kernel's nvmet discovery log page handler allows unauthenticated remote attackers to leak kernel memory or crash the host. Any system acting as an NVMe over Fabrics target with a discovery service exposed via TCP, RDMA, or FC is vulnerable. No active exploitation or public exploit code is reported at this time, and EPSS probability is low (0.25%), but the impact and ease of exploitation make remediation urgent for affected storage targets.

Out-of-bounds heap read in the Linux kernel's nvmet-auth module allows pre-authentication remote attackers to read up to 526 bytes of heap memory beyond a crafted DHCHAP_REPLY message. By sending an NVMe-oF authentication reply with a small transfer length but inflated hash and DH value length fields, an unauthenticated attacker can extract sensitive data or cause a denial-of-service. Patches are available in upstream stable kernels.

We are tasked with synthesizing data from multiple sources about CVE-2026-64318 into a comprehensive analysis, returning a JSON object with specified fields. Let's carefully parse the provided information. CVE-2026-64318: In the Linux kernel, a vulnerability in the AIX partition handling. The description: "aix_partition() reads the physical volume descriptor... pp_count is unvalidated, so a crafted AIX image with pp_count > 1016 drives an out-of-bounds read... bound the scan to array size." From description: - Product: Linux kernel, specifically the partition handling for AIX disks (block/partitions/aix.c). So product_name: "Linux Kernel". - CVSS Score: 7.1, Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - CWE: N/A - EPSS: 0.22% (percentile 13%) - Patch: Available from vendor - Tags: Linux, IBM, Information Disclosure - KEV status: not mentioned (likely not KEV). POC? Not mentioned. So no active exploitation or public exploit identified from data. - CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (but note: Linux kernel is typically "o:linux:linux_kernel", but given as "a" application? The data says "cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*". We'll use it as is, but product_name Linux kernel is correct.) - Affected versions: We have a list of git commit ranges and patches. We can extract the fix versions: mention specific stable versions patched: 7.1.4, 6.18.39, 5.15.212, 5.10.261, 7.2-rc1, 6.6.145, 6.12.96, 6.1.178, and the initial commit from 3.11. So the vulnerability was introduced long ago (Linux 3.11) and fixed in multiple stable branches. The description mentions "Linux 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 < ..." which is the commit that fixed it? Possibly the fix commit. The EUVD entries give commit ranges where the vulnerability exists. We'll synthesize: Affected: Linux kernel versions from 3.11 up to before the fix in the 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1, 7.2 series. So we can say "Linux kernel versions prior to the patched releases: 5.10.261, 5.1

Information disclosure in the Linux kernel's isofs filesystem driver allows a local attacker to leak up to 255 bytes of kernel heap memory to userspace by mounting a crafted ISO 9660 image. Because

Information disclosure in the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver can expose cryptographic key material via debug logs when CONFIG_DYNAMIC_DEBUG is enabled. A local attacker with low privileges could capture hex dumps of keys from kernel ring buffer, leading to full compromise of confidentiality, integrity, and availability. Patches are available in multiple stable kernel branches; no active exploitation or public exploit code has been identified.

Denial of service in the Linux kernel's pcrypt crypto template allows remote unauthenticated attackers to crash the system by triggering a faulty fallback path. When the parallel execution via padata fails (e.g., due to resource pressure), the pcrypt module does not restore the original callback, leading to unsafe execution of the parallel-only completion routine and kernel memory corruption. The vulnerability has a low EPSS score (0.22%, 13th percentile), no public exploit or active exploitation, and patches are available in multiple stable kernel series.

Use-after-free and missing forward security in the loongson-rng crypto driver of the Linux kernel allow a local, low-privilege attacker to corrupt memory and potentially execute arbitrary code, compromise system integrity, or read sensitive information. Affected systems are primarily Loongson-based machines running kernels between v6.18 and the respective fix versions; the driver itself is unused by any in‑kernel consumer and is being removed entirely rather than patched. No active exploitation or public exploit code is known, and the EPSS exploitation probability is low (0.21%).

