Information Disclosure

Local privilege escalation and memory corruption in the Linux kernel GPIO aggregator driver (gpio-aggregator) arises from a use-after-free on the error-handling path, where `aggr->lookups->dev_id` is freed before the lookup entry is removed from the table. A concurrent thread calling `gpiod_find()` can then dereference the freed `dev_id` via `strcmp()` in `gpiod_match_lookup_table()`, yielding a UAF that a low-privileged local attacker could leverage for code execution or DoS. There is no public exploit identified at time of analysis, and EPSS is low (0.17%), consistent with a race-condition kernel bug requiring local access rather than a mass-exploitation candidate.

Memory (kmalloc) leak in the Linux kernel's nvme-pci driver allows exhaustion of kernel memory over time on hosts using NVMe peer-to-peer (P2P) DMA. Because P2P memory is never unmapped, the driver has no need to track it, yet the dma_vec allocation used for tracking was never freed on I/O completion, leaking on every affected request. The flaw affects kernel 6.17 and is fixed in stable; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%).

Local privilege-escalation-class memory corruption in the Linux kernel's blk-mq multi-queue block layer allows a local low-privileged user to trigger a use-after-free when submitting a bio: if the task sleeps after peeking a cached request but before popping it, the plug flush frees the cached_rqs, leaving a dangling pointer. The flaw affects mainline and multiple stable trees (6.1.x, 6.5.x, 6.6.x, 6.7) and carries CVSS 7.8 (high CIA impact). There is no public exploit identified at time of analysis, and the very low EPSS (0.15%, 5th percentile) reflects the difficulty of winning the required timing race rather than low structural severity.

Kernel use-after-free in ksmbd, the Linux in-kernel SMB3 server, occurs when a durable handle reconnect succeeds but smb2_open() then hits a later error path. The cleanup logic double-frees the same ksmbd_file (once via ksmbd_fd_put and again via the non-session-aware ksmbd_put_durable_fd), freeing the file object while its volatile-id entry remains published in the session table. This dangling entry can be reused, giving a remote SMB client a path to kernel memory corruption; it is not in CISA KEV and no public exploit identified at time of analysis, with EPSS at a low 0.17%.

Use-after-free in the Linux kernel keyring subsystem (security/keys) allows a local low-privileged user to read freed memory because find_key_to_update() calls assoc_array_find() without holding the RCU read lock, racing against assoc_array_gc() which frees nodes after an RCU grace period. The flaw is exercised specifically through the persistent-keyring path, which does not rely on the keyring semaphore that masks the issue for regular keys. No public exploit identified at time of analysis; EPSS probability is low (0.17%, 7th percentile) and it is not listed in CISA KEV.

Local privilege escalation risk arises from a use-after-free in the Linux kernel's NFC LLCP subsystem, where llcp_sock_release() unconditionally unlinks a socket from the local sockets list even when the socket is still in the connecting state and actually resides on the connecting list. A local user able to open NFC LLCP sockets can trigger memory corruption during socket release, with high confidentiality, integrity and availability impact per the CVSS 7.8 rating. No public exploit identified at time of analysis, and EPSS is low (0.18%), consistent with a local-only, hardware-gated attack surface.

Use-after-free in the Linux kernel NFC LLCP subsystem allows an adjacent attacker to corrupt kernel memory by racing a connection-complete (CC) packet against socket release in nfc_llcp_recv_cc(). Affected are kernels using the NFC Logical Link Control Protocol stack; successful exploitation of the race can yield kernel memory corruption leading to potential privilege escalation or denial of service. No public exploit identified at time of analysis, and EPSS probability is low (0.18%), consistent with a memory-safety race that is hard to trigger and requires NFC proximity.

Local privilege-scoped memory corruption in the Linux kernel's IPsec/xfrm subsystem allows a low-privileged user with network-configuration capability to trigger a massive out-of-bounds kernel write. The xfrm_state_mtu() helper computes an ESP MTU in unsigned modulo-2^32 arithmetic; by installing an IPv4 ESP tunnel SA with an oversized truncated auth key, a tiny interface MTU, and a large XFRMA_TFCPAD value, an attacker forces the result to underflow, and esp_output() later treats it as a negative signed length passed to memset() — producing a near-16 EB write of zeroes at the skb tail. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and the flaw is not in CISA KEV, but the ubiquity of the Linux kernel makes patching important.

Local privilege escalation via use-after-free in the Linux kernel accel/rocket driver (Rockchip NPU accelerator) allows an authenticated local user with access to the accel device node to dereference freed slab memory. The flaw stems from rocket_ioctl_create_bo() registering a GEM handle in the file IDR before fallible operations (sgt allocation, drm_mm insert, iommu_map); on failure the object is freed while the handle stays live, and any later PREP_BO/FINI_BO/SUBMIT ioctl triggers the UAF. No public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile).

Kernel memory corruption in the Linux netfilter SYNPROXY module (synproxy_tstamp_adjust) lets remote hosts trigger a use-after-free write against systems that deploy the SYNPROXY target for TCP SYN-flood mitigation. When processing a cloned or non-linear packet, skb_ensure_writable() reallocates and frees the old skb->head, but the code then writes the recomputed TCP checksum through a stale header pointer - landing in freed slab memory or leaving a wrong on-wire checksum. Rated CVSS 9.8 by the automated feed, but EPSS is only 0.18% (7th percentile), it is not in CISA KEV, and no public exploit identified at time of analysis.

Memory corruption in the Linux kernel's SMC (Shared Memory Communications) networking subsystem arises because smc_init() re-runs INIT_HLIST_HEAD() on the smc_v1/smc_v2 hashtables after they may already hold live hash entries, resetting the list heads and corrupting an in-use linked list. A local user able to trigger SMC socket activity during the vulnerable window can cause list corruption leading to high confidentiality, integrity, and availability impact per the CVSS 7.8 (AV:L) rating. This is not actively exploited - no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.18%.

Denial of service in the Linux kernel SCSI core allows a device removal process to hang when SCSI devices in a partially-removed state (SDEV_CANCEL) retain requeued requests that are never kicked. Because scsi_run_host_queues() relied on shost_for_each_device()/scsi_device_get(), which skips devices not in a runnable state, requests queued during host error recovery stayed stuck after recovery cleared. The fix broadens scsi_run_host_queues() to run queues for every device except those in SDEV_DEL or where a reference cannot be acquired. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile).

