Information Disclosure

Predictable session ID generation in the Dancer2 Perl web framework (all versions through 2.1.0) allows remote attackers to guess valid session identifiers and hijack user sessions. When both the Math::Random::ISAAC::XS and Crypt::URandom CSPRNG modules are absent, Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a SHA-1 hash of low-entropy, largely deterministic inputs (built-in rand(), module path, a counter, PID, an object memory address, and a rand-shuffled string). There is no public exploit identified at time of analysis, KEV lists no active exploitation, and EPSS is low (0.14%), but the flaw is rated CVSS 8.2 and CISA SSVC marks it automatable with partial technical impact.

Predictable salt generation in Crypt::Password through version 0.28 for Perl weakens the security of stored password hashes by seeding salts with Perl's built-in rand() function, which is not cryptographically secure. An attacker who obtains a password hash database can more easily precompute or predict salts, reducing the cost of offline cracking. There is no public exploit identified at time of analysis, EPSS is low (0.14%, 4th percentile), and CISA SSVC records no observed exploitation.

Timing side-channel in the Crypt::Password Perl module (versions through 0.28) allows attackers to incrementally guess a stored password hash because check_password compares values with Perl's short-circuiting eq operator instead of a constant-time comparison. The flaw is classic CWE-208 (Observable Timing Discrepancy); it carries a CVSS 7.5 but a very low EPSS (0.14%, 4th percentile) and no public exploit identified at time of analysis, and SSVC records exploitation status as none. A vendor patch is available.

Unauthenticated SQL injection in the Modern Event Calendar Pro and Modern Events Calendar Lite WordPress plugins (all versions before 7.34.0) lets remote attackers extract sensitive database contents by injecting into an unsanitized request parameter used within a SQL statement, reachable through an AJAX action open to unauthenticated users. Publicly available exploit code exists (reported by WPScan), and a vendor patch is available; the CVSS 8.6 rating reflects a scope-changed, high-confidentiality impact with no authentication or user interaction required. No EPSS score or CISA KEV listing was provided, so there is no public exploit identified as being actively exploited at time of analysis.

Use-after-free memory corruption in Google Chrome prior to 150.0.7871.128 allows a remote attacker to corrupt heap memory and potentially achieve arbitrary code execution when a victim visits a malicious web page. The flaw carries a CVSS 9.6 with a scope change, reflecting the risk of escaping the renderer sandbox, though exploitation requires user interaction. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.27%, 19th percentile), consistent with a freshly patched browser bug that has not yet been weaponized.

Information disclosure in Google Chrome prior to 150.0.7871.128 allows a remote attacker to leak sensitive data after luring a user to a malicious web page, per the Chrome stable channel update. The CVSS 3.1 score of 8.8 reflects network reach with only user interaction required, and a vendor patch is available. No public exploit identified at time of analysis, and EPSS estimates a low ~0.29% probability of near-term exploitation.

Use-after-free in Google Chrome desktop versions prior to 150.0.7871.128 allows a remote attacker to corrupt memory and potentially achieve renderer code execution after a victim visits a crafted web page. The flaw carries a critical CVSS 9.6 owing to its network vector, low complexity, and scope-changing impact, though it requires user interaction (loading a malicious page). No public exploit has been identified at time of analysis and the EPSS probability is low (0.23%, 14th percentile).

Use-after-free memory corruption in Google Chrome for desktop before version 150.0.7871.128 lets a remote attacker corrupt heap memory and potentially achieve code execution or information disclosure after a victim visits an attacker-controlled page. The flaw carries a CVSS 9.6 with a scope change reflecting the browser sandbox boundary, but currently shows no public exploit and a low EPSS probability (0.22%, 12th percentile). It is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.

Remote code execution and information disclosure in Google Chrome desktop before 150.0.7871.128 stems from a use-after-free flaw (CWE-416) that a malicious web page can trigger when a victim simply visits it. The CVSS 3.1 score of 9.6 with a scope change reflects a likely sandbox-boundary crossing, giving an attacker high impact on confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the EPSS probability is low (0.22%, 12th percentile), but browser use-after-free bugs are a historically favored exploitation target.

Use-after-free memory corruption in Google Chrome for desktop before version 150.0.7871.128 lets a remote attacker corrupt heap memory and potentially execute arbitrary code or disclose sensitive information after the victim interacts with attacker-controlled web content. The flaw was fixed in the Stable channel update and reported downstream by the Ubuntu security team; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 7.8 CVSS reflects full confidentiality, integrity, and availability impact once a user is lured to malicious content.

Use-after-free memory corruption in Google Chrome versions prior to 150.0.7871.128 allows a remote attacker to corrupt heap memory and potentially disclose sensitive information or execute code after a user visits a malicious web page. The flaw was reported through the Ubuntu vendor channel and fixed in Chrome's Stable desktop channel; no public exploit identified at time of analysis, and its EPSS exploitation probability is low (0.22%). Successful exploitation requires user interaction (visiting attacker-controlled content) but no authentication.

Information disclosure in FileThingie 2.5.7, a single-file PHP web-based file manager, lets a remote attacker retrieve sensitive information through the ft2.php component. The flaw is documented in a third-party vulnerability-research repository, indicating exploitation details are likely public, though it is not listed in CISA KEV. The published CVSS 9.9 rating overstates impact relative to the description, which describes only information disclosure rather than full compromise.

Denial of service in Meshtastic firmware prior to 2.7.23.b246bcd allows a single node whose User.long_name contains malformed UTF-8 to render other radios unmanageable over Bluetooth Low Energy when paired with the iOS app. Because the strict-parsing iOS client refuses to load a node database containing a poisoned entry, BLE sync enters a fail/retry loop and the operator loses control of the device; the malformed name propagates across the mesh, so one bad node can degrade iOS management for many users over a wide area. There is no public exploit identified at time of analysis, but the condition has been observed occurring naturally in the wild from ordinary buffer truncation rather than deliberate attack.

Out-of-bounds read in the Linux kernel's AMD IOMMU debugfs subsystem exposes local users with standard privileges to potential kernel memory disclosure or denial of service via a sign-extension defect. The functions iommu_mmio_write() and iommu_capability_write() declare offset variables as signed int but populate them with kstrtou32_from_user(), allowing values in the range 0x80000000-0xFFFFFFFF to wrap negative and theoretically index before the intended MMIO region. The vulnerability description explicitly characterizes it as latent, acknowledging that three pre-existing defensive layers already prevent exploitation in practice; the fix replaces the unsigned parser with kstrtos32_from_user() and adds explicit negativity checks. No public exploit exists, no KEV listing is present, and EPSS sits at 0.15% (5th percentile).