Use-after-free and list corruption in the Linux kernel's Intel QuickAssist Technology (QAT) crypto driver allows a local low-privileged attacker to trigger kernel memory corruption by racing concurrent service registration and device lifecycle operations. The crypto/qat subsystem's service_table linked list is guarded by service_lock only during insertions and deletions, but seven device-state functions iterate the list unprotected, enabling a concurrent adf_service_register() or adf_service_unregister() call to mutate the list mid-traversal. Exploiting this race can result in kernel crash, arbitrary kernel memory read, or local privilege escalation to root. No public exploit code has been identified and EPSS stands at 0.21% (11th percentile), but the impact class is high for systems running QAT-capable Intel hardware.

Out-of-bounds slab read in the Linux kernel tracing subsystem allows a local attacker with access to the trace event filter interface to leak kernel slab memory or crash the kernel. The flaw exists because `regex_match_glob()` ignores the bounded length passed by filter predicate functions and calls the NUL-terminated-string-only `glob_match()`, which scans past the end of non-NUL-terminated dynamic string fields - exemplified by XFS namespace tracepoints whose dynamic char arrays are copied without a trailing NUL. EPSS is 0.22% (13th percentile); no public exploit code exists and the vulnerability is not listed in CISA KEV.

Unauthorized file truncation in the Linux kernel's NFSv4 client allows local attackers to bypass write permission checks when opening a file with O_RDONLY|O_TRUNC. By exploiting a missing MAY_WRITE permission mask during cached delegated opens, an attacker without write access can truncate files, causing data loss. No public exploit or active exploitation has been identified, and EPSS indicates a 0.22% exploitation probability.

We are tasked to synthesize a comprehensive analysis for CVE-2026-64293. Need to output JSON. Given data: - CVE ID: CVE-2026-64293 - Description: long description about iommufd veventq read bug with sizeof(hdr) vs sizeof(*hdr). On 32-bit, under-counts header size, leading to buffer overflow past user-supplied buffer. - CVSS: 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CWE: N/A (but we can infer CWE-131: Incorrect Calculation of Buffer Size? Or maybe CWE-682: Incorrect Calculation? Not given.) - EPSS: 0.21% (percentile 11%) — low exploitation probability. - Patch: Available from vendor. - Reported by: Linux (likely Linux kernel) - CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (all versions) - Tags: Linux, Information Disclosure (though the vulnerability is actually a buffer overflow, but tags say Information Disclosure; perhaps they are generic tags, not precise) - ENISA EUVD ID: EUVD-2026-49005 - Affected versions (EUVD): weird entries: "Linux patch: 7.1.4", "Linux 6.15", "Linux patch: 0", "Linux patch: 7.2-rc1", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <be93d186ae88a92e7aa77e122d4e661fa57b1e39", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <0cdbb97a4dbd69abdd2ab998b4fbc7803d4b0b72", "Linux e36ba5ab808ef6237c3148d469c8238674230e2b <04a177f91160ee18da98f5689482cf0f589ec869", "Linux patch: 6.18.39" - Looks like commit ranges and patch references. Need to interpret. - References: three kernel git commits, NVD link, vuldb link. Analysis: Product name: Linux kernel (specifically iommufd subsystem). So product_name: "Linux Kernel". Summary: Must not copy description, write original synthesis. Buffer overflow in Linux kernel's iommufd subsystem, specifically in veventq read path due to sizeof(hdr) using pointer size instead of structure size, leading to potential memory corruption on 32-bit systems. Allowing local attackers with low privileges to gain elevated privileges or cause system compromise. CVSS 7.8 indicates local vector, low complexity, high im

Privilege escalation in the Linux kernel's KVM on ARM64 with pKVM allows a host with root privileges to corrupt hypervisor memory via an out-of-bounds list register index, potentially leading to full hypervisor compromise. The vulnerability arises from missing bounds clamping of the used_lrs field when copying vGIC state from host to hyp, enabling a malicious host to read or write beyond the implemented list registers. A patch is available across several stable kernel branches; the EPSS score is low (0.21%) and no public exploit or active exploitation is known at time of analysis.