Use-after-free in the Linux kernel's IPv4 sysctl teardown path (ipv4_sysctl_exit_net) can corrupt kernel memory because net->ipv4.sysctl_local_reserved_ports is freed before unregister_net_sysctl_table(), leaving a window where threads accessing /proc/sys/net/ipv4/ip_local_reserved_ports reference freed memory. A local low-privileged attacker able to trigger network namespace teardown could leverage the dangling pointer for memory corruption, information disclosure, or potential privilege escalation. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the issue is not on CISA KEV, consistent with a fix delivered quietly through the kernel stable process.

Out-of-bounds kernel write in the Linux kernel's ethtool CMIS firmware-update path (cmis_fw_update_start_download) lets a malicious or malfunctioning pluggable transceiver module overflow a 112-byte stack/heap buffer by returning an oversized start_cmd_payload_size in its CDB FW Management Features reply. The value is used unchecked as a memcpy byte count, so any attacker able to present a crafted module-or corrupt its CDB response-can corrupt adjacent kernel memory. EPSS is very low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; the fix simply rejects payload sizes larger than the destination buffer.

Use-after-free in the Linux kernel IP tunnel path-MTU discovery code (iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6()) arises because ip_hdr()/ipv6_hdr() pointers were cached before an skb_cow() that can reallocate skb->head, leaving the code operating on freed memory when generating ICMP/ICMPv6 fragmentation-needed messages for tunnel traffic. On systems with IP tunnels configured, an attacker able to drive oversized traffic through the tunnel can trigger the freed-memory access, risking a kernel information leak (the issue is tagged Information Disclosure) or memory corruption/crash. No public exploit identified at time of analysis, EPSS probability is low (0.18%), and the fix is already merged across the stable trees.

Use-after-free in the Linux kernel's VXLAN tunnel driver (drivers/net/vxlan) arises because the transmit path caches the result of ip_hdr() into old_iph and reuses it after skb_tunnel_check_pmtu(), which may reallocate skb->head and invalidate that pointer. Affected are kernels from 5.9 through the fix commits (patched in 6.1.176, 6.6.143, 6.12.93, 5.15.210, 5.10.259, 6.18.35, 7.0.12 and 7.1) on hosts using VXLAN overlays; an attacker able to drive traffic through the tunnel can trigger memory corruption leading to information disclosure or a kernel crash. There is no public exploit identified at time of analysis and EPSS is low (0.18%, 7th percentile), so this is not currently associated with active exploitation despite the CVSS 9.8 rating.

Out-of-bounds memory access in the Linux kernel's IP tunnel path-MTU discovery code (iptunnel_pmtud_check_icmp) affects IPv4 tunnel interfaces where the function may run on packets whose skb transport header is unset, causing an ~65535-byte offset read past the linear buffer. Remote attackers can trigger this by sending crafted ICMP traffic to a tunnel endpoint, potentially leaking adjacent kernel memory or crashing the host (denial of service). This is a supplier-reported (Linux stable) fix with no public exploit identified at time of analysis and a low EPSS score of 0.18%.

Out-of-bounds heap write in the Linux kernel ethtool netlink coalesce interface allows a local privileged user (CAP_NET_ADMIN) to corrupt kernel memory beyond a 5-element IRQ moderation profile buffer, enabling privilege escalation, denial of service, or information disclosure. The flaw lives in ethnl_update_profile(), which trusts a fully user-controlled Netlink nest count while writing into a kmemdup()'d array sized at NET_DIM_PARAMS_NUM_PROFILES (5). This has been resolved upstream and is not known to be exploited; EPSS probability is low (0.17%, 6th percentile) and no public exploit has been identified at time of analysis.

Out-of-bounds read in the Linux kernel's ethtool module-EEPROM Netlink fallback path allows a local privileged user to read memory beyond the intended EEPROM buffer. The flaw lives in fallback_set_params(), which checks that the requested offset is below eeprom_len but never validates that offset + length also stays within bounds - a check the ioctl path (ethtool_get_any_eeprom()) has always enforced. A compounding issue is the use of plain kmalloc() instead of a zeroed allocation, so uninitialized kernel memory may be returned to the caller. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and it is not in CISA KEV.

Denial of service in the Linux kernel's net/handshake (TLS handshake) subsystem allows a CPU-local deadlock on hosts acting as NVMe-over-TCP (nvmet_tcp) targets with in-kernel TLS. The nvmet_tcp_state_change() socket callback runs in softirq/BH context and reaches handshake_req_cancel(), which took hn->hn_lock with a plain spin_lock(); if a process-context thread on the same CPU already holds hn_lock when the softirq fires, the lock attempt deadlocks and hangs the CPU. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not on CISA KEV, so this is a stability/availability hardening fix rather than an actively exploited threat.

Kernel memory corruption and resource leakage in the Linux net/handshake subsystem stems from reversed list_splice_init() arguments in handshake_net_exit(), so pending TLS/handshake requests are never drained when a network namespace is destroyed. Fixing the splice direction then exposes a list-corruption and use-after-free race between the namespace-exit drain path and a concurrent handshake_req_cancel() (e.g. sunrpc TLS timeout), which can free a socket-backed handshake_req while it is still linked on the drain list. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile), and the record is not in CISA KEV.

Use-after-free / NULL-pointer dereference in the Linux kernel zl3073x DPLL (digital phase-locked loop) driver allows a local attacker to crash the system or potentially corrupt kernel memory during DPLL device teardown. Introduced in kernel 6.18 and fixed in stable 7.0.12/7.1, the flaw stems from the change_work item being re-scheduled after cancel_work_sync(), causing the handler to dereference a freed or NULL dpll_dev pointer. No public exploit identified at time of analysis; EPSS probability is low (0.15%, 5th percentile) and it is not listed in CISA KEV.

Improper channel-identifier handling in the Linux kernel Bluetooth L2CAP stack lets an in-range peer forcibly tear down an established Enhanced Credit (ECRED) connection. Because l2cap_ecred_reconf_rsp() returns on success without clearing chan->ident, a remote peer that completed a reconfiguration can replay a failure response carrying the stale ident, causing the kernel to match and destroy the live channel with l2cap_chan_del(chan, ECONNRESET); the fix also hardens the failure path against a use-after-free. No public exploit is identified at time of analysis and EPSS risk is low (0.31%).