Memory-management corruption in the Linux kernel (introduced in 6.18) affects x86 32-bit systems with Transparent Huge Pages (THP) enabled, where __vm_normal_page() fails to recognize the huge zero PMD because pmd_special()/pud_special() are gated behind CONFIG_ARCH_SUPPORTS_PMD_PFNMAP, which is never set on any 32-bit architecture. A local user allocating THP mappings can trigger VM_WARN warnings, bad rss-counter and bad page state conditions, and mis-accounting of the huge zero folio as file-backed THP. No public exploit has been identified and EPSS is low (0.16%), consistent with a niche, non-default trigger condition.

Use-after-free read in the Linux kernel Bluetooth BNEP subsystem allows a local privileged user (CAP_NET_ADMIN) to read freed net_device memory by winning a race against concurrent teardown. Affected kernels span from 2.6.12 through the 6.x/7.x stable series until the fixed releases (e.g. 6.12.92, 6.6.142, 6.1.175, 5.15.209, 5.10.258, 6.18.34, 7.0.11, 7.1). The upstream maintainers explicitly characterize this as low practical security interest; there is no public exploit identified at time of analysis and EPSS is very low (0.17%, 6th percentile).

Denial of service in the Linux kernel's KVM/SVM AVIC (Advanced Virtual Interrupt Controller) IPI virtualization affects Hygon Family 18h hosts, where a hardware erratum (#1235, shared with AMD Zen1 Family 17h) lets the CPU read a stale IsRunning bit during ICR write emulation and skip the expected AVIC_IPI_FAILURE_TARGET_NOT_RUNNING VM-Exit. As a result KVM misses the wakeup of a blocking target vCPU, causing hung vCPUs and unbounded stalls in guest execution. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; the fix disables AVIC IPI virtualization on these CPUs so every non-self IPI is correctly emulated via VM-Exit.

Incorrect spinlock initialization ordering in the Linux kernel's idpf network driver (Intel Infrastructure Data Path Function) causes the PTP auxiliary worker to acquire the read_dev_clk_lock before spin_lock_init() has run, producing a lockdep 'non-static key' warning and a race on an uninitialized lock during device init/reset. This is a local kernel-driver initialization bug affecting systems using the idpf driver with PTP enabled, not a remotely reachable code-execution flaw; no public exploit identified at time of analysis and the EPSS score is negligible (0.15%). Despite an automated CVSS of 9.8, the real-world security impact is minimal and confined to hosts running specific Intel networking hardware.

Data-race tearing in the Linux kernel's netfs library allows the ->remote_i_size and ->zero_point fields to be read or written non-atomically, potentially yielding torn/inconsistent file-size values for network filesystems built on netfslib (e.g., AFS, Ceph, 9p, cifs/SMB). The fix mirrors the existing i_size_read()/i_size_write() pattern, reusing the i_size seqcount under i_lock to serialize updates. Despite an input CVSS of 9.8, this is a local race-condition hardening fix with no public exploit identified at time of analysis and a low EPSS (0.16%, 6th percentile); the tag set even reclassifies impact as Information Disclosure rather than RCE.

Improper handling of write streaming in the Linux kernel's netfs subsystem (network filesystem caching layer) allows a local, low-privileged user to trigger reads of stale, dirty-but-not-uptodate page cache data on network-backed filesystems. Introduced around kernel 6.8, the flaw stems from netfs caching dirty data in folios that are not marked uptodate; concurrent reads (e.g., via mmap or a separate read-only fd) could return incorrect or stale content, an information-disclosure/integrity concern (tagged 'Information Disclosure'). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is very low (0.11%, 2nd percentile), indicating negligible mass-exploitation likelihood.

Incorrect error-handling in the Qualcomm MSM DRM/GPU driver (drm/msm) of the Linux kernel mishandles the return value of iommu_map_sgtable(), which was changed upstream to return a signed ssize_t with negative error codes instead of a size_t/zero. On the failure path the driver triggered a WARN rather than propagating the error, so a local user able to reach the GPU IOMMU mapping code can provoke a kernel warning and a poorly-handled error condition. This is a robustness/error-path correctness fix reported through the kernel stable process; no public exploit and no active exploitation are known (EPSS 0.18%, 8th percentile).

Improper error-path handling in the Linux kernel IOMMU subsystem allows unbalanced debug-tracking operations when CONFIG_IOMMU_DEBUG is enabled and an IOMMU map operation fails partway. When iommu_map_nosync() hits an error, the cleanup path invoked iommu_unmap()/iommu_debug_unmap_begin()/end() against a mapping the debug layer never recorded via iommu_debug_map(), corrupting internal tracking state and producing spurious unmatched trace records. The fix lifts unmap error handling into iommu_map_nosync() and reorders it so trace_map()/iommu_debug_map() records the partial mapping before immediately unmapping it. This is a locally-scoped, debug-configuration-dependent issue with no public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and it is not in CISA KEV.

Local privilege-boundary weakness in the Linux kernel's iommupt (IOMMU generic page-table) code allows a driver-constructed iommu_domain that omits PAGE_SIZE from its pgsize_bitmap to take an unintended fast path in page-table handling. The upstream fix lifts a PT_WARN_ON into a branch check and skips the fast path when PAGE_SIZE is absent. No public exploit identified at time of analysis; EPSS probability is very low (0.15%, 5th percentile) and this is a design-hardening fix rather than a demonstrated attack primitive.

Improper lock/softirq release ordering in the Linux kernel's netfilter nft_inner component allows a local privileged user to trigger lock imbalance and softirq state corruption via the error path, where local_bh_enable() runs before local_unlock_nested_bh(). Affected are Linux stable branches around 6.16 through pre-patch 6.18.x/7.0.x, fixed by three stable commits; no public exploit identified at time of analysis and EPSS is very low (0.17%, 6th percentile) despite the auto-assigned 9.8 CVSS. This is a defensive locking-correctness fix rather than an evidenced remote code execution primitive.