Privilege escalation in the Linux kernel's

Incomplete dirty-page tracking in KVM's VMX fastpath userspace exit handling can lead to data corruption or availability loss in virtual machines. A local attacker with low privileges and the ability to run a KVM guest can trigger missed guest memory dirty markings, causing integrity and availability impacts on the host. No active exploitation is known, but vendor patches are available.

Persistent denial-of-service condition in the Linux kernel's svcrdma transport occurs when a remote disconnect causes server worker threads to hang indefinitely during transport shutdown, pinning resources and preventing normal teardown. Attackers can trigger this without authentication, leading to resource exhaustion and complete service unavailability for NFS-over-RDMA. No active exploitation is known, and the EPSS exploitation probability is low (0.20%).

An integer truncation vulnerability in the Linux kernel's FPGA DFL-AFU driver allows a local attacker with low privileges to trigger memory corruption by sending a crafted DMA map ioctl. The issue arises from a missing upper bound check on a 64-bit length parameter from userspace, leading to an undersized pin of memory pages and potential out-of-bounds access. This can result in privilege escalation to root, impacting systems with the dfl-afu module loaded. No active exploitation or public exploit code has been identified at time of analysis.

Local privilege escalation in the Linux kernel's I2C subsystem allows a low-privileged local attacker to compromise system integrity, confidentiality, and availability via a race condition during I2C adapter deregistration. The vulnerability affects kernel versions from 2.6.31 up to unpatched releases, with fixes available in stable trees 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1. No public exploit code or active exploitation is currently reported, and EPSS indicates a low exploitation probability (0.21%).

Out-of-bounds read and write in the Linux kernel's synaptics-rmi4 F3A GPIO driver allows local low-privileged users to leak adjacent kernel slab memory to userspace or perform a controlled heap write via the evdev ioctl interface. The root cause is a size mismatch: gpio_key_map is allocated for at most 6 entries while input->keycodemax is set to the full device-reported gpio_count (up to 127), causing the input core's EVIOCGKEYCODE and EVIOCSKEYCODE ioctls to index past the allocation. No public exploit has been identified at time of analysis; EPSS is 0.22%.

Touch event indexing in the Linux kernel mms114 driver misaligns reads for MMS134S and MMS136 controllers, which pack events at 6-byte intervals while the driver iterates at 8-byte struct offsets. On systems physically equipped with these MELFAS touch controllers, a locally privileged attacker can trigger multi-touch input processing that causes the driver to read kernel memory from incorrect offsets, potentially exposing sensitive data or corrupting kernel state. No public exploit or active exploitation has been identified; EPSS stands at 0.21%, reflecting negligible widespread exploitation risk at time of analysis.

Host memory disclosure to a remote RDMA peer in the Linux kernel's RDMA/rtrs-srv (RTRS server) transport allows a connected peer to read beyond a mapped chunk buffer. When answering an RTRS READ, rdma_write_sg() set the outbound RDMA-Write source-SGE length directly from the attacker-controlled wire descriptor field desc[0].len, which was only rejected when zero, and used the PD-wide local_dma_lkey rather than the chunk's own MR, so the verbs layer never constrained the transfer to max_chunk_size. A peer advertising a length larger than the chunk can force the posted RDMA write to read past the chunk into adjacent host memory (disclosed back to the peer under passthrough/no-IOMMU configs) or trigger a translation fault that aborts the connection. No public exploit identified at time of analysis and EPSS is low (0.21%).

A use-after-free in the FUSE subsystem of the Linux kernel allows a local attacker with permission to mount a FUSE filesystem to escalate privileges or crash the system. The vulnerability exists in fuse_ref_folio() due to improper request locking, and affects kernel versions from 2.6.35 through unpatched longterm branches. Patches are available, and no active exploitation or public exploit code has been identified.