Denial-of-service and potential memory-corruption exposure in the Linux kernel Bluetooth stack (hci_sync) arises because hci_dev_close_sync() failed to set the HCI_CMD_DRAIN_WORKQUEUE flag during device close, allowing command timeouts to be queued while the hdev workqueue is being drained on the reset path. The fix, present in stable trees (6.12.93, 6.18.35, 7.0.12, 7.1), closes a race that a Bluetooth-adjacent attacker could trigger during controller reset. There is no public exploit identified at time of analysis, EPSS risk is low (0.20%), and it is not listed in CISA KEV.

Local privilege escalation and memory corruption in the Linux kernel SCTP subsystem stems from a race condition where sctp_wait_for_connect() fails to detect that an association was migrated to a new socket via SCTP_SOCKOPT_PEELOFF while the socket lock was released. An attacker with a local account and the ability to open SCTP sockets can race a connecting association against a peeloff getsockopt() call, causing the connect path to operate on asoc->base.sk under the wrong socket lock in sctp_datamsg_from_user(). This is a fixed upstream kernel bug (EUVD-2026-45744) with a vendor patch available; no public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.21% (11th percentile).

Local memory corruption in the Linux kernel's vsock/virtio transport (AF_VSOCK) arises from a reference-counting lifetime mismatch in the MSG_ZEROCOPY send path, affecting kernels from 6.7 onward. Because virtio_transport_send_pkt_info() reuses or allocates the zerocopy uarg before virtio_transport_alloc_skb() fills the skb, a rollback after a partial fixed-buffer vectored zerocopy attach frees an skb that is flagged SKBFL_MANAGED_FRAG_REFS but has no uarg, causing skb_release_data() to take the wrong unref path. The CVSS 7.8 rating reflects high confidentiality, integrity, and availability impact from local access; there is no public exploit identified at time of analysis and EPSS is low at 0.20%.

Kernel panic (denial of service) in the Linux kernel's mm/vmalloc subsystem occurs because __get_vm_area_node() calls BUG_ON(in_interrupt()), and in_interrupt() also returns true when bottom halves (softirqs) are merely disabled rather than in a genuine interrupt context. A legitimate network-bridge path (br_fdb_add_local under spin_lock_bh) reaches vmalloc while BH is disabled, tripping the BUG() and crashing the kernel. NVD scores this A:H (availability only) with no public exploit identified at time of analysis; EPSS is low at 0.19% (9th percentile) and it is not in CISA KEV.

Protection-mechanism bypass in the Linux kernel's memfd file-sealing subsystem lets a local low-privileged process hold writable mappings on a memfd while still applying SEAL_WRITE via the SEAL_EXEC path, defeating the immutability guarantee that consumers rely on. Because the implied SEAL_WRITE was set after the mapping_deny_writable() check rather than before, an attacker can hand a victim (e.g. a sandbox or loader) a memfd that reports as write-sealed yet remains arbitrarily modifiable. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and this is not on CISA KEV.

Memory corruption in the Linux kernel Bluetooth ISO (Isochronous Channels) subsystem allows an attacker within Bluetooth range to trigger a use-after-free on a socket structure via a race in iso_recv_frame(), where conn->sk is read under iso_conn_lock but dereferenced after the lock drops while a concurrent iso_sock_kill() frees the socket. Successful exploitation can corrupt kernel memory when accessing sk->sk_state and sock_queue_rcv_skb(), enabling denial of service and potentially privilege escalation or code execution in kernel context. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile).

Use-after-free in the Linux kernel Bluetooth HCI subsystem (hci_sync) lets a concurrent Bluetooth disconnect free an hci_conn object that hci_le_create_cis_sync() then reads via a stale pointer, producing a use-after-free read during Connected Isochronous Stream (CIS) setup. The affected code path handles LE isochronous channel creation, and the flawed cancellation logic (queuing work with data=NULL while dequeuing with data=conn) means the pending work item is never cancelled, leaving the race exploitable. There is no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is not in CISA KEV.

Improper vector-length capping in the Linux kernel's KVM arm64 SVE handling lets a nested (L2) guest under a VHE guest hypervisor access Scalable Vector Extension vector lengths beyond its configured limit. When a guest hypervisor updates ZCR_EL2 indirectly via the untrapped ZCR_EL1 accessor, KVM restores the raw value into the physical ZCR_EL2 without capping, breaking the vector-length confinement policy. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.19%, 9th percentile); a vendor fix is available via the stable git tree.

Improper handling of zero-length Port I/O (PIO) requests in the Linux kernel's KVM AMD SEV/SEV-ES support allows a malicious confidential-computing guest to reach a length-underflow path when the hypervisor sets up the GHCB software scratch area. No public exploit has been identified at time of analysis and it is not on CISA KEV, though a vendor (upstream) patch is available. Despite a headline CVSS of 9.3, EPSS is only 0.20% (10th percentile), and the fix itself is a defensive hardening that ignores len/count '0' PIO to prevent length underflow.

Out-of-bounds memory access in the Linux kernel's KVM AMD SEV-SNP subsystem allows a malicious or compromised confidential-computing guest to read or corrupt host hypervisor memory by supplying a Page State Change (PSC) request whose buffer pointer is not aligned to the start of the GHCB shared buffer. The flaw affects KVM hosts running SEV-SNP guests on kernels from 6.11 onward and carries a high CVSS of 9.3 (AV:L/S:C) reflecting a guest-to-host boundary crossing. EPSS is low (0.20%, 10th percentile), it is not on CISA KEV, and no public exploit has been identified at time of analysis; a vendor fix is available in the stable trees.

Time-of-check-to-time-of-use race condition in the Linux kernel's KVM AMD SEV code allows a malicious or misbehaving encrypted guest to corrupt the host's processing of Page State Change (PSC) requests by mutating the guest-accessible PSC buffer while KVM reads entries and indices from it. Because KVM read the buffer without READ_ONCE(), the compiler could reload values mid-processing, enabling a TOCTOU exploit path with a CVSS-rated scope-changed impact affecting the host beyond the guest. No public exploit has been identified at time of analysis, and the EPSS score is low (0.20%); the fix hardens the reads with READ_ONCE() to make the guest's writes irrelevant to already-validated values.