Out-of-bounds memory access in the Linux kernel's ksmbd (in-kernel SMB3 server) occurs during ACL inheritance, where Owner and Group SIDs read from a parent directory's NT Security Descriptor were used without bounds validation. An authenticated SMB user able to write to a share can craft or place a malformed security descriptor so that a subsequent create operation reads past buffer boundaries, enabling kernel information disclosure and potential denial of service. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 6th percentile).

Local credential disclosure in the Linux kernel CIFS/SMB client (kernel 5.11 and later) stems from the CIFS_GENL generic-netlink family exposing the SWN (witness-notify) command and its CIFS_GENL_MCGRP_SWN multicast group without capability enforcement. Any unprivileged local process can join the multicast group to receive witness Register messages that, for NTLM-authenticated mounts, contain the session username, domain, and cleartext password, and can also inject spoofed RESOURCE_CHANGE or CLIENT_MOVE notifications into the in-kernel witness handler. No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a local-only issue.

Refcount race in the Linux kernel SMB/CIFS client (smb2_find_smb_sess_tcon_unlocked) leaves a tc_count increment unprotected by tc_lock, so concurrent tree-connect lookups can corrupt the tcon reference count and lead to premature free / use-after-free of the tcon object. It affects hosts that mount SMB2/SMB3 shares via the in-kernel cifs client and is a regression introduced by commit 96c4af418586 which converted tc_count locking from cifs_tcp_ses_lock to tc_lock but missed this one increment site. No public exploit is identified at time of analysis and EPSS is low (0.18%); the vendor-carried CVSS of 9.8 is auto-generated boilerplate that is not well supported by the actual local, race-conditioned nature of the bug.

Out-of-bounds array read in the Linux kernel's ALSA ASIHPI (AudioScience HPI) sound driver allows a local, low-privileged user to trigger memory disclosure or a kernel crash by requesting a cached control info entry with an unchecked index. The find_control() helper indexed its cache array with a caller-supplied index without bounds validation; the fix adds a sanity check. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%), and it is not listed in CISA KEV, so this is a routine defense-in-depth hardening fix rather than an urgent threat.

Use-after-free in the Linux kernel's IPv6 In-situ OAM (IOAM) hop-by-hop option handler (ipv6_hop_ioam) lets a crafted IPv6 packet trigger access to a freed skb data buffer on hosts configured as IOAM nodes. After skb_ensure_writable() reallocates the socket buffer via pskb_expand_head(), the code refreshes the trace pointer but leaves the stale hdr pointer, so hdr->opt_len is later read from freed memory when calling ioam6_event(), enabling potential information disclosure or kernel crash. This is a resolved upstream fix with no public exploit identified at time of analysis and a low EPSS score (0.18%, 7th percentile).

Out-of-bounds slab read in the Linux kernel Bluetooth management (MGMT) subsystem lets a privileged local user leak adjacent kernel heap memory via the MGMT_OP_ADD_EXT_ADV_DATA command. The handler trusts attacker-supplied adv_data_len and scan_rsp_len fields without confirming those bytes actually fit within the received command payload, so a short command drives an out-of-bounds pointer into tlv_data_is_valid() and can copy past-the-buffer bytes into an advertising instance that the caller then reads back via MGMT_OP_GET_ADV_INSTANCE. Exploitation requires CAP_NET_ADMIN in the initial user namespace; no public exploit identified at time of analysis, and EPSS is low at 0.18%.

Out-of-bounds kernel memory access in the Linux kernel's devmem TCP subsystem (net/devmem) allows a local, low-privileged user who can bind a dma-buf to a socket to read one slot past the tx_vec array and to desynchronize net_iov accounting from the underlying gen_pool region. The root cause is that net_devmem_bind_dmabuf() trusts dmabuf->size and sg_dma_len() to be PAGE_SIZE multiples without validating them, so a dma-buf sized N*PAGE_SIZE+r lets a sendmsg() at offset N*PAGE_SIZE pass the bounds check yet index tx_vec[N]. No public exploit is identified at time of analysis and the EPSS score is very low (0.17%, 6th percentile); the fix (reject non-page-aligned size or SG length with -EINVAL) is shipped in vendor-released patches.

Slab use-after-free in the Linux kernel's HSR (High-availability Seamless Redundancy) networking subsystem lets a local attacker read freed heap memory. Generic-netlink node-list/node-status operations walk hsr->node_db under rcu_read_lock(), but RTM_DELLINK teardown (hsr_dellink -> hsr_del_nodes) removed nodes with a plain list_del() and freed each hsr_node immediately, so a concurrent reader could dereference a freed node and copy node->macaddress_A. No public exploit is identified at time of analysis and EPSS is low (0.17%, 7th percentile); the flaw is a race-window read primarily affecting confidentiality and stability rather than a remote RCE.

Kernel-memory use-after-free in the Linux mlx5e Ethernet driver (NVIDIA/Mellanox ConnectX mlx5_core) occurs when mlx5e_tx_reporter_timeout_recover() dereferences sq->netdev after mlx5e_safe_reopen_channels() has already freed the channel and its embedded send queues during TX-timeout health recovery. Systems using mlx5 NICs are affected; the freed-pointer read can corrupt kernel state, leak kernel memory, or crash the host. No public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not in CISA KEV, so this is a reliability/hardening fix rather than an actively exploited threat despite the NVD 9.8 score.

Slab out-of-bounds read in the Linux kernel IFB (Intermediate Functional Block) network driver exposes adjacent kernel memory and risks system instability when a local user with low privileges queries ethtool statistics on an asymmetrically configured IFB device. The root cause is a queue-count mismatch: ethtool stat callbacks size and walk per-queue data using real_num_rx_queues and real_num_tx_queues, while the underlying tx_private allocation is sized only to num_tx_queues - creating an over-read when RX queue count exceeds TX queue count. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), though patch availability across multiple stable branches confirms vendor acknowledgment and active remediation.

Memory-corruption (double free) in the Linux kernel's qed driver (QLogic FastLinQ 40/100G Ethernet) occurs when a PF/VF CID bitmap allocation fails during qed_cxt_tables_alloc(): the error path in qed_cid_map_alloc() frees already-allocated bitmaps, and the subsequent qed_cxt_mngr_free() cleanup frees them a second time. The bug is present from the driver's introduction through v7.1-rc3 and was surfaced by an experimental kernel memory-analysis tool; no public exploit identified at time of analysis and it is not in CISA KEV. Exploitation requires the specific hardware and a triggered allocation failure, so despite the CVSS 8.4 the practical risk is limited to local denial of service on affected NIC hosts.