Local privilege escalation in the Linux kernel FUSE subsystem allows a low-privileged attacker to corrupt kernel memory

Local privilege escalation in the Linux kernel's fuse-uring subsystem allows a local attacker to trigger a use-after-free condition by racing with the async stop queues function, potentially resulting in arbitrary code execution and complete system compromise. The vulnerability affects Linux kernel versions 6.14 through 6.18.x (patched in 6.18.39, 7.1.4,

A race condition in the Linux kernel's fuse-uring subsystem allows a local user to achieve privilege escalation and full system compromise. The vulnerability, triggered by concurrent operations on the queue->stopped flag outside of locking, leads to a use-after

Use-after-free in the Linux kernel’s fuse-uring subsystem allows a local authenticated attacker to escalate privileges. The race condition occurs when a malicious userspace sends a commit SQE before the kernel completes the memcpy of request data, triggering a freed fuse_req to be reused. CVSS base score is 7.8 but EPSS probability is low (0.21%), and no public exploit or active exploitation has been reported.

Memory exposure and denial of service in the Linux kernel SMB client allows remote attackers to read kernel memory or crash the system via crafted SMB2 responses. The vulnerability exists in versions prior to the patched releases, affecting all systems mounting SMB shares from untrusted servers. No authentication or user interaction is required, and while no active exploitation is reported, the high CVSS score reflects the serious confidentiality and availability impact.

HTTP request smuggling in libsoup (GNOME's HTTP client/server library) enables network-accessible attackers to inject hidden requests into backend streams by exploiting a parsing differential between libsoup's permissive chunked transfer encoding parser and strict RFC 9112-compliant frontend proxies. All libsoup versions are affected as tracked under CPE cpe:2.3:a:gnome:libsoup, with confirmed vendor impact across Red Hat Enterprise Linux 6.0 through 10.0. No public exploit code or active exploitation has been identified at time of analysis; SSVC classifies exploitation as none with non-automatable, partial technical impact.

Apache Thrift C++ library's THeaderTransport::readString() fails to properly validate info-header length, allowing an out-of-bounds read. An attacker sending a specially crafted Thrift message can trigger this to read beyond the buffer, potentially leaking sensitive memory contents. Remote unauthenticated exploitation is possible against any service using vulnerable bindings, and the issue is fixed in version 0.24.0.

Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU resources via crafted requests that trigger quadratic-time processing in the receive transport. No active exploitation or public exploit is known at

Denial of service in Apache Thrift Ruby bindings before 0.24.0 allows unauthenticated remote attackers to exhaust server resources by sending highly compressed data. No active exploitation or public exploit code has been observed at time of analysis. Upgrading to version 0.24.0 resolves the vulnerability.

Data amplification vulnerability in Apache Thrift's TZlibTransport allows remote attackers to exhaust server resources by sending highly compressed data that decompresses to disproportionate sizes. Affecting all language bindings before version 0.24.0, the flaw enables denial of service via ZIP-bomb-style attacks. Upgrading to Thrift 0.24.0 provides a fix.

TLS hostname verification bypass in Apache Thrift C++ bindings allows man-in-the-middle interception of Thrift RPC communications. The vulnerability resides in the TSSLSocket matchName() function's handling of wildcard certificates per RFC 6125, permitting an attacker with a crafted certificate to impersonate a legitimate server. Upgrading to version 0.24.0 fixes the flaw; no active exploitation or public exploit has been identified at this time.

Improper certificate validation in Apache Thrift c_glib TLS clients allows man-in-the-middle attackers to intercept or tamper with communications by presenting a valid certificate for a different hostname. The vulnerability affects all c_glib bindings prior to version 0.24.0 and can lead to complete compromise of confidentiality and integrity of Thrift RPC traffic. No active exploitation or public exploit code has been reported, but the fix is available in version 0.24.0.