Local privilege escalation and memory corruption in the Linux kernel's Industrial I/O (IIO) buffer hardware-consumer subsystem stems from a use-after-free in the error-handling path of iio_hw_consumer_alloc(). When buffer allocation fails, the cleanup routine iterated the buffer list with the unsafe list_for_each_entry() macro while iio_buffer_put() could free the current buffer, causing the loop to dereference freed memory. CVSS is 7.8 (High) with local vector and low privileges; EPSS is low at 0.21% (11th percentile), and there is no public exploit identified at time of analysis, consistent with this being a defect reachable only in a rare allocation-failure path.

Memory corruption in the Linux kernel's BPF sockmap subsystem allows a local actor to produce an inconsistent scatterlist layout via bpf_msg_push_data(). When a BPF sk_msg program inserts data into a non-first scatterlist entry, the right-fragment offset is over-advanced by the message-global insertion point instead of the fragment-local delta (start - offset), corrupting the split-buffer layout and enabling information disclosure or further memory corruption. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%, 11th percentile), and it is not listed in CISA KEV.

Memory-corruption/stale-pointer flaw in the Linux kernel's IPv6 extension-header processing (net/ipv6/exthdrs.c) where the network-header pointer is not refreshed after ipv6_hop_jumbo() invokes pskb_trim_rcsum(), which can reallocate or relocate the socket buffer. Affects the IPv6 hop-by-hop jumbogram code path across a very broad range of kernel versions from 2.6.12 onward, and is reachable by remote attackers sending crafted IPv6 packets; NVD scores it CVSS 9.8 but EPSS is only 0.21% (11th percentile) and there is no public exploit identified at time of analysis. The upstream fix is merged and backported to stable trees (e.g., 6.6.143, 6.1.176, 6.12.93, 5.15.210, 5.10.259).

Out-of-bounds/stale-pointer read in the Linux kernel's IPv6 extension-header parser (net/ipv6/exthdrs.c) affects systems processing IPv6 Destination Options containing the Home Address Option (HAO). After ipv6_dest_hao() invokes pskb_expand_head() on a cloned skb - which can relocate the packet buffer - ip6_parse_tlv() continues using a stale cached network-header pointer, causing trailing padding/TLVs to be parsed from freed or moved memory. This is an information-disclosure/memory-safety defect (Linux CNA tag: Information Disclosure); there is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and it is not in CISA KEV.

Cross-tenant network traffic redirection in the Linux kernel's IPv6 Virtual Tunnel Interface (vti6) affects hosts running IPv6 VTI/IPsec tunnels, particularly multi-tenant container platforms. A local attacker with a user namespace can move a vti6 tunnel into their own netns via IFLA_NET_NS_FD and then issue SIOCCHGTUNNEL, exploiting an inconsistency where vti6_siocdevprivate() performs its collision lookup against dev_net(dev) while vti6_update() mutates the original creation netns hash, letting the attacker prepend their controlled device at the head of another tenant's hash bucket so that xfrm-matched packets are delivered through a device they control. It is reachable from an unprivileged user namespace and no public exploit has been identified at time of analysis; EPSS is low at 0.22%.

Local privilege-boundary memory corruption in the Linux kernel L2TP subsystem (net/l2tp) arises because l2tp_session_get_by_ifname() took its reference with a bare refcount_inc() instead of refcount_inc_not_zero(), letting an RCU reader acquire a session whose refcount already hit zero and dereference freed slab memory. Affected kernels include the 6.12.x and 6.18.x stable series (fixed in 6.12.93, 6.18.35, 7.0.12 and 7.1), and the flaw is a race between the IDR/RCU lookup and l2tp_session_free()->kfree_rcu() that is genuinely reachable on PREEMPT_RT builds. There is no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a hard-to-win local race rather than a widely weaponized bug.

Use-after-free memory corruption in the Linux kernel's IPv6 VTI (Virtual Tunnel Interface, vti6) tunnel driver allows a local attacker with access to unprivileged user namespaces to corrupt kernel memory and crash the host or potentially escalate. The flaw arises when a vti6 tunnel device is moved between network namespaces and then reconfigured; the driver tracks the wrong namespace, leaving a stale hash entry that cleanup_net() later dereferences as freed memory. No public exploit identified at time of analysis and EPSS probability is low (0.21%), but the cross-tenant reachability on container hosts makes it a meaningful risk in multi-tenant environments.

Cross-network-namespace information disclosure in the Linux kernel's XFRM/IPsec subsystem allows XFRM_MSG_MIGRATE (IKEv2 MOBIKE) notifications to leak between namespaces because xfrm_send_migrate() and pfkey_send_migrate() hardcode init_net for their multicast. An IKE daemon (e.g. strongSwan) listening on init_net's XFRMNLGRP_MIGRATE / pfkey BROADCAST_ALL groups receives migration events — including IPsec selectors and old/new endpoint addresses — that originated in other, isolated network namespaces. There is no public exploit identified at time of analysis and EPSS probability is low (0.21%); the fix is upstream in stable trees.

Improper TCP connection teardown in the Linux kernel netfilter conntrack subsystem lets remote attackers prematurely terminate active NAT/connection-tracked sessions by injecting an RST packet with an invalid sequence number after a SYN, without the state machine verifying packet direction. The flaw affects the nf_conntrack TCP state machine across numerous stable kernel branches and primarily threatens availability of tracked connections. EPSS is low (0.23%, 13th percentile) and there is no public exploit identified at time of analysis; a vendor patch is available across multiple stable trees.

Out-of-bounds memory access in the Linux kernel IPsec ESP output path (xfrm/esp) occurs when the out-of-place fast path appends the ESP trailer in esp_output_head() but the head-side length gate checks skb->data_len and tailen separately, while esp_output_tail() later allocates a single destination page fragment from the combined post-trailer skb->data_len. When the combined aligned length exceeds one page, skb_page_frag_refill() may return a single page while the destination scatterlist still spans the larger combined length, producing a scatter-gather over-read/over-write. Affected are kernels using ESP transforms for both IPv4 and IPv6; the fix restores the combined-length page gate. No public exploit is identified at time of analysis and EPSS risk is low (0.21%, 11th percentile).