Memory corruption (slab use-after-free) in the Linux kernel's mac80211 wireless stack allows an adjacent attacker on an 802.11s mesh network to trigger a KASAN-detected use-after-free in the fast-RX receive path. When a unicast frame is forwarded by mesh_data and hits the no-route path, the shared skb->cb storage is freed (or zeroed) before the RX_QUEUED handler reads rate statistics from it via sta_stats_encode_rate, corrupting kernel memory. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 6th percentile); the issue is a fixed upstream bug rather than an actively exploited one.

Local privilege-escalation-class use-after-free in the Linux kernel's VMware VMCI vsock transport (vsock/vmci) allows a local attacker to corrupt freed socket memory by resetting a connection during the vsock handshake. When a peer sends a VMCI RST packet, vmci_transport_recv_connecting_server() incorrectly returned success (err=0), so vsock_transport_recv_listen() skipped removing the pending socket; a deferred vsock_pending_work() then double-dropped the socket reference, freeing it and writing into the freed object (KASAN slab-use-after-free). CVSS is 8.8 with a scope change, but EPSS is low (0.18%, 8th percentile) and there is no public exploit identified at time of analysis and it is not in CISA KEV.

Local denial-of-service in the Linux kernel's IPv4 raw socket path allows a caller holding CAP_NET_RAW to crash the host by sending an IP_HDRINCL packet whose self-reported header length (ihl) is below the RFC 791 minimum of 5. raw_send_hdrinc() checks that the header fits within the message but never rejects ihl < 5, so the malformed header is injected into the output path where downstream consumers such as ah_output() compute a negative header size, cast it to size_t, and perform an OOB memcpy of nearly SIZE_MAX bytes, panicking the kernel. It affects all maintained kernel branches and is reachable from an unprivileged process inside a user+net namespace (CONFIG_USER_NS=y) or a rootless Docker container with NET_ADMIN; no public exploit identified at time of analysis and EPSS risk is low (0.18%).

Use-after-free in the Linux kernel's ixgbevf driver (Intel 82599 SR-IOV virtual-function NIC driver) occurs when the VEPA multicast source-pruning workaround frees an skb and continues the receive loop without resetting the shared skb pointer to NULL, so the next descriptor iteration calls ixgbevf_add_rx_frag() on freed memory in NAPI softirq context. The flaw is present in ixgbevf's ixgbevf_clean_rx_irq() and affects VFs running in VEPA mode on hosts using the 82599/X520 family. There is no public exploit identified at time of analysis - the bug was located by static analysis (scan_drop_continue_loops.py / semgrep) and the UAF was confirmed under KASAN only via a synthetic test module reproducing the code pattern, not against real hardware; EPSS is low (0.18%, 7th percentile) and it is not on CISA KEV.

Local privilege-holder-triggered use-after-free in the Linux kernel's RADOS block device (rbd) driver allows a kernel crash and potential memory corruption when a Ceph rbd image is unmapped concurrently with in-flight I/O. A TOCTOU race in the exclusive-lock delayed-work (lock_dwork) draining logic lets rbd_acquire_lock() run after the device has been released and its structures freed or reset, violating internal assertions such as rbd_image_format_valid() in rbd_dev_header_info(). No public exploit identified at time of analysis; EPSS is low (0.17%), consistent with a hard-to-win kernel race rather than a broadly weaponizable flaw.

Local privilege/security-policy bypass in the Linux kernel's LSM (Linux Security Module) infrastructure arises because lsm_set_self_attr() failed to hold cred_guard_mutex before invoking the LSM hook, unlike the equivalent proc_pid_attr_write() path. On SELinux- or AppArmor-enforced systems, this allows a local low-privileged process to race the ptrace-based checks that gate a security-context transition, potentially performing a domain/type transition that policy would otherwise deny. EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis; the fix is already merged into stable kernels.

Use-after-free read in the Linux kernel's AF_UNIX stream socket handler (unix_stream_data_wait()) lets a local user leak or corrupt kernel memory state and potentially crash the system by racing a peeking recv() against a normal recv() on the same socket. The flaw affects kernels from ~6.5 onward, where unix_stream_data_wait() dereferences tail->len from an SKB read via skb_peek_tail() without a lock preventing that SKB from being concurrently dequeued and freed. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis, though the fix commit includes a race reproducer; the issue is fixed in stable releases.

Use-after-free / dangling dentry reference in the Linux kernel's CIFS (SMB) client allows a local user to leave a filesystem dentry in use after unmount, triggering a 'still in use' warning and potential memory corruption. Introduced by commit 340cea84f691c ('cifs: open files should not hold ref on superblock'), the flaw affects multiple stable series (6.1.x, 6.6.x, 6.12.x, 6.18.x, 6.19.x, 7.0.x) where a deferred CIFS close work item can run after the superblock is torn down. No public exploit has been identified, though a crash reproducer is published in the kernel bugzilla, and EPSS is low (0.17%, 7th percentile) with no CISA KEV listing.

Out-of-bounds host memory access in the Linux kernel's arm64 KVM virtual ITS (vgic-its) subsystem allows a local user driving the VM migration/restore path to disclose kernel memory and crash the host. The flaw lets userspace restore an ITS Device Table Entry (DTE) whose Size field encodes more EventID bits than the virtual ITS supports; vgic_its_restore_dte() stores this out-of-range num_eventid_bits, which later produces an oversized scan_its_table() range. It carries a high CVSS (9.0) but a very low EPSS (0.18%), with no public exploit identified at time of analysis and no CISA KEV listing.

Information disclosure in the Linux kernel's SEV-SNP guest driver (virt/sev-guest) allows memory pages left in an indeterminate encryption state to be reclaimed by the buddy allocator, potentially exposing plaintext guest data to later allocations. When set_memory_encrypted()/set_memory_decrypted() fail partway, the caller cannot tell where they failed, so pages that may still be unencrypted were being freed for general reuse; the fix instead calls snp_leak_pages() to permanently retain them. Rated CVSS 8.7 (local, low-privilege); EPSS is low at 0.17% (7th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.