Denial of service in Apache Thrift 0.x before 0.24.0 allows remote attackers to exhaust server memory via crafted zlib-compressed payloads in the Python THeaderTransport layer. The flaw permits a small compressed request to decompress into an excessively large memory allocation, causing service disruption. No public exploit code or active exploitation is known, and the vulnerability is rated important by the Apache project.

Privilege escalation in Weintek cMT3092X HMI and EasyWeb allows authenticated non-privileged users to modify cookies to gain elevated privileges. Affected firmware versions before 20210218 and EasyWeb versions before v2.1.20 are susceptible, with no public exploit code or active exploitation reported. EPSS probability is low (0.32%), indicating limited real-world exploitation likelihood.

Plaintext storage of user account passwords in Weintek cMT3092X HMI firmware and EasyWeb exposes credentials to any network-based attacker with low-privileged authenticated access. Successful exploitation leads to full confidentiality compromise as stored passwords can be read directly. No active exploitation or public exploit code has been identified, and a vendor patch is available.

Unauthorized data modification in Weintek EasyWeb allows authenticated low-privilege attackers to alter read‑only data, compromising system integrity. Affected versions are EasyWeb prior to v2.1.20 and cMT3092X firmware prior to 20210218. No active exploitation is known, and low EPSS score indicates limited real‑world risk.

Memory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to exploit an integer overflow when calculating physical offsets for sparse PMRs larger than 4 GB, causing GPU MMU mapping errors that grant access to unintended physical memory. The vulnerability has a CVSS score of 9.8 and is considered automatable, but EPSS indicates low exploitation probability (0.14%) and no active exploitation or public exploit code is known at this time.

Uninitialized heap memory disclosure in FFmpeg's LCL/ZLIB video decoder (lcldec.c, through version 8.1.2) allows a remote attacker to exfiltrate heap contents - including pointer-derived allocator metadata - by supplying a crafted media file containing a syntactically valid zlib stream that inflates to fewer bytes than the declared frame size. The zlib_decomp() function treats a short-decompress result as non-fatal and falls through to the RGB24 conversion path, which reads full-frame-dimension rows from the partially-filled allocation buffer, copying uninitialized bytes into the attacker-observable AVFrame output. The practical threat is ASLR bypass in long-lived media processing services, making this a potential stepping stone in a multi-stage exploit chain rather than a standalone critical issue. No public exploit code exists and EPSS is 0.26% (17th percentile); CISA SSVC rates exploitation as none at time of analysis.

TLS certificate validation is entirely disabled in epa4all (med-united, all releases prior to 2026-05-20), allowing any network-adjacent attacker positioned on the path between the epa4all service and its healthcare backends to intercept and modify sensitive traffic using a self-signed certificate. For Konnektor and IDP connections, this exposes smartcard PIN operations and OIDC authentication exchanges in plaintext; for the ePA Aktensystem backend, the absent transport-layer verification directly enables the chained VAU-protocol MITM attack documented in the related advisory GHSA-vvh7-x6c7-46gh. No public exploit has been identified and no KEV listing exists; the vendor released a fix in the 2026-05-20 tag.

Memory corruption in libssh2's publickey response parser allows a malicious SSH server to leak heap pointers and corrupt the heap, potentially leading to remote code execution. The issue affects libssh2 versions up to 1.11.1 and is triggered when a client connects to an attacker-controlled SSH server and fetches public keys, with no authentication required on the server side. A patch is available in commit a13bb6c, though no tagged release includes the fix yet; no active exploitation or public exploit code is currently reported.

Double-free heap corruption in libssh2's SFTP client allows a malicious SSH server to corrupt the memory of any authenticated client that opens an SFTP session. This vulnerability, present in libssh2 through 1.11.1, can be triggered via a crafted server response during the `sftp_open()` operation, leading to tcache poisoning and potential arbitrary code execution on the client. No active exploitation has been confirmed, and no public PoC is known at this time, though the EPSS score is low (0.29%).