Local privilege escalation and memory corruption in the Linux kernel's XFRM IP-TFS (IPTFS) tunnel subsystem (introduced in 6.14) arises because iptfs_clone_state() shallow-copies runtime state via kmemdup() during IPsec SA cloning. If xfrm_state_migrate() fails after the clone but before re-initialization, the garbage collector can free skbs still owned by the original SA queue, yielding use-after-free and double-free. A local low-privileged actor able to drive IPsec SA migration on an IPTFS-configured tunnel can trigger the flaw; there is no public exploit identified at time of analysis and EPSS is low (0.20%).

Local privilege-boundary memory corruption in the Linux kernel dma-buf subsystem allows a local user to trigger a slab-use-after-free via a race in the dma_buf_fd() tracepoint (DMA_BUF_TRACE). After the FD_ADD() conversion, a thread sharing the file descriptor table can close() the freshly installed dma-buf fd before the tracepoint dereferences dmabuf->name_lock, freeing the object under the trace. Fixed in stable 7.0.12 and 7.1; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.19%.

Memory corruption in the Linux kernel's USB MUSB OMAP2430 glue driver (drivers/usb/musb/omap2430.c) stems from a use-after-free in omap2430_probe(), where of_node_put() releases the device-tree node reference before the node is last accessed. On affected TI OMAP2430-class platforms an attacker able to influence driver probe (device bind/unbind, hotplug, or device-tree handling) could trigger access to freed kernel memory, potentially corrupting kernel state. EPSS is low (0.21%, 11th percentile) and there is no public exploit identified at time of analysis; the fix is merged upstream across multiple stable branches.

Local privilege-boundary memory corruption in the Linux kernel USB gadget FunctionFS (f_fs) driver lets a process with access to the FunctionFS control node trigger a use-after-free by racing a DMABUF request completion against a FUNCTIONFS_DMABUF_DETACH ioctl or the file-close path. The completion frees the usb_request but leaves the priv->req back-pointer dangling, so the cancel path passes freed memory to usb_ep_dequeue(), corrupting kernel memory on SG-capable UDCs (chipidea, cdnsp) that dereference the request immediately. EPSS is low (0.20%, 10th percentile) and there is no public exploit identified at time of analysis; a vendor patch is available across stable trees.

Out-of-bounds kernel memory read in the Linux kernel Thunderbolt (thunderbolt) driver's XDomain property parser lets a malicious directly-connected Thunderbolt/USB4 peer leak kernel memory contents. The flaw stems from a u32 integer wrap in tb_property_entry_valid(), where a crafted property entry (value=0xffffff00, length=0x100) wraps the bounds check and causes tb_property_parse() to read attacker-directed memory far past the property block allocation; leaked bytes for TEXT-typed 'deviceid'/'vendorid' keys become readable via the per-XDomain device_name/vendor_name sysfs attributes. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, and EPSS is low (0.21%), consistent with a physical-access adjacent-only information-disclosure bug.

Local privilege escalation potential in the Linux kernel's DRM/GEM (Direct Rendering Manager Graphics Execution Manager) subsystem stems from a use-after-free triggered by a race in the drm_gem_change_handle_ioctl path. A local user with access to a DRM device node can race a GEM_CLOSE against a handle-change operation to drop a GEM object's reference count to zero and free it while another handle's IDR entry still points at it, yielding a dangling kernel pointer. No public exploit has been identified at time of analysis and it is not in CISA KEV; EPSS is low (0.20%, 10th percentile), consistent with a local-only race that is non-trivial to weaponize.

Local privilege escalation or denial of service in the Linux kernel's Intel i915 GPU driver stems from a use-after-free in the TTM object purge path (i915_ttm_purge), where the bo->ttm page-vector container can be replaced by ttm_bo_validate() during eviction, leaving a stale i915_tt pointer that is later dereferenced. A user on DG2 (Intel Arc/discrete) hardware reproduced this as a general protection fault under heavy GPU load during buffer-object eviction. There is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS (0.21%), but the CVSS 7.8 local vector reflects high confidentiality, integrity, and availability impact if the freed memory is groomed and reclaimed.

Information disclosure and buffer corruption in the Linux kernel's Qualcomm GENI serial driver (qcom_geni) allows leakage of stale TX buffer contents over the UART line when uart_flush_buffer() races a pending DMA-completion IRQ. On affected builds (6.3 through the fixed stable releases), a kfifo underflow drives kfifo->out past kfifo->in, so a subsequent start_tx_dma() transmits residual/stale buffer data rather than intended output. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the flaw is local-only and timing-dependent.

Local privilege escalation and memory corruption in the Linux kernel's AMD GPU (amdgpu) DRM driver arises from a race condition in amdgpu_hmm_range_get_pages, where the MMU notifier sequence was read more than once, allowing the driver to operate on stale or invalid page mappings. A local low-privileged user with GPU device access can exploit the timing window to disclose kernel memory or corrupt memory, matching the CVSS 7.8 high/high/high impact profile. There is no public exploit identified at time of analysis, and the EPSS score is low (0.20%, 10th percentile), consistent with a hard-to-time local race rather than a broadly weaponized flaw.

Stale TLB walk-cache entries in the Linux kernel on arm64 arise because huge_pmd_unshare() marks tlb->unshared_tables=true, but the aarch64 tlb_flush() logic only inspected tlb->freed_tables when deciding between a full invalidation (vae1is) and a leaf-only one (vale1is). As a result, unsharing a hugetlb PMD table leaves the obsolete PMD entry in the walk cache, allowing the MMU to perform incorrect page-table walks against freed/reassigned page-table memory - a potential path to information disclosure or memory corruption on affected 64-bit ARM systems. This is a config/architecture-specific kernel bug with no public exploit identified at time of analysis and a low EPSS (0.21%), and it is not listed in CISA KEV.

Denial of service and possible memory disclosure in the Linux kernel's MCTP-over-USB transport driver (net/mctp/usb) stems from a race between USB request block (urb) completion and cancellation of the rx_retry work during interface teardown. When the interface is brought down concurrently with an in-flight retry, a urb can remain queued and re-schedule already-cancelled work, leading to use-after-free-style memory corruption. This affects Linux 6.15 through the fixed stable releases; there is no public exploit identified at time of analysis, EPSS is low (0.15%, 5th percentile), and the flaw is not in CISA KEV.