Use-after-free in the Linux kernel ISCI (Intel SAS) driver's device removal path allows a local attacker with low privileges to corrupt kernel memory by racing the completion tasklet against driver teardown, potentially enabling privilege escalation. Systems running affected kernel versions with Intel ISCI SAS hardware are vulnerable across multiple stable branches, with vendor-released fixes available in 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit has been identified and EPSS of 0.18% (7th percentile) confirms no observed widespread exploitation, though the KASAN-verified reproduction documented in the fix commit confirms the failure class is reliably triggerable under controlled conditions.

Out-of-bounds kernel memory read in the Linux kernel's Soft-iWARP (siw) RDMA driver lets a malicious connected iWARP peer send an MPA FPDU whose 16-bit length field is smaller than the fixed DDP/RDMAP header, triggering a signed-integer underflow that propagates a negative length into skb_copy_bits() as a huge size_t, producing a multi-gigabyte use-after-free read. Affected are kernels from 5.3 up to the fixed stable releases wherever the siw module is loaded; the primary outcome is a kernel crash (denial of service) with potential exposure of adjacent kernel memory. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.18% (7th percentile), consistent with the niche siw attack surface despite the high CVSS.

Local privilege escalation and memory corruption in the Linux kernel's drm/v3d GPU driver (Broadcom VideoCore, used in Raspberry Pi and similar SoCs) stems from a use-after-free on the CPU-job ioctl error path, where kvfree() reads the cpu_job structure after v3d_job_cleanup() has already dropped its last reference and freed it. The same faulty path also causes a NULL-pointer dereference on early init failure and leaks a drm_syncobj reference per query. No public exploit is identified at time of analysis, EPSS is low (0.18%), and it is not in CISA KEV, but a kernel UAF reachable by a local unprivileged user with GPU access carries high impact (CVSS 7.8).

Use-after-free in the Linux kernel's batman-adv (B.A.T.M.A.N. mesh routing) multicast code lets an adjacent attacker on the mesh trigger access to freed orig_node memory, potentially disclosing kernel memory or crashing the node. The flaw stems from batadv_mcast_purge_orig() removing entries from RCU-protected hlists without waiting for a grace period, so concurrent RCU readers dereference already-freed multicast node references. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV.

Denial-of-service (and minor state corruption) in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced mesh routing) bridge-loop-avoidance (BLA) subsystem allows an adjacent mesh participant to trigger a race condition in the bla.num_requests reference counter. Because the request_sent state check and the atomic increment/decrement of num_requests are not performed under a common lock, concurrent contexts (batadv_bla_send_request(), batadv_handle_announce(), backbone purge, and periodic work) can double-decrement the counter, corrupting BLA state and potentially crashing the kernel. There is no public exploit identified at time of analysis and EPSS risk is low (0.18%, 7th percentile); the fix serializes state and counter updates under a lock and adds a 'stopped' backbone_gw state.

Use-after-free race condition in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh-networking throughput meter (tp_meter) can corrupt kernel memory when a sender timer is re-armed after its backing reference has already been freed during cleanup. The flaw affects systems that load the batman-adv module and run tp_meter sessions; an adjacent mesh peer's ACK can race the shutdown path (batadv_tp_sender_shutdown) so that batadv_tp_reset_sender_timer() re-arms a timer whose object is gone. CVSS is rated 8.8 (AV:A), but with EPSS at 0.21% (11th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is low.

Heap buffer overflow in the Linux kernel's batman-adv mesh networking subsystem (translation-table TVLV generation) lets the number of non-empty VLANs grow between a pre-allocation size check and the buffer fill, so a VLAN that gained its first TT entry during that window is written past the allocated buffer. The flaw affects nodes running batman-adv mesh with VLANs and can corrupt kernel heap memory, most realistically causing a crash or information leak (tagged Information Disclosure). It is not in CISA KEV, has no public exploit identified at time of analysis, and carries a low EPSS of 0.18% (8th percentile) despite the automated CVSS 9.8.

Kernel memory disclosure in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking module arises from an integer wraparound in the translation-table (TT) code, where last_changeset_len was a signed s16 that wraps negative once a changeset exceeds 32767 bytes; batadv_send_my_tt_response() then sign-extends that value and batadv_tt_prepare_tvlv_local_data() allocates a full-sized TVLV buffer while filling only a small part, emitting the uninitialized remainder onto the mesh. A remote mesh peer can thereby receive stale kernel heap contents in TT response frames, tagged by the source as Information Disclosure. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the issue is not in CISA KEV; a vendor patch is available.

Uninitialized kernel-memory disclosure in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced) mesh-routing module allows an adjacent mesh peer to receive leaked kernel heap contents inside translation-table (TT) response frames. The batadv_orig_node::tt_buff_len field was typed as s16 and wraps negative when a changeset exceeds 32767 bytes, so batadv_tt_prepare_tvlv_global_data() allocates a full-size buffer but populates only a small portion, transmitting the uninitialized remainder over the mesh. No public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), consistent with a niche, non-default kernel feature rather than a broadly weaponized flaw.

Out-of-bounds memory access in the Linux kernel's hwmon pmbus/adm1266 driver lets a malicious or malfunctioning ADM1266 PMBus device on the I2C bus trigger a one-byte write past the end of the driver's fixed read_buf array, plus a corresponding out-of-bounds read during the PEC comparison. The read_buf field is sized ADM1266_PMBUS_BLOCK_MAX+1 (256 bytes) while the i2c transaction is programmed for ADM1266_PMBUS_BLOCK_MAX+2 (257 bytes), so a maximum-length block response (255 payload bytes plus a PEC byte) overruns the buffer. No public exploit identified at time of analysis and EPSS risk is low (0.18%, 8th percentile); the flaw is fixed across multiple stable trees.

Kernel stack information disclosure and register-state corruption affects the Linux kernel's RISC-V 32-bit compat layer, where compat_riscv_gpr_set() (the PTRACE_SETREGSET handler) and compat_restore_sigcontext() (the compat sigreturn path) call cregs_to_regs() even after the user copy fails, writing an uninitialized stack buffer into the target task's pt_regs. A local low-privileged attacker running a 32-bit process on a riscv64 kernel can force the copy to fail and leak uninitialized kernel stack contents into user-visible registers while corrupting the task's register state. There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), consistent with the narrow RISC-V compat attack surface.