Out-of-bounds memory access in the Linux kernel’s iwlwifi wireless driver allows a remote attacker on the same WiFi network to corrupt kernel memory, potentially leading to code execution or system crash. The flaw occurs in Block Acknowledgment session handlers where the sta_mask field is not checked before being used to index an array, causing a wrap-around when the mask is zero. Affected are kernel versions prior to 6.18.38 and 7.1.3; no active exploitation or public exploit code is known at this time, and EPSS indicates a low probability of exploitation.

Use-after-free in the Linux kernel's power sequence (pwrseq) debugfs seq_file handler allows a local attacker with low privileges to achieve privilege escalation or system compromise. The flaw arises from incorrect device reference counting in the seq_next callback, leading to reuse of a freed pointer. Affected kernels include versions since commit 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c; no active exploitation or public exploit has been confirmed at the time of analysis.

Use-after-free in the Linux kernel FPGA region subsystem allows a local authenticated attacker with low privileges to corrupt kernel memory, potentially achieving full confidentiality, integrity, and availability impact. The flaw in `child_regions_with_firmware()` stems from `of_node_put(child_region)` freeing the node before `pr_err()` dereferences the same pointer on an error path - a deterministic UAF triggered by a specific error condition in FPGA device tree enumeration. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), placing this firmly as a maintenance-priority fix for most environments rather than an emergency response item.

Out-of-bounds read in KVM's x86 Hyper-V paravirtualization layer allows a guest attacker with L2 nested VM control to read host kernel memory or trigger a hypervisor crash. The VP (Virtual Processor) ID field from the enlightened VMCS is used without bounds validation in `hv_is_vp_in_sparse_set()` when servicing paravirtual TLB flush hypercalls for L2 guests; the TLFS defines a maximum of 4096 VP IDs (64 banks × 64 vCPUs), but an L2 guest can supply an arbitrary value, causing an out-of-bounds array read confirmed by a KASAN use-after-free splat in the commit. No public exploit code exists at time of analysis, and EPSS sits at 0.16% (5th percentile), reflecting niche real-world exposure.

Use-after-free in the Linux kernel's linkstation-poweroff driver exposes systems running affected kernel versions on Buffalo LinkStation NAS hardware to local privilege escalation. The flaw resides in linkstation_poweroff_init(), where of_node_put(dn) was called before of_match_node() finished using the pointer, producing a kernel-space use-after-free that can corrupt slab-allocated memory. No public exploit has been identified and the EPSS score of 0.16% (6th percentile) indicates very low observed exploitation probability, though the official CVSS base severity is 7.8 (High) with confirmed high impact to confidentiality, integrity, and availability.

Use-after-free in the Linux kernel fbdev subsystem's fb_find_mode() function allows a local attacker with low privileges to read freed kernel heap memory, potentially achieving information disclosure, memory corruption, or privilege escalation. The flaw exists when mode_option is NULL: a heap-allocated buffer (mode_option_buf) is freed while the local alias name still references it during the name_matches() comparison loop. Patched versions are available across multiple stable branches (6.6.144, 6.12.95, 6.18.38, 7.1.3, 7.2-rc1). No public exploit exists and EPSS sits at the 6th percentile, but the CVSS 7.8 High score correctly reflects the maximum-impact potential of kernel-level heap memory corruption.

Improper bounds checking in the Linux kernel's ASoC simple-mux driver allows a local attacker with low privileges to cause an out-of-bounds array index, leading to kernel memory disclosure and system crash. The driver erroneously accepts the maximum enum value (2) as valid for a two-entry mux, enabling an invalid mux state to propagate into GPIO and DAPM operations. Vendor patches are available for affected stable kernels, and no public exploit or active exploitation is known at this time.