Denial of service in the Linux kernel IPsec ESP stack (esp4/esp6) arises from a page fragment reference leak in esp_output_tail() when out-of-place crypto processing is used and the second skb_to_sgvec() call fails. On this error path the code jumps to error_free, freeing only the temporary scatterlist and the newly allocated page while leaking the original skb frag page references, allowing repeated failures to exhaust memory. No public exploit identified at time of analysis; EPSS is 0.14% (4th percentile), consistent with a low-likelihood, availability-only kernel bug fixed upstream in stable commits.

Use of uninitialized kernel memory in the Linux kernel's IEEE 802.15.4 6LoWPAN transmit path (lowpan_xmit) allows a local attacker to leak or corrupt kernel memory when a non-IPv6 packet (e.g., an ETH_P_AOE frame from the aoe driver) is queued on a 6LoWPAN interface. Because the 6LoWPAN header_create path skips initialization for non-IPv6 traffic, lowpan_xmit unconditionally reads a stale lowpan_addr_info structure from the skb headroom, yielding information disclosure and potential instability (tagged Information Disclosure). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV.

Availability degradation in the Linux kernel's MPTCP (Multipath TCP) subsystem allows remote peers to trigger connection-level inconsistencies through a time-of-check-to-time-of-use (TOCTOU) race in the transmit path. The MPTCP output code reads the connection-level ack_seq locklessly and multiple times per packet, so the data_ack value placed in the DSS option can diverge from the value used to compute the announced receive window, confusing the remote peer and destabilizing the multipath connection. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and the flaw is not in CISA KEV.

Memory-safety defect in the Linux kernel's MediaTek mt76/mt7996 Wi-Fi driver leaves a stale WCID (wireless client ID) pointer behind when a station link is torn down in mt7996_mac_sta_deinit_link(), creating a dangling reference that can be dereferenced after the underlying station object is freed. The fix, released in stable kernels, explicitly clears the WCID pointer during link deinitialization. The NVD-assigned CVSS of 8.8 (AV:A) rates this high, though no public exploit has been identified and EPSS exploitation probability is very low (0.15%, 5th percentile).

Denial-of-service / kernel-stability defect in the Linux kernel BPF LSM subsystem allows a privileged BPF program author to attach sleepable LSM programs to the bpf_lsm_task_to_inode() and bpf_lsm_inet_conn_established() hooks, which execute in atomic contexts (under rcu_read_lock() and in softirq respectively) where sleeping is illegal. The upstream fix removes these two hooks from the sleepable-eligible set; there is no public exploit identified at time of analysis, EPSS is very low (0.16%, 6th percentile), and it is not in CISA KEV. Despite an NVD CVSS of 8.8 the real-world risk is modest because triggering requires local privilege to load BPF LSM programs.

Memory-safety corruption in the Linux kernel eBPF verifier (fixed in 6.19 / stable 7.0.10 / 7.1) arises because visit_tailcall_insn(), added by commit e40f5a6bf88a to correct stack liveness for tail calls, discards its return value so verifier errors are never propagated. An attacker able to load a crafted BPF program can cause the verifier to accept an invalid program, leading to high-impact confidentiality, integrity, and availability compromise (CVSS 8.4). This is tagged as Information Disclosure with no public exploit identified at time of analysis and a low EPSS of 0.14%.

Local denial of service in the Linux kernel's DRM GPU SVM helper (drm_gpusvm_helper) arises from an unbalanced notifier-lock release in drm_gpusvm_scan_mm(): an early jump to the err_free label reaches drm_gpusvm_notifier_unlock() before the matching lock is taken, tripping the kernel's 'bad unlock balance' detector. Affected recent kernels (7.0 series, fixed in 7.0.10 and 7.1) can hit this path during GPU shared-virtual-memory scanning, leading to lock-state corruption and likely a crash or hang. There is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile); the fix is upstream in the stable tree.

Out-of-bounds string handling in the Linux kernel RDMA subsystem (drivers/infiniband/core) allows a local actor with RDMA netlink access to trigger reads past the end of a supplied netlink attribute. The affected code declared configuration attributes as NLA_STRING and then passed them directly to strcmp()/%s formatting without guaranteeing a NUL terminator, so a crafted, unterminated attribute can cause the kernel to read adjacent memory, potentially leaking information or crashing the host. No public exploit identified at time of analysis; the fix simply switches the attributes to NLA_NUL_STRING to enforce termination.

Local privilege escalation and kernel-memory disclosure in the Linux kernel netfilter nf_tables subsystem arises from unsafe handling of basechain/flowtable hook deletions, where moving hooks off an RCU-protected hook_list during the transaction preparation phase races with concurrent netlink dump readers. A low-privileged local user with netfilter administration capability (typically CAP_NET_ADMIN, obtainable inside an unprivileged user namespace on many distros) can trigger the race to read or corrupt freed kernel memory. There is no public exploit identified at time of analysis, EPSS exploitation probability is low (0.14%, 4th percentile), and the issue is not in CISA KEV; the fix is available as upstream stable commits.

An uninitialized-memory read in the Airoha ethernet driver (airoha_dev_xmit) of the Linux kernel affects systems using MediaTek/Airoha EN7581-class networking SoCs, where the transmit loop reads a fragment address and length on its final iteration before that descriptor data is initialized. Although the read values are never consumed, the access itself is unsafe and can trigger a page fault, potentially crashing the kernel during packet transmission. EPSS is low (0.15%, 5th percentile), there is no public exploit identified at time of analysis, and it is not listed in CISA KEV. Note: the auto-assigned CVSS of 9.8 (AV:N/C:H/I:H/A:H) appears substantially inflated for what is a local transmit-path bug with availability-only impact.

Local privilege escalation and memory corruption in the Linux kernel's amdgpu VCN (Video Core Next) driver arises because VCN v2.0 encoder and decoder rings accept command-stream (CS) submissions carrying 64-bit user fence writes that the hardware does not actually support. A local user able to submit GPU work (via /dev/dri render nodes) can trigger the driver to perform unsupported fence writes, leading to high-impact confidentiality, integrity, and availability effects consistent with kernel memory corruption or information disclosure. There is no public exploit identified at time of analysis, EPSS is low (0.16%), and the issue is not on the CISA KEV list, so this is a locally-scoped hardening/correctness fix rather than a remotely exploitable emergency.