Kernel memory corruption in the Linux arm_ffa (Arm Firmware Framework for A-profile) driver allows a local attacker to trigger a use-after-free by racing notifier unregistration against active notification delivery, affecting Arm systems running kernels from 6.15 up to the fixed 6.18.34/7.0.11 releases. Both the framework and non-framework notification handlers looked up a callback under notify_lock, dropped the lock, then dereferenced a notifier entry that a concurrent unregister could have already freed. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and it is not listed in CISA KEV.

Memory corruption in the Linux kernel netfilter x_tables subsystem lets a local user with network-admin capability trigger a use-after-free during table module removal (rmmod) while userspace performs concurrent set/getsockopt operations on the same table. The fix introduces a two-stage teardown (xtables_unregister_table_exit) that unlinks the table from the dying list, frees hook ops, and emits the audit notification, replacing the racy single-stage xt_unregister_table(). Rated CVSS 7.8 (local, high CIA impact); EPSS is low (0.17%), it is not in CISA KEV, and no public exploit has been identified at time of analysis.

Local privilege escalation and memory disclosure in the Linux kernel's netfilter ebtables subsystem stems from a table-removal race that could expose a partially-initialized ebt_table structure before its ops pointer is assigned. On affected kernels (5.15 through the fixes in 6.18.34, 7.0.11 and 7.1), a local user with network-administration capability manipulating ebtables can trigger the window between allocation and full initialization, corrupting or reading kernel memory. No public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile), consistent with a race-condition bug requiring local access rather than mass exploitation.

Local privilege escalation and memory-safety exposure in the Linux kernel netfilter bridge ebtables subsystem stems from a module-initialization race where nf_register_sockopt() runs before ebtables data structures are fully initialized, exposing the setsockopt/getsockopt interface globally too early. On affected kernels (5.13 through builds before the 6.18.34 / 7.0.11 / 7.1 stable fixes), a local low-privileged actor with the ability to reach ebtables sockopts during the init window can trigger operations on uninitialized state, risking high confidentiality, integrity, and availability impact (CVSS 7.8). There is no public exploit identified at time of analysis and EPSS is low (0.17%), so this is a code-correctness fix rather than an actively exploited threat.

Use-after-free in the Linux kernel's irq_work subsystem allows a local attacker on a PREEMPT_RT (real-time) kernel to corrupt memory by racing irq_work_sync() against irq_work_single(). After the BUSY flag is cleared via atomic_cmpxchg(), the work object is still dereferenced for irq_work_is_hard() and rcuwait_wake_up(), while a concurrent irq_work_sync() caller on another CPU can observe BUSY==0, return, and free the object before those accesses complete. Rated CVSS 7.8 (High); no public exploit identified at time of analysis and EPSS probability is low (0.19%, 8th percentile).

Improper error-path cleanup in the Linux kernel's netfs read subsystem (the netfslib helper used by network filesystem clients such as CIFS/SMB, AFS, Ceph and 9p) mishandles reference counting when preparation of a direct-I/O (DIO) or single-read subrequest fails after being added to the stream's subrequest list. Because the failed subrequest can still be observed by the collector while holding two outstanding references, this leads to reference mismanagement and potential use-after-free/memory disorder on the read failure path, tagged as an information-disclosure risk. The fix has been merged upstream and backported; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.17%).

Memory corruption in the Linux kernel's netfs library (introduced around v6.10) arises because netfs_retry_read_subrequests() and netfs_retry_write_stream() add new subrequests to stream->subrequests without holding the stream lock, creating a race on the shared list during I/O retry. The flaw affects systems using netfs-backed network filesystems (e.g. AFS, Ceph, CIFS/SMB, 9p) and can lead to list corruption, information disclosure, or a crash when concurrent retries mutate the list. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.15%), consistent with a hard-to-trigger local kernel race rather than a remotely weaponizable bug.

Memory-ordering defect in the Linux kernel's netfs (network filesystem helper) subsystem allows the lockless readers netfs_collect_read_results() and netfs_collect_write_results() to observe a subrequest pointer before the NETFS_SREQ_IN_PROGRESS flag and other subreq state are guaranteed visible, causing races on stream->subrequests. The flaw affects kernels from 6.10 onward that use netfs-backed filesystems (CIFS/SMB, AFS, Ceph, 9p) and can lead to stale-state reads, information disclosure, or instability during concurrent I/O collection. There is no public exploit identified at time of analysis, EPSS is very low (0.15%, 5th percentile), and it is not on CISA KEV; the upstream fix is available in stable git.

A missing back-pressure flaw in the Linux kernel's netfs read path (netfs_read_to_pagecache()) fails to pause generation of new read subrequests after an already-issued subrequest fails, affecting network/cached filesystems (e.g. AFS, Ceph, CIFS/SMB, 9p, and fscache-backed mounts) built on the netfs helper library. The upstream fix has been merged and backported to stable trees; EPSS is very low (0.17%, 6th percentile) and no public exploit or CISA KEV listing exists, so this is no public exploit identified at time of analysis. Despite an NVD/CNA CVSS of 9.8, the change is a reliability/correctness fix and the supplied tag characterizes real impact as Information Disclosure rather than remote code execution.

Use-after-free memory corruption in the Linux kernel's netfs subsystem (netfs_read_gaps()) allows local activity on network filesystem mounts (notably the cifs/SMB client) to write into a prematurely-freed sink folio. The bug arises because the sink page backing an ITER_BVEC iterator is released before the outstanding read op completes, letting the cifsd receive thread copy incoming socket data into freed memory - reproduced by KASAN on the generic/075 xfstest. There is no public exploit identified at time of analysis and EPSS risk is low (0.17%); the vendor-supplied CVSS of 9.8 (AV:N) appears inflated for what is fundamentally a local, race-dependent kernel flaw.

Local information disclosure and memory corruption in the Linux kernel's netfs subsystem arises because netfs_read_folio() does not wait for in-flight writeback to complete before trusting the folio dirty flag and the folio->private data, which the writeback collector may free before it clears the writeback flag. Hosts using network/cache-backed filesystems (9p, AFS, Ceph, CIFS/SMB, and fscache-backed mounts) can hit a race where a read consumes stale or freed metadata. There is no public exploit identified at time of analysis and the EPSS probability is low (0.17%, 6th percentile); the fix is merged in stable releases 6.18.34, 7.0.11, and 7.1.