Double free corruption in the Linux kernel's net2280 USB gadget driver probe error path enables local low-privilege users to corrupt kernel heap memory, potentially escalating privileges or triggering a system crash. The flaw affects all Linux kernel stable branches from 5.10 through 7.x prior to their respective patch releases (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, 7.1). Discovered by static analysis rather than active exploitation - no public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.17% (6th percentile), consistent with the niche hardware dependency of the affected driver.

Use-after-free in the Linux kernel DAMON (Data Access Monitor) sysfs subsystem allows a local, low-privileged user with sysfs write access to corrupt kernel memory structures, potentially escalating to full kernel-level code execution. The DAMOS tried-region directory removal function (damon_sysfs_scheme_regions_rm_dirs()) decrements kobject reference counts but omits removing region objects from the tracking linked list; asynchronous execution of the kobj release callback leaves dangling list entries that a concurrent list rebuild can write into freed memory. No public exploit or active exploitation has been identified - EPSS is 0.16% (5th percentile) and the vulnerability is absent from CISA KEV - consistent with a hardening fix rather than an actively weaponized flaw.

Out-of-bounds read in the Linux kernel elan_i2c touchpad driver allows a local authenticated user to leak kernel memory or crash the system by supplying a malformed firmware blob. The driver fails to validate that the firmware file is large enough to contain the expected number of pages plus the trailing signature before accessing them, affecting all stable kernel branches from 5.10.x through 7.x prior to their respective fix versions. No active exploitation is confirmed (not in CISA KEV), and EPSS is very low at 0.17% (6th percentile), indicating this is a local hardware-driver concern rather than an imminent widespread threat.

A kernel crash (BUG_ON) in the block layer's integrity segment handling can be triggered on systems using dm-multipath over NVMe/RDMA with data integrity protection. The vulnerability arises when a cloned request inherits an incorrect nr_integrity_segments count from the upper queue, causing a mismatch that panics the kernel during dispatch. Only local authenticated users with the ability to issue I/O to the affected stacked device can exploit this, leading to a denial of service.

Local privilege escalation in the Linux kernel's sched_ext subsystem allows a low-privileged local attacker to achieve root access via a use-after-free error in the scx_root_enable_workfn() initialization failure path. The vulnerability is fixed by reordering the put_task_struct() call after scx_error() to prevent premature freeing of the task structure. No active exploitation or public exploit has been reported, and EPSS indicates low exploitation likelihood.

Double free memory corruption in the Linux kernel's OcteonTX2 PF representor driver allows a local low-privileged user on hardware-equipped systems to corrupt kernel slab allocator state via rvu_rep_rsrc_init(), potentially enabling privilege escalation to root. The defect was identified by an experimental static analysis tool during review of v6.13-rc1 and confirmed present through v7.1-rc3 via manual inspection. No active exploitation is confirmed (not in CISA KEV), no public exploit code exists, and vendor-released patches are available across multiple stable kernel branches.

Out-of-bounds heap read in the Linux kernel mac80211 WiFi stack allows an adjacent wireless attacker with no authentication to trigger a slab-out-of-bounds read by sending a crafted 802.11be negotiated TTLM element with a sparse link-map presence bitmap. Affected kernels from 6.9 through 6.12.91, 6.18.33, and 7.0.10 advance the TTLM parser cursor for every TID regardless of whether a presence bit is set, reading past the validated element allocation. The raw read bytes are gated by valid_links before any driver state change, limiting direct policy impact; the primary risk is kernel crash (availability). No public exploit or CISA KEV listing exists; EPSS is 0.17%.

Double free in the Linux kernel's octeontx2-pf driver allows a local attacker with low privileges to corrupt kernel memory, potentially leading to privilege escalation or system crash. The flaw is in the error-handling paths of otx2_pool_aq_init() and cn20k_pool_aq_init(), where a freed stack pointer is not set to NULL and is subsequently freed again during cleanup. Exploitation requires a system with OcteonTX2 or

Local privilege escalation in the Linux kernel's ti-qspi SPI driver results from a use-after-free when DMA setup fails, allowing a local attacker to potentially execute arbitrary code or crash the system. The vulnerability affects Linux kernels from version 4.12 up to the patched stable releases 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No active exploitation has been confirmed (CISA KEV not listed), and the EPSS probability is low (0.18%), indicating limited real-world likelihood.