Local privilege escalation and memory corruption in the Linux kernel amdgpu driver stems from VCN (Video Core Next) v2.5 encoder/decoder rings accepting command-stream submissions that request 64-bit user fence writes, an operation the hardware does not support. A local user with render-node access to an AMD GPU can submit a crafted CS with a user fence, causing the kernel to write to an unsupported/attacker-influenced fence address. No public exploit is identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the flaw is not in CISA KEV.

Local privilege escalation and memory-corruption risk in the amdgpu driver's VCN (Video Core Next) v3.0 encoder/decoder rings allows an authenticated local user with GPU render-node access to submit command streams containing 64-bit user-fence writes that the hardware does not support, corrupting kernel memory. The fix marks these rings with no_user_fence so the kernel rejects any command submission carrying a user fence. This affects Linux kernels from 5.9 onward that ship the AMD VCN 3.0 support; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.16% (5th percentile).

Local privilege/impact flaw in the Linux kernel's amdgpu AMD GPU driver (VCN v4.0 video encode/decode rings) allowed userspace command submissions (CS) to include 64-bit user fences that the encoder/decoder ring hardware cannot correctly service. Before the fix, the driver accepted these submissions instead of rejecting them, so a local user with GPU render-node access could trigger unsupported fence writes with High confidentiality, integrity, and availability impact (CVSS 7.8). This is a fixed upstream stable-kernel issue tagged Information Disclosure; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.15%).

Local privilege-adjacent memory corruption in the Linux kernel's AMD GPU (amdgpu) VCN v4.0.3 driver arises because the video encode/decode rings accept command-stream submissions carrying 64-bit user fences that the hardware cannot honor. A local user with GPU/DRM access could submit crafted VCN jobs with user fences, leading to out-of-bounds fence writes and kernel memory corruption. No public exploit has been identified at the time of analysis, EPSS is low (0.16%, 5th percentile), and the flaw is not on the CISA KEV list; a vendor patch is available.

Local privilege escalation / memory corruption in the Linux kernel's AMD GPU driver (amdgpu VCN v4.0.5) allows an authenticated local user to submit command-stream (CS) requests carrying 64-bit user fences to VCN encoder/decoder rings that do not support them, corrupting kernel memory. The fix marks the affected rings with no_user_fence so the kernel rejects such submissions. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not on CISA KEV, but CVSS scores high impact (7.8) due to full C/I/A compromise from a local unprivileged-to-low-privileged vector.

Local privilege escalation and memory corruption in the Linux kernel's AMD GPU (amdgpu) VCN v5.0.0 driver arises because the video encode/decode rings do not support 64-bit user fence writes, yet command-stream (CS) submissions carrying user fences were accepted. A local user with render/DRI device access could submit crafted GPU jobs whose user-fence writes land outside the intended target, corrupting kernel-managed memory. The fix rejects such submissions by setting no_user_fence for the affected ring. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 6th percentile).

Local privilege/memory-safety flaw in the Linux kernel's amdgpu VCN (Video Core Next) v5.0.1 driver allows a local user with GPU render-node access to submit command-stream (CS) requests containing 64-bit user fences that the VCN encoder/decoder rings cannot handle, leading to high-impact corruption (CVSS 7.8, tagged Information Disclosure). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile). A vendor patch is available upstream in the kernel stable tree.

Local privilege-context memory corruption/information disclosure in the Linux kernel's AMD GPU (amdgpu) JPEG v2.0 driver arises because JPEG rings do not support 64-bit user fence writes, yet command-submission (CS) requests carrying user fences were accepted. A local authenticated user with GPU/DRM access could submit crafted jobs that trigger unsupported user-fence writes, leading to high confidentiality, integrity, and availability impact (CVSS 7.8). This is a resolved kernel bug with an upstream stable fix; no public exploit has been identified and EPSS exploitation probability is low (0.17%, 7th percentile).

Local privilege escalation potential in the Linux kernel's AMD GPU JPEG v2.5 driver (drm/amdgpu/jpeg) arises because JPEG rings do not support 64-bit user fence writes, yet command-submission (CS) requests carrying user fences were accepted rather than rejected. A local user with GPU access could submit crafted CS requests that trigger memory corruption impacting confidentiality, integrity, and availability. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.17%, 6th percentile), consistent with a hardware-gated local kernel driver bug rather than a mass-exploited flaw.

Local privilege escalation / memory-corruption risk in the Linux kernel's AMD GPU (amdgpu) JPEG v3.0 ring driver, where the ring was allowed to accept command-stream submissions containing 64-bit user fences that the JPEG hardware cannot actually write. The fix flags the JPEG v3.0 ring as no_user_fence and rejects such CS submissions, closing an unvalidated-write condition reachable by any local user with GPU device access. No public exploit identified at time of analysis; EPSS is low (0.17%) and this is not on CISA KEV.

Local memory-corruption/denial-of-service risk in the Linux kernel amdgpu JPEG v4.0 ring (drm/amdgpu/jpeg) arises because JPEG rings cannot perform 64-bit user-fence writes, yet command-stream (CS) submissions carrying user fences were accepted; the fix sets no_user_fence to reject them. A local user with access to the AMD GPU device can submit crafted CS jobs specifying a user fence, causing the ring to attempt a fence write it does not support. No public exploit has been identified and EPSS is low (0.17%, 7th percentile), but the CVSS 3.1 score is 7.8 with high confidentiality, integrity, and availability impact.

Local memory corruption in the Linux kernel's AMD GPU (amdgpu) JPEG v4.0.3 driver allows a user with GPU render-node access to escalate privileges or crash the system by submitting command-stream (CS) work with a 64-bit user fence, which the JPEG ring hardware cannot write correctly. The fix flags the ring with no_user_fence so the kernel rejects such submissions. EPSS is very low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis, so this is a hardening/robustness fix rather than an urgent externally-exploited threat.

Improper user-fence handling in the Linux kernel's AMDGPU JPEG v4.0.5 driver allows a local, low-privileged user to submit GPU command-stream (CS) jobs with 64-bit user fences to a JPEG ring that only supports narrower fence writes, potentially corrupting or disclosing kernel/GPU memory. The fix sets the no_user_fence flag so the driver rejects such CS submissions outright. Rated CVSS 7.8 (local), with no public exploit identified at time of analysis, a low EPSS of 0.17% (6th percentile), and no CISA KEV listing - this is a hardware-specific hardening fix rather than a broadly exploited flaw.