Improper locking in the Linux kernel AFS (Andrew File System) client's symbolic link handling (afs_get_link()) allows a local attacker on a host mounting an AFS volume to trigger race conditions that leak kernel memory and can expose stale or freed symlink buffers. The flaw affects kernels from roughly 6.14 up to the fixed 7.0.11/7.1 stable series and stems from a missing validate_lock, absent RCU barriering during lockless pathwalk, and unsynchronized access when a symlink is concurrently updated on the server. No public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and it is not on CISA KEV.

Data corruption and cross-port information disclosure affects the Linux kernel's Cortina Gemini (gmac) ethernet driver, where a single static local SKB used to reassemble fragmented RX packets in gmac_rx() is shared across the SoC's two ethernet ports. On devices actively using both ports simultaneously, concurrent RX processing can race on this shared buffer, mixing packet fragments between ports; the fix makes the RX SKB a per-port structure member. EPSS is low (0.18%, 8th percentile) with no public exploit identified at time of analysis and no CISA KEV listing, indicating this is a correctness/hardening fix rather than a practically weaponizable flaw despite its assigned CVSS of 9.8.

Malformed packet assembly in the Linux kernel's Cortina Gemini 'gmac' Ethernet driver (drivers/net/ethernet/cortina) occurs because the RX fragment counter (frag_nr) is reset to zero between NAPI poll invocations when the RX ring buffer empties mid-assembly, leaving a partially built SKB. The realistic impact is corrupted or partially-assembled receive buffers on affected ARM SoC platforms, tagged as Information Disclosure, potentially leaking stale buffer contents or destabilizing the receive path. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the issue is not in CISA KEV, and the NVD-supplied CVSS 9.8 is almost certainly an automated over-score inconsistent with a driver-internal RX race.

Out-of-bounds kernel memory read in the Linux kernel block layer (block integrity subsystem) stems from bio_integrity_copy_user() overwriting bip_vcnt with nr_vecs after bio_integrity_add_page() had already set it to 1 for the bounce segment. On WRITE this breaks the bip_vcnt <= bip_max_vcnt invariant (bip_max_vcnt is 1), causing gap-merge checks in block/blk.h to read past the bip_vec[] flex array; on READ, in-bounds access lands on a saved user bvec instead of the bounce. A local low-privileged user issuing I/O with user-supplied integrity metadata can trigger information disclosure and instability; there is no public exploit identified at time of analysis and EPSS is very low (0.17%, 6th percentile).

Use-after-free in the Linux kernel's Qualcomm MSM Display Processing Unit (DPU) DRM driver arises because dpu_writeback_init() mixes device-managed (devm_) and DRM-managed (drmm_) allocation lifetimes. On driver teardown, the writeback connector's data is freed via devm while userspace still holds a reference to the drm device and can interact with the drmm-backed connector, creating a dangling pointer a local user can exploit. Rated CVSS 7.8 (local, low-privilege); EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis.

Memory-safety off-by-one in the Linux kernel's TLS (kTLS) data path miscounts scatterlist entries when an sk_msg scatterlist ring wraps (sg.end < sg.start), causing tls_push_record() to place the sg_chain() continuation pointer at data[MAX_SKB_FRAGS] instead of the true last entry. On affected 5.5-through-7.x stable kernels this can corrupt or misdirect the scatterlist handed to the crypto API during TLS record transmission, with the potential for information disclosure (as tagged) or a crash. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the issue is not in CISA KEV.

Malformed scatterlist chaining in the Linux kernel TLS (kTLS) plaintext send path can hand illegal 'chain-after-chain' input to the crypto subsystem when the ring's end index is 0 while start is non-zero, because the sg_next iterator does not recursively resolve consecutive chain links. This affects the kernel's in-kernel TLS offload used by processes with TLS sockets, and is tagged as an information-disclosure issue. It is not in CISA KEV and no public exploit has been identified; EPSS is low at 0.18% (7th percentile), and a fix is available across multiple stable kernel branches.

Improper resource validation in the Linux kernel's vfio/pci DMABUF export path (vfio/pci) allows a local user holding a VFIO device file descriptor to export and access PCI BAR (MMIO) resources that were never successfully reserved, enabling disclosure of adjacent device memory. The flaw stems from the DMABUF-creation path exporting BAR access without first confirming the resources were reserved at startup. There is no public exploit identified at time of analysis, EPSS is low (0.19%), and it is not listed in CISA KEV; the fix has been merged upstream.

Information disclosure and denial-of-service in the Linux kernel's drm/msm display snapshot subsystem allows a local low-privileged user to read out-of-bounds register data and trigger a 16x memory overallocation during device state dumps. The flaw stems from the snapshot code force-aligning data segments to 16 bytes, which mishandles unaligned regions such as the 4-byte-shifted DSI data, causing inaccurate register reads. No public exploit identified at time of analysis; EPSS probability is low (0.21%), and it is not listed in CISA KEV.

TX-completion memory mishandling in the Linux kernel's Intel igc (I225/I226 2.5GbE) driver stems from igc_fpe_init_smd_frame() failing to set the tx-buffer type on SMD (Frame Preemption) frames, so a reused igc_tx_buffer can retain a stale XDP or XSK type and be freed through the wrong cleanup path. This affects local systems running an igc NIC with Frame Preemption active, and the realistic impact is memory corruption or a driver crash rather than remote compromise. No public exploit identified at time of analysis; EPSS is very low (0.17%, 6th percentile) and it is not in CISA KEV, despite the NVD-assigned 9.8 CVSS.

Use-after-free in the Linux kernel's RDMA/rtrs (RDMA Transport) server module allows corruption of freed memory during the error-cleanup path of rtrs_srv_create_path_files(). When sysfs path-file creation partially fails, cleanup calls kobject_put() (which can free srv_path via the rtrs_srv_release callback) before rtrs_srv_destroy_once_sysfs_root_folders() dereferences that now-freed structure. Reported upstream by Linux/kernel maintainers with a vendor patch available; there is no public exploit identified and EPSS exploitation probability is low (0.17%, 7th percentile), consistent with a hard-to-reach error path in a niche subsystem rather than a broadly weaponizable flaw.

Use-after-free in the Linux kernel's bridge multicast (br_multicast) subsystem lets a local user with network-configuration capability crash the host or potentially execute code by toggling global multicast snooping while per-VLAN multicast snooping is enabled on a VLAN-filtering bridge. The flawed logic can leave both per-port and per-{port, VLAN} multicast contexts active simultaneously, so a per-port context (including its query timer) survives after the bridge port is freed, yielding a UAF confirmed by kernel debug tooling (ODEBUG free-active). No public exploit has been identified and EPSS is low (0.17%), but a deterministic reproducer is included in the fix, and the CVSS is 7.8 (High).