Use-after-free in the Linux kernel's batman-adv BLA backbone gateway purging allows local attackers to escalate privileges. When stale backbone_gw entries are freed without properly synchronizing or canceling their pending `report_work` items, a race condition can cause the worker to access freed memory, leading to memory corruption and potential code execution with kernel privileges. Exploitation requires local low-privilege access and a system running the batman-adv module with backbone gateways active; no public exploit or active exploitation has been identified.

Use-after-free in the Linux kernel’s netfs library allows a local attacker to escalate privileges or cause denial of service. The race condition occurs when unlocking abandoned read folios after a netfs request completes, potentially corrupting kernel memory. No active exploitation or public exploit is known at this time.

Out-of-bounds read in the Qualcomm QMP USB-C PHY driver (`phy: qcom: qmp-usbc`) of the Linux kernel allows a local low-privileged user to read kernel memory beyond the bounds of the `swing_tbl` and `pre_emphasis_tbl` DisplayPort signal-tuning arrays, risking kernel memory disclosure or a kernel panic. The root cause is an off-by-one error where the boundary guard uses `> 4` instead of `>= 4`, permitting array index 4 on 4-element (0-3) rows. Exploitation is constrained to Qualcomm SoC hardware with USB-C DisplayPort capability; EPSS at 0.15% (5th percentile) and the absence of a KEV listing indicate no public exploit and very low current exploitation probability.

A remote denial-of-service vulnerability in the Linux kernel's AF_RXRPC subsystem allows unauthenticated attackers to crash the system by sending malicious RxGK-secured DATA packets. The flaw stems from missing length checks in the Kerberos 5 crypto library before message decryption or verification. While the CVSS score is 7.5 (High), no active exploitation or public proof-of-concept exists, and EPSS predicts a low exploitation probability (0.17%), suggesting limited immediate real-world risk.

Bundled-dependency exposure in the Image::WebP Perl module (versions 0 through 0.2, distributed by CPAN author ZAPAD) ships a statically compiled copy of libwebp 0.3.0 from 2013, which contains multiple known decoder flaws including the critical CVE-2023-4863 heap buffer overflow. Any Perl application that uses this module to decode an attacker-supplied WebP image reaches the outdated internal decoder, potentially enabling memory corruption and remote code execution. There is no public exploit identified for this specific repackaging, EPSS is low at 0.17%, and CISA SSVC records exploitation status as none - but the embedded CVE-2023-4863 was historically a high-impact, widely-abused decoder bug.

Credential exposure in the Loytec LWEB-802 browser-based management interface allows an unauthenticated remote attacker to steal management credentials stored in the browser's localStorage by tricking a logged-in user into clicking a crafted link. All platforms running LWEB-802 before version 5.0.8 are affected. Because the stolen credentials provide full access to the building automation management system, SSVC rates the technical impact as total - meaning successful exploitation effectively hands an attacker complete control over the managed facility systems.

Improper certificate validation in Apereo CAS Client 4.1.0 and Jasig CAS Client 3.6.4 allows a man-in-the-middle attacker to intercept Ticket-Granting Tickets (TGTs) by presenting any CA-signed certificate for a hostname matching the client's allowlist. An attacker with a network interception position can then obtain service tickets on behalf of the victim. No active exploitation or public exploit code is confirmed, and EPSS indicates low exploitation probability (0.17%).

Memory corruption and use-after-free in Imagination Technologies Graphics DDK allows local attackers to escalate privileges. The vulnerability stems from improper reference counting on synchronization primitives during fence export, enabling a low-privileged user to achieve kernel read/write and full system compromise. No active exploitation or public exploit is confirmed, and EPSS indicates low exploitation probability.