Local privilege escalation and memory corruption in the Linux kernel's amdgpu JPEG v5.0.0 driver allows a low-privileged local user with access to the GPU render node to submit command-stream (CS) requests carrying a 64-bit user fence that the JPEG ring cannot service, corrupting kernel/GPU-writable memory. The fix makes the driver set no_user_fence and reject such submissions. This is a CVSS 7.8 (AV:L) issue with a very low EPSS (0.17%, 6th percentile) and no public exploit identified at time of analysis; it is patched upstream.

Local privilege-adjacent memory corruption in the Linux kernel's AMD GPU JPEG engine (amdgpu driver, JPEG v5.0.1 ring) allows a local low-privileged user to submit command-stream (CS) submissions containing 64-bit user fences that the JPEG ring cannot service. Because the ring lacks support for user fence writes, accepting such submissions leads to high-impact confidentiality, integrity, and availability consequences (CVSS 7.8). No public exploit identified at time of analysis, and EPSS is very low (0.17%), consistent with a hardware-specific, locally-scoped GPU driver flaw rather than a mass-exploitation target.

Local privilege-adjacent memory corruption in the Linux kernel's AMD GPU (amdgpu) JPEG v5.3.0 driver arises because the ring did not set the no_user_fence flag, allowing command-stream (CS) submissions carrying 64-bit user fence writes that the JPEG ring cannot support. A local user with GPU/DRM device access can submit crafted CS with user fences, leading to undefined ring behavior and high impact on confidentiality, integrity, and availability. No public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%), but a vendor (upstream stable) patch is available.

Local privilege escalation in the Linux kernel NTFS3 filesystem driver allows an unprivileged user with a file on a writable ntfs3 mount to set the reserved $LXUID, $LXGID, $LXMOD and $LXDEV WSL-permission xattrs directly via setxattr(), planting root ownership and the S_ISUID bit on their own file so it executes with euid 0. The empty-prefix xattr handler failed to block userspace writes to these internal metadata names, which ntfs_get_wsl_perm() reloads into i_uid/i_gid/i_mode on inode reload. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and the issue is not on CISA KEV, but the outcome is full local root.

Memory corruption in the Linux kernel mt76 WiFi driver (mt7925 chipset support) occurs because mt76_sta_add reinitializes the wcid->poll_list even though mt7925_mac_sta_add has already published the wcid, corrupting the dev->sta_poll_list linked list during station association. The flaw manifests as list_add corruption (observed on kernel 7.1-rc4 with mt7925 hardware) reachable from the RX NAPI poll path when TX status frames are processed, typically leading to a kernel panic. This is a vendor-fixed Linux stable-tree issue with no public exploit identified at time of analysis and a low EPSS score (0.15%).

Improper page-cache modification in the Linux kernel's sk_msg (sockmap/BPF SK_MSG) subsystem allows an attacker who can attach SK_MSG BPF programs to expose externally-backed scatterlist pages as writable BPF ctx->data. Because the sg.copy ownership bitmap was not kept in sync when sk_msg entries are moved, split, shifted, or copied across transforms (BPF pull/push/pop, sk_msg_shift_left/right, sk_msg_xfer, and tls_split_open_record), a splice- or file-page-cache-backed entry could arrive at a new slot with a cleared copy bit and then be modified via BPF stores, corrupting the original page cache. There is no public exploit identified at time of analysis and the EPSS score is very low (0.16%), consistent with a subtle in-kernel logic bug rather than a widely-weaponized flaw.

Missing capability check in the Linux kernel's IPv4 GRE tunnel driver (ip_gre) lets a local user with CAP_NET_ADMIN in a device's network namespace reconfigure GRE/ERSPAN tunnels that actually live in a different namespace, crossing a namespace isolation boundary. The RTM_NEWLINK changelink path validated CAP_NET_ADMIN only against dev_net(dev) and never against the tunnel's own link netns (t->net), so an operator privileged in one container/netns could rewrite tunnels belonging to another. Patched upstream; EPSS is low (0.16%) and no public exploit is identified at time of analysis.

Local privilege-escalation-class memory corruption in the Linux kernel's AppArmor LSM affects the policy-replacement path (aa_replace_profiles) across a wide span of stable branches (5.10 through 7.1). During the rawdata deduplication loop, aa_get_profile_loaddata() performs an unconditional kref_get() on struct aa_loaddata entries whose pcount has already dropped to zero but which remain briefly on ns->rawdata_list before the deferred do_ploaddata_rmfs() workqueue frees them, producing a refcount 'addition on 0' use-after-free. Exploitation requires local access with the ability to load AppArmor policy and winning a narrow race; there is no public exploit identified at time of analysis and EPSS risk is low (0.16%, 6th percentile).

Local privilege escalation via a use-after-free in the Linux kernel's key management (keys) subsystem allows an unprivileged local user to corrupt kernel memory by racing a request_key() helper against KEYCTL_INSTANTIATE_IOV. The request_key_auth payload (rka) could be detached and freed by the key-request helper's completion path while a concurrent instantiate/reject operation was still dereferencing rka->target_key, yielding a UAF (CWE-416). It is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is low at 0.17% (6th percentile), and a vendor patch is available across multiple stable branches.

Local denial-of-service in the Linux kernel's f2fs filesystem lets an attacker who can mount a crafted f2fs image trigger a kernel panic (BUG_ON at fs/f2fs/file.c:845) during inode truncation. A corrupted inode containing a direct node whose footer reuses the inode's own ino/nid causes ADDRS_PER_PAGE to return an inode-sized address count (923), driving ofs_in_node into the out-of-bounds addr[923..1017] range and crashing the host. Discovered via syzkaller fuzzing; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile).

Local denial-of-service and out-of-bounds read in the Linux kernel F2FS filesystem allows an attacker who can mount a crafted image to panic the kernel via f2fs_recover_orphan_inodes(), which trusts an attacker-controlled orphan block entry_count. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK drives the recovery loop past the ino[] array, reading footer/adjacent data as inode numbers and tripping f2fs_bug_on(). No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not on CISA KEV.