Local privilege escalation / memory-corruption potential in the Linux kernel's EROFS filesystem arises from a managed-cache race condition affecting unaligned compressed extents. When two threads process the same Z_EROFS_PREALLOCATED_FOLIO for different pclusters, one thread can call filemap_add_folio() a second time on a folio whose private state was not yet cleared, corrupting the managed page cache. Rated CVSS 7.8 (AV:L), it affects EROFS images built with unaligned data compression (e.g. -E48bit with zstd); EPSS is low (0.17%, 6th percentile), it is not in CISA KEV, and no public exploit identified at time of analysis.

Local privilege-escalation-capable memory corruption in the Linux kernel's ALSA sequencer UMP (MIDI 2.0) client code allows a local user with access to the sound sequencer to trigger a use-after-free. seq_ump_process_event() borrows client->out_rfile.output without synchronizing against the ALSA sequencer output open/close transitions, so a last-close can free the rawmidi substream and its runtime while an in-flight event_input callback is still executing snd_rawmidi_kernel_write(). The race is confirmed reproducible under KASAN as a slab-use-after-free, but there is no public exploit identified at time of analysis and EPSS risk is low (0.17%, 6th percentile).

Use-after-free in the Linux kernel's net shaper subsystem allows a local, low-privileged attacker to trigger memory corruption via a race condition in the network shaper API's XArray-based entry tracking. Because XArray 'VALID' marks are not stored atomically with their entries, a reader can observe a VALID slot, be preempted while a writer replaces the entry, and then dereference a stale pointer that net_shaper_rollback() has already freed, enabling potential privilege escalation or information disclosure. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 6th percentile).

Local information disclosure and memory corruption in the Linux kernel's rxrpc (AF_RXRPC/AFS) subsystem allows a local user of an encrypted rxrpc socket to trigger pagecache corruption because DATA packets were decrypted in-place on shared sk_buffs while splice() referenced the same pages. This is a hardening follow-up to CVE-2026-43500, replacing in-place decryption with a per-call bounce buffer so recvmsg() copies clean data and the sk_buff is never mutated. No public exploit identified at time of analysis, EPSS is low (0.17%, 6th percentile), and it is not listed in CISA KEV, consistent with a niche kernel subsystem rather than a mass-exploitation target.

Use-after-free in the Linux kernel's BPF sockmap (skmsg) receive path arises when a socket is added to a BPF_SK_SKB_VERDICT sockmap before kernel TLS (kTLS) RX is configured, letting sk_psock_verdict_data_ready() drain the TCP receive queue that the TLS strparser believes it owns. The mismatch leaves the strparser's frag_list pointing at freed, psock-owned skbs, which tls_decrypt_sg() then walks, corrupting kernel memory. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis, but a kernel-space UAF with high confidentiality, integrity, and availability impact makes this a meaningful local privilege-escalation and denial-of-service risk on affected builds.

Predictable TCP Initial Sequence Number (ISN) generation in the Linux kernel's TCP stack (introduced in 6.10) stems from a stale per-CPU tcp_tw_isn value leaking between packets. A regression moved the TIME_WAIT-derived ISN from the per-skb control block to a per-CPU variable on the assumption it would always be consumed by the same packet; when that packet is instead dropped on any of several intermediate paths, the value persists and the next SYN handled on that CPU inherits a non-zero, potentially predictable ISN, weakening TCP connection integrity. NVD assigns CVSS 9.4, but EPSS is low at 0.17% (6th percentile), there is no public exploit identified at time of analysis, and it is not in CISA KEV.

Local privilege escalation and memory corruption in the Linux kernel GPIO aggregator driver (gpio-aggregator) arises from a use-after-free on the error-handling path, where `aggr->lookups->dev_id` is freed before the lookup entry is removed from the table. A concurrent thread calling `gpiod_find()` can then dereference the freed `dev_id` via `strcmp()` in `gpiod_match_lookup_table()`, yielding a UAF that a low-privileged local attacker could leverage for code execution or DoS. There is no public exploit identified at time of analysis, and EPSS is low (0.17%), consistent with a race-condition kernel bug requiring local access rather than a mass-exploitation candidate.

Memory (kmalloc) leak in the Linux kernel's nvme-pci driver allows exhaustion of kernel memory over time on hosts using NVMe peer-to-peer (P2P) DMA. Because P2P memory is never unmapped, the driver has no need to track it, yet the dma_vec allocation used for tracking was never freed on I/O completion, leaking on every affected request. The flaw affects kernel 6.17 and is fixed in stable; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%).

Local privilege-escalation-class memory corruption in the Linux kernel's blk-mq multi-queue block layer allows a local low-privileged user to trigger a use-after-free when submitting a bio: if the task sleeps after peeking a cached request but before popping it, the plug flush frees the cached_rqs, leaving a dangling pointer. The flaw affects mainline and multiple stable trees (6.1.x, 6.5.x, 6.6.x, 6.7) and carries CVSS 7.8 (high CIA impact). There is no public exploit identified at time of analysis, and the very low EPSS (0.15%, 5th percentile) reflects the difficulty of winning the required timing race rather than low structural severity.

Kernel use-after-free in ksmbd, the Linux in-kernel SMB3 server, occurs when a durable handle reconnect succeeds but smb2_open() then hits a later error path. The cleanup logic double-frees the same ksmbd_file (once via ksmbd_fd_put and again via the non-session-aware ksmbd_put_durable_fd), freeing the file object while its volatile-id entry remains published in the session table. This dangling entry can be reused, giving a remote SMB client a path to kernel memory corruption; it is not in CISA KEV and no public exploit identified at time of analysis, with EPSS at a low 0.17%.

Use-after-free in the Linux kernel keyring subsystem (security/keys) allows a local low-privileged user to read freed memory because find_key_to_update() calls assoc_array_find() without holding the RCU read lock, racing against assoc_array_gc() which frees nodes after an RCU grace period. The flaw is exercised specifically through the persistent-keyring path, which does not rely on the keyring semaphore that masks the issue for regular keys. No public exploit identified at time of analysis; EPSS probability is low (0.17%, 7th percentile) and it is not listed in CISA KEV.